Merge release/v2.19.0 into main: FastSync v2.19.0

- Protocol version 2.19.0 (SCRAM-SHA-256 daemon auth replacing the replayable digest)
- Salted PBKDF2 verifier store + --hash-credentials; legacy store hard-rejected
- Persistent anti-enumeration dummy key (<store>.dummykey)
- Verified TLS / opted-in loopback transport required for auth modules
- Secret wiping; carried-over hardening from the security phases
- Add CHANGELOG.md and set the CMake project version

CHANGELOG.md

@@ -0,0 +1,65 @@
+# Changelog
+
+All notable changes to FastSync are documented here. Versions match
+`PROTOCOL_VERSION` (printed by `fastsync --version`); the client and server must
+run the same version because the handshake is strict.
+
+## [2.19.0] - 2026-09-12
+
+### Security
+
+- **Daemon authentication rewritten as SCRAM-SHA-256 challenge/response**
+  (`STATUS_AUTH_CHALLENGE` → `STATUS_AUTH_RESPONSE` → `STATUS_AUTH_OK`/`STATUS_AUTH_FAILED`),
+  replacing the old replayable static `SHA-256(password)` bearer credential.
+  Each proof is bound to a fresh per-connection server nonce plus a client
+  nonce, so a captured response can never be reused.
+- **Salted verifier store.** `--password-file`/`--early-input` now hold
+  `user:$fastsync$1$pbkdf2-sha256$<iters>$<salt>$<stored_key>$<server_key>`
+  (PBKDF2-HMAC-SHA256, default 600000 iterations, range 100000–10000000). The
+  legacy `user:SHA256HEX` form is hard-rejected; there is no auto-upgrade.
+  Generate stores offline with `fastsync-server --hash-credentials FILE
+  [--iterations N]`.
+- **Username-enumeration hardening.** Unknown/off-list users are answered with a
+  dummy verifier whose salt is a deterministic per-username value
+  (`HMAC-SHA256(dummy_key, username)`), using the store-wide uniform iteration
+  count and a constant-time full-length membership scan. The dummy key is
+  persisted in an owner-only `<store>.dummykey` sidecar (atomic publish, exact
+  mode 0600) so challenges are stable across restarts.
+- **Verified transport for auth-required modules.** A module with `auth users`
+  accepts credentials only over verified TLS whose client certificate matches
+  `--client-cn`, or — when `--allow-unauthenticated` is explicitly set —
+  plaintext from a loopback peer. Remote plaintext is refused before any
+  challenge. Clients must use `--tls` to send `--password-file` credentials to a
+  non-loopback daemon; `--client-cn` is mandatory with `--tls`.
+- **Secret hygiene.** The plaintext password, derived keys, nonces/proofs and
+  the dummy key are wiped from memory on every path and never logged.
+- Carried-over hardening: `-K` TOCTOU-safe directory walk
+  (`openat(O_NOFOLLOW)` per component), always shell-quoted SSH remote path,
+  TLS compression/renegotiation disabled, race-free (open-then-`fstat`)
+  `--password-file`/`--early-input` checks, log-injection escaping, and lazy
+  protocol debug escaping.
+
+### Added
+
+- `fastsync-server --hash-credentials FILE [--iterations N]` offline tool.
+- `<store>.dummykey` sidecar (auto-created, owner-only, 0600).
+- Integration tests for auth replay rejection, malformed frames, legacy-store
+  refusal, and the loopback/TLS transport policy; fuzz targets for config
+  receive and daemon-auth parsing.
+
+### Changed
+
+- **Protocol version 2.18.0 → 2.19.0 (breaking).** The config-frame auth block
+  is now `[present][username]` (digest removed) and the auth challenge/response
+  frames are interleaved between the config frame and its `STATUS_OK`. A 2.19.0
+  client and a 2.18.0 server (or vice versa) fail cleanly at the handshake.
+- Daemon modules declaring `auth users` require a configured credential store at
+  startup (fail closed); operators regenerate stores from plaintext with
+  `--hash-credentials`.
+
+### Notes
+
+- First tagged release. FastSync implements rsync-compatible file
+  synchronization over TCP and SSH with TLS (OpenSSL), streaming zstd
+  compression, multithreaded transfers, and incremental sync. See
+  [RSYNC_COMPAT.md](RSYNC_COMPAT.md) for the flag-parity matrix.

CMakeLists.txt

@@ -1,6 +1,6 @@
 cmake_minimum_required(VERSION 3.22)
 
-project(FastFileTransfer)
+project(FastFileTransfer VERSION 2.19.0)
 
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 set(CMAKE_C_STANDARD 11)

README.md

@@ -6,6 +6,10 @@ source/destination model and rsync-style options while adding optional
 multithreading, streaming zstd compression, chunking, zero-copy TCP transfers,
 and native TCP/TLS transports.
 
+The release version is FastSync's client/server protocol version (printed by
+`fastsync --version`); client and server must match. See
+[CHANGELOG.md](CHANGELOG.md) for the history.
+
 The compatibility target is straightforward:
 
 - Existing rsync commands should keep the same meaning.
@@ -63,17 +67,26 @@ replacement for every rsync feature or protocol mode.
 - Archive mode does not yet provide all of rsync's `-rlptgoD` behavior.
 - Symlink transfer is incomplete; link targets are not yet recreated in all
   modes.
-- Owner/group, ACL, xattr, hard-link, device, and special-file handling is
-  incomplete or unavailable.
-- Sparse-file handling does not yet preserve all holes correctly.
-- `--partial`, `--partial-dir`, `-P`, `--append`, and `--append-verify` are not
-  yet full rsync-style resumable transfers. Interrupted files are not retained
-  for resumption.
+- Owner/group, ACL, xattr, and hard-link handling is incomplete or
+  unavailable.
+- Device and special-file preservation is implemented with documented
+  divergences: recreated device nodes require `CAP_MKNOD` on the receiver (a
+  non-root receiver skips the entry), and sockets cannot be recreated (FIFOs
+  are).
+- Sparse-file hole preservation (`-S`, `--sparse`) is implemented receiver-side:
+  long all-zero runs are written as holes (no wire change; the full file image
+  is already in memory).
+- `--partial`, `--partial-dir`, `-P`, `--append`, and `--append-verify` keep
+  the write atomic (temp + rename). With `--partial`, a failed/interrupted write
+  now retains the already-written temp at the destination path (best-effort) so
+  a later `--append`/`--append-verify` run can resume it.
 - `--dirs` is not implemented. Its compatibility aliases `--old-dirs` and
   `--old-d` are recognized but rejected explicitly rather than silently using
   FastSync's recursive directory behavior.
-- Several rsync short options currently have FastSync-specific meanings. Do
-  not assume every short option is interchangeable yet.
+- Short-option names are now rsync-parity (Phase 7 Wave A): FastSync's former
+  collisions were renamed (`-j`/`--threads`, `--preserve`, `--sendfile`,
+  `--chunk-serialization`, `--timeout`, `--ssh-port`), so `-m`, `-M`, `-f`,
+  `-s`, `-T`, `-p`, `-c`, `-a`, and `-z` follow rsync. See `RSYNC_COMPAT.md`.
 
 The detailed flag matrix is maintained in
 [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md). It distinguishes implemented,
@@ -88,20 +101,22 @@ partial, alternate, and planned behavior.
 | Argument | Description |
 |----------|-------------|
 | Positional | `<source> <dest>` — automatic SSH detection if dest contains `:` |
-| `-c [level]` | Compression with optional level (1–22, default 5) |
-| `-z [level]` | Alias for `-c` |
-| `-a, --archive` | Archive mode: enables `-c -m -M` (no `-s`) |
-| `-m` | Multithreading mode |
-| `-s` | Chunk serialization (batch all files per chunk) |
-| `--secluded-args` | Accepted as an rsync compatibility option with no effect; `-s` remains chunk serialization. |
-| `-f, --sendfile` | Sendfile zero-copy. Incompatible with `-c` / `-s`. TCP only. |
-| `-M, --preserve` | Preserve supported file metadata (mode and mtime; ownership and atime are unsupported) |
+| `-c, --checksum` | Verify content by checksum instead of size+mtime |
+| `-z, --compress [level]` | Enable streaming zstd compression (level 1–22, default 5) |
+| `-a, --archive` | rsync archive mode (`-rlptgoD`): links, metadata, devices and specials (not compression/multithreading) |
+| `-j, --threads` | Multithreading mode |
+| `-m` | rsync `--prune-empty-dirs` (short form now rsync-parity) |
+| `--chunk-serialization` | Chunk serialization (batch all files per chunk; long form only) |
+| `-s` | rsync `--secluded-args` compatibility no-op (remote SSH argv is already injection-safe) |
+| `--sendfile` | Sendfile zero-copy. Incompatible with compression / chunk serialization. TCP only. Long form only. |
+| `--preserve` | Preserve supported file metadata (mode and mtime; ownership and atime are unsupported) |
 | `-n, --dry-run` | Scan and print what would be transferred |
-| `-p <port>` | SSH port (default: 22) |
+| `-p, --perms` | Preserve permission bits (part of the metadata bundle) |
+| `--ssh-port <port>` | SSH port (default: 22) |
 | `-v, --verbose` | Enable debug logging |
 | `-q, --quiet` | Suppress non-error output |
 | `--progress` | Show real-time transfer speed |
-| `-P` | Enables partial-transfer mode and progress output (partial retention is incomplete) |
+| `-P` | Enables partial-transfer mode + progress output; interrupted writes retain the already-written temp for resumption |
 | `--delete` | Delete files on receiver not present in source (default timing: delete-after, i.e. only after the whole transfer succeeded) |
 | `--delete-before` | Delete extras before the transfer starts (implies `--delete`) |
 | `--delete-during`, `--del` | Delete extras once the keep-set is known, before data is applied (implies `--delete`) |
@@ -113,7 +128,7 @@ partial, alternate, and planned behavior.
 | `--max-size <n>` | Skip files larger than n bytes |
 | `--min-size <n>` | Skip files smaller than n bytes |
 | `--max-alloc <SIZE>` | Maximum single allocation (binary units: B, K, M, G, T, P, E; default 1G) |
-| `--incremental` | Skip files unchanged since last transfer (size + mtime). Auto-enables `--preserve`. Incompatible with `-s`. |
+| `--incremental` | Skip files unchanged since last transfer (size + mtime). Auto-enables `--preserve`. Incompatible with `--chunk-serialization`. |
 | `--existing` | Skip files not already present at the destination; update existing files normally. |
 | `--bwlimit <KB/s>` | Bandwidth limit in kilobytes per second |
 | `--chunk-size <n>` | Chunk size in bytes (default: 10485760) |
@@ -134,7 +149,7 @@ partial, alternate, and planned behavior.
 | `--cert <path>` | TLS certificate file (PEM) |
 | `--key <path>` | TLS private key file (PEM) |
 | `--ca <path>` | TLS CA certificate file for verification (PEM) |
-| `--client-cn <name>` | Required TLS client certificate common name |
+| `--client-cn <name>` | TLS client certificate common name; mandatory with `--tls` (a TLS connection always verifies the client CN) |
 
 ### Server
 
@@ -148,7 +163,7 @@ partial, alternate, and planned behavior.
 | `--ca <path>` | TLS CA certificate file for verification (PEM) |
 | `--destination-root <path>` | Authorized destination root (default: `.`) |
 | `--allow-delete` | Permit manifest deletion |
-| `--allow-unauthenticated` | Permit plaintext TCP clients |
+| `--allow-unauthenticated` | Permit plaintext TCP clients. For an `auth users` module this opts in **loopback plaintext only**; remote auth still requires verified TLS, so the flag never permits remote plaintext auth. |
 | `-v, --verbose` | Enable debug logging |
 | `--help` | Show help |
 
@@ -350,18 +365,18 @@ features without changing the meaning of ordinary compatibility options.
 
 | Option | Purpose |
 |---|---|
-| `-m` | Enable the multithreaded scanner/loader/sender pipeline. |
-| `-c [level]`, `-z [level]` | Enable streaming zstd compression, levels 1-22. |
+| `-j`, `--threads` | Enable the multithreaded scanner/loader/sender pipeline. |
+| `-z [level]`, `--compress [level]` | Enable streaming zstd compression, levels 1-22. |
 | `--compress-level <n>` | Set the zstd compression level. |
 | `--zc <alg>` | Alias for `--compress-choice`. FastSync supports `zstd` and `none`. |
 | `--zl <n>` | Alias for `--compress-level`. |
-| `--skip-compress <list>` | Skip compression for comma-separated suffixes; incompatible with `-s`. |
+| `--skip-compress <list>` | Skip compression for comma-separated suffixes; incompatible with `--chunk-serialization`. |
 | `--compress-threads <n>` | Use `n` zstd compression workers. Requires compression and a zstd build with threaded support; the setting affects sender CPU work only. |
 | `--chunk-size <bytes>` | Set the transfer chunk size. |
-| `-s` | Enable FastSync chunk serialization. |
-| `-f`, `--sendfile` | Use TCP `sendfile()` zero-copy transfer. Incompatible with compression and chunk serialization. |
+| `--chunk-serialization` | Enable FastSync chunk serialization (long form only; `-s` is rsync's `--secluded-args`). |
+| `--sendfile` | Use TCP `sendfile()` zero-copy transfer. Incompatible with compression and chunk serialization. Long form only. |
 | `--delta` | Use FastSync-native block delta transfer. Requires `--incremental`. |
-| `--delta-block <bytes>` | Set the FastSync delta block size. |
+| `--delta-block <bytes>` | Set the FastSync delta block size (`--block-size` is an alias). |
 | `--delta-max <bytes>` | Limit files eligible for FastSync delta transfer. |
 | `--server-host <host>` | Select the TCP server host. |
 | `--server-port <port>` | Select the TCP server port. |
@@ -372,15 +387,18 @@ features without changing the meaning of ordinary compatibility options.
 | `--timeout <seconds>` | Set I/O timeout. |
 | `--contimeout <seconds>` | Set connection timeout. |
 
-Current short-option conflicts are tracked as compatibility work. In
-particular, FastSync currently uses `-p` for SSH port, `-s` for chunk
-serialization, and `-S` for sparse handling. These meanings must be reconciled
-before FastSync can claim full rsync CLI compatibility.
+Short-option conflicts with rsync have been resolved for the CLI namespace
+(Phase 7): `-c` is now rsync's `--checksum`, `-m` is `--prune-empty-dirs`, `-M`
+is `--remote-option`, `-f` is `--filter`, `-s` is `--secluded-args`, `-p` is
+`--perms`, and `-T` is `--temp-dir`. FastSync's own flags were renamed to
+long-form-only or new shorts: multithreading is `-j`/`--threads`, metadata
+is `--preserve`, sendfile is `--sendfile`, chunk serialization is
+`--chunk-serialization`, timeout is `--timeout`, and SSH port is `--ssh-port`.
+`-a`/`--archive` is now real rsync archive (`-rlptgoD`).
 
-`--secluded-args` is accepted as a long-form compatibility no-op. It does not
-change FastSync's transport or protocol behavior. The rsync short form `-s` is
-intentionally not aliased because it remains FastSync's chunk-serialization
-option.
+`--secluded-args` (and its short form `-s`) is accepted as a compatibility
+no-op. It does not change FastSync's transport or protocol behavior, because
+remote SSH argv is already built injection-safe.
 
 ## Client Options
 
@@ -388,7 +406,7 @@ option.
 
 | Option | Description |
 |---|---|
-| `-a`, `--archive` | Enable current archive preset. Full rsync archive semantics are planned. |
+| `-a`, `--archive` | rsync archive mode (`-rlptgoD`): links, metadata, devices and specials. |
 | `-n`, `--dry-run` | Scan and report without writing files. |
 | `--delete` | Request removal of destination entries absent from the source. The server must allow deletion. Default timing is delete-after: extras are removed only after the whole transfer succeeded. |
 | `--delete-before` | Delete extras before the transfer starts (implies `--delete`). |
@@ -405,25 +423,26 @@ option.
 zero means unlimited.| | `--incremental` | Skip files matching destination size and mtime.|
     | `--checksum` | Include xxHash64 content checks in incremental comparisons.| | `--backup` |
     Back up overwritten files.| | `--backup - dir<dir>` | Store backups under a separate directory.|
-    | `--suffix<suffix>` | Set the backup filename suffix.| | `--partial` |
-    Select partial - transfer handling.With `--partial - dir`,
-    completed files are written there;
-resumable transfers are not implemented.| | `--partial - dir<dir>` |
-    Set a relative partial - transfer directory below the server destination root;
-use with `--partial`. |
+| `--suffix<suffix>` | Set the backup filename suffix.| | `--partial` |
+     Select partial - transfer handling. On failed/interrupted writes the
+     already-written temp file is retained (best-effort) for resumption.|
+     With `--partial --partial-dir <dir>`, completed files are written under the
+     partial directory and installed atomically. | | `--partial - dir<dir>` |
+     Set a relative partial - transfer directory below the server destination root.
+     Use with `--partial`. |
 | `--inplace` | Write directly to the destination instead of using a temporary file. |
 
 ### Metadata and links
 
 | Option | Description |
 |---|---|
-| `-M`, `--preserve` | Preserve supported file metadata, currently mode and modification time. |
+| `--preserve` | Preserve supported file metadata, currently mode and modification time (long form only). |
 | `-l`, `--links` | Request symlink preservation;
 link-target transfer remains incomplete. |
 | `--copy-links` | Copy symlink referents. |
 | `--safe-links` | Skip symlinks that point outside the transfer tree. |
 | `--copy-unsafe-links` | Copy unsafe symlink referents. |
-| `-S`, `--sparse` | Request sparse-file handling; full hole preservation is planned. |
+| `-S`, `--sparse` | Sparse-file handling: receiver preserves holes (zero runs are written as holes; no wire change). |
 
 ### Output and logging
 
@@ -440,7 +459,7 @@ link-target transfer remains incomplete. |
 
 | Option | Description |
 |---|---|
-| `-p <port>` | SSH port in the current CLI. This conflicts with rsync's `-p` permissions option and is planned for correction. |
+| `--ssh-port <port>` | SSH port for the SSH transport (default: 22). Note the short `-p` is now rsync's `--perms`. |
 | `--fastsync-server-path <path>` | Remote FastSync server path for SSH mode. |
 | `--source-dir <path>` | Set the source directory explicitly. |
 | `--dest-dir <path>` | Set the destination directory explicitly. |
@@ -492,13 +511,58 @@ defaults to the current directory. |
 
 ## Protocol and Security
 
-FastSync protocol version `2.5.0` is shared by the client and server. The
+FastSync protocol version `2.19.0` is shared by the client and server. The
 current protocol is sender-driven and includes configuration negotiation,
 including the maximum allocation limit, incremental checks, checksums,
 manifests, keep-alives, abort handling, per-file remove-source results, and
 FastSync-native delta messages.
 Client and server versions must currently match exactly.
 
+Daemon modules that declare `auth users` authenticate with a SCRAM-SHA-256-style
+challenge/response against a salted PBKDF2 verifier store: no password and no
+replayable bearer credential crosses the wire or is stored on the daemon. All
+store entries share one iteration count, and an unknown user is answered with a
+deterministic per-username dummy challenge, so probing the daemon cannot
+enumerate users. Store lines are generated with
+`fastsync-server --hash-credentials <plaintext-file>` (see `RSYNC_COMPAT.md`);
+redirect that output to an owner-only (mode 0600) file, and note that legacy
+`user:SHA256HEX` stores are rejected. FastSync also maintains an owner-only
+(mode 0600) `<store>.dummykey` sidecar next to the store: it holds the store-wide
+dummy key, is auto-created on first load, and must be preserved across daemon
+restarts so the dummy challenge for an unknown user stays stable (the key is
+never regenerated while the sidecar exists). The sidecar is secret material and
+must be protected like the credential store: keep it owner-only (mode 0600) and
+include it with the store in backups and credential rotation. If the sidecar
+cannot be created (a process-substitution/FIFO store path such as `/dev/fd/N`, a
+read-only filesystem, a missing directory, or a create, write, fsync, link, or
+fchmod failure), the daemon logs a warning and uses a transient key, so the
+cross-restart guarantee does not hold for those deployments. One residual is
+accepted: the store
+iteration count is observable pre-auth by design, since the miss path must match
+a hit.
+
+An `auth users` module accepts credentials only when one of two conditions
+holds: (a) the connection is an encrypted, verified TLS connection whose client
+certificate matches the server's `--client-cn`, or (b) the connection is
+plaintext from a loopback peer **and** the operator explicitly passed
+`--allow-unauthenticated`. A remote plaintext peer is refused before any
+challenge is sent, and `--allow-unauthenticated` never permits remote plaintext
+auth: remote peers still require verified TLS regardless of the flag. Clients
+sending daemon credentials with `--password-file` to a non-loopback daemon must
+therefore use `--tls`; the client rejects a non-local plaintext credential
+destination before any network I/O. Daemon modules are a `--daemon`-only
+feature: the SSH `--stdio` path never loads a daemon config and is not an auth
+transport for them.
+
+Because the loopback allowance trusts whichever peer the kernel reports as
+`127.0.0.1`, it assumes nothing relays remote connections to the daemon. A local
+TCP forwarder or a TLS-terminating proxy in front of an auth-module listener
+makes remote clients appear as loopback and bypasses the mutual-TLS identity
+check, so do not front an auth-module listener with such a relay. `--tls` always
+mandates `--client-cn`, so a TLS connection to an auth-required module always
+has its client CN verified (`--client-cn` matches the certificate's CN only, not
+a subjectAltName, which is acceptable for a private CA).
+
 TLS provides encrypted TCP transport. Supplying `--ca` enables certificate
 verification; without it, traffic is encrypted but peer identity is not
 verified. Use certificate verification for deployments where authentication

RSYNC_COMPAT.md

@@ -6,11 +6,12 @@ This document maps rsync's full feature set to FastSync's current implementation
 
 | Status | Count | Description |
 |--------|-------|-------------|
-| ✅ Implemented | 118 | Feature works end-to-end |
-| 🔀 Alt Arg | 3 | Functionality exists but under different flag/semantics |
-| ⚠️ Partial | 10 | Flag parsed/stored but behavior incomplete |
-| 🔄 Compatibility No-op | 3 | Flag is accepted for CLI compatibility but has no effect |
-| ❌ Not Implemented | 13 | Flag not recognized or no behavior |
+| ✅ Implemented | 143 | Feature works end-to-end |
+| 🔀 Alt Arg | 0 | Functionality exists but under different flag/semantics |
+| ⛔ Impossible/Divergence | 4 | Flag is a documented divergence or cannot be implemented on any portable filesystem call |
+| ⚠️ Partial | 0 | Flag parsed/stored but behavior incomplete |
+| 🔄 Compatibility No-op | 0 | Flag is accepted for CLI compatibility but has no effect |
+| ❌ Not Implemented | 0 | Flag not recognized or no behavior |
 | **Total** | **147** | |
 
 ---
@@ -19,14 +20,14 @@ This document maps rsync's full feature set to FastSync's current implementation
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `-a`, `--archive` | Archive mode is -rlptgoD | 🔀 Alt Arg | Maps to -c -m -M (compression + multithread + metadata) |
+| `-a`, `--archive` | Archive mode is -rlptgoD | ✅ Implemented | Phase 7 Wave A: real rsync archive. `-a`/`--archive` now implies `--links` + metadata (perms/times/group/owner as FastSync's broad bundle) + `--devices` + `--specials`. FastSync is always recursive, so no `-r` is needed. It no longer implies compression or multithreading (those moved to `-z`/`-j`). The short-option namespace is now rsync-parity (see the Phase 7 note) |
 | `-v`, `--verbose` | Increase verbosity | ✅ Implemented | Sets `log_level=DEBUG` |
 | `-q`, `--quiet` | Suppress non-error messages | ✅ Implemented | Suppresses client output while preserving errors |
 | `--help` | Show help | ✅ Implemented | Prints usage and exits; `-h` is not accepted |
 | `-V`, `--version` | Print version | ✅ Implemented | |
 | `--info=FLAGS` | Fine-grained info verbosity | ✅ Implemented | Supports `copy`, `misc`, `skip`, `stats`, `all`, and `none`; explicit flags override `--verbose`, and `none` suppresses info output; unsupported names are rejected |
 | `--debug=FLAGS` | Fine-grained debug verbosity | ✅ Implemented | `io`, `proto`, `pack`, and `util` are supported; `--debug=help` lists flags; other rsync categories are rejected |
-| `--stderr=MODE` | Change stderr output mode | ⚠️ Partial | `errors` (default) and `all` are supported; `client` is rejected because FastSync has no rsync message channel |
+| `--stderr=MODE` | Change stderr output mode | ⛔ Impossible/Divergence | `errors` (default) and `all` are supported; `client` is rejected with a clear error (`--stderr=client is not supported`) because FastSync has no rsync client-message channel — the rejection itself is the documented behavior (Phase 7 Wave B decision). The modes that exist work; the missing rsync channel cannot be emulated without a wire change |
 | `--no-motd` | Suppress daemon MOTD | ✅ Implemented | Client-only display switch (Wave C): the daemon still sends the configured `motd file` on a `host::module/path` connection; the client reads and discards the frame without showing it. Without the flag the MOTD is printed to stdout after the config/auth handshake and escaped so control bytes cannot inject terminal sequences |
 | `--exclude=PATTERN` | Exclude files matching pattern | ✅ Implemented | Glob matching in scanner |
 | `--include=PATTERN` | Include files matching pattern | ✅ Implemented | Glob matching in scanner |
@@ -38,9 +39,9 @@ This document maps rsync's full feature set to FastSync's current implementation
 |------|-------------------|-----------------|-------|
 | `--stats` | Give transfer stats | ✅ Implemented | Prints file/byte counts |
 | `-h`, `--human-readable` | Human-readable numbers | ✅ Implemented | Formats transfer byte sizes using binary units |
-| `-i`, `--itemize-changes` | Per-file change summary | ✅ Implemented | Prints rsync-style `>f+++++++++` lines to stdout only for files actually sent (also under `-m`); unchanged files print nothing, matching single-`-i` behavior |
+| `-i`, `--itemize-changes` | Per-file change summary | ✅ Implemented | Prints rsync-style `>f+++++++++` lines to stdout only for files actually sent (also under `-j`/`--threads`); unchanged files print nothing, matching single-`-i` behavior |
 | `--progress` | Show progress | ✅ Implemented | Progress callback in sender |
-| `-P` | Same as --partial --progress | ⚠️ Partial | Parses and enables progress, but interrupted files are not retained for resumable transfers |
+| `-P` | Same as --partial --progress | ✅ Implemented | Phase 7 Wave B: `-P` parses to `--partial` + `--progress`. On a failed/interrupted write the receiver now retains the already-written temp file at the destination path (best-effort rename instead of unlink when configured), so a later `--append`/`--append-verify` run can resume it; `--partial-dir` still stages completed files under the confined partial dir and installs them atomically. The retention never runs when `--partial` is off, when no data was actually written, or under `--ignore-existing`/`--existing` (the destination is not ours to overwrite), and it only ever renames the already-written temp (never a corrupt blend; a failed rename falls back to the normal unlink). See the `-S`/`--sparse` interplay note (a retained sparse temp has full logical size) |
 | `--out-format=FORMAT` | Custom output format | ✅ Implemented | Per-transfer template on stdout; tokens `%f` `%n` `%l` `%b` `%M` `%%` (`%b` is the source length, always `== %l`; post-compression/delta wire bytes are not counted); unknown escapes preserved |
 | `--log-file=FILE` | Log to file | ✅ Implemented | `log_file` config field |
 | `--log-file-format=FMT` | Log format | ✅ Implemented | Requires `--log-file`; writes one template line per transferred file using the same token set as `--out-format` (including `%b` `==` source length) |
@@ -58,11 +59,11 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `-0`, `--from0` | Delimit *-from files with NULs | ✅ Implemented | `--files-from` entries become NUL-delimited; the flag may appear before or after `--files-from` on the command line. NUL mode preserves entry bytes exactly (trailing CR/LF are part of the name; only newline mode trims them) |
 | `--max-size=SIZE` | Skip files larger than SIZE | ✅ Implemented | `max_size` in scanner |
 | `--min-size=SIZE` | Skip files smaller than SIZE | ✅ Implemented | `min_size` in scanner |
-| `-I`, `--ignore-times` | Don't skip files matching size+time | ❌ Not Implemented | |
+| `-I`, `--ignore-times` | Don't skip files matching size+time | ✅ Implemented | `ignore_times` config field (crosses the wire). Disables the size+mtime quick-check in the `--incremental` per-file handshake and the basis-dir quick-match, forcing the file to be transferred rather than skipped as unchanged. Receiver-side policy: `match_by_metadata` (file_receive.c) is bypassed, so the receiver never replies `STATUS_OK` for a matching size+mtime. Requires `--incremental` to have the handshake to act on (rsync does its quick check by default; FastSync's `-I`/`--size-only`/`--modify-window` only take effect under `--incremental`, exactly like they take effect through the basis check) |
 | `--size-only` | Skip based on size only | ✅ Implemented | With `--incremental`, ignores mtime |
 | `-@`, `--modify-window=NUM` | Mod-time comparison accuracy | ✅ Implemented | Whole-second tolerance with nanosecond-aware comparisons |
 | `--existing` | Skip creating new files on receiver | ✅ Implemented | Existing destination files continue through normal update handling |
-| `--ignore-existing` | Skip updating existing files | ❌ Not Implemented | |
+| `--ignore-existing` | Skip updating existing files | ✅ Implemented | `ignore_existing` config field (crosses the wire; receiver-side policy). For a destination entry that already exists, the receiver skips the write: in the regular-file path, existing/delay-updates-staged, hardlink-sibling, and special/device handlers all return `FILE_SAVE_SKIPPED` without overwriting (passed as `no_replace` to the write engine), and `--backup` is disabled for skipped files. Note: it is applied at write time, so an existing dest whose size+mtime differ still has its data (or delta) transmitted before the write is discarded — functionally correct, bandwidth-suboptimal vs rsync, which short-circuits earlier. Like rsync, it does not apply to directories/symlinks (those return before the block). Combines with `-j`/`--threads` and `--delay-updates`. See Phase-4/— notes below |
 | `--remove-source-files` | Sender removes regular files after confirmed transfer | ✅ Implemented | |
 | `-x`, `--one-file-system` | Do not cross filesystem boundaries | ✅ Implemented | Sender scanner captures the root device and skips descending into mount-point crossings (`st_dev` differs); cross-filesystem mount-point subdirectories are dropped entirely, matching rsync |
 | `-F` | Add the default `.rsync-filter` rules | ✅ Implemented | Reads one filter rule per line from each directory's `.rsync-filter` file during traversal and applies it to that directory's subtree; the current directory's rules are evaluated before its ancestors', so deeper files override shallower ones and per-directory files override the command-line `--filter`/`-C` base by default (matching rsync's first-match-wins precedence); `.rsync-filter` files are never transferred. The rsync `-FF` behavior (also `.cvsignore`) is out of scope; unsupported rule types inside the file abort with a clear error |
@@ -72,21 +73,21 @@ This document maps rsync's full feature set to FastSync's current implementation
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
 | `-r`, `--recursive` | Recurse into directories | ✅ Implemented | Default behavior |
-| `-R`, `--relative` | Use relative path names | ✅ Implemented | Meaningful together with `--files-from` (FastSync's default full-tree scan always mirrors the full source argument path below the destination root, so -R does not change it). With `-R` + `--files-from` each listed entry is transmitted under its bare relative destination path: an entry `sub/x.txt` lands at `<dest>/sub/x.txt` (its leading components preserved) instead of under the `<dest>/<full source path>` mirror. Only the path sent on the wire changes; the client still reads the absolute source path, and the delete manifest derives from the sent (relative) paths so `--delete` and `--remove-source-files` stay consistent in both layouts. Works single-threaded and under `-m` (including chunk serialization) |
+| `-R`, `--relative` | Use relative path names | ✅ Implemented | Meaningful together with `--files-from` (FastSync's default full-tree scan always mirrors the full source argument path below the destination root, so -R does not change it). With `-R` + `--files-from` each listed entry is transmitted under its bare relative destination path: an entry `sub/x.txt` lands at `<dest>/sub/x.txt` (its leading components preserved) instead of under the `<dest>/<full source path>` mirror. Only the path sent on the wire changes; the client still reads the absolute source path, and the delete manifest derives from the sent (relative) paths so `--delete` and `--remove-source-files` stay consistent in both layouts. Works single-threaded and under `-j`/`--threads` (including chunk serialization) |
 | `--no-implied-dirs` | Don't send implied dirs with -R | ✅ Implemented | Client-side, meaningful only with `-R` + `--files-from`. rsync would normally create the ancestor directories implied by a listed file so it can be written; with `--no-implied-dirs` a listed file whose parent directory is not itself (or via an ancestor) explicitly listed cannot be placed, and FastSync fails the whole run up front with a clear error (`--no-implied-dirs: cannot place file '...': parent directory '...' is not explicitly listed`). Listing the directory (or an ancestor of it, or the whole tree `.`) permits the file. In every other mode the option has no effect. FastSync has no per-entry skip channel, so the rsync "omit the file" case is surfaced as a hard pre-transfer error |
-| `-d`, `--dirs`, `--old-dirs`, `--old-d` | Transfer dirs without recursing | ✅ Implemented | `-d <dir>` transmits an explicit directory entry for the source-root directory, so the destination mirror is created empty and nothing is descended into. With `--files-from` exactly the listed items are transferred: a listed directory is created empty (no descent) and a listed file is transferred with its content; the dest layout follows the same -R rules as plain files. A new wire frame (`STATUS_MKDIR`) carries each directory entry (path only); the receiver creates it with the same confined mkdir-parent semantics as regular writes, in single-threaded and `-m` receivers (chunk serialization carries a per-entry type marker). Directory entries appear in the delete manifest so `--delete` prunes correctly. FastSync divergences: directory mtimes/modes are not transmitted, filter/`--exclude` rules are not re-applied to the listed dirs mode (there is no descent during which they would apply), and `-d` never creates the intermediate directories between the destination root and a listed file beyond the usual on-demand parent creation. Under `--delay-updates` only regular files are staged: directory entries are created immediately, so a delayed run that fails part way can leave the already-created empty directories behind (matching rsync, which also creates directories as it processes the file list and only delays regular-file data) |
+| `-d`, `--dirs`, `--old-dirs`, `--old-d` | Transfer dirs without recursing | ✅ Implemented | `-d <dir>` transmits an explicit directory entry for the source-root directory, so the destination mirror is created empty and nothing is descended into. With `--files-from` exactly the listed items are transferred: a listed directory is created empty (no descent) and a listed file is transferred with its content; the dest layout follows the same -R rules as plain files. A new wire frame (`STATUS_MKDIR`) carries each directory entry — the path and, when `--preserve`/`-a` (metadata mode) is negotiated, the directory's metadata; the receiver creates it with the same confined mkdir-parent semantics as regular writes, in single-threaded and `-j`/`--threads` receivers (chunk serialization carries a per-entry type marker). Directory entries appear in the delete manifest so `--delete` prunes correctly. Directory TIMES are transmitted (the `STATUS_DIR_TIMES` frame carries every traversed source directory's captured times, including `--dirs` entries) and applied by the receiver at the END of the transfer, after all children and the delete/publication phases, so a later child write cannot clobber a directory's mtime (`-O`/`--omit-dir-times` skips this application). FastSync divergences: directory modes/ownership are still not applied (only times are), and empty directories are still never created (a `STATUS_DIR_TIMES` entry is record-only), filter/`--exclude` rules are not re-applied to the listed dirs mode (there is no descent during which they would apply), and `-d` never creates the intermediate directories between the destination root and a listed file beyond the usual on-demand parent creation. Under `--delay-updates` only regular files are staged: directory entries are created immediately, so a delayed run that fails part way can leave the already-created empty directories behind (matching rsync, which also creates directories as it processes the file list and only delays regular-file data) |
 | `--mkpath` | Create missing path components | ✅ Implemented | Wire option (client → server). At connection start the server creates the client's destination root directory (and any missing leading components below its own authorized root) when `--mkpath` is set, failing the connection cleanly if it cannot. Without `--mkpath` a destination root that does not exist yet is rejected up front (rsync semantics), so the flag is the only way to transfer into a not-yet-created destination directory. Creation is confined by the same secure mkdir walk as file writes (`O_NOFOLLOW`, no `..`) |
 
 ## 5. Transfer Modifications
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `-u`, `--update` | Skip files newer on receiver | ❌ Not Implemented | Removed because it had no effect |
+| `-u`, `--update` | Skip files newer on receiver | ✅ Implemented | `update` config field (crosses the wire; receiver-side policy, implies `-M` metadata). Before writing a regular file, the receiver checks `file_destination_is_newer_secure()` (via `stat_is_newer`, second-then-nanosecond strict `>` on the existing destination) and skips the write when the destination is newer than the source (`FILE_SAVE_SKIPPED`); equal-or-older destination (or a newer source) is transferred normally. Applied at write time on the regular-file, delay-updates-staged, hardlink-sibling, and special/device paths. Only regular destinations can be guarded (the newer-check requires `S_ISREG`), and like the other write-time policies it does not short-circuit the data transfer for a differing-size dest. `--remove-source-files` correctly respects the receiver's skip outcome so a skipped source is not removed |
 | `--inplace` | Update files in-place | ✅ Implemented | Direct write mode |
 | `--append` | Append data to shorter files | ✅ Implemented | Tail-only resume. When an existing destination file is SHORTER than the source, the receiver negotiates a resume offset with the sender and only the tail is transferred; the receiver rebuilds the full file (retained prefix + tail) and installs it through the normal atomic store path, so the result is byte-identical to the source whenever the retained prefix matches. Plain `--append` does NOT content-verify that prefix (rsync parity): a destination whose prefix differs from the source is resumed anyway, so the result (wrong prefix + correct tail) is NOT byte-identical and the file is effectively left corrupt — the documented rsync-parity risk (use `--append-verify` when the prefix cannot be trusted). Non-content attributes (permissions/ownership/mtime, via `-M`) are still applied. Requires the per-file `STATUS_CHECK` handshake, so it implies `--incremental`; it takes precedence over block delta for a growing file and falls back to delta/full when the destination is not shorter. Incompatible with `-s` (chunk serialization) and `--whole-file` (both rejected up front so the mode never silently degrades to a full transfer). Combines with `--inplace`, `--partial`/`--partial-dir`, and `--delay-updates` (the reconstructed full file flows through those paths unchanged). Divergence: rsync appends in place; FastSync reconstructs and atomically installs, so an interrupted or failed resume never leaves a half-written file at the destination (no corruption window), and `--append` is thus safe to use with the normal atomic path — not only with in-place writes |
 | `--append-verify` | Append with old-data checksum | ✅ Implemented | Like `--append`, but the retained prefix IS verified before resuming: the sender transmits the source prefix checksum and the receiver compares it to the xxHash64 of the retained destination prefix; on a match only the tail is transferred, on a MISMATCH the run falls back to a clean full transfer so the result is always a byte-identical source copy (never a corrupt prefix+tail blend). Wire/protocol: the append handshake adds `STATUS_APPEND` / `STATUS_APPEND_SIG` / `STATUS_APPEND_OK` / `STATUS_APPEND_DATA` frames and `PROTOCOL_VERSION` was bumped **2.9.0 → 2.10.0** (peers must match, and both must be 2.10.0 or the run fails the version check). Same implications/incompatibilities as `--append`; when both spellings are given `--append-verify` wins (the safer semantics). See the Phase-3 append notes below |
-| `-W`, `--whole-file` | Copy whole file (no delta) | ❌ Not Implemented | |
-| `--block-size=SIZE` | Force checksum block-size | ⚠️ Partial | Parsed as `--delta-block`; controls delta transfer block size |
+| `-W`, `--whole-file` | Copy whole file (no delta) | ✅ Implemented | `whole_file` config field. Forces a full (whole-file) copy, disabling the block-level delta machinery: the sender only sends `STATUS_NEXT` + full data (client_send.c) and the receiver never requests a delta signature/reconstruction — the receiver's `try_delta = use_delta && !whole_file && ...` short-circuits. `whole_file` crosses the wire folded into `use_delta` (the wire carries `use_delta && !whole_file`), so no separate field/bump is needed. Delta is opt-in (`--delta` needs `--incremental`); `-W` additionally makes `--fuzzy` inert (no similar-file delta basis). `--append`/`--append-verify` are incompatible with `-W` and rejected up front (both sides). See the delta/append notes below |
+| `--block-size=SIZE` | Force checksum block-size | ✅ Implemented | Phase 7 Wave B: `--block-size` is an alias for `--delta-block`; both set `config->delta_block_size` (default `DELTA_BLOCK_SIZE_DEFAULT`, bounds `DELTA_BLOCK_SIZE_MIN..MAX`, out-of-range values are rejected with the default kept). The value is genuinely honored by the delta engine end-to-end: `delta_signature_create_seeded(old, size, config->delta_block_size, seed)` on the sender and receiver, `delta_apply(old, ...)` with the same size, so a non-default block size changes the block count of every signature the harnesses exchange (verified by unit + integration tests) |
 
 ## 6. Destination Handling
 
@@ -96,8 +97,8 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `-b`, `--backup` | Make backups of overwritten files | ✅ Implemented | Backup before overwrite |
 | `--backup-dir=DIR` | Backup directory hierarchy | ✅ Implemented | `backup_dir` config field |
 | `--suffix=SUFFIX` | Backup suffix (default ~) | ✅ Implemented | `suffix` config field |
-| `--delay-updates` | Put updated files in place at end | ✅ Implemented | Successfully received files are staged under a private 0700 `.fastsync-stage` dir inside the receive root and atomically renamed into their final destinations only after the whole transfer (manifest/delete handling included) succeeds, just before the success/outcome frame is sent. The delete walker deliberately skips the staging dir at the receive root, so `--delete` removes genuine extras but never the staged files (deletion runs before publication; rsync's delete-after ordering is not implemented). `--existing`/`--ignore-existing`/`--update` decide against the final destination path at stage time; `--backup` moves the old file aside at publication. Incompatible with `--inplace` and with `--backup-dir=.fastsync-stage` (the internal staging name is reserved; both are rejected). The staging dir name is fixed, so two simultaneous delayed transfers to the same destination root are serialized with an exclusive advisory lock held for the whole transfer: the second session fails cleanly instead of corrupting the first. Aborting or failing before publication installs nothing and removes the staging tree; a crash between stage and publish leaves staged leftovers that the next delayed run wipes at start (process death releases the lock). A stage→publish failure aborts the transfer (best-effort cleanup of the not-yet-published staged files; already-published files are not rolled back). Works in single-threaded and `-m` modes |
-| `-T`, `--temp-dir=DIR` | Create temporary files in DIR | ✅ Implemented | `--temp-dir` only; `-T` stays FastSync's `--timeout` alias. Scratch dir is resolved under the receive root; temp copies use a unique name there and are atomically renamed into place. If the scratch dir and destination are on different filesystems the atomic rename fails with EXDEV and the file save fails, which aborts the whole transfer (FastSync has no per-file skip/resume on a save error; rsync's non-atomic copy fallback is deliberately not used). `--inplace` and `--partial-dir` writes bypass the scratch dir |
+| `--delay-updates` | Put updated files in place at end | ✅ Implemented | Successfully received files are staged under a private 0700 `.fastsync-stage` dir inside the receive root and atomically renamed into their final destinations only after the whole transfer (manifest/delete handling included) succeeds, just before the success/outcome frame is sent. The delete walker deliberately skips the staging dir at the receive root, so `--delete` removes genuine extras but never the staged files (deletion runs before publication; rsync's delete-after ordering is not implemented). `--existing`/`--ignore-existing`/`--update` decide against the final destination path at stage time; `--backup` moves the old file aside at publication. Incompatible with `--inplace` and with `--backup-dir=.fastsync-stage` (the internal staging name is reserved; both are rejected). The staging dir name is fixed, so two simultaneous delayed transfers to the same destination root are serialized with an exclusive advisory lock held for the whole transfer: the second session fails cleanly instead of corrupting the first. Aborting or failing before publication installs nothing and removes the staging tree; a crash between stage and publish leaves staged leftovers that the next delayed run wipes at start (process death releases the lock). A stage→publish failure aborts the transfer (best-effort cleanup of the not-yet-published staged files; already-published files are not rolled back). Works in single-threaded and `-j`/`--threads` modes |
+| `-T`, `--temp-dir=DIR` | Create temporary files in DIR | ✅ Implemented | `--temp-dir` with the rsync short `-T` (Phase 7 Wave A; the timeout alias moved to long-only `--timeout`). Scratch dir is resolved under the receive root; temp copies use a unique name there and are atomically renamed into place. If the scratch dir and destination are on different filesystems the atomic rename fails with EXDEV and the file save fails, which aborts the whole transfer (FastSync has no per-file skip/resume on a save error; rsync's non-atomic copy fallback is deliberately not used). `--inplace` and `--partial-dir` writes bypass the scratch dir |
 
 ## 7. Deletion
 
@@ -112,7 +113,7 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `--max-delete=NUM` | Max files to delete | ✅ Implemented | `max_delete` config field (default -1 = no client limit; 0 = delete nothing). NUM bounds a `--delete` run with rsync's all-or-nothing semantics: the receiver rehearses the deletion first and, if the destination holds more than NUM extras, deletes NOTHING and fails the transfer with a distinct `--max-delete` error. A run at or below NUM deletes exactly the extras. NUM only applies together with `--delete` (it is inert otherwise, matching rsync). The hard server bound `MAX_SERVER_DELETE_COUNT` (100000) still caps the walk; a NUM above it never raises that cap, and exceeding the server bound is its own all-or-nothing error. Directories count toward the limit (each removed empty directory is one deletion), like rsync |
 | `--ignore-errors` | Delete even with I/O errors | ✅ Implemented | Sender-side, client-only config field. rsync suppresses `--delete` when the transfer had I/O errors; FastSync's equivalent is a source-scan I/O error (an unreadable directory, e.g. EACCES): by default the scan aborts the run so no deletion happens. With `--ignore-errors` the scan continues past the unreadable directory, the readable tree is transferred and the deletion still runs (the mirror of the unreadable directory is treated as an extra). The run still exits non-zero (the error is reported, matching rsync's error status). Divergence: without the flag FastSync aborts the whole run on the scan error, whereas rsync transfers the rest of the tree and merely skips the deletion; both leave the deletion undone |
 | `--force` | Force deletion of non-empty dirs | ✅ Implemented | `force_delete` receiver config field (crosses the wire). rsync's `--force` lets an incoming non-directory replace a destination directory; FastSync implements exactly that: when a regular file is written to a path that is currently a (possibly non-empty) destination directory, `--force` removes that directory tree first — confined to the receive root and symlink-safe (O_NOFOLLOW fd walk, symlinks removed by name, never followed) — so the atomic install can place the file. Without `--force` such a write fails and the run aborts. Divergence: `--force` acts on the immediate-install path only; under `--delay-updates` a blocking directory is not cleared (publication renames over regular files) |
-| `--prune-empty-dirs` | Prune empty dir chains | ✅ Implemented | Long-only: FastSync's `-m` is already multithreading (recorded divergence — rsync's `-m` short form is not reassigned). FastSync's recursive transfer never emits directory entries, so empty directories are inherently never transferred (which is rsync's `-m` behavior) and truly-empty destination directory chains are removed by `--delete` regardless of this flag. The flag's additional real effect is on the `--dirs` explicit directory-entry generator: a plain `-d <empty-dir>` run omits the empty source directory's entry, so nothing is created at the destination (no `STATUS_MKDIR`, no `-i`/`--out-format` change line, and an existing empty mirror becomes an extra that `--delete` prunes). Explicitly `--files-from`-listed directories always pass through (documented `--files-from` behavior). A directory that still holds an excluded-but-protected file survives, matching the `--delete-excluded` default |
+| `-m`, `--prune-empty-dirs` | Prune empty dir chains | ✅ Implemented | `-m`/`--prune-empty-dirs` (Phase 7 Wave A freed the rsync short `-m`; FastSync multithreading is now `-j`/`--threads`). FastSync's recursive transfer records directory times but never CREATES an empty directory (a `STATUS_DIR_TIMES` entry is record-only, and `--dirs` empty entries are pruned by this flag), so empty directories are inherently never transferred (which is rsync's `-m` behavior) and truly-empty destination directory chains are removed by `--delete` regardless of this flag. The flag's additional real effect is on the `--dirs` explicit directory-entry generator: a plain `-d <empty-dir>` run omits the empty source directory's entry, so nothing is created at the destination (no `STATUS_MKDIR`, no `-i`/`--out-format` change line, and an existing empty mirror becomes an extra that `--delete` prunes). Explicitly `--files-from`-listed directories always pass through (documented `--files-from` behavior). A directory that still holds an excluded-but-protected file survives, matching the `--delete-excluded` default |
 
 **Deletion-timing implementation notes (Phase 3):** the delete flags above are
 real. Two new config booleans (`delete_during`, `delete_delay`) join the already
@@ -238,7 +239,7 @@ why plain `--append` works on the normal atomic path, not only with `--inplace`.
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
 | `-M`, `--preserve` | Preserve file metadata | ✅ Implemented | Mode, uid, gid, mtime |
-| `-p`, `--perms` | Preserve permissions | 🔀 Alt Arg | `-p` means SSH port; permissions preserved via `-M`/`--preserve` |
+| `-p`, `--perms` | Preserve permissions | ✅ Implemented | Phase 7 Wave A: `-p`/`--perms` now preserve permission bits, folded into FastSync's broad metadata bundle (`--preserve`); the SSH port moved to `--ssh-port`. rsync-parity short form |
 | `-o`, `--owner` | Preserve owner | ✅ Implemented | Part of -M |
 | `-g`, `--group` | Preserve group | ✅ Implemented | Part of -M |
 | `-t`, `--times` | Preserve modification times | ✅ Implemented | Part of -M |
@@ -246,24 +247,24 @@ why plain `--append` works on the normal atomic path, not only with `--inplace`.
 | `--chmod=CHMOD` | Affect file permissions | ✅ Implemented | Supports numeric and symbolic `ugo` `rwx` changes; retains receiver safety masking |
 | `-A`, `--acls` | Preserve ACLs | ✅ Implemented | Implemented on Linux via the POSIX-ACL xattr representation: the sender captures the `system.posix_acl_access` / `system.posix_acl_default` xattrs into the same bounded whitelisted set as `-X`, transmits them per-file, and the receiver re-applies them fd-relative. Setting an ACL the receiver is not permitted to set (non-root on a file it does not own, unsupported filesystem) is logged and skipped, never fatal. libacl is **not** required. Only the `system.posix_acl_*` namespaces plus `user.*` are ever applied; privileged namespaces are never applied (see the Phase-4 xattr/ACL notes below). Implies metadata transmission |
 | `-X`, `--xattrs` | Preserve extended attributes | ✅ Implemented | Preserves unprivileged `user.*` extended attributes (Linux `listxattr`/`getxattr` on capture, `fsetxattr` on the written destination fd). Both capture (sender) and application (receiver) are restricted to the `user.*` namespace and the two POSIX ACL xattrs, so a client can **never** force a `security.*`/`trusted.*`/privileged attribute onto the destination; the receiver independently re-validates every incoming name against this whitelist and rejects anything else. Payloads are bounded (per-name ≤255B, per-value ≤1MiB, per-file count ≤256 total bytes ≤4MiB) on both ends, and an oversized/malformed frame is a clean protocol rejection (no OOM). Applied fd-relative to the exact written file. Implies metadata transmission. Incompatible with `-s` (chunk serialization), rejected up front (see the notes); a `--link-dest`/`-H` hard-link copy fallback re-applies the attributes so they are not dropped when a link is refused |
-| `-H`, `--hard-links` | Preserve hard links | ✅ Implemented | Files on the source that share an inode (`st_dev`+`st_ino`, e.g. a `cp -al` tree) are re-created as hard links to one another on the destination, so duplicate links stay deduplicated and only the first member's data is sent (later members are transmitted as payload-less `STATUS_HARDLINK` frames). The receiver links each sibling to the first member's installed file with an atomic link + rename; on `link()` failure it falls back to a byte-identical local copy of the first member, never a partial/corrupt file. Requires the sequential scan for ordering (the first member is always emitted and installed before any sibling is linked). Works single-threaded and under `-m`, `--inplace`, `--delay-updates` (links staged and published by rename) and `--partial`. Crosses the wire (`preserve_hard_links` bool; `PROTOCOL_VERSION` bumped **2.11.0 → 2.12.0**, peers must match). Incompatible with `-s` (chunk serialization) and `--append`/`--append-verify`, rejected up front with a distinct error. See the Phase-4 hard-links notes below |
+| `-H`, `--hard-links` | Preserve hard links | ✅ Implemented | Files on the source that share an inode (`st_dev`+`st_ino`, e.g. a `cp -al` tree) are re-created as hard links to one another on the destination, so duplicate links stay deduplicated and only the first member's data is sent (later members are transmitted as payload-less `STATUS_HARDLINK` frames). The receiver links each sibling to the first member's installed file with an atomic link + rename; on `link()` failure it falls back to a byte-identical local copy of the first member, never a partial/corrupt file. Requires the sequential scan for ordering (the first member is always emitted and installed before any sibling is linked). Works single-threaded and under `-j`/`--threads`, `--inplace`, `--delay-updates` (links staged and published by rename) and `--partial`. Crosses the wire (`preserve_hard_links` bool; `PROTOCOL_VERSION` bumped **2.11.0 → 2.12.0**, peers must match). Incompatible with `-s` (chunk serialization) and `--append`/`--append-verify`, rejected up front with a distinct error. See the Phase-4 hard-links notes below |
 | `-D` | Same as --devices --specials | ✅ Implemented | Implies `--devices --specials`. `-D` was unassigned in FastSync (verified: no collision), so it is free to imply both device-node and special-file preservation. See the `--devices`/`--specials` rows and the Phase-4 devices notes below |
-| `--devices` | Preserve device files | ⚠️ Partial | Recreates char/block device nodes on the destination via `mknod` instead of transferring content. Type + rdev are validated strictly (S_IFMT from the transmitted mode; major/minor range-checked, non-negative), and creation is **privilege-gated**: `mknod` needs `CAP_MKNOD`, so a non-root receiver (CI runs via setpriv as non-root) logs a warning and **skips the device entry safely** — the whole transfer never aborts just because the node could not be made. The node is created fd-relative below the receive root (`mknodat` on the confined secure parent), so it can never be placed outside the authorized root, never follows a symlink, and never replaces an existing directory. Only a char/block mode is honored. Crosses the wire (a new `STATUS_SPECIAL` frame carries the path + metadata mode + rdev; `PROTOCOL_VERSION` bumped **2.12.0 → 2.13.0**). Divergence: per-entry skip (not a hard error) when the receiver lacks `CAP_MKNOD`, documented in the Phase-4 devices notes |
-| `--specials` | Preserve special files | ⚠️ Partial | Recreates **FIFOs** on the destination via `mkfifo` (unprivileged, so this is a real, assertable behavior under CI). Sockets cannot be recreated by any standard filesystem call and are skipped with an explicit note (best-effort / unsupported, matching the plan). FIFO creation is privileged-gated only in the sense of graceful skip on any permission failure. Node creation is confined below the receive root (`mkfifoat` on the secure fd-relative parent; no `..`, no symlink follow). Crosses the wire like `--devices` (the `STATUS_SPECIAL` frame; `PROTOCOL_VERSION` bumped **2.12.0 → 2.13.0**). See the Phase-4 devices notes |
-| `--copy-devices` | Copy device contents as file | ⚠️ Partial | Copy a device's CONTENT into an ordinary regular file on the destination instead of recreating the node — non-privileged and safe. FastSync scans a device/FIFO as a regular file: its reported size (`st_size`, typically 0 for char devices and FIFOs) is copied, so a FIFO or a non-readable device becomes an empty (or size-bounded) regular file without ever blocking or reading unbounded pseudo-device streams. The run always succeeds and never crashes on such input. **Deliberate, safe divergence from rsync's dd-like unbounded device read.** See the Phase-4 devices notes |
-| `--write-devices` | Write to devices as files | ⚠️ Partial | Write the received data directly into an **existing** device node on the destination instead of creating a regular file. Restricted and best-effort: the destination must already exist and be a char/block device (opened only under the confined receive root, with `O_NOFOLLOW` + `O_NONBLOCK`); a missing, symlinked, FIFO-with-no-reader (`ENXIO`), non-device destination, or any write failure is **skipped with a warning** rather than allowed, so a run can never clobber the system, never blocks on a special-file target, and never aborts on an unusable target. See the Phase-4 devices notes |
+| `--devices` | Preserve device files | ✅ Implemented | Recreates char/block device nodes on the destination via `mknod` instead of transferring content. Type + rdev are validated strictly (S_IFMT from the transmitted mode; major/minor range-checked, non-negative), and creation is **privilege-gated**: `mknod` needs `CAP_MKNOD`, so a non-root receiver (CI runs via setpriv as non-root) logs a warning and **skips the device entry safely** — the whole transfer never aborts just because the node could not be made. The node is created fd-relative below the receive root (`mknodat` on the confined secure parent), so it can never be placed outside the authorized root, never follows a symlink, and never replaces an existing directory. Only a char/block mode is honored. Crosses the wire (a new `STATUS_SPECIAL` frame carries the path + metadata mode + rdev; `PROTOCOL_VERSION` bumped **2.12.0 → 2.13.0**). Divergence: per-entry skip (not a hard error) when the receiver lacks `CAP_MKNOD`, documented in the Phase-4 devices notes |
+| `--specials` | Preserve special files | ⛔ Impossible/Divergence | **FIFO recreation works**: FIFOs are recreated on the destination via `mkfifo` (unprivileged, so this is a real, assertable behavior under CI). **Only socket recreation is impossible**: a socket entry can be created only by `bind(2)` on a live socket, not by any filesystem call, so a source socket is skipped with an explicit note. That one unsupported node kind is why the flag is classified Impossible/Divergence even though FIFO recreation itself works; its normal path is otherwise complete. FIFO creation is privileged-gated only in the sense of graceful skip on any permission failure. Node creation is confined below the receive root (`mkfifoat` on the secure fd-relative parent; no `..`, no symlink follow). Crosses the wire like `--devices` (the `STATUS_SPECIAL` frame; `PROTOCOL_VERSION` bumped **2.12.0 → 2.13.0**). See the Phase-4 devices notes |
+| `--copy-devices` | Copy device contents as file | ✅ Implemented | Copy a device's CONTENT into an ordinary regular file on the destination instead of recreating the node — non-privileged and safe. FastSync scans a device/FIFO as a regular file: its reported size (`st_size`, typically 0 for char devices and FIFOs) is copied, so a FIFO or a non-readable device becomes an empty (or size-bounded) regular file. The default data path is size-bounded and never blocks (it sends exactly `st_size` bytes, never an unbounded pseudo-device stream); with `--sendfile`, a non-regular source (FIFO/device) is detected from its `stat` mode and falls back to that same buffered read, so `--copy-devices --sendfile` cannot hang either. The run always succeeds and never crashes on such input. **Deliberate, safe divergence from rsync's dd-like unbounded device read.** See the Phase-4 devices notes |
+| `--write-devices` | Write to devices as files | ✅ Implemented | Write the received data directly into an **existing** device node on the destination instead of creating a regular file. Restricted and best-effort: the destination must already exist and be a char/block device (opened only under the confined receive root, with `O_NOFOLLOW` + `O_NONBLOCK`); a missing, symlinked, FIFO-with-no-reader (`ENXIO`), non-device destination, or any write failure is **skipped with a warning** rather than allowed, so a run can never clobber the system, never blocks on a special-file target, and never aborts on an unusable target. See the Phase-4 devices notes |
 | `-U`, `--atimes` | Preserve access times | ✅ Implemented | Captures the source access time (from the scanner's pre-read stat, so it is not clobbered by reading the file for transfer) and transmits it over the wire; the receiver restores it together with the mtime via `futimens`/`utimensat`. Implies metadata transmission (the times travel inside the `-M` metadata payload), but does not enable ownership application (that stays opt-in via the identity flags). Wire: new `atime` fields on the metadata frame + a `preserve_atimes` config boolean; `PROTOCOL_VERSION` bumped **2.11.0 → 2.12.0** |
-| `-N`, `--crtimes` | Preserve create times | ⚠️ Partial | Captures the source birth time via `statx(STATX_BTIME)` on Linux and transmits it (recorded as a wire field), but there is **no portable way to set a birth time** (`utimensat` can only set atime/mtime), so the receiver explicitly does NOT apply it: it logs a debug note and continues — never failing the transfer and never pretending it worked. On platforms without `statx` it parses as a documented no-op (flag accepted; nothing is captured). Implies metadata transmission. Wire: new `crtime` fields + a `preserve_crtimes` config boolean; `PROTOCOL_VERSION` bumped **2.11.0 → 2.12.0** (see the Phase-4 metadata-time notes) |
-| `-O`, `--omit-dir-times` | Omit dirs from --times | 🔄 Compatibility No-op | Accepted and parsed for CLI compatibility, and the config boolean crosses the wire, but it has **no effect**: FastSync never preserves directory mtimes in the first place (directories are created via `mkdir` with no metadata, a documented divergence under `-d`/recursive), so there is nothing for an "omit" to suppress. It never breaks a normal run |
-| `-J`, `--omit-link-times` | Omit symlinks from --times | 🔄 Compatibility No-op | Accepted and parsed for CLI compatibility, and the config boolean crosses the wire, but it has **no effect**: FastSync never sets symlink times (`-l`/`--links` copies symlinks as symlinks but the receiver does not apply timestamps/owner to symlink entries), so there is nothing for an "omit" to suppress. It never breaks a normal run |
-| `--super` | Receiver attempts super-user activities | ❌ Not Implemented | |
-| `--fake-super` | Store/recover privileged attrs via xattrs | ⚠️ Partial | Honest, limited subset. The receiver records the source `uid:gid:mode:mtime_sec:mtime_nsec` into a reserved `user.fastsync.stat` xattr on each written file (best-effort, fd-relative), so a later privileged restore could re-apply them — without attempting the (typically failing as non-root) `chown`. Full rsync fake-super **replay** (parsing that xattr to actually re-apply ownership on a later privileged run) is out of scope and is **divergent** from rsync, which uses its own `user.rsync.%stat%` format; no cross-tool conversion is attempted. Implies metadata transmission so the source uid/gid/mode/mtime are available. Both it and `-X`/`-A` are incompatible with `-s` (chunk serialization), rejected up front |
+| `-N`, `--crtimes` | Preserve create times | ⛔ Impossible/Divergence | Birth-times cannot be set by any portable filesystem call (`utimensat`/`futimens` only set atime/mtime), so this row is an explicit **Impossible/Divergence** (Phase 7 Wave B). Capture + transmit stays: `statx(STATX_BTIME)` on Linux records the source birth time as a wire field; the receiver logs a debug note that it cannot be applied and continues — never failing the transfer and never pretending it worked. On platforms without `statx` it parses as a documented no-op (flag accepted; nothing is captured). Implies metadata transmission. Wire: new `crtime` fields + a `preserve_crtimes` config boolean; `PROTOCOL_VERSION` bumped **2.11.0 → 2.12.0** (see the Phase-4 metadata-time notes) |
+| `-O`, `--omit-dir-times` | Omit dirs from --times | ✅ Implemented | Real modifier now that FastSync preserves directory times. With metadata on, the scanner captures every traversed source directory's mtime (and atime under `-U`) and the sender transmits them in trailing `STATUS_DIR_TIMES` frame(s) **after all file data and the optional delete manifest** (chunked at the receiver's `MAX_MANIFEST_ENTRIES` per-frame cap); a dir-time entry only RECORDS metadata and never creates the directory, so empty source directories stay untransferred. The receiver defers applying them until its delete / `--delay-updates` publication phases have committed, so writing or removing a child never clobbers a parent directory's mtime (rsync applies directory times at the end for exactly this reason). When `-O` is set (the boolean crosses the wire) the receiver does not apply any of them; without `-O` an `-a`/`--preserve` transfer now restores directory times (reversing the old "never preserves dir times" divergence). Wire change: the terminal `STATUS_DIR_TIMES` frame; `PROTOCOL_VERSION` bumped **2.16.0 → 2.17.0** |
+| `-J`, `--omit-link-times` | Omit symlinks from --times | ✅ Implemented | Real modifier now that FastSync preserves symlink times. Symlink entries already carried their metadata on `STATUS_SYMLINK`; the receiver now applies it with **no-follow primitives only** (`utimensat(..., AT_SYMLINK_NOFOLLOW)`, plus best-effort `fchmodat(..., AT_SYMLINK_NOFOLLOW)` and policy-gated `fchownat(..., AT_SYMLINK_NOFOLLOW)`), so the link itself is stamped without ever dereferencing it, confined fd-relative below the authorized receive root. A symlink has no children, so the times are applied immediately at creation. When `-J` is set (the boolean crosses the wire) the receiver skips the timestamps (mode/ownership are unaffected); without `-J` an `-a`/`-l` transfer restores symlink mtimes. Wire change alongside `-O`: the shared `STATUS_DIR_TIMES` frame; `PROTOCOL_VERSION` bumped **2.16.0 → 2.17.0** |
+| `--super` | Receiver attempts super-user activities | ✅ Implemented | Phase 7 Wave E: receiver-side **safe-subset + clear-refusal** privilege model, tri-state `super_mode` (auto/on/off). `--super` **permits** the receiver to attempt super-user activities — ownership application and char/block device-node creation — that are already confined fd-relative below the authorized receive root; `--no-super` **forbids** them even when the receiver is root; the default (`auto`) preserves the pre-existing **best-effort** behavior of *attempting* them (not only when already root: an unprivileged attempt is refused by the kernel and skipped per entry, matching FastSync's history). The server additionally accepts an operator-level `--no-super` veto that forces `OFF` for every connection it accepts (so it also refuses any client `--copy-as`/`--super`); the `--fake-super` owner replay and the `--write-devices` write path are gated by the same policy. **FastSync never elevates**: no `setuid`/`seteuid`/`setgid` is ever called, and `--super` never bypasses the confinement floor (`file_open_secure_parent`, `O_NOFOLLOW`, root checks) — it only permits an attempt that is already confined. `--super` does **not** imply `--numeric-ids` and never enables client-chosen ownership on its own: ownership is applied only when an explicit identity policy (`--usermap`/`--groupmap`/`--chown`/`--numeric-ids`/`--copy-as`) is also given. A non-root receiver given `--super` logs exactly one warning at activation and each confined attempt is then refused by the kernel and skipped per entry (never aborts); `--no-super` suppresses ownership, char/block `mknod`, `--write-devices` and the fake-super owner replay, while unprivileged FIFO creation is unaffected. Wire: one trailing `super_mode` int on the config frame (validated 0..2), sent **before** the `--copy-as` block (fixed order: super int, then copy-as presence int + ids); `PROTOCOL_VERSION` bumped **2.17.0 → 2.18.0**. **Documented divergence from rsync:** rsync's `--super` runs the receiver with elevated privilege; FastSync only permits a confined attempt and never elevates |
+| `--fake-super` | Store/recover privileged attrs via xattrs | ✅ Implemented | Phase 7 Wave B: full record **and replay**. The receiver writes the source `uid:gid:mode:mtime_sec:mtime_nsec` into a reserved `user.fastsync.stat` xattr on each written file (best-effort, fd-relative, format unchanged), then immediately re-applies it via `fake_super_restore_fd`: `fchown` (only where privileged — a non-root EPERM/EACCES is skipped silently, matching FastSync's identity philosophy), `fchmod`, and `futimens`. The OWNER leg is additionally skipped unless an explicit ownership identity policy (`--numeric-ids`/`--usermap`/`--groupmap`/`--chown`/`--copy-as`) is active — `--fake-super` on its own only *records* the source owner and must not act as an un-gated chown primitive — when `--no-super` forbids super-user activities (even for root), or when an active `--copy-as` is authoritative, so the recorded source owner can never override a forced `--copy-as` owner; the xattr record is still stored/replayed for a later privileged restore and mode/mtime still apply, so unprivileged `--fake-super` keeps working. The restored mode goes through the same sanitization as the normal metadata path (group/other write bits are never granted, so a recorded 0666 restores as 0644), so fake-super replay can never grant group/other-write that plain `--preserve` would refuse. Absence or a malformed record is a silent no-op, never fatal. The recording format diverges from rsync's `user.rsync.%stat%`; no cross-tool conversion is attempted. Implies metadata transmission so the source uid/gid/mode/mtime are available. Both it and `-X`/`-A` are incompatible with `-s` (chunk serialization), rejected up front |
 | `--open-noatime` | Avoid changing access time when opening files | ✅ Implemented | Sender-side policy: the sender opens source files with `O_NOATIME` (Linux) when reading them for transfer, so the open/read does NOT bump the source's on-disk access time. Degrades safely when `O_NOATIME` is unavailable (not defined) or refused (`EPERM`, since it needs `CAP_FOWNER` or file ownership): the code falls back to a normal open, so the data always transfers — only the atime-bump is skipped. It does not itself capture/preserve atime; it only avoids modifying it. **Client-only, never crosses the wire.** Exposed as `file_open_for_read()` and applied to both the buffered data path and the sendfile path |
 | `--numeric-ids` | Do not map uid/gid by name | ✅ Implemented | Ownership is applied through FastSync's opt-in identity path (see the Phase-4 identity notes below). `--numeric-ids` is a mapping-policy modifier: when applying ownership it uses the transmitted numeric uid/gid directly, skipping the name lookup. Without an ownership-affecting option it is inert (FastSync only applies ownership when the user opts in). It does not need `-M` to be parsed, but ownership is only applied when metadata (hence the source uid/gid) is actually transmitted (see the notes) |
 | `--usermap=STRING` | Map usernames | ✅ Implemented | Opt-in ownership application. rsync subset implemented: comma-separated `FROM:TO` rules evaluated in order, first match wins; `FROM`/`TO` are group/user names (resolved on the SOURCE machine at parse time), `*` (FROM matches any id / TO = the receiving process's current euid), and an `@N` or bare `N` numeric id. Rules are carried over the wire as resolved numeric id pairs; the receiver applies a matching rule (else falls back to `--chown`, `--numeric-ids`, then a best-effort name lookup) via an fd-relative `fchown`. Malformed/unresolvable specs are rejected with a clear error, never a silent no-op. Implies metadata preservation so the source uid/gid travel. Only effective when the receiver can actually change ownership (root or membership); otherwise it warns and continues |
 | `--groupmap=STRING` | Map group names | ✅ Implemented | Same rsync subset and semantics as `--usermap` but for the group (gid) side and the group databases. See the Phase-4 identity notes |
 | `--chown=USER:GROUP` | Map owner and group | ✅ Implemented | Opt-in ownership override applied receiver-side. Forms: `USER:GROUP`, `USER` (owner only), `:GROUP` (group only); a `*` for USER/GROUP means the current/root user or group as appropriate; an `@N`/bare `N` numeric id is accepted. A `:` inside a name may be escaped as `\:`. Equivalent to a trailing `*:*` usermap+groupmap rule (so an explicit `--usermap`/`--groupmap` match wins). Malformed or unresolvable specs are clear parse errors. Implies metadata preservation. Only effective when the receiver has permission to chown; otherwise it warns and continues (rsync parity) |
-| `--copy-as=USER[:GROUP]` | Perform the copy as another user/group | ❌ Not Implemented | |
+| `--copy-as=USER[:GROUP]` | Perform the copy as another user/group | ✅ Implemented | Safe-subset implementation, an explicit divergence from rsync's **real identity switching**. rsync makes the receiving process actually assume USER/GROUP (setuid/setgid); FastSync's receiver is multithreaded, so a real credential drop would be unsafe and is never attempted — FastSync never calls `setuid`/`seteuid`/`setgid`. Instead the receiver FORCES the ownership of every entry it writes to `copy_as_uid`/`copy_as_gid` through the existing confined, fd-relative identity path (the same `fchown`/`fchownat` mechanism as `--chown`/`--usermap`/`--groupmap`; symlinks use `fchownat(..., AT_SYMLINK_NOFOLLOW)`, and directories — including intermediate parents created implicitly while writing a nested file — and char/block/FIFO nodes are owned no-follow too, so a directory never keeps the receiver's owner while its children get the target owner), with `--copy-as` at the **highest priority** — it beats usermap/groupmap/`--chown`/`--numeric-ids` and the best-effort name lookup. This REQUIRES a privileged (root) receiver: an unprivileged receiver REFUSES the whole transfer up front at the config handshake (`server_module_gate`, running inside `config_receive_with_validate` before the `STATUS_OK` ack) with a clear error and no file data exchanged — never a silent wrong-ownership result. A server running with an operator `--no-super` veto also refuses it, and a **daemon** refuses `--copy-as`, like every other client-chosen-ownership request (`--numeric-ids`/`--chown`/`--usermap`/`--groupmap`/`--fake-super`/explicit `--super`), unless the selected module opts in with `client owner = yes`; without that per-module opt-in a daemon must not honor an arbitrary client-selected owner (the standalone listener and SSH `--stdio` server keep honoring these for their single operator-authorized root). `--fake-super` interaction: `--copy-as` is authoritative, so the recorded source owner is never replayed over the forced target owner. If the ownership apply still fails with EPERM/EACCES (capability-restricted root, root-squash, read-only mount) the failure is logged at ERROR and the **entry is reported as failed** rather than written with the wrong owner, which fails the transfer (fail-fast) so overall success is never reported with the wrong owner. USER is resolved on the client against the user database (a name, an `@N`/bare `N` numeric id, or `*` meaning the client's current euid); when `:GROUP` is present it is resolved against the group database (`*` meaning the client's egid). **Group-default rule:** when the group is omitted FastSync uses the user's primary gid (`getpwuid(uid)->pw_gid`); a numeric id with no local passwd entry has no primary gid to look up, so `gid` falls back to `uid` (documented divergence). Malformed/empty/unresolvable specs are clear parse errors, never a silent no-op. Never elevates privileges and never bypasses the confined receive root. Implies metadata preservation (the source uid/gid must be transmitted). Wire: a new trailing config-frame block **sent after** the `--super` int (presence int, then the two int32 ids, both validated `>= 0` on receive; the ids are also rejected if they do not fit int32 at CLI parse time); `PROTOCOL_VERSION` bumped **2.17.0 → 2.18.0** |
 
 **Phase-4 metadata-time notes:** `-U/--atimes`, `-N/--crtimes`,
 `-O/--omit-dir-times`, `-J/--omit-link-times`, and `--open-noatime` are new.
@@ -348,14 +349,15 @@ fails the transfer and never pretends the crtime was applied. This is the
 explicit, documented unsupported-attribute handling. On platforms without
 `statx` the flag is accepted but nothing is captured (a documented no-op).
 
-**omit-dir-times / omit-link-times:** `-O` and `-J` are **accepted and parsed
-for CLI compatibility** and their config booleans cross the wire, but they are
-genuine **no-ops**: FastSync does not apply directory or symlink times at all
-(directories are made via `mkdir` with no metadata; symlinks are dereferenced
-or skipped, never written with a target), so there is nothing for an "omit" to
-suppress. They never break a normal run. This is documented as a
-divergence — the flags recognize the rsync interface but have no filtering
-effect in FastSync.
+**omit-dir-times / omit-link-times:** `-O` and `-J` are **real modifiers** as of
+P7 Wave D (`🔄 → ✅ Implemented`). FastSync now preserves directory mtimes
+(captured by the scanner, transmitted in trailing `STATUS_DIR_TIMES` frame(s),
+applied only after all children and the delete/publication phases) and symlink
+mtime/owner/mode (no-follow `utimensat`/`fchownat`/`fchmodat` at link creation).
+`-O` makes the receiver skip the directory-time set; `-J` makes it skip the
+symlink timestamps (ownership/mode application is unaffected and stays governed
+by the identity opt-in). Both config booleans already crossed the wire. See the
+`-O`/`-J` rows and the Wave D note below.
 
 **-U/-N and -M interaction:** because FastSync carries all metadata (mode, uid,
 gid, mtime, and now atime/crtime) in one bounded payload that is only sent when
@@ -414,7 +416,7 @@ transferred normally and carries the data; each later (sibling) member is
 transmitted as a payload-less `STATUS_HARDLINK` frame carrying its destination
 path, the group id, and the first member's destination-relative wire path.
 Ordering is guaranteed by forcing the sequential scanner whenever `-H` is on
-(even under `-m`), so the first member is always emitted — and, on the receiver's
+(even under `-j`/`--threads`), so the first member is always emitted — and, on the receiver's
 single write thread, installed — before any of its siblings; the receiver is
 therefore always able to link to an already-present first member, including the
 "first member already up-to-date/skipped" case (the sibling links to or copies
@@ -523,9 +525,10 @@ was bumped **2.12.0 → 2.13.0** (peers must match, exactly as prior phases did)
   predicate unconditionally, a plain `-l` sync **refuses to round-trip a
   legitimate absolute symlink target** (it is dropped, never created pointing
   outside the root — see the `--munge-links` note for the symmetric trust
-  boundary); a relative in-root target is copied as-is. FastSync also does not
-  set timestamps/owner on symlinks (no symlink-mode metadata application),
-  matching its existing no-op `--omit-link-times`.
+  boundary); a relative in-root target is copied as-is. As of P7 Wave D FastSync
+  also applies the symlink's own metadata with no-follow primitives
+  (`utimensat`/`fchownat`/`fchmodat` with `AT_SYMLINK_NOFOLLOW`), so `-J` is a
+  real omit switch rather than a no-op.
 - **`-k/--copy-dirlinks`** (sender): a symlink whose referent is a directory is
   dereferenced and recursed into as a real directory; a symlink to a regular
   file (or any non-directory) is kept as a symlink. This is rsync's `-k`. When
@@ -563,7 +566,7 @@ was bumped **2.12.0 → 2.13.0** (peers must match, exactly as prior phases did)
   symlink is being transmitted (`-l`/`-k`/`-a` off) `--munge-links` has nothing
   to rewrite and is inert. -*K/`--keep-dirlinks` policy is installed per
   connection at config-accept (stable for the whole transfer, never racy under
-  `-m`), and only ever follows an in-root symlink-to-directory.*
+  `-j`/`--threads`), and only ever follows an in-root symlink-to-directory.*
 
 **Compatibility (byte-identical when all three are absent):** `-k`, `-K` and
 `--munge-links` are opt-in. Without them the scanner's link handling, the wire
@@ -576,8 +579,8 @@ now transmits targets (the prior behavior was broken/partial); its status moved
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `-S`, `--sparse` | Sparse block handling | ⚠️ Partial | Flag is accepted, but full hole preservation is not implemented |
-| `--preallocate` | Allocate dest files before writing | ✅ Implemented | The receiver preallocates the destination file's full expected space before any data is written, so a transfer that would overflow disk fails fast at allocation time (a clean error, not a half-written file) and the file is laid out contiguously, avoiding fragmentation. Crosses the wire (the config frame carries a `preallocate` boolean; `PROTOCOL_VERSION` bumped **2.10.0 → 2.11.0**, peers must match) so the sender knows the receiver will preallocate and the receiver performs it. **Allocation approach:** `posix_fallocate()` is preferred because it reserves *real* disk blocks (true fail-fast on ENOSPC), falling back to plain `ftruncate()` only when the filesystem reports the allocation is unsupported (`EOPNOTSUPP`/`ENOSYS`); `ftruncate` still extends the logical size so the intent degrades gracefully. **Fallback/error semantics:** `EOPNOTSUPP`/`ENOSYS` → clean fallback to `ftruncate` (best-effort, preallocates the logical size and never fails a transfer on filesystems that lack `posix_fallocate`); a genuine allocation failure (`ENOSPC`/`EDQUOT`/`EFBIG`/…) aborts the file/receive with a distinct `preallocate failed ... transfer aborted` error — it does **not** fall back to a normal non-preallocated write, preserving the fail-fast purpose. **Size-known requirement:** preallocation only runs when the final size is already known up front (the normal regular-file case); unknown-length data is skipped (never failed). **Orthogonality:** applies uniformly across the atomic temp+rename store path, `--inplace`, `--partial`/`--partial-dir`, `--delay-updates` (the staged temp file is preallocated before data flows) and the `--link-dest` copy fallback; it neither implies nor conflicts with `-s`, `--append`, or delta. rsync-divergence: rsync signals that `--preallocate` is ignored with `--sparse`; FastSync simply preallocates first and still honours `--sparse`'s `ftruncate` sizing/trim, so the two combine rather than one being silently ignored. See the Phase-4 preallocate notes below |
+| `-S`, `--sparse` | Sparse block handling | ✅ Implemented | Phase 7 Wave B: real hole preservation with no wire change. The receiver's sparse-aware writer (`write_all_sparse`, next to `write_all` in `src/shared/file.c` and `src/shared/file_store.c`) walks the in-memory file image and emits any all-zero run ≥ 4096 bytes as a hole via `lseek(SEEK_CUR)` (the pre-size `ftruncate` guarantees the offset bookkeeping and logical size), `ftruncate(size)` after the last run pins the final size even with a hole tail. Wired into both the atomic temp+rename store and `--inplace` when `sparse` is set; the non-sparse path is byte-identical to before. **Sparse wins over `--preallocate`** (posix_fallocate is skipped when sparse is set, so the holes are not re-allocated). Interplay note: under `--partial` a retained sparse temp already has the full logical size (trailing content is holes), so `--append`'s "shorter destination" resume does not re-run; the retained file is still valid and a normal re-transfer (or `-W`/delta) repairs it — documented so the combination is never surprising |
+| `--preallocate` | Allocate dest files before writing | ✅ Implemented | The receiver preallocates the destination file's full expected space before any data is written, so a transfer that would overflow disk fails fast at allocation time (a clean error, not a half-written file) and the file is laid out contiguously, avoiding fragmentation. Crosses the wire (the config frame carries a `preallocate` boolean; `PROTOCOL_VERSION` bumped **2.10.0 → 2.11.0**, peers must match) so the sender knows the receiver will preallocate and the receiver performs it. **Allocation approach:** `posix_fallocate()` is preferred because it reserves *real* disk blocks (true fail-fast on ENOSPC), falling back to plain `ftruncate()` only when the filesystem reports the allocation is unsupported (`EOPNOTSUPP`/`ENOSYS`); `ftruncate` still extends the logical size so the intent degrades gracefully. **Fallback/error semantics:** `EOPNOTSUPP`/`ENOSYS` → clean fallback to `ftruncate` (best-effort, preallocates the logical size and never fails a transfer on filesystems that lack `posix_fallocate`); a genuine allocation failure (`ENOSPC`/`EDQUOT`/`EFBIG`/…) aborts the file/receive with a distinct `preallocate failed ... transfer aborted` error — it does **not** fall back to a normal non-preallocated write, preserving the fail-fast purpose. **Size-known requirement:** preallocation only runs when the final size is already known up front (the normal regular-file case); unknown-length data is skipped (never failed). **Orthogonality:** applies uniformly across the atomic temp+rename store path, `--inplace`, `--partial`/`--partial-dir`, `--delay-updates` (the staged temp file is preallocated before data flows) and the `--link-dest` copy fallback; it neither implies nor conflicts with `-s`, `--append`, or delta. rsync-divergence: rsync signals that `--preallocate` is ignored with `--sparse`; FastSync gives **sparse precedence** — when both are set, `posix_fallocate` is skipped so the holes the sparse writer creates are not re-allocated (the `ftruncate` presize sizing stays), matching the intent of "sparse wins". See the Phase-4 preallocate notes below |
 
 **Preallocate notes (Phase 4, preallocate wave):** `--preallocate` is implemented as a real receiver-side allocation of the destination file's space before data is written. It is a plain boolean config flag that crosses the wire (serialized in the config frame's selection-options block, mirroring `--inplace`/`--append`/`--force`), so the run requires matching ends: `PROTOCOL_VERSION` was bumped **2.10.0 → 2.11.0** (peers must match or the version check fails). The allocation is performed on the exact destination fd, immediately after it is opened, before any bytes are streamed; `posix_fallocate` (and the `ftruncate` fallback) leave the fd's file offset untouched, so the subsequent data write at offset 0 is unaffected and complete. Because FastSync writes each file's byte payload in one in-memory batch, the "full expected size" is exactly the known `data_size`, which is what gets preallocated. Unknown-length/streamed payloads are skipped rather than failed. A failed allocation logs a distinct `preallocate failed` error and aborts the file (the atomic temp is unlinked, the inplace target is left untrimmed) so the run fails cleanly and never silently degrades to a non-preallocated write — preserving rsync's fail-fast intent on a full disk.
 
@@ -597,10 +600,10 @@ now transmits targets (the prior behavior was broken/partial); its status moved
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `-z`, `--compress` | Compress file data | 🔀 Alt Arg | Always uses zstd (rsync supports multiple algorithms) |
+| `-z`, `--compress` | Compress file data | ✅ Implemented | Always uses zstd (rsync supports multiple algorithms — a documented divergence, selectable via `--compress-choice`). Phase 7 Wave A: `-z` is now the compression short form; `-c` is rsync's `--checksum` |
 | `--compress-choice=STR`, `--zc=STR` | Choose compression algorithm | ✅ Implemented | FastSync supports `zstd` and `none` |
 | `--compress-level=NUM`, `--zl=NUM` | Set compression level | ✅ Implemented | 1-22, default 5 |
-| `--compress-threads=NUM` | Set compression threads | ❌ Not Implemented | |
+| `--compress-threads=NUM` | Set compression threads | ✅ Implemented | `compression_threads` config field (client-only; does not cross the wire). Sets the number of worker threads used by the zstd compression pool to NUM (1..64; 0/garbage/oversized rejected up front). Accepted in both `--compress-threads=NUM` and two-argument `--compress-threads NUM` forms. Composes with `-z`/compression; under the `-j`/`--threads` multithreaded pipeline it parallelizes compressed chunk encoding. See test_tcp.py `-z --compress-threads=2` and test_client_cli.c |
 | `--skip-compress=LIST` | Skip compress for suffixes | ✅ Implemented | Comma-separated, case-insensitive suffix list; empty list skips none; incompatible with FastSync chunk serialization (`-s`) |
 
 ## 13. Connectivity
@@ -608,7 +611,7 @@ now transmits targets (the prior behavior was broken/partial); its status moved
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
 | `-e`, `--rsh=COMMAND` | Remote shell to use | ✅ Implemented | `-e`/`--rsh` (and `--rsh=COMMAND`) select the remote-shell program used to build the SSH child argv, overriding the default `ssh`. The command is whitespace-split into the leading argv words so rsync's `-e "ssh -p 2222"` works; the standard `-o` family, an optional `-p` port, `user@host` and the quoted remote command (`fastsync-server --stdio`) follow. Stored in the `rsh_command` config field. **Client-only, never crosses the wire** (it is a launch concern, not a handshake property) |
-| `--rsync-path=PROGRAM` | rsync binary on remote | ✅ Implemented | Alias for `--fastsync-server-path`: both write the `fastsync_server_path` config field used as the remote-side server program (quoted as one remote-shell word unless `--old-args`), which CROSSES the wire as before. Kept separate from `--rsh`, which names the local connecting program |
+| `--rsync-path=PROGRAM` | rsync binary on remote | ✅ Implemented | Alias for `--fastsync-server-path`: both write the `fastsync_server_path` config field used as the remote-side server program (always quoted as one remote-shell word), which CROSSES the wire as before. Kept separate from `--rsh`, which names the local connecting program |
 | `--port=PORT` | Alternate daemon port | ✅ Implemented | rsync's daemon-port flag maps to the client-side `server_port` config field: a client connects to a TCP/TLS server (incl. `host::module/path` daemon destinations) with `--server-port`, and the `fastsync-server --daemon` listener's port is taken from its config's `port` key (default 873) or overridden by `--dparam port=` / `-p` |
 | `--sockopts=OPTIONS` | Custom TCP options | ✅ Implemented | Comma-separated allowlist of `OPT=VAL` applied via `setsockopt` after `socket()` before `connect()`/`bind()`. Only `TCP_NODELAY`, `SO_KEEPALIVE`, `SO_REUSEADDR` (0/1) and `SO_RCVBUF`/`SO_SNDBUF` (byte count) are accepted; an unknown option name or a bad value is rejected up front, never silently ignored. A value is required for every option (`OPT=VAL`; a bare name is an error). Applied to the outgoing TCP and TLS client socket; absent by default. `SockOptEntry`/`sockopts` config fields. Local socket concern: never crosses the wire |
 | `--blocking-io` | Use blocking I/O for remote shell | ✅ Implemented | With `--blocking-io` the SSH-transport socketpair socket is left without `SO_RCVTIMEO`/`SO_SNDTIMEO`, so the transfer blocks naturally; by default it gets the same read/write timeout as the TCP transport (see `--timeout`). `blocking_io` config bool. **Client-only, never crosses the wire** |
@@ -616,31 +619,33 @@ now transmits targets (the prior behavior was broken/partial); its status moved
 | `--address=ADDRESS` | Bind address for outgoing socket | ✅ Implemented | Binds the outgoing client socket to a local source address before `connect()` (resolved with the same `-4`/`-6` family hints as the destination). Local socket concern: never crosses the wire |
 | `-4`, `--ipv4` | Prefer IPv4 | ✅ Implemented | Forces `AF_INET` in the `getaddrinfo` hints for client destination/source resolution and the server bind (see the Phase 5, Wave B note). Mutually exclusive with `-6` |
 | `-6`, `--ipv6` | Prefer IPv6 | ✅ Implemented | Forces `AF_INET6` in the `getaddrinfo` hints for client destination/source resolution and the server bind. Mutually exclusive with `-4` |
-| `--remote-option=OPT`, `-M` | Send an option only to the remote side | ✅ Implemented | Long form only; each value is appended to the remote server invocation over SSH as an individually single-quote-escaped shell word in `ssh_build_remote_command()`. Values are validated (non-empty, no control characters) and shell metacharacters cannot break out of the quoting (`;`, `&`, `|`, <code>`</code>, `$`, `(`, `)`, quotes are neutralized), so a value cannot inject an arbitrary remote command and a subsequent `--` on the client line cannot be turned into one. The options never cross the binary config frame. Divergence: the short `-M` form is intentionally unavailable because `-M` is already FastSync's metadata-preservation flag/multiplier (see Phase 5 notes below) |
+| `--remote-option=OPT`, `-M` | Send an option only to the remote side | ✅ Implemented | Each value is appended to the remote server invocation over SSH as an individually single-quote-escaped shell word in `ssh_build_remote_command()`. Values are validated (non-empty, no control characters) and shell metacharacters cannot break out of the quoting (`;`, `&`, `|`, <code>`</code>, `$`, `(`, `)`, quotes are neutralized), so a value cannot inject an arbitrary remote command and a subsequent `--` on the client line cannot be turned into one. The options never cross the binary config frame. Phase 7 Wave A: the short `-M` form is now available (as `-M OPT` and `-M=OPT`), matching rsync; metadata mode moved to long-only `--preserve` |
 
 ## 14. Daemon Mode
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `--daemon` | Run as rsync daemon | ✅ Implemented | Wave A: a real persistent listener. `fastsync-server --daemon --config FILE` (plus `--no-detach` to stay foreground; without it the listener detaches to the background after binding) reads a FastSync-native module config file and serves each connection confined to the requested module's `path` root (never a client-chosen root; no `--super`/`--copy-as`). TCP/TLS via the existing `--tls` stack; plaintext still requires `--allow-unauthenticated` (same secure default as the standalone server). Client destinations use rsync's `host::module/path` form. Wire/protocol: the config frame gained a trailing daemon-module string and `PROTOCOL_VERSION` was bumped **2.14.0 → 2.15.0** (see the Daemon Mode notes below). Daemon mode is built in FastSync's own protocol/config grammar, not rsync's SMB/daemon option encoding |
+| `--daemon` | Run as rsync daemon | ✅ Implemented | Wave A: a real persistent listener. `fastsync-server --daemon --config FILE` (plus `--no-detach` to stay foreground; without it the listener detaches to the background after binding) reads a FastSync-native module config file and serves each connection confined to the requested module's `path` root (never a client-chosen root; every client-chosen-ownership/super-user request (`--numeric-ids`/`--chown`/`--usermap`/`--groupmap`/`--fake-super`/`--copy-as`/explicit `--super`) is refused unless the module opts in with `client owner = yes`, and the operator `--no-super` veto is honored). TCP/TLS via the existing `--tls` stack; plaintext still requires `--allow-unauthenticated` (same secure default as the standalone server). Client destinations use rsync's `host::module/path` form. Wire/protocol: the config frame gained a trailing daemon-module string and `PROTOCOL_VERSION` was bumped **2.14.0 → 2.15.0** (see the Daemon Mode notes below). Daemon mode is built in FastSync's own protocol/config grammar, not rsync's SMB/daemon option encoding |
 | `--config=FILE` | Alternate rsyncd.conf file | ✅ Implemented | Wave A: selects the daemon config file. Default when omitted (in `--daemon` mode): `~/.config/fastsync/fastsyncd.conf` if it exists, else `/etc/fastsyncd.conf`. The grammar is FastSync-native (documented in the Daemon Mode notes below) and strictly rejects unknown keys so a typo can never silently change what a module serves; requires `--daemon` |
 | `--dparam=OVERRIDE` | Override global daemon config | ✅ Implemented | Wave A: overrides one global scalar from the command line (`--dparam port=8734` and `--dparam=KEY=VALUE` both work). Limited to the global scalar keys the grammar defines (`port`, `motd file`, `address`); keys are case-insensitive and unknown keys/invalid values are rejected. Requires `--daemon` |
 | `--no-detach` | Don't detach from parent | ✅ Implemented | Wave A: with `--daemon`, keeps the listener in the foreground (what integration tests use). Without it the daemonizes (fork/setsid, stdio redirected to /dev/null) after the listening socket is bound. Requires `--daemon` |
-| `--password-file=FILE` | Read daemon password from file | ✅ Implemented | Wave B daemon auth. Client: `--password-file` supplies `user:password` for a `host::module/path` destination (the username is taken from this file, so `user@host::module` stays rejected). Server (`fastsync-server --daemon --password-file FILE`): the credential store that modules with `auth users` are verified against. Only a SHA-256 digest of the password ever crosses the wire or is stored server-side; the literal password never appears in logs. See the Daemon Mode notes below for the file formats and the plaintext/TLS caveat |
-| `--early-input=FILE` | Use FILE for daemon early exec | ✅ Implemented | Server-only (requires `--daemon`): a second credential-store file, same `user:SHA256HEX` grammar as `--password-file`, read before the listener accepts connections (a secrets-manager / process-substitution source). Its entries layer over `--password-file`: identical entries dedupe, a conflicting secret for the same user is a startup error. A daemon whose modules declare `auth users` must be given at least one of the two, or it refuses to start (fail closed) |
+| `--password-file=FILE` | Read daemon password from file | ✅ Implemented | A7 daemon auth. Client: `--password-file` supplies `user:password` for a `host::module/path` destination (the username is taken from this file, so `user@host::module` stays rejected); the literal password is held client-side only for the SCRAM handshake and wiped at teardown. Server (`fastsync-server --daemon --password-file FILE`): the salted-PBKDF2 verifier store that modules with `auth users` are verified against. **Neither the password nor any replayable bearer value crosses the wire or is stored server-side** — the store holds a per-user salt plus derived keys, and the daemon proves the secret with a per-connection nonce challenge. The file must be private to its owner: both the client and server verify the exact inode they read (open-then-`fstat`, so the check cannot be raced) and refuse a `--password-file`/`--early-input` that is not owned by the current user or grants any group/other permission bit (mode 0600), mirroring the TLS private-key check. A process-substitution pipe (`--early-input <(vault ...)`) is still accepted when it satisfies those checks. See the Daemon Mode notes below for the file formats and the plaintext/TLS caveat |
+| `--early-input=FILE` | Use FILE for daemon early exec | ✅ Implemented | Server-only (requires `--daemon`): a second credential-store file, same new-format grammar as `--password-file`, read before the listener accepts connections (a secrets-manager / process-substitution source). Its entries layer over `--password-file`: byte-identical verifiers dedupe, a conflicting verifier for the same user is a startup error. A daemon whose modules declare `auth users` must be given at least one of the two, or it refuses to start (fail closed) |
+| `--hash-credentials=FILE`, `--iterations N` | Hash a plaintext credential file | ✅ Implemented | Server-only offline tool (A7): reads the `user:password` lines of FILE (same owner-only 0600 check) and prints one new-format store line per entry to stdout, then exits. `--iterations` sets the PBKDF2 work factor (default 600000, range 100000–10000000). Dependency-free and does not run a listener. Use its output as `--password-file` for `--daemon`. There is no auto-upgrade: a legacy store line is hard-rejected by the loader and must be regenerated |
 
-**Daemon Mode notes (Wave A, protocol 2.15.0; Wave B auth, Wave C MOTD, no bump):** FastSync daemon mode is supported in FastSync's own protocol/config grammar, not rsync's SMB/daemon option encoding.
+**Daemon Mode notes (Wave A protocol 2.15.0; A7 auth protocol 2.19.0; MOTD no bump):** FastSync daemon mode is supported in FastSync's own protocol/config grammar, not rsync's SMB/daemon option encoding.
 
-- **Config grammar** (`fastsyncd.conf`): line-based; an implicit global section first, then `[module]` sections. Keys are case-insensitive, values are trimmed and may be wrapped in one layer of double quotes (`path = "/srv/my dir"`). `#` and `;` at the start of a line (after leading whitespace) are full-line comments; inline comments and `\` continuations are not supported. Lines are bounded (4096 chars). Global keys: `port` (default 873), `motd file` (the daemon sends its bounded, escaped content to a client after the module gate/auth accepts, unless the client passes `--no-motd`), `address` (optional bind address). Module keys: `path` (required; the daemon-side authorized root for that module), `read only` (yes/no/true/false/1/0, default no), `auth users` (comma list). **Unknown keys and malformed lines are parse-and-reject errors** (never silently ignored), so a typo cannot change what a module serves.
-- **Module selection & confinement:** the client requests a module with an rsync-style `host::module[/path]` destination. The module name crosses the wire as a trailing string on the config frame (bumping `PROTOCOL_VERSION` 2.14.0 → 2.15.0; the bump is required because the config-frame layout changed and the strict same-version handshake is what prevents a peer from desynchronizing on the new trailing field). The daemon looks the module up in ITS OWN config and uses the module's `path` as the authorized root through the exact same `configure_authorization` confinement the standalone server applies to `--destination-root` (`file_open_secure_parent`, `has_path_traversal`, `path_is_within`); the client never supplies the root and there is no `--super`/`--copy-as`. The client's `/path` part is relative inside the module and is rejected if absolute or if it contains `..`. Unknown modules are refused before any data moves (the run fails cleanly at the config handshake). An absolute destination and a module request against a non-daemon server are also refused.
+- **Config grammar** (`fastsyncd.conf`): line-based; an implicit global section first, then `[module]` sections. Keys are case-insensitive, values are trimmed and may be wrapped in one layer of double quotes (`path = "/srv/my dir"`). `#` and `;` at the start of a line (after leading whitespace) are full-line comments; inline comments and `\` continuations are not supported. Lines are bounded (4096 chars). Global keys: `port` (default 873), `motd file` (the daemon sends its bounded, escaped content to a client after the module gate/auth accepts, unless the client passes `--no-motd`), `address` (optional bind address). Module keys: `path` (required; the daemon-side authorized root for that module), `read only` (yes/no/true/false/1/0, default no), `client owner` (yes/no/true/false/1/0, default no; opts the module into client-chosen ownership — see below), `auth users` (comma list). **Unknown keys and malformed lines are parse-and-reject errors** (never silently ignored), so a typo cannot change what a module serves.
+- **Module selection & confinement:** the client requests a module with an rsync-style `host::module[/path]` destination. The module name crosses the wire as a trailing string on the config frame (bumping `PROTOCOL_VERSION` 2.14.0 → 2.15.0; the bump is required because the config-frame layout changed and the strict same-version handshake is what prevents a peer from desynchronizing on the new trailing field). The daemon looks the module up in ITS OWN config and uses the module's `path` as the authorized root through the exact same `configure_authorization` confinement the standalone server applies to `--destination-root` (`file_open_secure_parent`, `has_path_traversal`, `path_is_within`); the client never supplies the root, every client-chosen-ownership/super-user request is refused unless the module declares `client owner = yes` (the daemon's per-module opt-in, see below), and the operator `--no-super` veto forces super-user activities off for every daemon connection. The client's `/path` part is relative inside the module and is rejected if absolute or if it contains `..`. Unknown modules are refused before any data moves (the run fails cleanly at the config handshake). An absolute destination and a module request against a non-daemon server are also refused.
+- **`client owner` (client-chosen-ownership opt-in):** by default a daemon module refuses every request that would let the client pick an owner or ask for super-user activities — `--numeric-ids`, `--chown`, `--usermap`/`--groupmap`, `--fake-super`, `--copy-as`, and an explicit `--super` — at the config handshake (before `STATUS_OK`), because a daemon has no per-module opt-in for client-chosen ownership and any anonymous client could otherwise force arbitrary owner ids inside the module root. `client owner = yes` opts a single module in, allowing those requests within that module's root (the standalone listener and the SSH `--stdio` server always honor them for their single operator-authorized root). Without the opt-in the daemon also forces super-user **device** activity off for that connection — char/block device-node creation (`--devices`) and `--write-devices` — even under the default `AUTO` mode, so a non-opted module can never be made to `mknod` or write a raw device; those entries are skipped (not refused) so an ordinary `-a` push still succeeds without device nodes. The opt-in does **not** lift the privilege requirement: `--copy-as` still needs a root receiver, and the operator `--no-super` veto still forces super-user activities off for every connection. The daemon logs a prominent startup warning for each `client owner = yes` module so the operator's deliberate choice is visible.
 - **`read only` safe default:** every network transfer FastSync currently supports is a push that writes under the module root, so a `read only` module refuses the connection (clear server log "module is read only"; the client exits non-zero, nothing is transferred). A future pull/list operation can be opened up when it exists; the knob is already stored.
-- **`auth users` (Wave B password authentication):** a module that declares `auth users` requires the client to present credentials. The client sends a username + the lowercase hex SHA-256 of the password (never the literal password) in the config frame; the daemon accepts a connection only when the presented username is **on the module's `auth users` list** AND the presented digest matches that user's credential-store entry. Verification is constant-time (username present/absent both take the same comparison work, so there is no timing oracle distinguishing "unknown user" from "wrong password"), and the daemon logs the username but **never the digest or the password**. A module WITHOUT `auth users` stays open (legitimate rsync configuration); credentials sent to such a module are ignored. Read-only is orthogonal: even a correctly authenticated push to a `read only` module is still refused (all FastSync network transfers write). Fail-closed policy: a daemon whose config declares `auth users` on any module refuses to start unless a credential store was given (`--password-file` and/or `--early-input`); a missing or empty store is never silently treated as "open".
-- **Credential store format:** server `--password-file`/`--early-input` files are line-based `user:SHA256HEX`, one per line, where `SHA256HEX` is the lowercase hex SHA-256 of the user's password (exactly what the client transmits). Blank lines and lines starting with `#`/`;` are comments; the parser is strict (a malformed line fails the whole load, so a typo can never let a different set of users in). The client `--password-file` holds `user:password` on its first meaningful line (the literal password, hashed client-side then wiped from memory); keep both files readable only by their owner (mode 0600) since the client file holds the password and the server file holds the equivalent credential. Per-username wire length is bounded (256 chars) and digests are validated to be exactly 64 lowercase hex on receive.
-- **Plaintext caveat:** over a plaintext (non-TLS) daemon, a sniffer can capture the transmitted digest and replay it (the exchange is challenge-less, like rsync), and it sees the same value that is already stored in the server's own credential file — so use `--tls` to protect the exchange. The daemon logs a warning when an auth-required module is reached over plaintext. TLS client-CN (`--client-cn`) is an independent transport identity check and composes with password auth: both may be required on the same connection.
-- **Wire/protocol:** the auth payload is two trailing config-frame strings (username + digest) behind a presence int, sent after the Wave A module string and before the STATUS_OK/STATUS_ERROR ack. Because both peers of a 2.15.0 build always parse the same full frame (the strict same-version handshake rejects any other version before any byte is parsed), this is NOT a new frame layout and does **not** require a `PROTOCOL_VERSION` bump — the 2.15.0 release ships Wave A + Wave B together (see the NOTE in `src/shared/config.h`).
-- **Client side:** `host::module/path` selects the TCP transport and connects to `--server-port`; `host:path` stays the SSH transport; plain paths stay local TCP. The daemon username comes from `--password-file` (first `user:password` line), and `--password-file` without a `host::module/path` destination is a client error (fail fast). A `user@host::module` form is rejected with a pointer to `--password-file`.
+- **`auth users` (A7 SCRAM-SHA-256 authentication):** a module that declares `auth users` requires the client to present credentials. The config frame carries ONLY the username; the daemon answers an auth-required module with `STATUS_AUTH_CHALLENGE` (PBKDF2 iteration count, 16-byte salt, 32-byte server nonce), the client answers with `STATUS_AUTH_RESPONSE` (fresh 32-byte client nonce + a 32-byte ClientProof), and the daemon accepts only when the proof verifies **and** the username is **on the module's `auth users` list** and has a store entry, replying `STATUS_AUTH_OK` with a 32-byte ServerSignature the client verifies before proceeding. Verification is constant-time over fixed 32-byte keys (the compare runs even for a miss), username membership uses a constant-time full-length scan, and an unknown/off-list user still receives a challenge and runs the same math against a dummy verifier: a deterministic per-username salt (`HMAC-SHA256(store dummy key, username)`), the store-wide uniform iteration count and dummy keys. Re-probing the same unknown username therefore yields an identical salt and iteration count while a different username yields a different salt, so there is no user-enumeration or timing oracle. The daemon logs the username but **never the password, proof or keys**. A module WITHOUT `auth users` stays open (legitimate rsync configuration); credentials sent to such a module are ignored. Read-only is orthogonal: even a correctly authenticated push to a `read only` module is still refused (all FastSync network transfers write). Fail-closed policy: a daemon whose config declares `auth users` on any module refuses to start unless a credential store was given (`--password-file` and/or `--early-input`); a missing or empty store is never silently treated as "open". A failed handshake (missing credentials, unknown/off-list user, wrong proof or malformed data) yields a single generic `STATUS_AUTH_FAILED` and the daemon closes before any data moves. The dummy key is persisted in an owner-only `<store_path>.dummykey` sidecar (auto-created on first load, mode 0600) so the dummy salt stays stable across daemon restarts, closing the restart-gated enumeration channel. The sidecar is secret material and must be protected like the credential store (owner-only 0600, included with the store in backups and rotation). It must be preserved across restarts for that guarantee; if it cannot be created (a process-substitution/FIFO store path such as `/dev/fd/N`, a read-only filesystem, a missing directory, or a create/write/fsync/link/fchmod failure), the daemon logs a warning and uses a transient per-run key, so unknown-user challenges change across restarts and the cross-restart guarantee does not hold for that deployment. One residual is accepted: the store iteration count is observable pre-auth by design, since the miss path must match a hit. **Transport policy (hardening A7-3/S1):** an auth-required module accepts credentials only when either (a) the connection is an encrypted, verified TLS connection whose client certificate matches `--client-cn`, or (b) the connection is plaintext from a loopback TCP peer **and** the operator explicitly passed `--allow-unauthenticated`. A remote plaintext peer, and a loopback plaintext peer without that flag, are refused at the config gate before any challenge is sent; `--allow-unauthenticated` never permits remote plaintext auth (remote peers still require verified TLS). Daemon modules are a `--daemon`-only feature — the SSH `--stdio` path never loads a daemon config and is not an auth transport for them. Because the loopback allowance trusts whichever peer the kernel reports as `127.0.0.1`, it assumes nothing relays remote connections to the daemon: a local TCP forwarder or TLS-terminating proxy in front of an auth-module listener makes remote clients appear as loopback and bypasses the mutual-TLS identity check, so do not front an auth-module listener with such a relay.
+- **Credential store format:** server `--password-file`/`--early-input` files are line-based `user:$fastsync$1$pbkdf2-sha256$<iters>$<salt_b64>$<stored_key_b64>$<server_key_b64>`, one per line (standard base64; 16-byte salt, 32-byte keys; `iters` in `[100000, 10000000]`, default 600000). Every entry in the resulting store must agree on `iters` (a store whose entries disagree, or where a layered `--early-input` disagrees with `--password-file`, is rejected). Generate lines with `fastsync-server --hash-credentials FILE [--iterations N]`; the emitted lines are secret material, so redirect them to an owner-only (mode 0600) file (the tool warns on stderr if stdout is a group/other-accessible regular file). Blank lines and lines starting with `#`/`;` are comments; the parser is strict (a malformed line fails the whole load, so a typo can never let a different set of users in). **The legacy `user:SHA256HEX` form is hard-rejected** with an actionable "legacy" error; there is no auto-upgrade, so a replayable bearer digest can never be loaded by a 2.19.0 daemon. The client `--password-file` holds `user:password` on its first meaningful line (the literal password, used only for the handshake then burned); keep both files readable only by their owner (mode 0600). Per-username wire length is bounded (256 chars) and every decoded salt/key length is validated. Loading the store also maintains an owner-only `<store_path>.dummykey` sidecar (auto-created, mode 0600, exactly 32 bytes) holding the store-wide dummy key that shapes unknown-user challenges; persist it across daemon restarts so those challenges stay stable, and treat a sidecar with the wrong owner, a mode other than exactly 0600, the wrong size or the wrong type as a fatal load error (fail closed). If the sidecar cannot be created (e.g. a process-substitution store path such as `/dev/fd/N`, a read-only filesystem, a missing directory, or a create/write/fsync/link/fchmod failure), the daemon logs a warning and uses a transient per-run key, so the cross-restart stability guarantee does not hold there.
+- **Plaintext caveat:** an auth-required module is refused, **before any challenge is sent**, unless the connection is encrypted and verified TLS whose client certificate matches the server's `--client-cn`, or it is plaintext from a loopback TCP peer **and** the operator passed `--allow-unauthenticated`. A remote plaintext peer, and a loopback plaintext peer without that flag, never receive a challenge, and `--allow-unauthenticated` never permits remote plaintext auth (remote peers still require verified TLS). On the loopback plaintext transport that remains permitted, a local sniffer could still read the challenge and response and mount an **offline dictionary attack** against a weak password, so use `--tls` for any real deployment. `--client-cn` matches the certificate CN only (not a subjectAltName), which is acceptable for a private CA. Clients sending daemon credentials with `--password-file` to a non-loopback daemon must use `--tls`; the client rejects such a destination before any network I/O. Unlike the old challenge-less exchange there is **no replay**: the proof is bound to the fresh per-connection server nonce, so a captured `STATUS_AUTH_RESPONSE` cannot be reused on another connection (an integration test proxies the daemon and proves this). TLS client-CN (`--client-cn`) is an independent transport identity check and composes with password auth; because `--tls` already mandates `--client-cn`, a TLS auth connection always verifies the client CN, so both checks necessarily apply together on such a connection.
+- **Wire/protocol:** the config-frame auth block is now `[int present][str_redacted username]` (the old digest field is gone), and the frame stream gains the challenge/response (`STATUS_AUTH_CHALLENGE` → `STATUS_AUTH_RESPONSE` → `STATUS_AUTH_OK`/`STATUS_AUTH_FAILED`) between the config frame and the `STATUS_OK` ack. Both are wire-layout changes, so `PROTOCOL_VERSION` is bumped **2.18.0 → 2.19.0** (see the A7 note in `src/shared/config.h`); the strict same-version handshake keeps a 2.19 client and a 2.18 server from desynchronizing.
+- **Client side:** `host::module/path` selects the TCP transport and connects to `--server-port`; `host:path` stays the SSH transport; plain paths stay local TCP. The daemon username comes from `--password-file` (first `user:password` line), and `--password-file` without a `host::module/path` destination is a client error (fail fast). A `user@host::module` form is rejected with a pointer to `--password-file`. The client's plaintext password is wiped from memory (`config_burn_auth`) at transfer teardown.
 - **MOTD (Wave C):** a daemon configured with a global `motd file` sends that file's content as the first server→client string frame after the config-frame STATUS_OK ack (rsync sends the MOTD as the first thing from the server at the start of a daemon connection). Only the daemon listener path (`host::module`) gets a MOTD; the `--stdio` SSH path never sends or reads one. The server reads the file bounded to 4096 bytes and treats an absent/unreadable file as "no MOTD" (an empty frame, never an error). The exchange is server→client only and does **not** bump `PROTOCOL_VERSION`: every 2.15.0 daemon client reads the frame after the ack, so sender and receiver stay in lockstep (see the Wave C note in `src/shared/config.h`). `--no-motd` is the client-side suppression switch: the client still reads (consumes) the frame to keep the stream in sync but does not display it. The MOTD is printed to stdout with control bytes (ESC included) escaped octal-style while newlines/tabs are preserved, so a hostile server cannot inject terminal escape sequences.
-- **Merge note:** later daemon waves (auth, MOTD) must not bump `PROTOCOL_VERSION` again — the module-selection bump is owned by Wave A (see the NOTE in `src/shared/config.h`).
+- **Merge note:** the Wave A module bump (2.15.0) and the MOTD wave did not bump the version, but the A7 auth redesign is a genuine wire-layout change and owns the 2.18.0 → 2.19.0 bump (see the A7 note in `src/shared/config.h`).
 
 ## 15. Safety & Security
 
@@ -653,7 +658,7 @@ now transmits targets (the prior behavior was broken/partial); its status moved
 | Per-connection memory limit | 1GB per connection | ✅ Implemented | `MAX_CONNECTION_MEMORY` |
 | `--max-alloc=SIZE` | Limit a single memory allocation | ✅ Implemented | Caps the largest single allocation; binary units, default 1G |
 | `--trust-sender` | Trust remote sender's file list | ✅ Implemented | Long-form-only, receiver-local policy that never crosses the wire. The receiver skips its redundant up-front re-validation of the incoming file list (empty/`..` path rejection and the escaping-symlink-target containment), trusting the sender instead of double-checking (fewer checks, faster, potentially unsafe, matching rsync). Off by default. The low-level fd-relative confinement primitives (`file_open_secure_parent`, the O_NOFOLLOW parent walk, leaf/destination confinement) are deliberately KEPT even under `--trust-sender`, so a hostile sender still cannot write or link outside the authorized root (see Phase-5 notes below) |
-| `--old-args` | Disable modern arg protection | ✅ Implemented | SSH-only legacy mode; restores raw remote command construction and permits shell interpretation of the configured server path |
+| `--old-args` | Disable modern arg protection | ✅ Implemented | SSH-only; accepted for CLI compatibility but is now a **documented no-op**: FastSync always single-quote-escapes the remote server path and each `--remote-option` value (`ssh_build_remote_command`), so a metacharacter-bearing `--rsync-path` can never be interpreted by the remote shell. The flag no longer disables that quoting (the old raw-construction behavior was an injection foot-gun and is removed); the safety-relevant behavior is identical either way |
 | `--ignore-missing-args` | Ignore missing source args | ✅ Implemented | FastSync has a single source-root argument (which always exists), so the "explicitly requested source arguments" are the `--files-from` entries and the flags only ever apply there (inert without `--files-from`, like `-R`). Without the flag a listed-but-missing entry stays a hard pre-transfer error (nothing is transferred). With it each missing entry is skipped: nothing is sent for it, it never enters the keep-set, and the run succeeds for the rest — an all-missing non-empty list succeeds transferring nothing, matching rsync. `--dirs` + `--files-from` missing entries are skipped the same way. Every skipped entry is logged and a per-run warning names the count, so the handling is never a silent no-op. Divergences: an EMPTY `--files-from` file stays a hard error in every mode (no argument was requested at all; rsync likewise reports "no source files specified"); missing-arg skipping only applies to the pre-transfer list validation, so an entry that is present at preflight and vanishes mid-transfer still fails (matching rsync, whose flag "does not affect subsequent vanished-file errors"); `--no-ignore-missing-args` is not a supported negation |
 | `--delete-missing-args` | Delete missing source args | ✅ Implemented | Implies `--ignore-missing-args` (order-independent) and additionally removes each missing entry's destination mirror receiver-side. The mirror is computed exactly like a present sibling's wire path: the bare relative entry under `-R`, otherwise the full source-mirror path below the destination root. rsync parity, verified against the man page: it does **not** imply `--delete` generally and is "independent of any other type of delete processing" — unrelated destination extras are untouched unless `--delete` is also present. Composition with `--delete` + timing: the exact-path deletions commit with the manifest, early for `--delete-before`/`--delete-during`, else only after a fully-successful transfer (delete-after/commit). A non-empty directory mirror is removed only when `--force` or `--delete` is in effect (otherwise it is left with a warning and the run continues, like rsync); an absent mirror is a no-op. An explicitly listed missing arg is a user request, not an excluded file: its deletion is never blocked by the filter-exclusion protection of excluded destination mirrors (a mirror sitting inside a filter-excluded directory is still removed). Safety/policy: gated by the server `--allow-delete` policy like `--delete`; the request paths cross the wire only in the delete-manifest frame and are confined by the same receiver validation as the keep-set (non-empty, relative, traversal-free, bounded by the per-section/per-frame manifest caps); the `--delay-updates` staging directory and basis snapshots are protected exactly as in the extras walker. Divergence: the missing-args deletions are not counted toward `--max-delete` (they are explicit per-path requests, not discovered extras). See the Phase-3 wire note below for the `PROTOCOL_VERSION` bump |
 
@@ -661,21 +666,21 @@ now transmits targets (the prior behavior was broken/partial); its status moved
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `--write-batch=FILE` | Write batched update to file | ❌ Not Implemented | |
-| `--only-write-batch=FILE` | Write batch without updating dest | ❌ Not Implemented | |
-| `--read-batch=FILE` | Read batched update from file | ❌ Not Implemented | |
+| `--write-batch=FILE` | Write batched update to file | ✅ Implemented | Phase-6 residual-batch (client-only): runs the normal live transfer AND additionally emits a self-contained single-file batch of the whole source tree. The batch is a magic/format-version header followed by length-prefixed `chunk_serialize` blobs (full file images), replayable byte-identically by `--read-batch` on another machine with no source/server. `--write-batch` drives the single-threaded transfer path (the multithreaded path consumes the config before the separate batch scan pass). See the Phase-6 batch note below |
+| `--only-write-batch=FILE` | Write batch without updating dest | ✅ Implemented | Phase-6 residual-batch: emits the self-contained batch FILE only — NO destination update, NO server connection. Requires a source (scans it and serializes the full tree to FILE). Same single-file format as `--write-batch`, so the file is re-appliable via `--read-batch=FILE DEST`. See the Phase-6 batch note below |
+| `--read-batch=FILE` | Read batched update from file | ✅ Implemented | Phase-6 residual-batch: applies a previously written batch FILE locally to the destination. NO source and NO server — positional args are the destination only. Reads the magic/version header, then length-prefixed records, `chunk_deserialize`, and applies each via the confined `file_save_to_disk_full` path (same O_NOFOLLOW / `..`-rejection / root-confinement as the network receiver, so an attacker-controlled batch cannot escape the destination root). Malformed/truncated/oversized/traversal records are rejected cleanly. See the Phase-6 batch note below |
 
 ## 17. Advanced
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `--stop-after=MINS` | Stop after N minutes | ❌ Not Implemented | |
-| `--stop-at=TIME` | Stop at specified time | ❌ Not Implemented | |
+| `--stop-after=MINS` | Stop after N minutes | ✅ Implemented | Client-only sender stop deadline (Phase 6): computing `--stop-after=MINS` (a positive minute count; 0/negative/garbage rejected) and `--stop-at=TIME` (`HH:MM`, `HH:MM:SS`, or `now+N[smhd]`; a past time stops immediately). The transfer stops ELEGANTLY at the next chunk boundary: everything already fully sent is kept and applied, the run returns 0, and --delete (late/delete-after timing) does NOT wipe the destination — when the scan is cut short the partial keep-set manifest is suppressed with a warning (the delete walk is skipped rather than acting on an incomplete keep-set, so unscanned source mirrors survive). `--delete-before`/`--delete-during` still run their complete pre-scan (which ignores the deadline). Local client-only fields: never serialized into the wire config frame, so no PROTOCOL_VERSION bump. `--stop-after` uses CLOCK_MONOTONIC; `--stop-at` uses the wall clock. Works single-threaded and under `-j`/`--threads` (multithreaded). Divergence: rsync computes `--stop-after` from the run start; FastSync likewise. When both are given, the earlier of the two deadlines wins (checked per iteration). See the Phase-6 stop notes below |
+| `--stop-at=TIME` | Stop at specified time | ✅ Implemented | Same feature as `--stop-after` (deadline transfer stop), absolute wall-clock form (`HH:MM[:SS]` or `now+N[smhd]`). See the row above and the Phase-6 stop notes |
 | `--fsync` | Fsync every written file before publication | ✅ Implemented | |
-| `--protocol=NUM` | Force older protocol version | ❌ Not Implemented | |
-| `--iconv=CONVERT_SPEC` | Charset conversion | ❌ Not Implemented | |
+| `--protocol=NUM` | Force older protocol version | ✅ Implemented | Forces the wire protocol version for this transfer. FastSync has exactly ONE wire format (`PROTOCOL_VERSION`, currently 2.19.0) with no downgrade/backward-compat code paths, so `--protocol=2.19.0` is accepted (it sets the version claim the client sends, which the server already requires to match exactly) and **every other value is rejected up front** with a clear error before any connection — it does not and cannot speak an older or virtual wire format. Divergence from rsync (which negotiates a range and downgrades to an integer 0..31): FastSync's honest contract is force-to-the-one-supported-value; a genuine downgrade would require a per-version compatibility layer that does not exist. Client-only; the server-side exact-match check is unchanged. `--protocol=2.18.0`/`2.18`/`2.17.0`/`2.16.0`/`2.15.0`/`216`/`31`/garbage are all rejected. See the Phase-6 protocol note below |
+| `--iconv=CONVERT_SPEC` | Charset conversion | ✅ Implemented | Charset conversion of FILE NAMES (not content) at the protocol boundary via iconv(3): `--iconv=LOCAL[,REMOTE]` — the sender converts each local filename LOCAL→REMOTE before transmitting, and the receiver converts each wire filename REMOTE→LOCAL before creating/writing. The full CONVERT_SPEC is serialized into the config frame as a new trailing string field so the peer knows the wire charset; **PROTOCOL_VERSION bumped 2.15.0 → 2.16.0**. `LOCAL[,REMOTE]` parse: single charset ⇒ LOCAL==REMOTE (identity both ways); garbage rejected up front. Validation probes BOTH directions (a spec that only opens one way is refused, as is a NUL-emitting target charset like utf-16/utf-32/ucs-2, since filenames cannot contain NUL). An unrepresentable name (EILSEQ/EINVAL) fails that path cleanly with a logged `--iconv: cannot convert file name ...` and is never written mangled/truncated. Conversion is applied at EVERY wire-path site (regular/MKDIR/hardlink path+target/symlink path+target/SPECIAL, the delete manifest, the incremental-check path, and the `-s`/`chunk_serialize` embedded blob path), on both client and server (`--iconv` is also a server/daemon option). Zero overhead when unset. See the Phase-6 iconv notes below |
 | `--checksum-seed=NUM` | Set checksum seed | ✅ Implemented | Sets the seed for FastSync's whole-file xxHash64 digest (full 64-bit seed) and for the delta path's per-block xxHash32 strong checksum (low 32 bits of the seed). An explicit seed deterministically changes every computed digest on BOTH endpoints (sender and receiver share the seed via the config frame, protocol 2.10.0), so identical runs with the same seed skip the same files and a changed seed changes the digests — the explicit-seed path that makes xxHash comparisons deterministic. `--checksum-choice=md5` has no seed and ignores it (documented). The value is a strict decimal 0..2⁶⁴-1 (blank, signed, or non-numeric values are rejected). Like rsync, a seed only matters where a digest is actually computed (`--checksum` or a basis-dir run, or a delta transfer); it does not by itself enable `--checksum`/`--delta`. Divergence from rsync: the default is seed 0, and FastSync never randomizes the seed (rsync uses a random per-transfer seed when `--checksum-seed` is unset); FastSync's unset default therefore reproduces its historical byte-for-byte behavior |
-| `--secluded-args` | Use protocol to send args | 🔄 Compatibility No-op | Accepted for CLI compatibility; it does not change FastSync transport or protocol behavior. `-s` remains chunk serialization. |
+| `--secluded-args`, `-s` | Use protocol to send args | ⛔ Impossible/Divergence | Accepted for CLI compatibility (including the rsync short `-s`, Phase 7 Wave A) but a documented **no-op / divergence**. rsync's `-s` protects arguments from shell expansion by shipping them over the protocol; FastSync never passes remote arguments through a shell expansion boundary in the first place — its SSH transport builds the remote argv as **single-quote-escaped shell words** (`ssh_build_remote_command`), so the injection/leak that `-s` guards against does not exist and there is nothing to "seclude". Implementing a true arg-send protocol would mean replacing the argv-based SSH launch with an in-band argument channel, a large redesign of the transport that buys no security here. Chunk serialization remains the long-only `--chunk-serialization`. |
 | `--no-OPTION` | Turn off implied option | ✅ Supported | Supported boolean FastSync options and archive-implied options; unsafe or value-taking options are rejected. |
 
 ---
@@ -683,7 +688,7 @@ now transmits targets (the prior behavior was broken/partial); its status moved
 ## Implementation Difficulty Plan
 
 **Phase 5 notes (remote-option wave):** `--remote-option=OPT` (long form only) and `--trust-sender` landed here.
-- `--remote-option` is CLIENT-only and never serialized into the binary config frame. On the SSH transport the client forwards each value to the remote server by appending it to the remote command line in `ssh_build_remote_command()`, after ` --stdio`, as an individually single-quoted shell word (`'...'` with `'\''` for embedded quotes). Values are validated at CLI parse time (non-empty; no ASCII control characters) and rejected otherwise, and a non-conforming value is refused again in the command builder, so shell metacharacters (`;`, `&`, `|`, backticks, `$()`, quotes) can never break out of the quoting to inject an unrelated remote command — including after a client-side `--` separator, whose arguments are never forwarded anyway. Because the remote options affect the *remote server invocation*, not the transmitted config, the wire frame layout is unchanged, but `PROTOCOL_VERSION` was bumped **2.13.0 → 2.14.0** as the Phase-5 lockstep release marker (a 2.14 client against a 2.13 server fails the version check cleanly rather than the old server rejecting an unfamiliar forwarded argv later). Divergence: rsync's short `-M` form of `--remote-option` is intentionally NOT implemented, because `-M` is already FastSync's metadata-preservation mode/multiplier.
+- `--remote-option` is CLIENT-only and never serialized into the binary config frame. On the SSH transport the client forwards each value to the remote server by appending it to the remote command line in `ssh_build_remote_command()`, after ` --stdio`, as an individually single-quoted shell word (`'...'` with `'\''` for embedded quotes). Values are validated at CLI parse time (non-empty; no ASCII control characters) and rejected otherwise, and a non-conforming value is refused again in the command builder, so shell metacharacters (`;`, `&`, `|`, backticks, `$()`, quotes) can never break out of the quoting to inject an unrelated remote command — including after a client-side `--` separator, whose arguments are never forwarded anyway. Because the remote options affect the *remote server invocation*, not the transmitted config, the wire frame layout is unchanged, but `PROTOCOL_VERSION` was bumped **2.13.0 → 2.14.0** as the Phase-5 lockstep release marker (a 2.14 client against a 2.13 server fails the version check cleanly rather than the old server rejecting an unfamiliar forwarded argv later). Divergence: rsync's short `-M` form of `--remote-option` was intentionally NOT implemented at that time because `-M` was FastSync metadata mode; **Phase 7 Wave A later freed `-M` for `--remote-option` and moved metadata to long-only `--preserve`** (see the Sending Options table).
 - `--trust-sender` is a receiver-local policy: it never crosses the wire (the sender's value is never serialized, so a wire peer can never enable it). On the receiving process it skips the up-front re-validation of the incoming file list (empty/`..` path rejection and the escaping-symlink-target containment), trusting the sender's list instead of double-checking — fewer checks, faster, and potentially unsafe, matching rsync. It is OFF by default (`config.trust_sender`). As a deliberate safety floor, the low-level fd-relative confinement primitives are NOT disabled: `file_open_secure_parent()` (O_NOFOLLOW walk, `..` rejection, root containment) and leaf/destination confinement still hold, so even under `--trust-sender` a hostile sender cannot write or create a symlink outside the authorized root — the relaxation only removes the redundant list-layer double-checks, never the root-confinement guarantees.
 
 The estimates below cover the currently unimplemented features in this document. They assume one engineer familiar with the codebase, include implementation and focused tests, and exclude production rollout time. A feature should not be marked implemented until its behavior is tested in both local and SSH/TCP paths where applicable.
@@ -778,12 +783,61 @@ These are the hardest compatibility items because they require durable formats o
 
 | Features | Effort | Implementation plan |
 |----------|--------|--------------------|
-| `--write-batch=FILE`; `--only-write-batch=FILE`; `--read-batch=FILE` | XL | Specify a versioned batch format, persist all required metadata, and test replay, corruption, and partial application. |
-| `--protocol=NUM` | XL | Add protocol-version negotiation and compatibility branches without weakening current validation. |
-| `--iconv=CONVERT_SPEC` | L | Convert filenames at the protocol boundary with invalid-sequence and normalization tests. |
-| `--stop-after=MINS`; `--stop-at=TIME` | M | Add deadline propagation, interruptible I/O, and safe checkpoint/cleanup behavior. |
+| `--write-batch=FILE`; `--only-write-batch=FILE`; `--read-batch=FILE` | XL | ✅ Implemented (see the Batch Operations table and Phase-6 batch note below): a versioned self-contained single-file residual-batch format, persisted via the existing chunk codec, with replay, corruption, and partial-application safety tests |
+| `--protocol=NUM` | XL | ✅ Implemented (see the Advanced table and Phase-6 protocol note below): protocol-version forcing without weakening current validation; FastSync's single lockstep wire format means only the current `PROTOCOL_VERSION` is accepted, and everything else is rejected up-front |
+| `--iconv=CONVERT_SPEC` | L | ✅ Implemented (see the Advanced table and Phase-6 iconv notes below): filename charset conversion at the wire boundary with expansion/overflow safety and invalid-sequence test coverage |
+| `--stop-after=MINS`; `--stop-at=TIME` | M | ✅ Implemented (see the Advanced table and Phase-6 stop notes below): deadline propagation and safe early stop with --delete safety |
 | `--early-input=FILE`; `--password-file=FILE` | M | Securely read startup credentials/input with permission checks and no secret disclosure in logs. |
 
+**Phase 6, Wave A (stop deadline) shipping note:** `--stop-after=MINS` and `--stop-at=TIME` are client-only sender stop deadlines. `--stop-after` takes a positive minute count (0/negative/garbage rejected); `--stop-at` takes `HH:MM`, `HH:MM:SS`, or `now+N[smhd]` (a past time stops immediately, a garbage spec is rejected at parse time). The deadline is computed once at the start of the transfer (CLOCK_MONOTONIC for `--stop-after`, wall clock via `time()` for `--stop-at`) and checked at every chunk boundary in both the single-threaded `send_files` loop and the multithreaded `send_chunks_multithreaded` path, and inside the scanner loops so a busy scan itself stops. When it fires, the transfer stops ELEGANTLY: the in-flight chunk completes, the existing completion tail runs (summary, `disconnect`), and the run returns 0 — exactly like rsync's clean early stop. Because the deadline is client-only and never crosses the wire config frame, no PROTOCOL_VERSION bump is required. The safety-critical interaction is with `--delete`: FastSync streams while scanning, so a deadline can cut the source scan short and yield a PARTIAL keep-set manifest; committing that would make the receiver delete destination mirrors of source files not yet scanned. So the sender tracks `scan_stopped_early` and, when it is true on the late/delete-after (`--delete`/`--delete-after`/`--delete-delay`) path, SUPPRESSES the keep-set manifest (logs a warning) so no deletion happens from an incomplete set — this is the safe direction (preserves data; the delete simply does not run). `--delete-before`/`--delete-during` are unaffected: their complete pre-scan runs before any data and ignores the deadline (a stop can be exceeded by that pre-scan). Under `-j`/`--threads` the stop is symmetric and the scanner thread's still-in-progress manifest appends can never race the tail because the tail does not read the manifest on the early-stop path.
+
+**Phase 6, Wave B (iconv) shipping note (PROTOCOL 2.15.0 → 2.16.0):** `--iconv=LOCAL[,REMOTE]` converts file NAMES at the wire boundary (never content). The full CONVERT_SPEC is serialized into the config frame as a new trailing string field (empty→NULL canonicalized), so both ends share the same wire charset interpretation; this required the PROTOCOL bump because the frame is a strict ordered sequence and a peer that does not parse the new trailing field would desynchronize. Each end derives LOCAL (its own charset) and REMOTE (the wire charset): the sender opens LOCAL→REMOTE and converts every transmitted filename; the receiver opens REMOTE→LOCAL and converts every received filename before creating/writing. Conversion is applied at every wire-path site (regular/MKDIR/hardlink path+target/symlink path+target/SPECIAL, the delete manifest keep/protected/missing entries, the incremental-check path, and the embedded `-s`/chunk-blob path). A name it cannot convert (EILSEQ/EINVAL) is failed cleanly with a logged `--iconv: cannot convert file name ...` and is never written truncated/mangled. Validation probes both directions up front (both the sender local→remote and the receiver remote→local, and, for a server/daemon with its own `--iconv`, the client-REMOTE→server-LOCAL pair) so an unusable spec is rejected before the connection rather than mid-transfer, and NUL-emitting target charsets (utf-16/utf-32/ucs-2) are refused because filenames cannot contain NUL. Divergence documented upstream: the receiver does NOT half-swap; the wire charset always comes from the sender's REMOTE half, so a server whose local charset differs from the client's LOCAL must declare it with its own `--iconv`. Conversion is process-global and runs on a single thread per process (sender thread / receiver-loop thread), initialized before worker threads start and freed after they join.
+
+**Phase 6, Wave C (protocol-version) shipping note (no PROTOCOL_VERSION change):** `--protocol=NUM` lets the client force the wire protocol version for a transfer. FastSync's protocol is a single lockstep format: the config frame is a strict ordered sequence and the server requires the client's version string to equal `PROTOCOL_VERSION` exactly (`config_receive_with_validate`, src/shared/config.c) — there are no older-format code paths and no downgrade/negotiation machinery, so a lower/higher/virtual version can never be spoken. The honest contract is therefore: `--protocol=2.19.0` (the current `PROTOCOL_VERSION`, as of the A7 auth redesign) is accepted and stored into the client's `version` claim (which `config_send` already transmits), and every other value — `2.18.0`, `2.18`, `2.17.0`, `2.16.0`, `2.15.0`, `3.0.0`, rsync-integer spellings like `216`/`31`, garbage, empty — is rejected up front in `validate_config()` before any connection, with a clear error that FastSync supports only its current wire protocol and cannot speak an older or virtual one. Implementation is client-only: a server-side `--protocol` is intentionally not added because the server has no negotiation (it only enforces exact match), and it could only ever be the current version. This preserves (and slightly tightens) existing validation: the client now also refuses to launch with a version it cannot actually speak, rather than only the server rejecting it later. A genuine downgrade would require a per-version compatibility layer for every frame/feature added since (append 2.10, preallocate 2.11, hardlinks 2.12, devices/specials/symlink-trust/xattr 2.13, remote-option 2.14, daemon module/auth 2.15, iconv 2.16, dir/symlink times 2.17, privilege flags --super/--copy-as 2.18, SCRAM daemon auth 2.19) and is intentionally out of scope — documented divergences from rsync's integer-negotiated downgrade remain.
+
+**Phase-1/2 selection-and-update status correction (docs):** `-I/--ignore-times`, `--size-only`, `-@/--modify-window`, `--existing`, `--ignore-existing`, `-u/--update`, `-W/--whole-file`, and `--compress-threads` were previously listed as not-implemented in this document but are in fact fully implemented and tested on `dev`. This pass corrects the matrix to match the code. The realistic model of these is that FastSync is a *sender-driven* whole-tree copy, so the size+mtime quick-check and all three receiver-policy skips (`--existing`, `--ignore-existing`, `-u`) are evaluated against the **destination** on the receiver side, and their booleans cross the wire in the config frame. `-I`/`--size-only`/`--modify-window` modify the `--incremental` per-file `STATUS_CHECK` handshake's match predicate (`-I` disables the mtime leg and forces transfer; `--size-only` drops only the mtime leg; `--modify-window` adds tolerance to `metadata_mtime_matches`); they require `--incremental` (or a basis dir) to have a handshake to affect, mirroring how they only matter where a quick-check exists in rsync. `--existing`/`--ignore-existing`/`-u` are receiver write-time policies (skipping the write / newer-destination guard) applied across the regular-file, `--delay-updates`-staged, hardlink-sibling, and special/device paths; `-u` implies `-M` metadata and uses a second-then-nanosecond strict `>` newer check; both correctly influence `--remove-source-files` (a skipped source is not removed). `-W/--whole-file` disables block-level delta (opt-in via `--delta`), folded into the wire `use_delta` so no protocol bump was needed, and makes `--fuzzy` inert; `--append`/`--append-verify` are rejected with `-W`. `--compress-threads=NUM` (1..64, client-only, never crosses the wire) sizes the zstd compression worker pool. No code was changed by this correction; the implementation had landed in earlier merge waves (feat/ignore-times, feat/ignore-existing via the newer `file_to_disk_secure_no_replace`/`linkat EEXIST` path, feat/size-only, feat/modify-window, feat/whole-file, feat/update, compression-threads).
+
+**Phase 6, Wave D (batch) shipping note (no PROTOCOL_VERSION change):** FastSync batch mode is a **client-only, self-contained "residual batch"**: a single file `MAGIC "FSTRESBATCH" + format version 1 + metadata flag`, followed by length-prefixed `chunk_serialize` blobs that store full file images (regular files, dirs, symlinks, specials). It is NOT a raw capture of the live wire, because FastSync's protocol is per-file interactive (`STATUS_CHECK`/`STATUS_DELTA_SIGNATURE`/`STATUS_APPEND` handshake), so a raw sender-stream tee is not deterministically replayable against an arbitrary destination. Storing full residuals via the existing, fuzz-tested chunk codec makes `--read-batch` replay byte-identically by construction. `--write-batch=FILE` runs the normal live transfer AND emits the batch from a separate deterministic scan pass; `--only-write-batch=FILE` emits the batch only (no destination, no server); `--read-batch=FILE DEST` applies it locally (no source, no server; DEST is the only positional arg). Because batch is a local driver concern, it never crosses the wire: no new config-frame field and no `PROTOCOL_VERSION` bump (mirroring `--stop-after`/`--protocol`/`--compress-threads`). The READ side is hardened against untrusted/attacker-controlled batch files: magic+version validated before any record, per-record length bounds checked before allocation (64 MB cap), clean-EOF-after-prefix and truncated/oversized records rejected, and every applied path goes through the same confined `file_save_to_disk_full` machinery as the network receiver (O_NOFOLLOW fd-walk, `..`-rejection, root confinement — a malicious `../` or absolute/symlink path cannot escape the destination root; this was security-reviewed and valgrind/ASan-clean). Divergences from rsync: (1) the batch carries the FULL residual (complete file images) rather than rsync's update-only delta stream — always byte-correct but larger; (2) per-file data is capped at the chunk codec's ~64 MB (`BATCH_MAX_RECORD`), so very large files may be refused by the batch writer with a clean error (never a corrupt/truncated batch); (3) hard-links and xattr/ACL blocks are not represented by `chunk_serialize`, so `-H`/`-X`/`-A` are out of scope for batch; (4) there is no companion `.sh`/`.rsync_argvs` — the batch is invoked directly (`fastsync --read-batch=FILE DEST`, `--only-write-batch=FILE SOURCE`); (5) `--write-batch` drives the single-threaded transfer path. Integration/`-M` note: metadata is captured in the batch when `-M` is used and persisted in the header so it applies consistently regardless of the reading process's own `-M`.
+
+### Phase 7: CLI-Namespace Parity, Filesystem/Output Completion, and Privilege (Final)
+
+These are the last compatibility items and the closing phase toward rsync flag parity. Per the project decision: every rsync flag (short **and** long) that is *possible* gets real rsync-parity behavior; anything physically impossible becomes an explicit **Impossible/Divergence** status (accepted for CLI compatibility, safely inert, with coverage tests proving that); and the two privilege flags (`--super`, `--copy-as`) adopt the deliberately-scoped **safe-subset + clear-refusal** model rather than blind elevation. The remaining `⚠️ Partial`, `🔄 Compatibility No-op`, `🔀 Alt Arg`, and `❌ Not Implemented` rows in the Summary are this phase's scope. All Wave A renames are **client-side only** (the wire config fields `use_compression`/`use_metadata`/`use_sendfile`/`use_chunk_serialization` are unchanged), so they require **no `PROTOCOL_VERSION` bump**.
+
+**Wave A — CLI namespace parity (rename colliding FastSync short flags) — ✅ implemented.** This freed the short letters rsync needs and made the three `🔀 Alt Arg` rows real. `-c`→`--checksum`, `-m`→`--prune-empty-dirs`, `-M`→`--remote-option`, `-f`→`--filter`, `-s`→`--secluded-args`, `-p`→`--perms`, `-T`→`--temp-dir`, `-a`/`--archive`→real `-rlptgoD`. FastSync's own flags moved to long-form-only or new shorts: `-j`/`--threads` (multithreading), `--preserve` (metadata), `--sendfile`, `--chunk-serialization`, `--timeout`, `--ssh-port`. The server's independent little CLI keeps `-p` as its port. All client-side, no wire change, no `PROTOCOL_VERSION` bump. Unit tests 37/37, full integration 400 passed, cppcheck and clang-format clean. Known Wave-A limitation: `--no-perms`/`--no-compress`-style negation of the newly-aliased shorts is not wired into the negatable set (only the long-form `--preserve`/`--compress`/`--no-links` negations exist); `--archive --no-perms` is consequently not supported yet — a minor deviation from rsync, acceptable for Wave A.
+
+| FastSync flag today | rsync wants that name | Proposed rename |
+|---------------------|----------------------|-----------------|
+| `-c` / `--compress` | `-c` = `--checksum` | compression is already aliased as `-z`/`--compress` (rsync parity!) → drop the `-c` short, keep `--compress`/`-z` |
+| `-m` / `--multithreading` | `-m` = `--prune-empty-dirs` | → `-j` / `--threads` |
+| `-M` / `--preserve` | `-M` = `--remote-option` | → `--preserve` (long-only) |
+| `-f` / `--sendfile` | `-f` = `--filter` | → `--sendfile` (long-only) |
+| `-s` / `--chunk-serialization` | `-s` = `--secluded-args`/`--protect-args` | → `--chunk-serialization` (long-only) |
+| `-p` (SSH port) | `-p` = `--perms` | → `--port` (long-only; `--server-port` already exists) |
+| `-T` / `--timeout` | `-T` = `--temp-dir` | → `--timeout` (long-only) |
+| `-a` / `--archive` (= `-c -m -M`) | `-a` = `-rlptgoD` | → becomes **real rsync `-a`** after the renames |
+
+**Wave B — Output & filesystem completion (✅ implemented).** `-S`/`--sparse` (`⚠️→✅`): real hole preservation — a sparse-aware writer (`write_all_sparse`) skips all-zero runs ≥ 4096 bytes with `lseek(SEEK_CUR)` and `ftruncate`s the final size, wired into both the atomic temp+rename store and `--inplace` receiver-side with **no wire change** (the full file image is already in memory; the ftruncate presize is kept). `-P` (`⚠️→✅`): interrupted-write retention — on a save failure after data reached the temp fd, `--partial` now renames the already-written temp to the destination path (best-effort; falls through to the normal unlink on failure, never retains when `--partial` is off) so a later `--append`/`--append-verify` run can resume. `--block-size=SIZE` (`⚠️→✅`): promoted after verification — `--block-size` is now an alias for `--delta-block`, both set `config->delta_block_size`, which the delta engine already honored end-to-end (`delta_signature_create_seeded` + `delta_apply`); out-of-range values keep the default. `--fake-super` (`⚠️→✅`): added `fake_super_restore_fd` to parse and re-apply the recorded `user.fastsync.stat` record fd-relative (fchown best-effort/non-root skipped, fchmod, futimens); a save under `--fake-super` now re-applies the recorded attrs instead of only recording them, with the recording format unchanged. `--stderr=client` (`⚠️→⛔ Impossible/Divergence`): FastSync has no rsync client-message channel, and `client` is rejected at CLI parse — the rejection is the documented behavior (unit-tested). `-N`/`--crtimes` (`⚠️→⛔ Impossible/Divergence`): birth-times cannot be set by any portable fs call (`utimensat` sets only atime/mtime); capture/transmit stays, setting is impossible, the flag is accepted and safely inert. Review-hardening (post-eval): fake-super replay applies the mode through the same sanitization as the normal metadata path (group/other write bits are never granted); `--sparse` takes precedence over `--preallocate` (posix_fallocate skipped so holes survive); `--partial` retention is disabled for `--no_replace` (ignore/existing) and only marks a write-attempt after the actual write begins; `--block-size=SIZE`/`--delta-block=SIZE` inline forms are accepted.
+
+**Wave C — Devices & special files (finalize statuses + tests) (✅ implemented).** The four special-file rows are finalized with coverage tests. `--devices`, `--copy-devices`, and `--write-devices` are **✅ Implemented**, each with a documented, safety-driven divergence: device-node creation is privilege-gated, so a receiver without `CAP_MKNOD` skips that entry with a warning (a per-entry skip, never a transfer failure); `--copy-devices` copies a device/FIFO's reported size into an ordinary regular file (a size-bounded safe divergence from rsync's unbounded dd-like read); `--write-devices` writes only into an existing char/block node under the confined receive root and skips every unusable target rather than clobbering or aborting. `--specials` is classified **⛔ Impossible/Divergence** for one reason only: **FIFO recreation works** (unprivileged `mkfifo`, asserted under CI), but **sockets cannot be recreated by any standard filesystem call**, so a source socket is skipped with an explicit note. Tests assert FIFO recreation, the safe socket skip, the regular-file result of `--copy-devices`, the skipped/missing and non-device `--write-devices` targets, and (root-gated) real device-node creation; a root runner additionally drops the receiver to an unprivileged user to assert the `CAP_MKNOD` skip is graceful.
+
+**Wave D — Times superstructure & arg-protection no-ops (✅ implemented, `--secluded-args` ⛔).** `-O`/`--omit-dir-times` and `-J`/`--omit-link-times` are now **real modifiers** (both `🔄 → ✅ Implemented`), reversing the old "never preserves directory/symlink times" divergence:
+
+- **Directory times.** The recursive scanner captures every traversed source directory's metadata (mtime, plus atime under `-U`) into a per-transfer list — two paths are covered: the sequential `DirectoryScanner` captures each opened directory (including the transfer root), and the parallel scanner captures both the root in `parallel_scanner_create_with_options` and each worker's subdirectories in `open_next_directory` (appends are guarded by a mutex shared with the sender's pipeline context). The sender transmits them in trailing `STATUS_DIR_TIMES` frames (each: int count + count × (wire path, metadata) pairs) sent **after all file data and after the optional delete manifest**, just before `STATUS_FINISHED`. A tree larger than `MAX_MANIFEST_ENTRIES` (1 048 576) directories is chunked into repeated frames, each within the receiver's per-frame bound. A dir-time entry is RECORD-ONLY (`file->dir_time_only`): `file_save_to_disk_full` returns `FILE_SAVE_SKIPPED` without creating anything, so a source directory that was empty (or pruned by `-m/--prune-empty-dirs`) is never resurrected. The receiver accumulates received directory metadata in a `DirTimeList` and applies it only at the very end — after the entire stream, after the commit-style `--delete` deletion, and after `--delay-updates` publication — because creating or removing a child bumps the parent's mtime. Application is fd-relative/walk-confined (`file_open_secure_parent` + `utimensat(..., AT_SYMLINK_NOFOLLOW)`) and best-effort per entry: an absent path (an intentionally uncreated empty dir) is skipped QUIETLY and only a real existing directory is stamped. `-O` (config boolean, already on the wire) makes the receiver skip the whole set. The single-threaded sink applies in `receiver_send_success_frame`; the `-j`/`--threads` sink accumulates in `write_thread` and server.c applies after both threads join and the deletion commits.
+- **Symlink times/owner/mode.** `STATUS_SYMLINK` already carried metadata; the receiver now applies it with no-follow primitives only: `utimensat(..., AT_SYMLINK_NOFOLLOW)`, best-effort `fchmodat(..., AT_SYMLINK_NOFOLLOW)` (honest no-op where unsupported, e.g. Linux), and policy-gated `fchownat(..., AT_SYMLINK_NOFOLLOW)` via a new `identity_apply_ownership_link` that shares the identity resolver with the fd path. `-J` suppresses only the timestamps; ownership stays governed by the identity opt-in (`--numeric-ids`/`--usermap`/`--groupmap`/`--chown`) exactly like regular files. A symlink has no children, so this is applied immediately at creation.
+- **Wire:** the shared `STATUS_DIR_TIMES` frame (and metadata on `STATUS_MKDIR` for `--dirs` entries) is a frame-sequence change, so `PROTOCOL_VERSION` was bumped **2.16.0 → 2.17.0**; every version-sensitive test (`--protocol` accepted/rejected values) was updated. The config-frame layout itself is unchanged (the omit booleans already crossed). Non-metadata and `--no-preserve` transfers send no `STATUS_DIR_TIMES` frame and no directory metadata, keeping them byte-identical.
+
+`--secluded-args` (`🔄 → ⛔ Impossible/Divergence`): a true arg-send protocol would replace the argv-based SSH launch with an in-band channel, and FastSync already builds the remote SSH argv injection-safe (single-quote-escaped shell words), so there is no argument-leak to close; the already-safe behavior is documented in the row and no transport change is made.
+
+**Wave E (LAST) — Privilege: `--super`/`--no-super` and `--copy-as=USER[:GROUP]` (✅ implemented).** FastSync adopts a **safe-subset + clear-refusal** privilege model: it never blind-elevates and never calls `setuid`/`seteuid`/`setgid`. All privileged operations remain fd-relative and confined below the authorized receive root.
+
+`--super`/`--no-super` set a receiver-side tri-state `Config->super_mode` (`SUPER_MODE_AUTO`/`ON`/`OFF`). `privilege_super_permitted()` / `privilege_super_mode_permitted()` (src/shared/identity.c) return true for `ON` and `AUTO` (AUTO preserves FastSync's historical best-effort attempt, where the kernel refuses an unprivileged call and the caller skips it) and false only for `OFF`. The gate covers every super-user activity FastSync performs: ownership application (`identity_apply_ownership`/`_link`), char/block device-node creation (`file_save_special_to_disk`), writes into an existing device (`--write-devices`), and the `--fake-super` owner replay. Unprivileged FIFO creation is deliberately unaffected. `--super` does **not** imply `--numeric-ids`: ownership is applied only when an explicit identity policy (`--usermap`/`--groupmap`/`--chown`/`--numeric-ids`/`--copy-as`) is also given. `--no-super` suppresses those activities even for a root receiver. A non-root receiver given `--super` logs one warning at activation (`identity_set_active`); each confined attempt is then refused by the kernel and skipped, never aborting. The confinement floor is unchanged (`file_open_secure_parent`, `O_NOFOLLOW`, root/path checks). Operator control: the server CLI accepts `--no-super`, a veto that forces `OFF` for every connection, refuses any client `--copy-as`, and neutralizes an explicit `--super` (the connection is accepted but no super-user activity is attempted). On a daemon, a module that has not opted in with `client owner = yes` additionally has super-user device activity forced off (see the Daemon Mode notes).
+
+`--copy-as=USER[:GROUP]` is the safe subset. FastSync's receiver is multithreaded, so a real credential switch is unsafe; instead the receiver forces the ownership of **every entry it writes** — regular files, symlinks, directories (including implicitly-created parents), and special nodes — to the resolved target ids through the confined fd-relative identity path. USER is resolved on the client (name, `@N`/bare N, or `*` = client euid); when `:GROUP` is omitted the user's primary gid is used (falling back to `gid == uid` for a numeric id with no local passwd entry). It requires a privileged (root) receiver: an unprivileged receiver refuses the whole transfer at the config handshake, before `STATUS_OK`, so no data is ever written with the wrong ownership. A `--copy-as` chown failure on a capability-restricted root is logged at ERROR (never silently downgraded). `--copy-as` implies metadata (`--no-preserve` is rejected) and `--fake-super` cannot override it. Daemon policy: a `--daemon` receiver refuses **every** client-chosen-ownership / super-user request — `--numeric-ids`, `--chown`, `--usermap`/`--groupmap`, `--fake-super`, `--copy-as`, and explicit `--super` — unless the selected module opts in with `client owner = yes`; without that per-module opt-in any client could force arbitrary ownership inside the module root (the standalone listener and the SSH-launched `--stdio` server, which each serve one operator-authorized root, honor these requests). A `--copy-as` chown failure on a capability-restricted root marks the entry as failed rather than reporting success with the wrong owner.
+
+**Wire:** two trailing config-frame blocks after the `--iconv` spec, in fixed order — `send_privilege_options`/`receive_privilege_options` (one `super_mode` int, validated `0..2`), then `send_copy_as_options`/`receive_copy_as_options` (presence int + two int32 ids, validated `>= 0`, with `copy_as_set ⇒ use_metadata`). `PROTOCOL_VERSION` bumped **2.17.0 → 2.18.0**. **Divergences from rsync:** rsync's `--super` elevates the receiver and `--copy-as` actually switches its credentials; FastSync never elevates and only permits/forwards confined attempts, and `--copy-as` forces ownership rather than switching identity.
+
+**Post-Phase-7 Summary (after Waves A–E).** ✅143 / 🔀0 / ⛔4 / ⚠️0 / 🔄0 / ❌0 = 147. The 3 `🔀 Alt Arg` rows (`-a`, `-p`, `-z`) are ✅ (Wave A). All 10 prior `⚠️ Partial` rows are resolved to ✅ (`-S`, `-P`, `--block-size`, `--fake-super`, `--devices`, `--copy-devices`, `--write-devices`) or ⛔ (`--stderr=client`, `-N/--crtimes`, `--specials` for the impossible socket case). The 3 `🔄 Compatibility No-op` rows are resolved: `-O`/`-J` are now real ✅ (Wave D), `--secluded-args` is ⛔. The **Impossible/Divergence** bucket holds the 4 physically-impossible/divergent flags: `--stderr=client`, `-N/--crtimes`, `--specials` (sockets), `--secluded-args`. The last two `❌ Not Implemented` rows — `--super` and `--copy-as=USER[:GROUP]` — are now ✅ (Wave E). **No `❌ Not Implemented` rows remain.**
+
 ### Recommended Delivery Order
 
 1. Resolve short-option conflicts (`-m`, `-M`, `-T`, `-f`, `-s`) and define the compatibility contract.
@@ -798,15 +852,15 @@ The existing priority list below is a feature shortlist, not an implementation s
 
 ## Recommendations: Top Features to Implement Next
 
-Ranked by user demand, implementation complexity, and interoperability impact:
+Ranked by user demand, implementation complexity, and interoperability impact (_status reflects current `dev`_):
 
 | Priority | Feature | Effort | Impact |
 |----------|---------|--------|--------|
-| 1 | `--whole-file` / `-W` | Low | High — users expect opt-out of delta |
-| 2 | `--ignore-times` / `-I` | Low | Medium — useful for forcing re-transfer |
-| 3 | `--size-only` | Low | Medium — common migration scenario |
-| 4 | `--ignore-existing` | Low | Medium — common sync patterns |
-| 5 | `--existing` | Low | Medium — common sync patterns |
+| 1 | `--whole-file` / `-W` | Low | High — users expect opt-out of delta — **✅ implemented** |
+| 2 | `--ignore-times` / `-I` | Low | Medium — useful for forcing re-transfer — **✅ implemented** |
+| 3 | `--size-only` | Low | Medium — common migration scenario — **✅ implemented** |
+| 4 | `--ignore-existing` | Low | Medium — common sync patterns — **✅ implemented** |
+| 5 | `--existing` | Low | Medium — common sync patterns — **✅ implemented** |
 | 6 | `--remove-source-files` | Low | High — common for moves/backup |
 | 7 | `--delete-during` | Medium | High — performance improvement |
 | 8 | `--delay-updates` | Medium | High — atomic updates |
@@ -820,10 +874,10 @@ Ranked by user demand, implementation complexity, and interoperability impact:
 
 | Feature | Description |
 |---------|-------------|
-| `-m` | Multithreaded pipeline (scanner/loader/sender) |
-| `-s` | Chunk serialization mode |
-| `-f` / `--sendfile` | Zero-copy sendfile() syscall (TCP only) |
-| `-c [level]` | zstd compression level (1-22) |
+| `-j` / `--threads` | Multithreaded pipeline (scanner/loader/sender) (renamed from `-m` in Phase 7 Wave A; `-m` is now rsync `--prune-empty-dirs`) |
+| `--chunk-serialization` | Chunk serialization mode (long form only; `-s` is now rsync `--secluded-args`) |
+| `--sendfile` | Zero-copy sendfile() syscall (TCP only) (long form only; `-f` is now rsync `--filter`) |
+| `-z [level]` / `--compress` | zstd compression level (1-22) (`-c` is now rsync `--checksum`) |
 | `--chunk-size` | Configurable chunk size |
 | `--tls` | TLS encryption (mutual auth) |
 | `--fastsync-server-path` | Path to fastsync-server binary |

src/client/client_cli.c

@@ -1,5 +1,6 @@
 #include "client_send.h"
 #include "client_validation.h"
+#include "charset.h"
 #include "chmod.h"
 #include "compression.h"
 #include "config.h"
@@ -11,12 +12,14 @@
 #include "identity.h"
 #include "log.h"
 #include "protocol.h"
+#include "stop_condition.h"
 #include "transport_tcp.h"
 #include "transport_tls.h"
 #include "usage.h"
 #include "utils.h"
 #include <errno.h>
 #include <limits.h>
+#include <time.h>
 #include <signal.h>
 #include <stdbool.h>
 #include <stddef.h>
@@ -386,6 +389,21 @@ static int parse_ull_arg(const char* val, unsigned long long* out, const char* o
   return 0;
 }
 
+/* Apply a --delta-block/--block-size value (both spellings and both the inline
+ * and separate argument forms share this one range check).  An out-of-range
+ * value warns once and leaves the configured default untouched.  Returns 0 on
+ * success, -1 on a non-numeric value. */
+static int set_delta_block_size(Config* config, const char* value) {
+  unsigned long long val;
+  if (parse_ull_arg(value, &val, "--block-size/--delta-block") != 0)
+    return -1;
+  if (val >= DELTA_BLOCK_SIZE_MIN && val <= DELTA_BLOCK_SIZE_MAX)
+    config->delta_block_size = (uint32_t)val;
+  else
+    log_message(LOG_LEVEL_WARNING, "block size value %llu out of range, using default", val);
+  return 0;
+}
+
 /* Parse a byte count with an optional single-letter binary suffix (K/M/G/T/P/E).
  * When allow_zero is false, a bare 0 is rejected (size limits use true, since 0
  * means "no limit"). Returns 0 on success, -1 on error. */
@@ -551,7 +569,7 @@ static const OptionEntry OPTION_TABLE[] = {
     {"--stats", NULL, OPT_FLAG, offsetof(Config, stats)},
     {"--human-readable", "-h", OPT_FLAG, offsetof(Config, human_readable)},
     {"--partial", NULL, OPT_FLAG, offsetof(Config, partial)},
-    {"--secluded-args", NULL, OPT_NOOP, 0},
+    {"--secluded-args", "-s", OPT_NOOP, 0},
     {"--update", "-u", OPT_FLAG, offsetof(Config, update)},
     {"--old-args", NULL, OPT_FLAG, offsetof(Config, old_args)},
     {"--rsh", "-e", OPT_STRING, offsetof(Config, rsh_command)},
@@ -570,7 +588,7 @@ static const OptionEntry OPTION_TABLE[] = {
     {"--append", NULL, OPT_FLAG, offsetof(Config, append)},
     {"--append-verify", NULL, OPT_FLAG, offsetof(Config, append_verify)},
     {"--fsync", NULL, OPT_FLAG, offsetof(Config, use_fsync)},
-    {"--checksum", NULL, OPT_FLAG, offsetof(Config, checksum)},
+    {"--checksum", "-c", OPT_FLAG, offsetof(Config, checksum)},
     {"--8-bit-output", "-8", OPT_FLAG, offsetof(Config, eight_bit_output)},
     {"--itemize-changes", "-i", OPT_FLAG, offsetof(Config, itemize_changes)},
     {"--list-only", NULL, OPT_FLAG, offsetof(Config, list_only)},
@@ -590,6 +608,25 @@ static const OptionEntry OPTION_TABLE[] = {
      * path; main() reads it (after the destination form is known) and derives
      * the wire credentials.  Never crosses the wire. */
     {"--password-file", NULL, OPT_STRING, offsetof(Config, password_file)},
+    /* --iconv (protocol 2.16.0): convert file-NAME charsets at the wire
+     * boundary.  The CONVERT_SPEC (LOCAL[,REMOTE]) is validated for real iconv
+     * charsets at startup (client_validation.c) and the full spec rides the
+     * config frame so the receiver derives the wire charset symmetrically. */
+    {"--iconv", NULL, OPT_STRING, offsetof(Config, iconv_spec)},
+    /* --protocol=NUM: rsync-compatible flag that forces the wire protocol
+     * version to the current value.  FastSync has exactly one wire format, so
+     * any value other than PROTOCOL_VERSION is rejected at validation, before
+     * any network I/O.  Client-only: the server does not negotiate, it just
+     * enforces an exact match. */
+    {"--protocol", NULL, OPT_STRING, offsetof(Config, version)},
+    /* Phase 6 residual-batch (client-only): --write-batch=FILE runs the normal
+     * live transfer AND also emits the self-contained batch FILE;
+     * --only-write-batch=FILE emits FILE only (no destination, no server);
+     * --read-batch=FILE applies FILE to the destination (no source, no server).
+     * All three are LOCAL driver flags and never cross the wire. */
+    {"--write-batch", NULL, OPT_STRING, offsetof(Config, write_batch)},
+    {"--only-write-batch", NULL, OPT_STRING, offsetof(Config, only_write_batch)},
+    {"--read-batch", NULL, OPT_STRING, offsetof(Config, read_batch)},
     {"--delete-before", NULL, OPT_FLAG, offsetof(Config, delete_before)},
     {"--delete-during", "--del", OPT_FLAG, offsetof(Config, delete_during)},
     {"--delete-delay", NULL, OPT_FLAG, offsetof(Config, delete_delay)},
@@ -598,7 +635,7 @@ static const OptionEntry OPTION_TABLE[] = {
     {"--max-delete", NULL, OPT_NONNEG_INT, offsetof(Config, max_delete)},
     {"--ignore-errors", NULL, OPT_FLAG, offsetof(Config, ignore_errors)},
     {"--force", NULL, OPT_FLAG, offsetof(Config, force_delete)},
-    {"--prune-empty-dirs", NULL, OPT_FLAG, offsetof(Config, prune_empty_dirs)},
+    {"--prune-empty-dirs", "-m", OPT_FLAG, offsetof(Config, prune_empty_dirs)},
     {"--ignore-missing-args", NULL, OPT_FLAG, offsetof(Config, ignore_missing_args)},
     {"--delete-missing-args", NULL, OPT_FLAG, offsetof(Config, delete_missing_args)},
 
@@ -613,7 +650,7 @@ static const OptionEntry OPTION_TABLE[] = {
     /* --rsync-path is rsync's spelling for the same "server program path"; it
      * is a pure alias for fastsync_server_path (never a distinct field). */
     {"--rsync-path", NULL, OPT_STRING, offsetof(Config, fastsync_server_path)},
-    {"--temp-dir", NULL, OPT_STRING, offsetof(Config, temp_dir)},
+    {"--temp-dir", "-T", OPT_STRING, offsetof(Config, temp_dir)},
     {"--partial-dir", NULL, OPT_STRING, offsetof(Config, partial_dir)},
     {"--suffix", NULL, OPT_STRING, offsetof(Config, suffix)},
     {"--compress-choice", "--zc", OPT_STRING, offsetof(Config, compress_choice)},
@@ -646,10 +683,10 @@ static const OptionEntry OPTION_TABLE[] = {
     {"--xattrs", "-X", OPT_FLAG, offsetof(Config, preserve_xattrs)},
     {"--acls", "-A", OPT_FLAG, offsetof(Config, preserve_acls)},
     {"--fake-super", NULL, OPT_FLAG, offsetof(Config, fake_super)},
-    /* Long-form-only: rsync's -M short form of --remote-option is INTENTIONALLY
-     * unavailable because -M already means metadata mode in FastSync (a
-     * documented divergence; see RSYNC_COMPAT.md).  --trust-sender is a local
-     * receiver policy and never travels to the remote peer. */
+    /* rsync's -M/--remote-option: -M is now the short alias for --remote-option
+     * (metadata mode is long-only --preserve), handled in the parse loop where
+     * --remote-option is parsed.  --trust-sender is a local receiver policy and
+     * never travels to the remote peer. */
     {"--trust-sender", NULL, OPT_FLAG, offsetof(Config, trust_sender)},
 };
 
@@ -674,17 +711,17 @@ static const NegatableOption NEGATABLE_OPTIONS[] = {
     {"sparse", "S", offsetof(Config, preserve_sparse)},
     {"inplace", NULL, offsetof(Config, inplace)},
     {"preallocate", NULL, offsetof(Config, preallocate)},
-    {"checksum", NULL, offsetof(Config, checksum)},
+    {"checksum", "c", offsetof(Config, checksum)},
     {"from0", NULL, offsetof(Config, from0)},
     {"cvs-exclude", NULL, offsetof(Config, cvs_exclude)},
 
     /* These options are also implied by --archive or handled outside the table. */
-    {"compress", "c", offsetof(Config, use_compression)},
+    {"compress", NULL, offsetof(Config, use_compression)},
     {"compress", "z", offsetof(Config, use_compression)},
-    {"multithreading", "m", offsetof(Config, use_multithreading)},
-    {"preserve", "M", offsetof(Config, use_metadata)},
-    {"sendfile", "f", offsetof(Config, use_sendfile)},
-    {"chunk-serialization", "s", offsetof(Config, use_chunk_serialization)},
+    {"multithreading", "j", offsetof(Config, use_multithreading)},
+    {"preserve", NULL, offsetof(Config, use_metadata)},
+    {"sendfile", NULL, offsetof(Config, use_sendfile)},
+    {"chunk-serialization", NULL, offsetof(Config, use_chunk_serialization)},
     {"xattrs", "X", offsetof(Config, preserve_xattrs)},
     {"acls", "A", offsetof(Config, preserve_acls)},
     {"fake-super", NULL, offsetof(Config, fake_super)},
@@ -826,6 +863,20 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
       config->no_motd = true;
       continue;
     }
+    /* "--super" / "--no-super" are real rsync option names controlling the
+     * receiver's super-user activity policy (ownership, device nodes), not a
+     * Boolean pair for the generic --no-* negation branch: both map onto the
+     * Config->super_mode tri-state.  Handle them explicitly (exact match only,
+     * so a malformed "--super=x" still falls through to the unknown-option
+     * error) before the generic negation branch would mis-reject "--no-super". */
+    if (strcmp(argv[i], "--super") == 0) {
+      config->super_mode = SUPER_MODE_ON;
+      continue;
+    }
+    if (strcmp(argv[i], "--no-super") == 0) {
+      config->super_mode = SUPER_MODE_OFF;
+      continue;
+    }
     if (strncmp(argv[i], "--no-", strlen("--no-")) == 0) {
       if (strcmp(argv[i], "--no-delta") == 0)
         no_delta = true;
@@ -847,6 +898,47 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
         return -1;
       continue;
     }
+    /* --stop-after/--stop-at are client-only sender-side stop deadlines.  They
+     * are parsed by stop_condition (so the unit tests exercise the same validate
+     * that production uses) and never serialized into the config frame. */
+    if (strncmp(argv[i], "--stop-after=", 13) == 0) {
+      if (!stop_parse_after_minutes(argv[i] + 13, &config->stop_after_mins)) {
+        log_message(LOG_LEVEL_ERROR, "--stop-after must be a positive number of minutes");
+        return -1;
+      }
+      continue;
+    }
+    if (strcmp(argv[i], "--stop-after") == 0) {
+      if (i + 1 >= argc) {
+        log_message(LOG_LEVEL_ERROR, "missing argument for --stop-after");
+        return -1;
+      }
+      if (!stop_parse_after_minutes(argv[++i], &config->stop_after_mins)) {
+        log_message(LOG_LEVEL_ERROR, "--stop-after must be a positive number of minutes");
+        return -1;
+      }
+      continue;
+    }
+    if (strncmp(argv[i], "--stop-at=", 10) == 0) {
+      if (!stop_parse_at_time(argv[i] + 10, time(NULL), &config->stop_at)) {
+        log_message(LOG_LEVEL_ERROR, "--stop-at must be HH:MM[:SS] or now+N[smhd]");
+        return -1;
+      }
+      config->stop_at_set = true;
+      continue;
+    }
+    if (strcmp(argv[i], "--stop-at") == 0) {
+      if (i + 1 >= argc) {
+        log_message(LOG_LEVEL_ERROR, "missing argument for --stop-at");
+        return -1;
+      }
+      if (!stop_parse_at_time(argv[++i], time(NULL), &config->stop_at)) {
+        log_message(LOG_LEVEL_ERROR, "--stop-at must be HH:MM[:SS] or now+N[smhd]");
+        return -1;
+      }
+      config->stop_at_set = true;
+      continue;
+    }
     const char* threads_prefix = "--compress-threads=";
     if (strncmp(argv[i], threads_prefix, strlen(threads_prefix)) == 0) {
       if (set_compression_threads_option(&config->compression_threads,
@@ -966,17 +1058,35 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
       config->preserve_specials = true;
       log_info_message(LOG_INFO_MISC, "Enabled preservation of device and special files (-D)");
     } else if (opt_is(argv[i], "-a", "--archive")) {
-      config->use_compression =
-          !config->compress_choice || strcmp(config->compress_choice, "zstd") == 0;
-      config->use_multithreading = true;
+      /* Real rsync archive (-rlptgoD).  FastSync is always recursive and always
+       * preserves hard-link/other transfer semantics per its own flags, so -a
+       * implies links, full metadata (perms/times/group/owner as FastSync's
+       * broad bundle), devices and specials.  Compression and multithreading
+       * are NOT implied (they are no longer part of archive mode). */
+      config->follow_symlinks = true;
       config->use_metadata = true;
-      log_info_message(LOG_INFO_MISC, "Enabled archive mode (-c -m -M)");
-    } else if (opt_is(argv[i], "-p", NULL)) {
+      config->preserve_devices = true;
+      config->preserve_specials = true;
+      log_info_message(LOG_INFO_MISC,
+                       "Enabled archive mode (-rlptgoD: links, metadata, devices, specials)");
+    } else if (opt_is(argv[i], "-p", "--perms")) {
+      /* rsync -p/--perms: preserve permission bits.  Folded into FastSync's
+       * broad metadata bundle (mode/mtime travel together). */
+      config->use_metadata = true;
+      log_info_message(LOG_INFO_MISC, "Enabled permission preservation");
+    } else if (opt_is(argv[i], "--ssh-port", NULL)) {
       if (i + 1 >= argc) {
         log_message(LOG_LEVEL_ERROR, "missing argument for %s", argv[i]);
         return -1;
       }
-      if (set_positive_int_option(&config->ssh_port, argv[++i], "-p") != 0)
+      if (set_positive_int_option(&config->ssh_port, argv[++i], "--ssh-port") != 0)
+        return -1;
+      if (config->ssh_port > 65535) {
+        log_message(LOG_LEVEL_ERROR, "SSH port must be 1-65535");
+        return -1;
+      }
+    } else if (strncmp(argv[i], "--ssh-port=", 11) == 0) {
+      if (set_positive_int_option(&config->ssh_port, argv[i] + 11, "--ssh-port") != 0)
         return -1;
       if (config->ssh_port > 65535) {
         log_message(LOG_LEVEL_ERROR, "SSH port must be 1-65535");
@@ -998,18 +1108,19 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
       if (config_add_pattern(&config->include_patterns, &config->include_count, argv[++i],
                              "--include") != 0)
         return -1;
-    } else if (opt_is(argv[i], "--delta-block", NULL)) {
+    } else if (strncmp(argv[i], "--delta-block=", 14) == 0) {
+      if (set_delta_block_size(config, argv[i] + 14) != 0)
+        return -1;
+    } else if (strncmp(argv[i], "--block-size=", 13) == 0) {
+      if (set_delta_block_size(config, argv[i] + 13) != 0)
+        return -1;
+    } else if (opt_is(argv[i], "--delta-block", "--block-size")) {
       if (i + 1 >= argc) {
         log_message(LOG_LEVEL_ERROR, "missing argument for %s", argv[i]);
         return -1;
       }
-      unsigned long long val;
-      if (parse_ull_arg(argv[++i], &val, "--delta-block") != 0)
+      if (set_delta_block_size(config, argv[++i]) != 0)
         return -1;
-      if (val >= DELTA_BLOCK_SIZE_MIN && val <= DELTA_BLOCK_SIZE_MAX)
-        config->delta_block_size = (uint32_t)val;
-      else
-        log_message(LOG_LEVEL_WARNING, "--delta-block value %llu out of range, using default", val);
     } else if (opt_is(argv[i], "--delta-max", NULL)) {
       if (i + 1 >= argc) {
         log_message(LOG_LEVEL_ERROR, "missing argument for %s", argv[i]);
@@ -1022,7 +1133,7 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
         config->delta_max_file_size = val;
       else
         log_message(LOG_LEVEL_WARNING, "--delta-max value %llu too small, using default", val);
-    } else if (opt_is(argv[i], "-c", "-z")) {
+    } else if (opt_is(argv[i], "-z", "--compress")) {
       config->use_compression =
           !config->compress_choice || strcmp(config->compress_choice, "zstd") == 0;
       log_info_message(LOG_INFO_MISC, "Enabled Compression");
@@ -1039,20 +1150,20 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
           i++;
         }
       }
-    } else if (opt_is(argv[i], "-M", "--preserve")) {
+    } else if (opt_is(argv[i], "--preserve", NULL)) {
       config->use_metadata = true;
       log_info_message(LOG_INFO_MISC, "Enabled metadata preservation");
     } else if (opt_is(argv[i], "-E", "--executability")) {
       config->use_metadata = true;
       config->use_executability = true;
       log_info_message(LOG_INFO_MISC, "Enabled executable permission preservation");
-    } else if (opt_is(argv[i], "-f", "--sendfile")) {
+    } else if (opt_is(argv[i], "--sendfile", NULL)) {
       config->use_sendfile = true;
       log_info_message(LOG_INFO_MISC, "Enabled sendfile");
-    } else if (opt_is(argv[i], "-m", NULL)) {
+    } else if (opt_is(argv[i], "-j", "--threads")) {
       config->use_multithreading = true;
       log_info_message(LOG_INFO_MISC, "Enabled Multithreading");
-    } else if (opt_is(argv[i], "-s", NULL)) {
+    } else if (opt_is(argv[i], "--chunk-serialization", NULL)) {
       config->use_chunk_serialization = true;
       log_info_message(LOG_INFO_MISC, "Enabled Chunk Serialization");
     } else if (opt_is(argv[i], "--server-port", NULL)) {
@@ -1147,7 +1258,10 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
     } else if (strncmp(argv[i], "--filter=", 9) == 0) {
       if (config_add_filter(config, argv[i] + 9) != 0)
         return -1;
-    } else if (opt_is(argv[i], "--filter", NULL)) {
+    } else if (strncmp(argv[i], "-f=", 3) == 0) {
+      if (config_add_filter(config, argv[i] + 3) != 0)
+        return -1;
+    } else if (opt_is(argv[i], "--filter", "-f")) {
       if (i + 1 >= argc) {
         log_message(LOG_LEVEL_ERROR, "missing argument for %s", argv[i]);
         return -1;
@@ -1185,13 +1299,6 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
     } else if (opt_is(argv[i], "--info", NULL)) {
       if (i + 1 >= argc || parse_info_flags(argv[++i], config) != 0)
         return -1;
-    } else if (opt_is(argv[i], "-T", NULL)) {
-      if (i + 1 >= argc) {
-        log_message(LOG_LEVEL_ERROR, "missing argument for %s", argv[i]);
-        return -1;
-      }
-      if (set_positive_int_option(&config->timeout, argv[++i], "-T") != 0)
-        return -1;
     } else if (strncmp(argv[i], "--skip-compress=", 16) == 0) {
       if (parse_skip_compress(config, argv[i] + 16) != 0)
         return -1;
@@ -1245,7 +1352,10 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
     } else if (strncmp(argv[i], "--remote-option=", 16) == 0) {
       if (config_add_remote_option(config, argv[i] + 16, "--remote-option") != 0)
         return -1;
-    } else if (opt_is(argv[i], "--remote-option", NULL)) {
+    } else if (strncmp(argv[i], "-M=", 3) == 0) {
+      if (config_add_remote_option(config, argv[i] + 3, "-M") != 0)
+        return -1;
+    } else if (opt_is(argv[i], "--remote-option", "-M")) {
       if (i + 1 >= argc) {
         log_message(LOG_LEVEL_ERROR, "missing argument for --remote-option");
         return -1;
@@ -1318,6 +1428,16 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
       if (identity_parse_chown(config, argv[++i]) != 0)
         return -1;
       config->use_metadata = true;
+    } else if (strncmp(argv[i], "--copy-as=", 10) == 0) {
+      if (identity_parse_copy_as(config, argv[i] + 10) != 0)
+        return -1;
+    } else if (opt_is(argv[i], "--copy-as", NULL)) {
+      if (i + 1 >= argc) {
+        log_message(LOG_LEVEL_ERROR, "missing argument for %s", argv[i]);
+        return -1;
+      }
+      if (identity_parse_copy_as(config, argv[++i]) != 0)
+        return -1;
     } else if (strncmp(argv[i], "--outbuf=", 9) == 0) {
       if (set_outbuf_option(config, argv[i] + 9) != 0)
         return -1;
@@ -1453,14 +1573,14 @@ static int read_patterns_from_file(const char* filepath, char*** patterns, int*
 }
 
 #ifndef FASTSYNC_TEST_BUILD
-/* Daemon auth (Wave B): read --password-file and derive the wire credentials
- * (username + SHA-256 hex digest of the password).  Runs once the destination
- * form is known: the credentials only make sense for a daemon
- * (host::module/path) destination, so a --password-file without one is a hard
- * error here rather than a silently-ignored flag.  The literal password is
- * hashed immediately and wiped from memory; only the digest (and username) are
- * kept on the Config for config_send.  Returns 0 on success, -1 on error (the
- * reason is logged; neither the password nor its digest is ever logged). */
+/* Daemon auth (A7, protocol 2.19.0): read --password-file and keep the
+ * username plus the LITERAL password (client-only, never serialized).  Runs
+ * once the destination form is known: the credentials only make sense for a
+ * daemon (host::module/path) destination, so a --password-file without one is a
+ * hard error here rather than a silently-ignored flag.  The password is handed
+ * to the SCRAM challenge/response in config_send and burned by
+ * config_burn_auth/config_delete at teardown.  Returns 0 on success, -1 on
+ * error (the reason is logged; the password is never logged). */
 static int load_daemon_credentials(Config* config) {
   if (!config->password_file)
     return 0;
@@ -1477,27 +1597,10 @@ static int load_daemon_credentials(Config* config) {
     log_message(LOG_LEVEL_ERROR, "%s", err);
     return -1;
   }
-  char hash[CREDENTIAL_HASH_HEX_LEN + 1];
-  if (!credentials_hash_password(password, hash)) {
-    log_message(LOG_LEVEL_ERROR, "failed to hash the password from '%s'", config->password_file);
-    credentials_burn(password, strlen(password));
-    free(password);
-    free(user);
-    return -1;
-  }
-  credentials_burn(password, strlen(password));
-  free(password);
 
-  free(config->auth_user);
-  free(config->auth_password_hash);
+  config_burn_auth(config);
   config->auth_user = user;
-  config->auth_password_hash = str_dup(hash);
-  if (!config->auth_password_hash) {
-    log_message(LOG_LEVEL_ERROR, "memory allocation failed reading '%s'", config->password_file);
-    free(config->auth_user);
-    config->auth_user = NULL;
-    return -1;
-  }
+  config->auth_password = password;
   log_info_message(LOG_INFO_MISC, "Loaded daemon credentials for user '%s'", config->auth_user);
   return 0;
 }
@@ -1548,10 +1651,33 @@ int main(int argc, char* argv[]) {
     }
     config->save_to_disk = true;
   } else if (positional_count == 1) {
-    log_message(LOG_LEVEL_ERROR, "missing destination argument");
-    print_usage();
-    exit_code = 1;
-    goto cleanup;
+    if (config->read_batch) {
+      /* --read-batch=<file> <dest>: the single positional is the destination
+         (there is no source). */
+      free(config->receive_root_directory);
+      config->receive_root_directory = str_dup(argv[positional_args[0]]);
+      if (!config->receive_root_directory) {
+        log_message(LOG_LEVEL_ERROR, "memory allocation failed");
+        exit_code = 1;
+        goto cleanup;
+      }
+      config->save_to_disk = true;
+    } else if (config->only_write_batch) {
+      /* --only-write-batch=<file> <source>: the single positional is the
+         source (there is no destination). */
+      free(config->send_directory);
+      config->send_directory = str_dup(argv[positional_args[0]]);
+      if (!config->send_directory) {
+        log_message(LOG_LEVEL_ERROR, "memory allocation failed");
+        exit_code = 1;
+        goto cleanup;
+      }
+    } else {
+      log_message(LOG_LEVEL_ERROR, "missing destination argument");
+      print_usage();
+      exit_code = 1;
+      goto cleanup;
+    }
   } else {
     if (!config->send_directory && env_source) {
       config->send_directory = str_dup(env_source);
@@ -1593,6 +1719,17 @@ int main(int argc, char* argv[]) {
     goto cleanup;
   }
 
+  /* --iconv: install the sender-side local->wire conversion before any path is
+     scanned or serialized (the scanner and the chunk/data path read windows are
+     all driven from this process, so one global initialization covers every
+     send site). */
+  if (!charset_wire_init_sender(config->iconv_spec)) {
+    log_message(LOG_LEVEL_ERROR,
+                "--iconv has an invalid CONVERT_SPEC or an unsupported charset name");
+    exit_code = 1;
+    goto cleanup;
+  }
+
   /* Apply the requested --outbuf style now that the mode is parsed. */
   apply_output_buffering(config);
 
@@ -1606,14 +1743,36 @@ int main(int argc, char* argv[]) {
 
   tcp_set_timeouts(config->timeout, config->contimeout);
 
+  /* Phase 6 residual-batch driver modes.  --read-batch / --only-write-batch are
+     purely local (apply a batch file, or emit one from a scan): neither connects
+     to nor transfers to a server.  --write-batch runs the normal live transfer
+     AND then emits the batch FILE from a separate deterministic scan pass.  It
+     drives the single-threaded transfer so the config outlives the run for that
+     second pass (the -m path takes ownership of the config). */
+  if (config->read_batch) {
+    exit_code = apply_batch_to_dest(config, config->read_batch, config->receive_root_directory);
+    goto cleanup;
+  }
+  if (config->only_write_batch) {
+    exit_code = write_batch_from_source(config, config->only_write_batch);
+    goto cleanup;
+  }
+
   /* Execute transfer */
-  if (config->use_multithreading) {
+  if (config->write_batch) {
+    exit_code = send_files(config);
+    if (exit_code == 0 && write_batch_from_source(config, config->write_batch) != 0) {
+      log_message(LOG_LEVEL_ERROR, "live transfer succeeded but batch emission failed");
+      exit_code = 1;
+    }
+  } else if (config->use_multithreading) {
     exit_code = send_files_multithreaded(&config);
   } else {
     exit_code = send_files(config);
   }
 
 cleanup:
+  charset_wire_free();
   if (config) {
     config_delete(config);
   }

src/client/client_send.c

@@ -1,6 +1,8 @@
 #include "client_send.h"
 #include "array_list.h"
+#include "batch.h"
 #include "change_list.h"
+#include "charset.h"
 #include "chunk.h"
 #include "compression.h"
 #include "config.h"
@@ -17,6 +19,7 @@
 #include "protocol.h"
 #include "queue.h"
 #include "scanner.h"
+#include "stop_condition.h"
 #include "transport_tcp.h"
 #include "transport_ssh.h"
 #include "transport_tls.h"
@@ -124,6 +127,11 @@ static bool prepare_scanner(const Config* config, int num_threads, PreparedScann
   options->excluded_paths = NULL;
   options->excluded_mutex = NULL;
   options->hardlinks = NULL;
+  /* P7 Wave D: capture source directory times whenever metadata rides the
+     wire.  Whether they are APPLIED is decided receiver-side (-O skips). */
+  options->capture_dir_times = config->use_metadata;
+  options->dir_entries = NULL;
+  options->dir_entries_mutex = NULL;
   if (config->preserve_hard_links) {
     out->hardlinks = hardlink_table_create();
     if (!out->hardlinks) {
@@ -810,21 +818,21 @@ static int send_delete_manifest(int fd, ArrayList* manifest, ArrayList* protecte
   if (!send_int(fd, keep_count))
     return -1;
   for (int i = 0; i < keep_count; i++) {
-    if (!send_str(fd, (char*)manifest->items[i]))
+    if (!send_wire_str(fd, (char*)manifest->items[i]))
       return -1;
   }
   int protected_count = protected_prefixes ? protected_prefixes->size : 0;
   if (!send_int(fd, protected_count))
     return -1;
   for (int i = 0; i < protected_count; i++) {
-    if (!send_str(fd, (char*)protected_prefixes->items[i]))
+    if (!send_wire_str(fd, (char*)protected_prefixes->items[i]))
       return -1;
   }
   int missing_count = missing_args ? missing_args->size : 0;
   if (!send_int(fd, missing_count))
     return -1;
   for (int i = 0; i < missing_count; i++) {
-    if (!send_str(fd, (char*)missing_args->items[i]))
+    if (!send_wire_str(fd, (char*)missing_args->items[i]))
       return -1;
   }
   return 0;
@@ -899,7 +907,7 @@ static int incremental_check(Client* client, File* file, const Config* config,
     *resume_offset = 0;
   if (!send_status(client->file_descriptor, STATUS_CHECK))
     return -1;
-  if (!send_str(client->file_descriptor, file_wire_path(file)))
+  if (!send_wire_str(client->file_descriptor, file_wire_path(file)))
     return -1;
   unsigned long long fsize = file->data->size;
   long long mtime = file->metadata ? file->metadata->mtime_sec : 0;
@@ -1112,14 +1120,51 @@ static bool send_file_direct(File* file, int fd, bool use_metadata, int compress
 }
 
 /* Transmit one explicit directory entry (--dirs): a STATUS_MKDIR frame whose
-   payload is only the destination path.  The receiver validates the path and
-   creates the directory under the receive root. */
-static bool send_directory_entry(Client* client, File* file) {
+   payload is the destination path and, when metadata is negotiated, the
+   directory's metadata frame.  The receiver validates the path, creates the
+   directory under the receive root, and (metadata case) defers applying its
+   times to the end of the transfer so -O/--omit-dir-times is honored. */
+static bool send_directory_entry(const Client* client, File* file, const Config* config) {
   if (!file || !file_wire_path(file))
     return false;
-  if (!send_status(client->file_descriptor, STATUS_MKDIR))
+  if (!send_status(client->file_descriptor, STATUS_MKDIR) ||
+      !send_wire_str(client->file_descriptor, file_wire_path(file)))
     return false;
-  return send_str(client->file_descriptor, file_wire_path(file));
+  return !config->use_metadata || metadata_send(client->file_descriptor, file->metadata);
+}
+
+/* P7 Wave D: transmit every captured source directory's metadata in terminal
+   STATUS_DIR_TIMES frames (count, then (path, metadata) pairs) after all file
+   data and the optional delete manifest.  The receiver applies them at the END
+   of its own transfer (after deletion and --delay-updates publication) so a
+   directory's mtime is not clobbered by writing its children.  A non-metadata
+   transfer (or an empty set) sends nothing, keeping the stream byte-identical.
+
+   The receiver rejects a frame whose count exceeds MAX_MANIFEST_ENTRIES, so a
+   huge tree is CHUNKED into repeated frames of at most that many entries each
+   (the receiver's loop handles repeated STATUS_DIR_TIMES frames).  Every frame
+   stays within the receiver's bound, and a frame that would exceed it is never
+   emitted. */
+static bool send_dir_times(const Client* client, const Config* config, ArrayList* dir_entries) {
+  if (!client || !config || !config->use_metadata || !dir_entries || dir_entries->size == 0)
+    return true;
+  int fd = client->file_descriptor;
+  int index = 0;
+  while (index < dir_entries->size) {
+    int remaining = dir_entries->size - index;
+    int chunk = remaining > MAX_MANIFEST_ENTRIES ? MAX_MANIFEST_ENTRIES : remaining;
+    if (!send_status(fd, STATUS_DIR_TIMES) || !send_int(fd, chunk))
+      return false;
+    for (int i = 0; i < chunk; i++) {
+      File* file = (File*)dir_entries->items[index + i];
+      if (!file || !file_wire_path(file))
+        return false;
+      if (!send_wire_str(fd, file_wire_path(file)) || !metadata_send(fd, file->metadata))
+        return false;
+    }
+    index += chunk;
+  }
+  return true;
 }
 
 /* Transmit one symlink entry: a STATUS_SYMLINK frame carrying the destination
@@ -1130,8 +1175,8 @@ static bool send_symlink_entry(const Client* client, File* file, const Config* c
   if (!file || !file_wire_path(file) || !file->symlink_target)
     return false;
   int fd = client->file_descriptor;
-  if (!send_status(fd, STATUS_SYMLINK) || !send_str(fd, file_wire_path(file)) ||
-      !send_str(fd, file->symlink_target))
+  if (!send_status(fd, STATUS_SYMLINK) || !send_wire_str(fd, file_wire_path(file)) ||
+      !send_wire_str(fd, file->symlink_target))
     return false;
   return !config->use_metadata || metadata_send(fd, file->metadata);
 }
@@ -1256,6 +1301,19 @@ static int send_single_file(Client* client, File* file, Config* config, bool use
   return 0;
 }
 
+/* Sendfile calls a blocking open() on the source (file_send_sendfile_with_skip
+ * -> file_open_for_read), which never returns for a FIFO/device with no writer.
+ * Only a regular file may take the zero-copy sendfile path; a non-regular source
+ * (FIFO/device copied by --copy-devices) must use the buffered, size-bounded
+ * read path instead.  `stat` follows symlinks, so a dereferenced symlink to a
+ * regular file keeps the sendfile fast path. */
+static bool source_is_regular_file(const File* file) {
+  if (!file || !file->path)
+    return false;
+  struct stat st;
+  return stat(file->path, &st) == 0 && S_ISREG(st.st_mode);
+}
+
 static int send_chunk_with_removal(Client* client, Chunk* chunk, Config* config,
                                    ArrayList* remove_sources) {
   if (config->use_chunk_serialization) {
@@ -1297,10 +1355,10 @@ static int send_chunk_with_removal(Client* client, Chunk* chunk, Config* config,
     if (f == NULL)
       continue;
     if (f->is_dir) {
-      /* Explicit directory entry (--dirs): a MKDIR frame carrying only the
-         destination path.  Directories have no source to remove and no
-         incremental check. */
-      if (!send_directory_entry(client, f))
+      /* Explicit directory entry (--dirs): a MKDIR frame carrying the
+         destination path (and metadata when negotiated).  Directories have no
+         source to remove and no incremental check. */
+      if (!send_directory_entry(client, f, config))
         return -1;
       change_emit_dir_sent(config, f);
       continue;
@@ -1311,9 +1369,9 @@ static int send_chunk_with_removal(Client* client, Chunk* chunk, Config* config,
        wire path so the receiver links this entry to that installed file. */
     if (f->link_group != 0 && !f->link_first && f->hardlink_target != NULL) {
       if (!send_status(client->file_descriptor, STATUS_HARDLINK) ||
-          !send_str(client->file_descriptor, file_wire_path(f)) ||
+          !send_wire_str(client->file_descriptor, file_wire_path(f)) ||
           !send_int(client->file_descriptor, f->link_group) ||
-          !send_str(client->file_descriptor, f->hardlink_target))
+          !send_wire_str(client->file_descriptor, f->hardlink_target))
         return -1;
       change_emit_file_sent(config, f);
       continue;
@@ -1334,8 +1392,9 @@ static int send_chunk_with_removal(Client* client, Chunk* chunk, Config* config,
       continue;
     }
     bool stream = f->data->data == NULL && f->data->size > 0;
-    bool use_sendfile =
-        (config->use_sendfile && !config->use_compression) || (stream && !config->use_compression);
+    bool use_sendfile = ((config->use_sendfile && !config->use_compression) ||
+                         (stream && !config->use_compression)) &&
+                        source_is_regular_file(f);
     SourceFile* source = remove_sources ? source_file_create(f) : NULL;
     int rc = send_single_file(client, f, config, config->use_incremental, use_sendfile);
     if (rc == 1) {
@@ -1396,6 +1455,16 @@ static int send_chunks_multithreaded(void* pipeline_context) {
   }
 
   while (true) {
+    /* Phase 6: stop-elegantly at the next chunk boundary once the --stop-after
+       / --stop-at deadline has passed.  Everything already sent is finalized by
+       the completion tail below; the run still returns success. */
+    if (stop_condition_reached(&context->stop_condition)) {
+      log_info_message(LOG_INFO_MISC,
+                       "Stop deadline reached; stopping transfer at the next chunk boundary");
+      context->scan_stopped_early = true;
+      pipeline_cancel(context);
+      break;
+    }
     Chunk* current_chunk = queue_dequeue_multithreaded(
         context->queue_loader, &context->mutex_loader, &context->condition_not_empty_loader,
         &context->condition_not_full_loader, &context->loader_done);
@@ -1407,55 +1476,7 @@ static int send_chunks_multithreaded(void* pipeline_context) {
         protocol_session_unbind();
         return thrd_error;
       }
-      if (context->config->use_delete && !context->early_delete) {
-        /* Empty keep-set + scan I/O error must not delete the whole destination
-           (the source may not be genuinely empty -- see send_files). */
-        bool empty_io;
-        mtx_lock(&context->mutex_scanner);
-        empty_io = context->scan_had_io_error && context->manifest && context->manifest->size == 0;
-        mtx_unlock(&context->mutex_scanner);
-        if (empty_io) {
-          log_message(LOG_LEVEL_ERROR,
-                      "source scan hit an I/O error before finding any file; refusing to delete "
-                      "with an empty keep-set (--delete)");
-          goto send_fail;
-        }
-        if (send_delete_manifest(client->file_descriptor, context->manifest,
-                                 context->excluded_paths, context->missing_args) != 0)
-          goto send_fail;
-      } else if (context->config->delete_missing_args && !context->early_delete) {
-        /* --delete-missing-args without --delete: no keep-set is built, but the
-           exact-delete paths still ride the same manifest frame (commit once the
-           transfer succeeded). */
-        if (send_delete_manifest(client->file_descriptor, NULL, NULL, context->missing_args) != 0)
-          goto send_fail;
-      }
-      bool ok = finalize_transfer(client, context->config, context->remove_source_files);
-      if (!ok && context->config->use_delete)
-        log_message(LOG_LEVEL_ERROR,
-                    "server reported a deletion failure (--delete); see the server log for the "
-                    "reason (a --max-delete limit that the run would exceed deletes nothing)");
-      if (ok)
-        remove_transferred_sources(context->config, context->remove_source_files);
-      mtx_lock(&context->mutex_progress);
-      int total_files = context->total_files;
-      unsigned long long total_bytes = context->total_bytes;
-      mtx_unlock(&context->mutex_progress);
-      if (context->config->stats)
-        fprintf(stderr, "Stats: %d files, %.1f MB\n", total_files, total_bytes / 1048576.0);
-      log_info_message(LOG_INFO_STATS, "Transfer summary: %d files, %.1f MB", total_files,
-                       total_bytes / 1048576.0);
-      disconnect_transfer_client(client);
-      mark_sender_done(context);
-      protocol_session_unbind();
-      return ok ? thrd_success : thrd_error;
-
-    send_fail:
-      pipeline_cancel(context);
-      disconnect_transfer_client(client);
-      mark_sender_done(context);
-      protocol_session_unbind();
-      return thrd_error;
+      break;
     }
     if (send_chunk_with_removal(client, current_chunk, context->config,
                                 context->remove_source_files) != 0) {
@@ -1482,6 +1503,79 @@ static int send_chunks_multithreaded(void* pipeline_context) {
     mtx_unlock(&context->mutex_progress);
     chunk_destroy(current_chunk);
   }
+
+  /* Completion tail: reached on natural exhaustion or an early stop deadline.
+     A deadline that cut the scan short leaves an incomplete keep-set manifest;
+     transmitting it would make the receiver --delete the unscanned source
+     mirrors (data loss), so it is deliberately suppressed.  Suppressing it also
+     means the manifest (which the scanner thread may still be appending) is
+     never read here on the early-stop path, so no scanner synchronization is
+     required to enter the tail. */
+  context->scan_stopped_early =
+      context->scan_stopped_early || stop_condition_reached(&context->stop_condition);
+  if (context->scan_stopped_early) {
+    if (context->config->use_delete || context->config->delete_missing_args)
+      log_message(LOG_LEVEL_WARNING,
+                  "transfer stopped early (stop deadline); skipping --delete keep-set so "
+                  "unscanned source mirrors are not deleted");
+    else
+      log_message(LOG_LEVEL_WARNING, "transfer stopped early (stop deadline)");
+  } else if (context->config->use_delete && !context->early_delete) {
+    /* Empty keep-set + scan I/O error must not delete the whole destination
+       (the source may not be genuinely empty -- see send_files). */
+    bool empty_io;
+    mtx_lock(&context->mutex_scanner);
+    empty_io = context->scan_had_io_error && context->manifest && context->manifest->size == 0;
+    mtx_unlock(&context->mutex_scanner);
+    if (empty_io) {
+      log_message(LOG_LEVEL_ERROR,
+                  "source scan hit an I/O error before finding any file; refusing to delete "
+                  "with an empty keep-set (--delete)");
+      goto send_fail;
+    }
+    if (send_delete_manifest(client->file_descriptor, context->manifest, context->excluded_paths,
+                             context->missing_args) != 0)
+      goto send_fail;
+  } else if (context->config->delete_missing_args && !context->early_delete) {
+    /* --delete-missing-args without --delete: no keep-set is built, but the
+       exact-delete paths still ride the same manifest frame (commit once the
+       transfer succeeded). */
+    if (send_delete_manifest(client->file_descriptor, NULL, NULL, context->missing_args) != 0)
+      goto send_fail;
+  }
+  /* P7 Wave D: transmit the captured directory times last.  The scanner thread
+     (and all parallel workers) has been joined before scanner_done was set, so
+     the list is complete and race-free; on an early stop the list may be
+     incomplete and is deliberately not sent. */
+  if (!context->scan_stopped_early &&
+      !send_dir_times(client, context->config, context->dir_entries))
+    goto send_fail;
+  bool ok = finalize_transfer(client, context->config, context->remove_source_files);
+  if (!ok && context->config->use_delete)
+    log_message(LOG_LEVEL_ERROR,
+                "server reported a deletion failure (--delete); see the server log for the "
+                "reason (a --max-delete limit that the run would exceed deletes nothing)");
+  if (ok)
+    remove_transferred_sources(context->config, context->remove_source_files);
+  mtx_lock(&context->mutex_progress);
+  int total_files = context->total_files;
+  unsigned long long total_bytes = context->total_bytes;
+  mtx_unlock(&context->mutex_progress);
+  if (context->config->stats)
+    fprintf(stderr, "Stats: %d files, %.1f MB\n", total_files, total_bytes / 1048576.0);
+  log_info_message(LOG_INFO_STATS, "Transfer summary: %d files, %.1f MB", total_files,
+                   total_bytes / 1048576.0);
+  disconnect_transfer_client(client);
+  mark_sender_done(context);
+  protocol_session_unbind();
+  return ok ? thrd_success : thrd_error;
+
+send_fail:
+  pipeline_cancel(context);
+  disconnect_transfer_client(client);
+  mark_sender_done(context);
+  protocol_session_unbind();
+  return thrd_error;
 }
 
 /* Scan thread of the -m pipeline.  --dirs disables recursive traversal (the
@@ -1496,6 +1590,11 @@ static int scan_directory_multithreaded(void* pipeline_context) {
     protocol_session_unbind();
     return thrd_error;
   }
+  prepared.options.stop_condition = &context->stop_condition;
+  /* P7 Wave D: the recursive scan feeds the shared directory-time list; the
+     parallel workers append under the context's dedicated mutex. */
+  prepared.options.dir_entries = context->dir_entries;
+  prepared.options.dir_entries_mutex = &context->dir_entries_mutex;
   /* The keep-set manifest for the late modes is built from this data pass, so
      the parallel scanner records the protected excluded prefixes here.  The
      early modes already transmitted the pre-scan keep-set and its protected
@@ -1687,6 +1786,78 @@ static int progress_thread_fn(void* arg) {
   return thrd_success;
 }
 
+/* Phase 6 residual-batch (client-only).  --write-batch=FILE / --only-write-batch
+ * emit a self-contained single-file batch of a whole source tree from a
+ * deterministic separate scan pass.  Each chunk's file images are fully loaded
+ * into memory (so chunk_serialize sees complete content, matching the -s wire
+ * codec byte-for-byte) and written to FILE as a length-prefixed record.  The
+ * batch never crosses the wire and needs no server.  Returns 0 on success. */
+int write_batch_from_source(const Config* config, const char* batch_path) {
+  if (!config || !batch_path || !config->send_directory)
+    return 1;
+  PreparedScanner prepared;
+  memset(&prepared, 0, sizeof(prepared));
+  if (!prepare_scanner(config, 0, &prepared))
+    return 1;
+  DirectoryScanner* scanner =
+      directory_scanner_create_with_options(config->send_directory, &prepared.options);
+  if (!scanner) {
+    prepared_scanner_destroy(&prepared);
+    return 1;
+  }
+  int fd = open(batch_path, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  if (fd < 0) {
+    log_perror("could not create batch file");
+    directory_scanner_destroy(scanner);
+    prepared_scanner_destroy(&prepared);
+    return 1;
+  }
+  bool ok = batch_write_header(fd, config);
+  Chunk* chunk;
+  while (ok && (chunk = directory_scanner_next(scanner)) != NULL) {
+    for (int i = 0; i < chunk->element_count && ok; i++) {
+      File* f = chunk->items[i];
+      if (f == NULL || f->data == NULL)
+        continue;
+      if (f->data->size > 0 && f->data->data == NULL && !file_load_data(f)) {
+        log_message(LOG_LEVEL_ERROR, "batch: failed to load data for %s",
+                    f->path ? f->path : "<no path>");
+        ok = false;
+        break;
+      }
+    }
+    if (ok)
+      ok = batch_write_chunk(fd, chunk);
+    chunk_destroy(chunk);
+  }
+  if (ok && directory_scanner_failed(scanner))
+    ok = false;
+  if (directory_scanner_had_io_error(scanner))
+    log_message(LOG_LEVEL_WARNING, "batch: source scan hit an unreadable directory");
+  close(fd);
+  directory_scanner_destroy(scanner);
+  prepared_scanner_destroy(&prepared);
+  if (!ok && batch_path[0] != '\0')
+    unlink(batch_path); /* never leave a partial batch behind */
+  return ok ? 0 : 1;
+}
+
+/* Apply a batch FILE to DEST_ROOT (client-only, no server).  Returns 0 on
+ * success; a malformed/truncated/oversized record or an apply error fails the
+ * whole apply. */
+int apply_batch_to_dest(const Config* config, const char* batch_path, const char* dest_root) {
+  if (!batch_path || !dest_root)
+    return 1;
+  int fd = open(batch_path, O_RDONLY);
+  if (fd < 0) {
+    log_perror("could not open batch file");
+    return 1;
+  }
+  int rc = batch_read_apply(fd, config, dest_root);
+  close(fd);
+  return rc;
+}
+
 int send_files(Config* config) {
   if (config->list_only)
     return send_list_only(config);
@@ -1725,6 +1896,9 @@ int send_files(Config* config) {
   DirectoryScanner* scanner = NULL;
   ArrayList* manifest = NULL;
   ArrayList* remove_sources = NULL;
+  /* P7 Wave D: captured source directory times, transmitted in trailing
+     STATUS_DIR_TIMES frame(s) (only when metadata rides the wire). */
+  ArrayList* dir_entries = NULL;
   /* Protected excluded prefixes (delete-excluded default protection). */
   ArrayList* excluded = NULL;
   bool delete_early = config->use_delete && config_delete_timing_early(config);
@@ -1737,6 +1911,11 @@ int send_files(Config* config) {
   receive_daemon_motd(client, config);
   if (!prepare_scanner(config, 0, &prepared))
     goto send_fail;
+  if (config->use_metadata) {
+    dir_entries = array_list_create(file_destroy);
+    if (!dir_entries)
+      goto send_fail;
+  }
   if (config->remove_source_files)
     remove_sources = array_list_create(source_file_destroy);
   if (config->remove_source_files && !remove_sources)
@@ -1790,6 +1969,21 @@ int send_files(Config* config) {
     if (!manifest)
       goto send_fail;
   }
+  /* Phase 6: compute the client-only stop deadline once at transfer start.  The
+     early-delete pre-scan above deliberately ignores it so the keep-set (and
+     its committed deletion) is always complete and correct. */
+  struct timespec now_mono;
+  if (clock_gettime(CLOCK_MONOTONIC, &now_mono) != 0) {
+    now_mono.tv_sec = 0;
+    now_mono.tv_nsec = 0;
+  }
+  StopCondition stop = stop_condition_make(config->stop_after_mins > 0, config->stop_after_mins,
+                                           config->stop_at_set, config->stop_at, now_mono);
+  prepared.options.stop_condition = &stop;
+  /* The early-delete pre-scan above already ran; only the data pass should feed
+     the directory-time list (otherwise every directory would be captured
+     twice). */
+  prepared.options.dir_entries = dir_entries;
   scanner = directory_scanner_create_with_options(config->send_directory, &prepared.options);
   if (!scanner)
     goto send_fail;
@@ -1799,7 +1993,20 @@ int send_files(Config* config) {
   int total_files = 0;
   time_t last_progress = 0;
   time_t start = time(NULL);
+  /* True when the stop deadline cut the scan short so the keep-set manifest is
+     only a prefix of the source. */
+  bool scan_stopped_early = false;
   while ((current_chunk = directory_scanner_next(scanner)) != NULL) {
+    /* Phase 6: stop-elegantly at the next chunk boundary once the deadline has
+       passed.  The scanner may also have stopped early itself; either way the
+       completion tail below keeps everything already sent. */
+    if (stop_condition_reached(&stop)) {
+      chunk_destroy(current_chunk);
+      log_info_message(LOG_INFO_MISC,
+                       "Stop deadline reached; stopping transfer at the next chunk boundary");
+      scan_stopped_early = true;
+      break;
+    }
     unsigned long long chunk_bytes = 0;
     for (int i = 0; i < current_chunk->element_count; i++) {
       chunk_bytes += current_chunk->items[i]->data->size;
@@ -1853,33 +2060,53 @@ int send_files(Config* config) {
     goto send_fail;
   if (directory_scanner_had_io_error(scanner))
     had_scan_io = true;
-  if (had_scan_io && manifest && manifest->size == 0) {
-    /* A scan that hit an I/O error and produced no keep entries is ambiguous;
-       an empty keep-set would delete the whole destination.  Refuse to delete
-       (see the early-timing comment above). */
-    log_message(LOG_LEVEL_ERROR,
-                "source scan hit an I/O error before finding any file; refusing to delete with "
-                "an empty keep-set (--delete)");
-    goto send_fail;
-  }
-  if ((manifest || config->delete_missing_args) && !delete_early) {
-    /* Late (commit) ordering: all file data is out; transmit the manifest so
-       the receiver commits the extras walk (--delete) and/or the
-       --delete-missing-args exact-path deletions only after the transfer
-       succeeds.  In the early modes (--delete-before/--delete-during) the
-       manifest already went out up front, so nothing is re-sent here. */
-    if (send_delete_manifest(client->file_descriptor, manifest, excluded, missing_args) != 0) {
+  /* Phase 6: the scanner may have stopped early (returning NULL without a
+     failure) as soon as the deadline passed, so reflect that here too.  A
+     deadline that cut the scan short leaves an incomplete keep-set; transmitting
+     it would make the receiver --delete the unscanned source mirrors (data
+     loss), so the late delete manifest is suppressed below. */
+  scan_stopped_early = scan_stopped_early || stop_condition_reached(&stop);
+  if (scan_stopped_early) {
+    if (config->use_delete || config->delete_missing_args)
+      log_message(LOG_LEVEL_WARNING,
+                  "transfer stopped early (stop deadline); skipping --delete keep-set so "
+                  "unscanned source mirrors are not deleted");
+    else
+      log_message(LOG_LEVEL_WARNING, "transfer stopped early (stop deadline)");
+  } else {
+    if (had_scan_io && manifest && manifest->size == 0) {
+      /* A scan that hit an I/O error and produced no keep entries is ambiguous;
+         an empty keep-set would delete the whole destination.  Refuse to delete
+         (see the early-timing comment above). */
+      log_message(LOG_LEVEL_ERROR,
+                  "source scan hit an I/O error before finding any file; refusing to delete with "
+                  "an empty keep-set (--delete)");
+      goto send_fail;
+    }
+    if ((manifest || config->delete_missing_args) && !delete_early) {
+      /* Late (commit) ordering: all file data is out; transmit the manifest so
+         the receiver commits the extras walk (--delete) and/or the
+         --delete-missing-args exact-path deletions only after the transfer
+         succeeds.  In the early modes (--delete-before/--delete-during) the
+         manifest already went out up front, so nothing is re-sent here. */
+      if (send_delete_manifest(client->file_descriptor, manifest, excluded, missing_args) != 0) {
+        if (manifest) {
+          array_list_delete(manifest);
+          manifest = NULL;
+        }
+        goto send_fail;
+      }
       if (manifest) {
         array_list_delete(manifest);
         manifest = NULL;
       }
-      goto send_fail;
-    }
-    if (manifest) {
-      array_list_delete(manifest);
-      manifest = NULL;
     }
   }
+  /* P7 Wave D: every directory has now been traversed (or the scan stopped
+     early), so transmit the captured directory times last.  The receiver defers
+     applying them until after its own deletion/publication phase. */
+  if (!send_dir_times(client, config, dir_entries))
+    goto send_fail;
   bool ok = finalize_transfer(client, config, remove_sources);
   if (!ok && config->use_delete)
     log_message(LOG_LEVEL_ERROR,
@@ -1921,6 +2148,8 @@ send_fail:
     array_list_delete(missing_args);
   if (remove_sources)
     array_list_delete(remove_sources);
+  if (dir_entries)
+    array_list_delete(dir_entries);
   if (scanner)
     directory_scanner_destroy(scanner);
   prepared_scanner_destroy(&prepared);
@@ -1987,6 +2216,14 @@ int send_files_multithreaded(Config** config_ptr) {
   context->missing_args = missing_args;
   missing_args = NULL; /* owned by the context from here on */
   *config_ptr = NULL;  /* context now owns config through all remaining paths */
+  struct timespec now_mono;
+  if (clock_gettime(CLOCK_MONOTONIC, &now_mono) != 0) {
+    now_mono.tv_sec = 0;
+    now_mono.tv_nsec = 0;
+  }
+  context->stop_condition =
+      stop_condition_make(config->stop_after_mins > 0, config->stop_after_mins, config->stop_at_set,
+                          config->stop_at, now_mono);
   bool collect_excluded = config->use_delete && !config->delete_excluded;
   if (config->use_delete) {
     context->manifest = array_list_create(free);

src/client/client_send.h

@@ -9,5 +9,8 @@ int send_chunk(Client* client, Chunk* chunk, Config* config);
 int send_files(Config* config);
 /* Takes ownership only when *config is set to NULL on return. */
 int send_files_multithreaded(Config** config);
+/* Phase 6 residual-batch (client-only).  See client_send.c. */
+int write_batch_from_source(const Config* config, const char* batch_path);
+int apply_batch_to_dest(const Config* config, const char* batch_path, const char* dest_root);
 
 #endif

src/client/client_validation.c

@@ -1,12 +1,42 @@
 #include "client_validation.h"
+#include "charset.h"
 #include "delay_updates.h"
 #include "log.h"
 #include "usage.h"
+#include "utils.h"
+#include <string.h>
 #include <stdio.h>
 
 /* Validate config after parsing. Returns true if valid. */
 bool validate_config(const Config* config) {
-  if (!config->send_directory || !config->receive_root_directory) {
+  /* Phase 6 residual-batch modes relax the normal source+destination pair: the
+     batch driver is local and needs only what it consumes.  --only-write-batch
+     emits a batch from the source (no destination, no server);
+     --read-batch applies a batch to the destination (no source, no server);
+     --write-batch runs the live transfer AND emits a batch, so it keeps the
+     full pair. */
+  bool write_batch = config->write_batch != NULL;
+  bool only_write_batch = config->only_write_batch != NULL;
+  bool read_batch = config->read_batch != NULL;
+  if ((write_batch && only_write_batch) || (write_batch && read_batch) ||
+      (only_write_batch && read_batch)) {
+    log_message(LOG_LEVEL_ERROR,
+                "--write-batch, --only-write-batch, and --read-batch are mutually exclusive");
+    return false;
+  }
+  if (read_batch) {
+    if (!config->receive_root_directory) {
+      log_message(LOG_LEVEL_ERROR, "--read-batch requires a destination directory");
+      print_usage();
+      return false;
+    }
+  } else if (only_write_batch) {
+    if (!config->send_directory) {
+      log_message(LOG_LEVEL_ERROR, "--only-write-batch requires a source directory");
+      print_usage();
+      return false;
+    }
+  } else if (!config->send_directory || !config->receive_root_directory) {
     log_message(LOG_LEVEL_ERROR, "source and destination directories are required");
     print_usage();
     return false;
@@ -107,6 +137,15 @@ bool validate_config(const Config* config) {
       return false;
     }
   }
+  /* Daemon credentials (A7, protocol 2.19.0): a --password-file would send the
+     username in the clear and derive a SCRAM proof a network sniffer could
+     attack offline, so it is only allowed over TLS (which itself mandates a
+     verified --cert/--key/--ca set above) or to a loopback destination.  A
+     remote plaintext daemon is refused here, before any network I/O. */
+  if (config->password_file && !config->use_tls && !utils_host_is_loopback(config->server_host)) {
+    log_message(LOG_LEVEL_ERROR, "sending daemon credentials to a non-local server requires --tls");
+    return false;
+  }
   if (config->delay_updates && config->inplace) {
     log_message(LOG_LEVEL_ERROR, "--delay-updates does not work with --inplace");
     return false;
@@ -123,5 +162,33 @@ bool validate_config(const Config* config) {
                 "timing; at most one may be given and each implies --delete");
     return false;
   }
+  /* --iconv: reject a malformed CONVERT_SPEC or an unsupported charset name at
+     startup (a probe iconv_open is attempted), so a typo'd charset never fails
+     the run mid-transfer with per-file errors. */
+  if (!charset_spec_valid(config->iconv_spec)) {
+    log_message(LOG_LEVEL_ERROR,
+                "--iconv requires LOCAL[,REMOTE] charset names supported by iconv");
+    return false;
+  }
+  /* --protocol: FastSync has exactly one wire format, so the forced version
+     must equal the current PROTOCOL_VERSION exactly.  Rejected here, before any
+     network I/O, rather than letting the server hit its own mismatch check. */
+  if (strcmp(config->version, PROTOCOL_VERSION) != 0) {
+    log_message(LOG_LEVEL_ERROR,
+                "--protocol must be %s (FastSync supports only its current wire "
+                "protocol version and cannot speak an older or virtual one)",
+                PROTOCOL_VERSION);
+    return false;
+  }
+  /* --copy-as pushes the source ids through the metadata path (it implies
+     --preserve).  A later --no-preserve would clear use_metadata, leaving the
+     transfer with nothing to chown while the receiver gate would still pass.
+     Refuse the combination up front rather than silently chowning nothing. */
+  if (config->copy_as_set && !config->use_metadata) {
+    log_message(LOG_LEVEL_ERROR,
+                "--copy-as requires metadata preservation and cannot be combined with "
+                "--no-preserve");
+    return false;
+  }
   return true;
 }

src/client/scanner.c

@@ -487,6 +487,10 @@ DirectoryScanner* directory_scanner_create_with_options(const char* root_directo
   scanner->relative_mode = options->relative && options->file_list != NULL;
   scanner->hardlinks = options->hardlinks;
   scanner->prune_empty_dirs = options->prune_empty_dirs;
+  scanner->stop_condition = options->stop_condition;
+  scanner->capture_dir_times = options->capture_dir_times;
+  scanner->dir_entries = options->dir_entries;
+  scanner->dir_entries_mutex = options->dir_entries_mutex;
   scanner->dirs_root_emitted = false;
   scanner->list_index = 0;
   scanner->dirs_batch = NULL;
@@ -594,6 +598,63 @@ static Chunk* chunk_data_to_chunk(ArrayList* chunk_data) {
   return chunk;
 }
 
+/* P7 Wave D: append one traversed source directory's captured metadata to the
+ * shared pending-directory-time list.  The File carries no payload; only the
+ * wire path (absolute fs path normally, the bare relative path under
+ * -R + --files-from) and its metadata are used, and the sender transmits them
+ * in trailing STATUS_DIR_TIMES frame(s).  `mutex` (optional) serializes the
+ * append for the parallel scanner's shared workers.  An unstattable or
+ * non-directory path is silently skipped (the transfer is unaffected); an
+ * allocation failure is fatal and reported to the caller. */
+static bool scanner_capture_dir_time(ArrayList* dir_entries, mtx_t* mutex, const char* root_path,
+                                     const char* fs_path, bool relative_mode, bool preserve_atimes,
+                                     bool preserve_crtimes) {
+  if (!dir_entries || !root_path || !fs_path)
+    return true;
+  struct stat st;
+  if (stat(fs_path, &st) != 0 || !S_ISDIR(st.st_mode))
+    return true;
+  char* rel = scanner_path_relative(root_path, fs_path);
+  if (!rel)
+    return true;
+  if (relative_mode && rel[0] == '\0') {
+    /* -R + --files-from: the transfer root itself has no bare relative wire
+       path (matches the -R scan, which never emits the root). */
+    free(rel);
+    return true;
+  }
+  File* file = file_create(fs_path);
+  if (!file) {
+    free(rel);
+    return false;
+  }
+  file->is_dir = true;
+  file->metadata = file_metadata_create(fs_path, &st, preserve_atimes, preserve_crtimes);
+  if (!file->metadata) {
+    free(rel);
+    file_destroy(file);
+    return false;
+  }
+  if (relative_mode) {
+    file->send_path = rel;
+    rel = NULL;
+  }
+  free(rel);
+  bool added;
+  if (mutex) {
+    mtx_lock(mutex);
+    added = array_list_add(dir_entries, file);
+    mtx_unlock(mutex);
+  } else {
+    added = array_list_add(dir_entries, file);
+  }
+  if (!added) {
+    file_destroy(file);
+    return false;
+  }
+  return true;
+}
+
 /* Open the next queued directory and set up its filter context.  Returns 1 when
    a directory is open, 0 when the queue is exhausted, and -1 on a fatal error.
    A directory that cannot be opened is an I/O error: it is recorded on the
@@ -660,6 +721,17 @@ static int open_next_directory(DirectoryScanner* scanner) {
       scanner->current_path = NULL;
       return -1;
     }
+    if (scanner->capture_dir_times &&
+        !scanner_capture_dir_time(scanner->dir_entries, scanner->dir_entries_mutex,
+                                  scanner->root_path, scanner->current_path, scanner->relative_mode,
+                                  scanner->preserve_atimes, scanner->preserve_crtimes)) {
+      closedir(scanner->current_dir);
+      scanner->current_dir = NULL;
+      free(scanner->current_path);
+      scanner->current_path = NULL;
+      scanner->failed = true;
+      return -1;
+    }
     return 1;
   }
   return 0;
@@ -843,6 +915,12 @@ static Chunk* dirs_flush_batch(DirectoryScanner* scanner) {
 
 static Chunk* directory_scanner_next_dirs(DirectoryScanner* scanner) {
   while (scanner->dirs_batch == NULL || scanner->dirs_batch_size <= scanner->chunk_size) {
+    if (scanner->stop_condition && stop_condition_reached(scanner->stop_condition)) {
+      Chunk* leftover = dirs_flush_batch(scanner);
+      if (leftover)
+        chunk_destroy(leftover);
+      return NULL;
+    }
     if (!scanner->dirs_batch) {
       scanner->dirs_batch = array_list_create(file_destroy);
       if (!scanner->dirs_batch) {
@@ -886,6 +964,10 @@ Chunk* directory_scanner_next(DirectoryScanner* scanner) {
   unsigned long long chunk_data_size = 0;
 
   while (1) {
+    if (scanner->stop_condition && stop_condition_reached(scanner->stop_condition)) {
+      array_list_delete(chunk_data);
+      return NULL;
+    }
     if (scanner->current_dir == NULL) {
       int ret = open_next_directory(scanner);
       if (ret == 0)
@@ -1573,6 +1655,18 @@ ParallelScanner* parallel_scanner_create_with_options(const char* root_directory
     parallel_scanner_destroy(ps);
     return NULL;
   }
+  /* P7 Wave D: the parallel scanner never runs a DirectoryScanner over the
+     transfer root itself (it hands the root's immediate subdirectories to
+     workers), so capture the root's directory time here. */
+  if (options->capture_dir_times &&
+      !scanner_capture_dir_time(options->dir_entries, options->dir_entries_mutex, root_directory,
+                                root_directory, options->relative && options->file_list != NULL,
+                                options->preserve_atimes, options->preserve_crtimes)) {
+    array_list_delete(root_files);
+    array_list_delete(subdirs);
+    parallel_scanner_destroy(ps);
+    return NULL;
+  }
 
   unsigned long long cs = options->chunk_size > 0 ? options->chunk_size : DESIRED_CHUNK_SIZE;
   ps->initial_chunk = batch_files(root_files, cs, ps->result_queue, &ps->failed);

src/client/scanner.h

@@ -7,6 +7,7 @@
 #include "hardlink.h"
 #include "protocol.h"
 #include "queue.h"
+#include "stop_condition.h"
 #include <dirent.h>
 #include <stdbool.h>
 #include <stdatomic.h>
@@ -92,6 +93,23 @@ typedef struct {
    * read-only here; the parallel scanner passes it unchanged to every worker so
    * one table detects every group across all subdirectories. */
   HardLinkTable* hardlinks;
+  /* Phase 6: optional sender stop deadline.  When non-NULL the scanner checks
+   * it at natural loop boundaries and stops emitting chunks once reached
+   * (without marking the scan as failed), so a busy scan itself stops early.
+   * Client-only, never serialized to the wire. */
+  const StopCondition* stop_condition;
+  /* P7 Wave D (protocol 2.17.0): directory-time capture sink.  When
+   * `capture_dir_times` is true the recursive scan appends one is_dir File
+   * (with metadata, no payload) per source directory it traverses to
+   * `dir_entries`, so the sender can transmit trailing STATUS_DIR_TIMES
+   * frame(s) and the receiver can apply directory mtimes AFTER all children
+   * are written.  `dir_entries_mutex` (optional) guards the list
+   * for the parallel scanner's shared worker threads; the caller owns both.
+   * The --dirs generator does not use this (its directory entries carry their
+   * metadata inline through STATUS_MKDIR). */
+  bool capture_dir_times;
+  ArrayList* dir_entries;
+  mtx_t* dir_entries_mutex;
 } ScannerOptions;
 
 /* Internal per-scanner filter state. FilterNode chains represent the ordered
@@ -165,6 +183,12 @@ typedef struct {
   /* --hard-links (-H): shared link-group detection table (see ScannerOptions).
      NULL when -H is off. */
   HardLinkTable* hardlinks;
+  /* Phase 6: sender stop deadline (from ScannerOptions). */
+  const StopCondition* stop_condition;
+  /* P7 Wave D directory-time capture (see ScannerOptions). */
+  bool capture_dir_times;
+  ArrayList* dir_entries;
+  mtx_t* dir_entries_mutex;
 } DirectoryScanner;
 
 typedef struct {

src/client/usage.c

@@ -17,12 +17,14 @@ void print_usage(void) {
   printf("  /local/path         TCP transport (requires server on localhost:8080)\n");
   printf("\n");
   printf("Options:\n");
-  printf("  -c [level]          Enable compression (level 1-22, default 5)\n");
-  printf("  -z [level]          Alias for -c\n");
-  printf("  -a, --archive       Archive mode (-c -m -M)\n");
+  printf("  -c, --checksum      Verify content by checksum instead of size+mtime\n");
+  printf("  -z, --compress [level]  Enable compression (level 1-22, default 5)\n");
+  printf("  -a, --archive       rsync archive mode (-rlptgoD): links, metadata,\n");
+  printf("                      devices and specials (not compression/multithreading)\n");
   printf("  -n, --dry-run       Show what would be transferred\n");
   printf("  --remove-source-files  Remove regular source files after successful transfer\n");
-  printf("  -p <port>           SSH port (default: 22)\n");
+  printf("  -p, --perms         Preserve permission bits (part of the metadata bundle)\n");
+  printf("  --ssh-port <port>   SSH port (default: 22)\n");
   printf("  -e, --rsh <command>  Remote shell to launch on the client for the SSH\n");
   printf("                      transport (default: ssh).  The command may include\n");
   printf("                      arguments, e.g. -e \"ssh -p 2222\"\n");
@@ -35,6 +37,22 @@ void print_usage(void) {
   printf("  --progress          Show transfer progress\n");
   printf("  -P                  Partial mode with progress (retention incomplete)\n");
   printf("  -8, --8-bit-output  Leave high-bit characters unescaped in output\n");
+  printf("  --iconv=LOCAL[,REMOTE]  Convert file-NAME charsets at the wire boundary:\n");
+  printf("                      LOCAL is the charset of our file names, REMOTE is the\n");
+  printf("                      remote side's charset (defaults to LOCAL).  Names are\n");
+  printf("                      converted before transmission and back on receipt; a\n");
+  printf("                      name that cannot be represented in the target charset\n");
+  printf("                      fails that transfer cleanly (rsync-compatible)\n");
+  printf("  --protocol=NUM       Force the wire protocol version (must equal the current\n");
+  printf("                       PROTOCOL_VERSION; FastSync cannot speak older/virtual\n");
+  printf("                       wire formats)\n");
+  printf("  --write-batch=FILE    Run the normal live transfer AND also emit a\n");
+  printf("                       self-contained batch file of the whole source tree\n");
+  printf("                       (implies the single-threaded transfer path)\n");
+  printf("  --only-write-batch=FILE\n");
+  printf("                       Emit the batch file only (no destination, no server)\n");
+  printf("  --read-batch=FILE     Apply the batch file to the destination (no source, no\n");
+  printf("                       server); takes only the destination as an argument\n");
   printf("  --delete            Delete files on receiver not in source\n");
   printf("                      (default timing: delete only after the whole\n");
   printf("                      transfer has succeeded)\n");
@@ -64,9 +82,8 @@ void print_usage(void) {
   printf("                      entry's destination mirror receiver-side.  Independent of\n");
   printf("                      --delete (it does not imply --delete; a non-empty directory\n");
   printf("                      mirror is removed only with --force or --delete)\n");
-  printf("  --prune-empty-dirs  Do not transfer empty directory entries (--dirs mode);\n");
-  printf("                      recursive transfers never send empty dirs.  rsync's -m\n");
-  printf("                      short form stays FastSync multithreading\n");
+  printf("  -m, --prune-empty-dirs  Do not transfer empty directory entries (--dirs mode);\n");
+  printf("                      recursive transfers never send empty dirs\n");
   printf("  Note: each timing flag implies --delete.  Combining a timing flag with\n");
   printf("  --no-delete (in either order) is rejected as a config error.\n");
   printf("  --ignore-existing  Skip files that already exist on receiver\n");
@@ -89,8 +106,8 @@ void print_usage(void) {
   printf("  --files-from <file> Read the source file list from FILE (paths relative to the "
          "source root)\n");
   printf("  -0, --from0       Entries in --files-from are NUL-delimited\n");
-  printf("  --filter=RULE     rsync-style filter rule (+/- include/exclude; repeatable; the\n");
-  printf("                    rsync -f short form conflicts with FastSync sendfile -f)\n");
+  printf("  -f, --filter=RULE rsync-style filter rule (+/- include/exclude; repeatable;\n");
+  printf("                  both --filter=RULE and the -f RULE / -f=RULE short forms work)\n");
   printf("  -C, --cvs-exclude Auto-ignore common CVS/SCM files (.git/, .svn/, *.o, *~, ...)\n");
   printf("  -F                Apply per-directory .rsync-filter files during the scan\n");
   printf("  --max-size <n>      Skip files larger than n bytes\n");
@@ -123,14 +140,15 @@ void print_usage(void) {
   printf("                    --incremental and --delta; inert with --whole-file,\n");
   printf("                    --no-delta, or --no-incremental)\n");
   printf("  --no-fuzzy          Disable --fuzzy\n");
-  printf("  --delta-block <n>   Delta block size in bytes (default: %d)\n",
-         DELTA_BLOCK_SIZE_DEFAULT);
+  printf("  --delta-block <n>, --block-size <n>\n");
+  printf("                    Delta block size in bytes (default: %d)\n", DELTA_BLOCK_SIZE_DEFAULT);
   printf("  --delta-max <n>     Max file size for delta transfer (default: %llu)\n",
          DELTA_MAX_FILE_SIZE);
-  printf("  -m                  Enable multithreading\n");
-  printf("  -s                  Enable chunk serialization\n");
-  printf("  --secluded-args    Accept rsync compatibility option (no effect)\n");
-  printf("  -f                  Enable sendfile (TCP only, not with -c or -s)\n");
+  printf("  -j, --threads       Enable multithreading\n");
+  printf("  --chunk-serialization  Enable chunk serialization (long form only)\n");
+  printf("  -s, --secluded-args    Protect-args compatibility option (no effect; remote\n");
+  printf("                      SSH argv is already built injection-safe)\n");
+  printf("  --sendfile          Enable sendfile zero-copy (TCP only; long form only)\n");
   printf("  --compress-choice <alg>  Compression algorithm (default: zstd)\n");
   printf("  --zc <alg>          Alias for --compress-choice\n");
   printf("  -v, --verbose       Enable debug logging\n");
@@ -138,7 +156,7 @@ void print_usage(void) {
   printf("  --debug=FLAGS       Fine-grained debug logging (use --debug=help for flags)\n");
   printf("  --info=FLAGS        Fine-grained info: copy,misc,skip,stats,all,none\n");
   printf("                      none suppresses info even with --verbose\n");
-  printf("  -M, --preserve      Preserve file metadata\n");
+  printf("  --preserve          Preserve file metadata (long form only)\n");
   printf("  -E, --executability Preserve executable permission bits\n");
   printf("  -X, --xattrs        Preserve user extended attributes (user.* only;\n");
   printf("                      privileged security.*/trusted.* namespaces are\n");
@@ -147,9 +165,17 @@ void print_usage(void) {
   printf("                      setting an ACL the receiver is not permitted to\n");
   printf("                      set is warned and skipped, never fatal)\n");
   printf("  --fake-super        Store the source uid/gid/mode/mtime in a reserved\n");
-  printf("                      user.fastsync.stat xattr on each written file instead\n");
-  printf("                      of applying ownership (for a later privileged restore);\n");
-  printf("                      partial: full rsync fake-super replay is out of scope\n");
+  printf("                      user.fastsync.stat xattr on each written file and\n");
+  printf("                      re-apply it (fd-relative) on a privileged run; the\n");
+  printf("                      recording format diverges from rsync's user.rsync.%%stat%%\n");
+  printf("  --super             Permit the receiver to attempt super-user activities\n");
+  printf("                      (char/block device-node creation, --write-devices)\n");
+  printf("                      within the confined receive root.  Never elevates\n");
+  printf("                      privileges and never bypasses confinement; ownership\n");
+  printf("                      is still applied only with an explicit identity flag\n");
+  printf("                      (--numeric-ids/--chown/--usermap/--groupmap/--copy-as)\n");
+  printf("  --no-super          Forbid those super-user activities even when the\n");
+  printf("                      receiver is running as root\n");
   printf("  --chmod <changes>   Modify transferred permissions (rsync syntax)\n");
   printf("  --numeric-ids       Do not map uid/gid by name: use the source numeric\n");
   printf("                      ids directly when applying ownership\n");
@@ -162,8 +188,15 @@ void print_usage(void) {
   printf("                      USER:GROUP, USER (owner only), :GROUP (group only); a\n");
   printf("                      value of * means the current/root user as appropriate.\n");
   printf("                      Names resolve on the source machine; @N for numerics.\n");
-  printf("                      Note: -M is already FastSync's preserve flag; these use\n");
-  printf("                      long forms only.\n");
+  printf("                      (Metadata is enabled with --preserve; -M now means\n");
+  printf("                      rsync's --remote-option.)\n");
+  printf("  --copy-as=USER[:GROUP]  Force every written entry (files, dirs, symlinks\n");
+  printf("                      and special nodes) to USER[:GROUP], resolved on the\n");
+  printf("                      source machine like --chown.  Requires a privileged\n");
+  printf("                      (root) receiver and implies --preserve; an\n");
+  printf("                      unprivileged receiver refuses the transfer.  Never\n");
+  printf("                      switches process credentials (safe-subset; see\n");
+  printf("                      RSYNC_COMPAT.md).  A daemon refuses it.\n");
   printf("  --chunk-size <n>    Chunk size in bytes (default: %d)\n", DEFAULT_CHUNK_SIZE);
   printf("  --source-dir <path> Source directory\n");
   printf("  --dest-dir <path>   Destination directory\n");
@@ -181,9 +214,15 @@ void print_usage(void) {
   printf("  --cert <path>       TLS certificate file (PEM)\n");
   printf("  --key <path>        TLS private key file (PEM)\n");
   printf("  --ca <path>         TLS CA certificate file (PEM)\n");
-  printf("  --timeout <sec>     I/O timeout in seconds (default: 30)\n");
-  printf("  -T <sec>            Alias for --timeout\n");
+  printf("  --timeout <sec>     I/O timeout in seconds (default: 30; long form only)\n");
   printf("  --contimeout <sec>  Connection timeout in seconds (default: 10)\n");
+  printf("  --stop-after=MINS   Stop the transfer after MINS minutes (a positive\n");
+  printf("                      integer); whatever was already transferred is kept\n");
+  printf("  --stop-at=TIME      Stop at an absolute time: HH:MM, HH:MM:SS, or\n");
+  printf("                      now+N[smhd] (a time already in the past stops the\n");
+  printf("                      transfer immediately; client-only).  An early stop\n");
+  printf("                      skips the late --delete keep-set so it cannot delete\n");
+  printf("                      source mirrors that were not yet scanned\n");
   printf("  --address <ip>      Bind the outgoing client socket to this source address\n");
   printf("  -4, --ipv4          Force IPv4 for destination resolution\n");
   printf("  -6, --ipv6          Force IPv6 for destination resolution\n");
@@ -204,17 +243,15 @@ void print_usage(void) {
   printf("  --stderr=MODE       Route logging to stderr: errors or all\n");
   printf("  --partial           Keep partial files on interrupted transfer\n");
   printf("  --partial-dir <dir> Directory for partial files\n");
-  printf("  --temp-dir <dir>    Scratch dir for temp files before atomic install\n");
+  printf("  -T, --temp-dir <dir>  Scratch dir for temp files before atomic install\n");
   printf("  --fastsync-server-path <path>\n");
   printf("                      Path to fastsync-server on remote (default: fastsync-server)\n");
-  printf(
-      "  --old-args          Disable safe SSH command argument quoting (legacy compatibility)\n");
-  printf("  --remote-option=OPT  Append OPT to the REMOTE server invocation over SSH\n");
+  printf("  --old-args          Accepted for rsync CLI compatibility; no effect (the\n");
+  printf("                      remote server path is always safely quoted now)\n");
+  printf("  -M, --remote-option=OPT  Append OPT to the REMOTE server invocation over SSH\n");
   printf("                      (repeatable; each value is single-quote-escaped on the remote\n");
   printf("                      command line; empty values and values with control characters\n");
-  printf("                      are rejected).  Long form only: rsync's -M short form is NOT\n");
-  printf("                      available because -M already means metadata preservation in\n");
-  printf("                      FastSync (documented divergence)\n");
+  printf("                      are rejected; -M OPT, -M=OPT and --remote-option=OPT work)\n");
   printf("  --trust-sender      Trust the remote sender's file list: the receiver skips its\n");
   printf("                      own up-front path-traversal/containment re-validation of the\n");
   printf("                      incoming file list (fewer checks, faster, potentially unsafe).\n");

src/server/receiver.c

@@ -1,5 +1,6 @@
 #include "receiver.h"
 
+#include "charset.h"
 #include "chunk.h"
 #include "config.h"
 #include "delay_updates.h"
@@ -73,13 +74,32 @@ static bool receiver_process_chunk(Chunk* chunk, const ReceiverSink* sink) {
   return true;
 }
 
+/* P7 Wave D: read one STATUS_DIR_TIMES frame (a count followed by that many
+ * (path, metadata) directory entries) and route every entry through the regular
+ * store_file sink.  A dir-time entry is RECORD-ONLY (file->dir_time_only): the
+ * sink accumulates its metadata for end-of-transfer application but creates
+ * nothing, so an empty/pruned source directory is never resurrected.  A large
+ * tree arrives as repeated frames, each bounded by MAX_MANIFEST_ENTRIES; a
+ * malformed count or entry is a hard error. */
+static bool receiver_process_dir_times(int fd, const Config* config, const ReceiverSink* sink) {
+  int count;
+  if (!receive_int(fd, &count) || count < 0 || count > MAX_MANIFEST_ENTRIES)
+    return false;
+  for (int i = 0; i < count; i++) {
+    File* dir = file_receive_dir_time(fd, config);
+    if (!dir || !sink->store_file(dir, sink->context))
+      return false;
+  }
+  return true;
+}
+
 static bool receiver_process_batch(Config* config, int file_descriptor) {
   int count;
   if (config->checksum || !receive_int(file_descriptor, &count) || count < 0 ||
       count > MAX_MANIFEST_ENTRIES)
     return false;
   for (int i = 0; i < count; i++) {
-    char* check_path = receive_str(file_descriptor);
+    char* check_path = receive_wire_str(file_descriptor);
     if (!check_path)
       return false;
     unsigned long long check_size;
@@ -160,7 +180,7 @@ int receiver_process_pending(Config* config, int file_descriptor, const Receiver
   while (status == STATUS_NEXT || status == STATUS_CHUNK || status == STATUS_CHECK ||
          status == STATUS_KEEPALIVE || status == STATUS_ABORT || status == STATUS_CHECK_BATCH ||
          status == STATUS_MKDIR || status == STATUS_MANIFEST || status == STATUS_HARDLINK ||
-         status == STATUS_SYMLINK || status == STATUS_SPECIAL) {
+         status == STATUS_SYMLINK || status == STATUS_SPECIAL || status == STATUS_DIR_TIMES) {
     if (status == STATUS_KEEPALIVE) {
       if (!send_status(file_descriptor, STATUS_KEEPALIVE))
         goto fail;
@@ -184,9 +204,12 @@ int receiver_process_pending(Config* config, int file_descriptor, const Receiver
         goto fail;
       goto next_status;
     } else if (status == STATUS_MKDIR) {
-      File* dir = file_receive_directory(file_descriptor);
+      File* dir = file_receive_directory(file_descriptor, config);
       if (!dir || !sink->store_file(dir, sink->context))
         goto receive_error;
+    } else if (status == STATUS_DIR_TIMES) {
+      if (!receiver_process_dir_times(file_descriptor, config, sink))
+        goto receive_error;
     } else if (status == STATUS_HARDLINK) {
       File* file = file_receive_hardlink(file_descriptor);
       if (!file || !sink->store_file(file, sink->context))
@@ -310,6 +333,10 @@ receive_error:
 typedef struct {
   Config* config;
   ReceiverOutcomes outcomes;
+  /* P7 Wave D: directory metadata accumulated during the stream, applied only
+     after the whole transfer (and its delete/publication phases) has run so a
+     child write never clobbers a directory mtime. */
+  DirTimeList dir_times;
 } ReceiverSaveContext;
 
 static bool receiver_save_file(File* file, void* context_pointer) {
@@ -322,6 +349,15 @@ static bool receiver_save_file(File* file, void* context_pointer) {
   } else {
     result = file_save_to_disk_full(context->config->receive_root_directory, file, context->config);
   }
+  /* A directory's times are deferred, never applied inline: collect the
+     metadata now and apply it at the end.  -O/--omit-dir-times is honored by
+     dir_time_list_apply's caller (see receiver_send_success_frame). */
+  if (result != FILE_SAVE_ERROR && file->is_dir && file->metadata &&
+      context->config->use_metadata && !context->config->omit_dir_times &&
+      !dir_time_list_add(&context->dir_times, file->path, file->metadata)) {
+    file_destroy(file);
+    return false;
+  }
   if (result != FILE_SAVE_ERROR && context->config->remove_source_files && !file->is_dir &&
       !file->is_special && !file->skip &&
       !receiver_outcomes_append(&context->outcomes, (unsigned char)result)) {
@@ -345,15 +381,22 @@ static bool receiver_send_success_frame(int fd, void* context_pointer) {
       return false;
     }
   }
+  /* P7 Wave D: every child is now written and the delete / --delay-updates
+     phases have committed, so it is finally safe to stamp directory times.
+     This runs after the deferred deletion because receiver_process commits it
+     before calling this success frame. */
+  dir_time_list_apply(&context->dir_times, context->config->receive_root_directory);
   return receiver_send_final_success(fd, context->config, &context->outcomes);
 }
 
 int receiver_receive_files(Config* config, int file_descriptor) {
   ReceiverSaveContext context = {.config = config, .outcomes = {0}};
+  dir_time_list_init(&context.dir_times);
   ReceiverSink sink = {receiver_save_file, &context, true, true, receiver_send_success_frame};
   int ret = receiver_process(config, file_descriptor, &sink);
   if (ret != 0 && config->delay_updates && config->delay_context)
     delay_updates_cleanup(config->delay_context);
   receiver_outcomes_destroy(&context.outcomes);
+  dir_time_list_free(&context.dir_times);
   return ret;
 }

src/server/server.c

@@ -1,4 +1,5 @@
 #include "config.h"
+#include "charset.h"
 #include "credentials.h"
 #include "daemon_conf.h"
 #include "delay_updates.h"
@@ -30,7 +31,15 @@ static int authorized_root_fd = -1;
 static bool allow_delete;
 static bool trust_sender;
 static bool allow_unauthenticated;
+/* --no-super operator veto: forces SUPER_MODE_OFF for every connection (even
+ * root), so no super-user activity is attempted and any client --copy-as is
+ * refused.  Set once in main before the accept loop / stdio handler. */
+static bool server_no_super;
 static const char* required_client_cn;
+/* --iconv CONVERT_SPEC the server was itself started with (borrowed argv
+ * pointer).  Its LOCAL half may override the local charset the client assumed;
+ * see charset_wire_init_receiver. */
+static const char* server_iconv_spec;
 
 /* Non-NULL exactly when the listener runs in --daemon mode.  Loaded once in
  * main before any accept-loop fork, then shared read-only by every forked
@@ -46,11 +55,105 @@ static CredentialStore* g_credentials = NULL;
 
 /* Opaque context threaded through to the config-frame gate: the connection's
  * SSL object (NULL over plaintext) so the gate can warn when a credential
- * exchange is not encrypted. */
+ * exchange is not encrypted, plus the super-mode override the gate decides on.
+ * The gate never mutates the received (const) Config; it records a forced
+ * SUPER_MODE_OFF here and the handler applies it exactly once after acceptance. */
 typedef struct ModuleGateContext {
   SSL* ssl;
+  /* The connection descriptor, so the gate can drive the SCRAM auth handshake
+   * while it still owns the config-frame exchange (before the STATUS_OK ack). */
+  int fd;
+  /* SUPER_MODE_OFF when this connection must not attempt any super-user
+     activity (operator --no-super, or a daemon module without the
+     `client owner = yes` opt-in); -1 when the config's own mode stands. */
+  int super_mode_override;
 } ModuleGateContext;
 
+/* Server half of the SCRAM challenge/response (A7 remediation, protocol
+ * 2.19.0).  Sends STATUS_AUTH_CHALLENGE (iteration count, base64 salt, base64
+ * server nonce), expects STATUS_AUTH_RESPONSE (base64 client nonce, base64
+ * ClientProof), verifies the proof constant-time and answers STATUS_AUTH_OK
+ * with the base64 ServerSignature.  On any failure BEFORE the success response
+ * it sends exactly one generic STATUS_AUTH_FAILED and returns false; a failure
+ * while writing the success signature cannot send a status and just drops an
+ * already-broken connection.  The verifier for an unknown/off-list
+ * user is a dummy (deterministic per-username salt, store-wide iterations, dummy
+ * keys, found=false) so the same math runs and no user-enumeration/timing oracle
+ * is exposed. */
+static bool server_auth_handshake(int fd, const Config* config, const DaemonModule* module) {
+  bool result = false;
+  CredentialVerifier verifier;
+  memset(&verifier, 0, sizeof(verifier));
+  uint8_t snonce[CREDENTIAL_NONCE_LEN] = {0};
+  char salt_b64[25] = {0};
+  char snonce_b64[45] = {0};
+  char* cnonce_b64 = NULL;
+  char* proof_b64 = NULL;
+  uint8_t cnonce[CREDENTIAL_NONCE_LEN] = {0};
+  uint8_t proof[CREDENTIAL_KEY_LEN] = {0};
+  uint8_t server_sig[CREDENTIAL_KEY_LEN] = {0};
+  char sig_b64[45] = {0};
+  size_t cnonce_len = 0;
+  size_t proof_len = 0;
+
+  if (!config->auth_user)
+    goto fail; /* no username: generic failure, no challenge */
+  if (!credentials_get_verifier(g_credentials, config->auth_user,
+                                (const char* const*)module->auth_users, module->auth_user_count,
+                                &verifier))
+    goto fail; /* a crypto failure still owes the gate a terminal frame */
+  if (!(credentials_random_bytes(snonce, sizeof(snonce)) &&
+        credentials_b64_encode(verifier.salt, CREDENTIAL_SALT_LEN, salt_b64, sizeof(salt_b64)) &&
+        credentials_b64_encode(snonce, sizeof(snonce), snonce_b64, sizeof(snonce_b64))))
+    goto fail;
+  if (!(send_status(fd, STATUS_AUTH_CHALLENGE) && send_int(fd, (int)verifier.iters) &&
+        send_str(fd, salt_b64) && send_str(fd, snonce_b64)))
+    goto fail;
+
+  Status status = STATUS_ERROR;
+  if (!(receive_status(fd, &status) && status == STATUS_AUTH_RESPONSE))
+    goto fail;
+  cnonce_b64 = receive_str_redacted(fd);
+  proof_b64 = receive_str_redacted(fd);
+  if (!(cnonce_b64 && proof_b64 &&
+        credentials_b64_decode(cnonce_b64, cnonce, sizeof(cnonce), &cnonce_len) &&
+        cnonce_len == CREDENTIAL_NONCE_LEN &&
+        credentials_b64_decode(proof_b64, proof, sizeof(proof), &proof_len) &&
+        proof_len == CREDENTIAL_KEY_LEN))
+    goto fail;
+  if (!credentials_verify_response(&verifier, config->auth_user, snonce, cnonce, proof, server_sig))
+    goto fail;
+
+  /* Success writes exactly one terminal frame (STATUS_AUTH_OK).  A broken pipe
+   * while sending the signature just drops the connection; it must never emit a
+   * second terminal status. */
+  result = credentials_b64_encode(server_sig, sizeof(server_sig), sig_b64, sizeof(sig_b64)) &&
+           send_status(fd, STATUS_AUTH_OK) && send_str_redacted(fd, sig_b64);
+  goto cleanup;
+
+fail:
+  /* Every failure path writes exactly one generic terminal status, satisfying
+   * the gate's CONFIG_VALIDATE_ALREADY_TERMINATED contract. */
+  send_status(fd, STATUS_AUTH_FAILED);
+
+cleanup:
+  credentials_burn(cnonce_b64, cnonce_b64 ? strlen(cnonce_b64) : 0);
+  credentials_burn(proof_b64, proof_b64 ? strlen(proof_b64) : 0);
+  free(cnonce_b64);
+  free(proof_b64);
+  credentials_burn((char*)snonce, sizeof(snonce));
+  credentials_burn(salt_b64, sizeof(salt_b64));
+  credentials_burn(snonce_b64, sizeof(snonce_b64));
+  credentials_burn((char*)cnonce, sizeof(cnonce));
+  credentials_burn((char*)proof, sizeof(proof));
+  credentials_burn((char*)server_sig, sizeof(server_sig));
+  credentials_burn(sig_b64, sizeof(sig_b64));
+  credentials_burn((char*)verifier.salt, sizeof(verifier.salt));
+  credentials_burn((char*)verifier.stored_key, sizeof(verifier.stored_key));
+  credentials_burn((char*)verifier.server_key, sizeof(verifier.server_key));
+  return result;
+}
+
 /* Aggregate payload bytes the multithreaded receiver may buffer ahead of the
    slow disk writer.  Receiving one more chunk adds up to ~2 * MAX_CHUNK_SIZE
    of transient wire/decompression buffers on top of the queued payloads, so
@@ -70,7 +173,7 @@ static bool tls_client_identity_allowed(SSL* ssl) {
   size_t required_length = strlen(required_client_cn);
   bool allowed = length >= 0 && (size_t)length == required_length &&
                  required_length < sizeof(common_name) &&
-                 memcmp(common_name, required_client_cn, required_length) == 0;
+                 credentials_secure_equal(common_name, required_client_cn, required_length);
   X509_free(certificate);
   return allowed;
 }
@@ -163,13 +266,51 @@ static bool configure_authorization(const char* root) {
  * --destination-root, but per-module and NEVER client-chosen.  The module is
  * refused (with a clear log) when it is unknown, when it is `read only` (every
  * FastSync network transfer writes; there is no read-only wire operation yet),
- * or when the presented daemon credentials fail for a module that declares
- * `auth users`.  Wave A refused every auth-required module (auth was not yet
- * implemented); Wave B authenticates the client instead (see below). */
+ * when it requests client-chosen ownership without the module's
+ * `client owner = yes` opt-in (P7 Wave E hardening), or when the presented
+ * daemon credentials fail for a module that declares `auth users`.  Wave A
+ * refused every auth-required module (auth was not yet implemented); Wave B
+ * authenticates the client instead (see below). */
 static const char* server_module_gate(const Config* config, void* context) {
   ModuleGateContext* gate_ctx = (ModuleGateContext*)context;
   if (!config)
     return "missing config frame";
+  /* Operator veto: --no-super forces SUPER_MODE_OFF for this connection before
+     the copy-as gate is evaluated.  The received config is const, so the gates
+     below evaluate a shallow effective copy (only super_mode differs); the
+     handler applies the recorded override to the accepted config exactly once. */
+  Config effective = *config;
+  if (server_no_super) {
+    effective.super_mode = SUPER_MODE_OFF;
+    if (gate_ctx)
+      gate_ctx->super_mode_override = SUPER_MODE_OFF;
+  }
+  /* --copy-as (P7 Wave E, protocol 2.18.0): FastSync's safe subset forces the
+     ownership of every written entry to the requested ids, which needs a
+     privileged (root) receiver.  An unprivileged receiver REFUSES the whole
+     transfer here, at the config handshake and BEFORE the STATUS_OK ack, so no
+     file data is exchanged and there is never a silent wrong-ownership result.
+     The daemon's per-module client-chosen-ownership refusal is enforced after
+     the module lookup below (it needs the module's opt-in) and covers --copy-as
+     like every other ownership flag. */
+  if (identity_copy_as_refused(&effective)) {
+    if (geteuid() != 0)
+      log_message(LOG_LEVEL_ERROR, "--copy-as requires a privileged receiver (root); refusing");
+    else
+      log_message(LOG_LEVEL_ERROR,
+                  "--copy-as refused: super-user activities are disabled by the server "
+                  "(--no-super); refusing");
+    return "cannot perform --copy-as on this receiver";
+  }
+  /* --iconv (protocol 2.16.0): the receiver's exact conversion direction (the
+     client spec's wire charset into this server's local charset, including a
+     server-side --iconv override) must be usable BEFORE the STATUS_OK ack, so
+     an impossible conversion is refused at the handshake instead of failing
+     the first file mid-transfer.  The client spec itself was already sanity
+     checked by validate_received_config. */
+  if (config->iconv_spec &&
+      !charset_wire_receiver_spec_valid(config->iconv_spec, server_iconv_spec))
+    return "client --iconv conversion cannot be honored by this server";
   bool is_daemon = g_daemon_conf != NULL;
   bool has_module = config->module != NULL && config->module[0] != '\0';
 
@@ -196,11 +337,43 @@ static const char* server_module_gate(const Config* config, void* context) {
                 config->module);
     return "requested daemon module is read only";
   }
+  /* Client-chosen ownership / super-user policy (P7 Wave E hardening): a daemon
+     module refuses EVERY ownership-affecting request (--numeric-ids, --chown,
+     --usermap/--groupmap, --fake-super, --copy-as, explicit --super) unless the
+     operator opted THIS module in with `client owner = yes`.  Otherwise any
+     client could force arbitrary ownership inside the module root.  The
+     standalone/SSH server has a single operator-authorized root and keeps
+     honoring these. */
+  if (!module->client_owner) {
+    /* Ownership: refuse the whole transfer up front (a clear failure).
+       Evaluated against the ORIGINAL config so an explicit --super is refused
+       even when an operator --no-super veto already forced the effective copy
+       to OFF (the veto must not silently convert a refusal into an accept). */
+    if (identity_ownership_requested(config)) {
+      log_message(LOG_LEVEL_ERROR,
+                  "daemon module '%s' refuses client-chosen ownership/super-user activities "
+                  "(no `client owner = yes` opt-in); refusing",
+                  config->module);
+      return "client-chosen ownership is not permitted by this daemon module";
+    }
+    /* Super-user DEVICE activities (char/block mknod and --write-devices) are
+       permitted under the default AUTO mode, so without this override a root
+       daemon would still let a non-opted module create arbitrary device nodes
+       and write raw devices.  Force them off for this connection: those entries
+       are skipped (never mknod'ed) while an ordinary `-a` push still succeeds
+       without device nodes, matching the operator's least-privilege choice.
+       The operator-level --no-super veto is already folded into this. */
+    if (gate_ctx)
+      gate_ctx->super_mode_override = SUPER_MODE_OFF;
+  }
   if (module->auth_user_count > 0) {
-    /* Auth-required module (Wave B): verify the presented credentials against
-     * the store BEFORE the module root is installed and before any data moves.
-     * Fail closed: no store -> refuse; no/invalid credentials -> refuse.  The
-     * username may be logged (never the digest/password). */
+    /* Auth-required module (A7, protocol 2.19.0): run the SCRAM challenge/
+     * response BEFORE the module root is installed and before any data moves.
+     * Fail closed: no store -> refuse (server misconfiguration, STATUS_ERROR);
+     * a handshake that fails before the success response writes exactly one
+     * STATUS_AUTH_FAILED before signalling ALREADY_TERMINATED (a failure while
+     * writing the success signature instead just drops the broken connection).
+     * The username may be logged (never the password or any derived proof). */
     if (g_credentials == NULL) {
       log_message(LOG_LEVEL_ERROR,
                   "daemon module '%s' requires authentication but no credential store is "
@@ -209,28 +382,46 @@ static const char* server_module_gate(const Config* config, void* context) {
       return "requested daemon module requires authentication and no credential "
              "store is configured";
     }
-    if (!config->auth_user || !config->auth_password_hash) {
+    /* Transport policy (A7-3/S1): an auth-required module only accepts
+     * credentials over (a) an encrypted, verified TLS connection whose client
+     * certificate matches --client-cn, or (b) an actual PLAINTEXT connection
+     * from a loopback peer that the operator explicitly opted into with
+     * --allow-unauthenticated.  A remote plaintext peer, an un-flagged loopback
+     * plaintext peer, and a loopback TLS peer whose certificate does not match
+     * --client-cn are all refused HERE, before the challenge is sent, so an
+     * unverified client never receives a nonce: the loopback allowance requires
+     * !gate_ctx->ssl, so --tls + --allow-unauthenticated can never be used to
+     * bypass the client-CN check.  The operator flag never permits REMOTE
+     * plaintext auth: remote peers still require verified TLS regardless. */
+    bool tls_ok = gate_ctx && gate_ctx->ssl && SSL_get_verify_result(gate_ctx->ssl) == X509_V_OK &&
+                  tls_client_identity_allowed(gate_ctx->ssl);
+    bool local_ok = allow_unauthenticated && gate_ctx && !gate_ctx->ssl && gate_ctx->fd >= 0 &&
+                    utils_fd_peer_is_local(gate_ctx->fd);
+    if (!tls_ok && !local_ok) {
       log_message(LOG_LEVEL_ERROR,
-                  "daemon module '%s' requires authentication; the client "
-                  "presented no credentials",
+                  "daemon module '%s' requires authentication over an encrypted, verified TLS "
+                  "connection (or an opted-in loopback plaintext transport); refusing",
                   config->module);
-      return "requested daemon module requires authentication";
+      return "daemon module requires authentication over an encrypted, verified TLS "
+             "connection";
     }
-    if (gate_ctx && !gate_ctx->ssl) {
-      log_message(LOG_LEVEL_WARNING,
-                  "daemon module '%s' is authenticating over a plaintext connection (no --tls); "
-                  "the credential exchange is not encrypted",
+    /* Belt-and-braces: the transport policy above already guarantees a context
+     * with a usable socket (verified TLS implies a live SSL object and loopback
+     * allowance requires gate_ctx->fd >= 0), so this is unreachable today; keep
+     * the guard so the handshake can never be driven over an invalid fd. */
+    if (!gate_ctx || gate_ctx->fd < 0) {
+      log_message(LOG_LEVEL_ERROR, "daemon module '%s': no auth transport available",
                   config->module);
-    }
-    if (!credentials_gate_allows(g_credentials, (const char* const*)module->auth_users,
-                                 module->auth_user_count, config->auth_user,
-                                 config->auth_password_hash)) {
-      char* escaped_user = output_escape(config->auth_user, config->eight_bit_output);
-      log_message(LOG_LEVEL_ERROR, "daemon module '%s': authentication failed for user '%s'",
-                  config->module, escaped_user ? escaped_user : "<allocation failed>");
-      free(escaped_user);
       return "authentication failed for the requested daemon module";
     }
+    if (!server_auth_handshake(gate_ctx->fd, config, module)) {
+      char* escaped_user =
+          config->auth_user ? output_escape(config->auth_user, config->eight_bit_output) : NULL;
+      log_message(LOG_LEVEL_ERROR, "daemon module '%s': authentication failed for user '%s'",
+                  config->module, escaped_user ? escaped_user : "(none)");
+      free(escaped_user);
+      return CONFIG_VALIDATE_ALREADY_TERMINATED;
+    }
     char* escaped_user = output_escape(config->auth_user, config->eight_bit_output);
     log_message(LOG_LEVEL_INFO, "daemon module '%s': user '%s' authenticated", config->module,
                 escaped_user ? escaped_user : "<allocation failed>");
@@ -252,6 +443,8 @@ void handler(int file_descriptor) {
   protocol_session_bind(&session);
   ModuleGateContext gate_ctx;
   gate_ctx.ssl = ssl;
+  gate_ctx.fd = file_descriptor;
+  gate_ctx.super_mode_override = -1;
   Config* config = config_receive_with_validate(file_descriptor, server_module_gate, &gate_ctx);
   if (config == NULL) {
     log_message(LOG_LEVEL_ERROR, "Failed to receive config");
@@ -259,6 +452,13 @@ void handler(int file_descriptor) {
     protocol_session_unbind();
     return;
   }
+  /* Apply the super-mode veto the gate decided on (operator --no-super, or a
+   * daemon module without the `client owner = yes` opt-in) exactly once, so
+   * every downstream gate (identity_apply_ownership via privilege_super_permitted,
+   * device-node creation) sees SUPER_MODE_OFF.  The gate never mutated the
+   * received config. */
+  if (gate_ctx.super_mode_override != -1)
+    config->super_mode = gate_ctx.super_mode_override;
   protocol_set_8_bit_output(config->eight_bit_output);
   if (!authorized_root) {
     log_message(LOG_LEVEL_ERROR, "No server-side destination root configured");
@@ -318,6 +518,20 @@ void handler(int file_descriptor) {
     return;
   }
   config->use_delete = config->use_delete && allow_delete;
+  /* --iconv (protocol 2.16.0): install the receiver-side wire->local conversion
+     now that the client's full CONVERT_SPEC has been received and validated,
+     before any received file name is decoded.  The server's own --iconv (if
+     any) may override the local charset; a spec the client is known to have
+     validated cannot fail here unless the server's override names an
+     unsupported charset. */
+  if (config->iconv_spec && !charset_wire_init_receiver(config->iconv_spec, server_iconv_spec)) {
+    log_message(LOG_LEVEL_ERROR,
+                "--iconv: unsupported charset conversion requested (LOCAL[,REMOTE])");
+    config_delete(config);
+    close(file_descriptor);
+    protocol_session_unbind();
+    return;
+  }
   /* --delete-missing-args deletes destination mirrors receiver-side, so it is
      deletion and stays gated by the same --allow-delete server policy.  When
      the server policy is off the flag is inert (the missing entries are still
@@ -327,8 +541,10 @@ void handler(int file_descriptor) {
      before anything else; without it the root must pre-exist.  A failure here
      aborts the connection cleanly before any file data is exchanged. */
   if (!ensure_receive_root(config)) {
+    char* escaped_root = output_escape(config->receive_root_directory, log_get_8_bit_output());
     log_message(LOG_LEVEL_ERROR, "destination root is not available: %s",
-                config->receive_root_directory);
+                escaped_root ? escaped_root : "<allocation failed>");
+    free(escaped_root);
     config_delete(config);
     close(file_descriptor);
     protocol_session_unbind();
@@ -350,8 +566,16 @@ void handler(int file_descriptor) {
   }
   /* Preserve the negotiated identity policy for the fd-relative ownership
      apply path.  Each connection is its own forked process, so this
-     per-process snapshot never races another connection. */
-  identity_set_active(config);
+     per-process snapshot never races another connection.  A failed deep copy
+     (allocation failure) leaves the snapshot cleared, so refuse the connection
+     rather than silently applying the wrong ownership policy. */
+  if (!identity_set_active(config)) {
+    log_message(LOG_LEVEL_ERROR, "Failed to activate identity policy");
+    config_delete(config);
+    close(file_descriptor);
+    protocol_session_unbind();
+    return;
+  }
   /* Persist the negotiated --keep-dirlinks policy once, here at config-accept,
      before any multithreaded receiver/writer threads are spawned, so the
      fd-walk reads a stable value during the whole transfer (and never bleeds
@@ -395,6 +619,7 @@ void handler(int file_descriptor) {
       config_delete(config);
       close(file_descriptor);
       protocol_session_unbind();
+      identity_clear_active();
       return;
     }
     PipelineContextReceiver* context =
@@ -465,6 +690,12 @@ void handler(int file_descriptor) {
           !delay_updates_publish(config->delay_context, config)) {
         transfer_ok = false;
       }
+      /* P7 Wave D: all writers have joined and the late deletion (and
+         --delay-updates publication) has committed above, so it is finally safe
+         to stamp directory times; a directory's mtime must not be clobbered by
+         its children or by an extra removal. */
+      if (transfer_ok)
+        dir_time_list_apply(&context->dir_times, config->receive_root_directory);
     }
     if (transfer_ok) {
       if (!receiver_send_final_success(file_descriptor, config, &context->outcomes))
@@ -485,6 +716,7 @@ void handler(int file_descriptor) {
   }
   protocol_session_unbind();
   identity_clear_active();
+  charset_wire_free();
   close(file_descriptor);
 }
 
@@ -516,10 +748,12 @@ static void print_server_usage(void) {
   printf("  --no-detach         Stay in the foreground (default detaches to\n");
   printf("                      background when running --daemon)\n");
   printf("  --password-file=FILE  Credential store for modules that declare\n");
-  printf("                      'auth users' (line format: user:SHA256HEX where\n");
-  printf("                      SHA256HEX is the lowercase hex SHA-256 of the\n");
-  printf("                      user's password).  Requires --daemon; an auth-\n");
-  printf("                      required module with no store refuses to start\n");
+  printf("                      'auth users' (line format:\n");
+  printf("                      user:$fastsync$1$pbkdf2-sha256$iters$salt$stored$server,\n");
+  printf("                      generated by --hash-credentials).  Legacy\n");
+  printf("                      user:SHA256HEX lines are rejected.  Requires\n");
+  printf("                      --daemon; an auth-required module with no store\n");
+  printf("                      refuses to start\n");
   printf("  --early-input=FILE  Second credential store layered over\n");
   printf("                      --password-file (same format); usually a secrets-\n");
   printf("                      manager/process-substitution file.  Requires --daemon\n");
@@ -528,14 +762,31 @@ static void print_server_usage(void) {
   printf("  --cert <path>       TLS certificate file (PEM)\n");
   printf("  --key <path>        TLS private key file (PEM)\n");
   printf("  --ca <path>         TLS CA certificate file (PEM)\n");
-  printf("  --client-cn <name>  Required TLS client certificate CN\n");
+  printf("  --client-cn <name>  TLS client certificate CN (mandatory with --tls)\n");
   printf("  --destination-root <path>  Authorized destination root (default: .)\n");
   printf("  --address <addr>    Bind the listening socket to this address\n");
   printf("  -4, --ipv4          Bind an IPv4 socket (default)\n");
   printf("  -6, --ipv6          Bind an IPv6 socket\n");
   printf("  --allow-delete      Permit manifest deletion\n");
   printf("  --trust-sender      Trust the remote sender's file list\n");
+  printf("  --no-super          Operator veto: never attempt super-user activities\n");
+  printf("                      (ownership, device nodes) even as root, and refuse\n");
+  printf("                      any client --copy-as/--super request\n");
+  printf("  --iconv=LOCAL[,REMOTE]  Declare this server's LOCAL charset for file-name\n");
+  printf("                      conversion: received names are translated to this\n");
+  printf("                      charset (the wire charset still comes from the\n");
+  printf("                      client's CONVERT_SPEC).  A name that cannot be\n");
+  printf("                      represented fails the run cleanly\n");
   printf("  --allow-unauthenticated  Allow plaintext/anonymous network clients\n");
+  printf("                      (an auth-required module still accepts only opted-in\n");
+  printf("                      loopback plaintext; remote auth requires verified TLS)\n");
+  printf("  --hash-credentials <file>  Read <file>'s user:password lines and print\n");
+  printf("                      PBKDF2 credential-store lines to stdout, then exit.\n");
+  printf("                      Use the output as --password-file for --daemon;\n");
+  printf("                      redirect it to an owner-only (0600) file\n");
+  printf("  --iterations N      PBKDF2 iteration count for --hash-credentials\n");
+  printf("                      (default %u, range %u-%u)\n", CREDENTIAL_DEFAULT_ITERS,
+         CREDENTIAL_MIN_ITERS, CREDENTIAL_MAX_ITERS);
   printf("  -v, --verbose       Enable debug logging\n");
   printf("  --help              Show this help\n");
 }
@@ -605,6 +856,29 @@ int main(int argc, char* argv[]) {
     return 1;
   }
 
+  /* --hash-credentials: standalone offline tool; read user:password lines and
+   * emit new-format credential-store lines, then exit. */
+  if (opts.hash_credentials_file) {
+    uint32_t iters = opts.hash_iterations_set ? opts.hash_iterations : CREDENTIAL_DEFAULT_ITERS;
+    /* The output is secret material: if it is redirected to a regular file,
+     * warn when that file is group/other-accessible (the store must be 0600). */
+    struct stat out_st;
+    if (fstat(STDOUT_FILENO, &out_st) == 0 && S_ISREG(out_st.st_mode) &&
+        (out_st.st_mode & (S_IRWXG | S_IRWXO)) != 0)
+      fprintf(stderr,
+              "Warning: credential-store output is a group/other-accessible file; restrict it to "
+              "mode 0600 (chmod 600)\n");
+    char hash_err[512];
+    if (credentials_hash_file(opts.hash_credentials_file, iters, stdout, hash_err,
+                              sizeof(hash_err)) != 0) {
+      fprintf(stderr, "Error: %s\n", hash_err);
+      server_cli_options_free(&opts);
+      return 1;
+    }
+    server_cli_options_free(&opts);
+    return 0;
+  }
+
   int exit_code = 0;
   signal(SIGPIPE, SIG_IGN);
   if (opts.verbose) {
@@ -621,6 +895,8 @@ int main(int argc, char* argv[]) {
   allow_delete = opts.allow_delete;
   trust_sender = opts.trust_sender;
   allow_unauthenticated = opts.allow_unauthenticated;
+  server_no_super = opts.no_super;
+  server_iconv_spec = opts.iconv_spec;
   signal(SIGINT, cleanup);
   signal(SIGTERM, cleanup);
 
@@ -669,6 +945,18 @@ int main(int argc, char* argv[]) {
     if (g_daemon_conf->module_count == 0)
       log_message(LOG_LEVEL_WARNING,
                   "daemon config has no modules; every connection will be refused");
+    /* Surface the operator's client-chosen-ownership opt-in prominently: an
+       opted-in module lets its clients request arbitrary owner ids inside that
+       module root. */
+    for (int i = 0; i < g_daemon_conf->module_count; i++) {
+      if (g_daemon_conf->modules[i].client_owner)
+        log_message(LOG_LEVEL_WARNING,
+                    "daemon module '%s' allows client-chosen ownership and super-user device "
+                    "activities (`client owner = yes`); clients may request arbitrary owner ids "
+                    "and device nodes within that module root -- pair it with `auth users` "
+                    "unless the module is intentionally open to the network",
+                    g_daemon_conf->modules[i].name);
+    }
     /* Daemon credential store (Wave B).  --password-file and --early-input
      * feed the same store, loaded BEFORE the listener forks so every
      * connection child shares one read-only store.  Fail closed at startup: a

src/server/server_cli.c

@@ -1,4 +1,6 @@
 #include "server_cli.h"
+#include "charset.h"
+#include "credentials.h"
 #include "utils.h"
 #include <limits.h>
 #include <stdarg.h>
@@ -63,6 +65,7 @@ int server_cli_parse(int argc, char* argv[], ServerCliOptions* opts, char* err,
   server_cli_options_default(opts);
 
   for (int i = 1; i < argc; i++) {
+    const char* inline_value = NULL;
     if (arg_is(argv[i], "--help")) {
       opts->show_help = true;
       return 1;
@@ -107,18 +110,51 @@ int server_cli_parse(int argc, char* argv[], ServerCliOptions* opts, char* err,
       }
       opts->destination_root = argv[++i];
       opts->destination_root_set = true;
-    } else if (arg_is(argv[i], "--password-file")) {
-      if (i + 1 >= argc) {
-        set_error(err, err_size, "missing argument for --password-file");
+    } else if (arg_has_value(argv[i], "--password-file", &inline_value)) {
+      if (!inline_value) {
+        if (i + 1 >= argc) {
+          set_error(err, err_size, "missing argument for --password-file");
+          return -1;
+        }
+        inline_value = argv[++i];
+      }
+      opts->password_file = inline_value;
+    } else if (arg_has_value(argv[i], "--early-input", &inline_value)) {
+      if (!inline_value) {
+        if (i + 1 >= argc) {
+          set_error(err, err_size, "missing argument for --early-input");
+          return -1;
+        }
+        inline_value = argv[++i];
+      }
+      opts->early_input_file = inline_value;
+    } else if (arg_has_value(argv[i], "--hash-credentials", &inline_value)) {
+      if (!inline_value) {
+        if (i + 1 >= argc) {
+          set_error(err, err_size, "missing argument for --hash-credentials");
+          return -1;
+        }
+        inline_value = argv[++i];
+      }
+      opts->hash_credentials_file = inline_value;
+    } else if (arg_has_value(argv[i], "--iterations", &inline_value)) {
+      if (!inline_value) {
+        if (i + 1 >= argc) {
+          set_error(err, err_size, "missing argument for --iterations");
+          return -1;
+        }
+        inline_value = argv[++i];
+      }
+      char* end = NULL;
+      long n = strtol(inline_value, &end, 10);
+      if (!end || *end != '\0' || n < (long)CREDENTIAL_MIN_ITERS ||
+          n > (long)CREDENTIAL_MAX_ITERS) {
+        set_error(err, err_size, "--iterations must be in [%u,%u], got '%s'", CREDENTIAL_MIN_ITERS,
+                  CREDENTIAL_MAX_ITERS, inline_value);
         return -1;
       }
-      opts->password_file = argv[++i];
-    } else if (arg_is(argv[i], "--early-input")) {
-      if (i + 1 >= argc) {
-        set_error(err, err_size, "missing argument for --early-input");
-        return -1;
-      }
-      opts->early_input_file = argv[++i];
+      opts->hash_iterations = (uint32_t)n;
+      opts->hash_iterations_set = true;
     } else if (arg_is(argv[i], "--address")) {
       if (i + 1 >= argc) {
         set_error(err, err_size, "missing argument for --address");
@@ -141,8 +177,19 @@ int server_cli_parse(int argc, char* argv[], ServerCliOptions* opts, char* err,
       opts->allow_delete = true;
     } else if (arg_is(argv[i], "--trust-sender")) {
       opts->trust_sender = true;
+    } else if (arg_is(argv[i], "--no-super")) {
+      opts->no_super = true;
     } else if (arg_is(argv[i], "--allow-unauthenticated")) {
       opts->allow_unauthenticated = true;
+    } else if (arg_has_value(argv[i], "--iconv", &inline_value)) {
+      if (!inline_value) {
+        if (i + 1 >= argc) {
+          set_error(err, err_size, "missing argument for --iconv");
+          return -1;
+        }
+        inline_value = argv[++i];
+      }
+      opts->iconv_spec = inline_value;
     } else if (arg_is(argv[i], "-p")) {
       if (i + 1 >= argc) {
         set_error(err, err_size, "missing argument for -p");
@@ -152,7 +199,6 @@ int server_cli_parse(int argc, char* argv[], ServerCliOptions* opts, char* err,
       if (parse_port_arg(argv[++i], &opts->port, err, err_size) != 0)
         return -1;
     } else {
-      const char* inline_value = NULL;
       if (arg_has_value(argv[i], "--config", &inline_value)) {
         if (!inline_value) {
           if (i + 1 >= argc) {
@@ -162,24 +208,6 @@ int server_cli_parse(int argc, char* argv[], ServerCliOptions* opts, char* err,
           inline_value = argv[++i];
         }
         opts->config_path = inline_value;
-      } else if (arg_has_value(argv[i], "--password-file", &inline_value)) {
-        if (!inline_value) {
-          if (i + 1 >= argc) {
-            set_error(err, err_size, "missing argument for --password-file");
-            return -1;
-          }
-          inline_value = argv[++i];
-        }
-        opts->password_file = inline_value;
-      } else if (arg_has_value(argv[i], "--early-input", &inline_value)) {
-        if (!inline_value) {
-          if (i + 1 >= argc) {
-            set_error(err, err_size, "missing argument for --early-input");
-            return -1;
-          }
-          inline_value = argv[++i];
-        }
-        opts->early_input_file = inline_value;
       } else if (arg_has_value(argv[i], "--dparam", &inline_value)) {
         if (!inline_value) {
           if (i + 1 >= argc) {
@@ -227,6 +255,20 @@ int server_cli_parse(int argc, char* argv[], ServerCliOptions* opts, char* err,
               "--daemon");
     return -1;
   }
+  if (opts->hash_credentials_file != NULL && (opts->daemon_mode || opts->stdio_mode)) {
+    set_error(err, err_size, "--hash-credentials cannot be combined with --daemon or --stdio");
+    return -1;
+  }
+  if (opts->hash_iterations_set && opts->hash_credentials_file == NULL) {
+    set_error(err, err_size, "--iterations requires --hash-credentials");
+    return -1;
+  }
+  /* --iconv: reject a malformed CONVERT_SPEC or an unsupported charset name at
+     startup (a probe iconv_open is attempted). */
+  if (opts->iconv_spec != NULL && !charset_spec_valid(opts->iconv_spec)) {
+    set_error(err, err_size, "--iconv requires LOCAL[,REMOTE] charset names supported by iconv");
+    return -1;
+  }
   return 0;
 }
 
@@ -236,4 +278,4 @@ void server_cli_options_free(ServerCliOptions* opts) {
   free((char**)opts->dparams);
   opts->dparams = NULL;
   opts->dparam_count = 0;
-}
+}

src/server/server_cli.h

@@ -3,6 +3,7 @@
 
 #include <stdbool.h>
 #include <stddef.h>
+#include <stdint.h>
 
 /* Parsed fastsync-server command line.  All string members are borrowed
  * pointers into the original argv (valid for the life of the argv array the
@@ -26,13 +27,30 @@ typedef struct ServerCliOptions {
   const char* config_path;      /* --config value, or NULL */
   const char* password_file;    /* --password-file value, or NULL (daemon) */
   const char* early_input_file; /* --early-input value, or NULL (daemon) */
-  const char** dparams;         /* raw --dparam override strings */
+  /* --hash-credentials=FILE: read `user:password` lines from FILE and print
+   * new-format credential-store lines to stdout, then exit.  Standalone mode
+   * (mutually exclusive with --daemon/--stdio). */
+  const char* hash_credentials_file;
+  bool hash_iterations_set; /* an explicit --iterations was given */
+  uint32_t hash_iterations; /* --iterations value (default CREDENTIAL_DEFAULT_ITERS) */
+  const char** dparams;     /* raw --dparam override strings */
   int dparam_count;
   const char* bind_address;   /* --address */
   int bind_family;            /* AF_UNSPEC / AF_INET / AF_INET6 */
   bool allow_delete;          /* --allow-delete */
   bool trust_sender;          /* --trust-sender */
   bool allow_unauthenticated; /* --allow-unauthenticated */
+  /* --no-super: operator veto forcing SUPER_MODE_OFF for every connection, so
+   * the receiver never attempts super-user activities (ownership application,
+   * device-node creation) even when running as root.  Applies to --stdio and
+   * --daemon alike; also makes the server refuse any client --copy-as. */
+  bool no_super; /* --no-super */
+  /* --iconv=CONVERT_SPEC: the server's own LOCAL charset declaration.  The
+   * client's full spec rides the wire config frame anyway; when the server is
+   * started with its own --iconv, its LOCAL half overrides the local charset
+   * the client assumed so the server converts received names to ITS charset.
+   * Borrowed pointer into argv (never owns heap). */
+  const char* iconv_spec; /* --iconv value, or NULL */
 } ServerCliOptions;
 
 /* Parse argc/argv into *opts.  Zero-initialize *opts before calling (or use

src/shared/batch.c

@@ -0,0 +1,160 @@
+#include "batch.h"
+#include "data.h"
+#include "file.h"
+#include "file_receive.h"
+#include "log.h"
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+/* Serialization metadata mode for the batch stream, captured from the config at
+ * batch_write_header time.  The header persists it into the file so a batch is
+ * self-describing: batch_read_apply re-reads it from the file (not from the
+ * reading config), so a batch written with -M is applied identically by an
+ * invoking process regardless of its own -M setting.  The batch driver is a
+ * single sequential scan pass within one thread, so this module-level flag is
+ * safe. */
+static bool batch_metadata_mode = false;
+
+static bool write_all_bytes(int fd, const void* data, size_t size) {
+  const unsigned char* p = (const unsigned char*)data;
+  size_t done = 0;
+  while (done < size) {
+    ssize_t n = write(fd, p + done, size - done);
+    if (n < 0 && errno == EINTR)
+      continue;
+    if (n <= 0)
+      return false;
+    done += (size_t)n;
+  }
+  return true;
+}
+
+bool batch_write_header(int fd, const Config* config) {
+  if (fd < 0)
+    return false;
+  batch_metadata_mode = config != NULL && config->use_metadata;
+  if (!write_all_bytes(fd, BATCH_MAGIC, BATCH_MAGIC_LEN))
+    return false;
+  unsigned char version = BATCH_FORMAT_VERSION;
+  if (!write_all_bytes(fd, &version, 1))
+    return false;
+  unsigned char mode = batch_metadata_mode ? 1 : 0;
+  return write_all_bytes(fd, &mode, 1);
+}
+
+bool batch_write_chunk(int fd, Chunk* chunk) {
+  if (fd < 0 || chunk == NULL)
+    return false;
+  Data* serialized = chunk_serialize(chunk, batch_metadata_mode);
+  if (serialized == NULL)
+    return false;
+  bool ok = false;
+  unsigned long long length = (unsigned long long)serialized->size;
+  if (length > BATCH_MAX_RECORD) {
+    log_message(LOG_LEVEL_ERROR, "batch: record size %llu exceeds the %llu-byte cap", length,
+                (unsigned long long)BATCH_MAX_RECORD);
+  } else if (write_all_bytes(fd, &length, sizeof(length)) &&
+             (length == 0 || write_all_bytes(fd, serialized->data, (size_t)length))) {
+    ok = true;
+  }
+  data_destroy(serialized);
+  return ok;
+}
+
+/* Read exactly `size` bytes.  Returns true on success.  On reaching EOF, sets
+ * *clean_eof only when no bytes had been read yet (a clean boundary) and returns
+ * that value, so a truncated record (EOF mid-read) yields false. */
+static bool read_exact(int fd, void* data, size_t size, bool* clean_eof) {
+  unsigned char* p = (unsigned char*)data;
+  size_t done = 0;
+  while (done < size) {
+    ssize_t n = read(fd, p + done, size - done);
+    if (n < 0 && errno == EINTR)
+      continue;
+    if (n == 0) {
+      if (clean_eof)
+        *clean_eof = done == 0;
+      return done == 0;
+    }
+    if (n < 0)
+      return false;
+    done += (size_t)n;
+  }
+  if (clean_eof)
+    *clean_eof = false;
+  return true;
+}
+
+int batch_read_apply(int fd, const Config* config, const char* dest_root) {
+  if (fd < 0 || dest_root == NULL || dest_root[0] == '\0')
+    return -1;
+
+  char magic[BATCH_MAGIC_LEN];
+  bool eof = false;
+  if (!read_exact(fd, magic, BATCH_MAGIC_LEN, &eof) || eof ||
+      memcmp(magic, BATCH_MAGIC, BATCH_MAGIC_LEN) != 0) {
+    log_message(LOG_LEVEL_ERROR, "batch: malformed header (bad magic)");
+    return -1;
+  }
+  unsigned char version;
+  if (!read_exact(fd, &version, 1, &eof) || eof || version != BATCH_FORMAT_VERSION) {
+    log_message(LOG_LEVEL_ERROR, "batch: malformed header (bad or missing format version)");
+    return -1;
+  }
+  unsigned char mode;
+  if (!read_exact(fd, &mode, 1, &eof) || eof || (mode != 0 && mode != 1)) {
+    log_message(LOG_LEVEL_ERROR, "batch: malformed header (bad metadata flag)");
+    return -1;
+  }
+  bool use_metadata = mode == 1;
+
+  while (1) {
+    unsigned long long length;
+    if (!read_exact(fd, &length, sizeof(length), &eof)) {
+      log_message(LOG_LEVEL_ERROR, "batch: truncated length prefix");
+      return -1;
+    }
+    if (eof)
+      break; /* clean end of stream */
+    if (length == 0 || length > BATCH_MAX_RECORD) {
+      log_message(LOG_LEVEL_ERROR, "batch: rejected record length %llu (valid range 1..%llu)",
+                  length, (unsigned long long)BATCH_MAX_RECORD);
+      return -1;
+    }
+    char* record = (char*)malloc((size_t)length);
+    if (record == NULL) {
+      log_message(LOG_LEVEL_ERROR, "batch: could not allocate a %llu-byte record", length);
+      return -1;
+    }
+    if (!read_exact(fd, record, (size_t)length, &eof) || eof) {
+      log_message(LOG_LEVEL_ERROR, "batch: truncated chunk record");
+      free(record);
+      return -1;
+    }
+    Data* data = data_create(record, (size_t)length);
+    if (data == NULL)
+      return -1; /* data_create frees `record` on failure */
+    Chunk* chunk = chunk_deserialize(data, use_metadata);
+    data_destroy(data);
+    if (chunk == NULL) {
+      log_message(LOG_LEVEL_ERROR, "batch: rejected malformed chunk record");
+      return -1;
+    }
+    for (int i = 0; i < chunk->element_count; i++) {
+      File* file = chunk->items[i];
+      chunk->items[i] = NULL;
+      if (file == NULL)
+        continue;
+      FileSaveResult result = file_save_to_disk_full(dest_root, file, config);
+      file_destroy(file);
+      if (result == FILE_SAVE_ERROR) {
+        chunk_destroy(chunk);
+        return -1;
+      }
+    }
+    chunk_destroy(chunk);
+  }
+  return 0;
+}

src/shared/batch.h

@@ -0,0 +1,28 @@
+#ifndef BATCH_H
+#define BATCH_H
+#include "chunk.h"
+#include "config.h"
+
+/* Phase 6 residual-batch codec.  A residual batch is a self-contained
+ * single-file record of a whole source tree: a magic+format-version header
+ * followed by length-prefixed chunk blobs (each built with chunk_serialize),
+ * byte-identical by construction.  The batch is a client-only driver feature:
+ * it never crosses the wire, so there is no PROTOCOL_VERSION bump and no server
+ * change. */
+
+#define BATCH_MAGIC "FSTRESBATCH"
+#define BATCH_MAGIC_LEN 11
+#define BATCH_FORMAT_VERSION 1
+/* Max size of a single length-prefixed record (a whole serialized chunk,
+ * which can span several files).  A single source file near the 64 MB wire
+ * limit plus per-file headers can produce a record slightly over 64 MB, so a
+ * large file just under the wire cap may be refused by the batch writer; this
+ * is documented upstream and the failure is clean (the partial batch is
+ * unlinked), never a truncated/corrupt batch. */
+#define BATCH_MAX_RECORD (64ULL * 1024 * 1024)
+
+bool batch_write_header(int fd, const Config* config);
+bool batch_write_chunk(int fd, Chunk* chunk);
+int batch_read_apply(int fd, const Config* config, const char* dest_root);
+
+#endif

src/shared/charset.c

@@ -0,0 +1,384 @@
+#include "charset.h"
+#include "log.h"
+#include "protocol.h"
+#include "utils.h"
+#include <errno.h>
+#include <iconv.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef struct {
+  iconv_t cd;
+} CharsetConversion;
+
+/* Process-wide wire conversion descriptor (one direction per process: a client
+ * only sends, a server only receives).  CONCURRENCY CONTRACT: iconv_t is not
+ * guaranteed thread-safe, so every conversion MUST run on a single thread at a
+ * time.  This holds today -- on the client the conversions run on the sender
+ * thread (in the -m pipeline chunk_serialize/send happen on the sender thread
+ * only), on the server on the receive-loop thread; the descriptor is
+ * initialized on one thread before any transfer thread spawns and torn down
+ * (charset_wire_free) only after all threads have joined.  Do not add a
+ * concurrent conversion path (e.g. parallel chunk serialization) without
+ * guarding access with a mutex. */
+static CharsetConversion* g_wire_conv;
+
+/* Grow *buf to double capacity, freeing it on failure.  realloc preserves the
+ * already-written prefix, so the caller only tracks its write offset. */
+static bool grow_charset_buffer(char** buf, size_t* cap) {
+  size_t new_cap = *cap * 2;
+  if (new_cap <= *cap) {
+    free(*buf);
+    *buf = NULL;
+    return false;
+  }
+  char* grown = realloc(*buf, new_cap);
+  if (!grown) {
+    free(*buf);
+    *buf = NULL;
+    return false;
+  }
+  *buf = grown;
+  *cap = new_cap;
+  return true;
+}
+
+/* Throw away any pending shift state so a subsequent conversion starts clean.
+ * The flush output is discarded; for the stateless single-byte/UTF charsets
+ * this feature targets it is a no-op. */
+static void charset_conversion_reset(const CharsetConversion* conv) {
+  char scratch[64];
+  char* sp = scratch;
+  size_t sl = sizeof(scratch);
+  (void)iconv(conv->cd, NULL, NULL, &sp, &sl);
+}
+
+int charset_spec_parse(const char* spec, char** local_out, char** remote_out) {
+  if (!local_out || !remote_out)
+    return -1;
+  *local_out = NULL;
+  *remote_out = NULL;
+  if (!spec || spec[0] == '\0')
+    return -1;
+  char* dup = str_dup(spec);
+  if (!dup)
+    return -1;
+  char* comma = strchr(dup, ',');
+  if (comma) {
+    if (comma == dup || comma[1] == '\0') {
+      free(dup);
+      return -1;
+    }
+    *comma = '\0';
+    *local_out = str_dup(dup);
+    *remote_out = str_dup(comma + 1);
+    free(dup);
+  } else {
+    *local_out = str_dup(dup);
+    *remote_out = str_dup(dup);
+    free(dup);
+  }
+  if (!*local_out || !*remote_out) {
+    free(*local_out);
+    free(*remote_out);
+    *local_out = NULL;
+    *remote_out = NULL;
+    return -1;
+  }
+  return 0;
+}
+
+void* charset_conversion_open(const char* from_charset, const char* to_charset) {
+  if (!from_charset || !to_charset)
+    return NULL;
+  iconv_t cd = iconv_open(to_charset, from_charset);
+  if (cd == (iconv_t)-1)
+    return NULL;
+  CharsetConversion* conv = malloc(sizeof(CharsetConversion));
+  if (!conv) {
+    iconv_close(cd);
+    return NULL;
+  }
+  conv->cd = cd;
+  return conv;
+}
+
+void charset_conversion_close(void* conversion) {
+  if (!conversion)
+    return;
+  CharsetConversion* conv = (CharsetConversion*)conversion;
+  iconv_close(conv->cd);
+  free(conv);
+}
+
+/* Probe a single conversion direction: the from/to charsets both open AND a
+ * representative ASCII name converts to a byte string containing no embedded
+ * NUL (so a target charset like UTF-16 that emits NUL bytes for ordinary ASCII
+ * names is rejected up front -- such an output would be silently truncated by
+ * the C-string wire helpers). */
+static bool direction_probe_valid(const char* from, const char* to) {
+  if (!from || !to)
+    return false;
+  void* conv = charset_conversion_open(from, to);
+  if (!conv)
+    return false;
+  bool ok = true;
+  char input = 'a';
+  char* in_ptr = &input;
+  size_t in_left = 1;
+  char out_buf[64];
+  char* out_ptr = out_buf;
+  size_t out_left = sizeof(out_buf);
+  if (iconv(((CharsetConversion*)conv)->cd, &in_ptr, &in_left, &out_ptr, &out_left) == (size_t)-1)
+    ok = false;
+  char flush_buf[64];
+  char* flush_ptr = flush_buf;
+  size_t flush_left = sizeof(flush_buf);
+  if (ok &&
+      iconv(((CharsetConversion*)conv)->cd, NULL, NULL, &flush_ptr, &flush_left) == (size_t)-1)
+    ok = false;
+  size_t produced = (size_t)(out_ptr - out_buf);
+  if (ok && produced > 0 && memchr(out_buf, '\0', produced) != NULL)
+    ok = false;
+  charset_conversion_close(conv);
+  return ok;
+}
+
+bool charset_pair_valid(const char* local, const char* remote) {
+  /* Both ends convert in opposite directions with the same two charsets, so a
+   * valid spec must open (and be NUL-free) in BOTH directions: the sender
+   * opens local->remote, the receiver opens remote->local. */
+  return direction_probe_valid(local, remote) && direction_probe_valid(remote, local);
+}
+
+bool charset_spec_valid(const char* spec) {
+  if (!spec)
+    return true;
+  char* local;
+  char* remote;
+  if (charset_spec_parse(spec, &local, &remote) != 0)
+    return false;
+  bool ok = charset_pair_valid(local, remote);
+  free(local);
+  free(remote);
+  return ok;
+}
+
+bool charset_spec_valid_direction(const char* from_charset, const char* to_charset) {
+  return direction_probe_valid(from_charset, to_charset);
+}
+
+/* The receiver's real conversion is wire(client REMOTE) -> server-local (the
+ * server's own --iconv LOCAL half, or the client's LOCAL half when the server
+ * has no --iconv).  A dedicated pre-ack check so an impossible direction is
+ * rejected before the connection instead of refusing mid-transfer. */
+bool charset_wire_receiver_spec_valid(const char* spec, const char* server_spec) {
+  if (!spec)
+    return true;
+  char* local;
+  char* remote;
+  if (charset_spec_parse(spec, &local, &remote) != 0)
+    return false;
+  const char* wire = remote;
+  const char* target_local = local;
+  char* server_local = NULL;
+  char* server_remote = NULL;
+  if (server_spec) {
+    if (charset_spec_parse(server_spec, &server_local, &server_remote) != 0) {
+      free(local);
+      free(remote);
+      return false;
+    }
+    target_local = server_local;
+  }
+  bool ok = charset_spec_valid_direction(wire, target_local);
+  free(server_local);
+  free(server_remote);
+  free(local);
+  free(remote);
+  return ok;
+}
+
+char* charset_convert(const void* conversion, const char* in, int* err_out) {
+  if (!conversion || !in)
+    return NULL;
+  const CharsetConversion* conv = (const CharsetConversion*)conversion;
+  size_t in_len = strlen(in);
+  size_t cap = in_len + 16;
+  char* out = malloc(cap);
+  if (!out)
+    return NULL;
+  size_t in_left = in_len;
+  char* in_ptr = (char*)in;
+  size_t out_used = 0;
+
+  while (in_left > 0) {
+    char* out_ptr = out + out_used;
+    size_t out_left = cap - out_used;
+    if (iconv(conv->cd, &in_ptr, &in_left, &out_ptr, &out_left) == (size_t)-1) {
+      if (errno != E2BIG) {
+        if (err_out)
+          *err_out = errno;
+        charset_conversion_reset(conv);
+        free(out);
+        return NULL;
+      }
+      /* Output exhausted but input remains.  E2BIG does not roll the output
+         pointer back: the bytes iconv already emitted before the failure must
+         be preserved, so advance out_used before growing. */
+      out_used = (size_t)(out_ptr - out);
+      if (!grow_charset_buffer(&out, &cap))
+        return NULL;
+      continue;
+    }
+    out_used = (size_t)(out_ptr - out);
+  }
+
+  /* Flush any pending shift state (a no-op for the stateless single-byte and
+     UTF charsets this feature targets, but keeps the descriptor clean). */
+  for (;;) {
+    char* out_ptr = out + out_used;
+    size_t out_left = cap - out_used;
+    if (iconv(conv->cd, NULL, NULL, &out_ptr, &out_left) == (size_t)-1) {
+      if (errno != E2BIG) {
+        if (err_out)
+          *err_out = errno;
+        charset_conversion_reset(conv);
+        free(out);
+        return NULL;
+      }
+      out_used = (size_t)(out_ptr - out);
+      if (!grow_charset_buffer(&out, &cap))
+        return NULL;
+      continue;
+    }
+    out_used = (size_t)(out_ptr - out);
+    break;
+  }
+
+  /* A successful iconv call may legitimately consume the whole buffer (output
+     exactly fills cap), leaving no room for the terminator: guarantee headroom
+     before the final write. */
+  if (out_used >= cap && !grow_charset_buffer(&out, &cap))
+    return NULL;
+
+  /* Defense in depth: a target charset that emits embedded NUL bytes would
+     truncate at the first NUL in the C-string wire helpers; fail cleanly
+     (validation already rejects such charsets up front). */
+  if (memchr(out, '\0', out_used) != NULL) {
+    if (err_out)
+      *err_out = EILSEQ;
+    charset_conversion_reset(conv);
+    free(out);
+    return NULL;
+  }
+
+  out[out_used] = '\0';
+  return out;
+}
+
+bool charset_wire_init_sender(const char* spec) {
+  charset_wire_free();
+  if (!spec)
+    return true;
+  char* local;
+  char* remote;
+  if (charset_spec_parse(spec, &local, &remote) != 0)
+    return false;
+  void* conv = charset_conversion_open(local, remote);
+  free(local);
+  free(remote);
+  if (!conv)
+    return false;
+  g_wire_conv = (CharsetConversion*)conv;
+  return true;
+}
+
+bool charset_wire_init_receiver(const char* spec, const char* server_spec) {
+  charset_wire_free();
+  if (!spec)
+    return true;
+  char* local;
+  char* remote;
+  if (charset_spec_parse(spec, &local, &remote) != 0)
+    return false;
+  /* The wire charset is the client spec's REMOTE half; the local charset is
+   * the client spec's LOCAL half unless the server was itself started with
+   * --iconv naming a different local charset (the server halves above never
+   * travel, so the server's own flag is the only way its local charset can
+   * differ from what the client assumed). */
+  const char* wire = remote;
+  const char* target_local = local;
+  char* server_local = NULL;
+  char* server_remote = NULL;
+  if (server_spec) {
+    if (charset_spec_parse(server_spec, &server_local, &server_remote) != 0) {
+      free(local);
+      free(remote);
+      return false;
+    }
+    target_local = server_local;
+  }
+  void* conv = charset_conversion_open(wire, target_local);
+  free(server_local);
+  free(server_remote);
+  free(local);
+  free(remote);
+  if (!conv)
+    return false;
+  g_wire_conv = (CharsetConversion*)conv;
+  return true;
+}
+
+void charset_wire_free(void) {
+  if (g_wire_conv) {
+    charset_conversion_close(g_wire_conv);
+    g_wire_conv = NULL;
+  }
+}
+
+bool charset_wire_active(void) {
+  return g_wire_conv != NULL;
+}
+
+char* charset_wire_apply(const char* path) {
+  if (!g_wire_conv)
+    return str_dup(path);
+  return charset_convert(g_wire_conv, path, NULL);
+}
+
+static void charset_convert_failure_log(const char* path) {
+  char* escaped = output_escape(path, false);
+  log_message(LOG_LEVEL_ERROR, "--iconv: cannot convert file name '%s' to the target charset",
+              escaped ? escaped : "<unprintable>");
+  free(escaped);
+}
+
+bool send_wire_str(int file_descriptor, const char* local_path) {
+  if (!g_wire_conv)
+    return send_str(file_descriptor, local_path);
+  char* wire = charset_wire_apply(local_path);
+  if (!wire) {
+    charset_convert_failure_log(local_path);
+    return false;
+  }
+  bool ok = send_str(file_descriptor, wire);
+  free(wire);
+  return ok;
+}
+
+char* receive_wire_str(int file_descriptor) {
+  char* raw = receive_str(file_descriptor);
+  if (!raw)
+    return NULL;
+  if (!g_wire_conv)
+    return raw;
+  char* local = charset_convert(g_wire_conv, raw, NULL);
+  if (!local) {
+    charset_convert_failure_log(raw);
+    free(raw);
+    return NULL;
+  }
+  free(raw);
+  return local;
+}

src/shared/charset.h

@@ -0,0 +1,85 @@
+#ifndef CHARSET_H
+#define CHARSET_H
+
+#include <stdbool.h>
+#include <stddef.h>
+
+/* --iconv=CONVERT_SPEC file-name charset conversion (rsync compatibility).
+ *
+ * CONVERT_SPEC is "LOCAL[,REMOTE]": LOCAL is the charset of our own file
+ * names, REMOTE is the charset of the remote side's file names and defaults
+ * to LOCAL when the comma half is omitted.  The sender converts every local
+ * path from LOCAL to REMOTE before it goes on the wire; the receiver converts
+ * every received path back from REMOTE to LOCAL.  A NULL/disabled spec means
+ * identity with zero overhead (the common path never consults iconv).
+ *
+ * All helpers are friendly to the strict cold path: the wire conversion state
+ * is process-global (one direction per process -- a client only sends, a
+ * server only receives) and is initialized once, before any path is
+ * serialized, so conversion compiles to a single non-NULL check when disabled.
+ */
+
+/* Parse CONVERT_SPEC into malloc'd LOCAL and REMOTE charset names (caller
+ * frees both).  REMOTE is a separate copy of LOCAL when no comma is present.
+ * Returns 0 on success, -1 on a malformed spec (empty halves / missing value /
+ * allocation failure); nothing is allocated on the -1 path.  Both output
+ * pointers are REQUIRED (non-NULL). */
+int charset_spec_parse(const char* spec, char** local_out, char** remote_out);
+
+/* True when a CONVERT_SPEC is well-formed AND its charsets are usable for this
+ * feature: each pair opens in a probe iconv_open in BOTH directions (a sender
+ * converts local->remote, the receiver converts remote->local) and converting
+ * a representative ASCII name emits no embedded NUL byte (a UTF-16-style NUL
+ * emitter would be silently truncated by the C-string wire helpers).  A typo'd
+ * charset name is therefore rejected at startup, not mid-run.  NULL (iconv
+ * disabled) is always valid. */
+bool charset_spec_valid(const char* spec);
+
+/* Probe a concrete from->to conversion pair without keeping the descriptor:
+ * both charsets open AND a representative ASCII name converts with no embedded
+ * NUL.  Used for direction-specific validation (e.g. the receiver's exact
+ * wire->local direction including a server-side charset override). */
+bool charset_spec_valid_direction(const char* from_charset, const char* to_charset);
+bool charset_pair_valid(const char* local, const char* remote);
+
+/* One-shot conversion of a NUL-terminated input to a malloc'd NUL-terminated
+ * result, or NULL on failure.  On failure *err_out (when non-NULL) receives
+ * the iconv errno (EILSEQ/EINVAL = the input is not representable in the
+ * target charset).  The caller must free the result. */
+char* charset_convert(const void* conversion, const char* in, int* err_out);
+
+/* Open a conversion descriptor for direction from_charset -> to_charset.
+ * Returns NULL (errno = EINVAL) when a charset name is unsupported.  Freed
+ * with charset_conversion_close. */
+void* charset_conversion_open(const char* from_charset, const char* to_charset);
+void charset_conversion_close(void* conversion);
+
+/* Process-wide wire conversion.  charset_wire_init_sender (client side) opens
+ * LOCAL->REMOTE; charset_wire_init_receiver (server side) opens
+ * wire(REMOTE)->server-local.  server_spec is the server's own --iconv, whose
+ * LOCAL half may override the local charset the client assumed; NULL reuses
+ * the client spec's LOCAL half.  Both return false on an unsupported spec.
+ * The state is freed with charset_wire_free. */
+bool charset_wire_init_sender(const char* spec);
+bool charset_wire_init_receiver(const char* spec, const char* server_spec);
+void charset_wire_free(void);
+bool charset_wire_active(void);
+
+/* Pre-ack receiver-direction sanity (see charset_wire_init_receiver): true
+ * when the exact wire->server-local conversion the receiver will use (client
+ * spec's REMOTE half into the server's own LOCAL half, or the client's LOCAL
+ * half when the server has no --iconv) opens and produces NUL-free output. */
+bool charset_wire_receiver_spec_valid(const char* spec, const char* server_spec);
+
+/* Convert a path across the wire in the process direction.  Returns a malloc'd
+ * string, or NULL when the name cannot be represented in the target charset. */
+char* charset_wire_apply(const char* path);
+
+/* Convenience wire string I/O: encode+send_str / receive_str+decode.  Both
+ * return false/NULL (logging a clear --iconv error) on conversion failure, so
+ * an unconvertible path FAILS the transfer cleanly instead of silently sending
+ * a mangled name. */
+bool send_wire_str(int file_descriptor, const char* local_path);
+char* receive_wire_str(int file_descriptor);
+
+#endif

src/shared/chunk.c

@@ -6,6 +6,7 @@
 #include <string.h>
 
 #include "array_list.h"
+#include "charset.h"
 #include "chunk.h"
 #include "compression.h"
 #include "data.h"
@@ -63,9 +64,22 @@ void chunk_destroy(void* item) {
   free(chunk);
 }
 
+/* --iconv: a chunk blob carries wire-charset path/target bytes.  Encode the
+ * sender-side path (a no-op copy when iconv is disabled) so the blob is in the
+ * same charset as every other wire string. */
+static char* chunk_encode_wire(const char* path) {
+  if (!charset_wire_active())
+    return str_dup(path);
+  return charset_wire_apply(path);
+}
+
 static unsigned long long per_file_serialize_size(File* file, bool use_metadata) {
   unsigned long long size = sizeof(size_t);
-  size_t path_len = strlen(file_wire_path(file));
+  char* wire_path = chunk_encode_wire(file_wire_path(file));
+  if (!wire_path)
+    return 0;
+  size_t path_len = strlen(wire_path);
+  free(wire_path);
   unsigned long long metadata_size =
       use_metadata ? sizeof(int) + (file->metadata ? FILE_METADATA_WIRE_SIZE : 0) : 0;
   if ((unsigned long long)path_len > ULLONG_MAX - size)
@@ -94,7 +108,11 @@ static unsigned long long per_file_serialize_size(File* file, bool use_metadata)
   size += file->data->size;
   /* Symlink entries append the target string (length-prefixed). */
   if (file->is_symlink) {
-    size_t target_len = file->symlink_target ? strlen(file->symlink_target) : 0;
+    char* wire_target = chunk_encode_wire(file->symlink_target ? file->symlink_target : "");
+    if (!wire_target)
+      return 0;
+    size_t target_len = strlen(wire_target);
+    free(wire_target);
     if (sizeof(size_t) > ULLONG_MAX - size)
       return 0;
     size += sizeof(size_t);
@@ -128,12 +146,17 @@ Data* chunk_serialize(Chunk* chunk, bool use_metadata) {
   char* data_pointer = data->data;
   for (int i = 0; i < chunk->element_count; i++) {
     File* file = chunk->items[i];
-    const char* wire_path = file_wire_path(file);
+    char* wire_path = chunk_encode_wire(file_wire_path(file));
+    if (wire_path == NULL) {
+      data_destroy(data);
+      return NULL;
+    }
     size_t path_len = strlen(wire_path);
     memcpy(data_pointer, &path_len, sizeof(size_t));
     data_pointer += sizeof(size_t);
     memcpy(data_pointer, wire_path, path_len);
     data_pointer += path_len;
+    free(wire_path);
 
     int entry_type = file->is_dir ? 1 : (file->is_symlink ? 2 : (file->is_special ? 3 : 0));
     memcpy(data_pointer, &entry_type, sizeof(int));
@@ -159,12 +182,18 @@ Data* chunk_serialize(Chunk* chunk, bool use_metadata) {
     data_pointer += file_data_size;
 
     if (file->is_symlink) {
-      size_t target_len = file->symlink_target ? strlen(file->symlink_target) : 0;
+      char* wire_target = chunk_encode_wire(file->symlink_target ? file->symlink_target : "");
+      if (wire_target == NULL) {
+        data_destroy(data);
+        return NULL;
+      }
+      size_t target_len = strlen(wire_target);
       memcpy(data_pointer, &target_len, sizeof(size_t));
       data_pointer += sizeof(size_t);
       if (target_len > 0)
-        memcpy(data_pointer, file->symlink_target, target_len);
+        memcpy(data_pointer, wire_target, target_len);
       data_pointer += target_len;
+      free(wire_target);
     }
   }
   return data;
@@ -222,6 +251,22 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
     data_pointer += path_len;
     remaining_size -= path_len;
 
+    /* --iconv: the blob holds the wire charset; translate it to the receiver's
+       local charset before validation and creation so the destination gets the
+       local name.  A name that cannot be decoded fails the file cleanly. */
+    if (charset_wire_active()) {
+      char* local_path = charset_wire_apply(path);
+      free(path);
+      if (local_path == NULL) {
+        log_message(LOG_LEVEL_ERROR,
+                    "--iconv: received chunk file name cannot be converted to the local charset");
+        array_list_delete(files);
+        return NULL;
+      }
+      path = local_path;
+      path_len = strlen(path);
+    }
+
     if (path_len == 0 || has_path_traversal(path)) {
       free(path);
       array_list_delete(files);
@@ -392,6 +437,21 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
         array_list_delete(files);
         return NULL;
       }
+      /* The symlink target also rides the wire charset; decode it to the local
+         charset like the path (a target is a path). */
+      if (charset_wire_active()) {
+        char* local_target = charset_wire_apply(target);
+        free(target);
+        if (local_target == NULL) {
+          log_message(LOG_LEVEL_ERROR,
+                      "--iconv: received chunk symlink target cannot be converted to the local "
+                      "charset");
+          file_destroy(file);
+          array_list_delete(files);
+          return NULL;
+        }
+        target = local_target;
+      }
       file->symlink_target = target;
       data_pointer += target_len;
       remaining_size -= target_len;

src/shared/config.c

@@ -1,4 +1,5 @@
 #include "config.h"
+#include "charset.h"
 #include "chmod.h"
 #include "credentials.h"
 #include "daemon_conf.h"
@@ -40,8 +41,9 @@ static void config_set_defaults(Config* config) {
   config->ssh_destination = NULL;
   config->module = NULL;
   config->auth_user = NULL;
-  config->auth_password_hash = NULL;
+  config->auth_password = NULL;
   config->password_file = NULL;
+  config->iconv_spec = NULL;
   config->fastsync_server_path = NULL;
   config->exclude_patterns = NULL;
   config->exclude_count = 0;
@@ -167,6 +169,7 @@ static void config_set_defaults(Config* config) {
   config->usermap_count = 0;
   config->groupmap = NULL;
   config->groupmap_count = 0;
+  config->super_mode = SUPER_MODE_AUTO;
   config->delay_context = NULL;
   config->preserve_atimes = false;
   config->preserve_crtimes = false;
@@ -175,7 +178,16 @@ static void config_set_defaults(Config* config) {
   config->open_noatime = false;
   config->use_xattrs = false;
   config->fake_super = false;
+  config->copy_as_set = false;
+  config->copy_as_uid = 0;
+  config->copy_as_gid = 0;
   config->trust_sender = false;
+  config->stop_after_mins = 0;
+  config->stop_at = 0;
+  config->stop_at_set = false;
+  config->write_batch = NULL;
+  config->only_write_batch = NULL;
+  config->read_batch = NULL;
 }
 
 static bool valid_wire_bool(int value) {
@@ -233,6 +245,11 @@ static bool validate_received_config(const Config* config) {
          valid_wire_bool(config->omit_dir_times) && valid_wire_bool(config->omit_link_times) &&
          valid_wire_bool(config->munge_links) && valid_wire_bool(config->keep_dirlinks) &&
          valid_wire_bool(config->fake_super) &&
+         (!config->copy_as_set || (config->copy_as_uid >= 0 && config->copy_as_gid >= 0)) &&
+         /* --copy-as forces ownership through the metadata path; without
+            metadata it would pass the privilege gate but silently chown
+            nothing.  Refuse the frame instead. */
+         (!config->copy_as_set || config->use_metadata) &&
          (!config->use_compression ||
           (config->compression_level >= 1 && config->compression_level <= 22)) &&
          config->chunk_size > 0 && config->chunk_size <= MAX_CHUNK_SIZE &&
@@ -242,7 +259,16 @@ static bool validate_received_config(const Config* config) {
          config->max_delete >= -1 && config->skip_compress_count >= 0 &&
          config->skip_compress_count <= 10000 && config->max_alloc > 0 &&
          (!config->chmod_spec || !*config->chmod_spec ||
-          chmod_apply(0, config->chmod_spec, &(mode_t){0}));
+          chmod_apply(0, config->chmod_spec, &(mode_t){0})) &&
+         /* The received --iconv CONVERT_SPEC is untrusted input that drives
+            the receiver's path decoding: reject a malformed spec or an
+            unsupported charset name so the run is refused up front instead of
+            every received file name failing mid-transfer.  A NULL spec (iconv
+            disabled) is always accepted. */
+         (!config->iconv_spec || charset_spec_valid(config->iconv_spec)) &&
+         /* --super / --no-super: the received tri-state must be one of the
+            defined values (AUTO/ON/OFF); anything else is a malformed frame. */
+         config->super_mode >= SUPER_MODE_AUTO && config->super_mode <= SUPER_MODE_OFF;
 }
 
 Config* config_create(void) {
@@ -604,6 +630,20 @@ void config_parse_ssh_dest(Config* config) {
   config->receive_root_directory = path;
 }
 
+void config_burn_auth(Config* config) {
+  if (!config)
+    return;
+  if (config->auth_password) {
+    credentials_burn(config->auth_password, strlen(config->auth_password));
+    free(config->auth_password);
+    config->auth_password = NULL;
+  }
+  if (config->auth_user) {
+    free(config->auth_user);
+    config->auth_user = NULL;
+  }
+}
+
 void config_delete(Config* config) {
   if (config == NULL)
     return;
@@ -616,9 +656,12 @@ void config_delete(Config* config) {
   free(config->receive_root_directory);
   free(config->ssh_destination);
   free(config->module);
-  free(config->auth_user);
-  free(config->auth_password_hash);
+  config_burn_auth(config);
   free(config->password_file);
+  free(config->iconv_spec);
+  free(config->write_batch);
+  free(config->only_write_batch);
+  free(config->read_batch);
   free(config->fastsync_server_path);
   for (int i = 0; i < config->exclude_count; i++)
     free(config->exclude_patterns[i]);
@@ -1098,23 +1141,18 @@ static bool receive_daemon_module(int fd, Config* c) {
   return true;
 }
 
-/* Daemon password credentials (Wave B, within protocol 2.15.0 -- see the
- * PROTOCOL_VERSION note in config.h: this rides the Wave A trailing-string
- * area, symmetric sender+receiver in every 2.15.0 build, so it is not a frame
- * layout that needs its own bump).  A single presence int is followed, when
- * set, by the username and the SHA-256 hex digest of the password.  The
- * literal password never crosses the wire. */
+/* Daemon password credentials (A7 remediation, protocol 2.19.0).  A single
+ * presence int is followed, when set, by ONLY the username; the password is
+ * never serialized.  The daemon answers an auth-required module with the SCRAM
+ * challenge (see the auth exchange below). */
 static bool send_daemon_auth(int fd, const Config* c) {
-  bool present = c->auth_user != NULL && c->auth_password_hash != NULL && c->auth_user[0] != '\0' &&
-                 c->auth_password_hash[0] != '\0';
+  bool present = c->auth_user != NULL && c->auth_user[0] != '\0';
   if (!send_int(fd, present ? 1 : 0))
     return false;
   if (!present)
     return true;
-  /* Redacted send: the username and hard-wired digest must never reach a
-   * --verbose debug log (they are replayable), while normal protocol strings
-   * keep their debug trace. */
-  return send_str_redacted(fd, c->auth_user) && send_str_redacted(fd, c->auth_password_hash);
+  /* Redacted send: the username must never reach a --verbose debug log. */
+  return send_str_redacted(fd, c->auth_user);
 }
 
 static bool receive_daemon_auth(int fd, Config* c) {
@@ -1123,24 +1161,178 @@ static bool receive_daemon_auth(int fd, Config* c) {
     return false;
   if (!present)
     return true;
-  /* Redacted receive: never log the incoming username/digest bodies. */
+  /* Redacted receive: never log the incoming username body. */
   char* user = receive_str_redacted(fd);
-  char* hash = receive_str_redacted(fd);
-  if (!user || !hash) {
-    free(user);
-    free(hash);
+  if (!user)
     return false;
-  }
-  size_t user_len = strlen(user);
-  bool valid = user_len > 0 && user_len <= CREDENTIAL_MAX_USER_LEN && credentials_hash_valid(hash);
-  if (!valid) {
+  if (!credentials_username_valid(user)) {
     free(user);
-    free(hash);
     log_message(LOG_LEVEL_WARNING, "Daemon client sent malformed auth credentials");
     return false;
   }
   c->auth_user = user;
-  c->auth_password_hash = hash;
+  return true;
+}
+
+/* Client half of the SCRAM challenge/response (A7 remediation).  Called by
+ * config_send after the config frame is written and the server answered
+ * STATUS_AUTH_CHALLENGE.  The plaintext password lives only in
+ * config->auth_password and every derived buffer is wiped on the way out. */
+static bool client_auth_exchange(int fd, const Config* c) {
+  if (!c->auth_user || !c->auth_password)
+    return false;
+  int iters = 0;
+  if (!receive_int(fd, &iters))
+    return false;
+  if (iters < (int)CREDENTIAL_MIN_ITERS || iters > (int)CREDENTIAL_MAX_ITERS) {
+    log_message(LOG_LEVEL_ERROR, "Daemon sent an out-of-range auth iteration count");
+    return false;
+  }
+  char* salt_b64 = receive_str(fd);
+  char* snonce_b64 = receive_str(fd);
+  uint8_t salt[CREDENTIAL_SALT_LEN];
+  uint8_t snonce[CREDENTIAL_NONCE_LEN];
+  uint8_t cnonce[CREDENTIAL_NONCE_LEN];
+  size_t salt_len = 0;
+  size_t snonce_len = 0;
+  bool ok = salt_b64 && snonce_b64 &&
+            credentials_b64_decode(salt_b64, salt, sizeof(salt), &salt_len) &&
+            salt_len == CREDENTIAL_SALT_LEN &&
+            credentials_b64_decode(snonce_b64, snonce, sizeof(snonce), &snonce_len) &&
+            snonce_len == CREDENTIAL_NONCE_LEN && credentials_random_bytes(cnonce, sizeof(cnonce));
+  credentials_burn(salt_b64, salt_b64 ? strlen(salt_b64) : 0);
+  credentials_burn(snonce_b64, snonce_b64 ? strlen(snonce_b64) : 0);
+  free(salt_b64);
+  free(snonce_b64);
+  if (!ok) {
+    log_message(LOG_LEVEL_ERROR, "Daemon sent a malformed auth challenge");
+    return false;
+  }
+  uint8_t client_key[CREDENTIAL_KEY_LEN];
+  uint8_t stored_key[CREDENTIAL_KEY_LEN];
+  uint8_t server_key[CREDENTIAL_KEY_LEN];
+  uint8_t auth_msg[CREDENTIAL_AUTH_MESSAGE_MAX];
+  size_t msg_len = 0;
+  uint8_t proof[CREDENTIAL_KEY_LEN];
+  uint8_t expected_sig[CREDENTIAL_KEY_LEN];
+  ok = credentials_compute_keys(c->auth_password, salt, (uint32_t)iters, client_key, stored_key,
+                                server_key) &&
+       credentials_build_auth_message(c->auth_user, snonce, cnonce, auth_msg, sizeof(auth_msg),
+                                      &msg_len) &&
+       credentials_client_proof(client_key, stored_key, server_key, auth_msg, msg_len, proof,
+                                expected_sig);
+  char cnonce_b64[45];
+  char proof_b64[45];
+  if (ok)
+    ok = credentials_b64_encode(cnonce, sizeof(cnonce), cnonce_b64, sizeof(cnonce_b64)) &&
+         credentials_b64_encode(proof, sizeof(proof), proof_b64, sizeof(proof_b64));
+  if (!ok) {
+    log_message(LOG_LEVEL_ERROR, "Failed to compute the daemon auth response");
+  } else {
+    ok = send_status(fd, STATUS_AUTH_RESPONSE) && send_str_redacted(fd, cnonce_b64) &&
+         send_str_redacted(fd, proof_b64);
+  }
+  if (ok) {
+    Status status = STATUS_ERROR;
+    char* sig_b64 = NULL;
+    uint8_t sig[CREDENTIAL_KEY_LEN];
+    size_t sig_len = 0;
+    ok = receive_status(fd, &status) && status == STATUS_AUTH_OK &&
+         (sig_b64 = receive_str_redacted(fd)) != NULL &&
+         credentials_b64_decode(sig_b64, sig, sizeof(sig), &sig_len) &&
+         sig_len == CREDENTIAL_KEY_LEN &&
+         credentials_secure_equal((const char*)sig, (const char*)expected_sig, CREDENTIAL_KEY_LEN);
+    if (!ok)
+      log_message(LOG_LEVEL_ERROR, "Daemon authentication failed");
+    credentials_burn(sig_b64, sig_b64 ? strlen(sig_b64) : 0);
+    credentials_burn((char*)sig, sizeof(sig));
+    free(sig_b64);
+  }
+  credentials_burn((char*)client_key, sizeof(client_key));
+  credentials_burn((char*)stored_key, sizeof(stored_key));
+  credentials_burn((char*)server_key, sizeof(server_key));
+  credentials_burn((char*)auth_msg, sizeof(auth_msg));
+  credentials_burn((char*)proof, sizeof(proof));
+  credentials_burn((char*)expected_sig, sizeof(expected_sig));
+  credentials_burn((char*)salt, sizeof(salt));
+  credentials_burn((char*)snonce, sizeof(snonce));
+  credentials_burn((char*)cnonce, sizeof(cnonce));
+  credentials_burn(cnonce_b64, sizeof(cnonce_b64));
+  credentials_burn(proof_b64, sizeof(proof_b64));
+  return ok;
+}
+
+/* --iconv CONVERT_SPEC (protocol 2.16.0).  Trailing string on the config frame,
+ * sent after the Wave A/B daemon-auth block and before the ack, so the
+ * receiver knows the wire charset before the first file name arrives.  The full
+ * spec travels (LOCAL,REMOTE) and each end derives its own LOCAL and the wire
+ * (REMOTE) charset symmetrically; an unset spec is serialized as "" and
+ * canonicalized back to NULL on receive. */
+static bool send_iconv_spec(int fd, const Config* c) {
+  return send_str(fd, c->iconv_spec ? c->iconv_spec : "");
+}
+
+static bool receive_iconv_spec(int fd, Config* c) {
+  char* spec = receive_str(fd);
+  if (!spec)
+    return false;
+  if (*spec == '\0') {
+    free(spec);
+    c->iconv_spec = NULL;
+    return true;
+  }
+  c->iconv_spec = spec;
+  return true;
+}
+
+/* --super / --no-super privilege policy (P7 Wave E, protocol 2.18.0).  One
+ * trailing int on the config frame, sent after the --iconv spec and before the
+ * STATUS_OK ack, so the receiver knows whether it may attempt super-user
+ * activities (ownership application, char/block device-node creation) that are
+ * already confined below the authorized receive root.  The received value is
+ * validated to the SUPER_MODE_AUTO..SUPER_MODE_OFF range (also re-checked by
+ * validate_received_config). */
+static bool send_privilege_options(int fd, const Config* c) {
+  return send_int(fd, c->super_mode);
+}
+
+static bool receive_privilege_options(int fd, Config* c) {
+  int mode;
+  if (!receive_int(fd, &mode) || mode < SUPER_MODE_AUTO || mode > SUPER_MODE_OFF)
+    return false;
+  c->super_mode = mode;
+  return true;
+}
+
+/* --copy-as=USER[:GROUP] (P7 Wave E, protocol 2.18.0).  Trailing block on the
+ * config frame, sent after the --super int and before the ack: a presence int,
+ * then (when set) the target uid and gid as int32.  The receiver forces the
+ * ownership of every entry it writes to these ids through the confined
+ * fd-relative identity path and requires privilege; both ids are validated
+ * `>= 0` on receive so a hostile peer cannot smuggle a negative (sentinel)
+ * value into the ownership path. */
+static bool send_copy_as_options(int fd, const Config* c) {
+  if (!send_int(fd, c->copy_as_set ? 1 : 0))
+    return false;
+  if (!c->copy_as_set)
+    return true;
+  return send_int(fd, c->copy_as_uid) && send_int(fd, c->copy_as_gid);
+}
+
+static bool receive_copy_as_options(int fd, Config* c) {
+  int present;
+  if (!receive_int(fd, &present) || !valid_wire_bool(present))
+    return false;
+  if (!present) {
+    c->copy_as_set = false;
+    return true;
+  }
+  int uid, gid;
+  if (!receive_int(fd, &uid) || !receive_int(fd, &gid) || uid < 0 || gid < 0)
+    return false;
+  c->copy_as_set = true;
+  c->copy_as_uid = uid;
+  c->copy_as_gid = gid;
   return true;
 }
 
@@ -1156,11 +1348,22 @@ bool config_send(int file_descriptor, const Config* config) {
       !send_metadata_times_options(file_descriptor, config) ||
       !send_symlink_trust_options(file_descriptor, config) ||
       !send_phase4_xattr_options(file_descriptor, config) ||
-      !send_daemon_module(file_descriptor, config) || !send_daemon_auth(file_descriptor, config))
+      !send_daemon_module(file_descriptor, config) || !send_daemon_auth(file_descriptor, config) ||
+      !send_iconv_spec(file_descriptor, config) ||
+      !send_privilege_options(file_descriptor, config) ||
+      !send_copy_as_options(file_descriptor, config))
     return false;
   Status status;
   if (!receive_status(file_descriptor, &status))
     return false;
+  if (status == STATUS_AUTH_CHALLENGE) {
+    /* Daemon auth (protocol 2.19.0): run the SCRAM exchange, then wait for the
+     * ordinary STATUS_OK the server sends once authentication succeeded. */
+    if (!client_auth_exchange(file_descriptor, config))
+      return false;
+    if (!receive_status(file_descriptor, &status))
+      return false;
+  }
   if (status != STATUS_OK) {
     log_message(LOG_LEVEL_ERROR, "Error transmitting config");
     return false;
@@ -1198,7 +1401,10 @@ Config* config_receive_with_validate(int file_descriptor, ConfigValidateFunc val
       !receive_symlink_trust_options(file_descriptor, config) ||
       !receive_phase4_xattr_options(file_descriptor, config) ||
       !receive_daemon_module(file_descriptor, config) ||
-      !receive_daemon_auth(file_descriptor, config))
+      !receive_daemon_auth(file_descriptor, config) ||
+      !receive_iconv_spec(file_descriptor, config) ||
+      !receive_privilege_options(file_descriptor, config) ||
+      !receive_copy_as_options(file_descriptor, config))
     goto error;
   if (config->compress_choice[0] != '\0' && strcmp(config->compress_choice, "zstd") != 0 &&
       strcmp(config->compress_choice, "none") != 0) {
@@ -1219,9 +1425,14 @@ Config* config_receive_with_validate(int file_descriptor, ConfigValidateFunc val
     if (rejection != NULL) {
       /* Daemon module gate (unknown module / read-only module / auth-required
        * module): refuse BEFORE the STATUS_OK so the client aborts at the
-       * config handshake and no file data is ever exchanged. */
-      fprintf(stderr, "%s\n", rejection);
-      send_status(file_descriptor, STATUS_ERROR);
+       * config handshake and no file data is ever exchanged.  The auth
+       * handshake already sent STATUS_AUTH_FAILED when it failed, signalled by
+       * the CONFIG_VALIDATE_ALREADY_TERMINATED sentinel, so no second status is
+       * written. */
+      if (rejection != CONFIG_VALIDATE_ALREADY_TERMINATED) {
+        fprintf(stderr, "%s\n", rejection);
+        send_status(file_descriptor, STATUS_ERROR);
+      }
       goto error;
     }
   }

src/shared/config.h

@@ -6,6 +6,7 @@
 #include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
+#include <time.h>
 
 typedef enum { TRANSPORT_TCP, TRANSPORT_SSH } TransportType;
 
@@ -95,21 +96,31 @@ typedef struct Config {
    * string so the daemon can look the module up in its own config and confine
    * the connection to the module's root (never a client-chosen root). */
   char* module;
-  /* Daemon password authentication (Wave B, protocol 2.15.0, WITHIN the Wave A
-   * frame layout -- see the PROTOCOL_VERSION note below for why this is not a
-   * bump).  Client-composed from a --password-file whose first meaningful line
-   * is `user:password`: the client sends ONLY the username and a SHA-256 hex
-   * digest of the password (auth_user + auth_password_hash), never the literal
-   * password.  Both are NULL when the client has no credentials to present; a
-   * module WITHOUT `auth users` stays open and the server ignores any
-   * credentials that do arrive (the client sends them opportunistically and
-   * the server decides). */
+  /* Daemon password authentication (A7 remediation, protocol 2.19.0).
+   * Client-composed from a --password-file whose first meaningful line is
+   * `user:password`: the client sends ONLY the username in the config frame
+   * (auth_user); the literal password is kept in auth_password CLIENT-SIDE for
+   * the duration of the SCRAM challenge/response and is NEVER serialized.  Both
+   * are NULL when the client has no credentials to present; a module WITHOUT
+   * `auth users` stays open and the server ignores any credentials that do
+   * arrive (the client sends them opportunistically and the server decides). */
   char* auth_user;
-  char* auth_password_hash;
+  char* auth_password;
   /* Client-only path of --password-file (never crosses the wire; it is read to
-   * populate auth_user/auth_password_hash before connecting). */
+   * populate auth_user/auth_password before connecting). */
   char* password_file;
   char* fastsync_server_path;
+  /* --iconv=CONVERT_SPEC (protocol 2.16.0, rsync compatibility): convert the
+   * charset of FILE NAMES at the wire boundary.  CONVERT_SPEC is
+   * "LOCAL[,REMOTE]": LOCAL is the charset of our own file names, REMOTE is
+   * the remote side's charset and defaults to LOCAL.  The sender converts
+   * every path LOCAL->REMOTE before transmitting it; the receiver converts
+   * every received path back REMOTE->LOCAL before creating/writing it.  The
+   * FULL SPEC crosses the wire as a trailing config-frame string so each end
+   * derives its own LOCAL and the wire (REMOTE) charset symmetrically.  NULL
+   * (or "") means no conversion: identity with zero overhead.  See charset.c
+   * and the PROTOCOL_VERSION note below. */
+  char* iconv_spec;
   char** exclude_patterns;
   int exclude_count;
   char** include_patterns;
@@ -390,6 +401,23 @@ typedef struct Config {
   IdentityMap* groupmap;
   int groupmap_count;
 
+  /* --super / --no-super (P7 Wave E, protocol 2.18.0): receiver-side privilege
+   * policy for super-user activities confined below the authorized receive
+   * root.  SUPER_MODE_AUTO (default) preserves the pre-existing best-effort
+   * behavior: the confined super-user operation is ALWAYS attempted and an
+   * unprivileged attempt is refused by the kernel and skipped per entry.
+   * SUPER_MODE_ON (--super) explicitly REQUESTS those activities (char/block
+   * device-node creation, --write-devices); it does NOT imply --numeric-ids and
+   * never enables ownership application on its own.  SUPER_MODE_OFF
+   * (--no-super) FORBIDS them even when running as root.  FastSync NEVER
+   * elevates privileges (no setuid/seteuid/setgid) and never bypasses the
+   * fd-relative confinement (file_open_secure_parent, O_NOFOLLOW, root checks);
+   * --super only permits an attempt that is already confined.  Crosses the wire
+   * as a trailing int so the receiver can enforce the policy.  See
+   * privilege_super_permitted() and identity_ownership_requested() in
+   * identity.h. */
+  int super_mode;
+
   // Receiver-side runtime staging registry for --delay-updates.  Never sent
   // over the wire and never set on the sender side.
   DelayUpdatesContext* delay_context;
@@ -427,6 +455,20 @@ typedef struct Config {
    * a reserved user.fastsync.stat xattr recording the source uid/gid/mode/mtime
    * so a later privileged restore could re-apply them.  Crosses the wire. */
   bool fake_super;
+  /* --copy-as=USER[:GROUP] (P7 Wave E, protocol 2.18.0).  Safe-subset
+   * implementation, a documented divergence from rsync's real identity switch:
+   * the receiver does NOT change its process credentials (FastSync's receiver
+   * is multithreaded, so a setuid/seteuid drop would be unsafe).  Instead the
+   * receiver FORCES the ownership of every entry it writes to copy_as_uid /
+   * copy_as_gid through the existing confined, fd-relative identity path
+   * (fchown/fchownat), which REQUIRES receiver privilege (root); an
+   * unprivileged receiver REFUSES the whole transfer up front at the config
+   * handshake (never a silent wrong-ownership result).  All three fields CROSS
+   * the wire as a trailing config-frame block so the receiver learns the
+   * requested ids; see the PROTOCOL_VERSION note below. */
+  bool copy_as_set;
+  int32_t copy_as_uid;
+  int32_t copy_as_gid;
 
   // Phase 5: --trust-sender
   /* Long-form-only, receiver-local policy.  rsync's --trust-sender tells the
@@ -446,6 +488,31 @@ typedef struct Config {
    * authorized root (see the phase-5 notes in RSYNC_COMPAT.md).  Off by
    * default; only relaxes validation when explicitly requested. */
   bool trust_sender;
+
+  // Phase 6: --stop-after / --stop-at
+  /* Client-only sender-side transfer stop deadlines.  --stop-after=MINS stops
+   * the transfer after a number of elapsed minutes (checked against
+   * CLOCK_MONOTONIC so clock changes do not skew it); --stop-at=TIME stops at
+   * an absolute wall-clock time (HH:MM, HH:MM:SS, or now+N[smhd]).  At the
+   * deadline the run stops elegantly at the next chunk/file boundary and the
+   * completion tail still runs (exit 0).  Both are LOCAL to the sending
+   * process and are NEVER serialized into the config frame. */
+  int stop_after_mins; /* --stop-after=MINS minutes; 0 when unset */
+  time_t stop_at;      /* --stop-at=... absolute wall-clock deadline */
+  bool stop_at_set;    /* true when --stop-at was given */
+
+  // Phase 6: --write-batch / --only-write-batch / --read-batch
+  /* Client-only residual-batch paths.  A residual batch is a self-contained
+   * single-file record of the whole source tree (full file images using the
+   * chunk codec), independent of any live server.  --write-batch=FILE runs the
+   * normal live transfer AND additionally emits the batch FILE;
+   * --only-write-batch=FILE emits FILE only (no destination, no server);
+   * --read-batch=FILE applies FILE to the destination (no source, no server).
+   * All three are LOCAL to the driving process and are NEVER serialized into
+   * the config frame (the batch paths bypass the transport entirely). */
+  char* write_batch;      /* --write-batch=FILE path, or NULL */
+  char* only_write_batch; /* --only-write-batch=FILE path, or NULL */
+  char* read_batch;       /* --read-batch=FILE path, or NULL */
 } Config;
 
 /* Phase 5 (remote-option wave): 2.13.0 -> 2.14.0.
@@ -478,8 +545,8 @@ typedef struct Config {
  * is what keeps a 2.15 client and a 2.14 server from ever reaching that state.
  *
  * NOTE: daemon module-selection bump owned by Wave A (2.15.0); later daemon
- * waves (auth, motd) must not bump PROTOCOL_VERSION.  Wave B (auth) adds the
- * credential fields (auth_user/auth_password_hash) as further trailing
+ * waves (auth, motd) must not bump PROTOCOL_VERSION.  Wave B (auth) added the
+ * credential fields (auth_user + password digest) as further trailing
  * config-frame strings AFTER the Wave A module string, with a presence int
  * prefix.  This is not a new frame version: sender and receiver of a 2.15.0
  * build always read and write the same full layout (the strict same-version
@@ -493,8 +560,78 @@ typedef struct Config {
  * reads that frame right after the ack (client_send.c) -- symmetric
  * server->client in every build, so the strict same-version handshake keeps the
  * two peers in lockstep and nothing can desynchronize.  The --stdio SSH path
- * sends/reads no MOTD at all. */
-#define PROTOCOL_VERSION "2.15.0"
+ * sends/reads no MOTD at all.
+ *
+ * --iconv Wave (P6): 2.15.0 -> 2.16.0.
+ *
+ * WHY the bump, grounded in the wire: the --iconv feature adds a serialized
+ * field to the binary config frame.  The client sends the full CONVERT_SPEC
+ * (Config->iconv_spec) as a new trailing string AFTER the Wave A/B daemon-auth
+ * block (in config_send/config_receive), so the receiver knows the wire charset
+ * (the REMOTE half) before the first file name arrives.  Any config-frame
+ * layout change must bump the protocol version: a peer that does not parse the
+ * new trailing bytes would desynchronize on the frame boundary, and the strict
+ * same-version handshake (config_receive rejects a mismatched version before
+ * parsing anything else) is what keeps a 2.16 client and a 2.15 server from
+ * ever reaching that state.
+ *
+ * Times Wave (P7 Wave D): 2.16.0 -> 2.17.0.
+ *
+ * WHY the bump, grounded in the wire: this wave makes -O/--omit-dir-times and
+ * -J/--omit-link-times REAL by adding directory and symlink time preservation.
+ * The config-frame LAYOUT is unchanged (the omit flags already crossed the
+ * wire), but the FRAME STREAM gains a new terminal frame: after all file data
+ * and the optional delete manifest, the sender transmits STATUS_DIR_TIMES
+ * frame(s) (each a count followed by (path, metadata) pairs, chunked so no
+ * frame exceeds the receiver's MAX_MANIFEST_ENTRIES bound) carrying every
+ * source directory's captured times, so the receiver can apply them AFTER all of a
+ * directory's children have been written (writing a child bumps the parent's
+ * mtime).  Symlink entries already carry their metadata on the STATUS_SYMLINK
+ * frame; the receiver now applies it (utimensat/lchown with
+ * AT_SYMLINK_NOFOLLOW) unless -J is set.  Any change to the frame sequence must
+ * bump the protocol version: a 2.16 peer that does not know STATUS_DIR_TIMES
+ * would desynchronize on the unknown frame, and the strict same-version
+ * handshake (config_receive rejects a mismatched version before parsing
+ * anything else) is what keeps a 2.17 client and a 2.16 server from ever
+ * reaching that state.
+ *
+ * Privilege Wave (P7 Wave E): 2.17.0 -> 2.18.0.
+ *
+ * WHY the bump, grounded in the wire: this wave adds the receiver-side
+ * privilege flags --super/--no-super and --copy-as=USER[:GROUP].  The
+ * config-frame layout gains two new trailing blocks AFTER the --iconv
+ * CONVERT_SPEC string, in this fixed order: (1) send_privilege_options /
+ * receive_privilege_options send one int (Config->super_mode, 0..2), then
+ * (2) send_copy_as_options / receive_copy_as_options send a presence int and,
+ * when set, the target uid and gid (both int32).  The receiver uses
+ * super_mode to decide whether it may attempt super-user activities
+ * (ownership application, char/block device-node creation) already confined
+ * below the authorized receive root, and the copy-as ids to force the
+ * ownership of every entry it writes (the safe-subset --copy-as model).  The
+ * receiver REQUIRES privilege for copy-as: an unprivileged receiver refuses
+ * the transfer at the config handshake (server_module_gate) instead of silently
+ * ignoring the flag.  Any config-frame layout change must bump the protocol
+ * version: a peer that does not parse the new trailing bytes would
+ * desynchronize on the frame boundary, and the strict same-version handshake
+ * (config_receive rejects a mismatched version before parsing anything else) is
+ * what keeps a 2.18 client and a 2.17 server from ever reaching that state.
+ * --super never elevates privileges; it only permits a confined attempt, and
+ * --copy-as never switches process credentials (see RSYNC_COMPAT.md).
+ *
+ * A7 Auth Wave: 2.18.0 -> 2.19.0.
+ *
+ * WHY the bump, grounded in the wire: the daemon auth block on the config frame
+ * loses the hard-wired password digest (it becomes `[int present][str_redacted
+ * username]`), and the frame stream gains the SCRAM challenge/response
+ * (STATUS_AUTH_CHALLENGE -> STATUS_AUTH_RESPONSE -> STATUS_AUTH_OK) between the
+ * config frame and the STATUS_OK ack.  A 2.18 peer would desynchronize on both
+ * the shorter auth block and the new status frames, so the strict same-version
+ * handshake (config_receive rejects a mismatched version before parsing
+ * anything else) is what keeps a 2.19 client and a 2.18 server from ever
+ * reaching that state.  SECURITY: a 2.19 store holds a salted PBKDF2 verifier
+ * and cannot verify (and refuses to load) a legacy unsalted-SHA-256 store line,
+ * so an old bearer digest can never be replayed against a 2.19 daemon. */
+#define PROTOCOL_VERSION "2.19.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 /* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */
 #define MAX_BASIS_DIRS 64
@@ -507,23 +644,47 @@ typedef struct Config {
 #define IDENTITY_CURRENT (-1)
 #define MAX_IDENTITY_MAP 128
 
+/* --super / --no-super tri-state (Config->super_mode).  AUTO (default) and ON
+ * both permit a confined super-user attempt (AUTO preserves FastSync's
+ * historical best-effort behavior; an unprivileged attempt is refused by the
+ * kernel and skipped per entry); OFF forbids the attempt even for root.  See
+ * privilege_super_mode_permitted() in identity.h. */
+#define SUPER_MODE_AUTO 0
+#define SUPER_MODE_ON 1
+#define SUPER_MODE_OFF 2
+
 Config* config_create(void);
 void config_delete(Config* config);
+
+/* Wipe the client-side plaintext auth password (and username) from a Config
+ * before it is freed or handed off.  Safe on a NULL/empty Config and idempotent
+ * (it clears the pointers after burning).  config_delete calls this
+ * automatically; a caller that drops a Config earlier may call it explicitly. */
+void config_burn_auth(Config* config);
+
 bool config_send(int file_descriptor, const Config* config);
 Config* config_receive(int file_descriptor);
 bool config_is_remote_dest(const char* s);
 void config_parse_ssh_dest(Config* config);
 
+/* A ConfigValidateFunc may return this sentinel to tell
+ * config_receive_with_validate that the callback ALREADY sent a terminal status
+ * frame (e.g. STATUS_AUTH_FAILED, then closed) and the frame must be abandoned
+ * without an additional STATUS_ERROR.  A normal rejection returns a message
+ * string (logged, then STATUS_ERROR); NULL accepts. */
+#define CONFIG_VALIDATE_ALREADY_TERMINATED ((const char*)-1)
+
 /* Server-side config-frame gate (daemon module selection, Wave A).  A server
  * that needs to make an accept/reject decision about a received Config BEFORE
  * it sends the STATUS_OK ack (so a rejected connection is refused cleanly with
  * no data transferred) passes a callback here; it runs after the frame parses
  * and validates but before the STATUS_OK/STATUS_ERROR ack.  Return NULL to
  * accept the connection; return a non-NULL message to reject it (the message
- * is logged server-side and STATUS_ERROR is sent in place of STATUS_OK).  The
- * callback runs in the connection's own process, so it may set up per-module
- * process state (e.g. the authorized root).  context is an opaque caller
- * pointer. */
+ * is logged server-side and STATUS_ERROR is sent in place of STATUS_OK), or the
+ * CONFIG_VALIDATE_ALREADY_TERMINATED sentinel when the callback already sent
+ * its own terminal status.  The callback runs in the connection's own process,
+ * so it may set up per-module process state (e.g. the authorized root) and
+ * drive the daemon auth handshake.  context is an opaque caller pointer. */
 typedef const char* (*ConfigValidateFunc)(const Config* config, void* context);
 Config* config_receive_with_validate(int file_descriptor, ConfigValidateFunc validate,
                                      void* context);

src/shared/credentials.h

@@ -3,46 +3,83 @@
 
 #include <stdbool.h>
 #include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
 
-/* Daemon password authentication (Wave B).
+/* Daemon password authentication (A7 remediation, protocol 2.19.0).
  *
- * FastSync authenticates a daemon connection with a username plus a SHA-256
- * hex digest of that username's password.  The digest is what crosses the
- * wire: a challenge-less credential exchange, so the literal password is never
- * transmitted (and never stored on the daemon host).  A module that declares
- * `auth users` demands that the presented username is on its list AND that the
- * presented digest matches the credential store's entry for that username.
- * The digest comparison is constant-time; a module with `auth users` whose
- * store is missing/misconfigured fails CLOSED (never falls open).
+ * FastSync authenticates a daemon connection with a SCRAM-SHA-256-style
+ * challenge/response handshake.  The daemon stores only a salted PBKDF2
+ * verifier (never the password, and never a value that can be replayed as a
+ * bearer credential): the client proves knowledge of the password against a
+ * per-connection server nonce, and the server proves the same shared secret
+ * back.  See credentials.c for the exact derivation.
  *
- * Credential store format (server --password-file and --early-input): one
- * `user:SHA256HEX` entry per line.  SHA256HEX is the lowercase hex SHA-256 of
- * the user's password -- the exact value a FastSync client transmits.  Blank
- * lines and lines whose first non-space character is '#' or ';' are comments.
- * The parser is STRICT: a malformed line (no ':', an empty/whitespace user, a
- * secret that is not 64 lowercase hex chars, a line longer than
- * CREDENTIAL_MAX_LINE) fails the whole load so a typo can never silently
- * change who may log in.
+ * Server credential store format (--password-file and --early-input): one line
+ * per entry,
+ *   user:$fastsync$1$pbkdf2-sha256$<iters>$<salt_b64>$<stored_key_b64>$<server_key_b64>
+ * with standard base64, a 16-byte salt and 32-byte keys, and iters in
+ * [CREDENTIAL_MIN_ITERS, CREDENTIAL_MAX_ITERS].  Blank lines and lines whose
+ * first non-space character is '#' or ';' are comments.  The parser is STRICT:
+ * a malformed line fails the whole load so a typo can never silently change who
+ * may log in.  A line holding the legacy (unsalted SHA-256 hex) secret is
+ * hard-rejected with an actionable "legacy" error; there is no auto-upgrade.
+ * Use `fastsync-server --hash-credentials` to generate new-format lines.
+ *
+ * Alongside the store, credentials_load maintains an exact-mode-0600
+ * `<store_path>.dummykey` sidecar holding the store-wide random dummy key.  It
+ * is auto-created on first load and MUST be preserved across restarts: it makes
+ * the dummy challenge for an unknown user stable for the life of the store, so
+ * a daemon restart cannot be used as a username-enumeration oracle.  A sidecar
+ * that is not an exact-mode-0600 regular file of exactly 32 bytes fails the load
+ * (fail closed); creation forces exact 0600 with fchmod (so a restrictive umask
+ * cannot leave the sidecar unreadable), and only a create/write/fsync/link or
+ * fchmod failure degrades to a transient per-run key with a warning.  NOTE: the
+ * sidecar requires EXACT 0600, whereas the store / password files only reject
+ * group/other bits (a deliberate difference).
  *
  * Client --password-file format: the FIRST meaningful (non-comment, non-blank)
- * line is `user:password`, holding the literal password.  The client hashes it
- * and sends only the digest; the file should be mode 0600 and readable only by
- * its owner.
- */
+ * line is `user:password`, holding the literal password.  The client keeps it
+ * only for the duration of the handshake and wipes it at teardown; the file
+ * should be mode 0600 and readable only by its owner. */
 
-/* Lowercase hex length of a SHA-256 digest (what travels on the wire and what
- * the server store holds). */
-#define CREDENTIAL_HASH_HEX_LEN 64
 /* Longest accepted credential-file line (excluding the trailing newline). */
 #define CREDENTIAL_MAX_LINE 4096
 /* Upper bound on a username in a credential file and on the wire.  Kept well
  * below MAX_STRING_SIZE so a wire username can never exhaust anything. */
 #define CREDENTIAL_MAX_USER_LEN 256
-/* Upper bound on a client-file password (before hashing). */
+/* Upper bound on a client-file password (before derivation). */
 #define CREDENTIAL_MAX_PASSWORD_LEN 1024
 
+/* SCRAM-SHA-256 parameters.  Salt and client nonce sizes are fixed by the
+ * shared-auth-message framing; keys are always 32 bytes (SHA-256). */
+#define CREDENTIAL_SALT_LEN 16
+#define CREDENTIAL_NONCE_LEN 32
+#define CREDENTIAL_KEY_LEN 32
+#define CREDENTIAL_DEFAULT_ITERS 600000u
+#define CREDENTIAL_MIN_ITERS 100000u
+#define CREDENTIAL_MAX_ITERS 10000000u
+/* Buffer size for the full AuthMessage (prefix + three length-prefixed fields).
+ * Worst case: 16 + 4 + 256 + 4 + 32 + 4 + 32. */
+#define CREDENTIAL_AUTH_MESSAGE_MAX                                                                \
+  (16 + 4 + CREDENTIAL_MAX_USER_LEN + 4 + CREDENTIAL_NONCE_LEN + 4 + CREDENTIAL_NONCE_LEN)
+
 typedef struct CredentialStore CredentialStore;
 
+/* One resolved verifier.  `found` is false for an unknown user or a user not on
+ * a module's auth list; the remaining fields then hold a deterministic dummy
+ * salt (HMAC of the store-wide dummy key over the username), the store-wide
+ * uniform iteration count (default for an empty store) and fixed dummy keys, so
+ * the server can run the same challenge/response math with no enumeration or
+ * timing oracle. */
+typedef struct {
+  uint8_t salt[CREDENTIAL_SALT_LEN];
+  uint32_t iters;
+  uint8_t stored_key[CREDENTIAL_KEY_LEN];
+  uint8_t server_key[CREDENTIAL_KEY_LEN];
+  bool found;
+} CredentialVerifier;
+
 /* Load the daemon credential store.
  *
  * password_file and early_input_file are both NULL-or-path, matching the
@@ -50,72 +87,113 @@ typedef struct CredentialStore CredentialStore;
  * opened or that fails the strict grammar is a hard error (err filled, NULL
  * returned) -- the daemon fails CLOSED rather than serving an auth-required
  * module with a partial store.  Both files may be NULL, which yields an empty
- * store (every auth-required module then refuses connections).  When both are
- * given, the --early-input file is layered over --password-file: a duplicate
- * username whose secret matches is deduplicated; one whose secret differs is
- * an error (the two sources disagree), never a silent pick.
+ * store (every auth-required module then refuses connections).  Every entry in
+ * the resulting store must agree on the iteration count; entries that disagree
+ * (within one file or across the two layered sources) are rejected.  When both
+ * are given, the --early-input file is layered over --password-file: a duplicate
+ * username whose verifier matches is deduplicated; one whose verifier differs
+ * is an error (the two sources disagree), never a silent pick.
  *
  * The returned store is heap-owned; free it with credentials_free. */
 CredentialStore* credentials_load(const char* password_file, const char* early_input_file,
                                   char* err, size_t err_size);
 
+/* Wipe every stored key/salt and free the store. */
 void credentials_free(CredentialStore* store);
 
-/* True when `hash_hex` is exactly CREDENTIAL_HASH_HEX_LEN lowercase hex digits
- * (the wire/store digest form).  Used to reject a malformed presented digest
- * before it reaches the comparison. */
-bool credentials_hash_valid(const char* hash_hex);
+/* True when `user` is a single bounded token free of whitespace/control bytes
+ * (the rule applied to store users, client-file users and the module list). */
+bool credentials_username_valid(const char* user);
 
-/* Compute the lowercase hex SHA-256 of `password` into out_hex, which must
- * hold at least CREDENTIAL_HASH_HEX_LEN + 1 bytes.  Returns false on a NULL
- * password or a hashing failure.  The output is NUL-terminated. */
-bool credentials_hash_password(const char* password, char* out_hex);
+/* Standard base64.  encode writes NUL-terminated output to out (size out_sz).
+ * decode writes the raw bytes to out (capacity out_sz) and stores the length;
+ * the input must be a well-formed padded base64 string.  Both return false on
+ * NULL arguments, a bad character/length, or insufficient output space. */
+bool credentials_b64_encode(const uint8_t* in, size_t n, char* out, size_t out_sz);
+bool credentials_b64_decode(const char* in, uint8_t* out, size_t out_sz, size_t* out_len);
+
+/* Fill out[0..n) from the CSPRNG (RAND_bytes).  Returns false on failure. */
+bool credentials_random_bytes(uint8_t* out, size_t n);
+
+/* Resolve `user` against the store AND the module's auth-user list.  The list
+ * scan is a constant-time full-length comparison with no early break.  On a
+ * miss, *out is filled with a dummy verifier (a deterministic per-username salt
+ * derived from the store's dummy key, the store-wide uniform iteration count,
+ * fixed dummy keys, found=false).  Returns false on invalid arguments or an
+ * HMAC/crypto primitive failure. */
+bool credentials_get_verifier(const CredentialStore* store, const char* user,
+                              const char* const* module_users, int n, CredentialVerifier* out);
+
+/* Derive the SCRAM keys from a plaintext password:
+ *   K = PBKDF2-HMAC-SHA256(password, salt, iters, 32)
+ *   ClientKey = HMAC-SHA256(K, "Client Key"); StoredKey = SHA256(ClientKey)
+ *   ServerKey = HMAC-SHA256(K, "Server Key")
+ * Any of client_key/stored_key/server_key may be NULL when not needed.
+ * `iters` must lie in [CREDENTIAL_MIN_ITERS, CREDENTIAL_MAX_ITERS]. */
+bool credentials_compute_keys(const char* password, const uint8_t salt[CREDENTIAL_SALT_LEN],
+                              uint32_t iters, uint8_t client_key[CREDENTIAL_KEY_LEN],
+                              uint8_t stored_key[CREDENTIAL_KEY_LEN],
+                              uint8_t server_key[CREDENTIAL_KEY_LEN]);
+
+/* Serialize the shared AuthMessage:
+ *   "FastSync-Auth-v1" || be32(len(user)) || user
+ *                      || be32(32) || server_nonce
+ *                      || be32(32) || client_nonce
+ * out must hold at least CREDENTIAL_AUTH_MESSAGE_MAX bytes.  *out_len receives
+ * the number of bytes written. */
+bool credentials_build_auth_message(const char* user, const uint8_t* snonce, const uint8_t* cnonce,
+                                    uint8_t* out, size_t out_sz, size_t* out_len);
+
+/* Client side: ClientProof = ClientKey XOR HMAC(StoredKey, AuthMessage), and
+ * the expected ServerSignature = HMAC(ServerKey, AuthMessage). */
+bool credentials_client_proof(const uint8_t client_key[CREDENTIAL_KEY_LEN],
+                              const uint8_t stored_key[CREDENTIAL_KEY_LEN],
+                              const uint8_t server_key[CREDENTIAL_KEY_LEN], const uint8_t* auth_msg,
+                              size_t msg_len, uint8_t proof[CREDENTIAL_KEY_LEN],
+                              uint8_t server_sig[CREDENTIAL_KEY_LEN]);
+
+/* Server side: recompute ClientSig' = HMAC(StoredKey, AuthMessage) and
+ * ClientKey' = proof XOR ClientSig', then accept iff v->found AND
+ * SHA256(ClientKey') equals StoredKey (constant-time over the 32-byte keys).
+ * Always computes server_sig_out = HMAC(ServerKey, AuthMessage).  Returns the
+ * accept decision. */
+bool credentials_verify_response(const CredentialVerifier* v, const char* user,
+                                 const uint8_t* snonce, const uint8_t* cnonce,
+                                 const uint8_t proof[CREDENTIAL_KEY_LEN],
+                                 uint8_t server_sig_out[CREDENTIAL_KEY_LEN]);
+
+/* Derive a new-format store line for `user`/`password` and write it (without a
+ * trailing newline) into out.  A random 16-byte salt is used.  On failure err is
+ * filled.  Used by --hash-credentials and by tests. */
+bool credentials_hash_store_line(const char* user, const char* password, uint32_t iters, char* out,
+                                 size_t out_sz, char* err, size_t err_size);
+
+/* Read `user:password` lines from `path` (the same no-group/other-bits check as
+ * the other secret files) and write one new-format store line per entry to
+ * `out`.
+ * Blank/comment lines are skipped; a malformed line fails the whole run.
+ * Returns 0 on success, -1 on error (err filled).  Used by
+ * `--hash-credentials`. */
+int credentials_hash_file(const char* path, uint32_t iters, FILE* out, char* err, size_t err_size);
 
 /* Read the CLIENT-side secret file: the first meaningful line is
  * `user:password` (the literal password).  *user_out and *password_out are
- * freshly allocated on success (password is plaintext -- the caller hashes it
- * and then burns/frees it); both are NULL on error.  Returns 0 on success, -1
- * on failure (err filled: the path is named, never the credential itself).
- * Only the line's trailing CR/LF are stripped: the password's bytes are
- * otherwise preserved exactly, so a password with leading/trailing whitespace
- * (after the ':') is kept usable.  The username is trimmed of surrounding
- * space/tabs. */
+ * freshly allocated on success (password is plaintext -- the caller derives the
+ * proof and then burns/frees it); both are NULL on error.  Returns 0 on
+ * success, -1 on failure (err filled: the path is named, never the credential
+ * itself).  Only the line's trailing CR/LF are stripped: the password's bytes
+ * are otherwise preserved exactly, so a password with leading/trailing
+ * whitespace (after the ':') is kept usable.  The username is trimmed of
+ * surrounding space/tabs. */
 int credentials_read_secret_file(const char* path, char** user_out, char** password_out, char* err,
                                  size_t err_size);
 
-/* Constant-time equality over exactly len bytes.  Returns true when the two
- * buffers match.  No early exit: the whole length is always scanned, so a
- * timing side-channel cannot reveal how many leading bytes matched. */
+/* Constant-time equality over exactly len bytes. */
 bool credentials_secure_equal(const char* a, const char* b, size_t len);
 
-/* Overwrite secret[0..len) with zeros (best-effort wipe of a plaintext
- * password that is about to be freed). */
+/* Overwrite secret[0..len) with zeros (best-effort wipe). */
 void credentials_burn(char* secret, size_t len);
 
-/* Verify a presented (user, digest) against the store.  Returns true only when
- * the store holds an entry for `user` whose stored digest equals the presented
- * one.  A NULL store, NULL user/digest, unknown user and wrong digest all
- * return false.  The digest comparison runs over a fixed dummy whenever the
- * user is absent, and the username lookup is a single constant-time
- * full-length compare (no byte-wise early exit), so neither "unknown user" vs
- * "wrong password" nor a username prefix match can be distinguished by timing
- * (no user-enumeration oracle in the comparison path). */
-bool credentials_verify(const CredentialStore* store, const char* user,
-                        const char* presented_hash_hex);
-
-/* The daemon's per-module auth decision, in one pure, unit-testable function.
- * `module_users`/`module_user_count` are the module's `auth users` list; a
- * module that declares auth users requires the presented user to be ON that
- * list AND to verify against the store.  Returns false (fail closed) when the
- * store is NULL, when no credential was presented, when the user is not on the
- * module's list, or when verification fails.  This is the single decision the
- * server_module_gate seam applies to an auth-required module.  Like
- * credentials_verify, username matches here use a constant-time full-length
- * compare rather than a byte-wise-short-circuiting strcmp. */
-bool credentials_gate_allows(const CredentialStore* store, const char* const* module_users,
-                             int module_user_count, const char* presented_user,
-                             const char* presented_hash_hex);
-
 /* Number of entries currently in the store (tests/introspection). */
 int credentials_store_size(const CredentialStore* store);
 

src/shared/daemon_conf.c

@@ -170,6 +170,17 @@ static bool apply_module_key(DaemonModule* module, char* key, char* value, char*
     module->read_only = parsed;
     return true;
   }
+  if (key_equals(key, "client owner")) {
+    bool parsed;
+    if (!parse_bool_value(value, &parsed)) {
+      set_error(err, err_size,
+                "module '%s': 'client owner' must be yes/no (or true/false/1/0), got '%s'",
+                module->name, value);
+      return false;
+    }
+    module->client_owner = parsed;
+    return true;
+  }
   if (key_equals(key, "auth users")) {
     char* list = str_dup(value);
     if (!list) {

src/shared/daemon_conf.h

@@ -23,8 +23,17 @@
  * server's --destination-root: the daemon confines every connection that
  * selects this module to this path (file_open_secure_parent /
  * has_path_traversal / path_is_within all keep the existing confinement, just
- * per-module).  There is never any client-chosen root and no --super /
- * --copy-as: a module path always stays confined.
+ * per-module).  There is never any client-chosen root: a module path always
+ * stays confined.  A daemon REFUSES every client-chosen ownership / super-user
+ * request by default -- --numeric-ids, --chown, --usermap/--groupmap,
+ * --fake-super, --copy-as and an explicit --super -- because there is no
+ * per-module opt-in unless the operator adds one.  An operator opts a single
+ * module in with `client owner = yes` (DaemonModule.client_owner), which allows
+ * that client to choose ownership within that module's root (the standalone/SSH
+ * server honors such requests for its single operator-authorized root).  The
+ * operator-level --no-super veto additionally forces super-user activities off
+ * for every daemon connection, even an opted-in module.  See server_module_gate
+ * in server.c and RSYNC_COMPAT.md.
  *
  * `auth_users` is honored by Wave B daemon authentication: a module that
  * declares auth users accepts a connection only when the presented username is
@@ -36,6 +45,11 @@ typedef struct DaemonModule {
   char* name;        /* module name, as the client requests it */
   char* path;        /* module root (daemon-side authorized root) */
   bool read_only;    /* `read only = yes/no`; default no */
+  bool client_owner; /* `client owner = yes/no`; default no.  Per-module opt-in
+                        that lets this module's clients choose ownership
+                        (--numeric-ids/--chown/--usermap/--groupmap/--fake-super/
+                        --copy-as) and request explicit --super super-user
+                        activities.  Without it the daemon refuses all of them. */
   char** auth_users; /* `auth users = a,b`; Wave B credential list */
   int auth_user_count;
 } DaemonModule;

src/shared/file.c

@@ -16,6 +16,8 @@
 #include "data.h"
 #include "delta.h"
 #include "file.h"
+#include "file_store.h"
+#include "identity.h"
 #include "log.h"
 #include "metadata.h"
 #include "utils.h"
@@ -111,6 +113,7 @@ File* file_create(const char* path) {
   file->metadata = NULL;
   file->skip = false;
   file->is_dir = false;
+  file->dir_time_only = false;
   file->basis_link = NULL;
   file->link_group = 0;
   file->link_first = false;
@@ -475,6 +478,50 @@ out:
   return ok;
 }
 
+/* Open the directory named by canonical absolute `resolved`, which the caller
+ * has already verified lies beneath `root` (the canonical authorized root).
+ * Each component is opened relative to the authorized-root fd with O_NOFOLLOW,
+ * so a directory swapped for a symlink after the realpath() check cannot
+ * redirect the open outside the root -- the walk simply fails.  This replaces
+ * re-opening the absolute resolved path (TOCTOU).  Returns an O_DIRECTORY fd,
+ * or -1 (the root itself and any error are refused). */
+static int open_dir_beneath_root(const char* resolved, const char* root) {
+  size_t root_len = strlen(root);
+  const char* rel = resolved + root_len;
+  while (*rel == '/')
+    rel++;
+  if (*rel == '\0')
+    return -1;
+  int fd = dup(authorized_root_fd);
+  if (fd < 0)
+    return -1;
+  char* copy = str_dup(rel);
+  if (!copy) {
+    close(fd);
+    return -1;
+  }
+  char* save = NULL;
+  for (char* component = strtok_r(copy, "/", &save); component;
+       component = strtok_r(NULL, "/", &save)) {
+    if (strcmp(component, ".") == 0)
+      continue;
+    /* A canonical realpath() output never contains "." or ".."; refuse ".."
+       defensively rather than let it climb toward the root. */
+    int next = strcmp(component, "..") == 0
+                   ? -1
+                   : openat(fd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+    if (next < 0) {
+      close(fd);
+      free(copy);
+      return -1;
+    }
+    close(fd);
+    fd = next;
+  }
+  free(copy);
+  return fd;
+}
+
 int file_open_secure_parent(const char* path, char** leaf_out, bool create_dirs) {
   char* copy = str_dup(path);
   if (!copy)
@@ -533,8 +580,31 @@ int file_open_secure_parent(const char* path, char** leaf_out, bool create_dirs)
     if (strcmp(component, ".") != 0) {
       int next = openat(fd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
       if (next < 0 && create_dirs && errno == ENOENT) {
-        if (mkdirat(fd, component, 0755) == 0 || errno == EEXIST)
+        bool created = mkdirat(fd, component, 0755) == 0;
+        if (created || errno == EEXIST) {
+          /* P7 Wave E: --copy-as owns EVERY entry, including the intermediate
+             directories this walk creates implicitly.  Its target ids are a
+             global policy, so they are available here without per-entry source
+             metadata.  Only a directory this walk actually created is chowned
+             (a pre-existing destination directory is left alone, matching
+             rsync's transferred-entry scope); the helper is a no-op unless an
+             identity policy is active. */
+          if (created && identity_copy_as_active() &&
+              !identity_apply_ownership_link(fd, component, 0, 0)) {
+            /* A REQUIRED --copy-as ownership that cannot be applied to a
+               directory this walk just created must fail the entry rather than
+               leave that implicit parent owned by the receiver.  Preserve the
+               failing errno across the cleanup so the caller logs the real
+               reason. */
+            int saved_errno = errno;
+            close(fd);
+            free(copy);
+            free(leaf);
+            errno = saved_errno;
+            return -1;
+          }
           next = openat(fd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+        }
       }
       /* --keep-dirlinks (-K): a path component that is an existing symlink to
          an in-root directory is used as THAT directory rather than failing the
@@ -556,16 +626,13 @@ int file_open_secure_parent(const char* path, char** leaf_out, bool create_dirs)
                 (resolved[strlen(root)] == '/' || resolved[strlen(root)] == '\0')) {
               struct stat rst;
               if (stat(resolved, &rst) == 0 && S_ISDIR(rst.st_mode)) {
-                /* Re-open the resolved directory WITHOUT following a symlink and
-                   re-verify it is still a directory inode, so a symlink swapped
-                   in between realpath() and open() (TOCTOU) cannot redirect this
-                   fd outside the root. */
-                next = open(resolved, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-                struct stat ofst;
-                if (next >= 0 && (fstat(next, &ofst) != 0 || !S_ISDIR(ofst.st_mode))) {
-                  close(next);
-                  next = -1;
-                }
+                /* Open the resolved directory through a relative no-follow walk
+                   from the authorized-root fd instead of re-opening the
+                   absolute `resolved` path: swapping an intermediate directory
+                   for a symlink between realpath() and open() (TOCTOU) then
+                   merely fails the walk rather than redirecting the fd outside
+                   the root. */
+                next = open_dir_beneath_root(resolved, root);
               }
             }
           }
@@ -640,11 +707,23 @@ bool file_ensure_directory_secure(const char* path) {
     return false;
 
   int dir_fd = openat(parent_fd, leaf, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+  bool created = false;
   if (dir_fd < 0 && errno == ENOENT) {
-    if (mkdirat(parent_fd, leaf, 0755) == 0 || errno == EEXIST)
+    if (mkdirat(parent_fd, leaf, 0755) == 0) {
+      created = true;
       dir_fd = openat(parent_fd, leaf, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+    } else if (errno == EEXIST) {
+      dir_fd = openat(parent_fd, leaf, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+    }
   }
   bool ok = dir_fd >= 0;
+  /* --copy-as owns a directory this call just created (the final component;
+     intermediate components were handled by file_open_secure_parent above).  A
+     failed REQUIRED ownership fails the call rather than leaving the directory
+     owned by the receiver. */
+  if (ok && created && identity_copy_as_active() &&
+      !identity_apply_ownership_link(parent_fd, leaf, 0, 0))
+    ok = false;
   if (dir_fd >= 0)
     close(dir_fd);
   close(parent_fd);
@@ -805,9 +884,15 @@ int file_open_private_dir(const char* dir_path) {
 static void restore_extra_fd(int fd, const FileMetadata* metadata, const FileXattrList* xattrs,
                              bool fake_super) {
   xattr_apply_fd(fd, xattrs);
-  if (fake_super && metadata)
+  if (fake_super && metadata) {
     fake_super_store_fd(fd, (uint32_t)metadata->uid, (uint32_t)metadata->gid,
                         (uint32_t)metadata->mode, metadata->mtime_sec, metadata->mtime_nsec);
+    /* Replay: re-apply the recorded uid/gid/mode/mtime fd-relative so a save
+       under --fake-super restores the attrs (when privileged) instead of only
+       recording them.  Best-effort; fake_super_restore_fd silently skips a
+       non-root fchown EPERM/EACCES and never fatal. */
+    fake_super_restore_fd(fd);
+  }
 }
 
 static bool file_to_disk_secure_impl(const char* path, const void* data,
@@ -815,7 +900,8 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
                                      bool preallocate, const FileMetadata* metadata,
                                      bool preserve_executability, bool update, bool no_replace,
                                      bool use_fsync, const char* temp_dir,
-                                     const FileXattrList* xattrs, bool fake_super) {
+                                     const FileXattrList* xattrs, bool fake_super,
+                                     bool keep_partial) {
   char* leaf = NULL;
   int dirfd = file_open_secure_parent(path, &leaf, true);
   if (dirfd < 0)
@@ -837,13 +923,19 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
         ok = true;
       } else {
         /* Preallocate the expected payload size before writing so an
-           out-of-space condition fails cleanly up front (--preallocate). */
+           out-of-space condition fails cleanly up front (--preallocate).
+           --sparse takes precedence: posix_fallocate would allocate every
+           block, defeating the holes the sparse writer would create, so the
+           two never combine here (the ftruncate presize below stays). */
         int prealloc_rc = 0;
-        if (preallocate && data_size > 0) {
+        if (preallocate && !sparse && data_size > 0) {
           prealloc_rc = preallocate_fd(fd, data_size);
-          if (prealloc_rc != 0)
-            log_message(LOG_LEVEL_ERROR, "preallocate failed for '%s' (%s); transfer aborted", path,
-                        strerror(prealloc_rc));
+          if (prealloc_rc != 0) {
+            char* escaped_path = output_escape(path, log_get_8_bit_output());
+            log_message(LOG_LEVEL_ERROR, "preallocate failed for '%s' (%s); transfer aborted",
+                        escaped_path ? escaped_path : "<allocation failed>", strerror(prealloc_rc));
+            free(escaped_path);
+          }
         }
         if (prealloc_rc == 0) {
           /* posix_fallocate does not guarantee the fd's file offset is left
@@ -852,7 +944,9 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
           if (sparse && data_size > 0)
             ok = ftruncate(fd, (off_t)data_size) == 0;
           if (ok || !sparse || data_size == 0)
-            ok = write_all(fd, data, data_size);
+            ok = sparse && data_size > 0
+                     ? file_store_write_sparse(fd, (const unsigned char*)data, data_size)
+                     : write_all(fd, data, data_size);
           if (ok)
             ok = ftruncate(fd, (off_t)data_size) == 0;
           /* Normalize the mode: apply the metadata-derived safe mode when the
@@ -875,6 +969,10 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
   } else {
     /* The --update newer-destination check runs first so a skipped file never
        creates an empty scratch directory behind it. */
+    /* True once the temp is being written: distinguishes a mid-write/metadata/
+       install failure (partial data may exist, --partial may retain it) from a
+       pre-write validation failure (nothing to retain). */
+    bool write_attempted = false;
     if (update && metadata) {
       /* This check protects the normal atomic path as far as possible.  A
          concurrent replacement can still occur before the final rename. */
@@ -940,18 +1038,28 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
       if (fd < 0)
         continue; /* EEXIST (or a transient open error): try a fresh name. */
       int prealloc_rc = 0;
-      if (preallocate && data_size > 0) {
+      if (preallocate && !sparse && data_size > 0) {
         prealloc_rc = preallocate_fd(fd, data_size);
-        if (prealloc_rc != 0)
-          log_message(LOG_LEVEL_ERROR, "preallocate failed for '%s' (%s); transfer aborted", path,
-                      strerror(prealloc_rc));
+        if (prealloc_rc != 0) {
+          char* escaped_path = output_escape(path, log_get_8_bit_output());
+          log_message(LOG_LEVEL_ERROR, "preallocate failed for '%s' (%s); transfer aborted",
+                      escaped_path ? escaped_path : "<allocation failed>", strerror(prealloc_rc));
+          free(escaped_path);
+        }
       }
       if (prealloc_rc == 0) {
         lseek(fd, 0, SEEK_SET);
         if (sparse && data_size > 0)
           ok = ftruncate(fd, (off_t)data_size) == 0;
-        if (ok || (!sparse || data_size == 0))
-          ok = write_all(fd, data, data_size);
+        /* A real write attempt begins here (the ftruncate presize succeeded or
+           no presize applies): a later mid-write / metadata / fsync / install
+           failure may leave partial data that --partial retention can rename. */
+        if (ok || (!sparse || data_size == 0)) {
+          write_attempted = true;
+          ok = sparse && data_size > 0
+                   ? file_store_write_sparse(fd, (const unsigned char*)data, data_size)
+                   : write_all(fd, data, data_size);
+        }
         if (ok && metadata)
           ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
         if (ok)
@@ -986,8 +1094,21 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
           ok = false;
         }
       }
-      if (!ok)
-        unlinkat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, 0);
+      if (!ok) {
+        /* --partial retention (best-effort): on a failure that happened after
+           the temp held data (mid-write / metadata / fsync / install error),
+           keep the already-written temp at the final destination path instead
+           of unlinking it, so a later --append / --append-verify run can resume.
+           This only ever renames the already-written temp (never a corrupt
+           blend); the rename can fail (cross-device, permissions) and we then
+           fall through to the normal unlink cleanup.  Never retains when
+           keep_partial is off, when nothing was actually written, or under
+           --ignore-existing/--existing (no_replace), where the destination is
+           not ours to overwrite. */
+        if (!keep_partial || !write_attempted || no_replace ||
+            renameat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, dirfd, leaf) != 0)
+          unlinkat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, 0);
+      }
       /* Once the temp fd was created the outcome is permanent: a write,
          metadata, fsync, close, linkat or renameat failure will not be fixed
          by retrying under a fresh name, so stop here.  Only the open-failure
@@ -1010,7 +1131,7 @@ bool file_to_disk_secure(const char* path, const void* data, unsigned long long
                          bool preserve_executability, const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                   preserve_executability, false, false, false, temp_dir, NULL,
-                                  false);
+                                  false, false);
 }
 
 bool file_to_disk_secure_update(const char* path, const void* data, unsigned long long data_size,
@@ -1018,7 +1139,7 @@ bool file_to_disk_secure_update(const char* path, const void* data, unsigned lon
                                 const FileMetadata* metadata, bool preserve_executability,
                                 const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
-                                  preserve_executability, true, false, false, temp_dir, NULL,
+                                  preserve_executability, true, false, false, temp_dir, NULL, false,
                                   false);
 }
 
@@ -1029,7 +1150,7 @@ bool file_to_disk_secure_with_fsync(const char* path, const void* data,
                                     const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                   preserve_executability, false, false, use_fsync, temp_dir, NULL,
-                                  false);
+                                  false, false);
 }
 
 bool file_to_disk_secure_no_replace(const char* path, const void* data,
@@ -1037,22 +1158,24 @@ bool file_to_disk_secure_no_replace(const char* path, const void* data,
                                     const FileMetadata* metadata, bool preserve_executability,
                                     const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, false, sparse, preallocate, metadata,
-                                  preserve_executability, false, true, false, temp_dir, NULL,
+                                  preserve_executability, false, true, false, temp_dir, NULL, false,
                                   false);
 }
 
 /* Receiver write-path variant that also applies the per-file xattrs (-X/-A)
  * and, under --fake-super, parks the source stat in the reserved xattr, on the
  * just-written file descriptor before the final rename.  `no_replace` / `update`
- * mirror the plain wrappers; see file_to_disk_secure_impl for the semantics. */
+ * mirror the plain wrappers; `keep_partial` enables --partial retention of a
+ * failed write's temp.  See file_to_disk_secure_impl for the semantics. */
 bool file_to_disk_secure_attrs(const char* path, const void* data, unsigned long long data_size,
                                bool inplace, bool sparse, bool preallocate,
                                const FileMetadata* metadata, bool preserve_executability,
                                bool update, bool no_replace, bool use_fsync,
-                               const FileXattrList* xattrs, bool fake_super, const char* temp_dir) {
+                               const FileXattrList* xattrs, bool fake_super, bool keep_partial,
+                               const char* temp_dir) {
   return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                   preserve_executability, update, no_replace, use_fsync, temp_dir,
-                                  xattrs, fake_super);
+                                  xattrs, fake_super, keep_partial);
 }
 
 /* Atomic --link-dest install.  The destination is replaced (via a temporary
@@ -1155,7 +1278,7 @@ static bool file_to_disk_secure_link_impl(const char* path, const char* basis_pa
        by the filesystem).  Write a byte-identical local copy instead. */
     return file_to_disk_secure_attrs(path, data, data_size, false, false, preallocate, metadata,
                                      preserve_executability, false, false, use_fsync, xattrs,
-                                     fake_super, temp_dir);
+                                     fake_super, false, temp_dir);
   }
 
   if (scratch_dirfd >= 0)

src/shared/file.h

@@ -113,12 +113,14 @@ bool file_to_disk_secure_no_replace(const char* path, const void* data,
                                     const char* temp_dir);
 /* Receiver write-path variant that also applies per-file xattrs (-X/-A) and the
  * --fake-super stat xattr fd-relative before the final rename.  `update` /
- * `no_replace` / `use_fsync` mirror the plain wrappers above. */
+ * `no_replace` / `use_fsync` mirror the plain wrappers above; `keep_partial`
+ * enables --partial best-effort retention of a failed write's temp. */
 bool file_to_disk_secure_attrs(const char* path, const void* data, unsigned long long data_size,
                                bool inplace, bool sparse, bool preallocate,
                                const FileMetadata* metadata, bool preserve_executability,
                                bool update, bool no_replace, bool use_fsync,
-                               const FileXattrList* xattrs, bool fake_super, const char* temp_dir);
+                               const FileXattrList* xattrs, bool fake_super, bool keep_partial,
+                               const char* temp_dir);
 /* Atomic --link-dest install: replace `path` with a hard link to `basis_path`
    (via a temp name + rename); fall back to a byte-identical local copy from
    `data` when the link is impossible (EXDEV/EPERM/unsupported filesystem).

src/shared/file_receive.c

@@ -10,6 +10,7 @@
 #include <unistd.h>
 
 #include "array_list.h"
+#include "charset.h"
 #include "chmod.h"
 #include "compression.h"
 #include "config.h"
@@ -17,6 +18,7 @@
 #include "delay_updates.h"
 #include "delta.h"
 #include "file.h"
+#include "identity.h"
 #include "log.h"
 #include "metadata.h"
 #include "protocol.h"
@@ -86,10 +88,10 @@ static FileSaveResult file_stage_delayed_update(const char* root_directory,
                                   config->preallocate, metadata, preserve_executability,
                                   config->use_fsync, NULL);
   } else {
-    ok =
-        file_to_disk_secure_attrs(staged_path, file->data->data, file->data->size, false, sparse,
-                                  config->preallocate, metadata, preserve_executability, false,
-                                  false, config->use_fsync, file->xattrs, config->fake_super, NULL);
+    ok = file_to_disk_secure_attrs(staged_path, file->data->data, file->data->size, false, sparse,
+                                   config->preallocate, metadata, preserve_executability, false,
+                                   false, config->use_fsync, file->xattrs, config->fake_super,
+                                   false, NULL);
   }
   if (!ok) {
     free(staged_path);
@@ -348,12 +350,29 @@ static FileSaveResult file_save_special_to_disk(const char* root_directory, cons
   }
   if (is_sock) {
     /* No standard filesystem call recreates a socket; best-effort unsupported. */
-    log_message(LOG_LEVEL_WARNING, "socket not recreated: %s (unsupported; skipped)", file->path);
+    char* escaped_path = output_escape(file->path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_WARNING, "socket not recreated: %s (unsupported; skipped)",
+                escaped_path ? escaped_path : "<allocation failed>");
+    free(escaped_path);
     return FILE_SAVE_SKIPPED;
   }
   if (is_char || is_blk) {
     if (!config || !config->preserve_devices)
       return FILE_SAVE_SKIPPED;
+    /* --super / --no-super (P7 Wave E): char/block device-node creation is a
+       super-user activity.  --no-super forbids it even for a root receiver;
+       AUTO and --super attempt it (an unprivileged attempt is refused by the
+       kernel and skipped).  The helper is evaluated against THIS config's mode
+       so the policy does not depend on a prior identity_set_active().  Pure
+       FIFO creation is unprivileged and deliberately NOT gated here. */
+    if (!privilege_super_mode_permitted(config->super_mode)) {
+      char* escaped_path = output_escape(file->path, log_get_8_bit_output());
+      log_message(LOG_LEVEL_WARNING,
+                  "skipping %s: super-user device-node creation is not permitted on this receiver",
+                  escaped_path ? escaped_path : "<allocation failed>");
+      free(escaped_path);
+      return FILE_SAVE_SKIPPED;
+    }
   } else if (is_fifo) {
     if (!config || !config->preserve_specials)
       return FILE_SAVE_SKIPPED;
@@ -424,18 +443,26 @@ static FileSaveResult file_save_special_to_disk(const char* root_directory, cons
         free(destination);
         return FILE_SAVE_SKIPPED;
       }
+      char* escaped_path = output_escape(file->path, log_get_8_bit_output());
       log_message(LOG_LEVEL_WARNING, "refusing to replace existing entry with %s: %s (skipped)",
-                  is_fifo ? "FIFO" : "device", file->path);
+                  is_fifo ? "FIFO" : "device", escaped_path ? escaped_path : "<allocation failed>");
+      free(escaped_path);
     } else if (errno == EPERM || errno == EACCES) {
       /* Missing CAP_MKNOD / parent write permission: the environment cannot
          create the node, so skip instead of failing the whole run. */
+      char* escaped_path = output_escape(file->path, log_get_8_bit_output());
       log_message(LOG_LEVEL_WARNING,
                   "skipping %s: cannot create %s node (%s)\n"
                   "  --devices/--specials node creation needs privilege (CAP_MKNOD)",
-                  file->path, is_fifo ? "FIFO" : "device", strerror(errno));
+                  escaped_path ? escaped_path : "<allocation failed>", is_fifo ? "FIFO" : "device",
+                  strerror(errno));
+      free(escaped_path);
     } else {
+      char* escaped_path = output_escape(file->path, log_get_8_bit_output());
       log_message(LOG_LEVEL_WARNING, "failed to create %s %s: %s (skipped)",
-                  is_fifo ? "FIFO" : "device", file->path, strerror(errno));
+                  is_fifo ? "FIFO" : "device", escaped_path ? escaped_path : "<allocation failed>",
+                  strerror(errno));
+      free(escaped_path);
     }
     close(parent_fd);
     free(leaf);
@@ -443,16 +470,26 @@ static FileSaveResult file_save_special_to_disk(const char* root_directory, cons
     return FILE_SAVE_SKIPPED;
   }
 
-  /* Apply mtime on the fresh node (utimensat, no-follow).  Ownership is not
-     applied -- identity fchown needs an fd and would require opening the node. */
+  /* Apply mtime on the fresh node (utimensat, no-follow). */
   struct timespec times[2] = {
       {.tv_sec = 0, .tv_nsec = UTIME_OMIT},
       {.tv_sec = file->metadata->mtime_sec, .tv_nsec = file->metadata->mtime_nsec}};
   utimensat(parent_fd, leaf, times, AT_SYMLINK_NOFOLLOW);
+  /* P7 Wave E: apply the negotiated ownership to the node ITSELF.  A FIFO is
+     created unprivileged, but --copy-as and explicit identity policies own
+     every entry (a char/block node path is already privilege-gated above).  The
+     no-follow helper changes the node's own ownership without dereferencing it;
+     it is a no-op unless an identity policy is active. */
+  bool owner_ok = true;
+  if (identity_active_enabled())
+    owner_ok = identity_apply_ownership_link(parent_fd, leaf, (int32_t)file->metadata->uid,
+                                             (int32_t)file->metadata->gid);
   close(parent_fd);
   free(leaf);
   free(destination);
-  return FILE_SAVE_WRITTEN;
+  /* A failed required --copy-as ownership marks the node as failed; every other
+   * identity policy stays best-effort. */
+  return owner_ok ? FILE_SAVE_WRITTEN : FILE_SAVE_ERROR;
 }
 
 /* --write-devices (receiver): write the received data directly into an EXISTING
@@ -488,22 +525,28 @@ static FileSaveResult file_save_write_device(const char* root_directory, const F
   close(parent_fd);
   if (fd < 0) {
     free(destination);
+    char* escaped_path = output_escape(file->path, log_get_8_bit_output());
+    const char* shown_path = escaped_path ? escaped_path : "<allocation failed>";
     if (saved_errno == ENXIO || saved_errno == EAGAIN) {
       /* A FIFO with no reader / an unreadable special: skip like every other
          unusable write-devices target instead of blocking or failing. */
-      log_message(LOG_LEVEL_WARNING, "write-devices: %s not writable (%s); skipped", file->path,
+      log_message(LOG_LEVEL_WARNING, "write-devices: %s not writable (%s); skipped", shown_path,
                   strerror(saved_errno));
     } else {
-      log_message(LOG_LEVEL_WARNING, "write-devices: cannot open %s (%s); skipped", file->path,
+      log_message(LOG_LEVEL_WARNING, "write-devices: cannot open %s (%s); skipped", shown_path,
                   strerror(saved_errno));
     }
+    free(escaped_path);
     return FILE_SAVE_SKIPPED;
   }
   struct stat st;
   if (fstat(fd, &st) != 0 || !(S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode))) {
     close(fd);
     free(destination);
-    log_message(LOG_LEVEL_WARNING, "write-devices: %s is not a device node; skipped", file->path);
+    char* escaped_path = output_escape(file->path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_WARNING, "write-devices: %s is not a device node; skipped",
+                escaped_path ? escaped_path : "<allocation failed>");
+    free(escaped_path);
     return FILE_SAVE_SKIPPED;
   }
   bool ok = true;
@@ -550,13 +593,38 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
     return FILE_SAVE_ERROR;
   }
 
+  /* P7 Wave D #1: a STATUS_DIR_TIMES entry is RECORD-ONLY.  The scanner
+     captures every traversed directory -- including empty ones whose parents
+     were never created by a child write and directories pruned by
+     -m/--prune-empty-dirs.  Creating them here would resurrect empty
+     directories (an -a behavior change) and could abort the whole transfer on a
+     pre-existing regular file/symlink at the mirror path.  Short-circuit before
+     any device/write-devices/directory branch and report it as skipped so the
+     sink still accumulates its metadata for the deferred DirTimeList
+     application, but create nothing. */
+  if (file->dir_time_only)
+    return FILE_SAVE_SKIPPED;
+
   /* Device/special node (--devices/--specials): recreate the node instead of
      writing content (privilege-gated, confined, rdev-validated). */
   if (file->is_special)
     return file_save_special_to_disk(root_directory, file, config);
-  /* --write-devices: write straight into an existing device node. */
-  if (config && config->write_devices)
+  /* --write-devices: write straight into an existing device node.  Writing
+     into a device is a super-user activity, so --no-super must suppress it just
+     like device-node creation; the default AUTO/--super attempt it (the wide
+     open below keeps its own confinement and best-effort skip semantics). */
+  if (config && config->write_devices) {
+    if (!privilege_super_mode_permitted(config->super_mode)) {
+      char* escaped_path = output_escape(file->path, log_get_8_bit_output());
+      log_message(LOG_LEVEL_WARNING,
+                  "write-devices: %s skipped: super-user activities are not permitted on this "
+                  "receiver",
+                  escaped_path ? escaped_path : "(null)");
+      free(escaped_path);
+      return FILE_SAVE_SKIPPED;
+    }
     return file_save_write_device(root_directory, file);
+  }
 
   /* Explicit directory entries (--dirs) carry an empty payload; the entry is
      created as a directory under the receive root, applying the same secure
@@ -572,6 +640,27 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
     if (!dir_path)
       return FILE_SAVE_ERROR;
     bool ok = file_ensure_directory_secure(dir_path);
+    /* P7 Wave E: apply the negotiated ownership to the directory ITSELF (not
+       just the files inside it).  --copy-as and every explicit identity policy
+       own every entry, so a directory must not keep the receiver's owner while
+       its children get the policy owner.  Applied no-follow on the confined
+       parent fd after the mkdir; identity_apply_ownership_link() is itself a
+       no-op unless an identity policy is active. */
+    if (ok && file->metadata && identity_active_enabled()) {
+      char* leaf = NULL;
+      int parent_fd = file_open_secure_parent(dir_path, &leaf, false);
+      if (parent_fd >= 0) {
+        if (!identity_apply_ownership_link(parent_fd, leaf, (int32_t)file->metadata->uid,
+                                           (int32_t)file->metadata->gid))
+          ok = false;
+        close(parent_fd);
+      } else if (identity_copy_as_active()) {
+        /* The directory exists (ok) but its required --copy-as ownership could
+           not be applied because the confined parent could not be opened. */
+        ok = false;
+      }
+      free(leaf);
+    }
     free(dir_path);
     return ok ? FILE_SAVE_WRITTEN : FILE_SAVE_ERROR;
   }
@@ -615,11 +704,20 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
     }
     char* parent = str_dup(link_path);
     if (parent) {
-      file_ensure_directory_secure(dirname(parent));
+      /* Propagate a failed --copy-as ownership of the parent directory this
+         creates; every other failure mode stays best-effort as before. */
+      ok = file_ensure_directory_secure(dirname(parent));
       free(parent);
     }
-    ok = file_symlink_at_secure(link_path, target);
+    if (ok)
+      ok = file_symlink_at_secure(link_path, target);
     free(target);
+    /* P7 Wave D: apply the symlink's own metadata with no-follow primitives
+       (utimensat/lchown/fchmodat AT_SYMLINK_NOFOLLOW).  -J/--omit-link-times
+       suppresses the timestamps; ownership stays gated by the identity policy.
+       A symlink has no children, so this can be applied immediately. */
+    if (ok && config && config->use_metadata)
+      ok = file_restore_symlink_metadata(link_path, file->metadata, config->omit_link_times);
     free(link_path);
     return ok ? FILE_SAVE_WRITTEN : FILE_SAVE_ERROR;
   }
@@ -795,11 +893,11 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
   } else {
     /* The plain no-replace / update / with-fsync engines, plus per-file xattr
        (-X/-A) and --fake-super application on the written fd. */
-    ok = file_to_disk_secure_attrs(disk_path, file->data->data, file->data->size, inplace, sparse,
-                                   config && config->preallocate, metadata, preserve_executability,
-                                   config && config->update, config && config->ignore_existing,
-                                   config && config->use_fsync, file->xattrs,
-                                   config ? config->fake_super : false, confined_temp);
+    ok = file_to_disk_secure_attrs(
+        disk_path, file->data->data, file->data->size, inplace, sparse,
+        config && config->preallocate, metadata, preserve_executability, config && config->update,
+        config && config->ignore_existing, config && config->use_fsync, file->xattrs,
+        config ? config->fake_super : false, config ? config->partial : false, confined_temp);
   }
   free(confined_temp);
   confined_temp = NULL;
@@ -1555,7 +1653,7 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
     return NULL;
   }
   *skipped = false;
-  char* check_path = receive_str(fd);
+  char* check_path = receive_wire_str(fd);
   if (check_path == NULL) {
     return NULL;
   }
@@ -2082,7 +2180,7 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
 }
 
 File* file_receive(const Config* config, int file_descriptor) {
-  char* path = receive_str(file_descriptor);
+  char* path = receive_wire_str(file_descriptor);
   if (path == NULL)
     return NULL;
   if (path[0] == '\0' || (!file_get_trust_sender() && has_path_traversal(path))) {
@@ -2136,13 +2234,120 @@ File* file_receive(const Config* config, int file_descriptor) {
   return file;
 }
 
+/* ---- P7 Wave D: deferred directory times ---- */
+
+void dir_time_list_init(DirTimeList* list) {
+  if (!list)
+    return;
+  list->paths = NULL;
+  list->entries = NULL;
+  list->count = 0;
+  list->capacity = 0;
+}
+
+void dir_time_list_free(DirTimeList* list) {
+  if (!list)
+    return;
+  for (size_t i = 0; i < list->count; i++)
+    free(list->paths[i]);
+  free(list->paths);
+  free(list->entries);
+  list->paths = NULL;
+  list->entries = NULL;
+  list->count = 0;
+  list->capacity = 0;
+}
+
+bool dir_time_list_add(DirTimeList* list, const char* wire_path, const FileMetadata* metadata) {
+  if (!list || !wire_path || !metadata)
+    return true; /* nothing to remember; never a hard error */
+  if (list->count == list->capacity) {
+    size_t new_capacity = list->capacity == 0 ? 16 : list->capacity * 2;
+    if (new_capacity < list->capacity)
+      return false;
+    /* Assign each grown array as soon as its realloc succeeds: the old block is
+       already freed by then, so discarding the pointer would dangle.  capacity
+       is advanced only after BOTH reallocs succeed, so a partial failure leaves
+       capacity no larger than the entries allocation (the paths array may be
+       over-allocated, which is harmless) -- never a mismatched list the next
+       add could write past. */
+    char** grown_paths = realloc(list->paths, new_capacity * sizeof(char*));
+    if (!grown_paths)
+      return false;
+    list->paths = grown_paths;
+    FileMetadata* grown_entries = realloc(list->entries, new_capacity * sizeof(FileMetadata));
+    if (!grown_entries)
+      return false;
+    list->entries = grown_entries;
+    list->capacity = new_capacity;
+  }
+  char* copy = str_dup(wire_path);
+  if (!copy)
+    return false;
+  list->paths[list->count] = copy;
+  list->entries[list->count] = *metadata;
+  list->count++;
+  return true;
+}
+
+void dir_time_list_apply(const DirTimeList* list, const char* root_directory) {
+  if (!list || !root_directory)
+    return;
+  for (size_t i = 0; i < list->count; i++) {
+    char* dir_path = path_cat(root_directory, list->paths[i]);
+    if (!dir_path)
+      continue;
+    char* leaf = NULL;
+    /* The parent walk is fd-relative and O_NOFOLLOW, so a symlink planted in a
+       parent component can never redirect the utimensat outside the root. */
+    int parent_fd = file_open_secure_parent(dir_path, &leaf, false);
+    if (parent_fd < 0) {
+      free(dir_path);
+      continue;
+    }
+    /* A dir-time entry only records metadata: the directory is (deliberately)
+       not created from it, so an empty source directory (or one pruned by
+       -m/--prune-empty-dirs) may well not exist here.  Skip absent paths
+       QUIETLY rather than warning for every one, and apply the times only to a
+       real directory that does exist.  AT_SYMLINK_NOFOLLOW keeps a same-named
+       symlink from being followed; a pre-existing regular file/symlink is not a
+       directory, so it is left completely untouched. */
+    struct stat st;
+    if (fstatat(parent_fd, leaf, &st, AT_SYMLINK_NOFOLLOW) != 0 || !S_ISDIR(st.st_mode)) {
+      close(parent_fd);
+      free(leaf);
+      free(dir_path);
+      continue;
+    }
+    struct timespec times[2] = {
+        {.tv_sec = 0, .tv_nsec = UTIME_OMIT},
+        {.tv_sec = list->entries[i].mtime_sec, .tv_nsec = list->entries[i].mtime_nsec}};
+    if (list->entries[i].atime_valid) {
+      times[0].tv_sec = list->entries[i].atime_sec;
+      times[0].tv_nsec = list->entries[i].atime_nsec;
+    }
+    if (utimensat(parent_fd, leaf, times, AT_SYMLINK_NOFOLLOW) != 0) {
+      char* escaped_path = output_escape(dir_path, log_get_8_bit_output());
+      log_message(LOG_LEVEL_WARNING, "Failed to set directory timestamps on %s: %s",
+                  escaped_path ? escaped_path : "<allocation failed>", strerror(errno));
+      free(escaped_path);
+    }
+    close(parent_fd);
+    free(leaf);
+    free(dir_path);
+  }
+}
+
 /* Receive an explicit directory entry (--dirs): a STATUS_MKDIR frame carries
-   only the destination path; the entry carries no payload.  The same path
-   validation as a regular file applies (non-empty, relative-or-mirrored, no
-   traversal), and the created File is routed through the regular store_file
-   sink so single-threaded and -m receivers handle directories identically. */
-File* file_receive_directory(int file_descriptor) {
-  char* path = receive_str(file_descriptor);
+   the destination path and, when metadata is negotiated, the directory's
+   metadata frame.  The same path validation as a regular file applies
+   (non-empty, relative-or-mirrored, no traversal), and the created File is
+   routed through the regular store_file sink so single-threaded and -m
+   receivers handle directories identically.  The metadata is NOT applied here:
+   the sink accumulates it into a DirTimeList that is applied only after the
+   whole transfer (children would otherwise clobber the directory mtime). */
+File* file_receive_directory(int file_descriptor, const Config* config) {
+  char* path = receive_wire_str(file_descriptor);
   if (path == NULL)
     return NULL;
   if (path[0] == '\0' || (!file_get_trust_sender() && has_path_traversal(path))) {
@@ -2158,6 +2363,50 @@ File* file_receive_directory(int file_descriptor) {
   if (file == NULL)
     return NULL;
   file->is_dir = true;
+  if (config && config->use_metadata) {
+    int meta_ok = 1;
+    file->metadata = metadata_receive(file_descriptor, &meta_ok);
+    if (!meta_ok) {
+      file_destroy(file);
+      return NULL;
+    }
+  }
+  return file;
+}
+
+/* Receive one directory-time entry from a STATUS_DIR_TIMES frame: the
+ * destination-relative wire path and (when metadata is negotiated) the
+ * directory's metadata frame.  The created File is an is_dir, dir_time_only
+ * entry routed through the regular store_file sink: the sink records its
+ * metadata into the deferred DirTimeList but never creates the directory (the
+ * scanner captures every traversed directory, including empty ones).  Unlike a
+ * STATUS_MKDIR entry, this one must not create anything. */
+File* file_receive_dir_time(int file_descriptor, const Config* config) {
+  char* path = receive_wire_str(file_descriptor);
+  if (path == NULL)
+    return NULL;
+  if (path[0] == '\0' || (!file_get_trust_sender() && has_path_traversal(path))) {
+    char* escaped_path = output_escape(path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_ERROR, "Invalid received directory-time path: %s",
+                escaped_path ? escaped_path : "<allocation failed>");
+    free(escaped_path);
+    free(path);
+    return NULL;
+  }
+  File* file = file_create(path);
+  free(path);
+  if (!file)
+    return NULL;
+  file->is_dir = true;
+  file->dir_time_only = true;
+  if (config && config->use_metadata) {
+    int meta_ok = 1;
+    file->metadata = metadata_receive(file_descriptor, &meta_ok);
+    if (!meta_ok) {
+      file_destroy(file);
+      return NULL;
+    }
+  }
   return file;
 }
 
@@ -2169,7 +2418,7 @@ File* file_receive_directory(int file_descriptor) {
    member.  All paths are validated like every other received path (non-empty,
    relative, no traversal). */
 File* file_receive_hardlink(int file_descriptor) {
-  char* path = receive_str(file_descriptor);
+  char* path = receive_wire_str(file_descriptor);
   if (path == NULL)
     return NULL;
   if (path[0] == '\0' || (!file_get_trust_sender() && has_path_traversal(path))) {
@@ -2186,7 +2435,7 @@ File* file_receive_hardlink(int file_descriptor) {
     free(path);
     return NULL;
   }
-  char* target = receive_str(file_descriptor);
+  char* target = receive_wire_str(file_descriptor);
   if (!target) {
     free(path);
     return NULL;
@@ -2219,7 +2468,7 @@ File* file_receive_hardlink(int file_descriptor) {
    routed through the regular store_file sink, which creates the link beneath
    the receive root (unmungeing the target first). */
 File* file_receive_symlink(int file_descriptor, const Config* config) {
-  char* path = receive_str(file_descriptor);
+  char* path = receive_wire_str(file_descriptor);
   if (path == NULL)
     return NULL;
   if (path[0] == '\0' || (!file_get_trust_sender() && has_path_traversal(path))) {
@@ -2231,7 +2480,7 @@ File* file_receive_symlink(int file_descriptor, const Config* config) {
     send_status(file_descriptor, STATUS_ERROR);
     return NULL;
   }
-  char* target = receive_str(file_descriptor);
+  char* target = receive_wire_str(file_descriptor);
   if (!target) {
     free(path);
     return NULL;
@@ -2274,7 +2523,7 @@ File* file_receive_symlink(int file_descriptor, const Config* config) {
  * confined).  rdev is validated here (non-negative, range-checked) so a bogus
  * value cannot drive a dangerous node on the receiver. */
 File* file_receive_special(int file_descriptor) {
-  char* path = receive_str(file_descriptor);
+  char* path = receive_wire_str(file_descriptor);
   if (path == NULL)
     return NULL;
   if (path[0] == '\0' || (!file_get_trust_sender() && has_path_traversal(path))) {
@@ -2354,7 +2603,7 @@ static bool receive_manifest_section(int fd, ArrayList* list, size_t* manifest_b
     return false;
   }
   for (int i = 0; i < count; i++) {
-    char* s = receive_str(fd);
+    char* s = receive_wire_str(fd);
     size_t entry_size = s ? strlen(s) : 0;
     if (!s || s[0] == '\0' || s[0] == '/' || has_path_traversal(s) ||
         entry_size > MAX_MANIFEST_BYTES - *manifest_bytes ||

src/shared/file_receive.h

@@ -8,13 +8,40 @@
 /* Server-side file receive/save path. */
 
 File* file_receive(const Config* config, int file_descriptor);
-File* file_receive_directory(int file_descriptor);
+File* file_receive_directory(int file_descriptor, const Config* config);
+File* file_receive_dir_time(int file_descriptor, const Config* config);
 File* file_receive_hardlink(int file_descriptor);
 File* file_receive_symlink(int file_descriptor, const Config* config);
 File* file_receive_special(int file_descriptor);
 bool file_special_rdev_valid(int32_t major, int32_t minor, mode_t mode);
 File* receive_incremental_check(int fd, const Config* config, bool* skipped);
 
+/* P7 Wave D directory-time accumulator.  The receiver collects the metadata of
+ * every directory it creates/receives (STATUS_MKDIR with metadata and/or the
+ * trailing STATUS_DIR_TIMES frame(s)) and applies the times only at the END of the
+ * transfer, after all children have been written and after the delete /
+ * --delay-updates phases have committed (writing or removing a child bumps the
+ * parent's mtime).  -O/--omit-dir-times skips the application entirely.  The
+ * list owns deep copies of the paths and metadata; freed on every path. */
+typedef struct {
+  char** paths;          /* owned, destination-relative wire paths */
+  FileMetadata* entries; /* owned, parallel to paths */
+  size_t count;
+  size_t capacity;
+} DirTimeList;
+
+void dir_time_list_init(DirTimeList* list);
+void dir_time_list_free(DirTimeList* list);
+/* Deep-copy one directory's path + metadata into the list.  Returns false on
+ * allocation failure (the caller fails the transfer). */
+bool dir_time_list_add(DirTimeList* list, const char* wire_path, const FileMetadata* metadata);
+/* Apply every accumulated directory's mtime (and atime when captured) beneath
+ * `root_directory`, confined fd-relative.  Best-effort per entry: an absent
+ * directory (an empty/pruned source dir that was deliberately not created) or a
+ * non-directory at the path is skipped QUIETLY, an unreachable one with a
+ * warning, and never fatal. */
+void dir_time_list_apply(const DirTimeList* list, const char* root_directory);
+
 /* A received delete-manifest frame: the keep-set (`keeps`, destination-relative
    paths the sender transferred/keeps) plus `protected`, destination-relative
    prefixes the sender asks the receiver never to delete (paths excluded on the

src/shared/file_send.c

@@ -10,6 +10,7 @@
 #include <time.h>
 #include <unistd.h>
 
+#include "charset.h"
 #include "compression.h"
 #include "data.h"
 #include "file.h"
@@ -27,7 +28,7 @@ bool file_send_special(const File* file, int file_descriptor, bool use_metadata)
     return false;
   if (!send_status(file_descriptor, STATUS_SPECIAL))
     return false;
-  if (!send_str(file_descriptor, file_wire_path(file)))
+  if (!send_wire_str(file_descriptor, file_wire_path(file)))
     return false;
   if (use_metadata && !metadata_send(file_descriptor, file->metadata))
     return false;
@@ -61,7 +62,7 @@ bool file_send_single_calls_with_skip(File* file, int file_descriptor, bool use_
     }
     data_to_send = compressed_data;
   }
-  if (send_path && !send_str(file_descriptor, file_wire_path(file))) {
+  if (send_path && !send_wire_str(file_descriptor, file_wire_path(file))) {
     data_destroy(compressed_data);
     return false;
   }
@@ -97,7 +98,7 @@ bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_meta
                                             send_path, skip_suffixes, skip_count,
                                             compression_threads, send_xattrs);
 
-  if (send_path && !send_str(file_descriptor, file_wire_path(file)))
+  if (send_path && !send_wire_str(file_descriptor, file_wire_path(file)))
     return false;
   if (use_metadata && !metadata_send(file_descriptor, file->metadata))
     return false;

src/shared/file_store.c

@@ -139,6 +139,44 @@ static bool write_all(int fd, const void* data, unsigned long long size) {
   return true;
 }
 
+/* A run of NUL bytes at least this long is emitted as a hole (lseek) rather
+ * than written, so the resulting file is genuinely sparse on the filesystem. */
+#define SPARSE_HOLE_MIN 4096U
+
+/* Sparse-aware writer (--sparse/-S).  Walks `data`; any all-zero run of at
+ * least SPARSE_HOLE_MIN bytes is skipped with lseek(SEEK_CUR) so the block is
+ * never allocated (a real hole on the destination); every other byte is written
+ * normally.  The file is pre-sized with ftruncate by the callers before this
+ * runs, so holes are guaranteed and the offset bookkeeping stays correct
+ * (each lseek advances the fd offset exactly as a write of that many bytes
+ * would).  After the final run, ftruncate(size) guarantees the logical size is
+ * exactly `size` even when the tail was a hole.  The full file image is in
+ * memory, so no wire change is needed.  Returns false on I/O error. */
+bool file_store_write_sparse(int fd, const unsigned char* data, unsigned long long size) {
+  unsigned long long i = 0;
+  while (i < size) {
+    if (data[i] == 0) {
+      unsigned long long run_start = i;
+      while (i < size && data[i] == 0)
+        i++;
+      unsigned long long run_len = i - run_start;
+      if (run_len >= SPARSE_HOLE_MIN) {
+        if (lseek(fd, (off_t)run_len, SEEK_CUR) < 0)
+          return false;
+      } else if (!write_all(fd, data + run_start, run_len)) {
+        return false;
+      }
+    } else {
+      unsigned long long run_start = i;
+      while (i < size && data[i] != 0)
+        i++;
+      if (!write_all(fd, data + run_start, i - run_start))
+        return false;
+    }
+  }
+  return ftruncate(fd, (off_t)size) == 0;
+}
+
 bool file_store_write_secure(const char* path, const void* data, unsigned long long data_size,
                              bool inplace, bool sparse, const FileMetadata* metadata,
                              bool preserve_executability) {
@@ -151,8 +189,12 @@ bool file_store_write_secure(const char* path, const void* data, unsigned long l
   if (inplace) {
     fd = openat(dirfd, leaf, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC | O_NOFOLLOW, 0644);
     if (fd >= 0) {
-      if (!sparse || data_size == 0 || ftruncate(fd, (off_t)data_size) == 0)
+      if (sparse && data_size > 0) {
+        if (ftruncate(fd, (off_t)data_size) == 0)
+          ok = file_store_write_sparse(fd, data, data_size);
+      } else {
         ok = write_all(fd, data, data_size);
+      }
       if (ok && metadata)
         ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
     }
@@ -177,7 +219,9 @@ bool file_store_write_secure(const char* path, const void* data, unsigned long l
       if (sparse && data_size > 0)
         ok = ftruncate(fd, (off_t)data_size) == 0;
       if (ok || (!sparse || data_size == 0))
-        ok = write_all(fd, data, data_size);
+        ok = (sparse && data_size > 0)
+                 ? file_store_write_sparse(fd, (const unsigned char*)data, data_size)
+                 : write_all(fd, data, data_size);
       if (ok && metadata)
         ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
       if (close(fd) != 0)

src/shared/file_store.h

@@ -10,5 +10,12 @@ bool file_store_rename_secure(const char* old_path, const char* new_path);
 bool file_store_write_secure(const char* path, const void* data, unsigned long long data_size,
                              bool inplace, bool sparse, const FileMetadata* metadata,
                              bool preserve_executability);
+/* Sparse-aware write (--sparse/-S): every all-zero run of at least
+ * SPARSE_HOLE_MIN bytes is skipped with lseek(SEEK_CUR) so it becomes a real
+ * hole; every other byte is written.  The caller pre-sizes the file with
+ * ftruncate; this function also ftruncate()s to `size` at the end so a trailing
+ * hole keeps the exact logical length.  Shared by the file_store and file write
+ * paths.  Returns false on write/lseek/ftruncate error. */
+bool file_store_write_sparse(int fd, const unsigned char* data, unsigned long long size);
 
 #endif

src/shared/file_types.h

@@ -42,6 +42,14 @@ typedef struct {
   /* True when this entry is an explicit directory entry (--dirs mode): the
    * receiver creates the directory instead of writing a regular file. */
   bool is_dir;
+  /* Receiver-only (P7 Wave D): this is a STATUS_DIR_TIMES entry.  It carries a
+   * traversed source directory's metadata for DEFERRED application, but must
+   * NEVER create the directory: the scanner captures every traversed directory
+   * (including empty ones whose parents no child write created), so creation
+   * would resurrect the empty dirs that FastSync deliberately never transfers.
+   * file_save_to_disk_full short-circuits such an entry as FILE_SAVE_SKIPPED,
+   * and the sink still accumulates the metadata into its DirTimeList. */
+  bool dir_time_only;
   /* Receiver-only, --link-dest: when set, install the destination entry as a
    * hard link to this absolute (root-confined) path instead of writing
    * `data`.  The matching code has already verified the link target's content

src/shared/identity.c

@@ -2,6 +2,7 @@
 #include "log.h"
 #include "utils.h"
 #include <errno.h>
+#include <fcntl.h>
 #include <grp.h>
 #include <limits.h>
 #include <pwd.h>
@@ -26,6 +27,15 @@ typedef struct {
   int usermap_count;
   IdentityMap* groupmap;
   int groupmap_count;
+  /* --super / --no-super tri-state (SUPER_MODE_AUTO when unset).  Snapshotted
+   * per connection so privilege_super_permitted() can gate super-user
+   * activities without a Config argument. */
+  int super_mode;
+  /* --copy-as=USER[:GROUP]: snapshotted so the ownership resolver can force the
+   * target ids without a Config argument. */
+  bool copy_as_set;
+  int32_t copy_as_uid;
+  int32_t copy_as_gid;
   bool set;
 } IdentityActive;
 
@@ -43,6 +53,10 @@ static void identity_active_reset(void) {
   g_identity.chown_uid = 0;
   g_identity.chown_gid_set = false;
   g_identity.chown_gid = 0;
+  g_identity.super_mode = SUPER_MODE_AUTO;
+  g_identity.copy_as_set = false;
+  g_identity.copy_as_uid = 0;
+  g_identity.copy_as_gid = 0;
   g_identity.set = false;
 }
 
@@ -50,41 +64,77 @@ void identity_clear_active(void) {
   identity_active_reset();
 }
 
-void identity_set_active(const Config* config) {
+bool identity_set_active(const Config* config) {
   identity_active_reset();
   if (!config)
-    return;
+    return true;
   g_identity.numeric_ids = config->numeric_ids;
   g_identity.chown_uid_set = config->chown_uid_set;
   g_identity.chown_uid = config->chown_uid;
   g_identity.chown_gid_set = config->chown_gid_set;
   g_identity.chown_gid = config->chown_gid;
+  g_identity.super_mode = config->super_mode;
+  g_identity.copy_as_set = config->copy_as_set;
+  g_identity.copy_as_uid = config->copy_as_uid;
+  g_identity.copy_as_gid = config->copy_as_gid;
   if (config->usermap_count > 0) {
     g_identity.usermap = calloc((size_t)config->usermap_count, sizeof(IdentityMap));
-    if (g_identity.usermap) {
-      memcpy(g_identity.usermap, config->usermap,
-             (size_t)config->usermap_count * sizeof(IdentityMap));
-      g_identity.usermap_count = config->usermap_count;
-    }
+    if (!g_identity.usermap)
+      goto alloc_failed;
+    memcpy(g_identity.usermap, config->usermap,
+           (size_t)config->usermap_count * sizeof(IdentityMap));
+    g_identity.usermap_count = config->usermap_count;
   }
   if (config->groupmap_count > 0) {
     g_identity.groupmap = calloc((size_t)config->groupmap_count, sizeof(IdentityMap));
-    if (g_identity.groupmap) {
-      memcpy(g_identity.groupmap, config->groupmap,
-             (size_t)config->groupmap_count * sizeof(IdentityMap));
-      g_identity.groupmap_count = config->groupmap_count;
-    }
+    if (!g_identity.groupmap)
+      goto alloc_failed;
+    memcpy(g_identity.groupmap, config->groupmap,
+           (size_t)config->groupmap_count * sizeof(IdentityMap));
+    g_identity.groupmap_count = config->groupmap_count;
   }
   g_identity.set = true;
   /* A root receiver would honor any client-supplied ownership request (a
-     --usermap/--groupmap/--chown, or raw ids under --numeric-ids).  Surface
-     that prominently; a privileged daemon applying arbitrary client ownership
-     is a deliberate, opt-in choice the operator should be aware of. */
+     --usermap/--groupmap/--chown/--copy-as, or raw ids under --numeric-ids).
+     Surface that prominently; a privileged daemon applying arbitrary client
+     ownership is a deliberate, opt-in choice the operator should be aware of. */
   if (geteuid() == 0)
     log_message(LOG_LEVEL_WARNING,
                 "identity mapping active and running as root: client-supplied "
                 "ownership (usermap/groupmap/chown/numeric-ids) will be honored; "
                 "run the daemon as an unprivileged user unless intended");
+  /* --super explicitly requests super-user activities, but FastSync never
+     elevates privileges: when the receiver is not already root the kernel will
+     refuse those confined attempts and each is skipped per entry.  Warn exactly
+     once at activation time (never abort) so the operator knows the flag cannot
+     succeed on this host. */
+  if (g_identity.super_mode == SUPER_MODE_ON && geteuid() != 0)
+    log_message(LOG_LEVEL_WARNING,
+                "--super requested but the receiver is not privileged; super-user "
+                "activities (ownership, device nodes) will be attempted but refused "
+                "by the kernel and skipped per entry");
+  return true;
+
+alloc_failed:
+  /* Never proceed with a partial (count-left-zero) map: that would silently
+     apply the WRONG ownership policy.  Fail closed and let the caller refuse
+     the connection. */
+  log_message(LOG_LEVEL_ERROR, "memory allocation failed while activating identity policy");
+  identity_active_reset();
+  return false;
+}
+
+bool privilege_super_permitted(void) {
+  return privilege_super_mode_permitted(g_identity.super_mode);
+}
+
+bool privilege_super_mode_permitted(int mode) {
+  /* AUTO and ON both attempt the confined operation; OFF forbids it even for a
+   * root receiver.  AUTO is the historical FastSync behavior (always attempt
+   * and let the kernel refuse an unprivileged call, which the caller skips), so
+   * it must stay permissive or a group-only chown that a non-root receiver is
+   * allowed to make would regress. */
+  return mode != SUPER_MODE_OFF;
 }
 
 bool identity_active_enabled(void) {
@@ -92,10 +142,39 @@ bool identity_active_enabled(void) {
      which runs only when metadata is present (a -M/--preserve transfer).  A
      standalone --numeric-ids (no ownership-affecting flag) carries no
      metadata, never reaches identity_apply_ownership, and therefore correctly
-     stays inert; combined with -M it activates raw-id application. */
+     stays inert; combined with -M it activates raw-id application.  --super /
+     --no-super does NOT enable ownership: it only permits or forbids the
+     already-requested super-user activities, so a --super with no explicit
+     identity flag must never silently apply client-chosen ownership. */
   return g_identity.set &&
          (g_identity.numeric_ids || g_identity.chown_uid_set || g_identity.chown_gid_set ||
-          g_identity.usermap_count > 0 || g_identity.groupmap_count > 0);
+          g_identity.usermap_count > 0 || g_identity.groupmap_count > 0 || g_identity.copy_as_set);
+}
+
+bool identity_ownership_requested(const Config* config) {
+  if (!config)
+    return false;
+  /* Every value that makes the receiver act on a client-chosen owner, plus an
+   * explicit --super (super-user device-node activities).  Pure config, so the
+   * daemon gate can evaluate it before identity_set_active(). */
+  return config->numeric_ids || config->chown_uid_set || config->chown_gid_set ||
+         config->usermap_count > 0 || config->groupmap_count > 0 || config->copy_as_set ||
+         config->fake_super || config->super_mode == SUPER_MODE_ON;
+}
+
+bool identity_copy_as_active(void) {
+  return g_identity.set && g_identity.copy_as_set;
+}
+
+bool identity_copy_as_refused(const Config* config) {
+  if (!config || !config->copy_as_set)
+    return false;
+  /* The safe-subset --copy-as needs a privileged (root) receiver, and an
+   * operator/--no-super veto forbids the ownership change even for root.  This
+   * is deliberately a pure function of the config and the current effective uid
+   * (never the active snapshot) because the server evaluates it at the
+   * pre-STATUS_OK config gate, before identity_set_active() has run. */
+  return geteuid() != 0 || config->super_mode == SUPER_MODE_OFF;
 }
 
 bool identity_wire_valid(const Config* config) {
@@ -116,6 +195,12 @@ bool identity_wire_valid(const Config* config) {
     if (config->groupmap[i].from < IDENTITY_MATCH_ANY || config->groupmap[i].to < IDENTITY_CURRENT)
       return false;
   }
+  /* Defense-in-depth: a --copy-as block must never carry a negative (sentinel)
+   * id into the ownership path.  receive_copy_as_options already rejects them,
+   * but identity_wire_valid is the shared validation used by both the receiver
+   * and unit tests, so re-assert it here. */
+  if (config->copy_as_set && (config->copy_as_uid < 0 || config->copy_as_gid < 0))
+    return false;
   return true;
 }
 
@@ -357,6 +442,142 @@ done:
   return ret;
 }
 
+/* uid_t/gid_t are unsigned and may hold a value wider than the signed int32 the
+ * wire (and the identity policy) uses.  Reject such an id instead of truncating
+ * it to an out-of-range (possibly negative sentinel) value. */
+static bool identity_id_fits_int32(unsigned long id) {
+  return id <= (unsigned long)INT32_MAX;
+}
+
+/* Resolve one --copy-as id token.  A '*' token means the caller's current
+ * effective uid (user) or gid (group).  Returns 0 on success.  On failure sets
+ * *overflow when a '*' id was wider than int32 so the caller can log the
+ * specific message; otherwise the token was simply unresolvable. */
+static int identity_resolve_copy_as_id(const char* token, bool is_group, int32_t* out,
+                                       bool* overflow) {
+  *overflow = false;
+  if (strcmp(token, "*") == 0) {
+    unsigned long current = is_group ? (unsigned long)getegid() : (unsigned long)geteuid();
+    if (!identity_id_fits_int32(current)) {
+      *overflow = true;
+      return -1;
+    }
+    *out = (int32_t)current;
+    return 0;
+  }
+  return identity_resolve_token(token, is_group, out);
+}
+
+int identity_parse_copy_as(Config* config, const char* value) {
+  if (!config || !value || *value == '\0') {
+    log_message(LOG_LEVEL_ERROR, "--copy-as requires USER[:GROUP]");
+    return -1;
+  }
+  /* --copy-as=USER[:GROUP] is the whole grammar: at most one field separator.
+   * (Unlike --chown there is no escaped-colon form; a name containing ':' is
+   * simply not expressible, and the extra colon is a clear parse error.) */
+  int colons = 0;
+  for (const char* p = value; *p; p++)
+    if (*p == ':')
+      colons++;
+  if (colons > 1) {
+    char* escaped = output_escape(value, false);
+    log_message(LOG_LEVEL_ERROR, "--copy-as must be USER[:GROUP] (got '%s')",
+                escaped ? escaped : "<allocation failed>");
+    free(escaped);
+    return -1;
+  }
+
+  char* spec = str_dup(value);
+  if (!spec) {
+    log_message(LOG_LEVEL_ERROR, "memory allocation failed for --copy-as");
+    return -1;
+  }
+  const char* user_token = spec;
+  const char* group_token = NULL;
+  char* colon = strchr(spec, ':');
+  if (colon) {
+    *colon = '\0';
+    group_token = colon + 1;
+  }
+
+  /* The spec is untrusted user input echoed back in error paths: escape it once
+   * (8-bit-safe) so a control byte cannot forge a log line. */
+  char* escaped_spec = output_escape(value, false);
+  const char* shown = escaped_spec ? escaped_spec : "<allocation failed>";
+  int ret = -1;
+
+  if (*user_token == '\0') {
+    log_message(LOG_LEVEL_ERROR, "--copy-as is missing the user (got '%s')", shown);
+    goto done;
+  }
+  bool overflow = false;
+  int32_t uid;
+  if (identity_resolve_copy_as_id(user_token, false, &uid, &overflow) != 0) {
+    if (overflow)
+      log_message(LOG_LEVEL_ERROR, "--copy-as: current user id %lu exceeds INT32_MAX",
+                  (unsigned long)geteuid());
+    else
+      log_message(LOG_LEVEL_ERROR,
+                  "--copy-as could not resolve user (use a name that exists on the "
+                  "source, '*', or @N): %s",
+                  shown);
+    goto done;
+  }
+
+  int32_t gid;
+  if (group_token) {
+    if (*group_token == '\0') {
+      log_message(LOG_LEVEL_ERROR, "--copy-as group is empty (got '%s')", shown);
+      goto done;
+    }
+    if (identity_resolve_copy_as_id(group_token, true, &gid, &overflow) != 0) {
+      if (overflow)
+        log_message(LOG_LEVEL_ERROR, "--copy-as: current group id %lu exceeds INT32_MAX",
+                    (unsigned long)getegid());
+      else
+        log_message(LOG_LEVEL_ERROR, "--copy-as could not resolve group (got '%s')", shown);
+      goto done;
+    }
+  } else {
+    /* Group omitted: use the user's primary gid.  A numeric id with no local
+     * passwd entry has no primary gid to look up, so fall back to gid == uid
+     * (the rsync-style numeric convention; documented divergence). */
+    struct passwd* pw = getpwuid((uid_t)uid);
+    if (pw) {
+      if (!identity_id_fits_int32((unsigned long)pw->pw_gid)) {
+        log_message(LOG_LEVEL_ERROR,
+                    "--copy-as: primary group id %lu for the requested user exceeds INT32_MAX",
+                    (unsigned long)pw->pw_gid);
+        goto done;
+      }
+      gid = (int32_t)pw->pw_gid;
+    } else {
+      gid = uid;
+    }
+  }
+  /* The group-default and gid==uid fallbacks must never store a negative
+   * (sentinel) value; the explicit numeric path is already capped by
+   * identity_resolve_token. */
+  if (uid < 0 || gid < 0) {
+    log_message(LOG_LEVEL_ERROR, "--copy-as resolved id does not fit in int32 (got '%s')", shown);
+    goto done;
+  }
+
+  config->copy_as_set = true;
+  config->copy_as_uid = uid;
+  config->copy_as_gid = gid;
+  /* Ownership application needs the metadata path (the source uid/gid must be
+   * transmitted); imply it exactly like --chown/--usermap/--groupmap. */
+  config->use_metadata = true;
+  ret = 0;
+
+done:
+  free(escaped_spec);
+  free(spec);
+  return ret;
+}
+
 /* ---- Receiver-side ownership application ---- */
 
 static bool identity_map_lookup(const IdentityMap* map, int count, int32_t source_id,
@@ -370,21 +591,30 @@ static bool identity_map_lookup(const IdentityMap* map, int count, int32_t sourc
   return false;
 }
 
-void identity_apply_ownership(int fd, int32_t source_uid, int32_t source_gid) {
-  /* Ownership application is OFF unless the client requested an identity flag.
-   * This is the controlled gate: a default (or plain -M) transfer never changes
-   * ownership, byte-for-byte preserving FastSync's existing behavior. */
-  if (!identity_active_enabled() || fd < 0)
-    return;
-  struct stat st;
-  if (fstat(fd, &st) != 0)
-    return;
-
+/* Resolve the target ownership from the negotiated policy against the entry's
+ * current stat.  Shared by the fd (regular file) and no-follow (symlink) apply
+ * paths.  Returns false when no side is to be changed. */
+static bool identity_resolve_targets(const struct stat* st, int32_t source_uid, int32_t source_gid,
+                                     uid_t* out_uid, gid_t* out_gid) {
   bool set_uid = false;
   bool set_gid = false;
   uid_t uid = 0;
   gid_t gid = 0;
 
+  /* --copy-as (P7 Wave E) has the highest priority: it forces BOTH the owner
+   * and group of every written entry to the requested ids, beating usermap /
+   * groupmap / --chown / --numeric-ids and the best-effort name lookup.  Only
+   * skip when the entry already carries exactly those ids. */
+  if (g_identity.copy_as_set) {
+    uid = (uid_t)g_identity.copy_as_uid;
+    gid = (gid_t)g_identity.copy_as_gid;
+    if (st->st_uid == uid && st->st_gid == gid)
+      return false;
+    *out_uid = uid;
+    *out_gid = gid;
+    return true;
+  }
+
   int32_t target;
   if (identity_map_lookup(g_identity.usermap, g_identity.usermap_count, source_uid, &target)) {
     uid = target == IDENTITY_CURRENT ? geteuid() : (uid_t)target;
@@ -431,29 +661,88 @@ void identity_apply_ownership(int fd, int32_t source_uid, int32_t source_gid) {
   }
 
   if (!set_uid && !set_gid)
-    return;
+    return false;
   /* An unset side keeps the file's current id so the other side can change. */
   if (!set_uid)
-    uid = st.st_uid;
+    uid = st->st_uid;
   if (!set_gid)
-    gid = st.st_gid;
+    gid = st->st_gid;
+  /* Only change ownership when the target differs (avoid needless syscalls and
+   * any chance of clearing setuid/setgid on an already-correct entry). */
+  if (st->st_uid == uid && st->st_gid == gid)
+    return false;
+  *out_uid = uid;
+  *out_gid = gid;
+  return true;
+}
 
-  /* Only call fchown when the target differs (avoid needless syscalls and any
-   * chance of clearing setuid/setgid on an already-correct file). */
-  if (st.st_uid == uid && st.st_gid == gid)
-    return;
-
-  if (fchown(fd, uid, gid) != 0) {
-    /* EPERM/EACCES are expected when the receiver is not privileged (e.g. the
-     * CI `nobody` user): warn and continue, never abort the transfer.  Any
-     * other error (EIO/EROFS/ENOSPC/...) is a real failure and must not be
-     * silently downgraded to a warning. */
-    if (errno == EPERM || errno == EACCES)
+static void identity_log_chown_failure(const char* what, uid_t uid, gid_t gid) {
+  /* EPERM/EACCES are expected when the receiver is not privileged (e.g. the CI
+   * `nobody` user): warn and continue, never abort the transfer.  Any other
+   * error (EIO/EROFS/ENOSPC/...) is a real failure and must not be silently
+   * downgraded to a warning.
+   *
+   * --copy-as is different: the whole point of the flag is that the target
+   * ownership is REQUIRED (the pre-flight gate already refused an unprivileged
+   * receiver).  If the chown still fails with EPERM/EACCES (a capability-
+   * restricted root, root-squash, or a read-only mount) the run would be
+   * silently producing the WRONG ownership, so surface it at ERROR.  The
+   * caller (identity_apply_ownership*) then reports the ENTRY as failed rather
+   * than as written, which becomes a FILE_SAVE_ERROR and fails the transfer
+   * (fail-fast) instead of reporting overall success with the wrong owner. */
+  if (errno == EPERM || errno == EACCES) {
+    if (identity_copy_as_active())
+      log_message(LOG_LEVEL_ERROR,
+                  "could not apply --copy-as ownership on %s (uid=%ld gid=%ld): %s; "
+                  "entry was written with the wrong owner",
+                  what, (long)uid, (long)gid, strerror(errno));
+    else
       log_message(LOG_LEVEL_WARNING,
                   "could not apply ownership (uid=%ld gid=%ld): %s; leaving as-is", (long)uid,
                   (long)gid, strerror(errno));
-    else
-      log_message(LOG_LEVEL_ERROR, "failed to apply ownership (uid=%ld gid=%ld): %s", (long)uid,
-                  (long)gid, strerror(errno));
+  } else {
+    log_message(LOG_LEVEL_ERROR, "failed to apply ownership on %s (uid=%ld gid=%ld): %s", what,
+                (long)uid, (long)gid, strerror(errno));
   }
-}
+}
+
+bool identity_apply_ownership(int fd, int32_t source_uid, int32_t source_gid) {
+  /* Ownership application is OFF unless the client requested an identity flag.
+   * This is the controlled gate: a default (or plain -M) transfer never changes
+   * ownership, byte-for-byte preserving FastSync's existing behavior.  --no-super
+   * additionally forbids it even when the receiver is root. */
+  if (!identity_active_enabled() || !privilege_super_permitted() || fd < 0)
+    return true;
+  struct stat st;
+  if (fstat(fd, &st) != 0)
+    return !identity_copy_as_active();
+  uid_t uid;
+  gid_t gid;
+  if (!identity_resolve_targets(&st, source_uid, source_gid, &uid, &gid))
+    return true;
+  if (fchown(fd, uid, gid) != 0) {
+    identity_log_chown_failure("file", uid, gid);
+    /* A required --copy-as ownership that did not land is a per-entry failure;
+     * every other policy stays best-effort (rsync parity). */
+    return !identity_copy_as_active();
+  }
+  return true;
+}
+
+bool identity_apply_ownership_link(int parent_fd, const char* leaf, int32_t source_uid,
+                                   int32_t source_gid) {
+  if (!identity_active_enabled() || !privilege_super_permitted() || parent_fd < 0 || !leaf)
+    return true;
+  struct stat st;
+  if (fstatat(parent_fd, leaf, &st, AT_SYMLINK_NOFOLLOW) != 0)
+    return !identity_copy_as_active();
+  uid_t uid;
+  gid_t gid;
+  if (!identity_resolve_targets(&st, source_uid, source_gid, &uid, &gid))
+    return true;
+  if (fchownat(parent_fd, leaf, uid, gid, AT_SYMLINK_NOFOLLOW) != 0) {
+    identity_log_chown_failure("no-follow entry", uid, gid);
+    return !identity_copy_as_active();
+  }
+  return true;
+}

src/shared/identity.h

@@ -7,7 +7,7 @@
 #include <sys/types.h>
 
 /*
- * Identity mapping: --numeric-ids / --usermap / --groupmap / --chown.
+ * Identity mapping: --numeric-ids / --usermap / --groupmap / --chown / --copy-as.
  *
  * FastSync transmits uid/gid numerically (int32 on the wire) and, by design,
  * NEVER applies client-supplied ownership unless a user explicitly opts in with
@@ -34,28 +34,100 @@ int identity_parse_map(Config* config, const char* value, bool is_group);
  * on success, -1 on a malformed spec / unresolvable name. */
 int identity_parse_chown(Config* config, const char* value);
 
+/* Parse --copy-as=USER[:GROUP] (P7 Wave E).  USER is resolved with the same
+ * user-database rules as --chown (a name, @N/bare N numeric id, or '*' meaning
+ * the client's current euid); when ':GROUP' is present the group is resolved
+ * with the group database ('*' meaning the client's egid).  When the group is
+ * omitted, the user's primary gid is used (getpwuid(uid)->pw_gid); if the
+ * resolved user is a numeric id with no local passwd entry, gid falls back to
+ * uid.  On success sets copy_as_set/copy_as_uid/copy_as_gid and forces
+ * metadata transmission (ownership application needs the metadata path).
+ * Returns 0 on success, -1 on a malformed / empty / unresolvable spec (never a
+ * silent no-op). */
+int identity_parse_copy_as(Config* config, const char* value);
+
+/* True when a --copy-as request is active but the receiver is not permitted to
+ * perform the privileged ownership application it needs.  This is the up-front
+ * refusal predicate: the server rejects the whole transfer at the config
+ * handshake rather than silently ignoring the requested ownership.  It is a
+ * pure function of the config mode and the current effective uid (it does NOT
+ * read the active snapshot, so it is valid at the pre-STATUS_OK gate, before
+ * identity_set_active() has run).  `super_mode` is the EFFECTIVE mode after any
+ * server-side policy veto. */
+bool identity_copy_as_refused(const Config* config);
+
+/* True when the CURRENT per-connection snapshot has a --copy-as active (i.e.
+ * identity_set_active() has run against a config with copy_as_set).  The
+ * --fake-super owner replay consults this so a copy-as run never lets the
+ * recorded source owner overwrite the forced target owner.  Reads the active
+ * snapshot, so call identity_set_active() first (the receiver does, before any
+ * write). */
+bool identity_copy_as_active(void);
+
 /* Receiver-side snapshot of the negotiated identity config.  The server calls
  * identity_set_active() once per connection (before any file write) using the
  * config received over the wire; the snapshot is a deep copy so the caller may
- * free its Config immediately.  identity_clear_active() releases it. */
-void identity_set_active(const Config* config);
+ * free its Config immediately.  identity_clear_active() releases it.
+ *
+ * Returns true on success.  On an allocation failure while deep-copying a
+ * requested usermap/groupmap it logs a LOG_LEVEL_ERROR, leaves the snapshot
+ * cleared (never a partial/wrong policy) and returns false; the caller must
+ * refuse the connection. */
+bool identity_set_active(const Config* config);
 void identity_clear_active(void);
 
 /* True when any ownership-affecting identity option is present in the active
  * snapshot.  Ownership stays OFF ("do not apply") for every transfer that
- * requests none of them, preserving FastSync's existing behavior. */
+ * requests none of them, preserving FastSync's existing behavior.  --super /
+ * --no-super alone does NOT enable ownership; an explicit identity flag
+ * (--numeric-ids / --chown / --usermap / --groupmap / --copy-as) is required. */
 bool identity_active_enabled(void);
 
+/* Pure, config-only predicate: true when the client requested ANY
+ * client-chosen ownership or super-user activity (--numeric-ids, --chown,
+ * --usermap/--groupmap, --copy-as, --fake-super, or an explicit --super).  Used
+ * by the daemon module gate to decide whether a module's per-module opt-in is
+ * required; it never reads the per-connection snapshot. */
+bool identity_ownership_requested(const Config* config);
+
 /* Apply the negotiated ownership to an already-written file descriptor.
  * source_uid/source_gid are the transmitted numeric ids.  Resolution order:
- * a matching usermap/groupmap rule, then --chown, then --numeric-ids (raw),
- * then a best-effort name lookup on the receiver's own databases (skipped when
- * the transmitted id has no name on this system).  Only calls fchown() when the
- * result differs from the current value; EPERM/EACCES are logged and ignored,
- * never fatal (rsync parity: the transfer must not abort). */
-void identity_apply_ownership(int fd, int32_t source_uid, int32_t source_gid);
+ * --copy-as (highest priority, forces both ids), then a matching
+ * usermap/groupmap rule, then --chown, then --numeric-ids (raw), then a
+ * best-effort name lookup on the receiver's own databases (skipped when the
+ * transmitted id has no name on this system).  Only calls fchown() when the
+ * result differs from the current value.
+ *
+ * Returns false ONLY when an active --copy-as ownership application failed: its
+ * forced ownership is REQUIRED, so the caller must treat the entry as failed
+ * rather than reporting success with the wrong owner.  For every other identity
+ * policy an fchown EPERM/EACCES is logged and ignored and true is returned
+ * (rsync parity: the transfer must not abort).  A no-op when no identity policy
+ * is active returns true. */
+bool identity_apply_ownership(int fd, int32_t source_uid, int32_t source_gid);
+
+/* P7 Wave D: the no-follow (symlink) counterpart.  Resolves the same
+ * usermap/groupmap/chown/numeric-ids/copy-as policy but applies it with
+ * fchownat(..., AT_SYMLINK_NOFOLLOW) so a symlink's own ownership is changed
+ * without ever dereferencing it.  A no-op unless an identity flag is active.
+ * The return value follows identity_apply_ownership(): false only when an
+ * active --copy-as application failed. */
+bool identity_apply_ownership_link(int parent_fd, const char* leaf, int32_t source_uid,
+                                   int32_t source_gid);
 
 /* Receiver-side wire validation of the resolved identity fields. */
 bool identity_wire_valid(const Config* config);
 
+/* P7 Wave E receiver-side permission gate for super-user activities (ownership
+ * application and char/block device-node creation).  `privilege_super_permitted`
+ * consults the per-connection snapshot (call identity_set_active() first);
+ * `privilege_super_mode_permitted` is the pure mode predicate and is what
+ * callers holding a Config use (the config-frame gate, file_receive).  Both
+ * return false only for SUPER_MODE_OFF; SUPER_MODE_ON and SUPER_MODE_AUTO (the
+ * default) permit a confined attempt, matching FastSync's historical
+ * best-effort behavior where an unprivileged attempt is refused by the kernel
+ * and skipped.  Neither EVER elevates privileges. */
+bool privilege_super_permitted(void);
+bool privilege_super_mode_permitted(int mode);
+
 #endif

src/shared/log.c

@@ -27,6 +27,10 @@ uint32_t get_log_debug_flags(void) {
   return current_debug_flags;
 }
 
+bool log_debug_enabled(LogDebugFlag flag) {
+  return current_log_level <= LOG_LEVEL_DEBUG && (current_debug_flags & flag) != 0;
+}
+
 void set_log_info_flags(uint32_t flags) {
   info_flags = flags;
   info_flags_explicit = true;

src/shared/log.h

@@ -29,6 +29,10 @@ void log_perror(const char* context);
 void set_log_level(LogLevel level);
 void set_log_debug_flags(uint32_t flags);
 uint32_t get_log_debug_flags(void);
+/* True when a log_debug_message() call with the same flag would actually emit:
+ * the debug log level is enabled AND the flag is selected.  Hot paths use this
+ * to skip expensive message formatting/escaping when the line is filtered. */
+bool log_debug_enabled(LogDebugFlag flag);
 void log_debug_message(LogDebugFlag flag, const char* message, ...);
 void set_log_info_flags(uint32_t flags);
 uint32_t get_log_info_flags(void);

src/shared/metadata.c

@@ -357,6 +357,47 @@ void file_restore_metadata(const char* path, const FileMetadata* metadata,
   }
 }
 
+bool file_restore_symlink_metadata(const char* path, const FileMetadata* metadata,
+                                   bool omit_link_times) {
+  if (path == NULL || metadata == NULL)
+    return !identity_copy_as_active();
+  char* leaf = NULL;
+  int parent_fd = file_open_secure_parent(path, &leaf, false);
+  if (parent_fd < 0)
+    return !identity_copy_as_active();
+  /* Ownership (only when the identity policy is active) via lchown semantics:
+     fchownat with AT_SYMLINK_NOFOLLOW never dereferences the link.  A failed
+     REQUIRED --copy-as ownership marks the entry failed; every other policy is
+     best-effort. */
+  bool owned = identity_apply_ownership_link(parent_fd, leaf, (int32_t)metadata->uid,
+                                             (int32_t)metadata->gid);
+  /* Symlink mode: not settable on Linux (fchmodat AT_SYMLINK_NOFOLLOW returns
+     EOPNOTSUPP/ENOTSUP); attempt it for platforms that support it and quietly
+     ignore the unsupported case so the transfer never fails over it. */
+  mode_t link_mode = metadata->mode & 0777;
+  if (fchmodat(parent_fd, leaf, link_mode, AT_SYMLINK_NOFOLLOW) != 0 && errno != EOPNOTSUPP &&
+      errno != ENOTSUP && errno != ENOSYS) {
+    log_message(LOG_LEVEL_DEBUG, "Could not set symlink mode on %s: %s", path, strerror(errno));
+  }
+  if (!omit_link_times) {
+    struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},
+                                {.tv_sec = metadata->mtime_sec, .tv_nsec = metadata->mtime_nsec}};
+    if (metadata->atime_valid) {
+      times[0].tv_sec = metadata->atime_sec;
+      times[0].tv_nsec = metadata->atime_nsec;
+    }
+    if (utimensat(parent_fd, leaf, times, AT_SYMLINK_NOFOLLOW) != 0) {
+      char* escaped_path = output_escape(path, log_get_8_bit_output());
+      log_message(LOG_LEVEL_WARNING, "Failed to set symlink timestamps on %s: %s",
+                  escaped_path ? escaped_path : "<allocation failed>", strerror(errno));
+      free(escaped_path);
+    }
+  }
+  close(parent_fd);
+  free(leaf);
+  return owned;
+}
+
 bool file_restore_metadata_fd(int fd, const FileMetadata* metadata, bool preserve_executability) {
   if (fd < 0 || metadata == NULL)
     return metadata == NULL;
@@ -372,10 +413,14 @@ bool file_restore_metadata_fd(int fd, const FileMetadata* metadata, bool preserv
      --groupmap / --chown).  identity_apply_ownership is the controlled,
      privilege-gated path: it consults the negotiated policy, resolves the
      target ids, and applies them via an fd-relative fchown() that is confined
-     to the just-written file (EPERM/EACCES are logged, never fatal).  With no
-     identity flag set it is a no-op, so a default or plain -M transfer keeps
-     FastSync's existing behavior of never applying client ownership. */
-  identity_apply_ownership(fd, (int32_t)metadata->uid, (int32_t)metadata->gid);
+     to the just-written file (EPERM/EACCES are logged, never fatal) -- EXCEPT
+     for an active --copy-as, whose forced ownership is REQUIRED: a failure
+     marks this entry as failed instead of reporting a wrong-owner write as
+     success.  With no identity flag set it is a no-op, so a default or plain -M
+     transfer keeps FastSync's existing behavior of never applying client
+     ownership. */
+  if (!identity_apply_ownership(fd, (int32_t)metadata->uid, (int32_t)metadata->gid))
+    ok = false;
   struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},
                               {.tv_sec = metadata->mtime_sec, .tv_nsec = metadata->mtime_nsec}};
   if (metadata->atime_valid) {

src/shared/metadata.h

@@ -39,6 +39,16 @@ FileMetadata* metadata_receive(int file_descriptor, int* ok);
 void file_restore_metadata(const char* path, const FileMetadata* metadata,
                            bool preserve_executability);
 bool file_restore_metadata_fd(int fd, const FileMetadata* metadata, bool preserve_executability);
+/* P7 Wave D: apply a SYMLINK's own metadata using no-follow primitives only
+ * (utimensat/lchown/fchmodat with AT_SYMLINK_NOFOLLOW), confined fd-relative
+ * under the authorized root.  `omit_link_times` (-J/--omit-link-times)
+ * suppresses the timestamps; the link's mode/ownership are still attempted
+ * (ownership stays gated by the identity policy and by default is not applied).
+ * A null metadata or an unfollowable parent is a harmless no-op.  Returns false
+ * only when a REQUIRED --copy-as ownership application failed, so the caller can
+ * report the entry as failed instead of claiming a wrong-owner success. */
+bool file_restore_symlink_metadata(const char* path, const FileMetadata* metadata,
+                                   bool omit_link_times);
 
 /* Compare timestamps using rsync's whole-second modification window. */
 bool metadata_mtime_matches(time_t left_sec, long left_nsec, time_t right_sec, long right_nsec,

src/shared/multiprocessing.c

@@ -31,6 +31,7 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
   context->scan_had_io_error = false;
   context->remove_source_files = NULL;
   context->early_delete = false;
+  context->scan_stopped_early = false;
   context->total_files = 0;
   context->progress_bytes = 0;
   context->total_bytes = 0;
@@ -38,7 +39,14 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
   atomic_init(&context->cancelled, false);
   protocol_session_init(&context->allocation_session, -1, -1);
   protocol_session_set_max_alloc(&context->allocation_session, config->max_alloc);
+  context->dir_entries = NULL;
+  context->dir_entries_mutex_init = false;
   int init = 0;
+  if (config->use_metadata) {
+    context->dir_entries = array_list_create(file_destroy);
+    if (!context->dir_entries)
+      goto fail;
+  }
   if (mtx_init(&context->mutex_scanner, mtx_plain) != thrd_success)
     goto fail;
   init++;
@@ -61,10 +69,17 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
     goto fail;
   // cppcheck-suppress unreadVariable
   init++;
+  if (mtx_init(&context->dir_entries_mutex, mtx_plain) != thrd_success)
+    goto fail;
+  context->dir_entries_mutex_init = true;
   return context;
 
 fail:
   log_perror("Error initializing synchronization objects");
+  if (context->dir_entries_mutex_init)
+    mtx_destroy(&context->dir_entries_mutex);
+  if (context->dir_entries)
+    array_list_delete(context->dir_entries);
   if (init >= 6)
     cnd_destroy(&context->condition_not_empty_loader);
   if (init >= 5)
@@ -91,6 +106,10 @@ void pipeline_context_sender_destroy(PipelineContextSender* context) {
     array_list_delete(context->missing_args);
   if (context->remove_source_files)
     array_list_delete(context->remove_source_files);
+  if (context->dir_entries)
+    array_list_delete(context->dir_entries);
+  if (context->dir_entries_mutex_init)
+    mtx_destroy(&context->dir_entries_mutex);
   config_delete(context->config);
   queue_destroy(context->queue_scanner);
   queue_destroy(context->queue_loader);
@@ -116,6 +135,7 @@ PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue*
   context->outcomes.entries = NULL;
   context->outcomes.count = 0;
   context->outcomes.capacity = 0;
+  dir_time_list_init(&context->dir_times);
   protocol_session_init(&context->session, file_descriptor, file_descriptor);
   protocol_session_set_ssl(&context->session, ssl);
   context->receiver_done = false;
@@ -154,6 +174,7 @@ void pipeline_context_receiver_destroy(PipelineContextReceiver* context) {
     delete_manifest_free(context->deferred_manifest);
   queue_destroy(context->queue);
   receiver_outcomes_destroy(&context->outcomes);
+  dir_time_list_free(&context->dir_times);
   mtx_destroy(&context->mutex);
   cnd_destroy(&context->condition_not_full);
   cnd_destroy(&context->condition_not_empty);
@@ -306,6 +327,24 @@ int write_thread(void* pipeline_context) {
         return thrd_error;
       }
     }
+    /* P7 Wave D: a directory's times are never applied inline (a later child
+       write would clobber them); accumulate the metadata here and let the
+       caller apply it once every writer has drained. */
+    if (result != FILE_SAVE_ERROR && file->is_dir && file->metadata &&
+        context->config->use_metadata && !context->config->omit_dir_times &&
+        !dir_time_list_add(&context->dir_times, file->path, file->metadata)) {
+      file_destroy(file);
+      pipeline_context_receiver_note_bytes_released(context, file_bytes);
+      mtx_lock(&context->mutex);
+      atomic_store(&context->cancelled, true);
+      context->receiver_done = true;
+      cnd_broadcast(&context->condition_not_full);
+      cnd_broadcast(&context->condition_not_empty);
+      mtx_unlock(&context->mutex);
+      free(root_directory);
+      protocol_session_unbind();
+      return thrd_error;
+    }
     /* Record the per-file outcome so a --remove-source-files sender learns
        which sources were actually written versus skipped on the receiver.
        Explicit directory entries and recreated device/special nodes have no

src/shared/multiprocessing.h

@@ -10,6 +10,7 @@
 #include "protocol.h"
 #include "queue.h"
 #include "receiver.h"
+#include "stop_condition.h"
 #include <openssl/ssl.h>
 
 typedef struct {
@@ -56,6 +57,23 @@ typedef struct {
   bool sender_done;
   atomic_bool cancelled;
   ProtocolSession allocation_session;
+  /* Phase 6: client-only sender stop deadline, computed once before the worker
+   * threads start and shared read-only by the scanner and the sender thread. */
+  StopCondition stop_condition;
+  /* Phase 6: set when the scanner/sender reached the stop deadline before the
+   * scan (and thus the keep-set manifest) completed naturally.  When true the
+   * completion tail must NOT transmit the partial manifest, or the receiver
+   * would delete unscanned source mirrors.  Written by the sender thread
+   * before it reads the manifest, so no additional synchronization is needed
+   * to suppress the manifest. */
+  bool scan_stopped_early;
+  /* P7 Wave D: captured source directory times, filled by the scanner thread
+   * (and its parallel workers, guarded by dir_entries_mutex) and drained by the
+   * sender thread in trailing STATUS_DIR_TIMES frame(s).  Owned by the
+   * context; NULL for non-metadata transfers. */
+  ArrayList* dir_entries;
+  mtx_t dir_entries_mutex;
+  bool dir_entries_mutex_init;
 } PipelineContextSender;
 
 typedef struct PipelineContextReceiver {
@@ -83,9 +101,13 @@ typedef struct PipelineContextReceiver {
      protocol stream but hands the manifest here instead of deleting while the
      disk writer may still be draining; the caller (server.c) commits the
      deletion after both threads have joined, so no extra is removed unless the
-      transfer truly succeeded.  NULL in the early delete modes (which delete at
-      the manifest). */
+     transfer truly succeeded.  NULL in the early delete modes (which delete at
+     the manifest). */
   DeleteManifest* deferred_manifest;
+  /* P7 Wave D: directory metadata collected by write_thread from received
+     directory entries.  Only write_thread mutates it (before it joins); the
+     caller (server.c) applies it after the delete/delay-updates phase. */
+  DirTimeList dir_times;
 } PipelineContextReceiver;
 
 PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* queue_scanner,

src/shared/protocol.c

@@ -407,15 +407,30 @@ static const char* status_to_string(Status status) {
     return "APPEND_DATA";
   case STATUS_HARDLINK:
     return "HARDLINK";
+  case STATUS_SYMLINK:
+    return "SYMLINK";
+  case STATUS_SPECIAL:
+    return "SPECIAL";
+  case STATUS_DIR_TIMES:
+    return "DIR_TIMES";
+  case STATUS_AUTH_CHALLENGE:
+    return "AUTH_CHALLENGE";
+  case STATUS_AUTH_RESPONSE:
+    return "AUTH_RESPONSE";
+  case STATUS_AUTH_OK:
+    return "AUTH_OK";
+  case STATUS_AUTH_FAILED:
+    return "AUTH_FAILED";
   default:
     return "UNKNOWN";
   }
 }
 
 /* Shared string send/receive implementation.  `redact` selects whether the
- * payload body is written to the LOG_DEBUG_PROTO debug log: secrets (daemon
- * auth username/digest) set it so a --verbose log never captures a replayable
- * credential, while every other string keeps its normal debug trace. */
+ * payload body is written to the LOG_DEBUG_PROTO debug log: daemon auth material
+ * (the username and the proof/signature fields) sets it so a --verbose log never
+ * captures a replayable credential, while every other string keeps its normal
+ * debug trace. */
 static bool protocol_send_str_impl(ProtocolSession* session, const char* data, bool redact) {
   if (data == NULL)
     return false;
@@ -424,10 +439,14 @@ static bool protocol_send_str_impl(ProtocolSession* session, const char* data, b
     return false;
   if (!protocol_send_n_data(session, data, size))
     return false;
-  if (redact)
+  if (redact) {
     log_debug_message(LOG_DEBUG_PROTO, "Send String: <redacted>");
-  else
-    log_debug_message(LOG_DEBUG_PROTO, "Send String: %s", data);
+  } else if (log_debug_enabled(LOG_DEBUG_PROTO)) {
+    char* escaped_data = output_escape(data, log_get_8_bit_output());
+    log_debug_message(LOG_DEBUG_PROTO, "Send String: %s",
+                      escaped_data ? escaped_data : "<allocation failed>");
+    free(escaped_data);
+  }
   return true;
 }
 
@@ -453,10 +472,14 @@ static char* protocol_receive_str_impl(ProtocolSession* session, bool redact) {
     return NULL;
   }
   data[size] = '\0';
-  if (redact)
+  if (redact) {
     log_debug_message(LOG_DEBUG_PROTO, "Received String: <redacted>");
-  else
-    log_debug_message(LOG_DEBUG_PROTO, "Received String: %s", data);
+  } else if (log_debug_enabled(LOG_DEBUG_PROTO)) {
+    char* escaped_data = output_escape(data, log_get_8_bit_output());
+    log_debug_message(LOG_DEBUG_PROTO, "Received String: %s",
+                      escaped_data ? escaped_data : "<allocation failed>");
+    free(escaped_data);
+  }
   return data;
 }
 
@@ -580,7 +603,8 @@ char* receive_str(int fd) {
   return protocol_receive_str(legacy_session(fd, -1));
 }
 /* Redacted variants: identical framing, but the string body is never written to
-   the debug protocol log.  Used for the daemon auth username/digest. */
+   the debug protocol log.  Used for daemon auth material (username, proof,
+   signature). */
 bool send_str_redacted(int fd, const char* data) {
   return protocol_send_str_redacted(legacy_session(-1, fd), data);
 }

src/shared/protocol.h

@@ -103,7 +103,30 @@ enum NET_STATUS {
    * int32 rdev major/minor fields.  The receiver validates the kind and rdev,
    * confines the node below the receive root, and recreates it (mknod/mkfifo),
    * privilege-gating the mknod.  Protocol 2.13.0. */
-  STATUS_SPECIAL
+  STATUS_SPECIAL,
+  /* Directory-time superstructure (P7 Wave D, protocol 2.17.0): one or more
+   * trailing frames sent after all file data (and after the optional delete
+   * manifest) carrying the source directories' captured metadata so the
+   * receiver can apply directory mtimes/atimes AFTER all of a directory's
+   * children have been written.  Payload per frame: an int count, then count
+   * repetitions of (wire path string, metadata frame); an entry count larger
+   * than MAX_MANIFEST_ENTRIES is split across repeated frames.  The receiver
+   * defers the actual utimensat until its own delete/publish phase has
+   * committed, then skips the whole set when -O/--omit-dir-times is set. */
+  STATUS_DIR_TIMES,
+  /* Daemon SCRAM-SHA-256 authentication (A7 remediation, protocol 2.19.0).
+   * STATUS_AUTH_CHALLENGE: the server requires auth and is about to send the
+   * iteration count, the base64 salt and the base64 server nonce.
+   * STATUS_AUTH_RESPONSE: the client's reply, followed by the base64 client
+   * nonce and the base64 ClientProof.  STATUS_AUTH_OK: the client proof
+   * verified, followed by the base64 ServerSignature.  STATUS_AUTH_FAILED:
+   * a single generic refusal (unknown user, off-list user, wrong proof,
+   * missing/malformed credentials) after which the server closes without
+   * writing any data. */
+  STATUS_AUTH_CHALLENGE,
+  STATUS_AUTH_RESPONSE,
+  STATUS_AUTH_OK,
+  STATUS_AUTH_FAILED
 };
 
 void io_set_fds(int read_fd, int write_fd);
@@ -128,8 +151,9 @@ bool protocol_send_str(ProtocolSession* session, const char* data);
 char* protocol_receive_str(ProtocolSession* session);
 /* Redacted string variants: identical wire framing to protocol_send_str /
  * protocol_receive_str, but the payload body is replaced by `<redacted>` in the
- * LOG_DEBUG_PROTO debug log.  Used for secrets (daemon auth username/digest) so
- * a --verbose log can never capture a replayable credential. */
+ * LOG_DEBUG_PROTO debug log.  Used for daemon auth material (the username and
+ * the proof/signature fields) so a --verbose log can never capture a credential
+ * that could be replayed. */
 bool protocol_send_str_redacted(ProtocolSession* session, const char* data);
 char* protocol_receive_str_redacted(ProtocolSession* session);
 bool protocol_send_data(ProtocolSession* session, const Data* data);

src/shared/stop_condition.c

@@ -0,0 +1,157 @@
+#include "stop_condition.h"
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* Parse a strictly positive decimal integer: only ASCII digits, no leading
+ * whitespace, sign or trailing garbage. */
+static bool parse_positive_minutes(const char* value, long* out) {
+  if (!value || *value == '\0')
+    return false;
+  if (*value < '0' || *value > '9')
+    return false;
+  long v = 0;
+  for (const char* p = value; *p != '\0'; p++) {
+    if (*p < '0' || *p > '9')
+      return false;
+    int digit = *p - '0';
+    if (v > (LONG_MAX - digit) / 10)
+      return false;
+    v = v * 10 + digit;
+  }
+  if (v <= 0 || v > INT_MAX)
+    return false;
+  *out = v;
+  return true;
+}
+
+bool stop_parse_after_minutes(const char* value, int* out_minutes) {
+  if (!out_minutes)
+    return false;
+  long minutes = 0;
+  if (!parse_positive_minutes(value, &minutes))
+    return false;
+  *out_minutes = (int)minutes;
+  return true;
+}
+
+/* Two consecutive ASCII digits -> 0..99. */
+static bool parse_two_digits(const char* s, int* out) {
+  if (s[0] < '0' || s[0] > '9' || s[1] < '0' || s[1] > '9')
+    return false;
+  *out = (s[0] - '0') * 10 + (s[1] - '0');
+  return true;
+}
+
+bool stop_parse_at_time(const char* value, time_t now, time_t* out_deadline) {
+  if (!value || !out_deadline)
+    return false;
+
+  /* now+N[smhd]: N whole units from the current wall clock. */
+  if (strncmp(value, "now+", 4) == 0) {
+    const char* p = value + 4;
+    /* The count must be a bare non-negative digit run: reject leading
+       whitespace ('now+ 5s') and a leading sign ('now++5s'). */
+    if (*p < '0' || *p > '9')
+      return false;
+    errno = 0;
+    char* end = NULL;
+    long amount = strtol(p, &end, 10);
+    if (errno != 0 || end == p || amount < 0)
+      return false;
+    long unit_seconds;
+    switch (*end) {
+    case 's':
+      unit_seconds = 1;
+      break;
+    case 'm':
+      unit_seconds = 60;
+      break;
+    case 'h':
+      unit_seconds = 3600;
+      break;
+    case 'd':
+      unit_seconds = 86400;
+      break;
+    default:
+      return false;
+    }
+    if (end[1] != '\0')
+      return false;
+    if (amount > LONG_MAX / unit_seconds)
+      return false;
+    long long delta = (long long)amount * unit_seconds;
+    /* Guard against signed overflow of now + delta. */
+    if ((long long)now > 0 && delta > (long long)LLONG_MAX - (long long)now)
+      return false;
+    if ((long long)now < 0 && delta < (long long)LLONG_MIN - (long long)now)
+      return false;
+    *out_deadline = now + (time_t)delta;
+    return true;
+  }
+
+  /* HH:MM or HH:MM:SS on the current local day. */
+  size_t len = strlen(value);
+  if (len != 5 && len != 8)
+    return false;
+  if (value[2] != ':' || (len == 8 && value[5] != ':'))
+    return false;
+  int hh, mm, ss = 0;
+  if (!parse_two_digits(value, &hh) || !parse_two_digits(value + 3, &mm))
+    return false;
+  if (len == 8 && !parse_two_digits(value + 6, &ss))
+    return false;
+  if (hh > 23 || mm > 59 || ss > 59)
+    return false;
+
+  struct tm today;
+  if (!localtime_r(&now, &today))
+    return false;
+  today.tm_hour = hh;
+  today.tm_min = mm;
+  today.tm_sec = ss;
+  today.tm_isdst = -1;
+  time_t deadline = mktime(&today);
+  if (deadline == (time_t)-1)
+    return false;
+  *out_deadline = deadline;
+  return true;
+}
+
+StopCondition stop_condition_make(bool has_after, int after_minutes, bool has_at, time_t at_time,
+                                  struct timespec now_mono) {
+  StopCondition condition;
+  condition.has_monotonic = false;
+  condition.monotonic_deadline.tv_sec = 0;
+  condition.monotonic_deadline.tv_nsec = 0;
+  condition.has_wall = false;
+  condition.wall_deadline = 0;
+  if (has_after && after_minutes > 0) {
+    condition.has_monotonic = true;
+    condition.monotonic_deadline.tv_sec = now_mono.tv_sec + (time_t)after_minutes * 60;
+    condition.monotonic_deadline.tv_nsec = now_mono.tv_nsec;
+  }
+  if (has_at) {
+    condition.has_wall = true;
+    condition.wall_deadline = at_time;
+  }
+  return condition;
+}
+
+bool stop_condition_reached(const StopCondition* condition) {
+  if (!condition)
+    return false;
+  if (condition->has_wall && time(NULL) >= condition->wall_deadline)
+    return true;
+  if (condition->has_monotonic) {
+    struct timespec now;
+    if (clock_gettime(CLOCK_MONOTONIC, &now) != 0)
+      return false;
+    if (now.tv_sec > condition->monotonic_deadline.tv_sec ||
+        (now.tv_sec == condition->monotonic_deadline.tv_sec &&
+         now.tv_nsec >= condition->monotonic_deadline.tv_nsec))
+      return true;
+  }
+  return false;
+}

src/shared/stop_condition.h

@@ -0,0 +1,46 @@
+#ifndef STOP_CONDITION_H
+#define STOP_CONDITION_H
+
+#include <stdbool.h>
+#include <time.h>
+
+/* Client-only transfer stop conditions (--stop-after=MINS / --stop-at=TIME).
+ * Both are local sender-side deadlines: they are never serialized into the
+ * config frame and never bump PROTOCOL_VERSION.  A transfer checks the
+ * condition at natural chunk/file boundaries and, once reached, stops
+ * elegantly (everything already sent is finalized normally, exit 0).
+ *
+ * A condition combines an optional CLOCK_MONOTONIC instant (the relative
+ * --stop-after duration, immune to wall-clock changes) with an optional
+ * wall-clock instant (the absolute --stop-at form).  Either one being reached
+ * ends the transfer. */
+typedef struct StopCondition {
+  bool has_monotonic;
+  struct timespec monotonic_deadline;
+  bool has_wall;
+  time_t wall_deadline;
+} StopCondition;
+
+/* Parse --stop-after=MINS: a positive integer count of minutes.  Zero,
+ * negative, empty and non-numeric values are rejected.  Returns true when
+ * accepted and stores the value in *out_minutes. */
+bool stop_parse_after_minutes(const char* value, int* out_minutes);
+
+/* Parse --stop-at=TIME.  Accepted forms are HH:MM, HH:MM:SS and
+ * now+N[smhd] (seconds/minutes/hours/days from now).  The absolute forms are
+ * resolved against `now` (local wall clock) and written to *out_deadline; a
+ * time already in the past yields a deadline <= now ("stop immediately").
+ * Returns false on any malformed value. */
+bool stop_parse_at_time(const char* value, time_t now, time_t* out_deadline);
+
+/* Build the runtime condition at transfer start.  after_minutes is the
+ * relative --stop-after duration (<= 0 disables it); at_time is the absolute
+ * --stop-at deadline (only consulted when has_at is true); now_mono is the
+ * CLOCK_MONOTONIC reading at start. */
+StopCondition stop_condition_make(bool has_after, int after_minutes, bool has_at, time_t at_time,
+                                  struct timespec now_mono);
+
+/* True once either deadline has passed (wall clock first, then monotonic). */
+bool stop_condition_reached(const StopCondition* condition);
+
+#endif

src/shared/transport_ssh.c

@@ -84,32 +84,29 @@ char* ssh_build_remote_command(const char* server_path, bool old_args, char* con
   const char* suffix = " --stdio";
 
   /* Each --remote-option=OPT is appended after " --stdio" as one shell word,
-     escaped with the SAME single-quote boundary used for the server path.  This
-     stays safe even in --old-args mode (which leaves the server path unquoted):
-     remote options are always single-quoted individually, so a value containing
-     shell metacharacters (; & | ` $ ()) can never break out of the quoting to
-     inject an unrelated remote command.  Values are already validated at CLI
-     parse time (non-empty, no control characters); this layer only adds the
-     escaping boundary. */
+     escaped with the SAME single-quote boundary used for the server path, so a
+     value containing shell metacharacters (; & | ` $ ()) can never break out of
+     the quoting to inject an unrelated remote command.  Values are already
+     validated at CLI parse time (non-empty, no control characters); this layer
+     only adds the escaping boundary. */
   size_t path_len = strlen(path);
   size_t suffix_len = strlen(suffix);
 
-  /* The base command (server path, quoted unless --old-args, then " --stdio"). */
-  size_t command_len;
-  if (old_args) {
-    if (path_len > SIZE_MAX - suffix_len - 1)
-      return NULL;
-    command_len = path_len + suffix_len + 1;
-  } else {
-    size_t quote_count = 0;
-    for (const char* p = path; *p; p++)
-      if (*p == '\'')
-        quote_count++;
-    if (path_len > SIZE_MAX - suffix_len - 4 ||
-        quote_count > (SIZE_MAX - path_len - suffix_len - 4) / 4)
-      return NULL;
-    command_len = path_len + quote_count * 4 + suffix_len + 4;
-  }
+  /* The base command: the server path is ALWAYS quoted as one single-quoted
+     shell word (remote options below reuse the same escaping), then
+     " --stdio".  Quoting the path is the only injection-safe construction: an
+     unquoted path would carry shell metacharacters straight into the remote
+     shell command.  --old-args is kept for CLI/ABI compatibility but no longer
+     disables that protection. */
+  (void)old_args;
+  size_t quote_count = 0;
+  for (const char* p = path; *p; p++)
+    if (*p == '\'')
+      quote_count++;
+  if (path_len > SIZE_MAX - suffix_len - 4 ||
+      quote_count > (SIZE_MAX - path_len - suffix_len - 4) / 4)
+    return NULL;
+  size_t command_len = path_len + quote_count * 4 + suffix_len + 4;
 
   /* Add each remote option, escaped as one single-quoted word:
      " '<body>'", i.e. 1 leading space + 1 open quote + body (len + 3 per
@@ -141,25 +138,18 @@ char* ssh_build_remote_command(const char* server_path, bool old_args, char* con
   if (!command)
     return NULL;
   char* out = command;
-  if (old_args) {
-    memcpy(out, path, path_len);
-    out += path_len;
-    memcpy(out, suffix, suffix_len + 1);
-    out += suffix_len;
-  } else {
-    *out++ = '\'';
-    for (const char* p = path; *p; p++) {
-      if (*p == '\'') {
-        memcpy(out, "'\\''", 4);
-        out += 4;
-      } else {
-        *out++ = *p;
-      }
+  *out++ = '\'';
+  for (const char* p = path; *p; p++) {
+    if (*p == '\'') {
+      memcpy(out, "'\\''", 4);
+      out += 4;
+    } else {
+      *out++ = *p;
     }
-    *out++ = '\'';
-    memcpy(out, suffix, suffix_len + 1);
-    out += suffix_len;
   }
+  *out++ = '\'';
+  memcpy(out, suffix, suffix_len + 1);
+  out += suffix_len;
   for (int i = 0; i < remote_option_count; i++) {
     const char* opt = remote_options[i];
     *out++ = ' ';

src/shared/transport_ssh.h

@@ -6,10 +6,13 @@
 Client* client_connect_ssh(const char* destination, int port, const char* server_path,
                            bool old_args, const char* rsh_command, bool blocking_io,
                            char* const* remote_options, int remote_option_count);
-/* Build the escaped remote-shell command string (the server program path quoted
- * as one remote-shell word unless --old-args, followed by ` --stdio` and each
+/* Build the escaped remote-shell command string (the server program path always
+ * quoted as one remote-shell word, followed by ` --stdio` and each
  * --remote-option value appended as an individually single-quoted shell word).
- * Every --remote-option value is individually escaped with the '\'' sequence and
+ * `old_args` is accepted for CLI/ABI compatibility but no longer disables
+ * quoting: the path is always escaped so a metacharacter-bearing
+ * --rsync-path can never be interpreted by the remote shell.  Every
+ * --remote-option value is individually escaped with the '\'' sequence and
  * values with empty/control characters are rejected at the CLI parse layer. */
 char* ssh_build_remote_command(const char* server_path, bool old_args, char* const* remote_options,
                                int remote_option_count);

src/shared/transport_tls.c

@@ -48,6 +48,15 @@ static SSL_CTX* create_ssl_ctx(bool is_server, const char* cert, const char* key
     return NULL;
   }
 
+  /* Harden the context: never negotiate TLS compression (the CRIME attack
+   * vector) and never honour a post-handshake renegotiation request.
+   * SSL_OP_NO_RENEGOTIATION is only available from OpenSSL 1.1.1, so it is
+   * guarded to keep older headers building. */
+  SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION);
+#ifdef SSL_OP_NO_RENEGOTIATION
+  SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION);
+#endif
+
   if (SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION) != 1) {
     SSL_CTX_free(ctx);
     return NULL;

src/shared/utils.c

@@ -1,13 +1,16 @@
 #include "utils.h"
 #include "array_list.h"
 #include "log.h"
+#include <arpa/inet.h>
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <netinet/in.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdint.h>
+#include <sys/socket.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
@@ -543,3 +546,69 @@ bool append_tail_length(unsigned long long old_size, unsigned long long check_si
   *tail_out = check_size - old_size;
   return true;
 }
+
+/* True when a bound/peer socket address is on the loopback interface: any
+   127.0.0.0/8 IPv4 address, IPv6 ::1, or an IPv4-mapped ::ffff:127.x.x.x.  This
+   is the transport-local test the daemon auth gate uses to decide whether a
+   plaintext connection is a trustworthy local/SSH channel. */
+bool utils_sockaddr_is_loopback(const struct sockaddr* addr) {
+  if (!addr)
+    return false;
+  if (addr->sa_family == AF_INET) {
+    const struct sockaddr_in* v4 = (const struct sockaddr_in*)addr;
+    uint32_t host = ntohl(v4->sin_addr.s_addr);
+    return (host & 0xff000000u) == 0x7f000000u;
+  }
+  if (addr->sa_family == AF_INET6) {
+    const struct sockaddr_in6* v6 = (const struct sockaddr_in6*)addr;
+    if (IN6_IS_ADDR_LOOPBACK(&v6->sin6_addr))
+      return true;
+    /* An IPv4-mapped ::ffff:127.x.x.x is loopback too. */
+    if (IN6_IS_ADDR_V4MAPPED(&v6->sin6_addr) && v6->sin6_addr.s6_addr[12] == 127)
+      return true;
+    return false;
+  }
+  return false;
+}
+
+/* True when the fd's peer is provably a loopback TCP peer: getpeername must
+   succeed AND the returned address must classify as loopback.  Everything else
+   is NOT local, including a non-socket descriptor (pipe/socketpair): a failed
+   getpeername (ENOTSOCK, ENOTCONN, ...) fails closed.  The daemon auth gate
+   must not treat "I cannot tell" as "trusted", and daemon auth modules are
+   daemon-only anyway (the --stdio path never loads a daemon config). */
+bool utils_fd_peer_is_local(int fd) {
+  if (fd < 0)
+    return false;
+  struct sockaddr_storage peer;
+  socklen_t length = sizeof(peer);
+  if (getpeername(fd, (struct sockaddr*)&peer, &length) != 0)
+    return false;
+  return utils_sockaddr_is_loopback((const struct sockaddr*)&peer);
+}
+
+/* True when a client-supplied host string names a loopback destination:
+   "localhost", any 127.0.0.0/8 literal, "::1", or "[::1]". */
+bool utils_host_is_loopback(const char* host) {
+  if (!host || host[0] == '\0')
+    return false;
+  if (strcmp(host, "localhost") == 0)
+    return true;
+  struct in_addr v4;
+  if (inet_pton(AF_INET, host, &v4) == 1)
+    return (ntohl(v4.s_addr) & 0xff000000u) == 0x7f000000u;
+  struct in6_addr addr6;
+  if (host[0] == '[') {
+    size_t len = strlen(host);
+    if (len < 3 || host[len - 1] != ']')
+      return false;
+    /* inet_pton needs the bare address, not the bracketed form. */
+    char bare[INET6_ADDRSTRLEN];
+    if (len - 2 >= sizeof(bare))
+      return false;
+    memcpy(bare, host + 1, len - 2);
+    bare[len - 2] = '\0';
+    return inet_pton(AF_INET6, bare, &addr6) == 1 && IN6_IS_ADDR_LOOPBACK(&addr6);
+  }
+  return inet_pton(AF_INET6, host, &addr6) == 1 && IN6_IS_ADDR_LOOPBACK(&addr6);
+}

src/shared/utils.h

@@ -4,6 +4,7 @@
 #include "array_list.h"
 #include <stddef.h>
 #include <stdbool.h>
+#include <sys/socket.h>
 
 char* str_dup(const char* string);
 char* output_escape(const char* string, bool eight_bit_output);
@@ -66,5 +67,15 @@ bool format_human_bytes(unsigned long long bytes, char* buffer, size_t buffer_si
 bool append_resume_eligible(unsigned long long old_size, unsigned long long check_size);
 bool append_tail_length(unsigned long long old_size, unsigned long long check_size,
                         unsigned long long* tail_out);
+/* Loopback / local-transport classification for the daemon auth gate and the
+   client credential rule.  utils_sockaddr_is_loopback accepts 127.0.0.0/8,
+   IPv6 ::1 and IPv4-mapped ::ffff:127.x.x.x; utils_host_is_loopback additionally
+   accepts the literal "localhost".  utils_fd_peer_is_local is fail-closed: it is
+   true only when getpeername SUCCEEDS and reports a loopback peer -- a non-socket
+   descriptor (pipe/socketpair) or any getpeername error yields false.  See
+   utils.c for the exact accepted forms. */
+bool utils_sockaddr_is_loopback(const struct sockaddr* addr);
+bool utils_fd_peer_is_local(int fd);
+bool utils_host_is_loopback(const char* host);
 
 #endif

src/shared/xattr.c

@@ -1,5 +1,6 @@
 #define _GNU_SOURCE
 #include "xattr.h"
+#include "identity.h"
 #include "log.h"
 #include "protocol.h"
 #include "utils.h"
@@ -9,7 +10,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
 #include <sys/xattr.h>
+#include <time.h>
+#include <unistd.h>
 
 /* ---- lifecycle ---- */
 
@@ -328,4 +332,64 @@ void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int6
     log_message(LOG_LEVEL_WARNING, "--fake-super: could not store %s on destination file: %s",
                 FAKESUPER_XATTR, strerror(errno));
   }
+}
+
+/* --fake-super replay: read the freshly-stored record and re-apply the source
+ * stat fd-relative.  A privileged (root) run can actually change the owner;
+ * a non-root run silently skips the fchown on EPERM/EACCES (never fatal,
+ * mirroring the normal metadata identity path; other errors are logged) and
+ * still applies mode/mtime where permitted.
+ *
+ * The OWNER leg additionally honors three policies:
+ *   - an explicit ownership identity policy must be active (numeric-ids /
+ *     chown / usermap / groupmap / copy-as).  --fake-super on its own only
+ *     RECORDS the source owner; replaying that owner as a live chown without an
+ *     explicit ownership opt-in would be an un-gated client-chosen-ownership
+ *     primitive.
+ *   - --no-super (privilege_super_permitted() false) suppresses it even for a
+ *     root receiver, exactly like the normal metadata identity path.
+ *   - an active --copy-as is AUTHORITATIVE: the identity path already forced the
+ *     target owner, so replaying the recorded source owner here would silently
+ *     override it.  The xattr record is still stored/replayed for a later
+ *     privileged restore; only the live chown is skipped.  Mode/mtime remain
+ *     applied either way so unprivileged --fake-super still works. */
+bool fake_super_restore_fd(int fd) {
+  if (fd < 0)
+    return false;
+  char record[128];
+  ssize_t len = fgetxattr(fd, FAKESUPER_XATTR, record, sizeof(record) - 1);
+  if (len < 0)
+    return false; /* absent or filesystem without xattrs: silent no-op */
+  record[len] = '\0';
+  unsigned long ul_uid, ul_gid, ul_mode;
+  long long mtime_sec;
+  long mtime_nsec;
+  if (sscanf(record, "%lu:%lu:%lo:%lld:%ld", &ul_uid, &ul_gid, &ul_mode, &mtime_sec, &mtime_nsec) !=
+      5)
+    return false; /* malformed record: skip, never fatal */
+
+  /* Owner is applied best-effort only: a non-root process cannot chown and
+     must not abort the transfer for that reason (FastSync identity philosophy).
+     EPERM/EACCES (expected for a non-root receiver) are skipped silently; a
+     genuine EINVAL (an impossible stored id) is logged so the corruption is
+     not hidden.  --no-super suppresses the owner leg even for root, and an
+     active --copy-as is authoritative so its forced owner must not be
+     overwritten by the recorded source owner. */
+  if (identity_active_enabled() && privilege_super_permitted() && !identity_copy_as_active() &&
+      fchown(fd, (uid_t)ul_uid, (gid_t)ul_gid) != 0 && errno != EPERM && errno != EACCES)
+    log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore owner on destination file: %s",
+                strerror(errno));
+  /* Mode is applied through the same sanitization the normal metadata path
+     uses (metadata_mode): group/other write bits are never granted, so a
+     recorded source mode of 0666 restores as 0644 — identical to a non-fake-
+     super --preserve run, never a privilege-granting regression. */
+  if (fchmod(fd, (mode_t)(ul_mode & 0777U & ~(S_IWGRP | S_IWOTH))) != 0)
+    log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore mode on destination file: %s",
+                strerror(errno));
+  struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},
+                              {.tv_sec = (time_t)mtime_sec, .tv_nsec = mtime_nsec}};
+  if (futimens(fd, times) != 0)
+    log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore mtime on destination file: %s",
+                strerror(errno));
+  return true;
 }

src/shared/xattr.h

@@ -86,4 +86,16 @@ bool xattr_apply_fd(int fd, const FileXattrList* list);
 void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int64_t mtime_sec,
                          int64_t mtime_nsec);
 
+/* --fake-super replay: parse the FAKESUPER_XATTR record previously written on
+ * `fd` by fake_super_store_fd and re-apply uid/gid/mode/mtime fd-relative.
+ * Best-effort: absence of the xattr or a malformed record is a silent no-op
+ * that never fails the transfer.  The OWNER leg is applied only when an explicit
+ * ownership identity policy is active (numeric-ids/chown/usermap/groupmap/
+ * copy-as), when super-user activities are permitted, and when --copy-as is not
+ * authoritative; a non-root EPERM/EACCES is skipped silently, matching
+ * FastSync's identity philosophy.  The mode is sanitized exactly like the normal
+ * metadata path (group/other write bits never granted).  Returns true when the
+ * xattr was present and parsed. */
+bool fake_super_restore_fd(int fd);
+
 #endif

tests/fuzz/fuzz_config_receive.c

@@ -0,0 +1,346 @@
+/*
+ * Fuzz the binary config-frame receive path: Config* config_receive(int fd).
+ *
+ * The frame is a length-prefixed stream of strings/ints/bools, so the receiver
+ * stops at the first malformed field.  Feeding raw fuzz bytes alone therefore
+ * almost never reaches the deep P8 trailing blocks (--super / --copy-as) or the
+ * identity-map block, because every preceding wire bool must be exactly 0 or 1.
+ *
+ * To exercise those paths we first build one canonical, fully-valid frame with
+ * the production sender and then feed the receiver four shapes:
+ *
+ *   1. raw     : the raw fuzz bytes as the whole frame (version gate included).
+ *   2. general : the valid version-string prefix + the raw fuzz bytes, so the
+ *                fuzzer can walk the early/core/selection blocks from arbitrary
+ *                input while staying past the version gate.
+ *   3. tail    : the valid frame up to its last P8_TAIL_BYTES (super_mode +
+ *                copy-as presence/uid/gid) + the raw fuzz bytes, so the fuzzer
+ *                directly mutates super_mode and the copy-as ids and truncates
+ *                the tail at any byte.
+ *   4. map     : the valid frame up to the --usermap count + the raw fuzz bytes,
+ *                so the fuzzer directly drives the map count (huge/extreme) and
+ *                the map entries.
+ *
+ * The canonical frame is captured by running config_send once, writing the
+ * frame into a pipe whose read end is drained afterwards; the STATUS_OK ack is
+ * pre-loaded into a second pipe so a single thread suffices.
+ */
+#include "config.h"
+#include "credentials.h"
+#include "protocol.h"
+#include "utils.h"
+#include <errno.h>
+#include <fcntl.h>
+#include <openssl/evp.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+/* super_mode (4) + copy-as presence (4) + uid (4) + gid (4) = the P8 tail. */
+#define P8_TAIL_BYTES 16
+
+/* Distinctive --usermap entry used to locate the map-count field in the
+ * canonical frame without duplicating the wire layout here. */
+#define MAP_FROM 0x11223344
+#define MAP_TO 0x55667788
+
+static unsigned char* g_frame;
+static size_t g_frame_len;
+static size_t g_version_len;       /* length of the leading version-string frame */
+static size_t g_usermap_count_off; /* offset of the usermap count int, 0 = unknown */
+static size_t g_auth_off;          /* offset of the auth presence int, 0 = unknown */
+static bool g_auth_found;          /* whether g_auth_off is valid */
+static bool g_frame_ready;
+
+/* Read the canonical frame from the send peer.  The producer shuts down its
+ * write half first, so a blocking read drains the frame and then sees EOF. */
+static unsigned char* drain_frame(int fd, size_t* out_len) {
+  size_t cap = 4096;
+  size_t len = 0;
+  unsigned char* buf = malloc(cap);
+  if (!buf)
+    return NULL;
+  for (;;) {
+    if (len == cap) {
+      size_t grown = cap * 2;
+      unsigned char* bigger = realloc(buf, grown);
+      if (!bigger) {
+        free(buf);
+        return NULL;
+      }
+      buf = bigger;
+      cap = grown;
+    }
+    ssize_t n = read(fd, buf + len, cap - len);
+    if (n > 0) {
+      len += (size_t)n;
+      continue;
+    }
+    if (n < 0 && errno == EINTR)
+      continue;
+    break; /* 0 (EOF) or error */
+  }
+  *out_len = len;
+  return buf;
+}
+
+/* Serialize a valid Config with the real sender.  The frame is written into a
+ * pipe (64 KiB kernel buffer, far larger than one config frame) whose read end
+ * is drained afterwards; the STATUS_OK ack is pre-loaded into a second pipe so
+ * a single thread suffices (config_send writes the whole frame before it reads
+ * the ack). */
+static void build_canonical_frame(void) {
+  g_frame_ready = true;
+
+  Config* cfg = config_create();
+  if (!cfg)
+    return;
+  cfg->send_directory = str_dup("/src");
+  cfg->receive_root_directory = str_dup("/dst");
+  /* Force the shortened auth block (`[present][username]`) to be present so the
+   * fuzzer can mutate it. */
+  cfg->auth_user = str_dup("alice");
+  cfg->auth_password = str_dup("alice-s3cret");
+  /* Force the three P8 tail fields to be present (copy-as requires metadata). */
+  cfg->copy_as_set = true;
+  cfg->copy_as_uid = 0;
+  cfg->copy_as_gid = 0;
+  cfg->use_metadata = true;
+  /* Force one usermap entry with a locatable sentinel. */
+  cfg->usermap = malloc(sizeof(IdentityMap));
+  if (cfg->usermap) {
+    cfg->usermap_count = 1;
+    cfg->usermap[0].from = MAP_FROM;
+    cfg->usermap[0].to = MAP_TO;
+  }
+  if (!cfg->send_directory || !cfg->receive_root_directory || !cfg->usermap) {
+    config_delete(cfg);
+    return;
+  }
+
+  int frame_pipe[2] = {-1, -1};
+  int status_pipe[2] = {-1, -1};
+  if (pipe(frame_pipe) != 0 || pipe(status_pipe) != 0)
+    goto out;
+
+  int ack = STATUS_OK;
+  if (write(status_pipe[1], &ack, sizeof(ack)) != (ssize_t)sizeof(ack))
+    goto out;
+
+  io_set_fds(status_pipe[0], frame_pipe[1]);
+  io_set_bwlimit(0);
+  bool sent = config_send(frame_pipe[1], cfg);
+  close(frame_pipe[1]);
+  frame_pipe[1] = -1;
+  close(status_pipe[0]);
+  status_pipe[0] = -1;
+  close(status_pipe[1]);
+  status_pipe[1] = -1;
+
+  if (sent)
+    g_frame = drain_frame(frame_pipe[0], &g_frame_len);
+
+out:
+  if (frame_pipe[0] != -1)
+    close(frame_pipe[0]);
+  if (frame_pipe[1] != -1)
+    close(frame_pipe[1]);
+  if (status_pipe[0] != -1)
+    close(status_pipe[0]);
+  if (status_pipe[1] != -1)
+    close(status_pipe[1]);
+  config_delete(cfg);
+  if (!g_frame || g_frame_len == 0) {
+    free(g_frame);
+    g_frame = NULL;
+    g_frame_len = 0;
+    return;
+  }
+
+  g_version_len = sizeof(size_t) + strlen(PROTOCOL_VERSION);
+  if (g_version_len > g_frame_len)
+    g_version_len = g_frame_len;
+
+  /* Locate the usermap entry sentinel; its count int sits 4 bytes before it. */
+  int32_t from = MAP_FROM;
+  int32_t to = MAP_TO;
+  unsigned char pattern[8];
+  memcpy(pattern, &from, sizeof(from));
+  memcpy(pattern + sizeof(from), &to, sizeof(to));
+  if (g_frame_len >= sizeof(pattern)) {
+    for (size_t i = 4; i + sizeof(pattern) <= g_frame_len; i++) {
+      if (memcmp(g_frame + i, pattern, sizeof(pattern)) == 0) {
+        g_usermap_count_off = i - sizeof(int32_t);
+        break;
+      }
+    }
+  }
+
+  /* Locate the auth username string (a size_t length followed by its bytes);
+   * the presence int sits one int before the length.  The username bytes cannot
+   * start before sizeof(size_t)+sizeof(int) without the presence-int offset
+   * underflowing, so begin the scan there. */
+  const char* auth_name = "alice";
+  size_t auth_name_len = strlen(auth_name);
+  if (g_frame_len >= sizeof(size_t) + auth_name_len + sizeof(int)) {
+    for (size_t i = sizeof(size_t) + sizeof(int); i + auth_name_len <= g_frame_len; i++) {
+      if (memcmp(g_frame + i, auth_name, auth_name_len) != 0)
+        continue;
+      size_t found_len = 0;
+      memcpy(&found_len, g_frame + i - sizeof(size_t), sizeof(size_t));
+      if (found_len == auth_name_len) {
+        g_auth_off = i - sizeof(size_t) - sizeof(int);
+        g_auth_found = true;
+        break;
+      }
+    }
+  }
+}
+
+/* Fuzz the A7 auth crypto primitives directly: arbitrary bytes through the
+ * base64 decoder, plus a self-consistent SCRAM property (a proof built from a
+ * chosen client key must verify, while a tampered proof, a proof replayed
+ * against a different nonce, and a not-found verifier must all be refused). */
+static uint8_t pick_byte(const uint8_t* data, size_t size, size_t index) {
+  return size ? data[index % size] : 0;
+}
+
+static void fuzz_credentials(const uint8_t* data, size_t size) {
+  char b64[300];
+  size_t n = size < sizeof(b64) - 1 ? size : sizeof(b64) - 1;
+  memcpy(b64, data, n);
+  b64[n] = '\0';
+  uint8_t decoded[64];
+  size_t decoded_len = 0;
+  (void)credentials_b64_decode(b64, decoded, sizeof(decoded), &decoded_len);
+
+  uint8_t client_key[CREDENTIAL_KEY_LEN];
+  uint8_t stored_key[CREDENTIAL_KEY_LEN];
+  uint8_t server_key[CREDENTIAL_KEY_LEN];
+  uint8_t snonce[CREDENTIAL_NONCE_LEN];
+  uint8_t cnonce[CREDENTIAL_NONCE_LEN];
+  for (size_t i = 0; i < CREDENTIAL_KEY_LEN; i++) {
+    client_key[i] = pick_byte(data, size, i);
+    server_key[i] = pick_byte(data, size, i + CREDENTIAL_KEY_LEN);
+  }
+  for (size_t i = 0; i < CREDENTIAL_NONCE_LEN; i++) {
+    snonce[i] = pick_byte(data, size, i + 2 * CREDENTIAL_KEY_LEN);
+    cnonce[i] = pick_byte(data, size, i + 2 * CREDENTIAL_KEY_LEN + CREDENTIAL_NONCE_LEN);
+  }
+  unsigned int stored_len = 0;
+  if (EVP_Digest(client_key, sizeof(client_key), stored_key, &stored_len, EVP_sha256(), NULL) !=
+          1 ||
+      stored_len != CREDENTIAL_KEY_LEN)
+    return;
+  uint8_t auth_msg[CREDENTIAL_AUTH_MESSAGE_MAX];
+  size_t msg_len = 0;
+  if (!credentials_build_auth_message("alice", snonce, cnonce, auth_msg, sizeof(auth_msg),
+                                      &msg_len))
+    return;
+  uint8_t proof[CREDENTIAL_KEY_LEN];
+  uint8_t server_sig[CREDENTIAL_KEY_LEN];
+  if (!credentials_client_proof(client_key, stored_key, server_key, auth_msg, msg_len, proof,
+                                server_sig))
+    return;
+  CredentialVerifier verifier;
+  memset(&verifier, 0, sizeof(verifier));
+  verifier.found = true;
+  verifier.iters = CREDENTIAL_DEFAULT_ITERS;
+  memcpy(verifier.stored_key, stored_key, CREDENTIAL_KEY_LEN);
+  memcpy(verifier.server_key, server_key, CREDENTIAL_KEY_LEN);
+  uint8_t out_sig[CREDENTIAL_KEY_LEN];
+  if (!credentials_verify_response(&verifier, "alice", snonce, cnonce, proof, out_sig))
+    abort();
+  if (memcmp(out_sig, server_sig, CREDENTIAL_KEY_LEN) != 0)
+    abort();
+  uint8_t bad_proof[CREDENTIAL_KEY_LEN];
+  memcpy(bad_proof, proof, CREDENTIAL_KEY_LEN);
+  bad_proof[pick_byte(data, size, 0) % CREDENTIAL_KEY_LEN] ^= 0x01;
+  if (credentials_verify_response(&verifier, "alice", snonce, cnonce, bad_proof, out_sig))
+    abort();
+  uint8_t other_cnonce[CREDENTIAL_NONCE_LEN];
+  memcpy(other_cnonce, cnonce, CREDENTIAL_NONCE_LEN);
+  other_cnonce[pick_byte(data, size, 1) % CREDENTIAL_NONCE_LEN] ^= 0x80;
+  if (credentials_verify_response(&verifier, "alice", snonce, other_cnonce, proof, out_sig))
+    abort();
+  verifier.found = false;
+  if (credentials_verify_response(&verifier, "alice", snonce, cnonce, proof, out_sig))
+    abort();
+}
+
+/* Best-effort non-blocking write: an oversized fuzz input is truncated rather
+ * than stalling the harness. */
+static void write_best_effort(int fd, const void* data, size_t size) {
+  const unsigned char* p = data;
+  size_t off = 0;
+  while (off < size) {
+    ssize_t n = write(fd, p + off, size - off);
+    if (n > 0) {
+      off += (size_t)n;
+      continue;
+    }
+    if (n < 0 && errno == EINTR)
+      continue;
+    break;
+  }
+}
+
+/* Build prefix ++ data as a stream and drive config_receive over it. */
+static void receive_stream(const unsigned char* prefix, size_t prefix_len, const uint8_t* data,
+                           size_t size) {
+  int sv[2];
+  if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) != 0)
+    return;
+
+  int flags = fcntl(sv[0], F_GETFL, 0);
+  if (flags != -1)
+    (void)fcntl(sv[0], F_SETFL, flags | O_NONBLOCK);
+
+  if (prefix_len > 0)
+    write_best_effort(sv[0], prefix, prefix_len);
+  if (size > 0)
+    write_best_effort(sv[0], data, size);
+  /* Signal EOF without closing the read half, so the receiver's STATUS_ERROR
+   * replies do not hit EPIPE. */
+  shutdown(sv[0], SHUT_WR);
+
+  io_set_fds(sv[1], sv[1]);
+  io_set_bwlimit(0);
+  Config* cfg = config_receive(sv[1]);
+  config_delete(cfg);
+
+  close(sv[0]);
+  close(sv[1]);
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  fuzz_credentials(data, size);
+
+  if (!g_frame_ready)
+    build_canonical_frame();
+
+  /* Raw bytes as the whole frame (version gate and all). */
+  receive_stream(NULL, 0, data, size);
+
+  if (g_frame) {
+    /* Keep the valid version prefix, fuzz everything after it. */
+    receive_stream(g_frame, g_version_len, data, size);
+
+    /* Keep the valid frame up to the shortened auth block, fuzz it. */
+    if (g_auth_found)
+      receive_stream(g_frame, g_auth_off, data, size);
+
+    /* Keep the valid frame up to the P8 tail, fuzz super_mode + copy-as. */
+    if (g_frame_len > P8_TAIL_BYTES)
+      receive_stream(g_frame, g_frame_len - P8_TAIL_BYTES, data, size);
+
+    /* Keep the valid frame up to the usermap count, fuzz the count + entries. */
+    if (g_usermap_count_off > 0)
+      receive_stream(g_frame, g_usermap_count_off, data, size);
+  }
+  return 0;
+}

tests/fuzz/fuzz_identity_parse.c

@@ -0,0 +1,58 @@
+/*
+ * Fuzz the CLI-time identity parsers (identity.h):
+ *   - identity_parse_copy_as
+ *   - identity_parse_map (user and group variants)
+ *   - identity_parse_chown
+ *
+ * Each parser mutates a Config, so every input gets a fresh config_create()
+ * (freed afterwards).  After a successful parse the shared wire validator and
+ * the ownership predicate are also exercised on the mutated config.  The input
+ * is NUL-terminated; embedded NULs simply shorten the effective spec, which is
+ * fine for a parser fuzzer.
+ */
+#include "config.h"
+#include "identity.h"
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+static void exercise(Config* c, const char* spec, int which) {
+  if (!c)
+    return;
+  switch (which) {
+  case 0:
+    (void)identity_parse_copy_as(c, spec);
+    break;
+  case 1:
+    (void)identity_parse_map(c, spec, false);
+    break;
+  case 2:
+    (void)identity_parse_map(c, spec, true);
+    break;
+  default:
+    (void)identity_parse_chown(c, spec);
+    break;
+  }
+  (void)identity_wire_valid(c);
+  (void)identity_ownership_requested(c);
+  config_delete(c);
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size == 0)
+    return 0;
+
+  char* spec = malloc(size + 1);
+  if (!spec)
+    return 0;
+  memcpy(spec, data, size);
+  spec[size] = '\0';
+
+  exercise(config_create(), spec, 0);
+  exercise(config_create(), spec, 1);
+  exercise(config_create(), spec, 2);
+  exercise(config_create(), spec, 3);
+
+  free(spec);
+  return 0;
+}

tests/integration/test_append.py

@@ -138,7 +138,7 @@ class TestAppend:
         self._place(source, REL, prefix + added)
         self._place(self._dest_file(source, dest, ""), REL, prefix)
 
-        result, _ = run_client(source, dest, flags=["--append", "-m"], port=shared_server.port)
+        result, _ = run_client(source, dest, flags=["--append", "--threads"], port=shared_server.port)
         assert result.returncode == 0, \
             f"--append -m failed: {(result.stderr or result.stdout)[:400]}"
         assert self._read(self._dest_file(source, dest, ""), REL) == prefix + added

tests/integration/test_batch.py

@@ -0,0 +1,120 @@
+"""Residual-batch (client-only) driver tests.
+
+--write-batch / --only-write-batch emit a self-contained batch file of a whole
+source tree; --read-batch applies one locally.  None of these cross the wire (no
+PROTOCOL_VERSION bump, no config-frame field, no server flag): only --write-batch
+also performs a live transfer and so needs a server.
+"""
+import os
+import shutil
+import subprocess
+import sys
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import (
+    TEST_DATA_DIR,
+    run_client,
+    generate_test_files,
+    verify_transfer,
+    clean_dir,
+    get_dest_received_dir,
+    CLIENT_CMD,
+)
+
+SOURCE_DIR = os.path.join(TEST_DATA_DIR, "batch_source")
+DEST1 = os.path.join(TEST_DATA_DIR, "batch_dest1")
+DEST2 = os.path.join(TEST_DATA_DIR, "batch_dest2")
+BATCH_FILE = os.path.join(TEST_DATA_DIR, "batch.bin")
+
+BATCH_MAGIC = b"FSTRESBATCH"
+
+
+@pytest.fixture(scope="module", autouse=True)
+def setup_test_data():
+    generate_test_files(SOURCE_DIR, full=False)
+    clean_dir(DEST1)
+    clean_dir(DEST2)
+    yield
+    shutil.rmtree(SOURCE_DIR, ignore_errors=True)
+    shutil.rmtree(DEST1, ignore_errors=True)
+    shutil.rmtree(DEST2, ignore_errors=True)
+    for p in (BATCH_FILE,):
+        if os.path.exists(p):
+            os.unlink(p)
+
+
+def _run(args):
+    return CLIENT_CMD + args
+
+
+def test_write_batch_no_server():
+    """--only-write-batch emits a batch from the source with no destination and
+    no server connection."""
+    if os.path.exists(BATCH_FILE):
+        os.unlink(BATCH_FILE)
+    cmd = _run(["--only-write-batch", BATCH_FILE, SOURCE_DIR])
+    result = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
+    assert result.returncode == 0, (result.stdout, result.stderr)
+    with open(BATCH_FILE, "rb") as f:
+        assert f.read(len(BATCH_MAGIC)) == BATCH_MAGIC
+    # No destination was touched (nothing was created next to the batch).
+    assert not os.path.exists(os.path.join(DEST1, "small.txt"))
+
+
+def test_read_batch_roundtrip_no_source():
+    """--read-batch applies an emitted batch to a fresh destination with no
+    source and no server; the tree is byte-identical to the source."""
+    received = get_dest_received_dir(DEST2, SOURCE_DIR)
+    clean_dir(DEST2)
+    cmd = _run(["--read-batch", BATCH_FILE, DEST2])
+    result = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
+    assert result.returncode == 0, (result.stdout, result.stderr)
+    mismatches, missing = verify_transfer(SOURCE_DIR, received)
+    assert not missing, f"Missing: {missing[:5]}"
+    assert not mismatches, f"Mismatch: {mismatches[:5]}"
+
+
+def test_write_batch_with_transfer(shared_server):
+    """--write-batch runs a live transfer to a server AND emits the batch file."""
+    if os.path.exists(BATCH_FILE):
+        os.unlink(BATCH_FILE)
+    clean_dir(DEST1)
+    result, _ = run_client(
+        SOURCE_DIR, DEST1,
+        flags=["--write-batch", BATCH_FILE], port=shared_server.port)
+    assert result.returncode == 0, (result.stdout, result.stderr)
+    with open(BATCH_FILE, "rb") as f:
+        assert f.read(len(BATCH_MAGIC)) == BATCH_MAGIC
+    received = get_dest_received_dir(DEST1, SOURCE_DIR)
+    mismatches, missing = verify_transfer(SOURCE_DIR, received)
+    assert not missing, f"Missing: {missing[:5]}"
+    assert not mismatches, f"Mismatch: {mismatches[:5]}"
+
+
+def test_read_batch_requires_destination():
+    """--read-batch with no positional destination fails cleanly."""
+    cmd = _run(["--read-batch", BATCH_FILE])
+    result = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
+    assert result.returncode != 0
+
+
+def test_only_write_batch_requires_source():
+    """--only-write-batch with no source fails cleanly."""
+    cmd = _run(["--only-write-batch", BATCH_FILE])
+    result = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
+    assert result.returncode != 0
+
+
+def test_batch_modes_conflict():
+    """The three batch flags are mutually exclusive."""
+    combos = [
+        ["--write-batch", BATCH_FILE, "--only-write-batch", BATCH_FILE],
+        ["--write-batch", BATCH_FILE, "--read-batch", BATCH_FILE],
+        ["--only-write-batch", BATCH_FILE, "--read-batch", BATCH_FILE],
+    ]
+    for flags in combos:
+        cmd = _run(["--source-dir", SOURCE_DIR, "--dest-dir", DEST1] + flags)
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
+        assert result.returncode != 0, \
+            f"expected conflict failure for {flags}: {result.stderr}"

tests/integration/test_daemon.py

@@ -5,19 +5,28 @@ started with --daemon reads a FastSync-native module config file, the client
 asks for a module with a host::module/path destination, and the transfer lands
 in the configured module root only.  Read-only modules, unknown modules, and
 auth-required modules without valid credentials are all refused cleanly before
-any data moves.  Wave B (daemon authentication) adds the real credential
-round-trips exercised in TestDaemonAuthentication: modules that declare
-`auth users` accept only a client whose --password-file presents a username on
-the module's list with a matching password (verified as a SHA-256 digest), and
-the daemon refuses to start when such a module has no credential store.
+any data moves.  The A7 auth wave adds the real credential round-trips exercised
+in TestDaemonAuthentication: modules that declare `auth users` accept only a
+client whose --password-file presents a username on the module's list, proven
+through a SCRAM-SHA-256-style challenge/response against a salted PBKDF2
+verifier.  The daemon refuses to start when such a module has no credential
+store, a legacy SHA-256 store line is hard-rejected, and a replayed response
+from another connection is refused.
 """
+import base64
 import glob
 import hashlib
+import hmac
 import os
+import select
 import shutil
 import signal
+import socket
+import stat
+import struct
 import subprocess
 import sys
+import tempfile
 import time
 
 import pytest
@@ -41,6 +50,7 @@ FILES_MODULE = os.path.join(MODULE_ROOT, "files")
 READONLY_MODULE = os.path.join(MODULE_ROOT, "readonly")
 AUTH_MODULE = os.path.join(MODULE_ROOT, "auth")
 TEAM_MODULE = os.path.join(MODULE_ROOT, "team")
+OWNER_MODULE = os.path.join(MODULE_ROOT, "owner")
 CONF_FILE = os.path.join(TEST_DATA_DIR, "fastsyncd.conf")
 CRED_FILE = os.path.join(TEST_DATA_DIR, "fastsyncd.passwd")
 STARTFAIL_CONF = os.path.join(TEST_DATA_DIR, "fastsyncd_startfail.conf")
@@ -55,14 +65,45 @@ ALICE_PASS = "alice-s3cret"
 BOB_PASS = "bob-s3cret"
 WRONG_PASS = "wrong-password"
 
+# The store holds a salted PBKDF2 verifier (A7 SCRAM); this is the exact
+# derivation the C implementation performs, recomputed here so the tests are an
+# independent reference.  100000 keeps the module import fast while staying at
+# the validation minimum.
+CRED_ITERS = 100000
 
-def _pw_hash(password):
-    return hashlib.sha256(password.encode()).hexdigest()
+
+def _verifier(password, salt, iters=CRED_ITERS):
+    key = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, iters, 32)
+    client_key = hmac.new(key, b"Client Key", hashlib.sha256).digest()
+    stored_key = hashlib.sha256(client_key).digest()
+    server_key = hmac.new(key, b"Server Key", hashlib.sha256).digest()
+    return stored_key, server_key
+
+
+def _store_line(user, password, iters=CRED_ITERS, salt=None):
+    if salt is None:
+        salt = os.urandom(16)
+    stored_key, server_key = _verifier(password, salt, iters)
+    return "%s:$fastsync$1$pbkdf2-sha256$%d$%s$%s$%s" % (
+        user, iters, base64.b64encode(salt).decode(),
+        base64.b64encode(stored_key).decode(), base64.b64encode(server_key).decode())
+
+
+def _store_secrets(line):
+    """The base64 stored_key/server_key fields of a store line (the values that
+    must never appear in a log)."""
+    parts = line.split("$")
+    return parts[-2], parts[-1]
+
+
+ALICE_LINE = _store_line("alice", ALICE_PASS)
+BOB_LINE = _store_line("bob", BOB_PASS)
 
 
 def _write_client_password_file(path, user, password):
     with open(path, "w") as f:
         f.write("%s:%s\n" % (user, password))
+    os.chmod(path, 0o600)
     return path
 
 
@@ -149,17 +190,19 @@ def _config_port(config_path):
 
 @pytest.fixture(scope="module", autouse=True)
 def daemon_env():
-    for d in (MODULE_ROOT, FILES_MODULE, READONLY_MODULE, AUTH_MODULE, TEAM_MODULE, DETACH_MODULE):
+    for d in (MODULE_ROOT, FILES_MODULE, READONLY_MODULE, AUTH_MODULE, TEAM_MODULE, OWNER_MODULE,
+              DETACH_MODULE):
         shutil.rmtree(d, ignore_errors=True)
         os.makedirs(d, exist_ok=True)
     generate_test_files(SOURCE_DIR, full=False)
 
-    # Server-side credential store: alice and bob (password digests only; the
-    # plaintext passwords never appear on the daemon host or in any log).
+    # Server-side credential store: alice and bob (salted PBKDF2 verifiers only;
+    # the plaintext passwords never appear on the daemon host or in any log).
     with open(CRED_FILE, "w") as f:
-        f.write("# daemon credential store (Wave B)\n")
-        f.write("alice:%s\n" % _pw_hash(ALICE_PASS))
-        f.write("bob:%s\n" % _pw_hash(BOB_PASS))
+        f.write("# daemon credential store (A7 SCRAM)\n")
+        f.write(ALICE_LINE + "\n")
+        f.write(BOB_LINE + "\n")
+    os.chmod(CRED_FILE, 0o600)
 
     # The config's port is a free port chosen per worker; the `daemon` fixture
     # boots on it (the config-port path) and the --dparam override test boots a
@@ -184,7 +227,11 @@ def daemon_env():
             "[team]\n"
             "path = %s\n"
             "auth users = alice,bob\n"
-            % (config_port, FILES_MODULE, READONLY_MODULE, AUTH_MODULE, TEAM_MODULE))
+            "\n"
+            "[owner]\n"
+            "path = %s\n"
+            "client owner = yes\n"
+            % (config_port, FILES_MODULE, READONLY_MODULE, AUTH_MODULE, TEAM_MODULE, OWNER_MODULE))
 
     # A dedicated config for the fail-closed startup check: an auth-required
     # module with no credential store must refuse to start.  Its own free port
@@ -238,6 +285,21 @@ def _tree_file_count(root):
     return sum(len(files) for _, _, files in os.walk(root)) if os.path.exists(root) else 0
 
 
+def _can_mknod():
+    """True when this process may create a char device (needs root/CAP_MKNOD)."""
+    probe = os.path.join(tempfile.gettempdir(), "._fastsync_mknod_probe_%d" % os.getpid())
+    try:
+        os.mknod(probe, stat.S_IFCHR | 0o600, os.makedev(1, 3))
+        os.unlink(probe)
+        return True
+    except (OSError, AttributeError):
+        try:
+            os.unlink(probe)
+        except OSError:
+            pass
+        return False
+
+
 class TestDaemonModuleSelection:
     @pytest.mark.ci
     def test_module_transfer(self, daemon):
@@ -320,6 +382,125 @@ class TestDaemonRejection:
         assert result.returncode != 0
         assert _tree_file_count(AUTH_MODULE) == 0
 
+    def _assert_ownership_refused(self, daemon, module, flags,
+                                  accept=("client-chosen ownership",)):
+        """A daemon module without `client owner = yes` refuses every
+        client-chosen ownership / super-user request at the config handshake,
+        before any data lands.  `accept` lists the log phrases that count as the
+        refusal (a non-root daemon refuses --copy-as earlier, at the privilege
+        check, so the caller accepts that phrase too)."""
+        log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
+        before = os.path.getsize(log_path) if os.path.exists(log_path) else 0
+        before_files = self._tree_files()
+        result, _ = run_client(SOURCE_DIR, f"127.0.0.1::{module}", port=daemon.port, flags=flags)
+        assert result.returncode != 0, f"the daemon must refuse {flags}"
+        assert self._tree_files() == before_files, \
+            f"{flags} refusal wrote under the module root"
+        time.sleep(0.3)
+        with open(log_path, "rb") as f:
+            f.seek(before)
+            tail = f.read().decode("utf-8", "replace")
+        assert any(phrase in tail for phrase in accept), (
+            f"daemon did not log the ownership refusal: {tail[-400:]!r}"
+        )
+
+    def test_copy_as_refused_by_daemon(self, daemon):
+        """P7 Wave E hardening: a daemon refuses client-chosen ownership
+        (--copy-as) outright unless the module opts in with `client owner = yes`,
+        so even a root daemon must not honor an arbitrary client-selected owner
+        by default.  The refusal happens at the config handshake, before any data
+        lands."""
+        self._assert_ownership_refused(
+            daemon, "files", ["--copy-as=@65534:@65534"],
+            accept=("client-chosen ownership", "requires a privileged receiver"))
+
+    def test_super_refused_by_daemon(self, daemon):
+        """An explicit --super is a super-user activity request, so a daemon
+        module refuses it unless it opts in with `client owner = yes`.  The
+        refusal happens at the config handshake, before any data lands."""
+        self._assert_ownership_refused(daemon, "files", ["--super", "--preserve"])
+
+    def test_super_refused_by_no_super_daemon(self):
+        """A daemon started with the operator --no-super veto must still REFUSE
+        an explicit client --super on a non-opted module: the veto must not turn
+        the refusal into a silent accept."""
+        port = _find_free_port()
+        d = DaemonManager()
+        log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
+        try:
+            d.start(CONF_FILE, port_override=port,
+                    extra_args=["--password-file", CRED_FILE, "--no-super"])
+            result, _ = run_client(SOURCE_DIR, "127.0.0.1::files", port=d.port,
+                                   flags=["--super", "--preserve"])
+            assert result.returncode != 0, "the --no-super daemon must refuse --super"
+            with open(log_path, "rb") as f:
+                tail = f.read().decode("utf-8", "replace")
+            assert "client-chosen ownership" in tail, (
+                f"daemon did not log the --super refusal: {tail[-400:]!r}"
+            )
+        finally:
+            d.stop()
+
+    def test_numeric_ids_refused_by_daemon(self, daemon):
+        """P7 Wave E hardening (A1): the daemon ownership gate must cover the
+        pre-existing identity flags too, not only --copy-as/--super.  A module
+        without `client owner = yes` refuses --numeric-ids at the handshake."""
+        self._assert_ownership_refused(daemon, "files", ["--numeric-ids", "--preserve"])
+
+    def test_chown_refused_by_daemon(self, daemon):
+        """--chown is client-chosen ownership too and must be refused by a
+        non-opted-in module."""
+        self._assert_ownership_refused(daemon, "files", ["--chown=@65534:@65534", "--preserve"])
+
+    def test_owner_opt_in_allows_numeric_ids(self, daemon):
+        """A module that opts in with `client owner = yes` accepts the
+        client-chosen ownership flags (here --numeric-ids); the transfer
+        succeeds and lands inside that module root."""
+        result, _ = run_client(SOURCE_DIR, "127.0.0.1::owner", port=daemon.port,
+                               flags=["--numeric-ids", "--preserve"])
+        assert result.returncode == 0, result.stderr or result.stdout
+        received = get_dest_received_dir(OWNER_MODULE, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"missing: {missing[:5]}"
+        assert not mismatches, f"mismatch: {mismatches[:5]}"
+
+    def _device_source(self, name):
+        src = os.path.join(TEST_DATA_DIR, name)
+        shutil.rmtree(src, ignore_errors=True)
+        os.makedirs(src)
+        with open(os.path.join(src, "f.txt"), "wb") as fh:
+            fh.write(b"device gate\n")
+        os.mknod(os.path.join(src, "null"), stat.S_IFCHR | 0o666, os.makedev(1, 3))
+        return src
+
+    @pytest.mark.skipif(not _can_mknod(), reason="device nodes need root/CAP_MKNOD")
+    def test_devices_skipped_without_owner_opt_in(self, daemon):
+        """H3: a non-opted daemon module must not create device nodes even under
+        the default AUTO super mode (a root daemon would otherwise let any client
+        mknod arbitrary devices).  An ordinary -a push still succeeds; the device
+        entry is skipped."""
+        src = self._device_source("devsrc_noowner")
+        os.makedirs(os.path.join(FILES_MODULE, "devskip"), exist_ok=True)
+        result, _ = run_client(src, "127.0.0.1::files/devskip", port=daemon.port, flags=["-a"])
+        assert result.returncode == 0, result.stderr or result.stdout
+        received = get_dest_received_dir(os.path.join(FILES_MODULE, "devskip"), src)
+        node = os.path.join(received, "null")
+        assert not os.path.exists(node) or not stat.S_ISCHR(os.stat(node).st_mode), \
+            "non-opted daemon module created a device node"
+
+    @pytest.mark.skipif(not _can_mknod(), reason="device nodes need root/CAP_MKNOD")
+    def test_devices_created_with_owner_opt_in(self, daemon):
+        """Control: an opted-in module (`client owner = yes`) may create device
+        nodes under -a, proving the clamp is specific to non-opted modules."""
+        src = self._device_source("devsrc_owner")
+        os.makedirs(os.path.join(OWNER_MODULE, "devok"), exist_ok=True)
+        result, _ = run_client(src, "127.0.0.1::owner/devok", port=daemon.port, flags=["-a"])
+        assert result.returncode == 0, result.stderr or result.stdout
+        received = get_dest_received_dir(os.path.join(OWNER_MODULE, "devok"), src)
+        node = os.path.join(received, "null")
+        assert os.path.exists(node) and stat.S_ISCHR(os.stat(node).st_mode), \
+            "opted-in daemon module did not create the device node"
+
     @pytest.mark.daemon_detach
     def test_real_detach_path(self):
         """--daemon WITHOUT --no-detach double-forks a real background daemon;
@@ -374,6 +555,139 @@ class TestDaemonRejection:
             d.stop()
 
 
+# Numeric status values (must match the enum order in src/shared/protocol.h).
+STATUS_AUTH_CHALLENGE = 21
+STATUS_AUTH_RESPONSE = 22
+_AUTH_FRAME_MAX = 1 << 20
+
+
+def _wire_string_frame_len(buf, off):
+    """Return the total byte length of the wire string at buf[off], or None when
+    more bytes are needed."""
+    if len(buf) < off + 8:
+        return None
+    (length,) = struct.unpack_from("<Q", buf, off)
+    if length > _AUTH_FRAME_MAX:
+        raise ValueError("oversized auth frame string")
+    if len(buf) < off + 8 + length:
+        return None
+    return 8 + length
+
+
+def _client_cmd(dest, port, cred_path):
+    return CLIENT_CMD + ["--source-dir", SOURCE_DIR, "--dest-dir", dest,
+                         "--save-to-disk", "--server-port", str(port),
+                         "--password-file", cred_path]
+
+
+class _AuthReplayProxy:
+    """A one-connection-at-a-time TCP relay in front of the daemon.
+
+    The capture connection records the client's STATUS_AUTH_RESPONSE frame (the
+    status, the client nonce string and the proof string); the replay connection
+    substitutes that recorded frame for its own response, so the daemon sees a
+    proof bound to the FIRST connection's challenge nonce."""
+
+    def __init__(self, backend_port):
+        self.backend = ("127.0.0.1", backend_port)
+        self.server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        self.server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        self.server.bind(("127.0.0.1", 0))
+        self.server.listen(4)
+        self.server.settimeout(20)
+        self.port = self.server.getsockname()[1]
+        self.stolen = None
+        # Set when a relayed connection received a SCRAM challenge from the
+        # backend; lets a test assert the daemon refused before any challenge.
+        self.saw_challenge = False
+
+    def close(self):
+        try:
+            self.server.close()
+        except OSError:
+            pass
+
+    def _run_connection(self, capture):
+        client, _ = self.server.accept()
+        backend = socket.create_connection(self.backend, timeout=20)
+        client.settimeout(20)
+        backend.settimeout(20)
+        buf_c = b""
+        buf_s = b""
+        state = "config"
+        try:
+            while True:
+                ready, _, _ = select.select([client, backend], [], [], 20)
+                if not ready:
+                    break
+                eof = False
+                for sock in ready:
+                    data = sock.recv(65536)
+                    if not data:
+                        eof = True
+                        continue
+                    if sock is client:
+                        buf_c += data
+                    else:
+                        buf_s += data
+                if state == "config":
+                    if buf_c:
+                        backend.sendall(buf_c)
+                        buf_c = b""
+                    if len(buf_s) >= 4:
+                        (status,) = struct.unpack_from("<i", buf_s, 0)
+                        if status == STATUS_AUTH_CHALLENGE:
+                            self.saw_challenge = True
+                            off = 4 + 4  # status int + iteration int
+                            for _ in range(2):
+                                frame = _wire_string_frame_len(buf_s, off)
+                                if frame is None:
+                                    break
+                                off += frame
+                            else:
+                                client.sendall(buf_s[:off])
+                                buf_s = buf_s[off:]
+                                state = "auth"
+                        else:
+                            if buf_s:
+                                client.sendall(buf_s)
+                                buf_s = b""
+                            state = "relay"
+                elif state == "auth":
+                    if len(buf_c) >= 4:
+                        off = 4
+                        for _ in range(2):
+                            frame = _wire_string_frame_len(buf_c, off)
+                            if frame is None:
+                                break
+                            off += frame
+                        else:
+                            response = buf_c[:off]
+                            buf_c = buf_c[off:]
+                            if capture:
+                                self.stolen = response
+                                backend.sendall(response)
+                            else:
+                                assert self.stolen is not None
+                                backend.sendall(self.stolen)
+                            state = "relay"
+                    if buf_s:
+                        client.sendall(buf_s)
+                        buf_s = b""
+                else:
+                    if buf_c:
+                        backend.sendall(buf_c)
+                        buf_c = b""
+                    if buf_s:
+                        client.sendall(buf_s)
+                        buf_s = b""
+                if eof:
+                    break
+        finally:
+            client.close()
+            backend.close()
+
+
 class TestDaemonAuthentication:
     """Wave B password authentication round-trips on the shared daemon (its
     config declares `locked` with `auth users = alice` and `team` with
@@ -456,11 +770,67 @@ class TestDaemonAuthentication:
         finally:
             os.unlink(cred_path)
 
+    @pytest.mark.ci
+    def test_remote_plaintext_credentials_rejected_client_side(self):
+        """A7-3/S1: sending daemon credentials to a clearly non-local daemon
+        WITHOUT --tls is refused by the client itself, before any network I/O
+        (192.0.2.0/24 is TEST-NET-1 and never reachable, so a network attempt
+        would time out instead of failing fast)."""
+        cred_path = os.path.join(TEST_DATA_DIR, "client_remote.pw")
+        _write_client_password_file(cred_path, "alice", ALICE_PASS)
+        try:
+            cmd = CLIENT_CMD + ["--source-dir", SOURCE_DIR,
+                                "--dest-dir", "192.0.2.1::files",
+                                "--save-to-disk", "--password-file", cred_path,
+                                "--server-port", "873"]
+            result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
+            assert result.returncode != 0
+            combined = (result.stderr or "") + (result.stdout or "")
+            assert "--tls" in combined, combined
+        finally:
+            os.unlink(cred_path)
+
+    @pytest.mark.ci
+    def test_loopback_plaintext_refused_before_challenge_without_flag(self):
+        """A7-3/S1: an auth-required module reached over loopback plaintext is
+        refused at the config gate -- before any SCRAM challenge is sent -- when
+        the operator did NOT pass --allow-unauthenticated.  That flag is the
+        explicit opt-in that makes loopback plaintext an accepted auth
+        transport; it never permits remote plaintext auth.  A relay records the
+        daemon's first status frame so a challenge is directly observable."""
+        d = DaemonManager()
+        port = _find_free_port()
+        log_path = os.path.join(TEST_DATA_DIR, "fastsyncd_noauth_auth.log")
+        log = open(log_path, "w")
+        cmd = SERVER_CMD + ["--daemon", "--config", CONF_FILE, "--no-detach",
+                            "--password-file", CRED_FILE, "--dparam", f"port={port}"]
+        d._proc = subprocess.Popen(cmd, stdout=log, stderr=log, stdin=subprocess.DEVNULL,
+                                   start_new_session=True)
+        d._port = port
+        _wait_for_port(port, timeout=10)
+        proxy = _AuthReplayProxy(port)
+        try:
+            before = _tree_file_count(AUTH_MODULE)
+            cred = os.path.join(TEST_DATA_DIR, "noauth_loopback.pw")
+            _write_client_password_file(cred, "alice", ALICE_PASS)
+            proc = subprocess.Popen(_client_cmd("127.0.0.1::locked", proxy.port, cred),
+                                    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+            proxy._run_connection(capture=True)
+            out, err = proc.communicate(timeout=30)
+            assert proc.returncode != 0, "auth over unflagged loopback plaintext must be refused"
+            assert not proxy.saw_challenge, "daemon sent a SCRAM challenge before the refusal"
+            assert _tree_file_count(AUTH_MODULE) == before, "a refused connection wrote data"
+            os.unlink(cred)
+        finally:
+            proxy.close()
+            d.stop()
+
     def test_client_empty_password_file_rejected(self):
         """Client-side: an empty --password-file is rejected (no credentials)."""
         cred_path = os.path.join(TEST_DATA_DIR, "client_empty.pw")
         with open(cred_path, "w") as f:
             f.write("# nothing here\n")
+        os.chmod(cred_path, 0o600)
         try:
             cmd = CLIENT_CMD + ["--source-dir", SOURCE_DIR,
                                 "--dest-dir", "127.0.0.1::files",
@@ -495,8 +865,63 @@ class TestDaemonAuthentication:
         finally:
             d.stop()
 
+    @pytest.mark.ci
+    def test_replayed_auth_response_rejected(self, daemon):
+        """A7 replay defense: an auth response captured from one connection is
+        refused on a second connection (the proof is bound to the challenge
+        nonce), and nothing is written to the module root."""
+        proxy = _AuthReplayProxy(daemon.port)
+        try:
+            cred_a = os.path.join(TEST_DATA_DIR, "replay_a.pw")
+            _write_client_password_file(cred_a, "alice", ALICE_PASS)
+            proc_a = subprocess.Popen(_client_cmd("127.0.0.1::locked", proxy.port, cred_a),
+                                      stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+            proxy._run_connection(capture=True)
+            out_a, err_a = proc_a.communicate(timeout=30)
+            assert proc_a.returncode == 0, err_a or out_a
+            assert proxy.stolen is not None
+            os.unlink(cred_a)
+
+            before = _tree_file_count(AUTH_MODULE)
+            cred_b = os.path.join(TEST_DATA_DIR, "replay_b.pw")
+            _write_client_password_file(cred_b, "alice", ALICE_PASS)
+            proc_b = subprocess.Popen(_client_cmd("127.0.0.1::locked", proxy.port, cred_b),
+                                      stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+            proxy._run_connection(capture=False)
+            out_b, err_b = proc_b.communicate(timeout=30)
+            assert proc_b.returncode != 0, "a replayed auth response must be refused"
+            assert _tree_file_count(AUTH_MODULE) == before, \
+                "a replayed auth response wrote data"
+            os.unlink(cred_b)
+        finally:
+            proxy.close()
+
+    def test_legacy_store_refuses_to_start(self):
+        """A legacy `user:SHA256HEX` store is hard-rejected: the daemon must not
+        start and must never accept a replayable bearer digest."""
+        legacy = os.path.join(TEST_DATA_DIR, "fastsyncd_legacy.passwd")
+        with open(legacy, "w") as f:
+            f.write("alice:9b90e524e94995ee4aeae2ee3c428a53405d1e8db147f44facc46797d0caf4c3\n")
+        os.chmod(legacy, 0o600)
+        conf = os.path.join(TEST_DATA_DIR, "fastsyncd_legacy.conf")
+        port = _find_free_port()
+        with open(conf, "w") as f:
+            f.write("port = %d\n\n[locked]\npath = %s\nauth users = alice\n" % (port, AUTH_MODULE))
+        try:
+            proc = subprocess.run(
+                SERVER_CMD + ["--daemon", "--config", conf, "--no-detach",
+                              "--password-file", legacy],
+                capture_output=True, text=True, timeout=15)
+            assert proc.returncode != 0
+            combined = (proc.stderr or "") + (proc.stdout or "")
+            assert "legacy" in combined
+            assert "alice" in combined
+        finally:
+            os.unlink(legacy)
+            os.unlink(conf)
+
     def test_auth_log_does_not_leak_password(self, daemon):
-        """The daemon log must never contain the password or its digest."""
+        """The daemon log must never contain the password or the store verifier."""
         log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
         before = os.path.getsize(log_path) if os.path.exists(log_path) else 0
         _push_with_creds("127.0.0.1::locked", daemon.port, "alice", WRONG_PASS)
@@ -507,15 +932,15 @@ class TestDaemonAuthentication:
             tail = f.read().decode("utf-8", "replace")
         assert ALICE_PASS not in tail
         assert WRONG_PASS not in tail
-        assert _pw_hash(ALICE_PASS) not in tail
-        assert _pw_hash(WRONG_PASS) not in tail
+        for secret in _store_secrets(ALICE_LINE):
+            assert secret not in tail
+        assert "$fastsync$" not in tail
 
-    def test_auth_digest_not_logged_at_debug_level(self):
+    def test_auth_secrets_not_logged_at_debug_level(self):
         """Under --verbose the daemon enables LOG_DEBUG_ALL, which normally
-        traces every protocol string -- the auth username/digest must NOT leak
-        into that trace even then.  The redacted marker is logged instead, and
-        the digest/username/password never appear while debug protocol logging
-        is actually proving itself active."""
+        traces every protocol string -- the auth username/proof/signature must
+        NOT leak into that trace even then.  The redacted marker is logged
+        instead, while debug protocol logging is actually proving itself active."""
         d = DaemonManager()
         port = _find_free_port()
         try:
@@ -535,8 +960,9 @@ class TestDaemonAuthentication:
         # The secret-worthy fields must never appear, at any log level.
         assert ALICE_PASS not in log
         assert WRONG_PASS not in log
-        assert _pw_hash(ALICE_PASS) not in log
-        assert _pw_hash(WRONG_PASS) not in log
+        for secret in _store_secrets(ALICE_LINE):
+            assert secret not in log
+        assert "$fastsync$" not in log
 
 
 class TestDaemonMotd:
@@ -634,23 +1060,30 @@ class TestDaemonMotd:
             d.stop()
 
 
-def _generate_tls_certs(cert_dir):
-    """Generate a self-signed CA, server cert (with 127.0.0.1 SAN) and a client
-    cert signed by that CA, for the TLS+auth composition test."""
+def _generate_tls_certs(cert_dir, extra_san_ips=None):
+    """Generate a self-signed CA, server cert (with 127.0.0.1 SAN plus any
+    extra_san_ips) and two client certs signed by that CA: one with the
+    expected CN (fastsync-client) and one with a WRONG CN, for the TLS+auth
+    composition and wrong-identity tests."""
     os.makedirs(cert_dir, exist_ok=True)
     ca_key, ca_cert = os.path.join(cert_dir, "ca.key"), os.path.join(cert_dir, "ca.pem")
     server_key = os.path.join(cert_dir, "server.key")
     server_cert = os.path.join(cert_dir, "server.pem")
     client_key = os.path.join(cert_dir, "client.key")
     client_cert = os.path.join(cert_dir, "client.pem")
+    wrong_client_key = os.path.join(cert_dir, "wrong_client.key")
+    wrong_client_cert = os.path.join(cert_dir, "wrong_client.pem")
     subprocess.run(["openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes",
                     "-keyout", ca_key, "-out", ca_cert, "-days", "1",
                     "-subj", "/CN=FastSync Test CA"], check=True, capture_output=True)
     san = os.path.join(cert_dir, "san.conf")
+    san_ips = ["IP.1 = 127.0.0.1"]
+    for index, ip in enumerate(extra_san_ips or [], start=2):
+        san_ips.append("IP.%d = %s" % (index, ip))
     with open(san, "w") as f:
         f.write("[req]\ndistinguished_name = dn\nreq_extensions = v3_req\n\n"
                 "[dn]\nCN = localhost\n\n[v3_req]\nsubjectAltName = @an\n\n"
-                "[an]\nDNS.1 = localhost\nIP.1 = 127.0.0.1\n")
+                "[an]\nDNS.1 = localhost\n" + "\n".join(san_ips) + "\n")
     subprocess.run(["openssl", "req", "-newkey", "rsa:2048", "-nodes",
                     "-keyout", server_key, "-out", os.path.join(cert_dir, "server.csr"),
                     "-subj", "/CN=localhost", "-config", san], check=True, capture_output=True)
@@ -664,12 +1097,20 @@ def _generate_tls_certs(cert_dir):
     subprocess.run(["openssl", "x509", "-req", "-in", os.path.join(cert_dir, "client.csr"),
                     "-CA", ca_cert, "-CAkey", ca_key, "-CAcreateserial",
                     "-out", client_cert, "-days", "1"], check=True, capture_output=True)
+    subprocess.run(["openssl", "req", "-newkey", "rsa:2048", "-nodes",
+                    "-keyout", wrong_client_key, "-out", os.path.join(cert_dir, "wrong_client.csr"),
+                    "-subj", "/CN=wrong-client"], check=True, capture_output=True)
+    subprocess.run(["openssl", "x509", "-req", "-in", os.path.join(cert_dir, "wrong_client.csr"),
+                    "-CA", ca_cert, "-CAkey", ca_key, "-CAcreateserial",
+                    "-out", wrong_client_cert, "-days", "1"], check=True, capture_output=True)
     return {
         "ca": ca_cert,
         "server_cert": server_cert,
         "server_key": server_key,
         "client_cert": client_cert,
         "client_key": client_key,
+        "wrong_client_cert": wrong_client_cert,
+        "wrong_client_key": wrong_client_key,
     }
 
 
@@ -710,3 +1151,45 @@ class TestDaemonTLSAuth:
             d.stop()
             os.unlink(client_creds)
             shutil.rmtree(cert_dir, ignore_errors=True)
+
+    @pytest.mark.ci
+    def test_wrong_client_cn_refused_before_auth_challenge(self):
+        """A7-3/S1: with --tls AND --allow-unauthenticated, a loopback TLS peer
+        whose CA-valid client certificate does not match --client-cn is still
+        refused at the config gate -- before any SCRAM challenge is sent and
+        before any file data moves.  The --allow-unauthenticated flag only opts
+        in loopback PLAINTEXT; it must never turn a wrong-CN TLS peer into an
+        accepted auth transport.  Runs over 127.0.0.1 so it is deterministic and
+        never skips; the gate log line (emitted before server_auth_handshake)
+        plus the unchanged module tree prove the refusal preceded any challenge."""
+        cert_dir = os.path.join(TEST_DATA_DIR, "daemon_tls_certs_wrong")
+        certs = _generate_tls_certs(cert_dir)
+        client_creds = os.path.join(TEST_DATA_DIR, "daemon_tls_wrong_client.pw")
+        _write_client_password_file(client_creds, "alice", ALICE_PASS)
+        d = DaemonManager()
+        port = _find_free_port()
+        log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
+        try:
+            d.start(CONF_FILE, port_override=port, extra_args=[
+                "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+                "--ca", certs["ca"], "--client-cn", "fastsync-client",
+                "--password-file", CRED_FILE])
+            before_files = _tree_file_count(AUTH_MODULE)
+            log_before = os.path.getsize(log_path) if os.path.exists(log_path) else 0
+            tls_flags = ["--tls",
+                         "--cert", certs["wrong_client_cert"], "--key",
+                         certs["wrong_client_key"], "--ca", certs["ca"]]
+            result, _ = run_client(SOURCE_DIR, "127.0.0.1::locked", port=port,
+                                   flags=tls_flags, extra_args=["--password-file", client_creds])
+            assert result.returncode != 0, "a wrong client CN must be refused"
+            assert _tree_file_count(AUTH_MODULE) == before_files, \
+                "a refused connection wrote file data"
+            with open(log_path, "rb") as f:
+                f.seek(log_before)
+                tail = f.read().decode("utf-8", "replace")
+            assert "requires authentication over an encrypted, verified TLS connection" in tail, \
+                tail[-400:]
+        finally:
+            d.stop()
+            os.unlink(client_creds)
+            shutil.rmtree(cert_dir, ignore_errors=True)

tests/integration/test_iconv.py

@@ -0,0 +1,250 @@
+"""--iconv=CONVERT_SPEC file-NAME charset conversion integration tests.
+
+The client converts every source file name from LOCAL to REMOTE before it goes
+on the wire, and the receiver converts it back from REMOTE to LOCAL, so a
+source tree using one charset can be written into a destination tree using
+another (rsync compatibility; content bytes are never touched).
+"""
+import os
+import shutil
+
+import pytest
+
+from common import TEST_DATA_DIR, run_client, clean_dir, ServerManager
+
+LATIN1_NAME = b"caf\xe9.txt"
+UTF8_NAME = "caf\u00e9.txt".encode("utf-8")
+
+
+def _make(tag):
+    source = os.path.join(TEST_DATA_DIR, f"iconv_{tag}_src")
+    dest = os.path.join(TEST_DATA_DIR, f"iconv_{tag}_dst")
+    clean_dir(source)
+    shutil.rmtree(dest, ignore_errors=True)
+    # The destination ROOT must pre-exist on the receiver (the --mkpath contract:
+    # without --mkpath the server requires the root directory to exist).
+    os.makedirs(dest, exist_ok=True)
+    return source, dest
+
+
+def _place_bytes(root, name_bytes, data=b"latin1 payload\n"):
+    full = os.path.join(os.fsencode(root), name_bytes)
+    os.makedirs(os.path.dirname(full), exist_ok=True)
+    with open(full, "wb") as fh:
+        fh.write(data)
+    return full
+
+
+def _dest_file(source, dest, name):
+    base = os.path.join(dest, os.path.abspath(source).lstrip(os.sep))
+    return os.path.join(os.fsencode(base), name)
+
+
+@pytest.mark.ci
+def test_iconv_latin1_roundtrip(shared_server):
+    """A source file whose name is ISO-8859-1 bytes is transferred with
+    --iconv=iso-8859-1,utf-8 and lands on the destination with the ORIGINAL
+    latin1 name (the wire carried it as UTF-8)."""
+    source, dest = _make("latin1")
+    _place_bytes(source, LATIN1_NAME)
+
+    result, _ = run_client(
+        source, dest, flags=["--iconv=iso-8859-1,utf-8"], port=shared_server.port
+    )
+    assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+
+    dst = _dest_file(source, dest, LATIN1_NAME)
+    assert os.path.exists(dst), f"dest latin1-named file not found under {dest}"
+
+
+@pytest.mark.ci
+def test_iconv_to_utf8_on_wire(shared_server):
+    """--iconv=utf-8 (single, identity both ways) on an ascii filename transfers
+    cleanly with no error."""
+    source, dest = _make("utf8")
+    src_path = os.path.join(source, "plain.txt")
+    with open(src_path, "wb") as fh:
+        fh.write(b"identity\n")
+
+    result, _ = run_client(source, dest, flags=["--iconv=utf-8"], port=shared_server.port)
+    assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+
+    dst = _dest_file(source, dest, os.fsencode("plain.txt"))
+    assert os.path.exists(dst)
+
+
+@pytest.mark.ci
+def test_iconv_passthrough_identity(shared_server):
+    """No --iconv flag: the transfer is unchanged (regression guard -- the common
+    path must not go through iconv at all)."""
+    source, dest = _make("identity")
+    for name, data in (("a.txt", b"aaa\n"), ("sub/b.txt", b"bbb\n")):
+        p = os.path.join(source, name)
+        os.makedirs(os.path.dirname(p), exist_ok=True)
+        with open(p, "wb") as fh:
+            fh.write(data)
+
+    result, _ = run_client(source, dest, port=shared_server.port)
+    assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+
+    for name in ("a.txt", "sub/b.txt"):
+        assert os.path.exists(_dest_file(source, dest, os.fsencode(name)))
+
+
+@pytest.mark.ci
+def test_iconv_receiver_own_charset(shared_server):
+    """A dedicated server started with its OWN --iconv converts received names
+    to ITS charset: the source holds a latin1-named file, the wire carries it
+    as UTF-8 (from the client's spec), and the receiver re-decodes it to UTF-8
+    on disk.  This discriminates a real wire conversion from a no-op passthrough
+    (a latin1 byte sequence is not valid UTF-8, so the receiver decoding it as
+    UTF-8 would fail the transfer)."""
+    with ServerManager() as server:
+        server.start(extra_args=["--iconv=utf-8"])
+        source, dest = _make("recv_charset")
+        _place_bytes(source, LATIN1_NAME)
+
+        result, _ = run_client(
+            source, dest, flags=["--iconv=iso-8859-1,utf-8"], port=server.port
+        )
+        assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+
+        dst = _dest_file(source, dest, UTF8_NAME)
+        assert os.path.exists(dst), f"dest UTF-8-named file not found under {dest}"
+
+
+@pytest.mark.ci
+def test_iconv_invalid_charset_rejected(shared_server):
+    """An unsupported charset name is rejected at startup with a nonzero exit."""
+    source, dest = _make("badcharset")
+    src_path = os.path.join(source, "f.txt")
+    with open(src_path, "wb") as fh:
+        fh.write(b"x")
+
+    result, _ = run_client(
+        source, dest, flags=["--iconv=no-such-charset,utf-8"], port=shared_server.port
+    )
+    assert result.returncode != 0
+
+
+@pytest.mark.ci
+def test_iconv_garbage_spec_rejected(shared_server):
+    """A malformed CONVERT_SPEC is rejected at startup with a nonzero exit."""
+    source, dest = _make("garbage")
+    src_path = os.path.join(source, "f.txt")
+    with open(src_path, "wb") as fh:
+        fh.write(b"x")
+
+    result, _ = run_client(source, dest, flags=["--iconv=,,,"], port=shared_server.port)
+    assert result.returncode != 0
+
+
+@pytest.mark.ci
+def test_iconv_expanding_name_growth(shared_server):
+    """A long latin1 name whose UTF-8 encoding expands past the initial output
+    buffer exercises the E2BIG growth path in charset_convert (each high-bit
+    latin1 byte doubles in UTF-8), and must land unchanged on the destination."""
+    source, dest = _make("growth")
+    name_bytes = b"a" * 40 + bytes(range(0x80, 0x80 + 40)) + b".txt"
+    _place_bytes(source, name_bytes, data=b"growth\n")
+
+    result, _ = run_client(
+        source, dest, flags=["--iconv=iso-8859-1,utf-8"], port=shared_server.port
+    )
+    assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+
+    assert os.path.exists(_dest_file(source, dest, name_bytes))
+
+
+def test_iconv_symlink_path_and_target(shared_server):
+    """A latin1-named symlink pointing at a latin1-named target survives the
+    transfer: both the link name and the link target are wire-converted and
+    re-decoded on the destination (-l preserves links)."""
+    source, dest = _make("symlink")
+    target = b"target\xe9.dat"
+    _place_bytes(source, target, data=b"t\n")
+    os.symlink(target, os.path.join(os.fsencode(source), b"link\xe9"))
+
+    result, _ = run_client(
+        source, dest, flags=["--iconv=iso-8859-1,utf-8", "--links"], port=shared_server.port
+    )
+    assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+
+    dst_target = _dest_file(source, dest, target)
+    dst_link = _dest_file(source, dest, b"link\xe9")
+    assert os.path.exists(dst_target), "dest latin1 target file missing"
+    assert os.path.islink(dst_link), "dest latin1 symlink missing"
+    assert os.readlink(dst_link) == target, "symlink target not preserved/decoded"
+    with open(dst_link, "rb") as fh:
+        assert fh.read() == b"t\n"
+
+
+def test_iconv_hardlink_path_and_target(shared_server):
+    """A latin1-named hard-linked pair is preserved: -H transmits later group
+    members as a path+target link to the first member, so both the member name
+    and the target wire-convert (the two destination names must stay one
+    inode)."""
+    source, dest = _make("hardlink")
+    a = b"hl_a\xe9.txt"
+    b = b"hl_b\xe9.txt"
+    src_a = os.path.join(os.fsencode(source), a)
+    with open(src_a, "wb") as fh:
+        fh.write(b"shared\n")
+    os.link(src_a, os.path.join(os.fsencode(source), b))
+
+    result, _ = run_client(
+        source, dest, flags=["--iconv=iso-8859-1,utf-8", "--hard-links"],
+        port=shared_server.port,
+    )
+    assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+
+    dst_a = _dest_file(source, dest, a)
+    dst_b = _dest_file(source, dest, b)
+    assert os.path.exists(dst_a) and os.path.exists(dst_b)
+    assert os.stat(dst_a).st_ino == os.stat(dst_b).st_ino, \
+        "hard-link relationship not preserved across the transfer"
+
+
+def test_iconv_delete_manifest_consistent(shared_server):
+    """Combining --iconv with --delete: the delete manifest's keep-set paths are
+    wire-converted on send and disk-converted on receive, so the receiver's
+    delete walker compares like with like and removes exactly the missing
+    latin1-named file (never a wrong-named mirror)."""
+    source, dest = _make("delete")
+    keep = b"keep\xe9.txt"
+    gone = b"gone\xe9.txt"
+    _place_bytes(source, keep, data=b"k\n")
+    _place_bytes(source, gone, data=b"g\n")
+
+    with ServerManager() as server:
+        server.start(extra_args=["--allow-delete"])
+        flags = ["--iconv=iso-8859-1,utf-8"]
+        result, _ = run_client(source, dest, flags=flags, port=server.port)
+        assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+        assert os.path.exists(_dest_file(source, dest, keep))
+        assert os.path.exists(_dest_file(source, dest, gone))
+
+        os.remove(os.path.join(os.fsencode(source), gone))
+        result, _ = run_client(
+            source, dest, flags=flags + ["--delete"], port=server.port
+        )
+        assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+        assert os.path.exists(_dest_file(source, dest, keep)), "kept file deleted"
+        assert not os.path.exists(_dest_file(source, dest, gone)), \
+            "missing file was not deleted"
+
+
+def test_iconv_chunk_serialization_blob(shared_server):
+    """-s (chunk serialization) embeds paths and symlink targets inside the
+    serialized chunk blob rather than as separate frames; a latin1 name must
+    still wire-convert and re-decoded on the destination."""
+    source, dest = _make("chunk")
+    name = b"\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9\xe9.txt"
+    _place_bytes(source, name, data=b"blob\n")
+
+    result, _ = run_client(
+        source, dest, flags=["--iconv=iso-8859-1,utf-8", "--chunk-serialization"], port=shared_server.port
+    )
+    assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+
+    assert os.path.exists(_dest_file(source, dest, name))

tests/integration/test_preflight.py

@@ -2,10 +2,11 @@
 import subprocess
 import sys
 import os
+import shutil
 import pytest
 
 sys.path.insert(0, os.path.dirname(__file__))
-from common import BUILD_DIR, CLIENT_CMD, SERVER_CMD
+from common import BUILD_DIR, CLIENT_CMD, SERVER_CMD, TEST_DATA_DIR, run_client, verify_transfer
 
 
 class TestHelp:
@@ -79,3 +80,58 @@ class TestServerPort:
         finally:
             proc.terminate()
             proc.wait(timeout=5)
+
+
+def _seed_protocol_source(source):
+    os.makedirs(source, exist_ok=True)
+    with open(os.path.join(source, "p.txt"), "w") as fh:
+        fh.write("protocol test\n")
+    os.makedirs(os.path.join(source, "nested"), exist_ok=True)
+    with open(os.path.join(source, "nested", "deep.txt"), "w") as fh:
+        fh.write("deep file\n")
+
+
+class TestProtocol:
+    @pytest.mark.ci
+    def test_protocol_current_version_accepted(self, shared_server):
+        """--protocol=2.19.0 (the current PROTOCOL_VERSION) is accepted and the
+        transfer completes normally."""
+        source = os.path.join(TEST_DATA_DIR, "proto_ok_src")
+        dest = os.path.join(TEST_DATA_DIR, "proto_ok_dst")
+        shutil.rmtree(dest, ignore_errors=True)
+        os.makedirs(dest)
+        _seed_protocol_source(source)
+        result, _ = run_client(source, dest, flags=["--protocol=2.19.0"],
+                               port=shared_server.port)
+        assert result.returncode == 0, \
+            f"--protocol current run failed: {(result.stderr or result.stdout)[:400]}"
+        received = os.path.join(dest, os.path.abspath(source).lstrip(os.sep))
+        mismatches, missing = verify_transfer(source, received)
+        assert not mismatches and not missing, \
+            f"transfer mismatch: missing={missing} mismatches={mismatches}"
+
+    @pytest.mark.ci
+    def test_protocol_rejects_other_versions(self, shared_server):
+        """Other versions are rejected up front, before connecting."""
+        source = os.path.join(TEST_DATA_DIR, "proto_reject_src")
+        dest = os.path.join(TEST_DATA_DIR, "proto_reject_dst")
+        shutil.rmtree(dest, ignore_errors=True)
+        os.makedirs(dest)
+        _seed_protocol_source(source)
+        for bad in ("2.18.0", "2.17.0", "2.15.0", "2.16.0", "216", "31"):
+            result, _ = run_client(source, dest, flags=[f"--protocol={bad}"],
+                                   port=shared_server.port)
+            assert result.returncode != 0, f"--protocol={bad} should be rejected"
+
+    @pytest.mark.ci
+    def test_protocol_rejects_garbage(self, shared_server):
+        """Garbage/empty --protocol values are rejected up front."""
+        source = os.path.join(TEST_DATA_DIR, "proto_garbage_src")
+        dest = os.path.join(TEST_DATA_DIR, "proto_garbage_dst")
+        shutil.rmtree(dest, ignore_errors=True)
+        os.makedirs(dest)
+        _seed_protocol_source(source)
+        for bad in ("abc", ""):
+            result, _ = run_client(source, dest, flags=[f"--protocol={bad}"],
+                                   port=shared_server.port)
+            assert result.returncode != 0, f"--protocol={bad} should be rejected"

tests/integration/test_ssh.py

@@ -97,31 +97,31 @@ class TestSSHStandard:
         assert r["status"] == "Success", r["error"]
 
     def test_multithreading(self):
-        r = _run_ssh_test("SSH Multithreading (-m)", ["-m"])
+        r = _run_ssh_test("SSH Multithreading (--threads)", ["--threads"])
         assert r["status"] == "Success", r["error"]
 
     def test_compression(self):
-        r = _run_ssh_test("SSH Compression (-c)", ["-c"])
+        r = _run_ssh_test("SSH Compression (-z)", ["-z"])
         assert r["status"] == "Success", r["error"]
 
     def test_chunk_serialization(self):
-        r = _run_ssh_test("SSH Chunk Serialization (-s)", ["-s"])
+        r = _run_ssh_test("SSH Chunk Serialization (--chunk-serialization)", ["--chunk-serialization"])
         assert r["status"] == "Success", r["error"]
 
     def test_compression_chunk(self):
-        r = _run_ssh_test("SSH Compression + Chunk (-c -s)", ["-c", "-s"])
+        r = _run_ssh_test("SSH Compression + Chunk (-z --chunk-serialization)", ["-z", "--chunk-serialization"])
         assert r["status"] == "Success", r["error"]
 
     def test_multithread_compression(self):
-        r = _run_ssh_test("SSH Multithread + Compression (-m -c)", ["-m", "-c"])
+        r = _run_ssh_test("SSH Multithread + Compression (--threads -z)", ["--threads", "-z"])
         assert r["status"] == "Success", r["error"]
 
     def test_multithread_chunk(self):
-        r = _run_ssh_test("SSH Multithread + Chunk (-m -s)", ["-m", "-s"])
+        r = _run_ssh_test("SSH Multithread + Chunk (--threads --chunk-serialization)", ["--threads", "--chunk-serialization"])
         assert r["status"] == "Success", r["error"]
 
     def test_all_flags(self):
-        r = _run_ssh_test("SSH All Flags (-m -c -s)", ["-m", "-c", "-s"])
+        r = _run_ssh_test("SSH All Flags (--threads -z --chunk-serialization)", ["--threads", "-z", "--chunk-serialization"])
         assert r["status"] == "Success", r["error"]
 
 
@@ -178,7 +178,7 @@ class TestSSHConnectivity:
         assert r["status"] == "Success", r["error"]
 
     def test_blocking_io_with_compression(self):
-        r = _run_ssh_test("SSH --blocking-io -c", ["--blocking-io", "-c"])
+        r = _run_ssh_test("SSH --blocking-io -c", ["--blocking-io", "-z"])
         assert r["status"] == "Success", r["error"]
 
     def test_trust_sender(self):

tests/integration/test_stop.py

@@ -0,0 +1,241 @@
+"""--stop-after / --stop-at deadline-stop integration tests.
+
+These cover the client-only sender stop conditions: --stop-after=MINS stops
+after N elapsed minutes, --stop-at=HH:MM[:SS] or now+N[smhd] stops at an
+absolute (or relative) wall-clock time.  A reached deadline ends the transfer
+elegantly at the next chunk/file boundary -- whatever was already transferred is
+kept, the completion tail still runs, and the exit code is 0 (like rsync's
+clean "stopped early" behavior).  Malformed values are rejected up front.
+"""
+import filecmp
+import os
+import shutil
+import time
+
+import pytest
+
+from common import (
+    TEST_DATA_DIR,
+    run_client,
+    clean_dir,
+    get_dest_received_dir,
+    verify_transfer,
+)
+
+
+def _make(self_prefix):
+    source = os.path.join(TEST_DATA_DIR, f"stop_{self_prefix}_src")
+    dest = os.path.join(TEST_DATA_DIR, f"stop_{self_prefix}_dst")
+    clean_dir(source)
+    shutil.rmtree(dest, ignore_errors=True)
+    os.makedirs(dest)
+    return source, dest
+
+
+def _received_files(root):
+    """All files under `root`, relative paths."""
+    if not os.path.isdir(root):
+        return []
+    return [
+        os.path.relpath(os.path.join(dirpath, name), root)
+        for dirpath, _, names in os.walk(root)
+        for name in names
+    ]
+
+
+def _seed_source(source):
+    """Create a handful of regular and nested files."""
+    files = {
+        "small.txt": b"hello world\n",
+        "medium.txt": b"the quick brown fox jumps over the lazy dog\n" * 400,
+        "binary.bin": bytes(range(256)) * 100,
+        "nested/deep.txt": b"deeply nested file\n",
+        "nested/another.txt": b"another nested file\n" * 40,
+    }
+    for rel, content in files.items():
+        path = os.path.join(source, rel)
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        with open(path, "wb") as fh:
+            fh.write(content)
+
+
+def _seed_many(source, count=40, size=32 * 1024):
+    """Create `count` same-size regular files (enough to span several chunks)."""
+    blob = os.urandom(size)
+    for i in range(count):
+        with open(os.path.join(source, f"f{i:04d}.dat"), "wb") as fh:
+            fh.write(blob)
+
+
+def _seed_dest_by_transfer(source, dest, port, extra=None):
+    """Do a plain full transfer source->dest so dest exactly mirrors source."""
+    run_client(source, dest, flags=(extra or []), port=port)
+
+
+def _received_subset_matches(source, received):
+    """Every file under `received` exists under `source` with identical bytes."""
+    if not os.path.isdir(received):
+        return not _received_files(received)
+    rels = _received_files(received)
+    for rel in rels:
+        src = os.path.join(source, rel)
+        dst = os.path.join(received, rel)
+        if not os.path.isfile(src) or not filecmp.cmp(src, dst, shallow=False):
+            return False
+    return True
+
+
+class TestStopAfter:
+    @pytest.mark.ci
+    def test_stop_after_within_window(self, shared_server):
+        """A --stop-after set well past the run's duration lets it finish fully."""
+        source, dest = _make("within")
+        _seed_source(source)
+        result, _ = run_client(source, dest, flags=["--stop-after=60"],
+                               port=shared_server.port)
+        assert result.returncode == 0, \
+            f"--stop-after full run failed: {(result.stderr or result.stdout)[:400]}"
+        received = get_dest_received_dir(dest, source)
+        mismatches, missing = verify_transfer(source, received)
+        assert not mismatches and not missing, \
+            f"full transfer mismatch: missing={missing} mismatches={mismatches}"
+
+    @pytest.mark.ci
+    def test_stop_after_rejects_nonpositive(self, shared_server):
+        """0 and negative minutes are invalid (must be a positive integer)."""
+        source, dest = _make("reject")
+        _seed_source(source)
+        for bad in ("0", "-1"):
+            result, _ = run_client(source, dest, flags=[f"--stop-after={bad}"],
+                                   port=shared_server.port)
+            assert result.returncode != 0, f"--stop-after={bad} should be rejected"
+
+
+class TestStopAt:
+    @pytest.mark.ci
+    def test_stop_at_past(self, shared_server):
+        """A --stop-at already in the past stops the transfer immediately but
+        cleanly (exit 0, nothing transferred)."""
+        source, dest = _make("past")
+        _seed_source(source)
+        # Use a same-day HH:MM two minutes in the past when that cannot roll
+        # over into the previous day (which would parse as a FUTURE time today);
+        # otherwise fall back to now+0s which is deterministically immediate.
+        lt = time.localtime()
+        if lt.tm_hour * 60 + lt.tm_min >= 3:
+            past = time.localtime(time.time() - 120)
+            stop_value = f"{past.tm_hour:02d}:{past.tm_min:02d}"
+        else:
+            stop_value = "now+0s"
+        result, _ = run_client(source, dest, flags=[f"--stop-at={stop_value}"],
+                               port=shared_server.port)
+        assert result.returncode == 0, \
+            f"--stop-at past run failed (rc {result.returncode}): " \
+            f"{(result.stderr or result.stdout)[:400]}"
+        received = get_dest_received_dir(dest, source)
+        assert _received_files(received) == [], \
+            f"expected nothing transferred, got {_received_files(received)}"
+
+    @pytest.mark.ci
+    def test_stop_at_now_plus_stops_immediately(self, shared_server):
+        """now+0s resolves to the current instant, so the transfer stops at once."""
+        source, dest = _make("nowplus")
+        _seed_source(source)
+        result, _ = run_client(source, dest, flags=["--stop-at=now+0s"],
+                               port=shared_server.port)
+        assert result.returncode == 0, \
+            f"--stop-at=now+0s should stop cleanly: " \
+            f"{(result.stderr or result.stdout)[:400]}"
+        received = get_dest_received_dir(dest, source)
+        assert _received_files(received) == [], \
+            f"expected nothing transferred, got {_received_files(received)}"
+
+    @pytest.mark.ci
+    def test_stop_rejects_garbage(self, shared_server):
+        """Malformed --stop-at/--stop-after values are rejected up front."""
+        source, dest = _make("garbage")
+        _seed_source(source)
+        for flag in ("--stop-after=abc", "--stop-at=12:99", "--stop-at=12",
+                     "--stop-at=now+5x", "--stop-at=now-5s"):
+            result, _ = run_client(source, dest, flags=[flag],
+                                   port=shared_server.port)
+            assert result.returncode != 0, f"{flag} should be rejected"
+
+
+class TestStopPartial:
+    """A genuine mid-transfer stop leaves a valid, strict non-empty prefix."""
+
+    @pytest.mark.ci
+    def test_stop_mid_transfer_leaves_valid_partial(self, shared_server):
+        """With --bwlimit a real deadline cuts the transfer mid-way: what WAS
+        transferred is byte-identical, not everything is transferred, and the
+        run returns 0 without corrupting any file."""
+        source, dest = _make("partial")
+        _seed_many(source, count=60, size=32 * 1024)
+        flags = ["--chunk-size", "262144", "--bwlimit", "100", "--stop-at=now+3s"]
+        result, _ = run_client(source, dest, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, \
+            f"mid-transfer stop failed (rc {result.returncode}): " \
+            f"{(result.stderr or result.stdout)[:400]}"
+        received = get_dest_received_dir(dest, source)
+        got = _received_files(received)
+        assert len(got) > 0, "expected an early stop to still transfer a prefix"
+        assert len(got) < 60, \
+            f"expected a PARTIAL transfer (all 60 arrived): stopped too late"
+        assert _received_subset_matches(source, received), \
+            f"received files are not a byte-identical subset of the source"
+
+
+class TestStopDelete:
+    """--delete must never wipe the destination when the scan is cut short."""
+
+    def _seed(self, prefix, port, many=False):
+        source, dest = _make(prefix)
+        if many:
+            _seed_many(source, count=40, size=96 * 1024)
+        else:
+            _seed_source(source)
+        _seed_dest_by_transfer(source, dest, port)
+        return source, dest
+
+    @pytest.mark.ci
+    def test_stop_delete_immediate_preserves_source_mirrors(self, shared_server):
+        """Immediate stop + --delete: the incomplete/empty keep-set must NOT
+        delete the seeded source mirrors (returncode 0, files survive)."""
+        source, dest = self._seed("del_imm", shared_server.port)
+        result, _ = run_client(source, dest, flags=["--delete", "--stop-at=now+0s"],
+                               port=shared_server.port)
+        assert result.returncode == 0, \
+            f"--delete immediate stop failed: {(result.stderr or result.stdout)[:400]}"
+        received = get_dest_received_dir(dest, source)
+        mismatches, missing = verify_transfer(source, received)
+        assert not mismatches and not missing, \
+            f"--delete wiped source mirrors: missing={missing} mismatches={mismatches}"
+
+    @pytest.mark.ci
+    def test_stop_delete_midscan_preserves_source_mirrors(self, shared_server):
+        """A mid-scan stop + --delete must suppress the partial keep-set so all
+        seeded source mirrors survive."""
+        source, dest = self._seed("del_mid", shared_server.port, many=True)
+        flags = ["--delete", "--chunk-size", "262144", "--bwlimit", "300", "--stop-at=now+3s"]
+        result, _ = run_client(source, dest, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, \
+            f"--delete mid-scan stop failed: {(result.stderr or result.stdout)[:400]}"
+        received = get_dest_received_dir(dest, source)
+        mismatches, missing = verify_transfer(source, received)
+        assert not mismatches and not missing, \
+            f"--delete mid-scan wiped source mirrors: missing={missing} mismatches={mismatches}"
+
+    @pytest.mark.ci
+    def test_stop_delete_multithreaded_preserves_source_mirrors(self, shared_server):
+        """-m immediate stop + --delete: the completion tail must not read the
+        still-appendable manifest (no race) and must not delete the mirrors."""
+        source, dest = self._seed("del_mt", shared_server.port, many=True)
+        result, _ = run_client(source, dest, flags=["--threads", "--delete", "--stop-at=now+0s"],
+                               port=shared_server.port)
+        assert result.returncode == 0, \
+            f"--threads --delete immediate stop failed: {(result.stderr or result.stdout)[:400]}"
+        received = get_dest_received_dir(dest, source)
+        mismatches, missing = verify_transfer(source, received)
+        assert not mismatches and not missing, \
+            f"--threads --delete wiped source mirrors: missing={missing} mismatches={mismatches}"

tests/integration/test_tcp.py

@@ -30,11 +30,11 @@ def _run_tcp_test(name, port, flags, use_metadata=True, posix=False):
     clean_dir(DEST_DIR)
     if posix:
         result, dur = run_client_posix(SOURCE_DIR, DEST_DIR,
-                                       flags=(["-M"] if use_metadata else []) + flags,
+                                       flags=(["--preserve"] if use_metadata else []) + flags,
                                        port=port)
     else:
         result, dur = run_client(SOURCE_DIR, DEST_DIR,
-                                 flags=(["-M"] if use_metadata else []) + flags,
+                                 flags=(["--preserve"] if use_metadata else []) + flags,
                                  port=port)
 
     if result.returncode != 0:
@@ -68,45 +68,45 @@ class TestTCPStandard:
 class TestTCPFlags:
     @pytest.mark.ci
     def test_multithreading(self, shared_server):
-        r = _run_tcp_test("Multithreading (-m)", shared_server.port, ["-m"])
+        r = _run_tcp_test("Multithreading (--threads)", shared_server.port, ["--threads"])
         assert r["status"] == "Success", r["error"]
 
     @pytest.mark.ci
     def test_compression(self, shared_server):
-        r = _run_tcp_test("Compression (-c)", shared_server.port, ["-c"])
+        r = _run_tcp_test("Compression (-z)", shared_server.port, ["-z"])
         assert r["status"] == "Success", r["error"]
 
     def test_compression_threads(self, shared_server):
-        r = _run_tcp_test("Compression threads (-c --compress-threads=2)", shared_server.port,
-                          ["-c", "--compress-threads=2"])
+        r = _run_tcp_test("Compression threads (-z --compress-threads=2)", shared_server.port,
+                          ["-z", "--compress-threads=2"])
         assert r["status"] == "Success", r["error"]
 
     def test_chunk_serialization(self, shared_server):
-        r = _run_tcp_test("Chunk Serialization (-s)", shared_server.port, ["-s"])
+        r = _run_tcp_test("Chunk Serialization (--chunk-serialization)", shared_server.port, ["--chunk-serialization"])
         assert r["status"] == "Success", r["error"]
 
     def test_compression_chunk(self, shared_server):
-        r = _run_tcp_test("Compression + Chunk (-c -s)", shared_server.port, ["-c", "-s"])
+        r = _run_tcp_test("Compression + Chunk (-z --chunk-serialization)", shared_server.port, ["-z", "--chunk-serialization"])
         assert r["status"] == "Success", r["error"]
 
     def test_multithread_compression(self, shared_server):
-        r = _run_tcp_test("Multithreading + Compression (-m -c)", shared_server.port, ["-m", "-c"])
+        r = _run_tcp_test("Multithreading + Compression (--threads -z)", shared_server.port, ["--threads", "-z"])
         assert r["status"] == "Success", r["error"]
 
     def test_multithread_chunk(self, shared_server):
-        r = _run_tcp_test("Multithreading + Chunk (-m -s)", shared_server.port, ["-m", "-s"])
+        r = _run_tcp_test("Multithreading + Chunk (--threads --chunk-serialization)", shared_server.port, ["--threads", "--chunk-serialization"])
         assert r["status"] == "Success", r["error"]
 
     def test_all_flags(self, shared_server):
-        r = _run_tcp_test("Multithread + Compression + Chunk (-m -c -s)", shared_server.port, ["-m", "-c", "-s"])
+        r = _run_tcp_test("Multithread + Compression + Chunk (--threads -z --chunk-serialization)", shared_server.port, ["--threads", "-z", "--chunk-serialization"])
         assert r["status"] == "Success", r["error"]
 
     def test_sendfile(self, shared_server):
-        r = _run_tcp_test("Sendfile (-f)", shared_server.port, ["-f"])
+        r = _run_tcp_test("Sendfile (--sendfile)", shared_server.port, ["--sendfile"])
         assert r["status"] == "Success", r["error"]
 
     def test_sendfile_multithread(self, shared_server):
-        r = _run_tcp_test("Sendfile + Multithreading (-f -m)", shared_server.port, ["-f", "-m"])
+        r = _run_tcp_test("Sendfile + Multithreading (--sendfile --threads)", shared_server.port, ["--sendfile", "--threads"])
         assert r["status"] == "Success", r["error"]
 
 

tests/integration/test_tls.py

@@ -132,7 +132,7 @@ class TestTLSBasic:
             ])
             result, dur = run_client(
                 SOURCE_DIR, DEST_DIR,
-                flags=["-c", "--tls",
+                flags=["-z", "--tls",
                        "--cert", certs["client_cert"], "--key", certs["client_key"],
                        "--ca", certs["ca"]],
                 port=server.port,
@@ -157,7 +157,7 @@ class TestTLSBasic:
             ])
             result, dur = run_client(
                 SOURCE_DIR, DEST_DIR,
-                flags=["-m", "--tls",
+                flags=["--threads", "--tls",
                        "--cert", certs["client_cert"], "--key", certs["client_key"],
                        "--ca", certs["ca"]],
                 port=server.port,

tests/runner.c

@@ -1,4 +1,5 @@
 #include "test_array_list.h"
+#include "test_batch.h"
 #include "test_chunk.h"
 #include "test_change_list.h"
 #include "test_checksum.h"
@@ -14,6 +15,7 @@
 #include "test_file_sendfile.h"
 #include "test_fuzz_smoke.h"
 #include "test_glob.h"
+#include "test_iconv.h"
 #include "test_log.h"
 #include "test_metadata.h"
 #include "test_motd.h"
@@ -27,6 +29,7 @@
 #include "test_server_cli.h"
 #include "test_shared_utils.h"
 #include "test_stress.h"
+#include "test_stop.h"
 #include "test_transport_tcp.h"
 #include "test_transport_ssh.h"
 #include "test_transport_tls.h"
@@ -48,6 +51,7 @@ int main() {
   RUN_TEST(test_array_list);
   RUN_TEST(test_shared_utils);
   RUN_TEST(test_chunk);
+  RUN_TEST(test_batch);
   RUN_TEST(test_change_list);
   RUN_TEST(test_config);
   RUN_TEST(test_credentials);
@@ -59,6 +63,7 @@ int main() {
   RUN_TEST(test_protocol);
   RUN_TEST(test_metadata);
   RUN_TEST(test_glob);
+  RUN_TEST(test_iconv);
   RUN_TEST(test_file);
   RUN_TEST(test_trust_sender);
   RUN_TEST(test_delay_updates);
@@ -67,6 +72,7 @@ int main() {
   RUN_TEST(test_log);
   RUN_TEST(test_robustness);
   RUN_TEST(test_stress);
+  RUN_TEST(test_stop);
   RUN_TEST(test_property);
   RUN_TEST(test_transport_tcp);
   RUN_TEST(test_transport_ssh);

tests/test_batch.c

@@ -0,0 +1,255 @@
+#include "batch.h"
+#include "chunk.h"
+#include "config.h"
+#include "file.h"
+#include "metadata.h"
+#include "test_utils.h"
+#include "utils.h"
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+static void batch_test_cleanup(void) {
+  unlink("batch_dest/batch_src.txt");
+  rmdir("batch_dest");
+  unlink("batch_src.txt");
+  unlink("batch.bin");
+  unlink("batch_bad.bin");
+  unlink("batch_trunc.bin");
+  unlink("batch_big.bin");
+}
+
+/* A batch round-trips a full file image byte-identically: write header+chunks,
+ * then apply the file to a fresh destination root and verify the content landed
+ * unchanged. */
+static void test_batch_roundtrip() {
+  batch_test_cleanup();
+  EXPECT_EQ_INT(mkdir("batch_dest", 0755), 0);
+
+  const char* content = "residual batch full image payload\nwith \x01\x02\x03 bytes\n";
+  size_t content_len = strlen(content);
+  file_write_to_disk("batch_src.txt", content, content_len, false, false);
+
+  struct stat st;
+  EXPECT_EQ_INT(stat("batch_src.txt", &st), 0);
+  File* f = file_create("batch_src.txt");
+  EXPECT_NOT_NULL(f);
+  f->data->size = (unsigned long long)st.st_size;
+  EXPECT_TRUE(file_load_data(f));
+  File* files[1] = {f};
+  Chunk* chunk = chunk_create(files, 1);
+  EXPECT_NOT_NULL(chunk);
+
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+
+  int wfd = open("batch.bin", O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  EXPECT_TRUE(wfd >= 0);
+  EXPECT_TRUE(batch_write_header(wfd, config));
+  EXPECT_TRUE(batch_write_chunk(wfd, chunk));
+  EXPECT_EQ_INT(close(wfd), 0);
+  chunk_destroy(chunk); /* frees f */
+
+  int rfd = open("batch.bin", O_RDONLY);
+  EXPECT_TRUE(rfd >= 0);
+  EXPECT_EQ_INT(batch_read_apply(rfd, config, "batch_dest"), 0);
+  EXPECT_EQ_INT(close(rfd), 0);
+
+  char* dest_path = path_cat("batch_dest", "batch_src.txt");
+  EXPECT_NOT_NULL(dest_path);
+  FILE* df = fopen(dest_path, "rb");
+  EXPECT_NOT_NULL(df);
+  char buf[512];
+  size_t n = fread(buf, 1, sizeof(buf), df);
+  EXPECT_EQ_INT(fclose(df), 0);
+  EXPECT_EQ_INT((int)n, (int)content_len);
+  EXPECT_EQ_INT(n == content_len && memcmp(buf, content, content_len) == 0, 1);
+  free(dest_path);
+
+  config_delete(config);
+  batch_test_cleanup();
+}
+
+static void test_batch_roundtrip_metadata() {
+  batch_test_cleanup();
+  EXPECT_EQ_INT(mkdir("batch_dest", 0755), 0);
+
+  const char* content = "metadata-carrying batch image\n";
+  size_t content_len = strlen(content);
+  file_write_to_disk("batch_src.txt", content, content_len, false, false);
+
+  struct stat st;
+  EXPECT_EQ_INT(stat("batch_src.txt", &st), 0);
+  File* f = file_create("batch_src.txt");
+  EXPECT_NOT_NULL(f);
+  f->data->size = (unsigned long long)st.st_size;
+  EXPECT_TRUE(file_load_data(f));
+  f->metadata = file_metadata_create("batch_src.txt", &st, false, false);
+  EXPECT_NOT_NULL(f->metadata);
+  File* files[1] = {f};
+  Chunk* chunk = chunk_create(files, 1);
+  EXPECT_NOT_NULL(chunk);
+
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  config->use_metadata = true;
+
+  int wfd = open("batch.bin", O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  EXPECT_TRUE(wfd >= 0);
+  EXPECT_TRUE(batch_write_header(wfd, config));
+  EXPECT_TRUE(batch_write_chunk(wfd, chunk));
+  EXPECT_EQ_INT(close(wfd), 0);
+  chunk_destroy(chunk); /* frees f */
+
+  int rfd = open("batch.bin", O_RDONLY);
+  EXPECT_TRUE(rfd >= 0);
+  EXPECT_EQ_INT(batch_read_apply(rfd, config, "batch_dest"), 0);
+  EXPECT_EQ_INT(close(rfd), 0);
+
+  char* dest_path = path_cat("batch_dest", "batch_src.txt");
+  EXPECT_NOT_NULL(dest_path);
+  FILE* df = fopen(dest_path, "rb");
+  EXPECT_NOT_NULL(df);
+  char buf[512];
+  size_t n = fread(buf, 1, sizeof(buf), df);
+  EXPECT_EQ_INT(fclose(df), 0);
+  EXPECT_EQ_INT((int)n, (int)content_len);
+  EXPECT_EQ_INT(memcmp(buf, content, content_len) == 0, 1);
+  free(dest_path);
+
+  config_delete(config);
+  batch_test_cleanup();
+}
+
+/* A corrupt magic (and only 11 bytes of junk) is rejected, never applied. */
+static void test_batch_reject_bad_magic() {
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  int fd = open("batch_bad.bin", O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  EXPECT_TRUE(fd >= 0);
+  const char* garbage = "NOTABATCHFXV";
+  EXPECT_EQ_INT(write(fd, garbage, strlen(garbage)), (ssize_t)strlen(garbage));
+  EXPECT_EQ_INT(close(fd), 0);
+  fd = open("batch_bad.bin", O_RDONLY);
+  EXPECT_TRUE(fd >= 0);
+  EXPECT_EQ_INT(batch_read_apply(fd, config, "batch_dest"), -1);
+  EXPECT_EQ_INT(close(fd), 0);
+  config_delete(config);
+  unlink("batch_bad.bin");
+}
+
+/* A clean header with a length prefix promising 100 bytes but only 12 present
+ * is a truncated record and is rejected (never crashes, never applies). */
+static void test_batch_reject_truncated() {
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  int fd = open("batch_trunc.bin", O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  EXPECT_TRUE(fd >= 0);
+  EXPECT_TRUE(batch_write_header(fd, config));
+  unsigned long long length = 100;
+  EXPECT_EQ_INT(write(fd, &length, sizeof(length)), (ssize_t)sizeof(length));
+  const char* partial = "onlytwelvebytes";
+  EXPECT_EQ_INT(write(fd, partial, 15), (ssize_t)15);
+  EXPECT_EQ_INT(close(fd), 0);
+  fd = open("batch_trunc.bin", O_RDONLY);
+  EXPECT_TRUE(fd >= 0);
+  EXPECT_EQ_INT(batch_read_apply(fd, config, "batch_dest"), -1);
+  EXPECT_EQ_INT(close(fd), 0);
+  config_delete(config);
+  unlink("batch_trunc.bin");
+}
+
+/* A length prefix above the 64 MB cap is refused before any allocation. */
+static void test_batch_reject_oversized() {
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  int fd = open("batch_big.bin", O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  EXPECT_TRUE(fd >= 0);
+  EXPECT_TRUE(batch_write_header(fd, config));
+  unsigned long long length = BATCH_MAX_RECORD + 16U;
+  EXPECT_EQ_INT(write(fd, &length, sizeof(length)), (ssize_t)sizeof(length));
+  EXPECT_EQ_INT(close(fd), 0);
+  fd = open("batch_big.bin", O_RDONLY);
+  EXPECT_TRUE(fd >= 0);
+  EXPECT_EQ_INT(batch_read_apply(fd, config, "batch_dest"), -1);
+  EXPECT_EQ_INT(close(fd), 0);
+  config_delete(config);
+  unlink("batch_big.bin");
+}
+
+/* A clean header followed by a length prefix with NO record bytes at all (clean
+ * EOF on the record-body read) must be rejected as truncated — it must not feed
+ * an uninitialized buffer to chunk_deserialize. Regression test for a
+ * confirmed uninitialized-read on the untrusted read side. */
+static void test_batch_reject_eof_after_prefix() {
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  int fd = open("batch_eof.bin", O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  EXPECT_TRUE(fd >= 0);
+  EXPECT_TRUE(batch_write_header(fd, config));
+  unsigned long long length = 32;
+  EXPECT_EQ_INT(write(fd, &length, sizeof(length)), (ssize_t)sizeof(length));
+  EXPECT_EQ_INT(close(fd), 0);
+  fd = open("batch_eof.bin", O_RDONLY);
+  EXPECT_TRUE(fd >= 0);
+  EXPECT_EQ_INT(batch_read_apply(fd, config, "batch_dest"), -1);
+  EXPECT_EQ_INT(close(fd), 0);
+  config_delete(config);
+  unlink("batch_eof.bin");
+}
+
+/* A malicious batch record whose chunk carries a path-traversal wire path must
+ * be refused by the apply path — never applied outside the destination root.
+ * We craft a chunk whose wire path is `../escape.txt` (the local source file
+ * is a benign temp file; only the transmitted path is hostile) and assert the
+ * apply refuses it and nothing is created outside the root. */
+static void test_batch_reject_traversal_path() {
+  const char* content = "hostile traversal image\n";
+  size_t content_len = strlen(content);
+  file_write_to_disk("batch_trav_src.txt", content, content_len, false, false);
+
+  struct stat st;
+  EXPECT_EQ_INT(stat("batch_trav_src.txt", &st), 0);
+  File* f = file_create("batch_trav_src.txt");
+  EXPECT_NOT_NULL(f);
+  f->data->size = (unsigned long long)st.st_size;
+  EXPECT_TRUE(file_load_data(f));
+  f->send_path = str_dup("../escape.txt");
+  EXPECT_NOT_NULL(f->send_path);
+  File* files[1] = {f};
+  Chunk* chunk = chunk_create(files, 1);
+  EXPECT_NOT_NULL(chunk);
+
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+
+  int wfd = open("batch_trav.bin", O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  EXPECT_TRUE(wfd >= 0);
+  EXPECT_TRUE(batch_write_header(wfd, config));
+  EXPECT_TRUE(batch_write_chunk(wfd, chunk));
+  EXPECT_EQ_INT(close(wfd), 0);
+  chunk_destroy(chunk); /* frees f and f->send_path */
+
+  int rfd = open("batch_trav.bin", O_RDONLY);
+  EXPECT_TRUE(rfd >= 0);
+  EXPECT_EQ_INT(batch_read_apply(rfd, config, "batch_dest"), -1);
+  EXPECT_EQ_INT(close(rfd), 0);
+  unlink("../escape.txt"); /* clear any stale file so the probe below is clean */
+  EXPECT_TRUE(access("../escape.txt", F_OK) != 0);
+
+  config_delete(config);
+  unlink("batch_trav.bin");
+  unlink("batch_trav_src.txt");
+}
+
+void test_batch() {
+  test_batch_roundtrip();
+  test_batch_roundtrip_metadata();
+  test_batch_reject_bad_magic();
+  test_batch_reject_truncated();
+  test_batch_reject_oversized();
+  test_batch_reject_eof_after_prefix();
+  test_batch_reject_traversal_path();
+}

tests/test_batch.h

@@ -0,0 +1,6 @@
+#ifndef TEST_BATCH_H
+#define TEST_BATCH_H
+
+void test_batch();
+
+#endif

tests/test_client_cli.c

@@ -3,6 +3,7 @@
 #include "client_validation.h"
 #include "chmod.h"
 #include "config.h"
+#include "delta.h"
 #include "file_list.h"
 #include "log.h"
 #include "test_utils.h"
@@ -68,6 +69,42 @@ static void test_validate_config_tls_requirements() {
   config_delete(cfg);
 }
 
+/* A7-3/S1: --password-file sends daemon credentials, so it is only allowed
+   over TLS (which itself mandates a verified --cert/--key/--ca) or to a
+   loopback destination.  A remote plaintext daemon is refused up front. */
+static void test_validate_config_credentials_require_tls_or_loopback() {
+  /* Default host is 127.0.0.1 (loopback), so plaintext credentials are fine. */
+  Config* cfg = valid_client_config();
+  cfg->password_file = str_dup("creds.pw");
+  EXPECT_TRUE(validate_config(cfg));
+
+  /* localhost is loopback too. */
+  free(cfg->server_host);
+  cfg->server_host = str_dup("localhost");
+  EXPECT_TRUE(validate_config(cfg));
+
+  /* A clearly remote host over plaintext is refused before any network I/O. */
+  free(cfg->server_host);
+  cfg->server_host = str_dup("192.0.2.1");
+  EXPECT_FALSE(validate_config(cfg));
+
+  /* TLS makes the remote destination acceptable (cert/key/ca are required). */
+  cfg->use_tls = true;
+  EXPECT_FALSE(validate_config(cfg));
+  cfg->tls_cert = str_dup("cert.pem");
+  cfg->tls_key = str_dup("key.pem");
+  cfg->tls_ca = str_dup("ca.pem");
+  EXPECT_TRUE(validate_config(cfg));
+
+  /* No credentials: the remote plaintext rule does not apply. */
+  cfg->use_tls = false;
+  char* creds = cfg->password_file;
+  cfg->password_file = NULL;
+  EXPECT_TRUE(validate_config(cfg));
+  cfg->password_file = creds;
+  config_delete(cfg);
+}
+
 static void test_validate_config_delta_sendfile_constraints() {
   Config* cfg = valid_client_config();
   cfg->use_delta = true;
@@ -103,19 +140,24 @@ static void test_cli_help() {
   config_delete(cfg);
 }
 
-/* Test that --archive sets compression, multithreading, and metadata */
+/* Test that the -a short spelling applies --archive's config bundle, matching
+ * rsync -rlptgoD semantics: links + metadata + devices + specials, and NOT
+ * compression/multithreading.  (--archive itself is covered by
+ * test_parse_args_archive; this guards the short alias.) */
 static void test_cli_archive_flags() {
   Config* cfg = config_create();
   EXPECT_NOT_NULL(cfg);
+  char* argv[] = {"fastsync", "-a", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
 
-  /* Simulate --archive flag */
-  cfg->use_compression = true;
-  cfg->use_multithreading = true;
-  cfg->use_metadata = true;
-
-  EXPECT_TRUE(cfg->use_compression);
-  EXPECT_TRUE(cfg->use_multithreading);
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->follow_symlinks);
   EXPECT_TRUE(cfg->use_metadata);
+  EXPECT_TRUE(cfg->preserve_devices);
+  EXPECT_TRUE(cfg->preserve_specials);
+  EXPECT_FALSE(cfg->use_compression);
+  EXPECT_FALSE(cfg->use_multithreading);
 
   config_delete(cfg);
 }
@@ -210,6 +252,68 @@ static void test_parse_args_version() {
   config_delete(cfg);
 }
 
+/* --protocol=NUM forces the wire protocol version: the current PROTOCOL_VERSION
+ * is accepted (stored into config->version, which the config frame transmits),
+ * and any other value is rejected.  Client-only: no server-side flag exists. */
+static void test_parse_args_protocol_accept_current() {
+  Config* cfg = valid_client_config();
+  EXPECT_NOT_NULL(cfg);
+  char* argv_equals[] = {"fastsync",   "--source-dir", "/src",
+                         "--dest-dir", "/dst",         "--protocol=2.19.0"};
+  int positional_args[2];
+  int positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 6, argv_equals, positional_args, &positional_count), 0);
+  EXPECT_EQ_STR(cfg->version, PROTOCOL_VERSION);
+  config_delete(cfg);
+
+  cfg = valid_client_config();
+  EXPECT_NOT_NULL(cfg);
+  char* argv_space[] = {"fastsync", "--source-dir", "/src",  "--dest-dir",
+                        "/dst",     "--protocol",   "2.19.0"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 7, argv_space, positional_args, &positional_count), 0);
+  EXPECT_EQ_STR(cfg->version, PROTOCOL_VERSION);
+  config_delete(cfg);
+}
+
+/* Any --protocol value other than the current PROTOCOL_VERSION must end in
+ * failure (parse_args simply stores it; validate_config rejects it up front). */
+static void test_parse_args_protocol_rejects_other_versions() {
+  static const char* const bad_versions[] = {"2.17",   "2.16", "2.15.0", "2.16.0", "2.17.0",
+                                             "2.18.0", "216",  "31",     "abc",    ""};
+  for (size_t i = 0; i < sizeof(bad_versions) / sizeof(bad_versions[0]); i++) {
+    Config* cfg = valid_client_config();
+    EXPECT_NOT_NULL(cfg);
+    char arg[64];
+    snprintf(arg, sizeof(arg), "--protocol=%s", bad_versions[i]);
+    char* argv[] = {"fastsync", "--source-dir", "/src", "--dest-dir", "/dst", arg};
+    int positional_args[2];
+    int positional_count = 0;
+    EXPECT_EQ_INT(parse_args(cfg, 6, argv, positional_args, &positional_count), 0);
+    EXPECT_TRUE(strcmp(cfg->version, PROTOCOL_VERSION) != 0);
+    EXPECT_FALSE(validate_config(cfg));
+    config_delete(cfg);
+  }
+}
+
+/* validate_config accepts the current PROTOCOL_VERSION (the default) and rejects
+ * a version that does not equal it -- the honest post-parse enforcement. */
+static void test_validate_config_protocol_version() {
+  Config* cfg = valid_client_config();
+  EXPECT_NOT_NULL(cfg);
+  EXPECT_EQ_STR(cfg->version, PROTOCOL_VERSION);
+  EXPECT_TRUE(validate_config(cfg));
+  config_delete(cfg);
+
+  cfg = valid_client_config();
+  EXPECT_NOT_NULL(cfg);
+  free(cfg->version);
+  cfg->version = str_dup("2.15.0");
+  EXPECT_NOT_NULL(cfg->version);
+  EXPECT_FALSE(validate_config(cfg));
+  config_delete(cfg);
+}
+
 /* --xattrs/-X and --acls/-A preserve per-file xattrs and both imply metadata
  * transmission (the xattr block rides the metadata/per-file frame); each is
  * individually negatable and the derived use_xattrs follows the flags. */
@@ -264,10 +368,47 @@ static void test_parse_args_fake_super() {
   config_delete(cfg);
 }
 
-/* Test parse_args with valid port */
+/* P7 Wave E: --super / --no-super set the receiver-side privilege tri-state
+ * (they take no argument).  The default is AUTO, the last of either flag wins,
+ * and a malformed inline value ("--super=x") is rejected rather than silently
+ * treated as --super. */
+static void test_parse_args_super() {
+  Config* cfg = config_create();
+  EXPECT_EQ_INT(cfg->super_mode, SUPER_MODE_AUTO);
+  char* argv_on[] = {"fastsync", "--super", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_on, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT(cfg->super_mode, SUPER_MODE_ON);
+  config_delete(cfg);
+
+  cfg = config_create();
+  positional_count = 0;
+  char* argv_off[] = {"fastsync", "--no-super", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_off, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT(cfg->super_mode, SUPER_MODE_OFF);
+  config_delete(cfg);
+
+  /* Tri-state, not a boolean pair: the last flag wins. */
+  cfg = config_create();
+  positional_count = 0;
+  char* argv_both[] = {"fastsync", "--super", "--no-super", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 5, argv_both, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT(cfg->super_mode, SUPER_MODE_OFF);
+  config_delete(cfg);
+
+  /* A malformed inline value is a hard unknown-option error. */
+  cfg = config_create();
+  positional_count = 0;
+  char* argv_bad[] = {"fastsync", "--super=x", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_bad, positional_args, &positional_count), -1);
+  config_delete(cfg);
+}
+
+/* Test parse_args with valid SSH port (long form; -p is now rsync --perms) */
 static void test_parse_args_valid_port() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "-p", "2222", "/src", "/dst"};
+  char* argv[] = {"fastsync", "--ssh-port", "2222", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
 
@@ -356,7 +497,7 @@ static void test_parse_args_rejects_invalid_chmod() {
 /* Test parse_args rejects port > 65535 */
 static void test_parse_args_invalid_port() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "-p", "99999", "/src", "/dst"};
+  char* argv[] = {"fastsync", "--ssh-port", "99999", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
 
@@ -369,7 +510,7 @@ static void test_parse_args_invalid_port() {
 /* Test parse_args rejects non-numeric port */
 static void test_parse_args_non_numeric_port() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "-p", "abc", "/src", "/dst"};
+  char* argv[] = {"fastsync", "--ssh-port", "abc", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
 
@@ -392,10 +533,10 @@ static void test_parse_args_invalid_server_port() {
   config_delete(cfg);
 }
 
-/* Test parse_args rejects invalid compression level */
+/* Test parse_args rejects invalid compression level (-z/--compress) */
 static void test_parse_args_invalid_compression_level() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "-c", "25", "/src", "/dst"};
+  char* argv[] = {"fastsync", "-z", "25", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
 
@@ -405,10 +546,10 @@ static void test_parse_args_invalid_compression_level() {
   config_delete(cfg);
 }
 
-/* Test parse_args accepts valid compression level */
+/* Test parse_args accepts valid compression level (-z/--compress) */
 static void test_parse_args_valid_compression_level() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "-c", "10", "/src", "/dst"};
+  char* argv[] = {"fastsync", "-z", "10", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
 
@@ -916,11 +1057,12 @@ static void test_parse_args_hard_links() {
   config_delete(cfg);
 }
 
-/* -H/--hard-links violates the per-file streaming requirement of -s and the
- * payload-bearing tail-resume of --append: both combos are rejected up front. */
+/* -H/--hard-links violates the per-file streaming requirement of
+ * --chunk-serialization and the payload-bearing tail-resume of --append: both
+ * combos are rejected up front. */
 static void test_validate_config_hard_links_incompatible_modes() {
   Config* cfg = config_create();
-  char* argv_s[] = {"fastsync", "-H", "-s", "/src", "/dst"};
+  char* argv_s[] = {"fastsync", "-H", "--chunk-serialization", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
   EXPECT_EQ_INT(parse_args(cfg, 5, argv_s, positional_args, &positional_count), 0);
@@ -988,33 +1130,52 @@ static void test_parse_args_archive() {
 
   int ret = parse_args(cfg, 4, argv, positional_args, &positional_count);
   EXPECT_EQ_INT(ret, 0);
-  EXPECT_TRUE(cfg->use_compression);
-  EXPECT_TRUE(cfg->use_multithreading);
+  EXPECT_TRUE(cfg->follow_symlinks);
   EXPECT_TRUE(cfg->use_metadata);
+  EXPECT_TRUE(cfg->preserve_devices);
+  EXPECT_TRUE(cfg->preserve_specials);
+  EXPECT_FALSE(cfg->use_compression);
+  EXPECT_FALSE(cfg->use_multithreading);
 
   config_delete(cfg);
 }
 
-/* Negations must override archive's implied options in argument order. */
+/* Negations must override archive's implied options in argument order.  Note:
+ * archive implies devices+specials, and device/special preservation itself
+ * forces metadata transmission (re-creating a node needs the metadata mode), so
+ * --no-preserve cannot turn metadata back off while archive keeps devices/specials
+ * on -- that is the correct interaction, not a bug.  A link negation does work. */
 static void test_parse_args_negations() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync",      "--archive",    "--no-compress", "--no-m",
-                  "--no-preserve", "--no-dry-run", "/src",          "/dst"};
+  char* argv[] = {"fastsync",     "--archive", "--no-links", "--no-preserve",
+                  "--no-dry-run", "/src",      "/dst"};
   int positional_args[2];
   int positional_count = 0;
 
-  EXPECT_EQ_INT(parse_args(cfg, 8, argv, positional_args, &positional_count), 0);
-  EXPECT_FALSE(cfg->use_compression);
-  EXPECT_FALSE(cfg->use_multithreading);
-  EXPECT_FALSE(cfg->use_metadata);
+  EXPECT_EQ_INT(parse_args(cfg, 7, argv, positional_args, &positional_count), 0);
+  EXPECT_FALSE(cfg->follow_symlinks);
+  EXPECT_TRUE(cfg->use_metadata);
   EXPECT_FALSE(cfg->dry_run);
   EXPECT_EQ_INT(positional_count, 2);
   config_delete(cfg);
 }
 
+/* --no-preserve negates an explicit --preserve when nothing forces metadata back
+ * on (no devices/specials). */
+static void test_parse_args_negate_preserve_without_devices() {
+  Config* cfg = config_create();
+  char* argv[] = {"fastsync", "--preserve", "--no-preserve", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+
+  EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
+  EXPECT_FALSE(cfg->use_metadata);
+  config_delete(cfg);
+}
+
 static void test_parse_args_negation_order() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "--no-z", "-c", "/src", "/dst"};
+  char* argv[] = {"fastsync", "--no-z", "-z", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
 
@@ -1367,9 +1528,11 @@ static void test_parse_args_secluded_args() {
   config_delete(cfg);
 }
 
-static void test_parse_args_short_s_remains_chunk_serialization() {
+static void test_parse_args_chunk_serialization_long_form() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "-s", "/src", "/dst"};
+  /* Chunk serialization is now long-form-only (the short -s is rsync's
+   * --secluded-args no-op). */
+  char* argv[] = {"fastsync", "--chunk-serialization", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
 
@@ -1590,7 +1753,7 @@ static void test_parse_args_fuzzy_respects_no_incremental() {
  * sendfile (-f) modes reject -- mirroring the --delta constraint checks. */
 static void test_validate_config_fuzzy_incompatible_modes() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "--fuzzy", "-s", "/src", "/dst"};
+  char* argv[] = {"fastsync", "--fuzzy", "--chunk-serialization", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
   EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
@@ -1601,7 +1764,7 @@ static void test_validate_config_fuzzy_incompatible_modes() {
   config_delete(cfg);
 
   cfg = config_create();
-  char* sendfile_argv[] = {"fastsync", "--fuzzy", "-f", "/src", "/dst"};
+  char* sendfile_argv[] = {"fastsync", "--fuzzy", "--sendfile", "/src", "/dst"};
   positional_count = 0;
   EXPECT_EQ_INT(parse_args(cfg, 5, sendfile_argv, positional_args, &positional_count), 0);
   cfg->send_directory = str_dup("/src");
@@ -1794,7 +1957,8 @@ static void test_parse_args_table_equals_string_and_int_options() {
  * generic "Unknown option", when they are the final argv entry. */
 static void test_parse_args_missing_argument_diagnostic() {
   static const char* const options[] = {"--exclude", "--server-port", "--skip-compress",
-                                        "-T",        "--out-format",  "--log-file-format"};
+                                        "-T",        "--out-format",  "--log-file-format",
+                                        "--protocol"};
 
   for (size_t i = 0; i < sizeof(options) / sizeof(options[0]); i++) {
     Config* cfg = config_create();
@@ -2285,20 +2449,24 @@ static void test_parse_args_append_both() {
 
 static void test_validate_config_append_rejects_chunk_serialization() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "--append", "-s", "/src", "/dst"};
+  char* argv[] = {"fastsync", "--append", "--chunk-serialization", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
   EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
+  cfg->send_directory = str_dup("/src");
+  cfg->receive_root_directory = str_dup("/dst");
   EXPECT_FALSE(validate_config(cfg));
   config_delete(cfg);
 }
 
 static void test_validate_config_append_verify_rejects_chunk_serialization() {
   Config* cfg = config_create();
-  char* argv[] = {"fastsync", "--append-verify", "-s", "/src", "/dst"};
+  char* argv[] = {"fastsync", "--append-verify", "--chunk-serialization", "/src", "/dst"};
   int positional_args[2];
   int positional_count = 0;
   EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
+  cfg->send_directory = str_dup("/src");
+  cfg->receive_root_directory = str_dup("/dst");
   EXPECT_FALSE(validate_config(cfg));
   config_delete(cfg);
 }
@@ -2445,6 +2613,64 @@ static void test_parse_args_chown() {
   config_delete(cfg);
 }
 
+/* --copy-as=USER[:GROUP] (P7 Wave E): resolve the user/group against the local
+ * databases, imply metadata, and apply the documented group-default rule. */
+static void test_parse_args_copy_as() {
+  /* Explicit numeric user and group. */
+  Config* cfg = config_create();
+  char* argv[] = {"fastsync", "--copy-as=@1000:@1001", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->copy_as_set);
+  EXPECT_TRUE(cfg->use_metadata);
+  EXPECT_EQ_INT(cfg->copy_as_uid, 1000);
+  EXPECT_EQ_INT(cfg->copy_as_gid, 1001);
+  config_delete(cfg);
+
+  /* Space form. */
+  cfg = config_create();
+  positional_count = 0;
+  char* argv2[] = {"fastsync", "--copy-as", "@2000:3000", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 5, argv2, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT(cfg->copy_as_uid, 2000);
+  EXPECT_EQ_INT(cfg->copy_as_gid, 3000);
+  config_delete(cfg);
+
+  /* Group omitted: a resolvable user uses its primary gid. */
+  struct passwd* self = getpwuid(geteuid());
+  if (self) {
+    cfg = config_create();
+    positional_count = 0;
+    char* argv3[] = {"fastsync", (char*)"--copy-as", (char*)self->pw_name, "/src", "/dst"};
+    EXPECT_EQ_INT(parse_args(cfg, 5, argv3, positional_args, &positional_count), 0);
+    EXPECT_EQ_INT(cfg->copy_as_uid, (int32_t)self->pw_uid);
+    EXPECT_EQ_INT(cfg->copy_as_gid, (int32_t)self->pw_gid);
+    config_delete(cfg);
+  }
+
+  /* Group omitted with a numeric id that has no passwd entry: gid falls back
+   * to uid (documented divergence). */
+  if (!getpwuid((uid_t)4242)) {
+    cfg = config_create();
+    positional_count = 0;
+    char* argv4[] = {"fastsync", "--copy-as=@4242", "/src", "/dst"};
+    EXPECT_EQ_INT(parse_args(cfg, 4, argv4, positional_args, &positional_count), 0);
+    EXPECT_EQ_INT(cfg->copy_as_uid, 4242);
+    EXPECT_EQ_INT(cfg->copy_as_gid, 4242);
+    config_delete(cfg);
+  }
+
+  /* '*' means the client's current euid/egid. */
+  cfg = config_create();
+  positional_count = 0;
+  char* argv5[] = {"fastsync", "--copy-as=*:*", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv5, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT(cfg->copy_as_uid, (int32_t)geteuid());
+  EXPECT_EQ_INT(cfg->copy_as_gid, (int32_t)getegid());
+  config_delete(cfg);
+}
+
 /* Malformed identity specs are rejected, never silently ignored. */
 static void test_parse_args_rejects_malformed_identity() {
   struct {
@@ -2458,6 +2684,12 @@ static void test_parse_args_rejects_malformed_identity() {
       {"--groupmap", "no_such_group_qqq:x"},
       {"--chown", "a:b:c"},
       {"--chown", "no_such_user_zzz:"},
+      {"--copy-as", ""},
+      {"--copy-as", ":"},
+      {"--copy-as", "a:b:c"},
+      {"--copy-as", "@1000:"},
+      {"--copy-as", "definitely_not_a_real_user_zzz"},
+      {"--copy-as", "no_such_group_qqq_group"},
   };
   for (size_t i = 0; i < sizeof(bad) / sizeof(bad[0]); i++) {
     Config* cfg = config_create();
@@ -2475,6 +2707,12 @@ static void test_parse_args_rejects_malformed_identity() {
   int positional_count = 0;
   EXPECT_EQ_INT(parse_args(cfg, 2, argv, positional_args, &positional_count), -1);
   config_delete(cfg);
+
+  cfg = config_create();
+  positional_count = 0;
+  char* argv2[] = {"fastsync", "--copy-as"};
+  EXPECT_EQ_INT(parse_args(cfg, 2, argv2, positional_args, &positional_count), -1);
+  config_delete(cfg);
 }
 
 /* --preallocate parses as a boolean flag and validates cleanly. */
@@ -2757,18 +2995,18 @@ static void test_parse_args_remote_option_rejects_bad_values() {
   config_delete(cfg);
 }
 
-/* A short -M form must NOT be accepted as --remote-option: -M stays FastSync
- * metadata mode (documented divergence). */
-static void test_parse_args_remote_option_no_short_M() {
+/* Since the Phase-7 CLI-namespace pass, -M is rsync's --remote-option short
+ * form (FastSync metadata mode is long-only --preserve): it consumes the next
+ * argv as a remote-option value and must NOT set FastSync metadata mode. */
+static void test_parse_args_remote_option_short_M() {
   Config* cfg = valid_client_config();
   EXPECT_NOT_NULL(cfg);
-  /* -M followed by a remote-option-looking word still means metadata mode. */
-  char* argv[] = {"fastsync", "-M", "-v", "--source-dir", "/src", "--dest-dir", "/dst"};
+  char* argv[] = {"fastsync", "-M", "--trust-sender", "--source-dir", "/src", "--dest-dir", "/dst"};
   int positional_args[2];
   int positional_count = 0;
   EXPECT_EQ_INT(parse_args(cfg, 7, argv, positional_args, &positional_count), 0);
-  EXPECT_TRUE(cfg->use_metadata);
-  EXPECT_EQ_INT(cfg->remote_option_count, 0);
+  EXPECT_FALSE(cfg->use_metadata);
+  EXPECT_EQ_INT(cfg->remote_option_count, 1);
   config_delete(cfg);
 }
 
@@ -2815,6 +3053,79 @@ static void test_parse_args_password_file() {
   config_delete(cfg);
 }
 
+/* --block-size (Delta block size): --block-size/--delta-block set
+ * config->delta_block_size, out-of-range values are rejected with the default
+ * kept, and the configured size genuinely reaches the delta engine (a larger
+ * block yields fewer signature blocks for identical data). */
+static void test_parse_args_block_size() {
+  Config* cfg = config_create();
+  cfg->send_directory = str_dup("/src");
+  cfg->receive_root_directory = str_dup("/dst");
+  int positional_args[2];
+  int positional_count = 0;
+
+  char* argv_long[] = {"fastsync", "--block-size", "4096", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 5, argv_long, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT((int)cfg->delta_block_size, 4096);
+
+  cfg->delta_block_size = DELTA_BLOCK_SIZE_DEFAULT;
+  char* argv_delta[] = {"fastsync", "--delta-block", "2048", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 5, argv_delta, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT((int)cfg->delta_block_size, 2048);
+
+  /* Inline =SIZE forms (the documented rsync spelling) are accepted too. */
+  cfg->delta_block_size = DELTA_BLOCK_SIZE_DEFAULT;
+  char* argv_eq[] = {"fastsync", "--block-size=8192", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_eq, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT((int)cfg->delta_block_size, 8192);
+
+  cfg->delta_block_size = DELTA_BLOCK_SIZE_DEFAULT;
+  char* argv_delta_eq[] = {"fastsync", "--delta-block=1024", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_delta_eq, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT((int)cfg->delta_block_size, 1024);
+
+  /* Out of range: parsed, warned, and the default is kept (both spellings). */
+  cfg->delta_block_size = DELTA_BLOCK_SIZE_DEFAULT;
+  char* argv_bad[] = {"fastsync", "--block-size", "1", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 5, argv_bad, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT((int)cfg->delta_block_size, (int)DELTA_BLOCK_SIZE_DEFAULT);
+
+  cfg->delta_block_size = DELTA_BLOCK_SIZE_DEFAULT;
+  char* argv_bad_inline[] = {"fastsync", "--delta-block=999999", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_bad_inline, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT((int)cfg->delta_block_size, (int)DELTA_BLOCK_SIZE_DEFAULT);
+
+  /* A non-numeric value is a hard error for both spellings. */
+  char* argv_nan[] = {"fastsync", "--delta-block=abc", "/src", "/dst"};
+  positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_nan, positional_args, &positional_count), -1);
+
+  /* A non-default block size changes the number of signature blocks for
+     identical data: block_count = ceil(size / block_size). */
+  const char data[10000] = {0};
+  DeltaSignature* small = delta_signature_create_seeded(data, sizeof(data), 1024, 0);
+  DeltaSignature* large = delta_signature_create_seeded(data, sizeof(data), 8192, 0);
+  EXPECT_NOT_NULL(small);
+  EXPECT_NOT_NULL(large);
+  /* cppcheck-suppress knownConditionTrueFalse -- EXPECT_NOT_NULL above asserts,
+     but cppcheck cannot see through the macro; the guard is defensive. */
+  if (small && large) {
+    EXPECT_TRUE(large->block_size == 8192 && small->block_size == 1024);
+    EXPECT_TRUE(large->block_count < small->block_count);
+    EXPECT_EQ_INT((int)small->block_count, 10); /* ceil(10000/1024) */
+    EXPECT_EQ_INT((int)large->block_count, 2);  /* ceil(10000/8192) */
+  }
+  delta_signature_destroy(small);
+  delta_signature_destroy(large);
+
+  config_delete(cfg);
+}
+
 void test_client_cli() {
   test_validate_config_required_paths();
   test_parse_args_numeric_ids();
@@ -2822,9 +3133,11 @@ void test_client_cli() {
   test_parse_args_groupmap();
   test_parse_args_usermap_name_resolution();
   test_parse_args_chown();
+  test_parse_args_copy_as();
   test_parse_args_rejects_malformed_identity();
   test_parse_args_preallocate();
   test_parse_args_metadata_times();
+  test_parse_args_block_size();
   test_parse_args_devices_specials();
   test_parse_args_atimes_long_and_short();
   test_parse_args_omit_link_times_long();
@@ -2840,6 +3153,7 @@ void test_client_cli() {
   test_validate_config_append_verify_rejects_whole_file();
   test_validate_config_incompatible_options();
   test_validate_config_tls_requirements();
+  test_validate_config_credentials_require_tls_or_loopback();
   test_validate_config_delta_sendfile_constraints();
   test_cli_help();
   test_cli_archive_flags();
@@ -2850,6 +3164,9 @@ void test_client_cli() {
   test_cli_exclude_patterns();
   test_parse_args_help();
   test_parse_args_version();
+  test_parse_args_protocol_accept_current();
+  test_parse_args_protocol_rejects_other_versions();
+  test_validate_config_protocol_version();
   test_parse_args_valid_port();
   test_parse_args_size_only();
   test_parse_args_ignore_existing();
@@ -2890,6 +3207,7 @@ void test_client_cli() {
   test_parse_args_rejects_invalid_info_flag();
   test_parse_args_archive();
   test_parse_args_negations();
+  test_parse_args_negate_preserve_without_devices();
   test_parse_args_negation_order();
   test_parse_args_no_preserve_blocks_implicit_metadata();
   test_parse_args_rejects_unsafe_negation();
@@ -2905,7 +3223,7 @@ void test_client_cli() {
   test_parse_args_stderr_modes();
   test_parse_args_rejects_unsupported_stderr_modes();
   test_parse_args_secluded_args();
-  test_parse_args_short_s_remains_chunk_serialization();
+  test_parse_args_chunk_serialization_long_form();
   test_parse_args_symlink_trust();
   test_parse_args_whole_file();
   test_parse_args_fuzzy_implies_delta();
@@ -2926,6 +3244,7 @@ void test_client_cli() {
   test_parse_args_missing_argument_diagnostic();
   test_parse_args_xattrs_acls();
   test_parse_args_fake_super();
+  test_parse_args_super();
   test_parse_args_partial_progress();
   test_parse_args_itemize_changes();
   test_parse_args_list_only();
@@ -2956,7 +3275,7 @@ void test_client_cli() {
   test_parse_args_remote_option_space_form();
   test_parse_args_remote_option_missing_value();
   test_parse_args_remote_option_rejects_bad_values();
-  test_parse_args_remote_option_no_short_M();
+  test_parse_args_remote_option_short_M();
   test_parse_args_no_motd();
   test_parse_args_password_file();
 }

tests/test_config.c

@@ -1,5 +1,6 @@
 #include "test_config.h"
 #include "config.h"
+#include "identity.h"
 #include "multiprocessing.h"
 #include "protocol.h"
 #include "queue.h"
@@ -245,9 +246,9 @@ static void test_config_module_wire_empty_canonicalizes_to_null() {
   }
 }
 
-/* Daemon auth credentials (Wave B) ride the config frame: username + SHA-256
- * hex digest are present together, or both are absent.  Round-trip a present
- * pair. */
+/* Daemon auth credentials (A7, protocol 2.19.0) ride the config frame as the
+ * username ONLY; the literal password never crosses the wire.  Round-trip a
+ * present username. */
 static void test_config_daemon_auth_wire_roundtrip() {
   Config* send_cfg = config_create();
   EXPECT_NOT_NULL(send_cfg);
@@ -255,8 +256,7 @@ static void test_config_daemon_auth_wire_roundtrip() {
   send_cfg->receive_root_directory = str_dup("rel/path");
   send_cfg->module = str_dup("backup");
   send_cfg->auth_user = str_dup("alice");
-  send_cfg->auth_password_hash =
-      str_dup("9b90e524e94995ee4aeae2ee3c428a53405d1e8db147f44facc46797d0caf4c3");
+  send_cfg->auth_password = str_dup("alice-s3cret");
 
   int p[2];
   EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
@@ -268,10 +268,9 @@ static void test_config_daemon_auth_wire_roundtrip() {
     close(p[1]);
     io_set_fds(p[0], p[0]);
     Config* recv_cfg = config_receive(p[0]);
+    /* The plaintext password is client-only: it is never serialized. */
     bool ok = recv_cfg != NULL && recv_cfg->auth_user != NULL &&
-              strcmp(recv_cfg->auth_user, "alice") == 0 && recv_cfg->auth_password_hash != NULL &&
-              strcmp(recv_cfg->auth_password_hash,
-                     "9b90e524e94995ee4aeae2ee3c428a53405d1e8db147f44facc46797d0caf4c3") == 0;
+              strcmp(recv_cfg->auth_user, "alice") == 0 && recv_cfg->auth_password == NULL;
     config_delete(recv_cfg);
     close(p[0]);
     _exit(ok ? 0 : 1);
@@ -288,7 +287,7 @@ static void test_config_daemon_auth_wire_roundtrip() {
   }
 }
 
-/* The receive side validates the auth payload: a present-but-malformed digest
+/* The receive side validates the auth payload: a present-but-malformed username
  * is refused (config_receive returns NULL), so a hostile peer cannot slip a
  * garbage credential past the receive guard into the module gate. */
 static void test_config_daemon_auth_wire_rejects_malformed() {
@@ -297,8 +296,7 @@ static void test_config_daemon_auth_wire_rejects_malformed() {
   send_cfg->send_directory = str_dup("/src");
   send_cfg->receive_root_directory = str_dup("/dst");
   send_cfg->module = str_dup("m");
-  send_cfg->auth_user = str_dup("alice");
-  send_cfg->auth_password_hash = str_dup("not-a-valid-sha256-hex-digest!!");
+  send_cfg->auth_user = str_dup("bad user");
 
   int p[2];
   EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
@@ -1565,6 +1563,401 @@ static void test_config_local_only_fields_not_serialized() {
   EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
 }
 
+static void test_config_iconv_spec_wire_roundtrip() {
+  Config* send_cfg = config_create();
+  EXPECT_NOT_NULL(send_cfg);
+  send_cfg->send_directory = str_dup("/src");
+  send_cfg->receive_root_directory = str_dup("rel/path");
+  send_cfg->iconv_spec = str_dup("utf-8,iso-8859-1");
+
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  io_set_bwlimit(0);
+
+  pid_t pid = fork();
+  if (pid == 0) {
+    close(p[1]);
+    io_set_fds(p[0], p[0]);
+    Config* recv_cfg = config_receive(p[0]);
+    bool ok = recv_cfg != NULL && recv_cfg->iconv_spec != NULL &&
+              strcmp(recv_cfg->iconv_spec, "utf-8,iso-8859-1") == 0;
+    config_delete(recv_cfg);
+    close(p[0]);
+    _exit(ok ? 0 : 1);
+  } else {
+    close(p[0]);
+    io_set_fds(p[1], p[1]);
+    bool sent = config_send(p[1], send_cfg);
+    int status;
+    waitpid(pid, &status, 0);
+    close(p[1]);
+    config_delete(send_cfg);
+    EXPECT_TRUE(sent);
+    EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+  }
+}
+
+static void test_config_iconv_spec_empty_canonicalizes_to_null() {
+  Config* send_cfg = config_create();
+  EXPECT_NOT_NULL(send_cfg);
+  send_cfg->send_directory = str_dup("/src");
+  send_cfg->receive_root_directory = str_dup("/dst");
+  /* iconv_spec left NULL -> serialized as "" -> received back as NULL. */
+
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  io_set_bwlimit(0);
+
+  pid_t pid = fork();
+  if (pid == 0) {
+    close(p[1]);
+    io_set_fds(p[0], p[0]);
+    Config* recv_cfg = config_receive(p[0]);
+    bool ok = recv_cfg != NULL && recv_cfg->iconv_spec == NULL;
+    config_delete(recv_cfg);
+    close(p[0]);
+    _exit(ok ? 0 : 1);
+  } else {
+    close(p[0]);
+    io_set_fds(p[1], p[1]);
+    bool sent = config_send(p[1], send_cfg);
+    int status;
+    waitpid(pid, &status, 0);
+    close(p[1]);
+    config_delete(send_cfg);
+    EXPECT_TRUE(sent);
+    EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+  }
+}
+
+static void test_config_receive_rejects_invalid_iconv_spec() {
+  Config* send_cfg = config_create();
+  EXPECT_NOT_NULL(send_cfg);
+  send_cfg->send_directory = str_dup("/src");
+  send_cfg->receive_root_directory = str_dup("/dst");
+  send_cfg->iconv_spec = str_dup("no-such-charset,utf-8");
+
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  io_set_bwlimit(0);
+
+  pid_t pid = fork();
+  if (pid == 0) {
+    close(p[1]);
+    io_set_fds(p[0], p[0]);
+    /* A malformed/unsupported spec must be refused at the config handshake
+       (STATUS_ERROR makes config_send fail on the parent). */
+    Config* recv_cfg = config_receive(p[0]);
+    config_delete(recv_cfg);
+    close(p[0]);
+    _exit(recv_cfg ? 1 : 0);
+  } else {
+    close(p[0]);
+    io_set_fds(p[1], p[1]);
+    bool sent = config_send(p[1], send_cfg);
+    int status;
+    waitpid(pid, &status, 0);
+    close(p[1]);
+    config_delete(send_cfg);
+    EXPECT_FALSE(sent);
+    EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+  }
+}
+
+/* P7 Wave E: the --super / --no-super tri-state crosses the config wire
+   unchanged (AUTO/ON/OFF), so the receiver can enforce the privilege policy. */
+static void test_config_super_mode_wire_roundtrip() {
+  if (is_running_under_valgrind())
+    return;
+  int modes[] = {SUPER_MODE_AUTO, SUPER_MODE_ON, SUPER_MODE_OFF};
+  for (size_t i = 0; i < sizeof(modes) / sizeof(modes[0]); i++) {
+    int p[2];
+    EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+    pid_t pid = fork();
+    if (pid == 0) {
+      close(p[1]);
+      io_set_fds(p[0], p[0]);
+      Config* recv = config_receive(p[0]);
+      bool ok = recv != NULL && recv->super_mode == modes[i];
+      config_delete(recv);
+      close(p[0]);
+      _exit(ok ? 0 : 1);
+    } else {
+      close(p[0]);
+      io_set_fds(p[1], p[1]);
+      Config* send_cfg = config_create();
+      EXPECT_NOT_NULL(send_cfg);
+      send_cfg->send_directory = str_dup("/src");
+      send_cfg->receive_root_directory = str_dup("/dst");
+      send_cfg->super_mode = modes[i];
+      bool sent = config_send(p[1], send_cfg);
+      int status;
+      waitpid(pid, &status, 0);
+      close(p[1]);
+      config_delete(send_cfg);
+      EXPECT_TRUE(sent);
+      EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+    }
+  }
+}
+
+/* --copy-as (P7 Wave E, protocol 2.18.0) travels as a trailing config-frame
+   block: a presence int, then the two int32 ids when set. */
+static void test_config_copy_as_wire_roundtrip() {
+  struct {
+    bool set;
+    int32_t uid;
+    int32_t gid;
+  } cases[] = {{false, 0, 0}, {true, 1000, 1001}};
+  if (is_running_under_valgrind())
+    return;
+  for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); i++) {
+    int p[2];
+    EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+    pid_t pid = fork();
+    if (pid == 0) {
+      close(p[1]);
+      io_set_fds(p[0], p[0]);
+      Config* recv = config_receive(p[0]);
+      bool ok = recv != NULL && recv->copy_as_set == cases[i].set &&
+                (!cases[i].set ||
+                 (recv->copy_as_uid == cases[i].uid && recv->copy_as_gid == cases[i].gid));
+      config_delete(recv);
+      close(p[0]);
+      _exit(ok ? 0 : 1);
+    } else {
+      close(p[0]);
+      io_set_fds(p[1], p[1]);
+      Config* send_cfg = config_create();
+      EXPECT_NOT_NULL(send_cfg);
+      send_cfg->send_directory = str_dup("/src");
+      send_cfg->receive_root_directory = str_dup("/dst");
+      send_cfg->copy_as_set = cases[i].set;
+      send_cfg->copy_as_uid = cases[i].uid;
+      send_cfg->copy_as_gid = cases[i].gid;
+      /* --copy-as requires the metadata path (the receiver chowns from the
+         transmitted source ids); a raw frame with copy_as_set but no metadata
+         is now rejected by validate_received_config. */
+      send_cfg->use_metadata = cases[i].set;
+      bool sent = config_send(p[1], send_cfg);
+      int status;
+      waitpid(pid, &status, 0);
+      close(p[1]);
+      config_delete(send_cfg);
+      EXPECT_TRUE(sent);
+      EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+    }
+  }
+}
+
+/* An out-of-range super_mode value on the wire must be refused on receive
+   (never silently clamped or accepted). */
+static void test_config_receive_rejects_invalid_super_mode() {
+  if (is_running_under_valgrind())
+    return;
+  Config* c = config_create();
+  EXPECT_NOT_NULL(c);
+  c->send_directory = str_dup("/src");
+  c->receive_root_directory = str_dup("/dst");
+  c->super_mode = 99;
+  EXPECT_FALSE(roundtrip_config_ok(c));
+  config_delete(c);
+
+  /* A negative value is equally invalid. */
+  c = config_create();
+  EXPECT_NOT_NULL(c);
+  c->send_directory = str_dup("/src");
+  c->receive_root_directory = str_dup("/dst");
+  c->super_mode = -1;
+  EXPECT_FALSE(roundtrip_config_ok(c));
+  config_delete(c);
+}
+
+/* A hostile peer must not smuggle a negative (sentinel) copy-as id into the
+   ownership path: the receive side rejects it and the run fails the handshake. */
+static void test_config_receive_rejects_negative_copy_as() {
+  if (is_running_under_valgrind())
+    return;
+  Config* send_cfg = config_create();
+  EXPECT_NOT_NULL(send_cfg);
+  send_cfg->send_directory = str_dup("/src");
+  send_cfg->receive_root_directory = str_dup("/dst");
+  send_cfg->copy_as_set = true;
+  send_cfg->copy_as_uid = -1;
+  send_cfg->copy_as_gid = 0;
+
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  io_set_bwlimit(0);
+
+  pid_t pid = fork();
+  if (pid == 0) {
+    close(p[1]);
+    io_set_fds(p[0], p[0]);
+    Config* recv_cfg = config_receive(p[0]);
+    config_delete(recv_cfg);
+    close(p[0]);
+    _exit(recv_cfg ? 1 : 0);
+  } else {
+    close(p[0]);
+    io_set_fds(p[1], p[1]);
+    bool sent = config_send(p[1], send_cfg);
+    int status;
+    waitpid(pid, &status, 0);
+    close(p[1]);
+    config_delete(send_cfg);
+    EXPECT_FALSE(sent);
+    EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+  }
+}
+
+/* --copy-as forces ownership through the metadata path.  A frame that sets
+   copy_as_set but not use_metadata would pass the receiver's privilege gate
+   while chowning nothing, so validate_received_config must reject it (and the
+   sender observes the rejection as a failed config_send). */
+static void test_config_receive_rejects_copy_as_without_metadata() {
+  if (is_running_under_valgrind())
+    return;
+  Config* c = config_create();
+  EXPECT_NOT_NULL(c);
+  c->send_directory = str_dup("/src");
+  c->receive_root_directory = str_dup("/dst");
+  c->copy_as_set = true;
+  c->copy_as_uid = 1000;
+  c->copy_as_gid = 1000;
+  c->use_metadata = false;
+  EXPECT_FALSE(roundtrip_config_ok(c));
+  config_delete(c);
+
+  /* With metadata enabled the same block is accepted. */
+  c = config_create();
+  EXPECT_NOT_NULL(c);
+  c->send_directory = str_dup("/src");
+  c->receive_root_directory = str_dup("/dst");
+  c->copy_as_set = true;
+  c->copy_as_uid = 1000;
+  c->copy_as_gid = 1000;
+  c->use_metadata = true;
+  EXPECT_TRUE(roundtrip_config_ok(c));
+  config_delete(c);
+}
+
+/* identity_copy_as_refused() is the pure, pre-snapshot refusal predicate: a
+   --copy-as is refused when the receiver is not root OR the effective super
+   mode is OFF (an operator veto), and never when --copy-as is unset. */
+static void test_identity_copy_as_refused() {
+  Config* c = config_create();
+  EXPECT_NOT_NULL(c);
+  EXPECT_FALSE(identity_copy_as_refused(c));
+  EXPECT_FALSE(identity_copy_as_refused(NULL));
+
+  c->copy_as_set = true;
+  c->super_mode = SUPER_MODE_AUTO;
+  if (geteuid() == 0) {
+    EXPECT_FALSE(identity_copy_as_refused(c)); /* AUTO permits as root */
+    c->super_mode = SUPER_MODE_ON;
+    EXPECT_FALSE(identity_copy_as_refused(c));
+    c->super_mode = SUPER_MODE_OFF;
+    EXPECT_TRUE(identity_copy_as_refused(c));
+  } else {
+    /* Unprivileged: refused regardless of the mode. */
+    EXPECT_TRUE(identity_copy_as_refused(c));
+    c->super_mode = SUPER_MODE_OFF;
+    EXPECT_TRUE(identity_copy_as_refused(c));
+  }
+  config_delete(c);
+}
+
+/* P7 Wave E: privilege_super_permitted() maps the super_mode tri-state.  OFF
+   forbids super-user activities even for root; ON and AUTO permit the confined
+   attempt (matching FastSync's historical best-effort behavior, where the kernel
+   refuses an unprivileged attempt and the caller skips it). */
+static void test_privilege_super_permitted_modes() {
+  Config* c = config_create();
+  EXPECT_NOT_NULL(c);
+  c->super_mode = SUPER_MODE_OFF;
+  EXPECT_TRUE(identity_set_active(c));
+  EXPECT_FALSE(privilege_super_permitted());
+  c->super_mode = SUPER_MODE_ON;
+  EXPECT_TRUE(identity_set_active(c));
+  EXPECT_TRUE(privilege_super_permitted());
+  c->super_mode = SUPER_MODE_AUTO;
+  EXPECT_TRUE(identity_set_active(c));
+  EXPECT_TRUE(privilege_super_permitted());
+  config_delete(c);
+
+  /* After clearing, the neutral default is AUTO (attempt), never a stale
+     snapshot from a previous connection. */
+  identity_clear_active();
+  EXPECT_TRUE(privilege_super_permitted());
+}
+
+/* P7 Wave E hardening (A1): identity_ownership_requested() is the pure,
+   config-only predicate the daemon module gate uses.  It must fire for every
+   client-chosen ownership / super-user request and stay false for a plain
+   transfer and for SUPER_MODE_AUTO (the default) alone. */
+static void test_identity_ownership_requested() {
+  EXPECT_FALSE(identity_ownership_requested(NULL));
+
+  Config* c = config_create();
+  EXPECT_NOT_NULL(c);
+  EXPECT_FALSE(identity_ownership_requested(c));
+  c->super_mode = SUPER_MODE_AUTO;
+  EXPECT_FALSE(identity_ownership_requested(c)); /* AUTO alone is not ownership */
+  c->super_mode = SUPER_MODE_ON;
+  EXPECT_TRUE(identity_ownership_requested(c)); /* explicit --super is */
+  c->super_mode = SUPER_MODE_AUTO;
+
+  c->numeric_ids = true;
+  EXPECT_TRUE(identity_ownership_requested(c));
+  c->numeric_ids = false;
+  c->chown_uid_set = true;
+  EXPECT_TRUE(identity_ownership_requested(c));
+  c->chown_uid_set = false;
+  c->chown_gid_set = true;
+  EXPECT_TRUE(identity_ownership_requested(c));
+  c->chown_gid_set = false;
+  c->copy_as_set = true;
+  EXPECT_TRUE(identity_ownership_requested(c));
+  c->copy_as_set = false;
+  c->fake_super = true;
+  EXPECT_TRUE(identity_ownership_requested(c));
+  config_delete(c);
+
+  Config* um = config_create();
+  EXPECT_NOT_NULL(um);
+  EXPECT_EQ_INT(identity_parse_map(um, "@1:@2", false), 0);
+  EXPECT_TRUE(identity_ownership_requested(um));
+  config_delete(um);
+
+  Config* gm = config_create();
+  EXPECT_NOT_NULL(gm);
+  EXPECT_EQ_INT(identity_parse_map(gm, "@1:@2", true), 0);
+  EXPECT_TRUE(identity_ownership_requested(gm));
+  config_delete(gm);
+}
+
+/* P7 Wave E hardening (A3): --super no longer implies raw numeric-id
+   preservation, so it must never enable ownership application on its own; an
+   explicit identity flag is required. */
+static void test_super_does_not_imply_numeric() {
+  Config* c = config_create();
+  EXPECT_NOT_NULL(c);
+  c->super_mode = SUPER_MODE_ON;
+  c->use_metadata = true;
+  EXPECT_TRUE(identity_set_active(c));
+  EXPECT_FALSE(identity_active_enabled());
+  c->numeric_ids = true;
+  EXPECT_TRUE(identity_set_active(c));
+  EXPECT_TRUE(identity_active_enabled());
+  identity_clear_active();
+  config_delete(c);
+}
+
 void test_config() {
   test_config_lifecycle();
   test_config_ssh_dest();
@@ -1608,8 +2001,20 @@ void test_config() {
     test_config_module_wire_empty_canonicalizes_to_null();
     test_config_daemon_auth_wire_roundtrip();
     test_config_daemon_auth_wire_rejects_malformed();
+    test_config_iconv_spec_wire_roundtrip();
+    test_config_iconv_spec_empty_canonicalizes_to_null();
+    test_config_receive_rejects_invalid_iconv_spec();
+    test_config_super_mode_wire_roundtrip();
+    test_config_receive_rejects_invalid_super_mode();
+    test_config_copy_as_wire_roundtrip();
+    test_config_receive_rejects_negative_copy_as();
+    test_config_receive_rejects_copy_as_without_metadata();
     test_config_receive_with_validate_rejects();
   }
+  test_identity_copy_as_refused();
+  test_identity_ownership_requested();
+  test_super_does_not_imply_numeric();
+  test_privilege_super_permitted_modes();
   test_config_delete_timing_early_helper();
   test_config_is_remote_dest();
 }

tests/test_daemon_conf.c

@@ -43,6 +43,7 @@ static void test_daemon_conf_full_parse() {
                            "[backup]\n"
                            "path = /srv/backup\n"
                            "read only = yes\n"
+                           "client owner = yes\n"
                            "auth users = alice, bob\n",
                            &path),
                 0);
@@ -57,6 +58,7 @@ static void test_daemon_conf_full_parse() {
   EXPECT_EQ_STR(conf->modules[0].name, "backup");
   EXPECT_EQ_STR(conf->modules[0].path, "/srv/backup");
   EXPECT_TRUE(conf->modules[0].read_only);
+  EXPECT_TRUE(conf->modules[0].client_owner);
   EXPECT_EQ_INT(conf->modules[0].auth_user_count, 2);
   EXPECT_EQ_STR(conf->modules[0].auth_users[0], "alice");
   EXPECT_EQ_STR(conf->modules[0].auth_users[1], "bob");
@@ -84,6 +86,10 @@ static void test_daemon_conf_comments_and_blank_lines() {
   EXPECT_EQ_INT(conf->module_count, 2);
   EXPECT_EQ_STR(conf->modules[0].name, "alpha");
   EXPECT_EQ_STR(conf->modules[1].name, "beta");
+  /* `client owner` defaults to off: a module must opt in to client-chosen
+     ownership. */
+  EXPECT_FALSE(conf->modules[0].client_owner);
+  EXPECT_FALSE(conf->modules[1].client_owner);
   daemon_conf_free(conf);
 }
 
@@ -207,6 +213,12 @@ static void test_daemon_conf_malformed_rejected() {
   EXPECT_NULL(conf);
   EXPECT_TRUE(strstr(err, "read only") != NULL);
 
+  EXPECT_EQ_INT(write_conf("[m]\npath = /x\nclient owner = maybe\n", &path), 0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NULL(conf);
+  EXPECT_TRUE(strstr(err, "client owner") != NULL);
+
   EXPECT_EQ_INT(write_conf("= value\n", &path), 0);
   conf = daemon_conf_load(path, err, sizeof(err));
   free(path);

tests/test_file.c

@@ -1,5 +1,10 @@
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE /* SEEK_HOLE/SEEK_DATA for the sparse-hole sparseness check */
+#endif
 #include "test_file.h"
 #include "file.h"
+#include "file_store.h"
+#include "file_receive.h"
 #include "data.h"
 #include "config.h"
 #include "utils.h"
@@ -33,6 +38,7 @@ static void test_file_special_rdev_valid() {
   mode_t fake_char = S_IFCHR | 0600;
   mode_t fake_blk = S_IFBLK | 0600;
   mode_t fake_fifo = S_IFIFO | 0600;
+  mode_t fake_sock = S_IFSOCK | 0600;
   /* char/block devices: accept a legal pair, reject negative / oversized. */
   EXPECT_TRUE(file_special_rdev_valid(1, 3, fake_char));
   EXPECT_TRUE(file_special_rdev_valid(0xffff, 0x00ffffff, fake_blk));
@@ -43,6 +49,8 @@ static void test_file_special_rdev_valid() {
   /* FIFOs/sockets must carry an empty rdev. */
   EXPECT_TRUE(file_special_rdev_valid(0, 0, fake_fifo));
   EXPECT_FALSE(file_special_rdev_valid(1, 0, fake_fifo));
+  EXPECT_TRUE(file_special_rdev_valid(0, 0, fake_sock));
+  EXPECT_FALSE(file_special_rdev_valid(0, 1, fake_sock));
   EXPECT_FALSE(file_special_rdev_valid(0, 0, (mode_t)(S_IFREG | 0600)));
 }
 
@@ -1216,6 +1224,272 @@ void test_trust_sender() {
   file_set_authorized_root(-1, NULL);
 }
 
+/* --sparse/-S hole preservation: a buffer with a long zero run written via
+ * file_store_write_secure(sparse=true) must round-trip its content exactly and
+ * have the right logical size, and should additionally be genuinely sparse on
+ * filesystems that support holes.  The sparseness assertion is tolerant: if the
+ * filesystem reports no holes (SEEK_HOLE/SEEK_DATA -> ENXIO) we skip the strict
+ * block-count check, but content and size always hold. */
+static void test_file_write_to_disk_sparse_preserves_holes() {
+  const char* path = "test_sparse_file.bin";
+  unlink(path);
+  /* 256 KiB with a 128 KiB zero run in the middle, bracketed by headers/tails. */
+  const unsigned long long size = 256u * 1024u;
+  unsigned char* buf = malloc(size);
+  EXPECT_NOT_NULL(buf);
+  /* cppcheck-suppress knownConditionTrueFalse -- EXPECT_NOT_NULL above asserts,
+     but cppcheck cannot see through the macro; the guard is defensive. */
+  if (!buf)
+    return;
+  memset(buf, 0, size);
+  for (unsigned long long i = 0; i < 4096; i++) {
+    buf[i] = (unsigned char)(i % 251);
+    buf[size - 1 - i] = (unsigned char)((i * 7) % 253);
+  }
+
+  EXPECT_TRUE(file_store_write_secure(path, buf, size, false, true, NULL, false));
+
+  /* Logical size must equal data_size exactly. */
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  EXPECT_EQ_INT((int)st.st_size, (int)size);
+
+  /* Content must round-trip exactly: the full readback must equal the original
+     buffer byte-for-byte (header, the hole region staying zero, and tail) —
+     a writer bug in the lseek-offset bookkeeping would show up here. */
+  int fd = open(path, O_RDONLY);
+  EXPECT_TRUE(fd >= 0);
+  /* cppcheck-suppress knownConditionTrueFalse -- EXPECT_TRUE above asserts,
+     but cppcheck cannot see through the macro; the guard is defensive. */
+  if (fd >= 0) {
+    unsigned char* readback = malloc(size);
+    if (readback) {
+      unsigned long long got = 0;
+      while (got < size) {
+        ssize_t n = read(fd, readback + got, (size_t)(size - got));
+        if (n <= 0)
+          break;
+        got += (unsigned long long)n;
+      }
+      EXPECT_EQ_INT((int)got, (int)size);
+      if (got == size)
+        EXPECT_EQ_INT(memcmp(readback, buf, size), 0);
+      free(readback);
+    }
+    /* Tolerant sparseness check: seek for holes; skip if unsupported. */
+    off_t hole_off = lseek(fd, (off_t)4096, SEEK_HOLE);
+    if (hole_off >= 0 && hole_off < (off_t)size) {
+      off_t next_data = lseek(fd, hole_off, SEEK_DATA);
+      fstat(fd, &st);
+      int blocks = (int)(st.st_blocks * 512);
+      if (next_data > hole_off)
+        EXPECT_TRUE(blocks < (int)size);
+    }
+    close(fd);
+  }
+  free(buf);
+  unlink(path);
+}
+
+/* --partial retention is hard to provoke end-to-end mid-transfer (the whole
+ * image is in one in-memory write), so this drives the failure path directly:
+ * a metadata whose mtime_nsec is out of the legal [0,999999999] range makes
+ * futimens (in file_restore_metadata_fd) fail with EINVAL AFTER the temp has
+ * been fully written.  With keep_partial=true the written temp must be renamed
+ * to the destination path (a resumable partial); with keep_partial=false the
+ * same failure must leave NOTHING behind.  The retention is always best-effort
+ * (never a corrupt blend), and this asserts the both-on/off behavior. */
+static void test_file_write_to_disk_partial_retention() {
+  const char* path = "test_partial_retention.bin";
+  unlink(path);
+  const char content[] = "partial-retention payload";
+  FileMetadata m;
+  memset(&m, 0, sizeof(m));
+  m.mode = 0644;
+  m.uid = (uid_t)geteuid();
+  m.gid = (gid_t)getegid();
+  m.mtime_sec = 1700000000;
+  m.mtime_nsec = 2000000000; /* invalid: forces futimens EINVAL after the write */
+  m.atime_valid = false;
+  m.crtime_valid = false;
+  bool ok = file_to_disk_secure_attrs(path, content, strlen(content), false, false, true, &m, false,
+                                      false, false, false, NULL, false, true, NULL);
+  EXPECT_FALSE(ok); /* the write itself succeeded, but metadata restore failed */
+  /* Retained: the already-written temp now sits at the destination path. */
+  int fd = open(path, O_RDONLY);
+  EXPECT_TRUE(fd >= 0);
+  /* cppcheck-suppress knownConditionTrueFalse -- EXPECT_TRUE above asserts,
+     but cppcheck cannot see through the macro; the guard is defensive. */
+  if (fd >= 0) {
+    char buf[64];
+    ssize_t n = read(fd, buf, sizeof(buf));
+    close(fd);
+    EXPECT_EQ_INT((int)strlen(content), (int)n);
+    if (n == (ssize_t)strlen(content))
+      EXPECT_TRUE(memcmp(buf, content, strlen(content)) == 0);
+  }
+  unlink(path);
+
+  /* Same failure with keep_partial=false: temp is unlinked, nothing retained. */
+  ok = file_to_disk_secure_attrs(path, content, strlen(content), false, false, true, &m, false,
+                                 false, false, false, NULL, false, false, NULL);
+  EXPECT_FALSE(ok);
+  EXPECT_TRUE(access(path, F_OK) == -1);
+}
+
+/* P7 Wave D: the deferred directory-time list deep-copies entries and applies
+ * them (fd-relative, no-follow) to an existing directory, then frees cleanly. */
+static void test_dir_time_list() {
+  const char* root = "test_dir_time_root";
+  const char* sub = "test_dir_time_root/sub";
+  file_set_authorized_root(-1, NULL);
+  rmdir(sub);
+  rmdir(root);
+  EXPECT_EQ_INT(mkdir(root, 0755), 0);
+  EXPECT_EQ_INT(mkdir(sub, 0755), 0);
+
+  DirTimeList list;
+  dir_time_list_init(&list);
+  EXPECT_EQ_INT((int)list.count, 0);
+  FileMetadata metadata = {.mtime_sec = 1000000000, .mtime_nsec = 0};
+  EXPECT_TRUE(dir_time_list_add(&list, "sub", &metadata));
+  EXPECT_TRUE(dir_time_list_add(&list, "sub", &metadata));
+  EXPECT_EQ_INT((int)list.count, 2);
+
+  dir_time_list_apply(&list, root);
+  struct stat st;
+  EXPECT_EQ_INT(stat(sub, &st), 0);
+  EXPECT_EQ_INT((int)st.st_mtime, 1000000000);
+
+  dir_time_list_free(&list);
+  EXPECT_EQ_INT((int)list.count, 0);
+  EXPECT_NULL(list.paths);
+  EXPECT_NULL(list.entries);
+
+  rmdir(sub);
+  rmdir(root);
+}
+
+/* -K/--keep-dirlinks secure open: with an authorized root, a destination path
+ * component that is a symlink to an IN-ROOT directory is used as that directory
+ * (its referent is opened through a relative O_NOFOLLOW walk from the root fd,
+ * not by re-opening an absolute realpath() result), while a symlink resolving
+ * OUTSIDE the root is rejected.  With -K off, even the in-root link is not
+ * followed. */
+static void test_keep_dirlinks_secure_open_impl() {
+  const char* root = "test_keep_dirlinks_root";
+  const char* real = "test_keep_dirlinks_root/realdir";
+  const char* link = "test_keep_dirlinks_root/linkdir";
+  const char* abslink = "test_keep_dirlinks_root/abslink";
+  const char* escape = "test_keep_dirlinks_root/escape";
+  const char* outside = "test_keep_dirlinks_outside";
+  unlink(link);
+  unlink(abslink);
+  unlink(escape);
+  rmdir(real);
+  rmdir(root);
+  rmdir(outside);
+  EXPECT_EQ_INT(mkdir(root, 0755), 0);
+  EXPECT_EQ_INT(mkdir(real, 0755), 0);
+  EXPECT_EQ_INT(mkdir(outside, 0755), 0);
+
+  char root_abs[PATH_MAX];
+  char real_abs[PATH_MAX];
+  char outside_abs[PATH_MAX];
+  EXPECT_NOT_NULL(realpath(root, root_abs));
+  EXPECT_NOT_NULL(realpath(real, real_abs));
+  EXPECT_NOT_NULL(realpath(outside, outside_abs));
+  EXPECT_EQ_INT(symlink("realdir", link), 0);   /* relative, in-root */
+  EXPECT_EQ_INT(symlink(real_abs, abslink), 0); /* absolute, in-root */
+  /* cppcheck-suppress knownConditionTrueFalse */
+  EXPECT_EQ_INT(symlink(outside_abs, escape), 0); /* absolute, outside root */
+
+  int root_fd = open(root_abs, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+  EXPECT_TRUE(root_fd >= 0);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (root_fd < 0) {
+    unlink(link);
+    unlink(abslink);
+    unlink(escape);
+    rmdir(real);
+    rmdir(root);
+    rmdir(outside);
+    return;
+  }
+  EXPECT_TRUE(file_set_authorized_root(root_fd, root_abs));
+  file_set_keep_dirlinks(true);
+
+  struct stat real_st;
+  EXPECT_EQ_INT(fstatat(root_fd, "realdir", &real_st, 0), 0);
+
+  /* Relative in-root symlink-to-directory: followed to the referent dir. */
+  char path[PATH_MAX + 64];
+  snprintf(path, sizeof(path), "%s/linkdir/file.txt", root_abs);
+  char* leaf = NULL;
+  int parent_fd = file_open_secure_parent(path, &leaf, false);
+  EXPECT_TRUE(parent_fd >= 0);
+  EXPECT_NOT_NULL(leaf);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (leaf)
+    EXPECT_EQ_STR(leaf, "file.txt");
+  // cppcheck-suppress knownConditionTrueFalse
+  if (parent_fd >= 0) {
+    struct stat st;
+    EXPECT_EQ_INT(fstat(parent_fd, &st), 0);
+    EXPECT_TRUE(st.st_dev == real_st.st_dev && st.st_ino == real_st.st_ino);
+    close(parent_fd);
+  }
+  free(leaf);
+
+  /* Absolute-but-in-root symlink-to-directory is followed the same way. */
+  snprintf(path, sizeof(path), "%s/abslink/file.txt", root_abs);
+  leaf = NULL;
+  parent_fd = file_open_secure_parent(path, &leaf, false);
+  EXPECT_TRUE(parent_fd >= 0);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (parent_fd >= 0) {
+    struct stat st;
+    EXPECT_EQ_INT(fstat(parent_fd, &st), 0);
+    EXPECT_TRUE(st.st_dev == real_st.st_dev && st.st_ino == real_st.st_ino);
+    close(parent_fd);
+  }
+  free(leaf);
+
+  /* A symlink resolving outside the authorized root is rejected. */
+  snprintf(path, sizeof(path), "%s/escape/file.txt", root_abs);
+  leaf = NULL;
+  EXPECT_EQ_INT(file_open_secure_parent(path, &leaf, false), -1);
+  free(leaf);
+
+  /* With -K off the in-root symlink is not followed either. */
+  file_set_keep_dirlinks(false);
+  snprintf(path, sizeof(path), "%s/linkdir/file.txt", root_abs);
+  leaf = NULL;
+  EXPECT_EQ_INT(file_open_secure_parent(path, &leaf, false), -1);
+  free(leaf);
+
+  file_set_keep_dirlinks(false);
+  file_set_authorized_root(-1, NULL);
+  close(root_fd);
+  unlink(link);
+  unlink(abslink);
+  unlink(escape);
+  rmdir(real);
+  rmdir(root);
+  rmdir(outside);
+}
+
+/* Wrapper guarantees the process-wide keep-dirlinks/authorized-root policy is
+ * cleared even when an EXPECT inside the body returns early (a failing EXPECT
+ * returns from its own function, so the body's trailing resets may be skipped). */
+static void test_keep_dirlinks_secure_open() {
+  file_set_authorized_root(-1, NULL);
+  file_set_keep_dirlinks(false);
+  test_keep_dirlinks_secure_open_impl();
+  file_set_authorized_root(-1, NULL);
+  file_set_keep_dirlinks(false);
+}
+
 void test_file() {
   test_file_create();
   test_file_special_rdev_valid();
@@ -1230,6 +1504,8 @@ void test_file() {
   test_file_save_to_disk_ignore_existing_entry_types();
   test_file_save_to_disk_partial_install();
   test_file_save_to_disk_reports_skips();
+  test_file_write_to_disk_sparse_preserves_holes();
+  test_file_write_to_disk_partial_retention();
   test_file_write_to_disk_basic();
   test_file_write_to_disk_with_fsync();
   test_file_write_to_disk_preallocate_atomic();
@@ -1254,6 +1530,8 @@ void test_file() {
     test_file_send_single_calls_metadata_and_path();
   }
   test_file_metadata_create();
+  test_dir_time_list();
+  test_keep_dirlinks_secure_open();
   test_inplace_overwrite_clears_special_mode_bits();
   test_inplace_overwrite_metadata_strips_special_bits();
   test_inplace_overwrite_truncates_shorter_payload();

tests/test_fuzz_smoke.c

@@ -1,16 +1,24 @@
 #include "test_fuzz_smoke.h"
 #include "chunk.h"
 #include "compression.h"
+#include "config.h"
 #include "data.h"
 #include "delta.h"
 #include "metadata.h"
+#include "protocol.h"
 #include "test_utils.h"
 #include "utils.h"
+#include <errno.h>
+#include <limits.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/socket.h>
 #include <unistd.h>
 
+/* P8 config-frame tail: super_mode (4) + copy-as presence (4) + uid (4) + gid (4). */
+#define P8_TAIL_BYTES 16
+
 /* Smoke test for chunk_deserialize fuzz target */
 static void test_fuzz_chunk_deserialize() {
   /* Create a minimal valid chunk to serialize and deserialize */
@@ -170,6 +178,272 @@ static void test_fuzz_glob_match() {
   EXPECT_FALSE(glob_match("*.md", "readme.txt"));
 }
 
+/* ---- Deterministic config-frame receive hardening (P8) ----
+ *
+ * The P8 tail (--super / --copy-as) and the identity-map count only parse after
+ * the entire preceding frame validates, which random bytes almost never reach.
+ * These tests capture one valid frame with the production sender and then
+ * mutate/truncate the exact tail bytes. */
+
+/* Serialize cfg with the production sender into a heap buffer.  The frame is
+ * written into a pipe (64 KiB kernel buffer, far larger than one config frame)
+ * whose read end is drained afterwards; the required STATUS_OK ack is
+ * pre-loaded into a second pipe, so a single thread suffices. */
+static bool capture_config_frame(const Config* cfg, unsigned char** out, size_t* out_len) {
+  *out = NULL;
+  *out_len = 0;
+
+  int frame_pipe[2];
+  int status_pipe[2];
+  if (pipe(frame_pipe) != 0)
+    return false;
+  if (pipe(status_pipe) != 0) {
+    close(frame_pipe[0]);
+    close(frame_pipe[1]);
+    return false;
+  }
+
+  int ack = STATUS_OK;
+  bool ok = write(status_pipe[1], &ack, sizeof(ack)) == (ssize_t)sizeof(ack);
+  if (ok) {
+    io_set_fds(status_pipe[0], frame_pipe[1]);
+    io_set_bwlimit(0);
+    ok = config_send(frame_pipe[1], cfg);
+  }
+  close(frame_pipe[1]);
+  close(status_pipe[0]);
+  close(status_pipe[1]);
+
+  unsigned char* buf = NULL;
+  if (ok) {
+    size_t cap = 4096;
+    size_t len = 0;
+    buf = malloc(cap);
+    if (!buf) {
+      ok = false;
+    }
+    while (ok) {
+      if (len == cap) {
+        size_t grown = cap * 2;
+        unsigned char* bigger = realloc(buf, grown);
+        if (!bigger) {
+          ok = false;
+          break;
+        }
+        buf = bigger;
+        cap = grown;
+      }
+      ssize_t n = read(frame_pipe[0], buf + len, cap - len);
+      if (n > 0) {
+        len += (size_t)n;
+        continue;
+      }
+      if (n < 0 && errno == EINTR)
+        continue;
+      break;
+    }
+    if (ok && len > 0) {
+      *out = buf;
+      *out_len = len;
+      buf = NULL;
+    }
+  }
+  close(frame_pipe[0]);
+  free(buf);
+  return *out != NULL;
+}
+
+/* Feed a raw config frame to config_receive over a socketpair.  The write half
+ * is shut down (not closed) after the data so the receiver sees EOF but its
+ * STATUS_ERROR replies do not hit a closed peer. */
+static bool receive_config_frame(const unsigned char* buf, size_t len) {
+  int sv[2];
+  if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) != 0)
+    return false;
+
+  size_t off = 0;
+  while (off < len) {
+    ssize_t n = write(sv[0], buf + off, len - off);
+    if (n > 0) {
+      off += (size_t)n;
+      continue;
+    }
+    if (n < 0 && errno == EINTR)
+      continue;
+    break;
+  }
+  shutdown(sv[0], SHUT_WR);
+  io_set_fds(sv[1], sv[1]);
+  io_set_bwlimit(0);
+  Config* cfg = config_receive(sv[1]);
+  bool accepted = cfg != NULL;
+  config_delete(cfg);
+  close(sv[0]);
+  close(sv[1]);
+  return accepted;
+}
+
+static void put_i32(unsigned char* buf, size_t off, int32_t value) {
+  memcpy(buf + off, &value, sizeof(value));
+}
+
+static size_t find_bytes(const unsigned char* haystack, size_t haystack_len,
+                         const unsigned char* needle, size_t needle_len) {
+  if (needle_len == 0 || haystack_len < needle_len)
+    return SIZE_MAX;
+  for (size_t i = 0; i + needle_len <= haystack_len; i++) {
+    if (memcmp(haystack + i, needle, needle_len) == 0)
+      return i;
+  }
+  return SIZE_MAX;
+}
+
+static Config* make_copy_as_config(void) {
+  Config* c = config_create();
+  if (!c)
+    return NULL;
+  c->send_directory = str_dup("/src");
+  c->receive_root_directory = str_dup("/dst");
+  c->copy_as_set = true;
+  c->copy_as_uid = 0;
+  c->copy_as_gid = 0;
+  c->use_metadata = true; /* --copy-as requires the metadata path */
+  return c;
+}
+
+/* The P8 tail must reject an out-of-range super_mode, a negative copy-as id and
+ * any truncation inside the tail, while the untouched frame is accepted. */
+static void test_fuzz_config_receive_p8_tail() {
+  Config* c = make_copy_as_config();
+  EXPECT_NOT_NULL(c);
+
+  unsigned char* frame = NULL;
+  size_t len = 0;
+  bool captured = capture_config_frame(c, &frame, &len);
+  config_delete(c);
+  if (!captured || len <= P8_TAIL_BYTES) {
+    free(frame);
+    EXPECT_TRUE(false);
+    return;
+  }
+
+  /* Baseline: the untouched frame is accepted. */
+  EXPECT_TRUE(receive_config_frame(frame, len));
+
+  unsigned char* mut = malloc(len);
+  EXPECT_NOT_NULL(mut);
+
+  /* super_mode outside the 0..2 tri-state is refused. */
+  memcpy(mut, frame, len);
+  put_i32(mut, len - P8_TAIL_BYTES, 99);
+  EXPECT_FALSE(receive_config_frame(mut, len));
+  put_i32(mut, len - P8_TAIL_BYTES, -1);
+  EXPECT_FALSE(receive_config_frame(mut, len));
+
+  /* A negative (sentinel) and an extreme copy-as uid/gid are refused. */
+  memcpy(mut, frame, len);
+  put_i32(mut, len - P8_TAIL_BYTES, SUPER_MODE_AUTO);
+  put_i32(mut, len - P8_TAIL_BYTES + 4, 1);
+  put_i32(mut, len - P8_TAIL_BYTES + 8, -1);
+  put_i32(mut, len - P8_TAIL_BYTES + 12, 0);
+  EXPECT_FALSE(receive_config_frame(mut, len));
+  put_i32(mut, len - P8_TAIL_BYTES + 8, 0);
+  put_i32(mut, len - P8_TAIL_BYTES + 12, INT32_MIN);
+  EXPECT_FALSE(receive_config_frame(mut, len));
+
+  /* A presence int that is not a wire bool is refused. */
+  memcpy(mut, frame, len);
+  put_i32(mut, len - P8_TAIL_BYTES, SUPER_MODE_AUTO);
+  put_i32(mut, len - P8_TAIL_BYTES + 4, 2);
+  EXPECT_FALSE(receive_config_frame(mut, len));
+
+  /* Truncating anywhere inside the P8 tail is refused. */
+  EXPECT_FALSE(receive_config_frame(frame, len - 2));
+  EXPECT_FALSE(receive_config_frame(frame, len - P8_TAIL_BYTES));
+
+  free(mut);
+  free(frame);
+}
+
+/* A huge or negative --usermap count must be refused up front, never driving a
+ * giant allocation.  The count is located by searching for a sentinel entry. */
+static void test_fuzz_config_receive_huge_map_count() {
+  Config* c = make_copy_as_config();
+  EXPECT_NOT_NULL(c);
+  int32_t sentinel_from = 0x11223344;
+  int32_t sentinel_to = 0x55667788;
+  c->usermap = malloc(sizeof(IdentityMap));
+  if (!c->usermap) {
+    config_delete(c);
+    EXPECT_TRUE(false);
+    return;
+  }
+  c->usermap_count = 1;
+  c->usermap[0].from = sentinel_from;
+  c->usermap[0].to = sentinel_to;
+
+  unsigned char* frame = NULL;
+  size_t len = 0;
+  bool captured = capture_config_frame(c, &frame, &len);
+  config_delete(c);
+  if (!captured) {
+    EXPECT_TRUE(false);
+    return;
+  }
+
+  unsigned char pattern[8];
+  memcpy(pattern, &sentinel_from, sizeof(sentinel_from));
+  memcpy(pattern + sizeof(sentinel_from), &sentinel_to, sizeof(sentinel_to));
+  size_t entry_off = find_bytes(frame, len, pattern, sizeof(pattern));
+  if (entry_off == SIZE_MAX || entry_off < sizeof(int32_t)) {
+    free(frame);
+    EXPECT_TRUE(false);
+    return;
+  }
+  size_t count_off = entry_off - sizeof(int32_t);
+
+  /* Baseline accepted. */
+  EXPECT_TRUE(receive_config_frame(frame, len));
+
+  unsigned char* mut = malloc(len);
+  EXPECT_NOT_NULL(mut);
+  memcpy(mut, frame, len);
+  put_i32(mut, count_off, INT_MAX);
+  EXPECT_FALSE(receive_config_frame(mut, len));
+  put_i32(mut, count_off, -1);
+  EXPECT_FALSE(receive_config_frame(mut, len));
+  put_i32(mut, count_off, MAX_IDENTITY_MAP + 1);
+  EXPECT_FALSE(receive_config_frame(mut, len));
+
+  free(mut);
+  free(frame);
+}
+
+/* A mismatched version and a matching version followed by a wrong-order field
+ * (an int that is not a wire bool) are both refused at/just after the gate. */
+static void test_fuzz_config_receive_version_gate() {
+  unsigned char buf[64];
+
+  size_t off = 0;
+  const char* bad_version = "1.2.3";
+  size_t bad_len = strlen(bad_version);
+  memcpy(buf + off, &bad_len, sizeof(bad_len));
+  off += sizeof(bad_len);
+  memcpy(buf + off, bad_version, bad_len);
+  off += bad_len;
+  EXPECT_FALSE(receive_config_frame(buf, off));
+
+  off = 0;
+  size_t good_len = strlen(PROTOCOL_VERSION);
+  memcpy(buf + off, &good_len, sizeof(good_len));
+  off += sizeof(good_len);
+  memcpy(buf + off, PROTOCOL_VERSION, good_len);
+  off += good_len;
+  put_i32(buf, off, -1);
+  off += sizeof(int32_t);
+  EXPECT_FALSE(receive_config_frame(buf, off));
+}
+
 void test_fuzz_smoke() {
   test_fuzz_chunk_deserialize();
   test_fuzz_compress_decompress();
@@ -177,4 +451,7 @@ void test_fuzz_smoke() {
   test_fuzz_metadata_from_buf();
   test_fuzz_delta_signature_deserialize();
   test_fuzz_glob_match();
+  test_fuzz_config_receive_p8_tail();
+  test_fuzz_config_receive_huge_map_count();
+  test_fuzz_config_receive_version_gate();
 }

tests/test_iconv.c

@@ -0,0 +1,217 @@
+#include "test_iconv.h"
+#include "charset.h"
+#include "protocol.h"
+#include "test_utils.h"
+#include "utils.h"
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+/* --- CONVERT_SPEC parsing ------------------------------------------------ */
+
+static void test_iconv_spec_parse_split() {
+  char* local = NULL;
+  char* remote = NULL;
+  EXPECT_EQ_INT(charset_spec_parse("utf-8,iso-8859-1", &local, &remote), 0);
+  EXPECT_EQ_STR(local, "utf-8");
+  EXPECT_EQ_STR(remote, "iso-8859-1");
+  free(local);
+  free(remote);
+}
+
+static void test_iconv_spec_parse_single_defaults_to_local() {
+  char* local = NULL;
+  char* remote = NULL;
+  EXPECT_EQ_INT(charset_spec_parse("utf-8", &local, &remote), 0);
+  EXPECT_EQ_STR(local, "utf-8");
+  EXPECT_EQ_STR(remote, "utf-8");
+  free(local);
+  free(remote);
+}
+
+static void test_iconv_spec_parse_garbage() {
+  char* local = NULL;
+  char* remote = NULL;
+  EXPECT_EQ_INT(charset_spec_parse(NULL, &local, &remote), -1);
+  EXPECT_EQ_INT(charset_spec_parse("", &local, &remote), -1);
+  EXPECT_EQ_INT(charset_spec_parse(",", &local, &remote), -1);
+  EXPECT_EQ_INT(charset_spec_parse("utf-8,", &local, &remote), -1);
+  EXPECT_EQ_INT(charset_spec_parse(",utf-8", &local, &remote), -1);
+}
+
+static void test_iconv_spec_valid() {
+  EXPECT_TRUE(charset_spec_valid(NULL));
+  EXPECT_TRUE(charset_spec_valid("utf-8"));
+  EXPECT_TRUE(charset_spec_valid("utf-8,iso-8859-1"));
+  EXPECT_TRUE(charset_spec_valid("iso-8859-1,ascii"));
+  EXPECT_FALSE(charset_spec_valid("no-such-charset,utf-8"));
+  EXPECT_FALSE(charset_spec_valid("utf-8,no-such-charset"));
+  EXPECT_FALSE(charset_spec_valid(",,,"));
+  EXPECT_FALSE(charset_spec_valid("utf-8,"));
+  /* A target charset whose conversion emits embedded NUL bytes would be
+     truncated by the C-string wire helpers; it must be rejected up front. */
+  EXPECT_FALSE(charset_spec_valid("utf-8,utf-16"));
+  EXPECT_FALSE(charset_spec_valid("utf-16"));
+  EXPECT_FALSE(charset_spec_valid("iso-8859-1,utf-16"));
+}
+
+/* --- one-shot conversion ------------------------------------------------ */
+
+static void test_iconv_utf8_to_latin1() {
+  void* conv = charset_conversion_open("utf-8", "iso-8859-1");
+  EXPECT_NOT_NULL(conv);
+  char* out = charset_convert(conv, "caf\xc3\xa9", NULL);
+  EXPECT_NOT_NULL(out);
+  EXPECT_EQ_INT(strcmp(out, "caf\xe9"), 0);
+  free(out);
+  charset_conversion_close(conv);
+}
+
+static void test_iconv_latin1_to_utf8() {
+  void* conv = charset_conversion_open("iso-8859-1", "utf-8");
+  EXPECT_NOT_NULL(conv);
+  char* out = charset_convert(conv, "caf\xe9", NULL);
+  EXPECT_NOT_NULL(out);
+  EXPECT_EQ_INT(strcmp(out, "caf\xc3\xa9"), 0);
+  free(out);
+  charset_conversion_close(conv);
+}
+
+static void test_iconv_invalid_sequence_fails() {
+  int err = 0;
+  /* 0xff is not a valid UTF-8 sequence. */
+  void* conv = charset_conversion_open("utf-8", "ascii");
+  EXPECT_NOT_NULL(conv);
+  EXPECT_TRUE(charset_convert(conv, "bad\xff", &err) == NULL);
+  EXPECT_TRUE(err == EILSEQ || err == EINVAL);
+  charset_conversion_close(conv);
+}
+
+static void test_iconv_unrepresentable_fails() {
+  /* "caf\xc3\xa9" (UTF-8 for cafe) has no ASCII representation. */
+  void* conv = charset_conversion_open("utf-8", "ascii");
+  EXPECT_NOT_NULL(conv);
+  EXPECT_TRUE(charset_convert(conv, "caf\xc3\xa9", NULL) == NULL);
+  charset_conversion_close(conv);
+}
+
+/* A latin1 high-bit byte expands to two UTF-8 bytes.  With exactly 16 high
+ * bytes the output is exactly cap = in_len + 16, so the final iconv call fills
+ * the buffer completely and a naive NUL-terminator write would overflow. */
+static void test_iconv_exact_fill_no_overflow() {
+  char name[64];
+  strcpy(name, "dir/");
+  int n = 4;
+  for (int i = 0; i < 16; i++)
+    name[n++] = (char)(0x80 + i);
+  name[n] = '\0';
+
+  void* conv = charset_conversion_open("iso-8859-1", "utf-8");
+  EXPECT_NOT_NULL(conv);
+  char* out = charset_convert(conv, name, NULL);
+  EXPECT_NOT_NULL(out);
+  EXPECT_EQ_INT((int)strlen(out), n + 16);
+  charset_conversion_close(conv);
+  free(out);
+}
+
+/* Many high-bit bytes force the output buffer past its initial cap, exercising
+ * the E2BIG growth path (input partially consumed/produced before the grow). */
+static void test_iconv_growth_expanding_name() {
+  char name[256];
+  strcpy(name, "dir/");
+  int n = 4;
+  for (int i = 0; i < 80; i++)
+    name[n++] = (char)(0x80 + (i % 0x80));
+  name[n] = '\0';
+
+  void* conv = charset_conversion_open("iso-8859-1", "utf-8");
+  EXPECT_NOT_NULL(conv);
+  char* out = charset_convert(conv, name, NULL);
+  EXPECT_NOT_NULL(out);
+  EXPECT_EQ_INT((int)strlen(out), n + 80);
+  charset_conversion_close(conv);
+  free(out);
+}
+
+/* --- process-wide wire conversion ---------------------------------------- */
+
+static void test_iconv_wire_sender_converts_local_to_remote() {
+  EXPECT_TRUE(charset_wire_init_sender("utf-8,iso-8859-1"));
+  char* wire = charset_wire_apply("caf\xc3\xa9");
+  EXPECT_NOT_NULL(wire);
+  EXPECT_EQ_INT(strcmp(wire, "caf\xe9"), 0);
+  free(wire);
+  charset_wire_free();
+}
+
+static void test_iconv_wire_receiver_converts_remote_to_local() {
+  EXPECT_TRUE(charset_wire_init_receiver("utf-8,iso-8859-1", NULL));
+  char* local = charset_wire_apply("caf\xe9");
+  EXPECT_NOT_NULL(local);
+  EXPECT_EQ_INT(strcmp(local, "caf\xc3\xa9"), 0);
+  free(local);
+  charset_wire_free();
+}
+
+static void test_iconv_wire_disabled_passthrough() {
+  charset_wire_init_sender(NULL);
+  EXPECT_FALSE(charset_wire_active());
+  char* out = charset_wire_apply("plain/name\xff");
+  EXPECT_NOT_NULL(out);
+  EXPECT_EQ_INT(strcmp(out, "plain/name\xff"), 0);
+  free(out);
+  charset_wire_free();
+}
+
+static void test_iconv_wire_str_roundtrip() {
+  EXPECT_TRUE(charset_wire_init_sender("utf-8,iso-8859-1"));
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  io_set_bwlimit(0);
+
+  pid_t pid = fork();
+  if (pid == 0) {
+    close(p[1]);
+    io_set_fds(p[0], p[0]);
+    charset_wire_free();
+    charset_wire_init_receiver("utf-8,iso-8859-1", NULL);
+    char* got = receive_wire_str(p[0]);
+    bool ok = got != NULL && strcmp(got, "caf\xc3\xa9") == 0;
+    free(got);
+    charset_wire_free();
+    close(p[0]);
+    _exit(ok ? 0 : 1);
+  } else {
+    close(p[0]);
+    io_set_fds(p[1], p[1]);
+    bool sent = send_wire_str(p[1], "caf\xc3\xa9");
+    int status;
+    waitpid(pid, &status, 0);
+    close(p[1]);
+    charset_wire_free();
+    EXPECT_TRUE(sent);
+    EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+  }
+}
+
+void test_iconv() {
+  test_iconv_spec_parse_split();
+  test_iconv_spec_parse_single_defaults_to_local();
+  test_iconv_spec_parse_garbage();
+  test_iconv_spec_valid();
+  test_iconv_utf8_to_latin1();
+  test_iconv_latin1_to_utf8();
+  test_iconv_invalid_sequence_fails();
+  test_iconv_unrepresentable_fails();
+  test_iconv_exact_fill_no_overflow();
+  test_iconv_growth_expanding_name();
+  test_iconv_wire_sender_converts_local_to_remote();
+  test_iconv_wire_receiver_converts_remote_to_local();
+  test_iconv_wire_disabled_passthrough();
+  test_iconv_wire_str_roundtrip();
+}

tests/test_iconv.h

@@ -0,0 +1,6 @@
+#ifndef TEST_ICONV_H
+#define TEST_ICONV_H
+
+void test_iconv(void);
+
+#endif

tests/test_log.c

@@ -128,6 +128,25 @@ static void test_log_message_formats() {
   EXPECT_TRUE(true);
 }
 
+/* log_debug_enabled is the lazy-formatting gate for log_debug_message: it must
+ * be true only at DEBUG level with the requested flag selected, exactly
+ * mirroring the filter inside log_debug_message itself. */
+static void test_log_debug_enabled_matches_gate() {
+  set_log_level(LOG_LEVEL_WARNING);
+  set_log_debug_flags(LOG_DEBUG_ALL);
+  EXPECT_FALSE(log_debug_enabled(LOG_DEBUG_PROTO));
+
+  set_log_level(LOG_LEVEL_DEBUG);
+  set_log_debug_flags(LOG_DEBUG_PROTO);
+  EXPECT_TRUE(log_debug_enabled(LOG_DEBUG_PROTO));
+  EXPECT_FALSE(log_debug_enabled(LOG_DEBUG_IO));
+
+  set_log_debug_flags(0);
+  EXPECT_FALSE(log_debug_enabled(LOG_DEBUG_PROTO));
+
+  set_log_debug_flags(LOG_DEBUG_ALL);
+}
+
 void test_log() {
   test_log_message_debug();
   test_log_message_info();
@@ -139,4 +158,5 @@ void test_log() {
   test_log_filtering();
   test_log_stderr_mode_all();
   test_log_message_formats();
+  test_log_debug_enabled_matches_gate();
 }

tests/test_metadata.c

@@ -302,6 +302,45 @@ static void test_chmod_changes() {
   EXPECT_FALSE(chmod_apply(0777, "a+r,", &result));
 }
 
+/* P7 Wave D: symlink metadata is applied with no-follow primitives, and -J
+ * (omit_link_times) suppresses the timestamp.  The positive apply path is
+ * asserted when the filesystem actually stores symlink timestamps; a filesystem
+ * that silently ignores them (or a platform where utimensat AT_SYMLINK_NOFOLLOW
+ * is unsupported) is tolerated, in which case only the omit-path invariant is
+ * checked. */
+static void test_file_restore_symlink_metadata() {
+  const char* dir = "temp_symlink_md_test";
+  const char* target = "temp_symlink_md_test/target";
+  const char* link = "temp_symlink_md_test/link";
+  EXPECT_EQ_INT(mkdir(dir, 0755), 0);
+  FILE* f = fopen(target, "w");
+  EXPECT_NOT_NULL(f);
+  fputs("t", f);
+  fclose(f);
+  EXPECT_EQ_INT(symlink("target", link), 0);
+
+  /* Positive path: a non-omitted apply stamps the link's own mtime. */
+  FileMetadata applied = {.mtime_sec = 1000000000, .mtime_nsec = 0};
+  file_restore_symlink_metadata(link, &applied, false);
+  struct stat st;
+  EXPECT_EQ_INT(lstat(link, &st), 0);
+  EXPECT_TRUE(S_ISLNK(st.st_mode));
+  bool symlink_times_supported = ((int)st.st_mtime == 1000000000);
+  time_t t1 = st.st_mtime;
+
+  /* -J: a different time must be left untouched. */
+  FileMetadata newer = {.mtime_sec = 1234567890, .mtime_nsec = 0};
+  file_restore_symlink_metadata(link, &newer, true);
+  EXPECT_EQ_INT(lstat(link, &st), 0);
+  EXPECT_EQ_INT((int)st.st_mtime, (int)t1);
+  if (symlink_times_supported)
+    EXPECT_EQ_INT((int)st.st_mtime, 1000000000);
+
+  unlink(link);
+  unlink(target);
+  rmdir(dir);
+}
+
 void test_metadata() {
   test_metadata_to_from_buf_roundtrip();
   test_metadata_to_buf_null();
@@ -315,5 +354,6 @@ void test_metadata() {
   test_file_restore_metadata_applies_atime();
   test_file_restore_executability_only();
   test_directory_restore_executability_only();
+  test_file_restore_symlink_metadata();
   test_chmod_changes();
 }

tests/test_scanner.c

@@ -1,5 +1,6 @@
 #include "test_utils.h"
 #include "scanner.h"
+#include "array_list.h"
 #include "file.h"
 #include "file_list.h"
 #include "filter.h"
@@ -1262,6 +1263,60 @@ static void test_files_from_relative_send_path() {
   rmdir(root);
 }
 
+/* P7 Wave D: the recursive scan captures every traversed source directory as an
+ * is_dir File (metadata, no payload) in the shared dir_entries list, including
+ * the transfer root and an EMPTY directory.  The empty dir is captured even
+ * though the receiver deliberately never creates it, so its time can still be
+ * applied when the destination already holds that directory. */
+static void test_scanner_captures_directory_times() {
+  const char* root = "test_scan_dirtime";
+  const char* sub = "test_scan_dirtime/sub";
+  const char* empty = "test_scan_dirtime/empty";
+  const char* file1 = "test_scan_dirtime/sub/a.txt";
+  EXPECT_EQ_INT(mkdir(root, 0755), 0);
+  EXPECT_EQ_INT(mkdir(sub, 0755), 0);
+  EXPECT_EQ_INT(mkdir(empty, 0755), 0);
+  create_test_file(file1, "x");
+
+  ArrayList* dirs = array_list_create(file_destroy);
+  EXPECT_NOT_NULL(dirs);
+  ScannerOptions options = {0};
+  options.use_metadata = true;
+  options.capture_dir_times = true;
+  options.dir_entries = dirs;
+  DirectoryScanner* scanner = directory_scanner_create_with_options(root, &options);
+  EXPECT_NOT_NULL(scanner);
+  Chunk* chunk;
+  while ((chunk = directory_scanner_next(scanner)) != NULL)
+    chunk_destroy(chunk);
+  EXPECT_FALSE(directory_scanner_failed(scanner));
+
+  int found_root = 0;
+  int found_sub = 0;
+  int found_empty = 0;
+  for (int i = 0; i < dirs->size; i++) {
+    const File* file = (const File*)dirs->items[i];
+    EXPECT_TRUE(file->is_dir);
+    EXPECT_NOT_NULL(file->metadata);
+    if (strcmp(file->path, root) == 0)
+      found_root = 1;
+    if (strcmp(file->path, sub) == 0)
+      found_sub = 1;
+    if (strcmp(file->path, empty) == 0)
+      found_empty = 1;
+  }
+  EXPECT_TRUE(found_root);
+  EXPECT_TRUE(found_sub);
+  EXPECT_TRUE(found_empty);
+
+  directory_scanner_destroy(scanner);
+  array_list_delete(dirs);
+  unlink(file1);
+  rmdir(empty);
+  rmdir(sub);
+  rmdir(root);
+}
+
 void test_scanner() {
   test_scanner_single_file();
   test_scanner_multiple_files();
@@ -1297,4 +1352,5 @@ void test_scanner() {
   test_dirs_no_descent();
   test_dirs_files_from();
   test_files_from_relative_send_path();
+  test_scanner_captures_directory_times();
 }

tests/test_server.c

@@ -2,6 +2,7 @@
 #include "config.h"
 #include "delta.h"
 #include "file.h"
+#include "log.h"
 #include "protocol.h"
 #include "test_utils.h"
 #include "utils.h"
@@ -724,7 +725,44 @@ static void test_receiver_pending_commits_missing_args() {
   free(root);
 }
 
+/* A6: an attacker-controlled file path appearing in a log line must be escaped
+   so a control byte cannot forge a second log record.  The socket special-node
+   branch logs file->path before touching the filesystem, making it a cheap way
+   to exercise an escaped site.  The captured line must contain the escaped path
+   (`\#012` for the newline), never the raw control byte. */
+static void test_special_socket_path_log_escaped() {
+  set_log_level(LOG_LEVEL_WARNING);
+  log_set_8_bit_output(false);
+
+  FILE* capture = tmpfile();
+  EXPECT_NOT_NULL(capture);
+  log_set_file(capture);
+
+  File* file = file_create("evil\npath");
+  EXPECT_NOT_NULL(file);
+  file->is_special = true;
+  file->metadata = calloc(1, sizeof(FileMetadata));
+  EXPECT_NOT_NULL(file->metadata);
+  file->metadata->mode = S_IFSOCK | 0644;
+
+  FileSaveResult result = file_save_to_disk_full("/tmp/dst", file, NULL);
+  EXPECT_EQ_INT(result, FILE_SAVE_SKIPPED);
+
+  fflush(capture);
+  rewind(capture);
+  char output[512] = {0};
+  size_t length = fread(output, 1, sizeof(output) - 1, capture);
+  output[length] = '\0';
+
+  log_set_file(NULL);
+  fclose(capture);
+  file_destroy(file);
+
+  EXPECT_NOT_NULL(strstr(output, "socket not recreated: evil\\#012path"));
+}
+
 void test_server() {
+  test_special_socket_path_log_escaped();
   if (!is_running_under_valgrind()) {
     test_receive_files_finished();
     test_receive_files_single_file();

tests/test_server_cli.c

@@ -31,9 +31,28 @@ static void test_server_cli_defaults() {
   EXPECT_EQ_INT(opts.bind_family, AF_UNSPEC);
   EXPECT_FALSE(opts.allow_delete);
   EXPECT_FALSE(opts.allow_unauthenticated);
+  EXPECT_FALSE(opts.no_super);
   server_cli_options_free(&opts);
 }
 
+/* --no-super is a standalone/SSH operator veto (does not require --daemon):
+   it forces SUPER_MODE_OFF for every connection and refuses client --copy-as. */
+static void test_server_cli_no_super() {
+  const char* args[] = {"fastsync-server", "--no-super", "--destination-root", "/srv"};
+  ServerCliOptions opts;
+  EXPECT_EQ_INT(parse_ok(args, 4, &opts), 0);
+  EXPECT_TRUE(opts.no_super);
+  EXPECT_EQ_STR(opts.destination_root, "/srv");
+  server_cli_options_free(&opts);
+
+  const char* args2[] = {"fastsync-server", "--daemon", "--config=/tmp/x.conf", "--no-super"};
+  ServerCliOptions opts2;
+  EXPECT_EQ_INT(parse_ok(args2, 4, &opts2), 0);
+  EXPECT_TRUE(opts2.no_super);
+  EXPECT_TRUE(opts2.daemon_mode);
+  server_cli_options_free(&opts2);
+}
+
 static void test_server_cli_daemon_flags() {
   const char* args[] = {"fastsync-server", "--daemon", "--no-detach", "--allow-unauthenticated"};
   ServerCliOptions opts;
@@ -145,19 +164,26 @@ static void test_server_cli_invalid() {
 }
 
 static void test_server_cli_password_and_early_input() {
-  const char* args[] = {"s", "--daemon", "--password-file=/etc/fast.pw", "--early-input",
-                        "/run/secrets"};
+  const char* args[] = {"s",
+                        "--daemon",
+                        "--password-file=/etc/fast.pw",
+                        "--early-input",
+                        "/run/secrets",
+                        "--iconv=utf-8"};
   ServerCliOptions opts;
-  EXPECT_EQ_INT(parse_ok(args, 5, &opts), 0);
+  EXPECT_EQ_INT(parse_ok(args, 6, &opts), 0);
   EXPECT_EQ_STR(opts.password_file, "/etc/fast.pw");
   EXPECT_EQ_STR(opts.early_input_file, "/run/secrets");
+  EXPECT_EQ_STR(opts.iconv_spec, "utf-8");
 
-  const char* args2[] = {"s", "--daemon", "--password-file", "/etc/fast.pw",
-                         "--early-input=/secrets"};
+  const char* args2[] = {
+      "s",       "--daemon",        "--password-file", "/etc/fast.pw", "--early-input=/secrets",
+      "--iconv", "utf-8,iso-8859-1"};
   ServerCliOptions opts2;
-  EXPECT_EQ_INT(parse_ok(args2, 5, &opts2), 0);
+  EXPECT_EQ_INT(parse_ok(args2, 7, &opts2), 0);
   EXPECT_EQ_STR(opts2.password_file, "/etc/fast.pw");
   EXPECT_EQ_STR(opts2.early_input_file, "/secrets");
+  EXPECT_EQ_STR(opts2.iconv_spec, "utf-8,iso-8859-1");
   server_cli_options_free(&opts);
   server_cli_options_free(&opts2);
 }
@@ -197,5 +223,6 @@ void test_server_cli() {
   test_server_cli_invalid();
   test_server_cli_password_and_early_input();
   test_server_cli_password_requires_daemon();
+  test_server_cli_no_super();
   test_server_cli_help();
 }

tests/test_shared_utils.c

@@ -2,12 +2,15 @@
 #include "utils.h"
 #include "protocol.h"
 #include "test_utils.h"
+#include <arpa/inet.h>
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <netinet/in.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/socket.h>
 #include <sys/stat.h>
 #include <threads.h>
 #include <unistd.h>
@@ -269,12 +272,97 @@ static int escape_thread(void* arg) {
   return 0;
 }
 
+/* A7-3/S1 transport classification: the daemon auth gate and the client
+   credential rule both key off these helpers, so cover the exact accepted
+   forms plus the negative cases. */
+static void test_loopback_helpers() {
+  /* Host strings. */
+  EXPECT_TRUE(utils_host_is_loopback("localhost"));
+  EXPECT_TRUE(utils_host_is_loopback("127.0.0.1"));
+  EXPECT_TRUE(utils_host_is_loopback("127.255.255.254"));
+  EXPECT_TRUE(utils_host_is_loopback("127.0.0.0"));
+  EXPECT_TRUE(utils_host_is_loopback("::1"));
+  EXPECT_TRUE(utils_host_is_loopback("[::1]"));
+  EXPECT_FALSE(utils_host_is_loopback("128.0.0.1"));
+  EXPECT_FALSE(utils_host_is_loopback("10.0.0.1"));
+  EXPECT_FALSE(utils_host_is_loopback("0.0.0.0"));
+  EXPECT_FALSE(utils_host_is_loopback("example.com"));
+  EXPECT_FALSE(utils_host_is_loopback(""));
+  EXPECT_FALSE(utils_host_is_loopback(NULL));
+
+  /* Raw sockaddr classification. */
+  struct sockaddr_in v4;
+  memset(&v4, 0, sizeof(v4));
+  v4.sin_family = AF_INET;
+  EXPECT_TRUE(inet_pton(AF_INET, "127.0.0.1", &v4.sin_addr) == 1);
+  EXPECT_TRUE(utils_sockaddr_is_loopback((const struct sockaddr*)&v4));
+  EXPECT_TRUE(inet_pton(AF_INET, "127.5.5.5", &v4.sin_addr) == 1);
+  EXPECT_TRUE(utils_sockaddr_is_loopback((const struct sockaddr*)&v4));
+  EXPECT_TRUE(inet_pton(AF_INET, "128.0.0.1", &v4.sin_addr) == 1);
+  EXPECT_FALSE(utils_sockaddr_is_loopback((const struct sockaddr*)&v4));
+
+  struct sockaddr_in6 v6;
+  memset(&v6, 0, sizeof(v6));
+  v6.sin6_family = AF_INET6;
+  EXPECT_TRUE(inet_pton(AF_INET6, "::1", &v6.sin6_addr) == 1);
+  EXPECT_TRUE(utils_sockaddr_is_loopback((const struct sockaddr*)&v6));
+  EXPECT_TRUE(inet_pton(AF_INET6, "::ffff:127.0.0.1", &v6.sin6_addr) == 1);
+  EXPECT_TRUE(utils_sockaddr_is_loopback((const struct sockaddr*)&v6));
+  EXPECT_TRUE(inet_pton(AF_INET6, "::ffff:127.255.255.254", &v6.sin6_addr) == 1);
+  EXPECT_TRUE(utils_sockaddr_is_loopback((const struct sockaddr*)&v6));
+  EXPECT_TRUE(inet_pton(AF_INET6, "::ffff:10.0.0.1", &v6.sin6_addr) == 1);
+  EXPECT_FALSE(utils_sockaddr_is_loopback((const struct sockaddr*)&v6));
+
+  EXPECT_FALSE(utils_sockaddr_is_loopback(NULL));
+
+  /* A pipe has no socket peer: getpeername fails with ENOTSOCK.  The helper is
+     fail-closed, so an unprovable channel is NOT local (daemon auth modules are
+     daemon-only and never run over the --stdio pipe). */
+  int pipe_fds[2];
+  EXPECT_EQ_INT(pipe(pipe_fds), 0);
+  EXPECT_FALSE(utils_fd_peer_is_local(pipe_fds[0]));
+  close(pipe_fds[0]);
+  close(pipe_fds[1]);
+  EXPECT_FALSE(utils_fd_peer_is_local(-1));
+
+  /* A connected AF_UNIX socketpair is a socket, but its peer is not a loopback
+     IP address, so it is not local either. */
+  int pair_fds[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, pair_fds), 0);
+  EXPECT_FALSE(utils_fd_peer_is_local(pair_fds[0]));
+  close(pair_fds[0]);
+  close(pair_fds[1]);
+
+  /* A real loopback TCP peer is local. */
+  int listener = socket(AF_INET, SOCK_STREAM, 0);
+  EXPECT_TRUE(listener >= 0);
+  struct sockaddr_in bind_addr;
+  memset(&bind_addr, 0, sizeof(bind_addr));
+  bind_addr.sin_family = AF_INET;
+  bind_addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  bind_addr.sin_port = 0;
+  EXPECT_EQ_INT(bind(listener, (const struct sockaddr*)&bind_addr, sizeof(bind_addr)), 0);
+  EXPECT_EQ_INT(listen(listener, 1), 0);
+  socklen_t addr_len = sizeof(bind_addr);
+  EXPECT_EQ_INT(getsockname(listener, (struct sockaddr*)&bind_addr, &addr_len), 0);
+  int dialer = socket(AF_INET, SOCK_STREAM, 0);
+  EXPECT_TRUE(dialer >= 0);
+  EXPECT_EQ_INT(connect(dialer, (const struct sockaddr*)&bind_addr, sizeof(bind_addr)), 0);
+  int accepted = accept(listener, NULL, NULL);
+  EXPECT_TRUE(accepted >= 0);
+  EXPECT_TRUE(utils_fd_peer_is_local(accepted));
+  close(accepted);
+  close(dialer);
+  close(listener);
+}
+
 void test_shared_utils() {
   test_walker_removes_extras_keeps_manifest_and_protected();
   test_walker_max_delete_exceeded_deletes_nothing();
   test_walker_max_delete_exact_bound_deletes();
   test_walker_unlimited_deletes_all();
   test_walker_hard_bound_all_or_nothing();
+  test_loopback_helpers();
 
   /* --append / --append-verify tail-resume math: a resume is eligible only for
      a shorter existing destination, and the tail length is then the difference. */

tests/test_stop.c

@@ -0,0 +1,150 @@
+#include "test_stop.h"
+#include "stop_condition.h"
+#include "test_utils.h"
+#include <limits.h>
+#include <time.h>
+
+static void test_stop_after_parse_valid() {
+  int minutes = 0;
+  EXPECT_TRUE(stop_parse_after_minutes("5", &minutes));
+  EXPECT_EQ_INT(minutes, 5);
+  EXPECT_TRUE(stop_parse_after_minutes("1", &minutes));
+  EXPECT_EQ_INT(minutes, 1);
+  EXPECT_TRUE(stop_parse_after_minutes("1440", &minutes));
+  EXPECT_EQ_INT(minutes, 1440);
+  EXPECT_TRUE(stop_parse_after_minutes("2147483647", &minutes));
+  EXPECT_EQ_INT(minutes, INT_MAX);
+}
+
+static void test_stop_after_parse_invalid() {
+  int minutes = 0;
+  EXPECT_FALSE(stop_parse_after_minutes("0", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes("-1", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes("abc", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes("", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes("5x", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes("1.5", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes(" 5", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes(" 5 ", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes("+5", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes("2147483648", &minutes));
+  EXPECT_FALSE(stop_parse_after_minutes(NULL, &minutes));
+}
+
+static void test_stop_at_parse_hhmm() {
+  time_t now = 1700000000;
+  time_t deadline = 0;
+
+  EXPECT_TRUE(stop_parse_at_time("12:30", now, &deadline));
+  struct tm t;
+  EXPECT_NOT_NULL(localtime_r(&deadline, &t));
+  EXPECT_EQ_INT(t.tm_hour, 12);
+  EXPECT_EQ_INT(t.tm_min, 30);
+  EXPECT_EQ_INT(t.tm_sec, 0);
+
+  EXPECT_TRUE(stop_parse_at_time("12:30:59", now, &deadline));
+  EXPECT_NOT_NULL(localtime_r(&deadline, &t));
+  EXPECT_EQ_INT(t.tm_hour, 12);
+  EXPECT_EQ_INT(t.tm_min, 30);
+  EXPECT_EQ_INT(t.tm_sec, 59);
+
+  EXPECT_TRUE(stop_parse_at_time("00:00", now, &deadline));
+  EXPECT_NOT_NULL(localtime_r(&deadline, &t));
+  EXPECT_EQ_INT(t.tm_hour, 0);
+  EXPECT_EQ_INT(t.tm_min, 0);
+  EXPECT_EQ_INT(t.tm_sec, 0);
+}
+
+static void test_stop_at_parse_now_plus() {
+  time_t now = 1700000000;
+  time_t deadline = 0;
+
+  EXPECT_TRUE(stop_parse_at_time("now+90s", now, &deadline));
+  EXPECT_EQ_INT(deadline, now + 90);
+  EXPECT_TRUE(stop_parse_at_time("now+5m", now, &deadline));
+  EXPECT_EQ_INT(deadline, now + 300);
+  EXPECT_TRUE(stop_parse_at_time("now+2h", now, &deadline));
+  EXPECT_EQ_INT(deadline, now + 7200);
+  EXPECT_TRUE(stop_parse_at_time("now+1d", now, &deadline));
+  EXPECT_EQ_INT(deadline, now + 86400);
+  EXPECT_TRUE(stop_parse_at_time("now+0s", now, &deadline));
+  EXPECT_EQ_INT(deadline, now);
+}
+
+static void test_stop_at_parse_invalid() {
+  time_t now = 1700000000;
+  time_t deadline = 0;
+  EXPECT_FALSE(stop_parse_at_time("12", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("12:3", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("1234", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("12:30:5", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("12:30:5x", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("24:00", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("12:60", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("12:30:61", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("12;00", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("now", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("now+", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("now+5", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("now+5x", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("now-5m", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("now+1w", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("now+ 5s", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("now++5s", now, &deadline));
+  /* Signed overflow of the destination deadline must be rejected, not wrap. */
+  EXPECT_FALSE(stop_parse_at_time("now+9223372036854775807s", now, &deadline));
+  /* 10^15 days is well beyond LONG_MAX/86400, so the amount itself is rejected. */
+  EXPECT_FALSE(stop_parse_at_time("now+1000000000000000d", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("abc", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time("", now, &deadline));
+  EXPECT_FALSE(stop_parse_at_time(NULL, now, &deadline));
+}
+
+static void test_stop_deadline_latency() {
+  struct timespec now;
+  EXPECT_EQ_INT(clock_gettime(CLOCK_MONOTONIC, &now), 0);
+
+  StopCondition future = stop_condition_make(true, 60, false, 0, now);
+  EXPECT_TRUE(future.has_monotonic);
+  EXPECT_EQ_INT(future.monotonic_deadline.tv_sec, now.tv_sec + 3600);
+  EXPECT_EQ_INT(future.monotonic_deadline.tv_nsec, now.tv_nsec);
+  EXPECT_FALSE(future.has_wall);
+  EXPECT_FALSE(stop_condition_reached(&future));
+
+  /* Move the 60-minute deadline into the past: the check now reports reached. */
+  StopCondition past = stop_condition_make(true, 60, false, 0, now);
+  past.monotonic_deadline.tv_sec -= 7200;
+  EXPECT_TRUE(stop_condition_reached(&past));
+
+  StopCondition no_after = stop_condition_make(false, 0, false, 0, now);
+  EXPECT_FALSE(no_after.has_monotonic);
+  EXPECT_FALSE(no_after.has_wall);
+  EXPECT_FALSE(stop_condition_reached(&no_after));
+
+  /* An invalid (non-positive) after_minutes never arms the monotonic half. */
+  StopCondition zero_after = stop_condition_make(true, 0, false, 0, now);
+  EXPECT_FALSE(zero_after.has_monotonic);
+  StopCondition neg_after = stop_condition_make(true, -5, false, 0, now);
+  EXPECT_FALSE(neg_after.has_monotonic);
+
+  /* --stop-at: a wall-clock deadline in the past/now is reached; one in the
+     future is not, and it stays independent of the monotonic half. */
+  StopCondition wall_future = stop_condition_make(false, 0, true, time(NULL) + 3600, now);
+  EXPECT_TRUE(wall_future.has_wall);
+  EXPECT_FALSE(wall_future.has_monotonic);
+  EXPECT_FALSE(stop_condition_reached(&wall_future));
+
+  StopCondition wall_past = stop_condition_make(false, 0, true, time(NULL) - 1, now);
+  EXPECT_TRUE(stop_condition_reached(&wall_past));
+
+  EXPECT_FALSE(stop_condition_reached(NULL));
+}
+
+void test_stop(void) {
+  test_stop_after_parse_valid();
+  test_stop_after_parse_invalid();
+  test_stop_at_parse_hhmm();
+  test_stop_at_parse_now_plus();
+  test_stop_at_parse_invalid();
+  test_stop_deadline_latency();
+}

tests/test_stop.h

@@ -0,0 +1,6 @@
+#ifndef TEST_STOP_H
+#define TEST_STOP_H
+
+void test_stop(void);
+
+#endif

tests/test_transport_ssh.c

@@ -55,8 +55,14 @@ static void test_ssh_remote_command_argument_modes() {
   EXPECT_EQ_STR(command, "'fast'\\''sync' --stdio");
   free(command);
 
+  /* --old-args no longer disables injection-safe quoting: the path is still one
+     single-quoted word, even when it carries shell metacharacters. */
   command = ssh_build_remote_command("fast sync; touch /tmp/pwned", true, NULL, 0);
-  EXPECT_EQ_STR(command, "fast sync; touch /tmp/pwned --stdio");
+  EXPECT_EQ_STR(command, "'fast sync; touch /tmp/pwned' --stdio");
+  free(command);
+
+  command = ssh_build_remote_command("fast'sync; rm -rf /", true, NULL, 0);
+  EXPECT_EQ_STR(command, "'fast'\\''sync; rm -rf /' --stdio");
   free(command);
 }
 
@@ -131,9 +137,9 @@ static void test_ssh_remote_command_with_remote_options() {
   free(command);
   free(val);
 
-  /* --old-args leaves the server path unquoted but still quotes remote options. */
+  /* --old-args still quotes both the server path and the remote options. */
   command = ssh_build_remote_command("srv", true, multi, 2);
-  EXPECT_EQ_STR(command, "srv --stdio '-v' '--allow-delete'");
+  EXPECT_EQ_STR(command, "'srv' --stdio '-v' '--allow-delete'");
   free(command);
 }
 

tests/test_transport_tls.c

@@ -3,6 +3,7 @@
 #include "test_utils.h"
 #include "transport_tcp.h"
 #include "transport_tls.h"
+#include <openssl/ssl.h>
 #include <string.h>
 #include <unistd.h>
 
@@ -17,6 +18,12 @@ static void test_server_create_tls_without_certs() {
   bool ok = server_create_tls(s, NULL, NULL, NULL);
   EXPECT_TRUE(ok);
   EXPECT_NOT_NULL(s->ssl_ctx);
+  /* The context must disable TLS compression (CRIME) and renegotiation. */
+  SSL_CTX* ctx = (SSL_CTX*)s->ssl_ctx;
+  EXPECT_TRUE((SSL_CTX_get_options(ctx) & SSL_OP_NO_COMPRESSION) != 0);
+#ifdef SSL_OP_NO_RENEGOTIATION
+  EXPECT_TRUE((SSL_CTX_get_options(ctx) & SSL_OP_NO_RENEGOTIATION) != 0);
+#endif
   server_delete(&s);
   EXPECT_NULL(s);
 }

tests/test_xattr.c

@@ -1,6 +1,8 @@
 #include "test_xattr.h"
 #include "xattr.h"
+#include "config.h"
 #include "file.h"
+#include "identity.h"
 #include "protocol.h"
 #include "test_utils.h"
 #include <fcntl.h>
@@ -222,6 +224,136 @@ static void test_link_copy_fallback_preserves_xattrs() {
   rmdir(basis_dir);
 }
 
+/* --fake-super replay: fake_super_store_fd records the source stat into the
+ * reserved xattr, and fake_super_restore_fd re-applies mode/mtime (and owner,
+ * when the process may) fd-relative.  Restore must also be a safe no-op with no
+ * xattr present.  Guarded on filesystem xattr support. */
+static void test_fake_super_restore() {
+  const char* path = "test_fake_super_restore.txt";
+  unlink(path);
+  int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  if (fd < 0)
+    return;
+  bool has_xattr = setxattr(path, "user.fastsync.xprobe", "p", 1, 0) == 0;
+  if (has_xattr)
+    removexattr(path, "user.fastsync.xprobe");
+  if (!has_xattr) {
+    close(fd);
+    unlink(path);
+    return; /* skip silently when the filesystem has no xattr support */
+  }
+
+  /* No xattr present yet: restore is a silent no-op (returns false, no crash). */
+  EXPECT_FALSE(fake_super_restore_fd(fd));
+
+  fake_super_store_fd(fd, 1001, 1002, 0751, 1700000000, 123456789);
+  EXPECT_TRUE(fake_super_restore_fd(fd));
+  struct stat st;
+  EXPECT_EQ_INT(fstat(fd, &st), 0);
+  EXPECT_EQ_INT((int)(st.st_mode & 07777), 0751);
+
+  /* Mode sanitization: the normal metadata path never grants group/other write
+     bits, and fake-super replay must not re-add them (a recorded 0666 restores
+     as 0644, never as world-writable). */
+  fake_super_store_fd(fd, 1001, 1002, 0666, 1700000000, 0);
+  EXPECT_TRUE(fake_super_restore_fd(fd));
+  EXPECT_EQ_INT(fstat(fd, &st), 0);
+  EXPECT_EQ_INT((int)(st.st_mode & 0777), 0644);
+
+  /* Restore with a malformed record must skip without failing. */
+  time_t before = st.st_mtime;
+  int wfd = open(path, O_RDONLY);
+  if (wfd >= 0) {
+    EXPECT_EQ_INT((int)fsetxattr(wfd, FAKESUPER_XATTR, "not-a-valid-record", 19, 0), 0);
+    close(wfd);
+  }
+  EXPECT_FALSE(fake_super_restore_fd(fd));
+  fstat(fd, &st);
+  EXPECT_EQ_INT((int)st.st_mtime, (int)before);
+
+  close(fd);
+  unlink(path);
+}
+
+/* --fake-super owner replay must honor the super gate and copy-as authority:
+   --no-super suppresses the recorded-source-owner chown even for root, and an
+   active --copy-as keeps its forced owner (the recorded source owner must never
+   override it).  Root-gated: only root can observe a chown actually landing. */
+static void test_fake_super_owner_gate() {
+  if (geteuid() != 0)
+    return; /* non-root cannot observe ownership changes; skip silently */
+  const char* path = "test_fake_super_owner_gate.txt";
+  unlink(path);
+  int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  if (fd < 0)
+    return;
+  bool has_xattr = setxattr(path, "user.fastsync.xprobe", "p", 1, 0) == 0;
+  if (has_xattr)
+    removexattr(path, "user.fastsync.xprobe");
+  if (!has_xattr) {
+    close(fd);
+    unlink(path);
+    return; /* filesystem without xattr support */
+  }
+  if (fchown(fd, 0, 0) != 0) {
+    close(fd);
+    unlink(path);
+    return;
+  }
+  fake_super_store_fd(fd, 12345, 12346, 0755, 1700000000, 0);
+
+  Config* c = config_create();
+  EXPECT_NOT_NULL(c);
+
+  /* An explicit ownership policy is required before fake-super replay may
+     chown; --fake-super alone only records the source owner (A2). */
+  c->numeric_ids = true;
+
+  /* --no-super: the owner leg is skipped even as root. */
+  c->super_mode = SUPER_MODE_OFF;
+  EXPECT_TRUE(identity_set_active(c));
+  EXPECT_TRUE(fake_super_restore_fd(fd));
+  struct stat st;
+  EXPECT_EQ_INT(fstat(fd, &st), 0);
+  EXPECT_EQ_INT((int)st.st_uid, 0);
+  EXPECT_EQ_INT((int)st.st_gid, 0);
+
+  /* AUTO with an identity policy: the recorded source owner is applied. */
+  c->super_mode = SUPER_MODE_AUTO;
+  EXPECT_TRUE(identity_set_active(c));
+  EXPECT_TRUE(fake_super_restore_fd(fd));
+  EXPECT_EQ_INT(fstat(fd, &st), 0);
+  EXPECT_EQ_INT((int)st.st_uid, 12345);
+  EXPECT_EQ_INT((int)st.st_gid, 12346);
+
+  /* --super / --fake-super with NO explicit identity flag must NOT apply a
+     client-chosen owner: super_mode alone never enables ownership. */
+  EXPECT_EQ_INT(fchown(fd, 0, 0), 0);
+  c->numeric_ids = false;
+  c->super_mode = SUPER_MODE_ON;
+  EXPECT_TRUE(identity_set_active(c));
+  EXPECT_TRUE(fake_super_restore_fd(fd));
+  EXPECT_EQ_INT(fstat(fd, &st), 0);
+  EXPECT_EQ_INT((int)st.st_uid, 0);
+  EXPECT_EQ_INT((int)st.st_gid, 0);
+
+  /* Active --copy-as is authoritative: the recorded source owner must not
+     override it, even with AUTO/ON. */
+  c->copy_as_set = true;
+  c->copy_as_uid = 777;
+  c->copy_as_gid = 778;
+  EXPECT_TRUE(identity_set_active(c));
+  EXPECT_TRUE(fake_super_restore_fd(fd));
+  EXPECT_EQ_INT(fstat(fd, &st), 0);
+  EXPECT_EQ_INT((int)st.st_uid, 0);
+  EXPECT_EQ_INT((int)st.st_gid, 0);
+
+  identity_clear_active();
+  config_delete(c);
+  close(fd);
+  unlink(path);
+}
+
 void test_xattr() {
   test_xattr_wire_roundtrip();
   test_xattr_reject_privileged_namespace();
@@ -229,4 +361,6 @@ void test_xattr() {
   test_xattr_count_bound();
   test_xattr_capture_and_appliable();
   test_link_copy_fallback_preserves_xattrs();
+  test_fake_super_restore();
+  test_fake_super_owner_gate();
 }