fix(p6-stop): block delete-manifest on early stop; sync -m manifest access; overflow guard

src/client/client_send.c

@@ -1403,6 +1403,7 @@ static int send_chunks_multithreaded(void* pipeline_context) {
     if (stop_condition_reached(&context->stop_condition)) {
       log_info_message(LOG_INFO_MISC,
                        "Stop deadline reached; stopping transfer at the next chunk boundary");
+      context->scan_stopped_early = true;
       pipeline_cancel(context);
       break;
     }
@@ -1446,9 +1447,19 @@ static int send_chunks_multithreaded(void* pipeline_context) {
   }
 
   /* Completion tail: reached on natural exhaustion or an early stop deadline.
-     The keep-set manifest is committed exactly where it normally would be, so
-     --delete (delete-after timing) still commits its extras deletion. */
-  if (context->config->use_delete && !context->early_delete) {
+     A deadline that cut the scan short leaves an incomplete keep-set manifest;
+     transmitting it would make the receiver --delete the unscanned source
+     mirrors (data loss), so it is deliberately suppressed.  Suppressing it also
+     means the manifest (which the scanner thread may still be appending) is
+     never read here on the early-stop path, so no scanner synchronization is
+     required to enter the tail. */
+  context->scan_stopped_early =
+      context->scan_stopped_early || stop_condition_reached(&context->stop_condition);
+  if (context->scan_stopped_early) {
+    log_message(LOG_LEVEL_WARNING,
+                "transfer stopped early (stop deadline); skipping --delete keep-set so "
+                "unscanned source mirrors are not deleted");
+  } else if (context->config->use_delete && !context->early_delete) {
     /* Empty keep-set + scan I/O error must not delete the whole destination
        (the source may not be genuinely empty -- see send_files). */
     bool empty_io;
@@ -1826,15 +1837,18 @@ int send_files(Config* config) {
   int total_files = 0;
   time_t last_progress = 0;
   time_t start = time(NULL);
+  /* True when the stop deadline cut the scan short so the keep-set manifest is
+     only a prefix of the source. */
+  bool scan_stopped_early = false;
   while ((current_chunk = directory_scanner_next(scanner)) != NULL) {
     /* Phase 6: stop-elegantly at the next chunk boundary once the deadline has
        passed.  The scanner may also have stopped early itself; either way the
-       completion tail below keeps everything already sent and still commits a
-       --delete keep-set manifest. */
+       completion tail below keeps everything already sent. */
     if (stop_condition_reached(&stop)) {
       chunk_destroy(current_chunk);
       log_info_message(LOG_INFO_MISC,
                        "Stop deadline reached; stopping transfer at the next chunk boundary");
+      scan_stopped_early = true;
       break;
     }
     unsigned long long chunk_bytes = 0;
@@ -1890,31 +1904,43 @@ int send_files(Config* config) {
     goto send_fail;
   if (directory_scanner_had_io_error(scanner))
     had_scan_io = true;
-  if (had_scan_io && manifest && manifest->size == 0) {
-    /* A scan that hit an I/O error and produced no keep entries is ambiguous;
-       an empty keep-set would delete the whole destination.  Refuse to delete
-       (see the early-timing comment above). */
-    log_message(LOG_LEVEL_ERROR,
-                "source scan hit an I/O error before finding any file; refusing to delete with "
-                "an empty keep-set (--delete)");
-    goto send_fail;
-  }
-  if ((manifest || config->delete_missing_args) && !delete_early) {
-    /* Late (commit) ordering: all file data is out; transmit the manifest so
-       the receiver commits the extras walk (--delete) and/or the
-       --delete-missing-args exact-path deletions only after the transfer
-       succeeds.  In the early modes (--delete-before/--delete-during) the
-       manifest already went out up front, so nothing is re-sent here. */
-    if (send_delete_manifest(client->file_descriptor, manifest, excluded, missing_args) != 0) {
+  /* Phase 6: the scanner may have stopped early (returning NULL without a
+     failure) as soon as the deadline passed, so reflect that here too.  A
+     deadline that cut the scan short leaves an incomplete keep-set; transmitting
+     it would make the receiver --delete the unscanned source mirrors (data
+     loss), so the late delete manifest is suppressed below. */
+  scan_stopped_early = scan_stopped_early || stop_condition_reached(&stop);
+  if (scan_stopped_early) {
+    log_message(LOG_LEVEL_WARNING,
+                "transfer stopped early (stop deadline); skipping --delete keep-set so "
+                "unscanned source mirrors are not deleted");
+  } else {
+    if (had_scan_io && manifest && manifest->size == 0) {
+      /* A scan that hit an I/O error and produced no keep entries is ambiguous;
+         an empty keep-set would delete the whole destination.  Refuse to delete
+         (see the early-timing comment above). */
+      log_message(LOG_LEVEL_ERROR,
+                  "source scan hit an I/O error before finding any file; refusing to delete with "
+                  "an empty keep-set (--delete)");
+      goto send_fail;
+    }
+    if ((manifest || config->delete_missing_args) && !delete_early) {
+      /* Late (commit) ordering: all file data is out; transmit the manifest so
+         the receiver commits the extras walk (--delete) and/or the
+         --delete-missing-args exact-path deletions only after the transfer
+         succeeds.  In the early modes (--delete-before/--delete-during) the
+         manifest already went out up front, so nothing is re-sent here. */
+      if (send_delete_manifest(client->file_descriptor, manifest, excluded, missing_args) != 0) {
+        if (manifest) {
+          array_list_delete(manifest);
+          manifest = NULL;
+        }
+        goto send_fail;
+      }
       if (manifest) {
         array_list_delete(manifest);
         manifest = NULL;
       }
-      goto send_fail;
-    }
-    if (manifest) {
-      array_list_delete(manifest);
-      manifest = NULL;
     }
   }
   bool ok = finalize_transfer(client, config, remove_sources);

src/client/usage.c

@@ -188,7 +188,9 @@ void print_usage(void) {
   printf("                      integer); whatever was already transferred is kept\n");
   printf("  --stop-at=TIME      Stop at an absolute time: HH:MM, HH:MM:SS, or\n");
   printf("                      now+N[smhd] (a time already in the past stops the\n");
-  printf("                      transfer immediately; client-only)\n");
+  printf("                      transfer immediately; client-only).  An early stop\n");
+  printf("                      skips the late --delete keep-set so it cannot delete\n");
+  printf("                      source mirrors that were not yet scanned\n");
   printf("  --address <ip>      Bind the outgoing client socket to this source address\n");
   printf("  -4, --ipv4          Force IPv4 for destination resolution\n");
   printf("  -6, --ipv6          Force IPv6 for destination resolution\n");

src/shared/multiprocessing.h

@@ -60,6 +60,13 @@ typedef struct {
   /* Phase 6: client-only sender stop deadline, computed once before the worker
    * threads start and shared read-only by the scanner and the sender thread. */
   StopCondition stop_condition;
+  /* Phase 6: set when the scanner/sender reached the stop deadline before the
+   * scan (and thus the keep-set manifest) completed naturally.  When true the
+   * completion tail must NOT transmit the partial manifest, or the receiver
+   * would delete unscanned source mirrors.  Written by the sender thread
+   * before it reads the manifest, so no additional synchronization is needed
+   * to suppress the manifest. */
+  bool scan_stopped_early;
 } PipelineContextSender;
 
 typedef struct PipelineContextReceiver {

src/shared/stop_condition.c

@@ -4,16 +4,22 @@
 #include <stdlib.h>
 #include <string.h>
 
-/* Parse a strictly positive decimal integer.  Accepts leading '+' but not a
- * leading '-', surrounding whitespace, fractional parts or trailing garbage. */
+/* Parse a strictly positive decimal integer: only ASCII digits, no leading
+ * whitespace, sign or trailing garbage. */
 static bool parse_positive_minutes(const char* value, long* out) {
   if (!value || *value == '\0')
     return false;
-  errno = 0;
-  char* end = NULL;
-  long v = strtol(value, &end, 10);
-  if (errno != 0 || end == value || *end != '\0')
+  if (*value < '0' || *value > '9')
     return false;
+  long v = 0;
+  for (const char* p = value; *p != '\0'; p++) {
+    if (*p < '0' || *p > '9')
+      return false;
+    int digit = *p - '0';
+    if (v > (LONG_MAX - digit) / 10)
+      return false;
+    v = v * 10 + digit;
+  }
   if (v <= 0 || v > INT_MAX)
     return false;
   *out = v;
@@ -45,10 +51,12 @@ bool stop_parse_at_time(const char* value, time_t now, time_t* out_deadline) {
   /* now+N[smhd]: N whole units from the current wall clock. */
   if (strncmp(value, "now+", 4) == 0) {
     const char* p = value + 4;
-    if (*p == '\0')
+    /* The count must be a bare non-negative digit run: reject leading
+       whitespace ('now+ 5s') and a leading sign ('now++5s'). */
+    if (*p < '0' || *p > '9')
       return false;
-    char* end = NULL;
     errno = 0;
+    char* end = NULL;
     long amount = strtol(p, &end, 10);
     if (errno != 0 || end == p || amount < 0)
       return false;
@@ -74,6 +82,11 @@ bool stop_parse_at_time(const char* value, time_t now, time_t* out_deadline) {
     if (amount > LONG_MAX / unit_seconds)
       return false;
     long long delta = (long long)amount * unit_seconds;
+    /* Guard against signed overflow of now + delta. */
+    if ((long long)now > 0 && delta > (long long)LLONG_MAX - (long long)now)
+      return false;
+    if ((long long)now < 0 && delta < (long long)LLONG_MIN - (long long)now)
+      return false;
     *out_deadline = now + (time_t)delta;
     return true;
   }