fix(parity): init delete_suppressed; gate deleted-path retention

- Initialize PipelineContextSender.delete_suppressed=false: an uninitialized
  true silently skipped the --delete keep-set manifest under -m/--threads,
  so destination extras were never removed.
- Allocate/install the receiver deleted-path observer only when
  report_deletes is set (--info=del / -i / --out-format under --delete), cap
  the retained list at MAX_MANIFEST_ENTRIES, and free already-created lists
  on the receiver-pipeline create failure path.
- Validate report_deletes/report_stats/report_dest_info on receive.
- Correct stale comments (config.h report_deletes, delete_plan.h deleted
  count, multiprocessing.h stats locking, utils.h observer placement).
- Tests: sender delete_suppressed init, report_deletes gating (unit), and
  -m/--delete default delete-after keep-set removal (integration).

src/shared/config.c

@@ -206,7 +206,8 @@ static bool validate_received_config(const Config* config) {
          valid_wire_bool(config->preserve_perms) && valid_wire_bool(config->preserve_times) &&
          valid_wire_bool(config->preserve_owner) && valid_wire_bool(config->preserve_group) &&
          valid_wire_bool(config->munge_links) && valid_wire_bool(config->keep_dirlinks) &&
-         valid_wire_bool(config->fake_super) &&
+         valid_wire_bool(config->fake_super) && valid_wire_bool(config->report_dest_info) &&
+         valid_wire_bool(config->report_stats) && valid_wire_bool(config->report_deletes) &&
          (!config->copy_as_set || (config->copy_as_uid >= 0 && config->copy_as_gid >= 0)) &&
          (!config->use_compression ||
           (config->compression_level >= 1 && config->compression_level <= 22)) &&

src/shared/config.h

@@ -265,8 +265,9 @@ typedef enum SuperMode { SUPER_MODE_AUTO = 0, SUPER_MODE_ON = 1, SUPER_MODE_OFF
  * the destination-relative paths it ACTUALLY removed in its terminal
  * STATUS_STATS record (the same path-list field the dry-run would-delete report
  * uses), so the sender can print rsync's `deleting PATH`/`*deleting` lines for a
- * real (non-dry-run) deletion.  It is set only when --info=del is requested with
- * --delete; the transfer decision itself is unchanged. */
+ * real (non-dry-run) deletion.  It is set when --delete is active and any of
+ * --info=del, -i/--itemize-changes or --out-format requests per-file change
+ * output; the transfer decision itself is unchanged. */
 #define CONFIG_WIRE_OUTPUT_FIELDS(X)                                                               \
   X(report_dest_info, bool, false, BOOL)                                                           \
   X(report_stats, bool, false, BOOL) X(report_deletes, bool, false, BOOL)

src/shared/delete_plan.h

@@ -77,8 +77,10 @@ int delete_plan_session_receive(DeletePlanSession* session, const Config* config
 DeleteCommitResult delete_plan_session_commit(DeletePlanSession* session, const Config* config);
 /* True once the shared --max-delete budget stopped part of a deletion. */
 bool delete_plan_session_limit_reached(const DeletePlanSession* session);
-/* Number of destination entries the session's plans removed (or, for
-   --delete-delay, snapshotted for removal), for the end-of-transfer stats. */
+/* Number of destination entries the session's plans ACTUALLY removed, for the
+   end-of-transfer stats.  A --delete-delay entry only snapshotted for removal
+   that survives the commit (e.g. a directory refilled before it is removed, so
+   unlink/rmdir fails with ENOTEMPTY) is not counted. */
 size_t delete_plan_session_deleted(const DeletePlanSession* session);
 /* Install an observer invoked for every destination-relative path the session
    truly removes (including the deferred --delete-delay commit), so the receiver

src/shared/multiprocessing.c

@@ -38,6 +38,7 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
   context->remove_source_files = NULL;
   context->early_delete = false;
   context->delete_plans = NULL;
+  context->delete_suppressed = false;
   context->scan_stopped_early = false;
   context->total_files = 0;
   context->progress_bytes = 0;

src/shared/multiprocessing.h

@@ -93,7 +93,11 @@ typedef struct {
   unsigned long long progress_bytes;
   unsigned long long total_bytes;
   /* Per-type flist / transferred accounting for the rsync --stats breakdown and
-     the progress `to-chk` denominator.  Guarded by mutex_progress. */
+     the progress `to-chk` denominator.  Owned by the sender thread: it is the
+     only writer (the entry/transfer notes in send_chunks_multithreaded) and it
+     reads the totals in its completion tail, so no lock is needed.  This is NOT
+     guarded by mutex_progress (which covers total_files/progress_bytes/
+     total_bytes/sender_done). */
   TransferStats stats;
   bool sender_done;
   atomic_bool cancelled;

src/shared/utils.h

@@ -134,6 +134,11 @@ bool path_under_skip_prefix(const char* child_rel, bool at_root, const DeleteSki
    cap and returns DELETE_WALK_LIMIT_REACHED when more extras remained.
    `deleted_out`/`skipped_out` optionally receive the number of entries removed
    and the number skipped because of the cap. */
+DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
+                                       const ArrayList* synced_dirs, size_t max_delete,
+                                       const DeleteSkipEntry* skips, int skip_count,
+                                       size_t* deleted_out, size_t* skipped_out);
+
 /* Optional per-deletion observer: called for each destination-relative path
    actually removed (a file, symlink, or directory), in removal order, so the
    receiver can stream rsync's `--info=del`/`--info=remove` lines. */
@@ -147,11 +152,6 @@ DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const Arr
                                                 size_t* deleted_out, size_t* skipped_out,
                                                 DeletePathObserver observer,
                                                 void* observer_context);
-
-DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
-                                       const ArrayList* synced_dirs, size_t max_delete,
-                                       const DeleteSkipEntry* skips, int skip_count,
-                                       size_t* deleted_out, size_t* skipped_out);
 /* Read-only companion to delete_extras_limited: walk the destination exactly as
    the delete pass would and APPEND (strdup'd) destination-relative paths that
    WOULD be removed, without touching disk.  Used for -n/--dry-run --delete