fix(delete): match rsync deletion semantics (#290)

- Scope the --delete extras walk to directories synchronized by the
  transfer: add a synchronized-directory section to the delete manifest
  (protocol 2.23.0) so --files-from subsets no longer delete untransmitted
  paths outside listed directory subtrees (data-loss fix).
- Separate --max-size/--min-size prune protection from --delete-excluded so
  size-pruned source mirrors survive (rsync parity).
- Unlink extraneous destination symlinks instead of skipping them.
- Make --max-delete partial (delete up to N, skip the rest) and exit 25;
  accept negative values as unlimited.
- Draw --delete-missing-args deletions from the shared --max-delete budget.
- Honor --force during --delay-updates publication.

Add unit and integration regression tests; update the pinned config wire
golden and version strings for the 2.23.0 manifest/status additions.

src/shared/config.h

@@ -849,8 +849,25 @@ typedef struct Config {
  * version before parsing anything else) is what keeps a 2.22 client and a 2.21
  * server from ever reaching that state.  The fixed-width FileMetadata layout is
  * UNCHANGED: the receiver still gates attribute application on use_metadata,
- * which is now DERIVED from these attributes by config_derived_use_metadata(). */
-#define PROTOCOL_VERSION "2.22.0"
+ * which is now DERIVED from these attributes by config_derived_use_metadata().
+ *
+ * Delete-Semantics Wave (#290): 2.22.0 -> 2.23.0.
+ *
+ * WHY the bump, grounded in the wire: the delete-manifest frame gains a fourth
+ * trailing section (protocol 2.23.0): a synchronized-directory count followed by
+ * that many destination-relative directory paths (the receive root is ".").
+ * The receiver confines its extras walk to these directories, so `--files-from`
+ * with `--delete` only removes inside listed directory subtrees (rsync parity)
+ * instead of deleting every untransmitted path under the receive root.  The
+ * frame stream also gains STATUS_DELETE_LIMIT, the terminal success status sent
+ * instead of STATUS_OK when a --max-delete commit removes up to the bound and
+ * skips the rest (the sender then exits 25 like rsync).  The config-frame LAYOUT
+ * is unchanged.  Any manifest/frame-sequence change must bump the protocol
+ * version: a 2.22 peer would desynchronize on the extra trailing section or the
+ * unknown status, and the strict same-version handshake (config_receive rejects
+ * a mismatched version before parsing anything else) is what keeps a 2.23 client
+ * and a 2.22 server from ever reaching that state. */
+#define PROTOCOL_VERSION "2.23.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 /* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */
 #define MAX_BASIS_DIRS 64

src/shared/delay_updates.c

@@ -264,6 +264,20 @@ static bool delay_publish_entry(DelayUpdatesContext* context, const Config* conf
                                 const StagedFileEntry* entry) {
   if (!delay_publish_backup(context, config, entry))
     return false;
+  /* --force: an incoming regular file/symlink may replace a destination
+     DIRECTORY (possibly non-empty).  The immediate-install path handles this in
+     file_receive; a --delay-updates run stages elsewhere and only discovers the
+     blocking directory here, so clear it before the rename (rsync's
+     "could not make way for new regular file" without --force). */
+  if (config && config->force_delete && file_directory_exists_secure(entry->final_path)) {
+    if (!file_remove_tree_secure(entry->final_path)) {
+      char* escaped = output_escape(entry->final_path, false);
+      log_message(LOG_LEVEL_ERROR, "could not remove destination directory blocking '%s': %s",
+                  escaped ? escaped : "<allocation failed>", strerror(errno));
+      free(escaped);
+      return false;
+    }
+  }
   if (!file_rename_secure(entry->staged_path, entry->final_path)) {
     if (errno == EXDEV) {
       char* escaped = output_escape(entry->final_path, false);

src/shared/file_list.c

@@ -240,3 +240,29 @@ bool file_list_affects(const FileListSet* set, const char* rel) {
      entry (binary search for the first entry at or after `rel` + '/'). */
   return path_index_has_descendant(&set->index, rel);
 }
+
+bool file_list_dir_in_scope(const FileListSet* set, const char* rel) {
+  if (!set || set->whole_tree)
+    return true;
+  if (!rel || rel[0] == '\0')
+    return false;
+  /* `rel` itself is listed, or one of its ancestor prefixes is an exact listed
+     directory (a listed prefix of a directory path is necessarily a
+     directory). */
+  size_t len = strlen(rel);
+  while (len > 0) {
+    const char* slash = NULL;
+    for (size_t i = len; i-- > 0;) {
+      if (rel[i] == '/') {
+        slash = rel + i;
+        break;
+      }
+    }
+    if (!slash)
+      break;
+    len = (size_t)(slash - rel);
+    if (path_index_contains_n(&set->index, rel, len))
+      return true;
+  }
+  return path_index_contains(&set->index, rel);
+}

src/shared/file_list.h

@@ -40,4 +40,14 @@ void file_list_destroy(FileListSet* set);
  * this returns true, files are transferred only when it returns true. */
 bool file_list_affects(const FileListSet* set, const char* rel);
 
+/* True when the DIRECTORY `rel` (path relative to the source root) is inside a
+ * listed directory subtree: `rel` itself is a listed entry, or one of `rel`'s
+ * ancestor directory prefixes is an exact listed entry.  Unlike
+ * file_list_affects this does NOT treat an ancestor of a listed entry as
+ * affected, so an implied parent directory of a listed file is not synchronized
+ * (rsync deletes nothing in it).  With no set or a whole-tree set every
+ * directory is in scope.  This is the delete-walker's "synchronized directory"
+ * predicate. */
+bool file_list_dir_in_scope(const FileListSet* set, const char* rel);
+
 #endif

src/shared/file_receive.c

@@ -2832,8 +2832,10 @@ File* file_receive_special(int file_descriptor) {
 /* Read a delete-manifest frame (the STATUS_MANIFEST leading code has already
    been consumed): a keep-set entry count followed by that many
    destination-relative paths, then a protected-prefix count followed by that
-   many destination-relative prefixes, then (protocol 2.10.0+) a missing-args
-   count followed by that many destination-relative delete paths.  The frame is
+   many destination-relative prefixes, then a missing-args count followed by that
+   many destination-relative delete paths, then (protocol 2.23.0) a
+   synchronized-directory count followed by that many destination-relative
+   directory paths (the receive root is the "." sentinel).  The frame is
    self-delimiting (the counts are authoritative), so the caller decides what to
    do next and continues reading the following STATUS_* frame.  Every section is
    validated identically: an entry must be non-empty, relative and traversal-free
@@ -2878,7 +2880,8 @@ DeleteManifest* receive_manifest_entries(int fd) {
   manifest->keeps = array_list_create(free);
   manifest->protected = array_list_create(free);
   manifest->missing = array_list_create(free);
-  if (!manifest->keeps || !manifest->protected || !manifest->missing) {
+  manifest->dirs = array_list_create(free);
+  if (!manifest->keeps || !manifest->protected || !manifest->missing || !manifest->dirs) {
     delete_manifest_free(manifest);
     send_status(fd, STATUS_ERROR);
     return NULL;
@@ -2887,7 +2890,8 @@ DeleteManifest* receive_manifest_entries(int fd) {
   size_t manifest_entries = 0;
   if (!receive_manifest_section(fd, manifest->keeps, &manifest_bytes, &manifest_entries) ||
       !receive_manifest_section(fd, manifest->protected, &manifest_bytes, &manifest_entries) ||
-      !receive_manifest_section(fd, manifest->missing, &manifest_bytes, &manifest_entries)) {
+      !receive_manifest_section(fd, manifest->missing, &manifest_bytes, &manifest_entries) ||
+      !receive_manifest_section(fd, manifest->dirs, &manifest_bytes, &manifest_entries)) {
     delete_manifest_free(manifest);
     return NULL;
   }
@@ -2900,18 +2904,33 @@ void delete_manifest_free(DeleteManifest* manifest) {
   array_list_delete(manifest->keeps);
   array_list_delete(manifest->protected);
   array_list_delete(manifest->missing);
+  array_list_delete(manifest->dirs);
   free(manifest);
 }
 
+/* Shared --max-delete budget for one receiver-side deletion commit.  Both the
+   --delete-missing-args exact-path removals and the ordinary extras walk draw
+   from the same tally, matching rsync (whose --max-delete counts every deleted
+   file or directory).  `max_delete` is SIZE_MAX for an unlimited budget. */
+typedef struct {
+  size_t max_delete;
+  size_t deleted;
+  size_t skipped;
+  bool limit_hit;
+} DeleteBudgetState;
+
 /* Remove every destination entry under the receive root that is not in the
-   keep-set, bounded by MAX_SERVER_DELETE_COUNT (or a smaller client
-   --max-delete=NUM, which is all-or-nothing), using the symlink-safe delete
-   walker.  With --delay-updates the not-yet-published staging directory is a
+   keep-set, bounded by the shared budget (a smaller client --max-delete=NUM
+   replaces the server hard bound; rsync deletes up to the bound and skips the
+   rest).  With --delay-updates the not-yet-published staging directory is a
    direct child of the receive root and must not be treated as a set of extras;
-   the manifest's protected prefixes (paths excluded on the source) and the
+   the manifest's protected prefixes (paths excluded on the source), the
+   size-pruned prefixes (--max-size/--min-size, always protected) and the
    alternate basis directories are never destination content and are skipped at
-   any depth.  Prints a notice and returns true on success. */
-bool manifest_delete_extras(const Config* config, DeleteManifest* manifest) {
+   any depth.  Returns true unless a traversal/unlink error aborted the walk;
+   the budget's limit_hit/skipped fields report a cap-stopped run. */
+static bool delete_extras_budgeted(const Config* config, DeleteManifest* manifest,
+                                   DeleteBudgetState* budget) {
   if (!config || !manifest || !manifest->keeps)
     return false;
   fprintf(stderr, "Deleting files not in manifest...\n");
@@ -2923,9 +2942,10 @@ bool manifest_delete_extras(const Config* config, DeleteManifest* manifest) {
        at any depth: they are extra comparison snapshots the user pointed at,
        not destination content, and deleting them would destroy the very files a
        --link-dest run just linked into place;
-     - the sender-side protected prefixes (source paths excluded by filters), at
-       any depth, so an excluded destination mirror survives --delete unless
-       --delete-excluded opts back into removing it. */
+     - the sender-side protected prefixes (source paths excluded by filters and
+       paths pruned by --max-size/--min-size), at any depth, so their destination
+       mirror survives --delete unless --delete-excluded opts back into removing
+       the filter-excluded ones (size-pruned entries are always protected). */
   int skip_count = (config->delay_updates ? 1 : 0) + config->basis_count +
                    (manifest->protected ? manifest->protected->size : 0);
   DeleteSkipEntry* skips = NULL;
@@ -2950,30 +2970,19 @@ bool manifest_delete_extras(const Config* config, DeleteManifest* manifest) {
       idx++;
     }
   }
-  /* A client --max-delete=NUM smaller than the server's hard bound replaces it
-     for this run; both still bound the walk.  The walker is all-or-nothing, so
-     a run that would delete more than the bound removes nothing and fails with
-     an error that names the bound that was hit. */
-  bool user_limited =
-      config->max_delete >= 0 && (size_t)config->max_delete < MAX_SERVER_DELETE_COUNT;
-  size_t cap = user_limited ? (size_t)config->max_delete : MAX_SERVER_DELETE_COUNT;
-  size_t deleted_count = 0;
-  DeleteWalkResult result = delete_extras_limited(config->receive_root_directory, manifest->keeps,
-                                                  cap, skips, skip_count, &deleted_count);
+  size_t remaining =
+      budget->max_delete == SIZE_MAX ? SIZE_MAX : budget->max_delete - budget->deleted;
+  size_t deleted = 0;
+  size_t skipped = 0;
+  DeleteWalkResult result =
+      delete_extras_limited(config->receive_root_directory, manifest->keeps, manifest->dirs,
+                            remaining, skips, skip_count, &deleted, &skipped);
   free(skips);
-  if (result == DELETE_WALK_LIMIT_EXCEEDED) {
-    if (user_limited) {
-      log_message(LOG_LEVEL_ERROR,
-                  "deletion stopped: the destination holds more than --max-delete=%d extraneous "
-                  "entries; no files were deleted",
-                  config->max_delete);
-    } else {
-      log_message(LOG_LEVEL_ERROR,
-                  "deletion stopped: the destination holds more than %u extraneous entries "
-                  "(server deletion limit); no files were deleted",
-                  (unsigned)MAX_SERVER_DELETE_COUNT);
-    }
-    return false;
+  budget->deleted += deleted;
+  budget->skipped += skipped;
+  if (result == DELETE_WALK_LIMIT_REACHED) {
+    budget->limit_hit = true;
+    return true;
   }
   if (result != DELETE_WALK_OK) {
     log_message(LOG_LEVEL_ERROR, "deletion failed while removing extraneous files");
@@ -2991,10 +3000,12 @@ bool manifest_delete_extras(const Config* config, DeleteManifest* manifest) {
    removed recursively only when --delete or --force is in effect (rsync parity:
    the man page says a non-empty directory mirror is only deleted with --force
    or --delete); otherwise it is left with a warning and the run continues.  A
-   mirror that does not exist is a no-op.  Returns false only on a genuine error
-   (a confinement failure on a validated path or an I/O error), which fails the
-   run. */
-bool manifest_delete_missing_args(const Config* config, DeleteManifest* manifest) {
+   mirror that does not exist is a no-op.  Each removal draws from the shared
+   --max-delete budget: once it is exhausted the remaining requests are skipped
+   and counted.  Returns false only on a genuine error (a confinement failure on
+   a validated path or an I/O error), which fails the run. */
+static bool delete_missing_args_budgeted(const Config* config, DeleteManifest* manifest,
+                                         DeleteBudgetState* budget) {
   if (!config || !manifest)
     return false;
   if (!manifest->missing || manifest->missing->size == 0)
@@ -3068,6 +3079,16 @@ bool manifest_delete_missing_args(const Config* config, DeleteManifest* manifest
       free(full);
       continue;
     }
+    /* An entry that exists is one deletion: skip it (and count it) when the
+       shared --max-delete budget is already exhausted. */
+    if (budget->deleted >= budget->max_delete) {
+      budget->limit_hit = true;
+      budget->skipped++;
+      close(parent_fd);
+      free(leaf);
+      free(full);
+      continue;
+    }
     bool removed = false;
     if (S_ISDIR(st.st_mode)) {
       if (unlinkat(parent_fd, leaf, AT_REMOVEDIR) == 0) {
@@ -3101,6 +3122,7 @@ bool manifest_delete_missing_args(const Config* config, DeleteManifest* manifest
       }
     }
     if (removed) {
+      budget->deleted++;
       char* escaped = output_escape(rel, log_get_8_bit_output());
       fprintf(stderr, "  Deleted: %s\n", escaped ? escaped : "<allocation failed>");
       free(escaped);
@@ -3116,24 +3138,58 @@ bool manifest_delete_missing_args(const Config* config, DeleteManifest* manifest
   return ok;
 }
 
+/* Public wrappers used outside the commit path (and by unit tests): no
+   --max-delete budget. */
+bool manifest_delete_extras(const Config* config, DeleteManifest* manifest) {
+  DeleteBudgetState budget = {
+      .max_delete = SIZE_MAX, .deleted = 0, .skipped = 0, .limit_hit = false};
+  return delete_extras_budgeted(config, manifest, &budget);
+}
+
+bool manifest_delete_missing_args(const Config* config, DeleteManifest* manifest) {
+  DeleteBudgetState budget = {
+      .max_delete = SIZE_MAX, .deleted = 0, .skipped = 0, .limit_hit = false};
+  return delete_missing_args_budgeted(config, manifest, &budget);
+}
+
 /* Commit every deletion family the manifest carries.  The --delete-missing-args
    exact-path deletions run FIRST: they are explicit user requests and must not
    be blocked by the extras walker's filter-exclusion protection (a protected
    leftover inside a missing-argument directory must not make that user-requested
    removal fail).  The ordinary extras walk then runs when --delete is active.
-   Returns true when there was nothing to do or every requested deletion
-   committed. */
-bool manifest_delete_all(const Config* config, DeleteManifest* manifest) {
+   Both draw from one --max-delete budget; the result reports a cap-stopped
+   (partial) commit distinctly so the client can exit 25 like rsync. */
+DeleteCommitResult manifest_delete_all(const Config* config, DeleteManifest* manifest) {
   if (!config || !manifest)
-    return false;
+    return DELETE_COMMIT_ERROR;
   /* Central no-mutation guard: a dry-run never deletes.  No manifest is sent on
      the dry-run path, but a hostile/buggy peer could; treat it as a no-op so
      the receiver can never remove anything. */
   if (config->dry_run)
-    return true;
-  if (config->delete_missing_args && !manifest_delete_missing_args(config, manifest))
-    return false;
-  if (config->use_delete && !manifest_delete_extras(config, manifest))
-    return false;
-  return true;
+    return DELETE_COMMIT_OK;
+  /* A client --max-delete=NUM smaller than the server's hard bound replaces it
+     for this run; both still bound the commit. */
+  bool user_limited =
+      config->max_delete >= 0 && (size_t)config->max_delete < MAX_SERVER_DELETE_COUNT;
+  DeleteBudgetState budget = {.max_delete = user_limited ? (size_t)config->max_delete
+                                                         : MAX_SERVER_DELETE_COUNT,
+                              .deleted = 0,
+                              .skipped = 0,
+                              .limit_hit = false};
+  if (config->delete_missing_args && !delete_missing_args_budgeted(config, manifest, &budget))
+    return DELETE_COMMIT_ERROR;
+  if (config->use_delete && !delete_extras_budgeted(config, manifest, &budget))
+    return DELETE_COMMIT_ERROR;
+  if (budget.limit_hit) {
+    if (user_limited) {
+      log_message(LOG_LEVEL_ERROR, "Deletions stopped due to --max-delete limit (%zu skipped)",
+                  budget.skipped);
+    } else {
+      log_message(LOG_LEVEL_ERROR,
+                  "Deletions stopped due to the server deletion limit of %u (%zu skipped)",
+                  (unsigned)MAX_SERVER_DELETE_COUNT, budget.skipped);
+    }
+    return DELETE_COMMIT_LIMIT_REACHED;
+  }
+  return DELETE_COMMIT_OK;
 }

src/shared/file_receive.h

@@ -85,11 +85,18 @@ typedef struct DeleteManifest {
   ArrayList* keeps;
   ArrayList* protected;
   ArrayList* missing;
+  /* Destination-relative paths of the directories the sender synchronized for
+     this run.  The extras walker only removes entries directly inside one of
+     these (the receive root is the "." sentinel); `--files-from` runs therefore
+     leave untransmitted directories and the unlisted parts of listed ones
+     alone, matching rsync's "delete only in synchronized directories". */
+  ArrayList* dirs;
 } DeleteManifest;
 
 void delete_manifest_free(DeleteManifest* manifest);
-/* Read a delete-manifest frame: keep count + keeps, then protected count +
-   protected prefixes, then missing count + missing paths (self-delimiting; the
+/* Read a delete-manifest frame (protocol 2.23.0): keep count + keeps, then
+   protected count + protected prefixes, then missing count + missing paths,
+   then synchronized-directory count + directory paths (self-delimiting; the
    leading STATUS_MANIFEST code has been consumed).  Returns an owned
    DeleteManifest, or NULL after signalling STATUS_ERROR on a malformed frame. */
 DeleteManifest* receive_manifest_entries(int fd);
@@ -108,11 +115,22 @@ bool manifest_delete_extras(const Config* config, DeleteManifest* manifest);
    confinement or I/O error (the run then fails); tolerated per-path cases are
    reported and skipped. */
 bool manifest_delete_missing_args(const Config* config, DeleteManifest* manifest);
+/* Outcome of committing a delete manifest.  LIMIT_REACHED reports rsync's
+   partial --max-delete result: the budget allowed some deletions and the rest
+   were skipped (the run still stores all file data but the client exits 25). */
+typedef enum {
+  DELETE_COMMIT_OK = 0,
+  DELETE_COMMIT_LIMIT_REACHED,
+  DELETE_COMMIT_ERROR
+} DeleteCommitResult;
+
 /* Run every deletion family the manifest carries: the --delete-missing-args
    exact-path deletions first (user requests are not blocked by exclusion
-   protection), then the ordinary extras walk when --delete is active.  Returns
-   true when nothing to do or everything committed. */
-bool manifest_delete_all(const Config* config, DeleteManifest* manifest);
+   protection), then the ordinary extras walk when --delete is active.  Both
+   share one --max-delete budget.  Returns DELETE_COMMIT_OK when nothing was to
+   do or everything committed, DELETE_COMMIT_LIMIT_REACHED when the budget
+   stopped part of the work, or DELETE_COMMIT_ERROR on a genuine failure. */
+DeleteCommitResult manifest_delete_all(const Config* config, DeleteManifest* manifest);
 
 /* Outcome of a single file_save_to_disk operation.  The receiver needs to
    distinguish "written" from "skipped" so --remove-source-files can be told

src/shared/multiprocessing.c

@@ -30,6 +30,8 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
   context->max_queue_bytes = 0;
   context->manifest = NULL;
   context->excluded_paths = NULL;
+  context->size_skipped_paths = NULL;
+  context->synced_dirs = NULL;
   context->missing_args = NULL;
   context->scan_had_io_error = false;
   context->remove_source_files = NULL;
@@ -44,6 +46,7 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
   protocol_session_set_max_alloc(&context->allocation_session, config->max_alloc);
   context->dir_entries = NULL;
   context->dir_entries_mutex_init = false;
+  context->delete_limit = false;
   int init = 0;
   if (config->use_metadata) {
     context->dir_entries = array_list_create(file_destroy);
@@ -186,6 +189,10 @@ void pipeline_context_sender_destroy(PipelineContextSender* context) {
   }
   if (context->excluded_paths)
     array_list_delete(context->excluded_paths);
+  if (context->size_skipped_paths)
+    array_list_delete(context->size_skipped_paths);
+  if (context->synced_dirs)
+    array_list_delete(context->synced_dirs);
   if (context->missing_args)
     array_list_delete(context->missing_args);
   if (context->remove_source_files)

src/shared/multiprocessing.h

@@ -42,6 +42,18 @@ typedef struct {
      scanner's exclusion sink) or, in the early modes, by the path-only pre-scan
      on the calling thread before the pipeline starts. */
   ArrayList* excluded_paths;
+  /* --max-size/--min-size pruned source paths.  These are ALWAYS sent as
+     protected prefixes (even with --delete-excluded), so the destination
+     mirrors of size-skipped files survive --delete like rsync.  Populated by
+     the scanner thread (workers append under mutex_scanner) or, in the early
+     modes, by the path-only pre-scan on the calling thread. */
+  ArrayList* size_skipped_paths;
+  /* Destination-relative paths of the directories the source scan synchronized
+     for this run (the receive root is the "." sentinel).  Sent with the
+     manifest so the receiver confines its extras walk to them, matching rsync's
+     "delete only in synchronized directories" (notably for --files-from).
+     Populated by the scanner thread or the early pre-scan. */
+  ArrayList* synced_dirs;
   /* --delete-missing-args: the destination-relative mirrors of the --files-from
      entries that are missing under the source.  Computed by the preflight on
      the calling thread before the pipeline starts; the sender thread transmits
@@ -83,6 +95,10 @@ typedef struct {
   ArrayList* dir_entries;
   mtx_t dir_entries_mutex;
   bool dir_entries_mutex_init;
+  /* Set by the sender thread when the receiver reported a --max-delete-capped
+     deletion (STATUS_DELETE_LIMIT): the transfer succeeded and the process must
+     exit 25 like rsync.  Read by the caller after the sender thread is joined. */
+  bool delete_limit;
 } PipelineContextSender;
 
 /* `config` is borrowed and must outlive the context: destroy does NOT free it,

src/shared/protocol.h

@@ -155,7 +155,15 @@ enum NET_STATUS {
    * (the receiver reads none in dry-run).  STATUS_OK keeps its meaning in this
    * path ("already up to date / nothing to do").  Appended after
    * STATUS_ERROR_DETAIL so no existing status is renumbered. */
-  STATUS_DRY_RUN_TRANSFER
+  STATUS_DRY_RUN_TRANSFER,
+  /* --max-delete budget exhausted (protocol 2.23.0).  Sent by the receiver as
+   * the terminal success status INSTEAD of STATUS_OK when a --delete/
+   * --delete-missing-args commit removed up to the --max-delete bound but had
+   * to skip further extras.  The transfer itself succeeded and all file data is
+   * stored; the sender maps this to rsync's exit code 25 ("the --max-delete
+   * limit stopped deletions").  Appended after STATUS_DRY_RUN_TRANSFER so no
+   * existing status is renumbered. */
+  STATUS_DELETE_LIMIT
 };
 
 void io_set_fds(int read_fd, int write_fd);

src/shared/utils.c

@@ -584,22 +584,41 @@ bool path_under_skip_prefix(const char* child_rel, bool at_root, const DeleteSki
   return false;
 }
 
-/* All-or-nothing max-delete needs to know BEFORE any unlink whether the run
-   would delete more than max_delete entries.  This rehearsal pass walks the
-   destination with the same decisions as the delete pass but never touches the
-   filesystem: it counts every regular file the delete pass would unlink and
-   every directory it would rmdir (a directory is removed only once every entry
-   below it has been removed and nothing the walker leaves in place survives).
-   Entries the walker never removes (symlinks, manifest-listed files, protected
-   prefixes) mark the enclosing directory as surviving, exactly as they would
-   make a real rmdir fail with ENOTEMPTY.  Stops early once *count reaches the
-   cap (sets *exceeds).  Returns false on a traversal error. */
-static bool count_extras_fd(int dirfd, const char* rel_path, const PathIndex* keep, size_t cap,
-                            size_t* count, bool* exceeds, const DeleteSkipEntry* skips,
-                            int skip_count, bool* survives) {
+/* Per-run deletion budget and tallies.  `max_delete` is the cap on the number
+   of entries the walker may remove (SIZE_MAX = unlimited); once it is reached
+   the remaining extras are counted in `skipped` and left in place, matching
+   rsync's partial --max-delete behavior. */
+typedef struct {
+  size_t max_delete;
+  size_t deleted;
+  size_t skipped;
+  bool limit_hit;
+} DeleteBudget;
+
+/* True when direct children of the directory named by `rel` may be removed.
+   With no synchronization info (dirs == NULL) the whole tree is deletable; when
+   a dirs index is supplied only its exact entries are (the receive root is the
+   "." sentinel). */
+static bool is_synced_dir(const PathIndex* dirs, const char* rel) {
+  if (!dirs)
+    return true;
+  return path_index_contains(dirs, rel[0] == '\0' ? "." : rel);
+}
+
+/* Remove the extras directly inside the directory open on `dirfd`, recursing
+   into every child directory so kept content below a synchronized prefix is
+   reached.  `all_removed` reports whether every child entry was removed (so the
+   caller may rmdir this directory).  A child directory is never removed when it
+   is itself a synchronized directory or holds kept content; with a dirs index
+   supplied, direct children of a non-synchronized directory are never extras at
+   all (they are left in place but still descended into).  Symlinks are unlinked
+   like any other non-directory extra (never followed). */
+static bool delete_extras_fd(int dirfd, const char* rel_path, const PathIndex* keep,
+                             const PathIndex* dirs, DeleteBudget* budget,
+                             const DeleteSkipEntry* skips, int skip_count, bool parent_deletable,
+                             bool* all_removed) {
   /* openat(dirfd, ".") opens an independent file description: a dup() would
-     share dirfd's file offset, and a prior rehearsal pass must not have drained
-     this directory's stream before the delete pass reads it again. */
+     share dirfd's file offset and a prior pass could leave the stream drained. */
   int scanfd = openat(dirfd, ".", O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
   if (scanfd < 0)
     return false;
@@ -610,93 +629,10 @@ static bool count_extras_fd(int dirfd, const char* rel_path, const PathIndex* ke
   }
   bool operation_ok = true;
   bool local_survives = false;
-  bool at_root = rel_path[0] == '\0';
-  const struct dirent* entry;
-  while ((entry = readdir(dir)) != NULL) {
-    if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
-      continue;
-    if (*exceeds)
-      break;
-    char* child_rel = path_cat((char*)rel_path, entry->d_name);
-    if (!child_rel) {
-      operation_ok = false;
-      continue;
-    }
-    if (path_under_skip_prefix(child_rel, at_root, skips, skip_count)) {
-      local_survives = true;
-      free(child_rel);
-      continue;
-    }
-    struct stat st;
-    if (fstatat(dirfd, entry->d_name, &st, AT_SYMLINK_NOFOLLOW) != 0) {
-      if (errno != ENOENT)
-        operation_ok = false;
-      free(child_rel);
-      continue;
-    }
-    if (S_ISLNK(st.st_mode)) {
-      local_survives = true;
-      free(child_rel);
-      continue;
-    }
-    if (S_ISDIR(st.st_mode)) {
-      int childfd = openat(dirfd, entry->d_name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-      bool child_ok = true;
-      bool child_survives = true;
-      if (childfd >= 0) {
-        child_ok = count_extras_fd(childfd, child_rel, keep, cap, count, exceeds, skips, skip_count,
-                                   &child_survives);
-        close(childfd);
-      } else if (errno != ENOENT) {
-        operation_ok = false;
-      }
-      if (!child_ok)
-        operation_ok = false;
-      if (keep_is_dir(keep, child_rel)) {
-        /* A directory with kept content below it is never removed. */
-        local_survives = true;
-      } else if (child_survives) {
-        /* The directory still holds entries the walker leaves in place, so an
-           rmdir would fail with ENOTEMPTY; the delete pass leaves it behind
-           rather than reporting an error (matching rsync). */
-        local_survives = true;
-      } else {
-        if (*count >= cap) {
-          *exceeds = true;
-        } else {
-          (*count)++;
-        }
-      }
-    } else {
-      bool found = keep_is_file(keep, child_rel);
-      if (!found) {
-        if (*count >= cap) {
-          *exceeds = true;
-        } else {
-          (*count)++;
-        }
-      }
-    }
-    free(child_rel);
-  }
-  closedir(dir);
-  *survives = local_survives;
-  return operation_ok;
-}
-
-static bool delete_extras_fd(int dirfd, const char* rel_path, const PathIndex* keep,
-                             size_t max_delete, size_t* deleted_count, const DeleteSkipEntry* skips,
-                             int skip_count) {
-  /* Independent file description (see count_extras_fd). */
-  int scanfd = openat(dirfd, ".", O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-  if (scanfd < 0)
-    return false;
-  DIR* dir = fdopendir(scanfd);
-  if (!dir) {
-    close(scanfd);
-    return false;
-  }
-  bool operation_ok = true;
+  /* A directory is deletable when it or ANY ancestor is synchronized; the
+     `parent_deletable` flag carries that down the recursion so dest-only
+     directories below a synchronized root are removed wholesale. */
+  bool deletable = parent_deletable || is_synced_dir(dirs, rel_path);
   const struct dirent* entry;
   while ((entry = readdir(dir)) != NULL) {
     if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
@@ -714,6 +650,7 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, const PathIndex* k
        destination directory that happens to be called .fastsync-stage is
        ordinary content. */
     if (path_under_skip_prefix(child_rel, rel_path[0] == '\0', skips, skip_count)) {
+      local_survives = true;
       free(child_rel);
       continue;
     }
@@ -724,55 +661,58 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, const PathIndex* k
       free(child_rel);
       continue;
     }
-    // Skip symlinks to prevent following them outside the destination tree
-    if (S_ISLNK(st.st_mode)) {
-      free(child_rel);
-      continue;
-    }
     if (S_ISDIR(st.st_mode)) {
       int childfd = openat(dirfd, entry->d_name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-      bool child_removed = false;
+      bool child_all_removed = false;
       if (childfd >= 0) {
-        child_removed = delete_extras_fd(childfd, child_rel, keep, max_delete, deleted_count, skips,
-                                         skip_count);
-        if (!child_removed)
+        if (!delete_extras_fd(childfd, child_rel, keep, dirs, budget, skips, skip_count, deletable,
+                              &child_all_removed))
           operation_ok = false;
         close(childfd);
       } else if (errno != ENOENT) {
         operation_ok = false;
       }
-      if (child_removed && !keep_is_dir(keep, child_rel)) {
-        if (*deleted_count >= max_delete) {
-          operation_ok = false;
+      bool child_synced = dirs && path_index_contains(dirs, child_rel);
+      if (child_synced || keep_is_dir(keep, child_rel)) {
+        /* A synchronized directory and a directory holding kept content are
+           never removed. */
+        local_survives = true;
+      } else if (child_all_removed && deletable) {
+        if (budget->deleted >= budget->max_delete) {
+          budget->limit_hit = true;
+          budget->skipped++;
+          local_survives = true;
+        } else if (unlinkat(dirfd, entry->d_name, AT_REMOVEDIR) != 0) {
+          /* ENOENT: already gone (fine).  ENOTEMPTY/EEXIST: the directory
+             still holds entries the walker leaves in place (a protected
+             excluded prefix, a kept file the manifest protects, a symlink);
+             rsync leaves such a directory behind, so this is not an error.
+             Only genuine I/O failures abort the deletion. */
+          if (errno != ENOENT && errno != ENOTEMPTY && errno != EEXIST)
+            operation_ok = false;
+          local_survives = true;
         } else {
-          if (unlinkat(dirfd, entry->d_name, AT_REMOVEDIR) != 0) {
-            /* ENOENT: already gone (fine).  ENOTEMPTY/EEXIST: the directory
-               still holds entries the walker leaves in place (a protected
-               excluded prefix, a kept file the manifest protects, a symlink);
-               rsync leaves such a directory behind, so this is not an error.
-               Only genuine I/O failures abort the deletion. */
-            if (errno != ENOENT && errno != ENOTEMPTY && errno != EEXIST)
-              operation_ok = false;
-          } else {
-            (*deleted_count)++;
-          }
+          budget->deleted++;
         }
+      } else {
+        local_survives = true;
       }
     } else {
-      // Check if relative path is in manifest
       bool found = keep_is_file(keep, child_rel);
-      if (!found) {
-        if (*deleted_count >= max_delete) {
+      if (found || !deletable) {
+        /* Kept file, or a child of a directory that is not synchronized: never
+           an extra for this run. */
+        local_survives = true;
+      } else if (budget->deleted >= budget->max_delete) {
+        budget->limit_hit = true;
+        budget->skipped++;
+        local_survives = true;
+      } else if (unlinkat(dirfd, entry->d_name, 0) != 0) {
+        if (errno != ENOENT)
           operation_ok = false;
-          free(child_rel);
-          continue;
-        }
-        if (unlinkat(dirfd, entry->d_name, 0) != 0) {
-          if (errno != ENOENT)
-            operation_ok = false;
-        } else {
-          (*deleted_count)++;
-        }
+        local_survives = true;
+      } else {
+        budget->deleted++;
         char* escaped_path = output_escape(child_rel, log_get_8_bit_output());
         fprintf(stderr, "  Deleted: %s\n", escaped_path ? escaped_path : "<allocation failed>");
         free(escaped_path);
@@ -781,21 +721,33 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, const PathIndex* k
     free(child_rel);
   }
   closedir(dir);
+  *all_removed = !local_survives;
   return operation_ok;
 }
 
 DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
-                                       size_t max_delete, const DeleteSkipEntry* skips,
-                                       int skip_count, size_t* deleted_out) {
+                                       const ArrayList* synced_dirs, size_t max_delete,
+                                       const DeleteSkipEntry* skips, int skip_count,
+                                       size_t* deleted_out, size_t* skipped_out) {
   if (deleted_out)
     *deleted_out = 0;
+  if (skipped_out)
+    *skipped_out = 0;
   if (!manifest)
     return DELETE_WALK_ERROR;
-  /* Index the keep-set once so both passes answer membership in O(path length)
-     instead of scanning every manifest entry for every destination entry. */
+  /* Index the keep-set (and the synchronized-dir set, when supplied) once so
+     membership is answered in O(path length) instead of scanning every entry
+     for every destination entry. */
   PathIndex keep;
   if (!build_keep_index(manifest, &keep))
     return DELETE_WALK_ERROR;
+  PathIndex dirs;
+  bool have_dirs = synced_dirs != NULL;
+  if (have_dirs &&
+      !path_index_build(&dirs, (const char* const*)synced_dirs->items, (size_t)synced_dirs->size)) {
+    path_index_free(&keep);
+    return DELETE_WALK_ERROR;
+  }
   int rootfd;
   int root_fd = utils_get_authorized_root_fd();
   if (root_fd >= 0) {
@@ -810,39 +762,31 @@ DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* m
   }
   if (rootfd < 0) {
     path_index_free(&keep);
+    if (have_dirs)
+      path_index_free(&dirs);
     return DELETE_WALK_ERROR;
   }
-  if (max_delete != SIZE_MAX) {
-    /* Rehearse the deletion first so a run that would exceed the cap removes
-       nothing (rsync's all-or-nothing --max-delete contract). */
-    size_t count = 0;
-    bool exceeds = false;
-    bool survives = false;
-    bool counted_ok = count_extras_fd(rootfd, "", &keep, max_delete, &count, &exceeds, skips,
-                                      skip_count, &survives);
-    if (!counted_ok) {
-      close(rootfd);
-      path_index_free(&keep);
-      return DELETE_WALK_ERROR;
-    }
-    if (exceeds) {
-      close(rootfd);
-      path_index_free(&keep);
-      return DELETE_WALK_LIMIT_EXCEEDED;
-    }
-  }
-  size_t deleted_count = 0;
-  bool ok = delete_extras_fd(rootfd, "", &keep, max_delete, &deleted_count, skips, skip_count);
+  DeleteBudget budget = {.max_delete = max_delete, .deleted = 0, .skipped = 0, .limit_hit = false};
+  bool all_removed = false;
+  bool ok = delete_extras_fd(rootfd, "", &keep, have_dirs ? &dirs : NULL, &budget, skips,
+                             skip_count, false, &all_removed);
   if (close(rootfd) != 0)
     ok = false;
   path_index_free(&keep);
+  if (have_dirs)
+    path_index_free(&dirs);
   if (deleted_out)
-    *deleted_out = deleted_count;
-  return ok ? DELETE_WALK_OK : DELETE_WALK_ERROR;
+    *deleted_out = budget.deleted;
+  if (skipped_out)
+    *skipped_out = budget.skipped;
+  if (!ok)
+    return DELETE_WALK_ERROR;
+  return budget.limit_hit ? DELETE_WALK_LIMIT_REACHED : DELETE_WALK_OK;
 }
 
 bool delete_extras(const char* dest_root, const ArrayList* manifest) {
-  return delete_extras_limited(dest_root, manifest, SIZE_MAX, NULL, 0, NULL) == DELETE_WALK_OK;
+  return delete_extras_limited(dest_root, manifest, NULL, SIZE_MAX, NULL, 0, NULL, NULL) ==
+         DELETE_WALK_OK;
 }
 
 bool has_path_traversal(const char* path) {

src/shared/utils.h

@@ -98,10 +98,10 @@ bool glob_match(const char* pattern, const char* str);
 typedef enum {
   /* Every extra entry was removed (or there were none). */
   DELETE_WALK_OK = 0,
-  /* The destination holds more extras than the numeric cap for this run.  With
-     the all-or-nothing max-delete semantics NOTHING was removed (the walker
-     counts first and refuses to start when the run would exceed the limit). */
-  DELETE_WALK_LIMIT_EXCEEDED,
+  /* The numeric cap for this run was reached before every extra was removed.
+     The walker removed exactly the entries the cap allowed and skipped (without
+     removing) the rest, matching rsync's partial --max-delete behavior. */
+  DELETE_WALK_LIMIT_REACHED,
   /* A traversal or unlink failure aborted the deletion (partial removal is
      possible, mirroring the delete pass). */
   DELETE_WALK_ERROR
@@ -122,19 +122,22 @@ typedef struct {
    only DIRECT children of the destination root, i.e. child_rel has no '/'). */
 bool path_under_skip_prefix(const char* child_rel, bool at_root, const DeleteSkipEntry* skips,
                             int skip_count);
-/* Remove files/dirs under dest_root that are not listed in manifest without
-   ever descending into a protected prefix (see DeleteSkipEntry).  When
-   max_delete is not SIZE_MAX the run is all-or-nothing: extras are counted
-   first and DELETE_WALK_LIMIT_EXCEEDED is returned (with nothing removed) when
-   the count would exceed the cap.  `deleted_out` optionally receives the number
-   of entries actually removed.  The all-or-nothing guarantee holds only while
-   the destination tree is not being concurrently modified: the rehearsal pass
-   and the delete pass are two separate walks, so a concurrent change between
-   them (another process adding/removing entries) can make the second pass
-   delete a different set than the first one counted. */
+/* Remove files/dirs/symlinks under dest_root that are not listed in manifest
+   without ever descending into a protected prefix (see DeleteSkipEntry).  When
+   `synced_dirs` is non-NULL, extras are only removed directly inside a directory
+   whose destination-relative path is an exact entry in that list (the receive
+   root is the "." sentinel); directories outside the synchronized set are still
+   descended into so kept content below a listed directory is preserved, but
+   nothing in them is removed.  A NULL `synced_dirs` keeps the legacy behavior of
+   treating the whole destination tree as deletable.  `max_delete` caps the
+   number of removed entries (SIZE_MAX = unlimited): the walker removes up to the
+   cap and returns DELETE_WALK_LIMIT_REACHED when more extras remained.
+   `deleted_out`/`skipped_out` optionally receive the number of entries removed
+   and the number skipped because of the cap. */
 DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
-                                       size_t max_delete, const DeleteSkipEntry* skips,
-                                       int skip_count, size_t* deleted_out);
+                                       const ArrayList* synced_dirs, size_t max_delete,
+                                       const DeleteSkipEntry* skips, int skip_count,
+                                       size_t* deleted_out, size_t* skipped_out);
 bool delete_extras(const char* dest_root, const ArrayList* manifest);
 bool utils_set_authorized_root(int fd, const char* canonical_path);
 /* The fd-only compatibility form is fail-closed for path-based operations;