Release v2.28.0

- rsync-parity cycle: differential parity gate + tracks 1-6
- protocol 2.28.0 (batched wire changes)
- --delete defaults to delete-during; new --delete-commit, --verify-basis
- parity matrix 116/14/27 of 157
- tested: unit, integration, ASan, strict differential parity

CHANGELOG.md

@@ -4,7 +4,45 @@ All notable changes to FastSync are documented here. Versions match
 `PROTOCOL_VERSION` (printed by `fastsync --version`); the client and server must
 run the same version because the handshake is strict.
 
-## [Unreleased]
+## [2.28.0] - 2026-09-20
+
+The rsync-parity cycle. `PROTOCOL_VERSION` moves `2.26.0 → 2.27.0 → 2.28.0`;
+client and server must run the same version (the handshake is strict). See
+`RSYNC_COMPAT.md` for the per-option matrix, now **116 ✅ / 14 ⚠️ / 27 ❌** of
+157 rows.
+
+### Added
+
+- **Differential rsync 3.4.1 parity gate** (`tests/integration/
+  test_differential_parity.py`, `parity_harness.py`, `parity_caveats.py`): runs
+  real `rsync` and FastSync over generated corpora and diffs the destination
+  tree, normalized stdout and exit code. A fast subset runs on pull requests and
+  the full strict set on push; the residual allowlist is empty.
+- FastSync-only long option **`--verify-basis`**: require a
+  `--compare-dest`/`--copy-dest`/`--link-dest` hit to match the source by
+  whole-file digest instead of trusting the size+mtime quick-check.
+- FastSync-only long option **`--delete-commit`** (implies `--delete`): the old
+  atomic late whole-tree commit.
+- `--bwlimit` now parses rsync's units exactly and paces like rsync's leaky
+  bucket; `--ignore-errors` reproduces rsync's skip-unreadable-subdir and
+  IO-error-suppressed deletion (exit 23).
+- `--info=name/flist/del/remove/nonreg/progress` emit rsync's line format,
+  including real-run `deleting`/`*deleting` lines carried by a new
+  `report_deletes` wire bool.
+- Receiver-observed `--stats` counters: `Number of created files` now carries
+  rsync's `(reg/dir/link/special)` breakdown and `Literal data` is exact for a
+  delta transfer (extended `STATUS_STATS`).
+- `--progress` uses an opt-in paths-only pre-count so the `to-chk` denominator
+  counts every entry like rsync, and emits per-directory/symlink/special names.
+- Receiver-side `protect`/`risk` filter engine (new bounded filter-rule wire
+  block): `--filter='P ...'` now shields a destination-only entry like rsync.
+- `auto` for `--compress-choice`/`--checksum-choice` honors
+  `RSYNC_COMPRESS_LIST`/`RSYNC_CHECKSUM_LIST`, and per-codec compression-level
+  defaults match rsync.
+- Empty source directories are recreated recursively; `-R --no-implied-dirs
+  --files-from` places listed files under missing implied parents; `--iconv`
+  matches rsync's push direction; `--delete-delay` reports actual removals and
+  recursively removes a refilled deferred directory.
 
 ### Changed
 
@@ -15,11 +53,11 @@ run the same version because the handshake is strict.
   space progressively, and avoids the whole-old+new-tree peak that could
   `ENOSPC` a tight destination. The client maps the default onto the existing
   `delete_during` wire boolean, so `PROTOCOL_VERSION` stays `2.28.0`.
-- Added the FastSync-only long option **`--delete-commit`** (implies
+- Basis directories (`--compare-dest`/`--copy-dest`/`--link-dest`) now default
-  `--delete`): it selects the old late whole-tree commit and is timing-identical
+  to rsync's metadata quick-check (equal size and mtime; `--size-only` drops the
-  to `--delete-after` (the same `delete_after` wire boolean). Explicit timing
+  mtime leg) instead of FastSync's historical always-verify content hash.
-  flags always win over the default, at most one timing flag may be given, and a
+  `--copy-dest` re-applies the source attributes, and basis materialization is
-  timing flag combined with `--no-delete` is still rejected.
+  streamed so the 256 MiB whole-file cap no longer applies to a basis hit.
 - The per-directory `STATUS_DELETE_PLAN` frame gained a one-int `apply` flag:
   the one-shot per-run config block (protected prefixes, size-pruned mirrors,
   `--delete-missing-args` exact paths) is now always transmitted first on a
@@ -27,6 +65,16 @@ run the same version because the handshake is strict.
   `--delete-missing-args` run whose `--files-from` list synchronized no directory
   never sent its exact deletions.
 
+### Notes
+
+- `--delete`/`--delete-during` remain caveats for the mid-transfer abort
+  boundary (rsync's generator removes all planned extras ahead of its throttled
+  sender; FastSync removes only reached directories — final trees agree).
+  `--delete-before`, `--progress`, `--stats`, `--fuzzy` and the basis rows keep
+  their documented residuals in `RSYNC_COMPAT.md`; `--filter` and
+  `--delete-excluded` are now parity, including protection of a destination-only
+  excluded entry under default `--delete`.
+
 ### Migration
 
 - Scripts that relied on plain `--delete` deleting nothing until the transfer
@@ -34,9 +82,13 @@ run the same version because the handshake is strict.
   that behavior. Plain `--delete` now removes reached directories' extras during
   the transfer, exactly like rsync's default; on a completed run the final tree
   is unchanged.
+- Deployments that relied on FastSync's stricter basis verification should pass
+  **`--verify-basis`**; the default now trusts the size+mtime quick-check like
+  rsync.
 
 ## [2.26.0] - 2026-09-17
 
+
 ### Added
 
 - **Parity-completion wave.** Closed the remaining rsync-parity gaps against

HANDOFF.md

@@ -1,16 +1,19 @@
-# FastSync — Session Handoff (2026-09-17)
+# FastSync — Session Handoff (2026-09-19)
 
 ## Current status
-- **Release `v2.21.0`** tagged (`919a729`, "Release v2.21.0"); full CI green
+- **rsync-parity tracks 1-6 landed on `dev`** via **PR #303** (`10159dc`,
-  (run 552: lint, build-and-test, ASan, UBSan, fuzz-build, coverage, valgrind).
+  "feat(parity): rsync parity tracks 1-6 (protocol 2.28.0)"). Dev push CI run
-  `dev` has the release commit plus later doc-only merges (a README refresh and
+  **581** fully green: lint, build-and-test, parity-full, ASan, UBSan,
-  this handoff).
+  fuzz-build, coverage, valgrind.
-- **Release PR #284 (`dev` -> `main`)** open, CI green (run 553).
+- **`PROTOCOL_VERSION` = `"2.28.0"`** (`src/shared/config.h`); CMake
-  `main` is protected: it needs review/approval to merge.
+  `project(FastFileTransfer VERSION 2.28.0)`. The cycle batched all wire
-  https://gitea.tap-tap.win/TapTap/FastSync/pulls/284
+  changes (stats counters, filter-rule block, `--verify-basis`) under the one
-- **`PROTOCOL_VERSION` = `"2.27.0"`** (`src/shared/config.h`); CMake
+  bump.
-  `project(FastFileTransfer VERSION 2.27.0)`.
+- **`main` = `ef76c90`** (tag `v2.26.0`); the 2.27.0/2.28.0 work is on `dev`
-- Working tree clean; no wave worktrees remain.
+  and not yet released. A `dev -> main` v2.28.0 release PR is the next step.
+- Parity matrix: **116 ✅ / 14 ⚠️ / 27 ❌ = 157** (was 111/13/33 at cycle start).
+- Working tree clean; feature branch deleted; no scratch trees or worktrees.
+
 
 ## What landed this session
 1. **Wave 8 (refactors):** Config X-macro wire table; single-owner `authorized_root`;

README.md

@@ -798,7 +798,7 @@ before the module list, before authentication, and the connecting peer address
 
 ## Protocol and Security
 
-FastSync protocol version `2.27.0` is shared by the client and server. The
+FastSync protocol version `2.28.0` is shared by the client and server. The
 current protocol is sender-driven and includes configuration negotiation,
 including the maximum allocation limit, incremental checks, checksums,
 manifests, keep-alives, abort handling, per-file remove-source results, and