Merge branch 'fix/parity-review-c' into feat/parity-fixes

src/shared/config.h

@@ -82,7 +82,7 @@ typedef struct {
 typedef enum SuperMode { SUPER_MODE_AUTO = 0, SUPER_MODE_ON = 1, SUPER_MODE_OFF = 2 } SuperMode;
 
 /* ===========================================================================
- * Config wire-field table (single source of truth for protocol 2.26.0).
+ * Config wire-field table (single source of truth for protocol 2.27.0).
  *
  * Every field below crosses the wire.  The table is the ONLY place a
  * serialized field is named: config.h expands CONFIG_WIRE_FIELDS() to declare

src/shared/file.c

@@ -807,23 +807,22 @@ bool file_ensure_directory_secure(const char* path) {
     } else if (errno == EEXIST) {
       dir_fd = openat(parent_fd, leaf, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
     }
-  } else if (dir_fd < 0 && (errno == ENOTDIR || errno == ELOOP)) {
-    /* rsync replaces a destination non-directory (regular file or symlink)
-       with an incoming directory.  Confined to the already-opened secure
-       parent fd: the leaf is unlinked by name (never followed) and only a
-       non-directory is ever removed, so this cannot escape the authorized
-       root or remove a pre-existing directory tree.  A symlink is left alone:
-       replacing it is not required for FastSync's transferred directories and
-       keeps --keep-dirlinks semantics untouched. */
+  } else if (dir_fd < 0 && errno == ENOTDIR) {
+    /* rsync replaces a destination non-directory (regular file) with an
+       incoming directory.  Confined to the already-opened secure parent fd:
+       the leaf is unlinked by name (never followed) and only a non-directory
+       is ever removed, so this cannot escape the authorized root or remove a
+       pre-existing directory tree.  A symlink is left alone (openat with
+       O_NOFOLLOW reports ELOOP, which takes no branch here), since replacing
+       it is not required for FastSync's transferred directories and keeps
+       --keep-dirlinks semantics untouched. */
     struct stat leaf_st;
     if (fstatat(parent_fd, leaf, &leaf_st, AT_SYMLINK_NOFOLLOW) == 0 && !S_ISDIR(leaf_st.st_mode) &&
         !S_ISLNK(leaf_st.st_mode)) {
       if (unlinkat(parent_fd, leaf, 0) == 0) {
-        if (mkdirat(parent_fd, leaf, (mode_t)(0777 & ~(mode_t)file_process_umask())) == 0) {
+        if (mkdirat(parent_fd, leaf, (mode_t)(0777 & ~(mode_t)file_process_umask())) == 0)
           created = true;
-        } else if (errno != EEXIST) {
-          /* leave dir_fd < 0 so the caller sees the failure */
-        }
+        /* On failure dir_fd stays < 0 below, so the caller still sees it. */
         dir_fd = openat(parent_fd, leaf, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
       }
     }

src/shared/format.h

@@ -88,7 +88,12 @@ typedef struct {
   unsigned long long total_file_size;       /* sum of entry sizes (link target len) */
   unsigned long long transferred_regular;   /* regular files actually stored */
   unsigned long long transferred_file_size; /* source size of those files */
-  unsigned long long literal_data;          /* literal bytes sent for them */
+  /* Whole-file accuracy: the `--stats` "Literal data" row.  The sender counts
+   * the source size of every stored file, so a whole-file transfer matches
+   * rsync.  A delta run actually ships only the literal fragments of the diff
+   * (the rest is matched/copied), so here the value is an upper bound, not
+   * rsync's literal-byte total; see RSYNC_COMPAT.md's `--stats` row. */
+  unsigned long long literal_data;
 } TransferStats;
 
 #endif

src/shared/log.h

@@ -24,17 +24,18 @@ typedef enum {
   /* rsync categories that map to a FastSync event (emitted in rsync's line
    * format): del (deletions), remove (sender-side source removal), name
    * (transferred entry names), flist (file-list header), nonreg (skipped
-   * non-regular files), backup (backed-up files), progress (per-file progress). */
+   * non-regular files), progress (per-file progress).  rsync's `backup`
+   * category is accepted for CLI parity but stays silent: the receiver does the
+   * backing-up and FastSync has no backup event to report from the sender. */
   LOG_INFO_DEL = 1u << 4,
   LOG_INFO_REMOVE = 1u << 5,
   LOG_INFO_NAME = 1u << 6,
   LOG_INFO_FLIST = 1u << 7,
   LOG_INFO_NONREG = 1u << 8,
-  LOG_INFO_BACKUP = 1u << 9,
-  LOG_INFO_PROGRESS = 1u << 10,
+  LOG_INFO_PROGRESS = 1u << 9,
   LOG_INFO_ALL = LOG_INFO_COPY | LOG_INFO_MISC | LOG_INFO_SKIP | LOG_INFO_STATS | LOG_INFO_DEL |
                  LOG_INFO_REMOVE | LOG_INFO_NAME | LOG_INFO_FLIST | LOG_INFO_NONREG |
-                 LOG_INFO_BACKUP | LOG_INFO_PROGRESS,
+                 LOG_INFO_PROGRESS,
 } LogInfoFlag;
 
 void log_message(LogLevel log_level, const char* message, ...);

src/shared/utils.c

@@ -52,6 +52,31 @@ bool path_is_within_root(const char* root, const char* path) {
   return strncmp(root, path, root_len) == 0 && (path[root_len] == '\0' || path[root_len] == '/');
 }
 
+/* Borrowed transfer-relative view of `path`: strip any leading '/' and then a
+ * `root` prefix (its own leading/trailing slashes tolerated), returning a
+ * pointer into `path`.  Non-allocating, so it is safe on the hot scan/print
+ * paths.  A NULL/empty root, or a path not under `root`, leaves only the
+ * leading-slash strip.  `path` must be NUL-terminated and live in the caller. */
+const char* utils_strip_transfer_root(const char* path, const char* root) {
+  if (path == NULL)
+    return NULL;
+  const char* rel = path;
+  while (*rel == '/')
+    rel++;
+  if (root == NULL)
+    return rel;
+  while (*root == '/')
+    root++;
+  size_t root_len = strlen(root);
+  while (root_len > 0 && root[root_len - 1] == '/')
+    root_len--;
+  if (root_len == 0)
+    return rel;
+  if (strncmp(rel, root, root_len) == 0 && (rel[root_len] == '/' || rel[root_len] == '\0'))
+    return rel + root_len + (rel[root_len] == '/' ? 1 : 0);
+  return rel;
+}
+
 /* Open the destination root directory itself, confined to the authorized root.
  * NOTE (do not merge with file_open_secure_parent): this walk opens dest_root
  * (a directory that must already exist) and returns its fd, whereas

src/shared/utils.h

@@ -191,6 +191,11 @@ const char* utils_get_authorized_root_path(void);
  * callers guarantee this); this is containment by string, not by resolved
  * symlinks.  Shared by the utils and file secure-walk root confinement. */
 bool path_is_within_root(const char* root, const char* path);
+/* Non-allocating transfer-relative view of `path`: strip any leading '/' and
+ * then a `root` prefix (leading/trailing slashes tolerated), returning a
+ * borrowed pointer into `path`.  A NULL/empty root, or a path not under
+ * `root`, yields just the leading-slash strip.  `path`/`root` must stay alive. */
+const char* utils_strip_transfer_root(const char* path, const char* root);
 /* True when `path` contains a ".." component.  This is a purely lexical
  * dot-dot check: an absolute path is NOT rejected here, because default
  * (non-relative) transfers legitimately put the sender's absolute source path