fix: cppcheck cleanups (printf sentinel type, scanner test style)

6 rows flipped to implemented across the three merges; total stays 147.

CMakeLists.txt

@@ -82,7 +82,7 @@ set(TEST_INCLUDES tests src/shared src/server src/client)
 
 # Monolithic test binary (backward compatible)
 file(GLOB TEST_SRCS "tests/test_*.c" "tests/runner.c")
-add_executable(tests ${TEST_SRCS} ${SHARED_SRCS} ${FILE_STORE_SRCS} ${SERVER_RECEIVER_SRCS} src/client/scanner.c src/client/client_cli.c src/client/client_validation.c src/client/usage.c)
+add_executable(tests ${TEST_SRCS} ${SHARED_SRCS} ${FILE_STORE_SRCS} ${SERVER_RECEIVER_SRCS} src/client/scanner.c src/client/change_list.c src/client/client_cli.c src/client/client_validation.c src/client/usage.c)
 target_include_directories(tests PRIVATE ${TEST_INCLUDES})
 target_compile_definitions(tests PRIVATE FASTSYNC_TEST_BUILD)
 target_link_libraries(tests PRIVATE ${TEST_LIBS})

RSYNC_COMPAT.md

@@ -6,11 +6,11 @@ This document maps rsync's full feature set to FastSync's current implementation
 
 | Status | Count | Description |
 |--------|-------|-------------|
-| ✅ Implemented | 51 | Feature works end-to-end |
+| ✅ Implemented | 57 | Feature works end-to-end |
 | 🔀 Alt Arg | 3 | Functionality exists but under different flag/semantics |
 | ⚠️ Partial | 5 | Flag parsed/stored but behavior incomplete |
 | 🔄 Compatibility No-op | 1 | Flag is accepted for CLI compatibility but has no effect |
-| ❌ Not Implemented | 87 | Flag not recognized or no behavior |
+| ❌ Not Implemented | 81 | Flag not recognized or no behavior |
 | **Total** | **147** | |
 
 ---
@@ -38,14 +38,14 @@ This document maps rsync's full feature set to FastSync's current implementation
 |------|-------------------|-----------------|-------|
 | `--stats` | Give transfer stats | ✅ Implemented | Prints file/byte counts |
 | `-h`, `--human-readable` | Human-readable numbers | ✅ Implemented | Formats transfer byte sizes using binary units |
-| `-i`, `--itemize-changes` | Per-file change summary | ❌ Not Implemented | Removed because it had no effect |
+| `-i`, `--itemize-changes` | Per-file change summary | ✅ Implemented | Prints rsync-style `>f+++++++++` lines to stdout only for files actually sent (also under `-m`); unchanged files print nothing, matching single-`-i` behavior |
 | `--progress` | Show progress | ✅ Implemented | Progress callback in sender |
 | `-P` | Same as --partial --progress | ⚠️ Partial | Parses and enables progress, but interrupted files are not retained for resumable transfers |
-| `--out-format=FORMAT` | Custom output format | ❌ Not Implemented | Removed because it had no effect |
+| `--out-format=FORMAT` | Custom output format | ✅ Implemented | Per-transfer template on stdout; tokens `%f` `%n` `%l` `%b` `%M` `%%` (`%b` is the source length, always `== %l`; post-compression/delta wire bytes are not counted); unknown escapes preserved |
 | `--log-file=FILE` | Log to file | ✅ Implemented | `log_file` config field |
-| `--log-file-format=FMT` | Log format | ❌ Not Implemented | |
+| `--log-file-format=FMT` | Log format | ✅ Implemented | Requires `--log-file`; writes one template line per transferred file using the same token set as `--out-format` (including `%b` `==` source length) |
 | `--8-bit-output`, `-8` | Leave high-bit chars unescaped | ✅ Implemented | Applies to displayed paths and protocol debug output |
-| `--list-only` | List files instead of copying | ❌ Not Implemented | Removed because it had no effect |
+| `--list-only` | List files instead of copying | ✅ Implemented | `ls -l`-style listing of files that would be transferred; scans the source only, contacts no server, writes nothing; also works with `-n` |
 
 ## 3. File Selection
 
@@ -64,7 +64,7 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `--existing` | Skip creating new files on receiver | ✅ Implemented | Existing destination files continue through normal update handling |
 | `--ignore-existing` | Skip updating existing files | ❌ Not Implemented | |
 | `--remove-source-files` | Sender removes regular files after confirmed transfer | ✅ Implemented | |
-| `-x`, `--one-file-system` | Do not cross filesystem boundaries | ❌ Not Implemented | |
+| `-x`, `--one-file-system` | Do not cross filesystem boundaries | ✅ Implemented | Sender scanner captures the root device and skips descending into mount-point crossings (`st_dev` differs); cross-filesystem mount-point subdirectories are dropped entirely, matching rsync |
 | `-F` | Add the default `.rsync-filter` rules | ❌ Not Implemented | |
 
 ## 4. Directory Options
@@ -97,7 +97,7 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `--backup-dir=DIR` | Backup directory hierarchy | ✅ Implemented | `backup_dir` config field |
 | `--suffix=SUFFIX` | Backup suffix (default ~) | ✅ Implemented | `suffix` config field |
 | `--delay-updates` | Put updated files in place at end | ❌ Not Implemented | |
-| `-T`, `--temp-dir=DIR` | Create temporary files in DIR | ❌ Not Implemented | `-T` is FastSync's timeout alias |
+| `-T`, `--temp-dir=DIR` | Create temporary files in DIR | ✅ Implemented | `--temp-dir` only; `-T` stays FastSync's `--timeout` alias. Scratch dir is resolved under the receive root; temp copies use a unique name there and are atomically renamed into place. If the scratch dir and destination are on different filesystems the atomic rename fails with EXDEV and the file save fails, which aborts the whole transfer (FastSync has no per-file skip/resume on a save error; rsync's non-atomic copy fallback is deliberately not used). `--inplace` and `--partial-dir` writes bypass the scratch dir |
 
 ## 7. Deletion
 

src/client/change_list.c

@@ -0,0 +1,310 @@
+#include "change_list.h"
+#include "utils.h"
+#include <limits.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <time.h>
+
+/* Itemize code emitted for a transferred regular file.
+ *
+ * Layout (rsync-compatible 11-char item): `>f` marks a regular file that was
+ * transferred to the remote host; the trailing nine markers are, in order,
+ * c(hecksum) s(ize) t(ime) p(erms) o(wner) g(roup) u(ser/acl) a(ttrs) x(attrs).
+ * Every marker is `+` (FastSync does not compare each attribute on the
+ * receiving side, so a sent file is reported as fully updated).  Files that
+ * are already up to date print no line at all, matching rsync's single -i
+ * which only itemizes changes.
+ *
+ * Because the scanner only yields regular-file transfer candidates, `>d`
+ * (directory) lines are never produced; directories are not transferred as
+ * items by FastSync. */
+#define ITEMIZE_SENT_FILE ">f+++++++++"
+
+typedef struct {
+  char* data;
+  size_t length;
+  size_t capacity;
+} StrBuf;
+
+static void strbuf_free(StrBuf* buf) {
+  if (buf == NULL)
+    return;
+  free(buf->data);
+  buf->data = NULL;
+  buf->length = 0;
+  buf->capacity = 0;
+}
+
+static bool strbuf_reserve(StrBuf* buf, size_t extra) {
+  if (buf->length > SIZE_MAX - extra - 1)
+    return false;
+  size_t need = buf->length + extra + 1;
+  if (need <= buf->capacity)
+    return true;
+  size_t capacity = buf->capacity > 0 ? buf->capacity : 32;
+  while (capacity < need) {
+    if (capacity > SIZE_MAX / 2) {
+      capacity = need;
+      break;
+    }
+    capacity *= 2;
+  }
+  char* grown = realloc(buf->data, capacity);
+  if (!grown)
+    return false;
+  buf->data = grown;
+  buf->capacity = capacity;
+  return true;
+}
+
+static bool strbuf_append_char(StrBuf* buf, char c) {
+  if (!strbuf_reserve(buf, 1))
+    return false;
+  buf->data[buf->length++] = c;
+  buf->data[buf->length] = '\0';
+  return true;
+}
+
+static bool strbuf_append(StrBuf* buf, const char* text) {
+  if (text == NULL)
+    return true;
+  size_t length = strlen(text);
+  if (!strbuf_reserve(buf, length))
+    return false;
+  memcpy(buf->data + buf->length, text, length);
+  buf->length += length;
+  buf->data[buf->length] = '\0';
+  return true;
+}
+
+static bool strbuf_append_ull(StrBuf* buf, unsigned long long value) {
+  char digits[32];
+  int written = snprintf(digits, sizeof(digits), "%llu", value);
+  if (written < 0 || (size_t)written >= sizeof(digits))
+    return false;
+  return strbuf_append(buf, digits);
+}
+
+static bool strbuf_append_longlong(StrBuf* buf, long long value) {
+  char digits[32];
+  int written = snprintf(digits, sizeof(digits), "%lld", value);
+  if (written < 0 || (size_t)written >= sizeof(digits))
+    return false;
+  return strbuf_append(buf, digits);
+}
+
+bool change_list_enabled(const Config* config) {
+  return config != NULL && (config->itemize_changes || config->out_format != NULL ||
+                            (config->log_file != NULL && config->log_file_format != NULL));
+}
+
+char* change_render_itemize(const ChangeEvent* event) {
+  if (event == NULL || event->decision != CHANGE_SENT)
+    return str_dup("");
+  const char* code = event->is_directory ? ">d+++++++++" : ITEMIZE_SENT_FILE;
+  StrBuf line = {0};
+  bool ok = strbuf_append(&line, code) && strbuf_append(&line, " ") &&
+            strbuf_append(&line, event->path != NULL ? event->path : "");
+  if (!ok) {
+    strbuf_free(&line);
+    return NULL;
+  }
+  return line.data;
+}
+
+static const char* leaf_name(const char* path) {
+  if (path == NULL)
+    return "";
+  const char* slash = strrchr(path, '/');
+  return slash != NULL && slash[1] != '\0' ? slash + 1 : path;
+}
+
+char* change_render_format(const char* format, const ChangeEvent* event) {
+  if (format == NULL)
+    return NULL;
+  StrBuf line = {0};
+  bool ok = true;
+  for (const char* p = format; *p != '\0' && ok;) {
+    if (*p != '%') {
+      ok = strbuf_append_char(&line, *p);
+      p++;
+      continue;
+    }
+    char token = p[1];
+    if (token == '\0') {
+      ok = strbuf_append_char(&line, '%');
+      break;
+    }
+    switch (token) {
+    case '%':
+      ok = strbuf_append_char(&line, '%');
+      break;
+    case 'f':
+      ok = strbuf_append(&line, event->path != NULL ? event->path : "");
+      break;
+    case 'n':
+      ok = strbuf_append(&line, leaf_name(event->path));
+      break;
+    case 'l':
+      ok = strbuf_append_ull(&line, event->size);
+      break;
+    case 'b':
+      ok = strbuf_append_ull(&line, event->bytes_sent);
+      break;
+    case 'M':
+      ok = strbuf_append_longlong(&line, (long long)event->mtime_sec);
+      break;
+    default:
+      /* Unknown escape sequences are preserved verbatim. */
+      ok = strbuf_append_char(&line, '%') && strbuf_append_char(&line, token);
+      break;
+    }
+    p += 2;
+  }
+  if (!ok) {
+    strbuf_free(&line);
+    return NULL;
+  }
+  if (line.data == NULL) {
+    line.data = str_dup("");
+    if (!line.data)
+      return NULL;
+  }
+  return line.data;
+}
+
+/* Format a mode as an `ls -l` permission string, e.g. `-rw-r--r--`. */
+static void mode_to_ls_string(mode_t mode, char out[11]) {
+  out[0] = S_ISDIR(mode)    ? 'd'
+           : S_ISLNK(mode)  ? 'l'
+           : S_ISCHR(mode)  ? 'c'
+           : S_ISBLK(mode)  ? 'b'
+           : S_ISFIFO(mode) ? 'p'
+           : S_ISSOCK(mode) ? 's'
+                            : '-';
+  mode_t bits = mode & 07777;
+  out[1] = (bits & S_IRUSR) ? 'r' : '-';
+  out[2] = (bits & S_IWUSR) ? 'w' : '-';
+  out[3] = (bits & S_IXUSR) ? (bits & S_ISUID ? 's' : 'x') : (bits & S_ISUID ? 'S' : '-');
+  out[4] = (bits & S_IRGRP) ? 'r' : '-';
+  out[5] = (bits & S_IWGRP) ? 'w' : '-';
+  out[6] = (bits & S_IXGRP) ? (bits & S_ISGID ? 's' : 'x') : (bits & S_ISGID ? 'S' : '-');
+  out[7] = (bits & S_IROTH) ? 'r' : '-';
+  out[8] = (bits & S_IWOTH) ? 'w' : '-';
+  out[9] = (bits & S_IXOTH) ? (bits & S_ISVTX ? 't' : 'x') : (bits & S_ISVTX ? 'T' : '-');
+  out[10] = '\0';
+}
+
+char* change_render_list_line(mode_t mode, unsigned long long size, time_t mtime,
+                              const char* path) {
+  char permission[11];
+  mode_to_ls_string(mode, permission);
+  char date[32];
+  struct tm broken_down;
+  if (localtime_r(&mtime, &broken_down) != NULL) {
+    if (strftime(date, sizeof(date), "%Y/%m/%d %H:%M:%S", &broken_down) == 0)
+      snprintf(date, sizeof(date), "?");
+  } else {
+    snprintf(date, sizeof(date), "?");
+  }
+  StrBuf line = {0};
+  char size_field[32];
+  int written = snprintf(size_field, sizeof(size_field), "%llu", size);
+  if (written < 0 || (size_t)written >= sizeof(size_field)) {
+    strbuf_free(&line);
+    return NULL;
+  }
+  bool ok = strbuf_append(&line, permission) && strbuf_append_char(&line, ' ') &&
+            strbuf_append(&line, size_field) && strbuf_append_char(&line, ' ') &&
+            strbuf_append(&line, date) && strbuf_append_char(&line, ' ') &&
+            strbuf_append(&line, path != NULL ? path : "");
+  if (!ok) {
+    strbuf_free(&line);
+    return NULL;
+  }
+  return line.data;
+}
+
+static void print_escaped_line(FILE* stream, const char* line, bool eight_bit_output) {
+  char* escaped = output_escape(line, eight_bit_output);
+  if (escaped != NULL) {
+    fprintf(stream, "%s\n", escaped);
+    free(escaped);
+  } else {
+    fprintf(stream, "%s\n", line);
+  }
+  fflush(stream);
+}
+
+void change_emit(const Config* config, const ChangeEvent* event) {
+  if (event == NULL || !change_list_enabled(config))
+    return;
+  if (event->decision == CHANGE_UP_TO_DATE)
+    return;
+  bool to_stdout = config->itemize_changes || config->out_format != NULL;
+  bool to_log = config->log_file != NULL && config->log_file_format != NULL;
+  if (to_stdout) {
+    char* line = config->out_format != NULL ? change_render_format(config->out_format, event)
+                                            : change_render_itemize(event);
+    if (line != NULL) {
+      print_escaped_line(stdout, line, config->eight_bit_output);
+      free(line);
+    }
+  }
+  if (to_log) {
+    char* line = change_render_format(config->log_file_format, event);
+    if (line != NULL) {
+      print_escaped_line(config->log_file, line, config->eight_bit_output);
+      free(line);
+    }
+  }
+}
+
+static bool format_uses_mtime(const char* format) {
+  if (format == NULL)
+    return false;
+  /* Mirror change_render_format's tokenizer: "%%" is a literal percent (so
+   * "%%M" does NOT expand %M) and unknown "%X" escapes consume both chars.
+   * This keeps the optional stat() fallback below in step with the renderer. */
+  for (const char* p = format; *p != '\0';) {
+    if (*p != '%') {
+      p++;
+      continue;
+    }
+    char token = p[1];
+    if (token == '\0')
+      break;
+    if (token == 'M')
+      return true;
+    p += 2;
+  }
+  return false;
+}
+
+void change_emit_file_sent(const Config* config, const File* file) {
+  if (file == NULL || !change_list_enabled(config))
+    return;
+  ChangeEvent event;
+  memset(&event, 0, sizeof(event));
+  event.path = file->path;
+  event.decision = CHANGE_SENT;
+  event.is_directory = false;
+  event.size = file->data != NULL ? file->data->size : 0;
+  /* FastSync has no wire-byte counter yet, so %b reports the source length
+   * that had to be delivered (always equal to %l); the actual bytes written
+   * to the socket (compressed/delta) are not measured. */
+  event.bytes_sent = event.size;
+  if (file->metadata != NULL) {
+    event.mtime_sec = file->metadata->mtime_sec;
+  } else if (format_uses_mtime(config->out_format) || format_uses_mtime(config->log_file_format)) {
+    /* Best-effort fallback for %M when no metadata was captured (no -M): the
+     * path is stat()ed just to fill the field, and any failure leaves 0. */
+    struct stat st;
+    if (file->path != NULL && stat(file->path, &st) == 0)
+      event.mtime_sec = st.st_mtime;
+  }
+  change_emit(config, &event);
+}

src/client/change_list.h

@@ -0,0 +1,75 @@
+#ifndef CHANGE_LIST_H
+#define CHANGE_LIST_H
+
+#include "config.h"
+#include "file_types.h"
+#include <stdbool.h>
+#include <sys/stat.h>
+#include <time.h>
+
+/*
+ * Shared per-file change-event / output model (rsync --itemize-changes,
+ * --out-format, --log-file-format, and --list-only all render from here).
+ *
+ * FastSync is a push-style tool: the client sends files from the source tree
+ * to a server that writes them under the destination root.  Events are
+ * emitted by whichever code path decides a file's fate (the single-threaded
+ * send loop and the `-m` sender thread both call the same per-file sender), so
+ * all change events are emitted by exactly one thread and itemize/out-format
+ * lines never interleave with each other.  They may still interleave with
+ * legacy log messages (log.c) that share the same stdout/log-file stream.
+ */
+
+typedef enum {
+  CHANGE_SENT,       /* file data (full or delta) was transmitted */
+  CHANGE_UP_TO_DATE, /* receiver already had an identical file; skipped */
+} ChangeDecision;
+
+typedef struct {
+  const char* path; /* full source path */
+  ChangeDecision decision;
+  bool is_directory;
+  unsigned long long size; /* source file length in bytes */
+  /* The number of bytes reported for a sent file. FastSync has no wire-byte
+   * counter, so this is always the source length (== size / %l); actual
+   * post-compression/delta bytes on the wire are not counted. */
+  unsigned long long bytes_sent;
+  time_t mtime_sec; /* 0 when unknown */
+} ChangeEvent;
+
+/* True when any output mode is active and per-file events matter. */
+bool change_list_enabled(const Config* config);
+
+/* Render the rsync-style itemize line for a transferred file:
+ *   `>f+++++++++ <path>`
+ * The 11-char code is `>f` (regular file transferred to the remote host)
+ * followed by c/s/t/p/o/g/u/a/x markers that are all `+` (value will be set
+ * / differs) because FastSync does not separately compare checksums, size,
+ * mtime, perms, owner, group, uid, acl, or xattr on the receiving side, so a
+ * sent file is reported as fully updated.  Up-to-date files print no line
+ * (rsync single `-i` only shows changes).  Caller frees the result. */
+char* change_render_itemize(const ChangeEvent* event);
+
+/* Expand an --out-format/--log-file-format template.  Tokens:
+ *   %f  full source path        %b  "bytes sent" == the source length (%l);
+ *   %n  leaf (base) name            actual post-compression/delta wire bytes
+ *   %l  file length in bytes        are not counted
+ *   %M  mtime in whole seconds      %%  a literal percent sign
+ * Unknown %X sequences are preserved verbatim.  Caller frees the result. */
+char* change_render_format(const char* format, const ChangeEvent* event);
+
+/* Render one --list-only long-listing entry:
+ *   `-rw-r--r--           12 2026/09/06 10:00:00 <path>`
+ * (ls -l style columns; mtime in the local time zone).  Caller frees it. */
+char* change_render_list_line(mode_t mode, unsigned long long size, time_t mtime, const char* path);
+
+/* Emit an event to every active destination:
+ *   stdout: --itemize-changes line, or the --out-format expansion when set;
+ *   log file: the --log-file-format expansion (requires --log-file).
+ * CHANGE_UP_TO_DATE events produce no output. */
+void change_emit(const Config* config, const ChangeEvent* event);
+
+/* Build and emit a CHANGE_SENT event for a file the client just sent. */
+void change_emit_file_sent(const Config* config, const File* file);
+
+#endif

src/client/client_cli.c

@@ -390,6 +390,10 @@ static const OptionEntry OPTION_TABLE[] = {
     {"--fsync", NULL, OPT_FLAG, offsetof(Config, use_fsync)},
     {"--checksum", NULL, OPT_FLAG, offsetof(Config, checksum)},
     {"--8-bit-output", "-8", OPT_FLAG, offsetof(Config, eight_bit_output)},
+    {"--itemize-changes", "-i", OPT_FLAG, offsetof(Config, itemize_changes)},
+    {"--list-only", NULL, OPT_FLAG, offsetof(Config, list_only)},
+    {"--out-format", NULL, OPT_STRING, offsetof(Config, out_format)},
+    {"--log-file-format", NULL, OPT_STRING, offsetof(Config, log_file_format)},
     {"--existing", NULL, OPT_FLAG, offsetof(Config, existing)},
     {"--ignore-existing", NULL, OPT_FLAG, offsetof(Config, ignore_existing)},
     {"--chmod", NULL, OPT_STRING, offsetof(Config, chmod_spec)},
@@ -405,6 +409,7 @@ static const OptionEntry OPTION_TABLE[] = {
     {"--ca", NULL, OPT_STRING, offsetof(Config, tls_ca)},
     {"--backup-dir", NULL, OPT_STRING, offsetof(Config, backup_dir)},
     {"--fastsync-server-path", NULL, OPT_STRING, offsetof(Config, fastsync_server_path)},
+    {"--temp-dir", NULL, OPT_STRING, offsetof(Config, temp_dir)},
     {"--partial-dir", NULL, OPT_STRING, offsetof(Config, partial_dir)},
     {"--suffix", NULL, OPT_STRING, offsetof(Config, suffix)},
     {"--compress-choice", "--zc", OPT_STRING, offsetof(Config, compress_choice)},
@@ -416,6 +421,7 @@ static const OptionEntry OPTION_TABLE[] = {
 
     {"--max-size", NULL, OPT_ULL, offsetof(Config, max_size)},
     {"--min-size", NULL, OPT_ULL, offsetof(Config, min_size)},
+    {"--one-file-system", "-x", OPT_FLAG, offsetof(Config, one_file_system)},
 };
 
 /* Only boolean options with no required argument are safe to negate. */

src/client/client_send.c

@@ -1,5 +1,6 @@
 #include "client_send.h"
 #include "array_list.h"
+#include "change_list.h"
 #include "chunk.h"
 #include "compression.h"
 #include "config.h"
@@ -40,12 +41,14 @@ static const char* display_bytes(unsigned long long bytes, bool human_readable,
 }
 
 static ScannerOptions scanner_options_from_config(const Config* config, int num_threads) {
-  ScannerOptions options = {
-      config->use_metadata,  config->chunk_size,        config->exclude_patterns,
-      config->exclude_count, config->include_patterns,  config->include_count,
-      config->max_size,      config->min_size,          config->max_depth,
-      num_threads,           config->follow_symlinks,   config->copy_links,
-      config->safe_links,    config->copy_unsafe_links, config->checksum};
+  ScannerOptions options = {config->use_metadata,     config->chunk_size,
+                            config->exclude_patterns, config->exclude_count,
+                            config->include_patterns, config->include_count,
+                            config->max_size,         config->min_size,
+                            config->max_depth,        num_threads,
+                            config->follow_symlinks,  config->copy_links,
+                            config->safe_links,       config->copy_unsafe_links,
+                            config->checksum,         config->one_file_system};
   return options;
 }
 
@@ -290,6 +293,113 @@ static int send_dry_run_manifest(const Config* config) {
   return 0;
 }
 
+typedef struct {
+  char* path;
+  mode_t mode;
+  unsigned long long size;
+  time_t mtime;
+} ListEntry;
+
+static void list_entries_destroy(ListEntry* entries, size_t count) {
+  if (entries == NULL)
+    return;
+  for (size_t i = 0; i < count; i++)
+    free(entries[i].path);
+  free(entries);
+}
+
+static int compare_list_entries(const void* left, const void* right) {
+  const ListEntry* a = (const ListEntry*)left;
+  const ListEntry* b = (const ListEntry*)right;
+  return strcmp(a->path, b->path);
+}
+
+/* --list-only: print an ls-style listing of the files that WOULD be
+ * transferred and exit without contacting the server or writing anything.
+ * Directory lines are not printed because the scanner only yields regular
+ * transfer candidates. Returns 0 on success, 1 on error. */
+static int send_list_only(const Config* config) {
+  ScannerOptions options = scanner_options_from_config(config, 0);
+  options.use_metadata = true; /* capture mode + mtime for the listing */
+  DirectoryScanner* scanner =
+      directory_scanner_create_with_options(config->send_directory, &options);
+  if (!scanner)
+    return 1;
+  ListEntry* entries = NULL;
+  size_t count = 0;
+  size_t capacity = 0;
+  Chunk* chunk;
+  bool oom = false;
+  while ((chunk = directory_scanner_next(scanner)) != NULL) {
+    for (int i = 0; i < chunk->element_count; i++) {
+      File* f = chunk->items[i];
+      if (f == NULL)
+        continue;
+      if (count == capacity) {
+        size_t new_capacity = capacity > 0 ? capacity * 2 : 64;
+        if (new_capacity <= capacity) {
+          oom = true;
+          break;
+        }
+        ListEntry* grown = realloc(entries, new_capacity * sizeof(ListEntry));
+        if (!grown) {
+          oom = true;
+          break;
+        }
+        entries = grown;
+        capacity = new_capacity;
+      }
+      char* path = str_dup(f->path);
+      if (!path) {
+        oom = true;
+        break;
+      }
+      mode_t mode = 0;
+      time_t mtime = 0;
+      if (f->metadata != NULL) {
+        mode = f->metadata->mode;
+        mtime = f->metadata->mtime_sec;
+      } else {
+        struct stat st;
+        if (stat(f->path, &st) == 0) {
+          mode = st.st_mode;
+          mtime = st.st_mtime;
+        }
+      }
+      entries[count].path = path;
+      entries[count].mode = mode;
+      entries[count].mtime = mtime;
+      entries[count].size = f->data != NULL ? f->data->size : 0;
+      count++;
+    }
+    chunk_destroy(chunk);
+    if (oom)
+      break;
+  }
+  bool failed = oom || directory_scanner_failed(scanner);
+  directory_scanner_destroy(scanner);
+  if (failed) {
+    list_entries_destroy(entries, count);
+    if (oom)
+      log_message(LOG_LEVEL_ERROR, "memory allocation failed while listing");
+    return 1;
+  }
+  if (count > 1)
+    qsort(entries, count, sizeof(ListEntry), compare_list_entries);
+  for (size_t i = 0; i < count; i++) {
+    char* line = change_render_list_line(entries[i].mode, entries[i].size, entries[i].mtime,
+                                         entries[i].path);
+    if (line != NULL) {
+      char* escaped = output_escape(line, config->eight_bit_output);
+      printf("%s\n", escaped != NULL ? escaped : line);
+      free(escaped);
+      free(line);
+    }
+  }
+  list_entries_destroy(entries, count);
+  return 0;
+}
+
 /* Send the delete manifest (list of files) to the server. Returns 0 on success, -1 on failure. */
 static int send_delete_manifest(int fd, ArrayList* manifest) {
   if (!manifest)
@@ -531,6 +641,10 @@ static int send_chunk_with_removal(Client* client, Chunk* chunk, Config* config,
       return -1;
     }
     data_destroy(data);
+    for (int i = 0; i < chunk->element_count; i++) {
+      if (chunk->items[i] != NULL)
+        change_emit_file_sent(config, chunk->items[i]);
+    }
     return 0;
   }
 
@@ -551,6 +665,7 @@ static int send_chunk_with_removal(Client* client, Chunk* chunk, Config* config,
       source_file_destroy(source);
       return -1;
     }
+    change_emit_file_sent(config, f);
     if (source && !array_list_add(remove_sources, source)) {
       source_file_destroy(source);
       return -1;
@@ -804,6 +919,8 @@ static int progress_thread_fn(void* arg) {
 }
 
 int send_files(Config* config) {
+  if (config->list_only)
+    return send_list_only(config);
   if (config->dry_run)
     return send_dry_run_manifest(config);
 
@@ -935,6 +1052,8 @@ int send_files_multithreaded(Config** config_ptr) {
   if (!config_ptr || !*config_ptr)
     return 1;
   Config* config = *config_ptr;
+  if (config->list_only)
+    return send_list_only(config);
   if (config->dry_run)
     return send_dry_run_manifest(config);
 

src/client/client_validation.c

@@ -44,6 +44,10 @@ bool validate_config(const Config* config) {
     log_message(LOG_LEVEL_ERROR, "--delta cannot be combined with -f (sendfile)");
     return false;
   }
+  if (config->log_file_format && !config->log_file) {
+    log_message(LOG_LEVEL_ERROR, "--log-file-format requires --log-file");
+    return false;
+  }
   if (config->append || config->append_verify) {
     fprintf(
         stderr,

src/client/scanner.c

@@ -59,6 +59,13 @@ typedef struct {
   bool is_directory;
 } ScannerEntry;
 
+/* --one-file-system (-x) decision. Only directories can carry a different
+ * device than their parent (mount points), so this is checked when a child
+ * directory is about to be descended into. */
+bool scanner_same_filesystem(bool one_file_system, dev_t root_device, dev_t entry_device) {
+  return !one_file_system || entry_device == root_device;
+}
+
 /* Inspect symlinks, resolve the entry type, and apply file filters once for both scanners. */
 static int scanner_inspect_entry(const ScannerOptions* options, const char* source_root,
                                  const char* containing_dir, const char* name,
@@ -156,7 +163,18 @@ DirectoryScanner* directory_scanner_create_with_options(const char* root_directo
   scanner->safe_links = options->safe_links;
   scanner->copy_unsafe_links = options->copy_unsafe_links;
   scanner->checksum = options->checksum;
+  scanner->one_file_system = options->one_file_system;
   scanner->failed = false;
+  if (scanner->one_file_system) {
+    struct stat root_stats;
+    if (stat(root_directory, &root_stats) != 0) {
+      log_perror("Could not stat source directory");
+      queue_destroy(scanner->directories);
+      free(scanner);
+      return NULL;
+    }
+    scanner->root_dev = root_stats.st_dev;
+  }
   DirEntry* root = dir_entry_create(root_directory, 0);
   if (!root) {
     queue_destroy(scanner->directories);
@@ -179,10 +197,14 @@ DirectoryScanner* directory_scanner_create(const char* root_directory, bool use_
                                            unsigned long long min_size, int max_depth,
                                            bool follow_symlinks, bool copy_links, bool safe_links,
                                            bool copy_unsafe_links, bool checksum) {
-  ScannerOptions options = {
-      use_metadata,    chunk_size, exclude_patterns, exclude_count,     include_patterns,
-      include_count,   max_size,   min_size,         max_depth,         0,
-      follow_symlinks, copy_links, safe_links,       copy_unsafe_links, checksum};
+  ScannerOptions options = {use_metadata,     chunk_size,
+                            exclude_patterns, exclude_count,
+                            include_patterns, include_count,
+                            max_size,         min_size,
+                            max_depth,        0,
+                            follow_symlinks,  copy_links,
+                            safe_links,       copy_unsafe_links,
+                            checksum,         false};
   return directory_scanner_create_with_options(root_directory, &options);
 }
 
@@ -272,7 +294,7 @@ Chunk* directory_scanner_next(DirectoryScanner* scanner) {
                               scanner->max_depth,        0,
                               scanner->follow_symlinks,  scanner->copy_links,
                               scanner->safe_links,       scanner->copy_unsafe_links,
-                              scanner->checksum};
+                              scanner->checksum,         scanner->one_file_system};
     ScannerEntry inspected;
     int inspection = scanner_inspect_entry(&options, scanner->current_path, scanner->current_path,
                                            entry->d_name, &inspected);
@@ -286,6 +308,10 @@ Chunk* directory_scanner_next(DirectoryScanner* scanner) {
     struct stat stats = inspected.stats;
 
     if (inspected.is_directory) {
+      if (!scanner_same_filesystem(scanner->one_file_system, scanner->root_dev, stats.st_dev)) {
+        free(cur_path);
+        continue;
+      }
       int next_depth = scanner->current_depth + 1;
       if (scanner->max_depth <= 0 || next_depth < scanner->max_depth) {
         DirEntry* de = dir_entry_create(cur_path, next_depth);
@@ -525,7 +551,7 @@ static Chunk* batch_files(ArrayList* files, unsigned long long chunk_size, Queue
 /* Scan one root-directory entry into either the subdirs or files list. */
 static void scan_root_entry(const ScannerOptions* options, const char* root_directory,
                             const struct dirent* entry, ArrayList* root_files, ArrayList* subdirs,
-                            ParallelScanner* ps) {
+                            dev_t root_dev, ParallelScanner* ps) {
   ScannerEntry inspected;
   int inspection =
       scanner_inspect_entry(options, root_directory, root_directory, entry->d_name, &inspected);
@@ -538,6 +564,10 @@ static void scan_root_entry(const ScannerOptions* options, const char* root_dire
   char* cur_path = inspected.path;
   struct stat st = inspected.stats;
   if (inspected.is_directory) {
+    if (!scanner_same_filesystem(options->one_file_system, root_dev, st.st_dev)) {
+      free(cur_path);
+      return;
+    }
     if (!array_list_add(subdirs, cur_path)) {
       free(cur_path);
       ps->failed = true;
@@ -567,8 +597,8 @@ static void scan_root_entry(const ScannerOptions* options, const char* root_dire
 /* Scan the root directory itself, collecting root files and subdirectories.
  * Returns false if the root directory could not be opened. */
 static bool scan_root_directory(ParallelScanner* ps, const char* root_directory,
-                                const ScannerOptions* options, ArrayList* root_files,
-                                ArrayList* subdirs) {
+                                const ScannerOptions* options, dev_t root_dev,
+                                ArrayList* root_files, ArrayList* subdirs) {
   DIR* dir = opendir(root_directory);
   if (!dir) {
     log_perror("Could not open root directory for parallel scan");
@@ -578,7 +608,7 @@ static bool scan_root_directory(ParallelScanner* ps, const char* root_directory,
   while ((entry = readdir(dir)) != NULL) {
     if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
       continue;
-    scan_root_entry(options, root_directory, entry, root_files, subdirs, ps);
+    scan_root_entry(options, root_directory, entry, root_files, subdirs, root_dev, ps);
   }
   closedir(dir);
   return true;
@@ -677,7 +707,20 @@ ParallelScanner* parallel_scanner_create_with_options(const char* root_directory
     return NULL;
   }
 
-  if (!scan_root_directory(ps, root_directory, options, root_files, subdirs)) {
+  dev_t root_dev = 0;
+  if (options->one_file_system) {
+    struct stat root_stats;
+    if (stat(root_directory, &root_stats) != 0) {
+      log_perror("Could not stat source directory");
+      array_list_delete(root_files);
+      array_list_delete(subdirs);
+      parallel_scanner_destroy(ps);
+      return NULL;
+    }
+    root_dev = root_stats.st_dev;
+  }
+
+  if (!scan_root_directory(ps, root_directory, options, root_dev, root_files, subdirs)) {
     array_list_delete(root_files);
     array_list_delete(subdirs);
     parallel_scanner_destroy(ps);

src/client/scanner.h

@@ -6,8 +6,9 @@
 #include "queue.h"
 #include <dirent.h>
 #include <stdbool.h>
-#include <threads.h>
 #include <stdatomic.h>
+#include <sys/types.h>
+#include <threads.h>
 
 typedef struct {
   bool use_metadata;
@@ -25,6 +26,7 @@ typedef struct {
   bool safe_links;
   bool copy_unsafe_links;
   bool checksum;
+  bool one_file_system;
 } ScannerOptions;
 
 typedef struct {
@@ -46,6 +48,8 @@ typedef struct {
   bool safe_links;
   bool copy_unsafe_links;
   bool checksum;
+  bool one_file_system;
+  dev_t root_dev;
   bool failed;
 } DirectoryScanner;
 
@@ -79,6 +83,11 @@ Chunk* directory_scanner_next(DirectoryScanner* scanner);
 bool directory_scanner_failed(const DirectoryScanner* scanner);
 void directory_scanner_destroy(DirectoryScanner* scanner);
 
+/* --one-file-system (-x) decision: a directory entry may be descended into
+ * only when the option is disabled or the entry lives on the same device as
+ * the transfer root. Exposed so tests can exercise the rule directly. */
+bool scanner_same_filesystem(bool one_file_system, dev_t root_device, dev_t entry_device);
+
 ParallelScanner* parallel_scanner_create_with_options(const char* root_directory,
                                                       const ScannerOptions* options,
                                                       ProtocolSession* allocation_session);

src/client/usage.c

@@ -81,12 +81,18 @@ void print_usage(void) {
   printf("  --backup-dir <dir>  Directory for backups (requires --backup)\n");
   printf("  --suffix <str>      Backup suffix (default: ~)\n");
   printf("  --stats             Print transfer statistics at end\n");
+  printf("  -i, --itemize-changes  Print an rsync-style per-file change line\n");
+  printf("  --out-format=FORMAT Output format for changed files (%%f %%n %%l %%b %%M %%%%)\n");
+  printf("  --list-only         List source files instead of transferring\n");
+  printf("  --log-file-format=FORMAT  Per-file log line format (needs --log-file)\n");
   printf("  -h, --human-readable  Print byte sizes in human-readable form\n");
   printf("  --max-depth <n>     Maximum directory depth (0=unlimited)\n");
+  printf("  -x, --one-file-system  Do not cross filesystem boundaries\n");
   printf("  --log-file <path>   Write log messages to file\n");
   printf("  --stderr=MODE       Route logging to stderr: errors or all\n");
   printf("  --partial           Keep partial files on interrupted transfer\n");
   printf("  --partial-dir <dir> Directory for partial files\n");
+  printf("  --temp-dir <dir>    Scratch dir for temp files before atomic install\n");
   printf("  --fastsync-server-path <path>\n");
   printf("                      Path to fastsync-server on remote (default: fastsync-server)\n");
   printf(

src/shared/config.c

@@ -74,6 +74,7 @@ static void config_set_defaults(Config* config) {
   config->preserve_sparse = false;
   config->itemize_changes = false;
   config->out_format = NULL;
+  config->log_file_format = NULL;
   config->info_level = 0;
   config->debug_level = 0;
   config->list_only = false;
@@ -93,6 +94,7 @@ static void config_set_defaults(Config* config) {
   config->files_from = NULL;
   config->cvs_exclude = false;
   config->prune_empty_dirs = false;
+  config->one_file_system = false;
   config->relative = false;
   config->rsh_command = NULL;
   config->rsync_path = NULL;
@@ -223,6 +225,7 @@ void config_delete(Config* config) {
   free(config->backup_dir);
   free(config->server_host);
   free(config->out_format);
+  free(config->log_file_format);
   free(config->files_from);
   free(config->rsh_command);
   free(config->rsync_path);

src/shared/config.h

@@ -79,6 +79,7 @@ typedef struct Config {
   // Issue #122: Output/logging options
   bool itemize_changes;
   char* out_format;
+  char* log_file_format;
   int info_level;
   int debug_level;
   bool list_only;
@@ -104,6 +105,7 @@ typedef struct Config {
   char* files_from;
   bool cvs_exclude;
   bool prune_empty_dirs;
+  bool one_file_system; /* -x/--one-file-system: do not cross filesystem boundaries */
   bool relative;
 
   // Issue #130: Remote shell/connection options

src/shared/file.c

@@ -2,6 +2,7 @@
 #include <fcntl.h>
 #include <libgen.h>
 #include <limits.h>
+#include <stdatomic.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -30,6 +31,17 @@ static bool write_all(int fd, const void* data, unsigned long long size) {
   return true;
 }
 
+/* Process-wide counter for scratch temp names.  A --temp-dir scratch directory
+   is flat: different destinations that share a basename must never race onto
+   the same temp name.  Deriving the trailing number from a global atomic
+   sequence keeps every temp name unique across the whole scratch directory
+   even when several threads write concurrently, so the O_EXCL creation loop
+   below almost never needs a retry. */
+static unsigned long long next_temp_sequence(void) {
+  static atomic_ullong sequence;
+  return atomic_fetch_add_explicit(&sequence, 1, memory_order_relaxed);
+}
+
 bool file_checksum(File* file, uint64_t* checksum) {
   if (!file || !checksum || !file->data)
     return false;
@@ -326,10 +338,36 @@ bool file_rename_secure(const char* old_path, const char* new_path) {
   return ok;
 }
 
+/* Open the configured --temp-dir scratch directory, creating it (and any
+   missing path components) on demand.  scratch_path is expected to already be
+   confined below the authorized root by the caller; file_open_secure_parent
+   re-checks that confinement and rejects `..` components, so a scratch
+   directory can never be created or opened outside the destination root.
+   Returns an O_DIRECTORY|O_NOFOLLOW fd, or -1 on error. */
+static int file_open_scratch_dir(const char* scratch_path) {
+  if (!scratch_path)
+    return -1;
+  char* leaf = NULL;
+  int parent_fd = file_open_secure_parent(scratch_path, &leaf, true);
+  if (parent_fd < 0)
+    return -1;
+  int fd = openat(parent_fd, leaf, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+  if (fd < 0 && errno == ENOENT) {
+    /* A scratch directory holds transient working copies only; keep it
+       private (0700) so other users cannot race on temp names inside it. */
+    if (mkdirat(parent_fd, leaf, 0700) == 0 || errno == EEXIST)
+      fd = openat(parent_fd, leaf, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+  }
+  close(parent_fd);
+  free(leaf);
+  return fd;
+}
+
 static bool file_to_disk_secure_impl(const char* path, const void* data,
                                      unsigned long long data_size, bool inplace, bool sparse,
                                      const FileMetadata* metadata, bool preserve_executability,
-                                     bool update, bool no_replace, bool use_fsync) {
+                                     bool update, bool no_replace, bool use_fsync,
+                                     const char* temp_dir) {
   char* leaf = NULL;
   int dirfd = file_open_secure_parent(path, &leaf, true);
   if (dirfd < 0)
@@ -337,6 +375,8 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
   int fd = -1;
   bool ok = false;
   if (inplace) {
+    /* --inplace writes directly into the destination; a scratch --temp-dir
+       does not apply and must never redirect these writes. */
     fd = openat(dirfd, leaf, O_WRONLY | O_CREAT | O_CLOEXEC | O_NOFOLLOW, 0644);
     if (fd >= 0) {
       struct stat destination_stat;
@@ -372,7 +412,8 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
       }
     }
   } else {
-    char tmp[NAME_MAX];
+    /* The --update newer-destination check runs first so a skipped file never
+       creates an empty scratch directory behind it. */
     if (update && metadata) {
       /* This check protects the normal atomic path as far as possible.  A
          concurrent replacement can still occur before the final rename. */
@@ -384,11 +425,59 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
         return true;
       }
     }
-    for (unsigned int i = 0; i < 100 && !ok; ++i) {
-      snprintf(tmp, sizeof(tmp), ".%s.tmp.%ld.%u", leaf, (long)getpid(), i);
-      fd = openat(dirfd, tmp, O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC | O_NOFOLLOW, 0600);
+    /* Scratch directory for the temporary working copy.  When NULL the temp
+       file is created in the destination directory, exactly as historically. */
+    int scratch_dirfd = -1;
+    if (temp_dir) {
+      scratch_dirfd = file_open_scratch_dir(temp_dir);
+      if (scratch_dirfd < 0) {
+        int saved_errno = errno;
+        log_message(LOG_LEVEL_ERROR, "could not open --temp-dir scratch directory '%s': %s",
+                    temp_dir, strerror(saved_errno));
+        close(dirfd);
+        free(leaf);
+        return false;
+      }
+    }
+    /* Temp names can exceed NAME_MAX for basenames near the limit (leaf plus
+       the ".tmp.<pid>.<n>" decoration); heap-size the buffer instead of
+       truncating into a fixed array, which would silently collide in a flat
+       scratch directory.  The sizing sentinel is the widest value of each
+       format. */
+    int tmp_size;
+    if (scratch_dirfd >= 0)
+      tmp_size = snprintf(NULL, 0, ".%s.tmp.%ld.%llu", leaf, (long)getpid(), ~0ULL);
+    else
+      tmp_size = snprintf(NULL, 0, ".%s.tmp.%ld.%u", leaf, (long)getpid(), 999U);
+    if (tmp_size < 0) {
+      if (scratch_dirfd >= 0)
+        close(scratch_dirfd);
+      close(dirfd);
+      free(leaf);
+      return false;
+    }
+    char* tmp = malloc((size_t)tmp_size + 1);
+    if (!tmp) {
+      if (scratch_dirfd >= 0)
+        close(scratch_dirfd);
+      close(dirfd);
+      free(leaf);
+      return false;
+    }
+    for (unsigned int i = 0; i < 100; ++i) {
+      /* The temp name is created inside the scratch directory (when one is
+         configured) and, on success, atomically renamed into the destination
+         directory.  In a shared scratch directory the atomic sequence number
+         keeps the name unique even for destinations with a common basename. */
+      if (scratch_dirfd >= 0)
+        snprintf(tmp, (size_t)tmp_size + 1, ".%s.tmp.%ld.%llu", leaf, (long)getpid(),
+                 next_temp_sequence());
+      else
+        snprintf(tmp, (size_t)tmp_size + 1, ".%s.tmp.%ld.%u", leaf, (long)getpid(), i);
+      fd = openat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp,
+                  O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC | O_NOFOLLOW, 0600);
       if (fd < 0)
-        continue;
+        continue; /* EEXIST (or a transient open error): try a fresh name. */
       if (sparse && data_size > 0)
         ok = ftruncate(fd, (off_t)data_size) == 0;
       if (ok || (!sparse || data_size == 0))
@@ -404,19 +493,37 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
         if (no_replace) {
           /* The probe and commit cannot be one operation. A concurrent
              creator may win; EEXIST is then the requested skip. */
-          if (linkat(dirfd, tmp, dirfd, leaf, 0) == 0 || errno == EEXIST) {
-            if (unlinkat(dirfd, tmp, 0) != 0 && errno != ENOENT)
+          if (linkat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, dirfd, leaf, 0) == 0 ||
+              errno == EEXIST) {
+            if (unlinkat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, 0) != 0 &&
+                errno != ENOENT)
               ok = false;
           } else {
+            if (scratch_dirfd >= 0 && errno == EXDEV)
+              log_message(LOG_LEVEL_ERROR,
+                          "temp dir is on a different filesystem than the destination; cannot "
+                          "link file into place (EXDEV); no fallback copy is attempted");
             ok = false;
           }
-        } else if (renameat(dirfd, tmp, dirfd, leaf) != 0) {
+        } else if (renameat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, dirfd, leaf) != 0) {
+          if (scratch_dirfd >= 0 && errno == EXDEV)
+            log_message(LOG_LEVEL_ERROR,
+                        "temp dir is on a different filesystem than the destination; cannot "
+                        "atomically install file (EXDEV); no fallback copy is attempted");
           ok = false;
         }
       }
       if (!ok)
-        unlinkat(dirfd, tmp, 0);
+        unlinkat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, 0);
+      /* Once the temp fd was created the outcome is permanent: a write,
+         metadata, fsync, close, linkat or renameat failure will not be fixed
+         by retrying under a fresh name, so stop here.  Only the open-failure
+         path above retries a new name. */
+      break;
     }
+    free(tmp);
+    if (scratch_dirfd >= 0)
+      close(scratch_dirfd);
   }
   if (fd >= 0)
     close(fd);
@@ -427,36 +534,37 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
 
 bool file_to_disk_secure(const char* path, const void* data, unsigned long long data_size,
                          bool inplace, bool sparse, const FileMetadata* metadata,
-                         bool preserve_executability) {
+                         bool preserve_executability, const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, metadata,
-                                  preserve_executability, false, false, false);
+                                  preserve_executability, false, false, false, temp_dir);
 }
 
 bool file_to_disk_secure_update(const char* path, const void* data, unsigned long long data_size,
                                 bool inplace, bool sparse, const FileMetadata* metadata,
-                                bool preserve_executability) {
+                                bool preserve_executability, const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, metadata,
-                                  preserve_executability, true, false, false);
+                                  preserve_executability, true, false, false, temp_dir);
 }
 
 bool file_to_disk_secure_with_fsync(const char* path, const void* data,
                                     unsigned long long data_size, bool inplace, bool sparse,
                                     const FileMetadata* metadata, bool preserve_executability,
-                                    bool use_fsync) {
+                                    bool use_fsync, const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, metadata,
-                                  preserve_executability, false, false, use_fsync);
+                                  preserve_executability, false, false, use_fsync, temp_dir);
 }
 
 bool file_to_disk_secure_no_replace(const char* path, const void* data,
                                     unsigned long long data_size, bool sparse,
-                                    const FileMetadata* metadata, bool preserve_executability) {
+                                    const FileMetadata* metadata, bool preserve_executability,
+                                    const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, false, sparse, metadata,
-                                  preserve_executability, false, true, false);
+                                  preserve_executability, false, true, false, temp_dir);
 }
 
 bool file_write_to_disk(const char* path, const void* data, unsigned long long data_size,
                         bool inplace, bool sparse) {
   if (!path || (!data && data_size != 0) || has_path_traversal(path))
     return false;
-  return file_to_disk_secure(path, data, data_size, inplace, sparse, NULL, false);
+  return file_to_disk_secure(path, data, data_size, inplace, sparse, NULL, false, NULL);
 }

src/shared/file.h

@@ -31,21 +31,32 @@ bool file_destination_is_newer_secure(const char* path, const FileMetadata* meta
 int file_open_secure_parent(const char* path, char** leaf_out, bool create_dirs);
 bool file_ensure_directory_secure(const char* path);
 bool file_rename_secure(const char* old_path, const char* new_path);
+
+/* The file_to_disk_secure* variants write a temporary copy in the destination
+   directory and atomically rename it over `path`.  temp_dir is an absolute,
+   root-confined scratch directory (already validated by the caller): when it
+   is non-NULL the temporary copy is instead created there (with a name unique
+   across the whole scratch directory) and atomically renamed into the
+   destination directory once fully written and fsynced.  A rename across
+   filesystems (EXDEV) fails the write with an error; the file is never
+   silently copied into place.  Pass NULL for the historical same-directory
+   behavior.  --inplace writes never use temp_dir. */
 bool file_to_disk_secure(const char* path, const void* data, unsigned long long data_size,
                          bool inplace, bool sparse, const FileMetadata* metadata,
-                         bool preserve_executability);
+                         bool preserve_executability, const char* temp_dir);
 bool file_to_disk_secure_with_fsync(const char* path, const void* data,
                                     unsigned long long data_size, bool inplace, bool sparse,
                                     const FileMetadata* metadata, bool preserve_executability,
-                                    bool use_fsync);
+                                    bool use_fsync, const char* temp_dir);
 /* With update enabled, an existing newer destination is left untouched.  The
    check is descriptor-based for inplace writes; atomic replacement still has
    an unavoidable final rename race without filesystem locking. */
 bool file_to_disk_secure_update(const char* path, const void* data, unsigned long long data_size,
                                 bool inplace, bool sparse, const FileMetadata* metadata,
-                                bool preserve_executability);
+                                bool preserve_executability, const char* temp_dir);
 bool file_to_disk_secure_no_replace(const char* path, const void* data,
                                     unsigned long long data_size, bool sparse,
-                                    const FileMetadata* metadata, bool preserve_executability);
+                                    const FileMetadata* metadata, bool preserve_executability,
+                                    const char* temp_dir);
 
 #endif

src/shared/file_receive.c

@@ -37,6 +37,7 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
   const char* backup_suffix = (config && config->suffix) ? config->suffix : "~";
   const char* backup_dir = (config && config->backup_dir) ? config->backup_dir : NULL;
   const char* partial_dir = (config && config->partial_dir) ? config->partial_dir : NULL;
+  const char* temp_dir = (config && config->temp_dir) ? config->temp_dir : NULL;
   bool use_partial_root = partial_dir && config && config->partial;
   char *confined_backup = NULL, *confined_partial = NULL, *disk_path = NULL;
   char* destination_path = NULL;
@@ -52,9 +53,13 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
   }
 
   /* These options arrive from the client.  They are names below the server
-     root, never independent filesystem roots. */
+     root, never independent filesystem roots.  --temp-dir is confined exactly
+     like --backup-dir/--partial-dir: an absolute or `..`-escaping scratch
+     directory is rejected outright so nothing is ever created outside the
+     authorized destination root. */
   if ((backup_dir && (backup_dir[0] == '/' || has_path_traversal(backup_dir))) ||
-      (partial_dir && (partial_dir[0] == '/' || has_path_traversal(partial_dir))))
+      (partial_dir && (partial_dir[0] == '/' || has_path_traversal(partial_dir))) ||
+      (temp_dir && (temp_dir[0] == '/' || has_path_traversal(temp_dir))))
     return FILE_SAVE_ERROR;
   if (backup_dir && !(confined_backup = path_cat(root_directory, backup_dir)))
     return FILE_SAVE_ERROR;
@@ -151,15 +156,37 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
       goto fail;
     metadata = &adjusted_metadata;
   }
-  bool ok = config && config->ignore_existing
-                ? file_to_disk_secure_no_replace(disk_path, file->data->data, file->data->size,
-                                                 sparse, metadata, preserve_executability)
-            : config && config->update
-                ? file_to_disk_secure_update(disk_path, file->data->data, file->data->size, inplace,
-                                             sparse, metadata, preserve_executability)
-                : file_to_disk_secure_with_fsync(disk_path, file->data->data, file->data->size,
-                                                 inplace, sparse, metadata, preserve_executability,
-                                                 config && config->use_fsync);
+
+  /* A configured --temp-dir sends the temporary working copy to a scratch
+     directory resolved below the receive root; the engine then atomically
+     renames the completed file into the final destination directory.  The
+     partial-dir flow already keeps its working copy in a separate directory
+     and --inplace writes directly, so neither diverts through the scratch
+     dir (matching rsync, where --inplace/--partial-dir supersede --temp-dir). */
+  char* confined_temp = NULL;
+  bool use_temp_dir = temp_dir != NULL && !inplace && !use_partial_root;
+  if (use_temp_dir) {
+    confined_temp = path_cat(root_directory, temp_dir);
+    if (!confined_temp)
+      goto fail;
+    /* A user-supplied trailing slash would leave the scratch path ending in
+       "/", which has no final component to create/open.  Normalize it away. */
+    size_t temp_len = strlen(confined_temp);
+    while (temp_len > 1 && confined_temp[temp_len - 1] == '/')
+      confined_temp[--temp_len] = '\0';
+  }
+  bool ok =
+      config && config->ignore_existing
+          ? file_to_disk_secure_no_replace(disk_path, file->data->data, file->data->size, sparse,
+                                           metadata, preserve_executability, confined_temp)
+      : config && config->update
+          ? file_to_disk_secure_update(disk_path, file->data->data, file->data->size, inplace,
+                                       sparse, metadata, preserve_executability, confined_temp)
+          : file_to_disk_secure_with_fsync(disk_path, file->data->data, file->data->size, inplace,
+                                           sparse, metadata, preserve_executability,
+                                           config && config->use_fsync, confined_temp);
+  free(confined_temp);
+  confined_temp = NULL;
   if (!ok)
     goto fail;
 

tests/integration/test_features.py

@@ -2,6 +2,7 @@
 import filecmp
 import os
 import shutil
+import subprocess
 import sys
 import time
 import pytest
@@ -1021,3 +1022,386 @@ class TestLargeFile:
         assert result.returncode == 0, f"Large-file sync failed: {result.stderr[:200]}"
         received = get_dest_received_dir(dest, source)
         assert filecmp.cmp(source_file, os.path.join(received, "big.bin"), shallow=False)
+
+class TestOneFileSystem:
+    def _make_tree(self, source):
+        clean_dir(source)
+        os.makedirs(os.path.join(source, "nested", "deeper"))
+        with open(os.path.join(source, "root.txt"), "wb") as f:
+            f.write(b"root")
+        with open(os.path.join(source, "nested", "inner.txt"), "wb") as f:
+            f.write(b"inner")
+        with open(os.path.join(source, "nested", "deeper", "deep.txt"), "wb") as f:
+            f.write(b"deep")
+
+    def _assert_full_tree_transferred(self, source, dest, port, flags):
+        clean_dir(dest)
+        result, _ = run_client(source, dest, flags=flags, port=port)
+        assert result.returncode == 0, f"Sync failed: {result.stderr[:200]}"
+        received = get_dest_received_dir(dest, source)
+        mismatches, missing = verify_transfer(source, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+    def test_x_transfer_matches_plain_over_single_filesystem(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "ofs_src")
+        self._make_tree(source)
+        self._assert_full_tree_transferred(source, os.path.join(TEST_DATA_DIR, "ofs_dst"),
+                                           shared_server.port, ["-x"])
+
+    def test_x_multithreaded_transfer_matches_plain_over_single_filesystem(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "ofs_m_src")
+        self._make_tree(source)
+        self._assert_full_tree_transferred(source, os.path.join(TEST_DATA_DIR, "ofs_m_dst"),
+                                           shared_server.port, ["-m", "--one-file-system"])
+
+    def test_x_skips_other_device_mountpoint(self, shared_server):
+        if os.geteuid() != 0 or shutil.which("mount") is None or shutil.which("umount") is None:
+            pytest.skip("cross-device test requires root and mount(8)")
+        source = os.path.join(TEST_DATA_DIR, "ofs_mnt_src")
+        dest = os.path.join(TEST_DATA_DIR, "ofs_mnt_dst")
+        dest_plain = os.path.join(TEST_DATA_DIR, "ofs_mnt_plain_dst")
+        mountpoint = os.path.join(source, "external")
+        clean_dir(source)
+        clean_dir(dest)
+        clean_dir(dest_plain)
+        os.makedirs(mountpoint)
+        os.makedirs(os.path.join(source, "nested"))
+        with open(os.path.join(source, "root.txt"), "wb") as f:
+            f.write(b"root")
+        with open(os.path.join(source, "nested", "inner.txt"), "wb") as f:
+            f.write(b"inner")
+        mounted = False
+        unmount_error = ""
+        try:
+            mount = subprocess.run(["mount", "-t", "tmpfs", "tmpfs", mountpoint],
+                                   capture_output=True, text=True)
+            if mount.returncode != 0:
+                pytest.skip(f"cannot mount tmpfs: {mount.stderr.strip()}")
+            mounted = True
+            with open(os.path.join(mountpoint, "away.txt"), "wb") as f:
+                f.write(b"cross device")
+            result, _ = run_client(source, dest, flags=["-x"], port=shared_server.port)
+            assert result.returncode == 0, f"-x sync failed: {result.stderr[:200]}"
+            received = get_dest_received_dir(dest, source)
+            assert os.path.isfile(os.path.join(received, "root.txt"))
+            assert os.path.isfile(os.path.join(received, "nested", "inner.txt"))
+            assert not os.path.exists(os.path.join(received, "external", "away.txt")), \
+                "-x must not cross into the mounted filesystem"
+            result, _ = run_client(source, dest_plain, port=shared_server.port)
+            assert result.returncode == 0, f"plain sync failed: {result.stderr[:200]}"
+            received_plain = get_dest_received_dir(dest_plain, source)
+            assert os.path.isfile(os.path.join(received_plain, "external", "away.txt")), \
+                "without -x the mounted subtree must be transferred"
+        finally:
+            if mounted:
+                umount = subprocess.run(["umount", mountpoint], capture_output=True, text=True)
+                if umount.returncode != 0:
+                    unmount_error = umount.stderr.strip()
+        if unmount_error:
+            pytest.fail(f"test mountpoint {mountpoint} still mounted after umount: {unmount_error}")
+
+
+def _walk_tmp_files(root):
+    """Recursively list *.tmp* leftovers under root (empty if root missing)."""
+    leftovers = []
+    if not os.path.isdir(root):
+        return leftovers
+    for base, _, files in os.walk(root):
+        for name in files:
+            if ".tmp." in name:
+                leftovers.append(os.path.join(base, name))
+    return leftovers
+
+
+class TestTempDir:
+    """--temp-dir=DIR puts the receiver's temporary working copies in a scratch
+    directory below the destination root and atomically renames each completed
+    file into its final destination.  Files sharing a basename across
+    directories exercise the flat scratch namespace."""
+
+    def _make_source(self, name):
+        source = os.path.join(TEST_DATA_DIR, name)
+        clean_dir(source)
+        entries = {
+            "top.txt": b"top level\n",
+            "sub/file.txt": b"nested file\n" * 20,
+            "other/file.txt": b"other nested file\n",
+            "sub/deep.bin": bytes(range(256)) * 8,
+        }
+        for rel, content in entries.items():
+            full = os.path.join(source, rel)
+            os.makedirs(os.path.dirname(full), exist_ok=True)
+            with open(full, "wb") as fh:
+                fh.write(content)
+        return source
+
+    def _assert_clean_scratch(self, scratch):
+        assert os.path.isdir(scratch), f"scratch dir {scratch} was not created"
+        leftovers = _walk_tmp_files(scratch)
+        assert leftovers == [], f"leftover temp files in scratch dir: {leftovers}"
+
+    @pytest.mark.parametrize("mt", [False, True])
+    def test_temp_dir_scratch(self, shared_server, mt):
+        source = self._make_source("tempdir_src")
+        dest = os.path.join(TEST_DATA_DIR, "tempdir_dst")
+        clean_dir(dest)
+        flags = ["--temp-dir=scratch"] + (["-m"] if mt else [])
+        result, _ = run_client(source, dest, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, f"temp-dir sync failed: {result.stderr[:200]}"
+        received = get_dest_received_dir(dest, source)
+        mismatches, missing = verify_transfer(source, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+        self._assert_clean_scratch(os.path.join(dest, "scratch"))
+
+    def test_default_behavior_has_no_scratch_dir(self, shared_server):
+        source = self._make_source("tempdir_default_src")
+        dest = os.path.join(TEST_DATA_DIR, "tempdir_default_dst")
+        clean_dir(dest)
+        result, _ = run_client(source, dest, port=shared_server.port)
+        assert result.returncode == 0, f"Default sync failed: {result.stderr[:200]}"
+        received = get_dest_received_dir(dest, source)
+        mismatches, missing = verify_transfer(source, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+        assert not os.path.exists(os.path.join(dest, "scratch"))
+
+    def test_temp_dir_ignored_with_inplace(self, shared_server):
+        """--inplace writes directly into the destination; --temp-dir must not
+        redirect those writes into a scratch dir."""
+        source = self._make_source("tempdir_inplace_src")
+        dest = os.path.join(TEST_DATA_DIR, "tempdir_inplace_dst")
+        clean_dir(dest)
+        result, _ = run_client(source, dest,
+                               flags=["--inplace", "--temp-dir=scratch"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"inplace+temp-dir sync failed: {result.stderr[:200]}"
+        received = get_dest_received_dir(dest, source)
+        mismatches, missing = verify_transfer(source, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+        assert not os.path.exists(os.path.join(dest, "scratch")), \
+            "--inplace wrote through the scratch dir"
+
+    def test_temp_dir_ignored_with_partial_dir(self, shared_server):
+        """--partial --partial-dir already stages in a separate directory;
+        --temp-dir must not be used on top of it."""
+        source = self._make_source("tempdir_partial_src")
+        dest = os.path.join(TEST_DATA_DIR, "tempdir_partial_dst")
+        clean_dir(dest)
+        result, _ = run_client(source, dest,
+                               flags=["--partial", "--partial-dir", ".partial",
+                                      "--temp-dir=scratch"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"partial+temp-dir sync failed: {result.stderr[:200]}"
+        received = get_dest_received_dir(dest, source)
+        mismatches, missing = verify_transfer(source, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+        partial = os.path.join(dest, ".partial",
+                               os.path.relpath(os.path.join(source, "top.txt"), os.path.sep))
+        assert not os.path.exists(partial), "completed file remained under the partial dir"
+        assert not os.path.exists(os.path.join(dest, "scratch")), \
+            "--partial-dir wrote through the scratch dir"
+
+    def test_temp_dir_escape_rejected(self, shared_server):
+        source = self._make_source("tempdir_escape_src")
+        dest = os.path.join(TEST_DATA_DIR, "tempdir_escape_dst")
+        clean_dir(dest)
+        # "../escape" would resolve one level above the destination root.
+        outside = os.path.join(TEST_DATA_DIR, "escape")
+        assert not os.path.lexists(outside)
+
+        result, _ = run_client(source, dest, flags=["--temp-dir=../escape"],
+                               port=shared_server.port)
+        assert result.returncode != 0, "relative escaping --temp-dir was not rejected"
+        assert not os.path.lexists(outside), "file created outside the destination root"
+
+        clean_dir(dest)
+        abs_escape = os.path.join(TEST_DATA_DIR, "abs_escape_probe")
+        assert not os.path.lexists(abs_escape)
+        result, _ = run_client(source, dest, flags=["--temp-dir", abs_escape],
+                               port=shared_server.port)
+        assert result.returncode != 0, "absolute --temp-dir was not rejected"
+        assert not os.path.lexists(abs_escape), "file created outside the destination root"
+
+
+def _source_files():
+    """All source paths (absolute) that a transfer would send right now."""
+    return [
+        os.path.join(root, name)
+        for root, _dirs, names in os.walk(SOURCE_DIR)
+        for name in names
+    ]
+
+
+class TestListOnly:
+    """--list-only prints every transfer candidate and changes nothing."""
+
+    def test_list_only_prints_each_file_and_does_not_transfer(self):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["--list-only"])
+        assert result.returncode == 0, f"list-only failed: {result.stderr[:200]}"
+        for full_path in _source_files():
+            assert full_path in result.stdout, f"list-only omitted {full_path}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert not os.path.exists(received), "list-only wrote to the destination"
+
+    def test_list_only_with_dry_run_does_not_error(self):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["--list-only", "--dry-run"])
+        assert result.returncode == 0, f"list-only -n failed: {result.stderr[:200]}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert not os.path.exists(received)
+
+    def test_list_only_multithreaded(self):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["--list-only", "-m"])
+        assert result.returncode == 0, f"list-only -m failed: {result.stderr[:200]}"
+        for full_path in _source_files():
+            assert full_path in result.stdout, f"list-only -m omitted {full_path}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert not os.path.exists(received), "list-only -m wrote to the destination"
+
+
+class TestItemizeChanges:
+    """-i/--itemize-changes prints rsync-style lines only for files sent."""
+
+    def test_first_run_prints_sent_lines(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["-M", "-i"], port=shared_server.port)
+        assert result.returncode == 0, f"itemize sync failed: {result.stderr[:200]}"
+        sent_lines = {">f+++++++++ " + p for p in _source_files()}
+        assert sent_lines <= set(result.stdout.splitlines()), (
+            f"missing itemize lines; got {result.stdout[:500]}"
+        )
+
+    def test_incremental_second_run_prints_no_line_for_unchanged(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0, f"seed sync failed: {result.stderr[:200]}"
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["-M", "-i", "--incremental"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"incremental itemize failed: {result.stderr[:200]}"
+        itemized = [line for line in result.stdout.splitlines() if line and line[0] in ">.<c"]
+        assert itemized == [], f"unchanged files were itemized: {itemized[:5]}"
+
+    def test_multithreaded_emits_same_itemize_lines(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["-M", "-i", "-m"], port=shared_server.port)
+        assert result.returncode == 0, f"itemize -m sync failed: {result.stderr[:200]}"
+        sent_lines = {">f+++++++++ " + p for p in _source_files()}
+        assert sent_lines <= set(result.stdout.splitlines()), (
+            f"missing itemize lines in -m mode; got {result.stdout[:500]}"
+        )
+
+    def test_dry_run_with_itemize_does_not_error(self):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-i", "--dry-run"])
+        assert result.returncode == 0, f"dry-run -i failed: {result.stderr[:200]}"
+
+    def test_changed_file_on_second_incremental_run_prints_exactly_one_line(self, shared_server):
+        """A changed file itemizes exactly once on an incremental rerun while
+        unchanged files print nothing (no double emission)."""
+        source = os.path.join(TEST_DATA_DIR, "itemize_change_src")
+        dest = os.path.join(TEST_DATA_DIR, "itemize_change_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        changed = os.path.join(source, "changed.txt")
+        untouched = os.path.join(source, "untouched.txt")
+        with open(changed, "wb") as fh:
+            fh.write(b"original\n")
+        with open(untouched, "wb") as fh:
+            fh.write(b"stable\n")
+
+        result, _ = run_client(source, dest, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0, f"seed sync failed: {result.stderr[:200]}"
+
+        with open(changed, "wb") as fh:
+            fh.write(b"edited payload\n")
+
+        result, _ = run_client(source, dest,
+                               flags=["-M", "-i", "--incremental"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"incremental itemize failed: {result.stderr[:200]}"
+        itemized = [line for line in result.stdout.splitlines() if line.startswith(">f")]
+        assert itemized == [">f+++++++++ " + changed], (
+            f"expected exactly one itemize line for {changed}, got {itemized}"
+        )
+        received = get_dest_received_dir(dest, source)
+        assert _read_file(os.path.join(received, "changed.txt")) == b"edited payload\n"
+        assert _read_file(os.path.join(received, "untouched.txt")) == b"stable\n"
+
+
+class TestOutFormat:
+    """--out-format prints a line per transferred file using the template."""
+
+    def test_out_format_path_and_size(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["--out-format=%f %l"], port=shared_server.port)
+        assert result.returncode == 0, f"out-format sync failed: {result.stderr[:200]}"
+        expected = {f"{p} {os.path.getsize(p)}" for p in _source_files()}
+        got = set(result.stdout.splitlines())
+        assert expected <= got, f"out-format lines missing: expected {len(expected)} got {len(got)}"
+
+    def test_out_format_multithreaded_matches_single(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["--out-format=%f %l", "-m"], port=shared_server.port)
+        assert result.returncode == 0, f"out-format -m sync failed: {result.stderr[:200]}"
+        expected = {f"{p} {os.path.getsize(p)}" for p in _source_files()}
+        got = set(result.stdout.splitlines())
+        assert expected <= got, f"out-format -m lines missing: {result.stdout[:500]}"
+
+
+class TestLogFileFormat:
+    """--log-file plus --log-file-format writes per-file lines to the log."""
+
+    def test_log_file_format_writes_transferred_files(self, shared_server):
+        clean_dir(DEST_DIR)
+        log_path = os.path.join(TEST_DATA_DIR, "itemize_transfer.log")
+        if os.path.exists(log_path):
+            os.unlink(log_path)
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--log-file", log_path, "--log-file-format=%f %l"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"log-file sync failed: {result.stderr[:200]}"
+        assert os.path.exists(log_path), "--log-file created no log"
+        with open(log_path, encoding="utf-8", errors="replace") as fh:
+            content = fh.read()
+        expected = {f"{p} {os.path.getsize(p)}" for p in _source_files()}
+        for line in expected:
+            assert line in content, f"log file missing {line!r}"
+
+    def test_log_file_format_multithreaded_writes_transferred_files(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "itemize_log_mt_src")
+        dest = os.path.join(TEST_DATA_DIR, "itemize_log_mt_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        files = {"a.txt": b"alpha\n", "b.txt": b"beta\n"}
+        for rel, data in files.items():
+            with open(os.path.join(source, rel), "wb") as fh:
+                fh.write(data)
+        log_path = os.path.join(TEST_DATA_DIR, "itemize_mt.log")
+        if os.path.exists(log_path):
+            os.unlink(log_path)
+        result, _ = run_client(
+            source,
+            dest,
+            flags=["--log-file", log_path, "--log-file-format=%f %l", "-m"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"log-file -m sync failed: {result.stderr[:200]}"
+        assert os.path.exists(log_path), "--log-file created no log"
+        with open(log_path, encoding="utf-8", errors="replace") as fh:
+            content = fh.read()
+        expected = {f"{os.path.join(source, rel)} {len(data)}" for rel, data in files.items()}
+        for line in expected:
+            assert line in content, f"log file (-m) missing {line!r}"

tests/runner.c

@@ -1,5 +1,6 @@
 #include "test_array_list.h"
 #include "test_chunk.h"
+#include "test_change_list.h"
 #include "test_client_cli.h"
 #include "test_compression.h"
 #include "test_config.h"
@@ -40,6 +41,7 @@ int main() {
   RUN_TEST(test_array_list);
   RUN_TEST(test_shared_utils);
   RUN_TEST(test_chunk);
+  RUN_TEST(test_change_list);
   RUN_TEST(test_config);
   RUN_TEST(test_compression);
   RUN_TEST(test_scanner);

tests/test_change_list.c

@@ -0,0 +1,101 @@
+#include "test_change_list.h"
+#include "change_list.h"
+#include "test_utils.h"
+#include "utils.h"
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+static ChangeEvent sample_event(void) {
+  ChangeEvent event;
+  memset(&event, 0, sizeof(event));
+  event.path = "/srv/root/sub/file.txt";
+  event.decision = CHANGE_SENT;
+  event.is_directory = false;
+  event.size = 12345;
+  event.bytes_sent = 999;
+  event.mtime_sec = 1700000000;
+  return event;
+}
+
+static void test_format_tokens() {
+  ChangeEvent event = sample_event();
+  char* line = change_render_format("%f %n %l %b %M %%", &event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, "/srv/root/sub/file.txt file.txt 12345 999 1700000000 %");
+  free(line);
+}
+
+static void test_format_unknown_tokens_preserved() {
+  ChangeEvent event = sample_event();
+  char* line = change_render_format("x%q=%f%z", &event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, "x%q=/srv/root/sub/file.txt%z");
+  free(line);
+}
+
+static void test_format_leaf_name() {
+  ChangeEvent event = sample_event();
+  event.path = "bare.txt";
+  char* line = change_render_format("%n|%f", &event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, "bare.txt|bare.txt");
+  free(line);
+}
+
+static void test_render_itemize_sent_file() {
+  ChangeEvent event = sample_event();
+  char* line = change_render_itemize(&event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, ">f+++++++++ /srv/root/sub/file.txt");
+  free(line);
+}
+
+static void test_render_itemize_up_to_date_is_empty() {
+  ChangeEvent event = sample_event();
+  event.decision = CHANGE_UP_TO_DATE;
+  char* line = change_render_itemize(&event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, "");
+  free(line);
+}
+
+static void test_render_list_line() {
+  char* line = change_render_list_line(0100644, 4096, 1700000000, "/srv/x.txt");
+  EXPECT_NOT_NULL(line);
+  EXPECT_TRUE(strncmp(line, "-rw-r--r--", 10) == 0);
+  EXPECT_TRUE(strstr(line, "4096") != NULL);
+  EXPECT_TRUE(strstr(line, "/srv/x.txt") != NULL);
+  free(line);
+}
+
+static void test_change_list_enabled() {
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  EXPECT_FALSE(change_list_enabled(config));
+  config->itemize_changes = true;
+  EXPECT_TRUE(change_list_enabled(config));
+  config->itemize_changes = false;
+  config->out_format = str_dup("%f");
+  EXPECT_TRUE(change_list_enabled(config));
+  free(config->out_format);
+  config->out_format = NULL;
+  EXPECT_FALSE(change_list_enabled(config));
+  /* config_delete() closes log_file, so use a throwaway tmpfile. */
+  config->log_file = tmpfile();
+  EXPECT_NOT_NULL(config->log_file);
+  EXPECT_FALSE(change_list_enabled(config)); /* needs a format too */
+  config->log_file_format = str_dup("%n");
+  EXPECT_TRUE(change_list_enabled(config));
+  config_delete(config); /* closes config->log_file */
+}
+
+void test_change_list() {
+  test_format_tokens();
+  test_format_unknown_tokens_preserved();
+  test_format_leaf_name();
+  test_render_itemize_sent_file();
+  test_render_itemize_up_to_date_is_empty();
+  test_render_list_line();
+  test_change_list_enabled();
+}

tests/test_change_list.h

@@ -0,0 +1,6 @@
+#ifndef TEST_CHANGE_LIST_H
+#define TEST_CHANGE_LIST_H
+
+void test_change_list(void);
+
+#endif

tests/test_client_cli.c

@@ -602,10 +602,6 @@ static void test_parse_args_rejects_unimplemented_options() {
                                         "--xattrs",
                                         "-D",
                                         "--devices",
-                                        "-i",
-                                        "--itemize-changes",
-                                        "--out-format",
-                                        "--list-only",
                                         "--append",
                                         "--append-verify",
                                         "--delete-excluded",
@@ -620,7 +616,6 @@ static void test_parse_args_rejects_unimplemented_options() {
                                         "-e",
                                         "--rsh",
                                         "--rsync-path",
-                                        "--temp-dir",
                                         "--compare-dest",
                                         "--copy-dest",
                                         "--link-dest",
@@ -840,6 +835,34 @@ static void test_parse_args_checksum_choice_requires_value() {
   }
 }
 
+/* --temp-dir accepts both the "--temp-dir=DIR" and "--temp-dir DIR" forms. */
+static void test_parse_args_temp_dir() {
+  Config* cfg = config_create();
+  char* equals_argv[] = {"fastsync", "--temp-dir=scratch", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+
+  EXPECT_EQ_INT(parse_args(cfg, 4, equals_argv, positional_args, &positional_count), 0);
+  EXPECT_EQ_STR(cfg->temp_dir, "scratch");
+  EXPECT_EQ_INT(positional_count, 2);
+  config_delete(cfg);
+
+  cfg = config_create();
+  char* space_argv[] = {"fastsync", "--temp-dir", "scratch/sub", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 5, space_argv, positional_args, &positional_count), 0);
+  EXPECT_EQ_STR(cfg->temp_dir, "scratch/sub");
+  EXPECT_EQ_INT(positional_count, 2);
+  config_delete(cfg);
+
+  /* A value-taking option may not be passed without a value. */
+  cfg = config_create();
+  char* missing_argv[] = {"fastsync", "--temp-dir"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 2, missing_argv, positional_args, &positional_count), -1);
+  config_delete(cfg);
+}
+
 static void test_parse_args_old_args() {
   Config* cfg = config_create();
   char* argv[] = {"fastsync", "--old-args", "/src", "/dst"};
@@ -985,6 +1008,35 @@ static void test_parse_args_whole_file() {
   config_delete(cfg);
 }
 
+/* -x and --one-file-system enable client-side single-filesystem scanning. */
+static void test_parse_args_one_file_system() {
+  Config* cfg = config_create();
+  EXPECT_FALSE(cfg->one_file_system);
+
+  char* argv[] = {"fastsync", "-x", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->one_file_system);
+  EXPECT_EQ_INT(positional_count, 2);
+
+  config_delete(cfg);
+  cfg = config_create();
+  char* long_argv[] = {"fastsync", "--one-file-system", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, long_argv, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->one_file_system);
+
+  config_delete(cfg);
+  cfg = config_create();
+  /* Flags never take a value: the "=value" form must be rejected. */
+  char* bad_argv[] = {"fastsync", "--one-file-system=yes", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, bad_argv, positional_args, &positional_count), -1);
+  config_delete(cfg);
+}
+
 /* Test rsync-compatible compression-choice and compression-level aliases. */
 static void test_parse_args_compression_aliases() {
   Config* cfg = config_create();
@@ -1126,7 +1178,8 @@ static void test_parse_args_table_equals_string_and_int_options() {
 /* Options that take a separate value must report "missing argument", not the
  * generic "Unknown option", when they are the final argv entry. */
 static void test_parse_args_missing_argument_diagnostic() {
-  static const char* const options[] = {"--exclude", "--server-port", "--skip-compress", "-T"};
+  static const char* const options[] = {"--exclude", "--server-port", "--skip-compress",
+                                        "-T",        "--out-format",  "--log-file-format"};
 
   for (size_t i = 0; i < sizeof(options) / sizeof(options[0]); i++) {
     Config* cfg = config_create();
@@ -1152,6 +1205,66 @@ static void test_parse_args_missing_argument_diagnostic() {
   }
 }
 
+static void test_parse_args_itemize_changes() {
+  static const char* const flags[] = {"-i", "--itemize-changes"};
+  for (size_t i = 0; i < sizeof(flags) / sizeof(flags[0]); i++) {
+    Config* cfg = config_create();
+    char* argv[] = {"fastsync", (char*)flags[i], "/src", "/dst"};
+    int positional_args[2];
+    int positional_count = 0;
+
+    EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
+    EXPECT_TRUE(cfg->itemize_changes);
+    EXPECT_EQ_INT(positional_count, 2);
+    config_delete(cfg);
+  }
+}
+
+static void test_parse_args_list_only() {
+  Config* cfg = config_create();
+  char* argv[] = {"fastsync", "--list-only", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->list_only);
+  config_delete(cfg);
+}
+
+static void test_parse_args_out_format() {
+  Config* cfg = config_create();
+  char* argv[] = {"fastsync", "--out-format=%f %l", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
+  EXPECT_EQ_STR(cfg->out_format, "%f %l");
+  config_delete(cfg);
+
+  cfg = config_create();
+  char* separate_argv[] = {"fastsync", "--out-format", "%f %l", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 5, separate_argv, positional_args, &positional_count), 0);
+  EXPECT_EQ_STR(cfg->out_format, "%f %l");
+  config_delete(cfg);
+}
+
+static void test_parse_args_log_file_format() {
+  Config* cfg = config_create();
+  char* argv[] = {"fastsync", "--log-file-format=%n %M", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
+  EXPECT_EQ_STR(cfg->log_file_format, "%n %M");
+  config_delete(cfg);
+
+  cfg = config_create();
+  char* separate_argv[] = {"fastsync", "--log-file-format", "%n %M", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 5, separate_argv, positional_args, &positional_count), 0);
+  EXPECT_EQ_STR(cfg->log_file_format, "%n %M");
+  config_delete(cfg);
+}
+
 void test_client_cli() {
   test_validate_config_required_paths();
   test_validate_config_incompatible_options();
@@ -1213,6 +1326,7 @@ void test_client_cli() {
   test_parse_args_secluded_args();
   test_parse_args_short_s_remains_chunk_serialization();
   test_parse_args_whole_file();
+  test_parse_args_one_file_system();
   test_parse_args_compression_aliases();
   test_parse_args_compression_equals_and_none();
   test_parse_args_compression_canonical_equals();
@@ -1223,6 +1337,11 @@ void test_client_cli() {
   test_parse_args_table_equals_string_and_int_options();
   test_parse_args_missing_argument_diagnostic();
   test_parse_args_partial_progress();
+  test_parse_args_itemize_changes();
+  test_parse_args_list_only();
+  test_parse_args_out_format();
+  test_parse_args_log_file_format();
   test_parse_args_checksum_choice_aliases();
   test_parse_args_checksum_choice_requires_value();
+  test_parse_args_temp_dir();
 }

tests/test_config.c

@@ -381,6 +381,30 @@ static void test_config_string_null_vs_empty_roundtrip() {
   config_delete(c);
 }
 
+/* A --temp-dir value must survive config_send/config_receive unchanged on the
+   receive side (round-trips through the resume-options wire block). */
+static void test_config_temp_dir_roundtrip() {
+  if (is_running_under_valgrind())
+    return;
+  Config* c = config_create();
+  EXPECT_NOT_NULL(c);
+  c->send_directory = str_dup("/src");
+  c->receive_root_directory = str_dup("/dst");
+  c->temp_dir = str_dup("scratch");
+  EXPECT_TRUE(roundtrip_config_ok(c));
+  config_delete(c);
+
+  /* An empty-STRING wire value is canonicalized back to NULL (never an empty
+     scratch-dir name). */
+  c = config_create();
+  EXPECT_NOT_NULL(c);
+  c->send_directory = str_dup("/src");
+  c->receive_root_directory = str_dup("/dst");
+  c->temp_dir = str_dup("");
+  EXPECT_TRUE(roundtrip_config_ok(c));
+  config_delete(c);
+}
+
 static void test_config_is_remote_dest() {
   /* Valid SSH-style destinations */
   EXPECT_TRUE(config_is_remote_dest("user@host:/path"));
@@ -415,6 +439,7 @@ void test_config() {
     test_config_send_receive_version_mismatch();
     test_config_receive_truncated();
     test_config_string_null_vs_empty_roundtrip();
+    test_config_temp_dir_roundtrip();
   }
   test_config_is_remote_dest();
 }

tests/test_file.c

@@ -381,7 +381,7 @@ static void test_file_write_to_disk_with_fsync() {
   const char* path = "test_file_write_to_disk_fsync.txt";
   const char* content = "fsync file content";
   EXPECT_TRUE(file_to_disk_secure_with_fsync(path, content, strlen(content), false, false, NULL,
-                                             false, true));
+                                             false, true, NULL));
   struct stat st;
   EXPECT_EQ_INT(stat(path, &st), 0);
   EXPECT_EQ_INT((int)st.st_size, (int)strlen(content));

tests/test_scanner.c

@@ -394,8 +394,8 @@ static void test_parallel_scanner_root_chunks_without_workers() {
   create_test_file(file1, "a");
   create_test_file(file2, "b");
 
-  ScannerOptions options = {false, 1, NULL,  0,     NULL,  0,     0,    0,
-                            0,     0, false, false, false, false, false};
+  ScannerOptions options = {false, 1, NULL,  0,     NULL,  0,     0,     0,
+                            0,     0, false, false, false, false, false, false};
   ParallelScanner* scanner = parallel_scanner_create_with_options(dir, &options, NULL);
   EXPECT_NOT_NULL(scanner);
 
@@ -414,6 +414,245 @@ static void test_parallel_scanner_root_chunks_without_workers() {
   rmdir(dir);
 }
 
+/* --one-file-system (-x) decision is a pure device comparison. */
+static void test_scanner_one_file_system_decision() {
+  /* Option disabled: every device is allowed (unchanged default behavior). */
+  EXPECT_TRUE(scanner_same_filesystem(false, 0, 123));
+  EXPECT_TRUE(scanner_same_filesystem(false, 7, 999));
+  /* Option enabled: only entries on the root device may be descended into. */
+  EXPECT_TRUE(scanner_same_filesystem(true, 7, 7));
+  EXPECT_FALSE(scanner_same_filesystem(true, 7, 8));
+}
+
+/* With -x over an ordinary tree (all one device) nothing may be skipped. */
+static void test_scanner_one_file_system_same_device() {
+  const char* root = "test_scan_ofs";
+  const char* sub = "test_scan_ofs/sub";
+  const char* deeper = "test_scan_ofs/sub/deeper";
+  const char* root_file = "test_scan_ofs/root.txt";
+  const char* sub_file = "test_scan_ofs/sub/inner.txt";
+  const char* deep_file = "test_scan_ofs/sub/deeper/deep.txt";
+
+  EXPECT_EQ_INT(mkdir(root, 0755), 0);
+  EXPECT_EQ_INT(mkdir(sub, 0755), 0);
+  EXPECT_EQ_INT(mkdir(deeper, 0755), 0);
+  create_test_file(root_file, "root");
+  create_test_file(sub_file, "inner");
+  create_test_file(deep_file, "deep");
+
+  ScannerOptions options = {0};
+  options.one_file_system = true;
+  DirectoryScanner* scanner = directory_scanner_create_with_options(root, &options);
+  EXPECT_NOT_NULL(scanner);
+
+  int total_files = 0;
+  Chunk* chunk;
+  while ((chunk = directory_scanner_next(scanner)) != NULL) {
+    total_files += chunk->element_count;
+    chunk_destroy(chunk);
+  }
+  EXPECT_EQ_INT(total_files, 3);
+  EXPECT_FALSE(directory_scanner_failed(scanner));
+
+  directory_scanner_destroy(scanner);
+  unlink(root_file);
+  unlink(sub_file);
+  unlink(deep_file);
+  rmdir(deeper);
+  rmdir(sub);
+  rmdir(root);
+}
+
+/* Multithreaded (-m) scan with -x over a single-device tree must match the
+ * single-threaded result. */
+static void test_parallel_scanner_one_file_system_same_device() {
+  const char* root = "test_parallel_scan_ofs";
+  const char* sub = "test_parallel_scan_ofs/sub";
+  const char* sub2 = "test_parallel_scan_ofs/sub2";
+  const char* root_file = "test_parallel_scan_ofs/root.txt";
+  const char* sub_file = "test_parallel_scan_ofs/sub/inner.txt";
+  const char* sub2_file = "test_parallel_scan_ofs/sub2/inner2.txt";
+
+  EXPECT_EQ_INT(mkdir(root, 0755), 0);
+  EXPECT_EQ_INT(mkdir(sub, 0755), 0);
+  EXPECT_EQ_INT(mkdir(sub2, 0755), 0);
+  create_test_file(root_file, "root");
+  create_test_file(sub_file, "inner");
+  create_test_file(sub2_file, "inner2");
+
+  ScannerOptions options = {0};
+  options.one_file_system = true;
+  options.num_threads = 2;
+  ParallelScanner* scanner = parallel_scanner_create_with_options(root, &options, NULL);
+  EXPECT_NOT_NULL(scanner);
+
+  int total_files = 0;
+  Chunk* chunk;
+  while ((chunk = parallel_scanner_next(scanner)) != NULL) {
+    total_files += chunk->element_count;
+    chunk_destroy(chunk);
+  }
+  EXPECT_EQ_INT(total_files, 3);
+  EXPECT_FALSE(parallel_scanner_failed(scanner));
+
+  parallel_scanner_destroy(scanner);
+  unlink(root_file);
+  unlink(sub_file);
+  unlink(sub2_file);
+  rmdir(sub);
+  rmdir(sub2);
+  rmdir(root);
+}
+
+/* Scan a tree with copy_links semantics, collecting every emitted path.
+ * Returns 0 on success, -1 on scanner failure. */
+static int collect_directory_scan(const char* root, bool one_file_system, const char* needle,
+                                  bool* found, int* total) {
+  ScannerOptions options = {0};
+  options.copy_links = true;
+  options.one_file_system = one_file_system;
+  DirectoryScanner* scanner = directory_scanner_create_with_options(root, &options);
+  if (!scanner)
+    return -1;
+  *found = false;
+  *total = 0;
+  Chunk* chunk;
+  while ((chunk = directory_scanner_next(scanner)) != NULL) {
+    for (int i = 0; i < chunk->element_count; i++) {
+      (*total)++;
+      if (strstr(chunk->items[i]->path, needle) != NULL)
+        *found = true;
+    }
+    chunk_destroy(chunk);
+  }
+  bool failed = directory_scanner_failed(scanner);
+  directory_scanner_destroy(scanner);
+  return failed ? -1 : 0;
+}
+
+static int collect_parallel_scan(const char* root, bool one_file_system, const char* needle,
+                                 bool* found, int* total) {
+  ScannerOptions options = {0};
+  options.copy_links = true;
+  options.one_file_system = one_file_system;
+  options.num_threads = 2;
+  ParallelScanner* scanner = parallel_scanner_create_with_options(root, &options, NULL);
+  if (!scanner)
+    return -1;
+  *found = false;
+  *total = 0;
+  Chunk* chunk;
+  while ((chunk = parallel_scanner_next(scanner)) != NULL) {
+    for (int i = 0; i < chunk->element_count; i++) {
+      (*total)++;
+      if (strstr(chunk->items[i]->path, needle) != NULL)
+        *found = true;
+    }
+    chunk_destroy(chunk);
+  }
+  bool failed = parallel_scanner_failed(scanner);
+  parallel_scanner_destroy(scanner);
+  return failed ? -1 : 0;
+}
+
+/* Rootless cross-filesystem test: a symlink nested under the scan root points
+ * at a directory on another device (typically /dev/shm, a tmpfs distinct from
+ * the build filesystem). With --copy-links semantics the scanner resolves the
+ * link and must descend into it only when -x is off. The nested placement
+ * exercises the skip decision in the sequential walker and in the parallel
+ * worker (depth > 1). Skips when no cross-device target is available. */
+static void test_scanner_one_file_system_cross_device() {
+  struct stat local_stat;
+  if (stat(".", &local_stat) != 0)
+    return;
+
+  char shm_dir[64] = "/dev/shm/fastsync_ofs_shm_XXXXXX";
+  if (mkdtemp(shm_dir) == NULL)
+    return;
+  struct stat shm_stat;
+  if (stat(shm_dir, &shm_stat) != 0 || shm_stat.st_dev == local_stat.st_dev) {
+    rmdir(shm_dir);
+    return;
+  }
+
+  char root_dir[64] = "./fastsync_ofs_root_XXXXXX";
+  if (mkdtemp(root_dir) == NULL) {
+    rmdir(shm_dir);
+    return;
+  }
+
+  char nested[96];
+  snprintf(nested, sizeof(nested), "%s/nested", root_dir);
+  char link_path[128];
+  snprintf(link_path, sizeof(link_path), "%s/link", nested);
+  char root_file[96];
+  snprintf(root_file, sizeof(root_file), "%s/keep.txt", root_dir);
+  char shm_file[96];
+  snprintf(shm_file, sizeof(shm_file), "%s/inside.txt", shm_dir);
+
+  bool ready = mkdir(nested, 0755) == 0 && symlink(shm_dir, link_path) == 0;
+  if (ready) {
+    create_test_file(root_file, "keep");
+    create_test_file(shm_file, "cross");
+  }
+
+  int seq_off_rc, seq_off_total, seq_on_rc, seq_on_total;
+  bool seq_off_found, seq_on_found;
+  int par_off_rc, par_off_total, par_on_rc, par_on_total;
+  bool par_off_found, par_on_found;
+  if (!ready) {
+    seq_off_rc = seq_on_rc = par_off_rc = par_on_rc = -1;
+    seq_off_total = seq_on_total = par_off_total = par_on_total = 0;
+    seq_off_found = seq_on_found = par_off_found = par_on_found = false;
+  } else {
+    int rc, total;
+    bool found;
+    rc = collect_directory_scan(root_dir, false, "inside.txt", &found, &total);
+    seq_off_rc = rc;
+    seq_off_total = total;
+    seq_off_found = found;
+    rc = collect_directory_scan(root_dir, true, "inside.txt", &found, &total);
+    seq_on_rc = rc;
+    seq_on_total = total;
+    seq_on_found = found;
+    rc = collect_parallel_scan(root_dir, false, "inside.txt", &found, &total);
+    par_off_rc = rc;
+    par_off_total = total;
+    par_off_found = found;
+    rc = collect_parallel_scan(root_dir, true, "inside.txt", &found, &total);
+    par_on_rc = rc;
+    par_on_total = total;
+    par_on_found = found;
+  }
+
+  /* Hermetic cleanup regardless of scan outcome, before any assertions. */
+  unlink(shm_file);
+  rmdir(shm_dir);
+  unlink(link_path);
+  unlink(root_file);
+  rmdir(nested);
+  rmdir(root_dir);
+
+  if (!ready)
+    return;
+
+  /* Sequential: without -x the symlinked foreign subtree is included. */
+  EXPECT_EQ_INT(seq_off_rc, 0);
+  EXPECT_TRUE(seq_off_found);
+  EXPECT_EQ_INT(seq_off_total, 2);
+  /* Sequential: with -x the cross-device subtree is dropped, keep.txt remains. */
+  EXPECT_EQ_INT(seq_on_rc, 0);
+  EXPECT_FALSE(seq_on_found);
+  EXPECT_EQ_INT(seq_on_total, 1);
+  /* Parallel: same behavior, worker path (depth > 1). */
+  EXPECT_EQ_INT(par_off_rc, 0);
+  EXPECT_TRUE(par_off_found);
+  EXPECT_EQ_INT(par_off_total, 2);
+  EXPECT_EQ_INT(par_on_rc, 0);
+  EXPECT_FALSE(par_on_found);
+  EXPECT_EQ_INT(par_on_total, 1);
+}
+
 void test_scanner() {
   test_scanner_single_file();
   test_scanner_multiple_files();
@@ -429,4 +668,8 @@ void test_scanner() {
   test_scanner_mixed_patterns();
   test_scanner_no_patterns();
   test_parallel_scanner_root_chunks_without_workers();
+  test_scanner_one_file_system_decision();
+  test_scanner_one_file_system_same_device();
+  test_parallel_scanner_one_file_system_same_device();
+  test_scanner_one_file_system_cross_device();
 }