feat(filter): receiver-side protect/risk engine for dest-only entries

- new bounded config-wire block (BLOCK_PROTECT_RULES) serializes the sender's
  compiled filter rules to the receiver (bounded count + 256 KiB patterns;
  strict action/sides validation)
- receiver evaluates protect/risk in the whole-tree extras walk and the
  per-directory delete plans, so a dest-only entry matching 'P' is kept like
  rsync; dry-run would-delete enumeration also honours it
- --filter flips to parity (115/11/31); per-dir merge receiver re-derivation
  remains the documented residual

src/shared/config.c

@@ -791,6 +791,8 @@ void config_delete(Config* config) {
   if (config->filters) {
     array_list_delete(config->filters);
   }
+  filter_rule_list_free(config->protect_rules);
+  config->protect_rules = NULL;
   /* A --delay-updates staging tree is transient receiver state: remove any
      leftovers on every exit path (success already emptied it). */
   if (config->delay_context)
@@ -1026,6 +1028,108 @@ static bool receive_basis_entries(int fd, Config* c, ConfigStringBudget* budget)
   return true;
 }
 
+/* Receiver-side delete-protection rules (protocol 2.28.0).  The sender compiles
+ * its command-line selection rules exactly as the scanner does and streams the
+ * result as one bounded, self-describing block (count + per-rule records); the
+ * receiver reconstructs a FilterRuleList for the --delete extras walk.  owner
+ * and pattern are charged through the shared ConfigStringBudget and the block
+ * additionally enforces MAX_FILTER_RULES / MAX_FILTER_BYTES. */
+static bool send_protect_entries(int fd, const Config* c) {
+  int count = c->filters ? c->filters->size : 0;
+  const char** texts = NULL;
+  if (count > 0) {
+    texts = malloc((size_t)count * sizeof(char*));
+    if (!texts)
+      return false;
+    for (int i = 0; i < count; i++)
+      texts[i] = (const char*)c->filters->items[i];
+  }
+  char err[160];
+  FilterRuleList* rules =
+      filter_base_build(texts, count, c->cvs_exclude, c->delete_excluded, err, sizeof(err));
+  free(texts);
+  if (!rules) {
+    log_message(LOG_LEVEL_ERROR, "invalid filter rule: %s", err);
+    return false;
+  }
+  bool ok = send_int(fd, rules->count);
+  for (int i = 0; ok && i < rules->count; i++) {
+    const FilterRule* r = rules->items[i];
+    ok = send_int(fd, (int)r->action) && send_int(fd, (int)r->sides) &&
+         send_int(fd, r->anchored ? 1 : 0) && send_int(fd, r->dir_only ? 1 : 0) &&
+         send_int(fd, r->negate ? 1 : 0) && send_str(fd, r->owner ? r->owner : "") &&
+         send_str(fd, r->pattern ? r->pattern : "");
+  }
+  filter_rule_list_free(rules);
+  return ok;
+}
+
+static bool receive_protect_entries(int fd, Config* c, ConfigStringBudget* budget) {
+  int count;
+  if (!receive_int(fd, &count))
+    return false;
+  if (count < 0 || count > MAX_FILTER_RULES)
+    return false;
+  if (count == 0)
+    return true;
+  FilterRuleList* list = filter_rule_list_create();
+  if (!list)
+    return false;
+  size_t pattern_bytes = 0;
+  for (int i = 0; i < count; i++) {
+    int action;
+    int sides;
+    bool anchored;
+    bool dir_only;
+    bool negate;
+    if (!receive_int(fd, &action) ||
+        (action != FILTER_ACTION_EXCLUDE && action != FILTER_ACTION_INCLUDE) ||
+        !receive_int(fd, &sides) || sides < (int)FILTER_SIDE_SENDER ||
+        sides > (int)(FILTER_SIDE_SENDER | FILTER_SIDE_RECEIVER) ||
+        !receive_wire_bool(fd, &anchored) || !receive_wire_bool(fd, &dir_only) ||
+        !receive_wire_bool(fd, &negate))
+      goto fail;
+    char* owner = config_receive_str(fd, budget);
+    if (!owner)
+      goto fail;
+    char* pattern = config_receive_str(fd, budget);
+    if (!pattern || pattern[0] == '\0') {
+      free(owner);
+      free(pattern);
+      goto fail;
+    }
+    size_t bytes = strlen(owner) + strlen(pattern);
+    if (bytes > MAX_FILTER_BYTES - pattern_bytes) {
+      free(owner);
+      free(pattern);
+      goto fail;
+    }
+    pattern_bytes += bytes;
+    FilterRule* rule = calloc(1, sizeof(FilterRule));
+    if (!rule) {
+      free(owner);
+      free(pattern);
+      goto fail;
+    }
+    rule->action = (FilterAction)action;
+    rule->sides = (unsigned)sides;
+    rule->anchored = anchored;
+    rule->dir_only = dir_only;
+    rule->negate = negate;
+    rule->owner = owner;
+    rule->pattern = pattern;
+    if (!filter_rule_list_add(list, rule)) {
+      filter_rule_free(rule);
+      goto fail;
+    }
+  }
+  c->protect_rules = list;
+  return true;
+fail:
+  filter_rule_list_free(list);
+  return false;
+}
+
 static bool send_identity_entries(int fd, const IdentityMap* map, int count) {
   for (int i = 0; i < count; i++) {
     if (!send_int(fd, map[i].from) || !send_int(fd, map[i].from_hi) || !send_int(fd, map[i].to) ||
@@ -1153,6 +1257,9 @@ fail:
 #define CONFIG_RECV_BLOCK_IDMAP(name)                                                              \
   receive_identity_entries(fd, budget, c->name##_count, &c->name)
 
+#define CONFIG_SEND_BLOCK_PROTECT_RULES(name) send_protect_entries(fd, c)
+#define CONFIG_RECV_BLOCK_PROTECT_RULES(name) receive_protect_entries(fd, c, budget)
+
 /* One table entry, applied in sequence.  XSEND/XRECV are statement macros so
  * consecutive entries read as a plain sequence of assignments. */
 #define XSEND(name, ctype, def, kind) ok = ok && (CONFIG_SEND_##kind(name));
@@ -1190,6 +1297,7 @@ CONFIG_DEFINE_SEND(send_privilege_options, CONFIG_WIRE_PRIVILEGE_FIELDS)
 CONFIG_DEFINE_SEND(send_copy_as_options, CONFIG_WIRE_COPY_AS_FIELDS)
 CONFIG_DEFINE_SEND(send_output_options, CONFIG_WIRE_OUTPUT_FIELDS)
 CONFIG_DEFINE_SEND(send_codec_options, CONFIG_WIRE_CODEC_FIELDS)
+CONFIG_DEFINE_SEND(send_protect_options, CONFIG_WIRE_PROTECT_FIELDS)
 
 CONFIG_DEFINE_RECV(receive_core_fields, CONFIG_WIRE_CORE_FIELDS)
 CONFIG_DEFINE_RECV(receive_delta_fields, CONFIG_WIRE_DELTA_FIELDS)
@@ -1210,6 +1318,7 @@ CONFIG_DEFINE_RECV(receive_privilege_options, CONFIG_WIRE_PRIVILEGE_FIELDS)
 CONFIG_DEFINE_RECV(receive_copy_as_options, CONFIG_WIRE_COPY_AS_FIELDS)
 CONFIG_DEFINE_RECV(receive_output_options, CONFIG_WIRE_OUTPUT_FIELDS)
 CONFIG_DEFINE_RECV(receive_codec_options, CONFIG_WIRE_CODEC_FIELDS)
+CONFIG_DEFINE_RECV(receive_protect_options, CONFIG_WIRE_PROTECT_FIELDS)
 
 #undef XSEND
 #undef XRECV
@@ -1328,7 +1437,8 @@ bool config_send_wire_block(int file_descriptor, const Config* config) {
          send_privilege_options(file_descriptor, config) &&
          send_copy_as_options(file_descriptor, config) &&
          send_output_options(file_descriptor, config) &&
-         send_codec_options(file_descriptor, config);
+         send_codec_options(file_descriptor, config) &&
+         send_protect_options(file_descriptor, config);
 }
 
 bool config_send(int file_descriptor, const Config* config) {
@@ -1400,7 +1510,8 @@ Config* config_receive_with_validate(int file_descriptor, ConfigValidateFunc val
       !receive_privilege_options(file_descriptor, config, &budget) ||
       !receive_copy_as_options(file_descriptor, config, &budget) ||
       !receive_output_options(file_descriptor, config, &budget) ||
-      !receive_codec_options(file_descriptor, config, &budget))
+      !receive_codec_options(file_descriptor, config, &budget) ||
+      !receive_protect_options(file_descriptor, config, &budget))
     goto error;
   /* Validate/normalize the negotiated codec.  compress_choice is the human
    * spelling (NULL or "" when -z was not given); compression_algo is the

src/shared/config.h

@@ -4,6 +4,7 @@
 #include "array_list.h"
 #include "checksum.h"
 #include "compression.h"
+#include "filter.h"
 #include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
@@ -293,6 +294,20 @@ typedef enum SuperMode { SUPER_MODE_AUTO = 0, SUPER_MODE_ON = 1, SUPER_MODE_OFF
 #define CONFIG_WIRE_CODEC_FIELDS(X)                                                                \
   X(compression_algo, int, COMPRESSION_ALGO_ZSTD, INT_COMPRESSION_ALGO)
 
+/* Receiver-side delete-protection filter rules (protocol 2.28.0).  The sender
+ * compiles its root-level selection rules exactly as the scanner does
+ * (filter_base_build over --filter/-f/--exclude/--include/-C) and streams them
+ * as one self-describing, bounded block (count followed by per-rule records).
+ * The receiver reconstructs `protect_rules` and evaluates them against
+ * DESTINATION-ONLY entries during the --delete extras walk, so a
+ * `protect`/`P` rule protects an extra that never appeared on the sender
+ * (rsync re-derives deletion protection from the filter list; FastSync
+ * historically derived it only from the source scan).  `protect_rules` is NULL
+ * on the sender and is owned/freed by the receiver Config.  Bounded by
+ * MAX_FILTER_RULES and MAX_FILTER_BYTES; an unknown action/sides is a protocol
+ * error. */
+#define CONFIG_WIRE_PROTECT_FIELDS(X) X(protect_rules, FilterRuleList*, NULL, BLOCK_PROTECT_RULES)
+
 /* All serialized fields, in exact wire order.  Concatenating the per-segment
  * lists here is what keeps the declaration order = the wire order. */
 #define CONFIG_WIRE_FIELDS(X)                                                                      \
@@ -315,7 +330,8 @@ typedef enum SuperMode { SUPER_MODE_AUTO = 0, SUPER_MODE_ON = 1, SUPER_MODE_OFF
   CONFIG_WIRE_PRIVILEGE_FIELDS(X)                                                                  \
   CONFIG_WIRE_COPY_AS_FIELDS(X)                                                                    \
   CONFIG_WIRE_OUTPUT_FIELDS(X)                                                                     \
-  CONFIG_WIRE_CODEC_FIELDS(X)
+  CONFIG_WIRE_CODEC_FIELDS(X)                                                                      \
+  CONFIG_WIRE_PROTECT_FIELDS(X)
 
 typedef struct Config {
   /* -j/--threads=N: number of parallel scanner worker threads for the -m
@@ -1025,11 +1041,23 @@ typedef struct Config {
  * same-version handshake (config_receive rejects a mismatched version before
  * parsing anything else) keeps mixed deployments from ever reaching that
  * state. */
+/* (9) Receiver-side delete protection (still protocol 2.28.0): the config frame
+ * gains one trailing self-describing block carrying the sender's compiled base
+ * filter rules so the receiver can protect DESTINATION-ONLY entries from
+ * --delete with `protect`/`risk` rules (rsync parity).  The block appends after
+ * compression_algo; see CONFIG_WIRE_PROTECT_FIELDS. */
 #define PROTOCOL_VERSION "2.28.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 /* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */
 #define MAX_BASIS_DIRS 64
 
+/* Bounds on the received receiver-side delete-protection rule block.  The rule
+ * count and the aggregate pattern+owner bytes are each capped so a hostile
+ * peer cannot pin unbounded pre-auth memory; both are validated strictly on
+ * receive (alongside the per-string ConfigStringBudget). */
+#define MAX_FILTER_RULES 4096
+#define MAX_FILTER_BYTES (256 * 1024)
+
 /* Upper bound on the number of --skip-compress suffixes accepted from the wire.
  * Each suffix is an independent wire string (up to MAX_STRING_SIZE = 64 KiB), so
  * without this a hostile pre-auth client could otherwise retain

src/shared/delete_plan.c

@@ -546,12 +546,18 @@ static int open_plan_dir(const Config* config, const char* dir) {
 typedef struct PlanSkips {
   DeleteSkipEntry* entries;
   int count;
+  /* Receiver-side delete-protection rules received on the config frame (NULL
+     when the sender sent none).  Evaluated per extra so a protect/risk rule is
+     honored under --delete-during/--delete-delay exactly like the whole-tree
+     commit walker. */
+  const FilterRuleList* protect_rules;
 } PlanSkips;
 
 static bool build_plan_skips(const Config* config, const DeletePlanSession* session,
                              PlanSkips* out) {
   out->entries = NULL;
   out->count = 0;
+  out->protect_rules = config->protect_rules;
   int count = (config->delay_updates ? 1 : 0) + config->basis_count +
               session->protected_prefixes->size + session->size_skipped->size;
   if (count == 0)
@@ -733,6 +739,10 @@ static bool process_children(int dirfd, const char* dir_rel, const ArrayList* ke
     bool is_dir = S_ISDIR(st.st_mode);
     bool in_keep_dirs = is_dir && list_contains_str(keep_dirs, entry->d_name);
     bool in_keep_files = !is_dir && list_contains_str(keep_files, entry->d_name);
+    bool rule_protected =
+        skips->protect_rules &&
+        filter_rules_apply_side(skips->protect_rules, child_rel, entry->d_name, is_dir,
+                                FILTER_SIDE_RECEIVER) == FILTER_ACTION_PROTECT;
     if (in_keep_dirs) {
       local_survives = true;
     } else if (keep_dirs && !is_dir && list_contains_str(keep_dirs, entry->d_name)) {
@@ -750,11 +760,18 @@ static bool process_children(int dirfd, const char* dir_rel, const ArrayList* ke
       else if (!removed)
         local_survives = true;
     } else if (is_dir) {
-      bool removed = false;
-      if (!process_extra_dir(dirfd, entry->d_name, child_rel, force_now, skips, session, &removed))
-        operation_ok = false;
-      else if (!removed)
+      if (rule_protected) {
         local_survives = true;
+      } else {
+        bool removed = false;
+        if (!process_extra_dir(dirfd, entry->d_name, child_rel, force_now, skips, session,
+                               &removed))
+          operation_ok = false;
+        else if (!removed)
+          local_survives = true;
+      }
+    } else if (rule_protected) {
+      local_survives = true;
     } else {
       if (!process_extra_file(dirfd, entry->d_name, child_rel, force_now, session))
         operation_ok = false;

src/shared/file_receive.c

@@ -3328,7 +3328,7 @@ static bool delete_extras_budgeted_observed(const Config* config, DeleteManifest
   size_t skipped = 0;
   DeleteWalkResult result = delete_extras_limited_observed(
       config->receive_root_directory, manifest->keeps, manifest->dirs, remaining, skips, used,
-      &deleted, &skipped, observer, observer_context);
+      config->protect_rules, &deleted, &skipped, observer, observer_context);
   if (owned_prefixes) {
     for (int i = 0; i < config->basis_count; i++)
       free(owned_prefixes[i]);
@@ -3509,7 +3509,7 @@ static bool delete_missing_args_budgeted_observed(const Config* config, DeleteMa
           PrefixedDeleteObserver nested = {observer, observer_context, rel};
           DeleteWalkResult walk =
               no_keeps ? delete_extras_limited_observed(full, no_keeps, NULL, remaining, NULL, 0,
-                                                        &contents_deleted, &contents_skipped,
+                                                        NULL, &contents_deleted, &contents_skipped,
                                                         observer ? prefixed_delete_observer : NULL,
                                                         observer ? &nested : NULL)
                        : DELETE_WALK_ERROR;
@@ -3620,7 +3620,7 @@ bool manifest_would_delete_list(const Config* config, DeleteManifest* manifest,
     used = idx;
   }
   bool ok = delete_extras_list(config->receive_root_directory, manifest->keeps, manifest->dirs,
-                               skips, used, out, count_out);
+                               skips, used, config->protect_rules, out, count_out);
   if (owned_prefixes) {
     for (int i = 0; i < config->basis_count; i++)
       free(owned_prefixes[i]);

src/shared/filter.h

@@ -53,7 +53,7 @@ typedef struct {
   char* pattern;       /* cleaned glob pattern (no leading '/', no trailing '/') */
 } FilterRule;
 
-typedef struct {
+typedef struct FilterRuleList {
   FilterRule** items; /* owned array of rule pointers */
   int count;
   int capacity;

src/shared/utils.c

@@ -682,7 +682,8 @@ static bool is_synced_dir(const PathIndex* dirs, const char* rel) {
    like any other non-directory extra (never followed). */
 static bool delete_extras_fd(int dirfd, const char* rel_path, const PathIndex* keep,
                              const PathIndex* dirs, DeleteBudget* budget,
-                             const DeleteSkipEntry* skips, int skip_count, bool parent_deletable,
+                             const DeleteSkipEntry* skips, int skip_count,
+                             const FilterRuleList* protect_rules, bool parent_deletable,
                              bool* all_removed, DeletePathObserver observer,
                              void* observer_context) {
   /* openat(dirfd, ".") opens an independent file description: a dup() would
@@ -729,12 +730,23 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, const PathIndex* k
       free(child_rel);
       continue;
     }
-    if (S_ISDIR(st.st_mode)) {
+    bool is_dir = S_ISDIR(st.st_mode);
+    if (protect_rules && filter_rules_apply_side(protect_rules, child_rel, entry->d_name, is_dir,
+                                                 FILTER_SIDE_RECEIVER) == FILTER_ACTION_PROTECT) {
+      /* A first-match protect rule shields the extra; for a directory the whole
+         subtree is shielded (rsync prunes an excluded directory), so do not
+         descend. */
+      local_survives = true;
+      free(child_rel);
+      continue;
+    }
+    if (is_dir) {
       int childfd = openat(dirfd, entry->d_name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
       bool child_all_removed = false;
       if (childfd >= 0) {
-        if (!delete_extras_fd(childfd, child_rel, keep, dirs, budget, skips, skip_count, deletable,
-                              &child_all_removed, observer, observer_context))
+        if (!delete_extras_fd(childfd, child_rel, keep, dirs, budget, skips, skip_count,
+                              protect_rules, deletable, &child_all_removed, observer,
+                              observer_context))
           operation_ok = false;
         close(childfd);
       } else if (errno != ENOENT) {
@@ -802,7 +814,8 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, const PathIndex* k
    reportable children (depth-first), matching the delete pass's ordering. */
 static bool list_extras_fd(int dirfd, const char* rel_path, const PathIndex* keep,
                            const PathIndex* dirs, ArrayList* out, size_t* recorded,
-                           const DeleteSkipEntry* skips, int skip_count, bool parent_deletable,
+                           const DeleteSkipEntry* skips, int skip_count,
+                           const FilterRuleList* protect_rules, bool parent_deletable,
                            bool* all_removed) {
   int scanfd = openat(dirfd, ".", O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
   if (scanfd < 0)
@@ -836,12 +849,21 @@ static bool list_extras_fd(int dirfd, const char* rel_path, const PathIndex* kee
       free(child_rel);
       continue;
     }
-    if (S_ISDIR(st.st_mode)) {
+    bool is_dir = S_ISDIR(st.st_mode);
+    if (protect_rules && filter_rules_apply_side(protect_rules, child_rel, entry->d_name, is_dir,
+                                                 FILTER_SIDE_RECEIVER) == FILTER_ACTION_PROTECT) {
+      /* Mirror the delete walk: a protected entry is never reported as a
+         would-delete and a protected directory's subtree is not enumerated. */
+      local_survives = true;
+      free(child_rel);
+      continue;
+    }
+    if (is_dir) {
       int childfd = openat(dirfd, entry->d_name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
       bool child_all_removed = false;
       if (childfd >= 0) {
         if (!list_extras_fd(childfd, child_rel, keep, dirs, out, recorded, skips, skip_count,
-                            deletable, &child_all_removed))
+                            protect_rules, deletable, &child_all_removed))
           operation_ok = false;
         close(childfd);
       } else if (errno != ENOENT) {
@@ -892,7 +914,7 @@ static bool list_extras_fd(int dirfd, const char* rel_path, const PathIndex* kee
 
 bool delete_extras_list(const char* dest_root, const ArrayList* manifest,
                         const ArrayList* synced_dirs, const DeleteSkipEntry* skips, int skip_count,
-                        ArrayList* out, size_t* count_out) {
+                        const FilterRuleList* protect_rules, ArrayList* out, size_t* count_out) {
   if (count_out)
     *count_out = 0;
   if (!manifest || !out)
@@ -928,7 +950,7 @@ bool delete_extras_list(const char* dest_root, const ArrayList* manifest,
   bool all_removed = false;
   size_t recorded = 0;
   bool ok = list_extras_fd(rootfd, "", &keep, have_dirs ? &dirs : NULL, out, &recorded, skips,
-                           skip_count, false, &all_removed);
+                           skip_count, protect_rules, false, &all_removed);
   if (close(rootfd) != 0)
     ok = false;
   path_index_free(&keep);
@@ -942,6 +964,7 @@ bool delete_extras_list(const char* dest_root, const ArrayList* manifest,
 DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const ArrayList* manifest,
                                                 const ArrayList* synced_dirs, size_t max_delete,
                                                 const DeleteSkipEntry* skips, int skip_count,
+                                                const FilterRuleList* protect_rules,
                                                 size_t* deleted_out, size_t* skipped_out,
                                                 DeletePathObserver observer,
                                                 void* observer_context) {
@@ -984,8 +1007,9 @@ DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const Arr
   }
   DeleteBudget budget = {.max_delete = max_delete, .deleted = 0, .skipped = 0, .limit_hit = false};
   bool all_removed = false;
-  bool ok = delete_extras_fd(rootfd, "", &keep, have_dirs ? &dirs : NULL, &budget, skips,
-                             skip_count, false, &all_removed, observer, observer_context);
+  bool ok =
+      delete_extras_fd(rootfd, "", &keep, have_dirs ? &dirs : NULL, &budget, skips, skip_count,
+                       protect_rules, false, &all_removed, observer, observer_context);
   if (close(rootfd) != 0)
     ok = false;
   path_index_free(&keep);
@@ -1003,13 +1027,15 @@ DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const Arr
 DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
                                        const ArrayList* synced_dirs, size_t max_delete,
                                        const DeleteSkipEntry* skips, int skip_count,
-                                       size_t* deleted_out, size_t* skipped_out) {
+                                       const FilterRuleList* protect_rules, size_t* deleted_out,
+                                       size_t* skipped_out) {
   return delete_extras_limited_observed(dest_root, manifest, synced_dirs, max_delete, skips,
-                                        skip_count, deleted_out, skipped_out, NULL, NULL);
+                                        skip_count, protect_rules, deleted_out, skipped_out, NULL,
+                                        NULL);
 }
 
 bool delete_extras(const char* dest_root, const ArrayList* manifest) {
-  return delete_extras_limited(dest_root, manifest, NULL, SIZE_MAX, NULL, 0, NULL, NULL) ==
+  return delete_extras_limited(dest_root, manifest, NULL, SIZE_MAX, NULL, 0, NULL, NULL, NULL) ==
          DELETE_WALK_OK;
 }
 

src/shared/utils.h

@@ -2,6 +2,7 @@
 #define UTILS_H
 
 #include "array_list.h"
+#include "filter.h"
 #include <stddef.h>
 #include <stdbool.h>
 #include <stdio.h>
@@ -148,7 +149,8 @@ bool path_under_skip_prefix(const char* child_rel, bool at_root, const DeleteSki
 DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
                                        const ArrayList* synced_dirs, size_t max_delete,
                                        const DeleteSkipEntry* skips, int skip_count,
-                                       size_t* deleted_out, size_t* skipped_out);
+                                       const FilterRuleList* protect_rules, size_t* deleted_out,
+                                       size_t* skipped_out);
 
 /* Optional per-deletion observer: called for each destination-relative path
    actually removed (a file, symlink, or directory), in removal order, so the
@@ -156,10 +158,15 @@ DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* m
 typedef void (*DeletePathObserver)(void* context, const char* rel_path);
 
 /* `delete_extras_limited_observed` is delete_extras_limited with an optional
-   observer; the observer is invoked only for entries truly removed. */
+ * observer; the observer is invoked only for entries truly removed.  When
+ * `protect_rules` is non-NULL its receiver-side verdict is evaluated for every
+ * candidate extra: a first-match PROTECT leaves the entry (and, for a
+ * directory, its whole subtree) in place, while RISK/NONE fall through to the
+ * ordinary skip-prefix/keep-set logic. */
 DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const ArrayList* manifest,
                                                 const ArrayList* synced_dirs, size_t max_delete,
                                                 const DeleteSkipEntry* skips, int skip_count,
+                                                const FilterRuleList* protect_rules,
                                                 size_t* deleted_out, size_t* skipped_out,
                                                 DeletePathObserver observer,
                                                 void* observer_context);
@@ -170,7 +177,7 @@ DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const Arr
    strings appended to `out` and receives their count in *count_out. */
 bool delete_extras_list(const char* dest_root, const ArrayList* manifest,
                         const ArrayList* synced_dirs, const DeleteSkipEntry* skips, int skip_count,
-                        ArrayList* out, size_t* count_out);
+                        const FilterRuleList* protect_rules, ArrayList* out, size_t* count_out);
 bool delete_extras(const char* dest_root, const ArrayList* manifest);
 /* Open the existing destination directory at `dest_root`, confined to the
    authorized root with an O_NOFOLLOW component walk (the same confinement the