docs: clarify %b semantics, temper thread-safety claim, harden %M scan; add -m coverage

Address c-review nits on the itemize/output feature:
- RSYNC_COMPAT.md: state that %b is the source length (always == %l) because
  no wire-byte counter exists; keep Summary equal to the matrix (recounted:
  54 implemented / 84 not-implemented, 147 rows total - four rows flipped).
- change_list.h/.c: document bytes_sent == size; note itemize/out-format lines
  never interleave with each other but may interleave with legacy log
  messages sharing the stream; mark the %M stat() path best-effort.
- change_render_format scan in format_uses_mtime now mirrors the tokenizer
  (skips '%%' and unknown '%X' pairs) so a literal '%%M' no longer triggers
  the stat() fallback.
- Integration tests: --list-only under -m; a changed file on a second
  --incremental run emits exactly one '>f' line while unchanged files print
  nothing; --log-file + --log-file-format under -m.

CMakeLists.txt

@@ -58,7 +58,7 @@ endif()
 find_package(OpenSSL REQUIRED)
 
 file(GLOB SHARED_SRCS "src/shared/*.c")
-set(FILE_STORE_SRCS src/shared/file_store.c)
+set(FILE_STORE_SRCS "${CMAKE_CURRENT_SOURCE_DIR}/src/shared/file_store.c")
 list(REMOVE_ITEM SHARED_SRCS ${FILE_STORE_SRCS})
 file(GLOB SERVER_SRCS "src/server/*.c")
 set(SERVER_RECEIVER_SRCS src/server/receiver.c)
@@ -82,7 +82,7 @@ set(TEST_INCLUDES tests src/shared src/server src/client)
 
 # Monolithic test binary (backward compatible)
 file(GLOB TEST_SRCS "tests/test_*.c" "tests/runner.c")
-add_executable(tests ${TEST_SRCS} ${SHARED_SRCS} ${FILE_STORE_SRCS} ${SERVER_RECEIVER_SRCS} src/client/scanner.c src/client/client_cli.c src/client/client_validation.c src/client/usage.c)
+add_executable(tests ${TEST_SRCS} ${SHARED_SRCS} ${FILE_STORE_SRCS} ${SERVER_RECEIVER_SRCS} src/client/scanner.c src/client/change_list.c src/client/client_cli.c src/client/client_validation.c src/client/usage.c)
 target_include_directories(tests PRIVATE ${TEST_INCLUDES})
 target_compile_definitions(tests PRIVATE FASTSYNC_TEST_BUILD)
 target_link_libraries(tests PRIVATE ${TEST_LIBS})

README.md

@@ -1,103 +1,87 @@
 #FastSync
 
-A high-performance file synchronization system with SSH and TCP transport, TLS encryption, streaming zstd compression, multithreaded transfer, incremental sync, metadata preservation, and rsync-compatible CLI flags.
+FastSync is a high-performance file synchronization tool designed to become a
+drop-in replacement for common `rsync` workflows. It keeps the familiar
+source/destination model and rsync-style options while adding optional
+multithreading, streaming zstd compression, chunking, zero-copy TCP transfers,
+and native TCP/TLS transports.
 
-## Technical Overview
+The compatibility target is straightforward:
 
-1. **Dual transport**: custom TCP client-server or SSH subprocess (rsync-style `user@host:/path`)
+- Existing rsync commands should keep the same meaning.
-2. **TLS encryption**: OpenSSL-based TLS 1.2+ for encrypted TCP connections with optional CA verification
+- FastSync-only performance options should be additive and optional.
-3. **Chunked file transfer**: files grouped into configurable-size chunks (default ~10 MB)
+- A normal compatibility-mode transfer should prioritize rsync filesystem
-4. **Streaming zstd compression** (levels 1–22) using `ZSTD_compressStream2`
+  semantics over maximum throughput.
-5. **Multithreading**: producer-consumer pipeline with thread-safe queues (scanner → loader → sender)
-6. **Incremental sync**: skip files unchanged since last transfer (compares size + mtime)
-7. **Batch incremental**: send incremental checks in batched groups for reduced round-trips
-8. **Metadata preservation**: file mode and mtime are restored when enabled; ownership and atime are intentionally not restored
-9. **`sendfile()` zero-copy** on TCP (~2× faster on loopback)
-10. **SSH ControlMaster** for connection reuse across repeated invocations
-11. **Bandwidth limiting**: token-bucket throttling (`--bwlimit`)
-12. **`--delete`**: receiver removes files not present in sender manifest
-13. **`--exclude` / `--include`**: glob-pattern filename filtering
-14. **Path traversal protection**: `..` sequences in file paths are rejected automatically
-15. **Connection limits**: server enforces maximum concurrent connections (default 100)
-16. **Keep-alive**: periodic `STATUS_KEEPALIVE` messages detect stalled connections
-17. **Abort handling**: `SIGINT` sends `STATUS_ABORT` for clean server-side teardown
-18. **Atomic writes**: received files are written to a temporary name then atomically renamed
-19. **Backup mode**: `--backup` preserves overwritten files with optional `--backup-dir`
-20. **Log file**: `--log-file` redirects log output to a file instead of stderr
-21. **Transfer statistics**: `--stats` prints summary of transferred bytes, files, and timing
 
-## System Architecture
+FastSync currently speaks its own protocol to `fastsync-server`. SSH mode
+starts that server remotely; it does not yet interoperate with an unmodified
+rsync client or rsync daemon. See [Compatibility Status](#compatibility-status)
+for the current boundary.
 
-### Client
+## Why FastSync
-- Recursively scans source directories (BFS), supports exclude and include patterns
-- Groups files into chunks (configurable size)
-- Streaming zstd compression with configurable level
-- Chunk serialization (compact binary format) or per-file transfer
-- Incremental transfer: sends file metadata to server, skips unchanged files
-- Batch incremental: groups incremental checks to minimize round-trips
-- Manifests all sent paths when `--delete` is active
-- Sends via TCP `sendfile()` or SSH pipe
-- Optional progress display with throughput
-- Bandwidth limiting via token-bucket algorithm
-- Configurable I/O and connection timeouts (`--timeout`, `--contimeout`)
-- Backup overwritten files (`--backup`) with optional directory (`--backup-dir`)
-- Transfer statistics summary (`--stats`)
-- Maximum directory depth control (`--max-depth`)
-- Log file output (`--log-file`)
-- Exclude patterns from file (`--exclude-from`)
 
-### Server
+FastSync uses a producer-consumer transfer pipeline and can combine several
-- TCP mode: listens on configurable port (default 8080); SSH mode: runs via `--stdio`
+optimizations for large or high-latency transfers:
-- TLS mode: wraps TCP connections with OpenSSL with optional CA verification
-- Receives and reassembles files
-- Decompresses (streaming zstd), deserializes, restores metadata
-- Handles incremental checks: compares size + mtime against destination files
-- Handles batch incremental checks for reduced round-trips
-- Processes `STATUS_MANIFEST` for `--delete`: walks destination tree, removes extras
-- Per-connection concurrency via `fork()` with configurable connection limit (default 100)
-- Thread pool for parallel processing
-- Atomic writes: files written to `.tmp` path then atomically renamed on success
-- Abort handling: cleanly shuts down on `STATUS_ABORT` from client
-- Path traversal protection: rejects file paths containing `..`
 
-## Protocol Details
+- Multithreaded scanning, loading, and sending.
+- Streaming zstd compression with levels 1 through 22.
+- Configurable file chunking and compact chunk serialization.
+- `sendfile()` zero-copy transfers over TCP.
+- Batched incremental checks to reduce round trips.
+- Optional block-level delta transfer for FastSync peers.
+- Bandwidth limiting, progress reporting, statistics, and backups.
+- TCP, SSH, and TLS transports.
+- Atomic temporary-file writes by default.
 
-### Status Codes
+These optimizations are disabled or selected independently. Users can start
-| Code | Meaning |
+with rsync-style commands and add FastSync options when they are useful.
-|------|---------|
-| `STATUS_OK` | Operation successful |
-| `STATUS_ERROR` | Error occurred |
-| `STATUS_FINISHED` | Transfer complete |
-| `STATUS_NEXT` | Ready for next file (per-file mode) |
-| `STATUS_CHUNK` | Following data is a serialized chunk |
-| `STATUS_MANIFEST` | Following data is a file manifest (for `--delete`) |
-| `STATUS_CHECK` | Incremental check: client sends file path + size + mtime and, when negotiated, checksum; server responds with OK (skip) or NEXT (send) |
-| `STATUS_CHECK_BATCH` | Batch incremental check: multiple file checks sent in one message |
-| `STATUS_KEEPALIVE` | Keep-alive heartbeat to detect stalled connections |
-| `STATUS_ABORT` | Abort signal: client interrupts, server cleans up and exits |
-| `STATUS_DELTA_SIGNATURE` | Delta sync: following data is a file signature (rsync-style rolling hash) |
-| `STATUS_DELTA_DATA` | Delta sync: following data is a delta patch for a file |
 
-### Wire Format — Metadata
+## Compatibility Status
 
-When `use_metadata` is enabled (`-M`), each file entry carries a 4-byte `present` flag followed by five fields (`mode`, `uid`, `gid`, `mtime_sec`, `mtime_nsec`). When disabled globally, no metadata bytes are sent — zero wire overhead.
+FastSync is currently an rsync-compatible CLI in progress, not a complete
+replacement for every rsync feature or protocol mode.
 
-### Transfer Flow
+### Working today
-```
-Config → (STATUS_NEXT | STATUS_CHUNK | STATUS_CHECK | STATUS_CHECK_BATCH)* → [STATUS_MANIFEST] → STATUS_FINISHED → STATUS_OK
-```
 
-Keep-alive (`STATUS_KEEPALIVE`) may be sent at any point during the transfer. The receiver resets its inactivity timer on receipt. If no data arrives within the receive timeout, the connection is aborted.
+- Recursive directory scanning.
+- Rsync-style source and destination arguments.
+- SSH transport using `user@host:destination` paths below the remote authorized root.
+- TCP client/server transfers.
+- Dry runs, excludes, includes, size filters, backups, statistics, and
+  bandwidth limiting.
+- Incremental size/mtime checks and optional xxHash64 content checks.
+- FastSync-native delta transfer for changed files.
+- Optional mode and timestamp preservation.
+- Delete manifests with server-side delete authorization.
+- Temporary-file writes with atomic rename by default.
+- Path traversal checks and destination-root confinement.
 
-Abort (`STATUS_ABORT`) may be sent at any point. On receipt the server cleans up temporary files and exits the child process.
+### Not yet equivalent to rsync
 
-### Protocol Version
+- The FastSync wire protocol is not the rsync wire protocol.
+- SSH mode requires `fastsync-server` on the remote host.
+- Archive mode does not yet provide all of rsync's `-rlptgoD` behavior.
+- Symlink transfer is incomplete; link targets are not yet recreated in all
+  modes.
+- Owner/group, ACL, xattr, hard-link, device, and special-file handling is
+  incomplete or unavailable.
+- Sparse-file handling does not yet preserve all holes correctly.
+- `--partial`, `--partial-dir`, `-P`, `--append`, and `--append-verify` are not
+  yet full rsync-style resumable transfers. Interrupted files are not retained
+  for resumption.
+- `--dirs` is not implemented. Its compatibility aliases `--old-dirs` and
+  `--old-d` are recognized but rejected explicitly rather than silently using
+  FastSync's recursive directory behavior.
+- Several rsync short options currently have FastSync-specific meanings. Do
+  not assume every short option is interchangeable yet.
 
-`2.2.0` — server and client must match. This version adds a 64-bit XXH64 checksum to checksum-enabled `STATUS_CHECK` messages and validates the negotiated compression choice (`zstd` or `none`). Older clients and servers must not be mixed with this version; mismatch results in `STATUS_ERROR`.
+The detailed flag matrix is maintained in
+[`RSYNC_COMPAT.md`](RSYNC_COMPAT.md). It distinguishes implemented,
+partial, alternate, and planned behavior.
 
-Config negotiation is sender-driven: the client serializes transfer options and the server applies them while receiving and writing files. `--checksum` compares size and content checksum instead of timestamps. `--compress-choice zstd` enables zstd; `none` disables it. Unsupported choices are rejected during config exchange.
+## Quick Start
 
-## Command-Line Arguments
+### Build
 
 ### Client
 
@@ -109,19 +93,24 @@ Config negotiation is sender-driven: the client serializes transfer options and
 | `-a, --archive` | Archive mode: enables `-c -m -M` (no `-s`) |
 | `-m` | Multithreading mode |
 | `-s` | Chunk serialization (batch all files per chunk) |
+| `--secluded-args` | Accepted as an rsync compatibility option with no effect; `-s` remains chunk serialization. |
 | `-f, --sendfile` | Sendfile zero-copy. Incompatible with `-c` / `-s`. TCP only. |
 | `-M, --preserve` | Preserve supported file metadata (mode and mtime; ownership and atime are unsupported) |
 | `-n, --dry-run` | Scan and print what would be transferred |
 | `-p <port>` | SSH port (default: 22) |
 | `-v, --verbose` | Enable debug logging |
+| `-q, --quiet` | Suppress non-error output |
 | `--progress` | Show real-time transfer speed |
+| `-P` | Enables partial-transfer mode and progress output (partial retention is incomplete) |
 | `--delete` | Delete files on receiver not present in source |
 | `--exclude <pattern>` | Exclude files matching glob pattern (repeatable) |
 | `--exclude-from <file>` | Read exclude patterns from a file (one per line) |
 | `--include <pattern>` | Only transfer files matching glob pattern (repeatable, whitelist) |
 | `--max-size <n>` | Skip files larger than n bytes |
 | `--min-size <n>` | Skip files smaller than n bytes |
+| `--max-alloc <SIZE>` | Maximum single allocation (binary units: B, K, M, G, T, P, E; default 1G) |
 | `--incremental` | Skip files unchanged since last transfer (size + mtime). Auto-enables `--preserve`. Incompatible with `-s`. |
+| `--existing` | Skip files not already present at the destination; update existing files normally. |
 | `--bwlimit <KB/s>` | Bandwidth limit in kilobytes per second |
 | `--chunk-size <n>` | Chunk size in bytes (default: 10485760) |
 | `--timeout <sec>` | I/O timeout in seconds (default: 30) |
@@ -129,6 +118,7 @@ Config negotiation is sender-driven: the client serializes transfer options and
 | `--backup` | Backup existing destination files before overwriting |
 | `--backup-dir <dir>` | Target directory for backups (requires `--backup`) |
 | `--stats` | Print transfer statistics at end (bytes, files, timing) |
+| `-h, --human-readable` | Format transfer byte sizes with binary units |
 | `--max-depth <n>` | Maximum directory depth to recurse (0 = unlimited, default: 0) |
 | `--log-file <path>` | Write log messages to file instead of stderr |
 | `--source-dir <path>` | Source directory (overrides `FASTSYNC_SOURCE_DIR`) |
@@ -140,6 +130,7 @@ Config negotiation is sender-driven: the client serializes transfer options and
 | `--cert <path>` | TLS certificate file (PEM) |
 | `--key <path>` | TLS private key file (PEM) |
 | `--ca <path>` | TLS CA certificate file for verification (PEM) |
+| `--client-cn <name>` | Required TLS client certificate common name |
 
 ### Server
 
@@ -151,6 +142,9 @@ Config negotiation is sender-driven: the client serializes transfer options and
 | `--cert <path>` | TLS certificate file (PEM) |
 | `--key <path>` | TLS private key file (PEM) |
 | `--ca <path>` | TLS CA certificate file for verification (PEM) |
+| `--destination-root <path>` | Authorized destination root (default: `.`) |
+| `--allow-delete` | Permit manifest deletion |
+| `--allow-unauthenticated` | Permit plaintext TCP clients |
 | `-v, --verbose` | Enable debug logging |
 | `--help` | Show help |
 
@@ -173,26 +167,46 @@ Config negotiation is sender-driven: the client serializes transfer options and
 ### Data Structures
 1. **Chunk** — collection of files (~10 MB total by default)
 2. **File** — path, content (`Data`), optional `FileMetadata` pointer
-3. **FileMetadata** — `mode`, `uid`, `gid`, `mtime_sec`, `mtime_nsec`; uid/gid are advisory wire fields and are never applied by the receiver; atime is unsupported
+3. **FileMetadata** — `mode`, `uid`, `gid`, `mtime_sec`, `mtime_nsec`;
+uid / gid are advisory wire fields and are never applied by the receiver;
+atime is unsupported
 4. **Config** — runtime parameters (transported over wire, TLS settings excluded). Includes `timeout`, `contimeout`, `quiet`, `backup`, `backup_dir`, `stats`, `max_depth`, `log_file`, `queue_size`.
 5. **Queue** — thread-safe bounded queue with condition variables
 6. **DirectoryScanner** — recursive BFS traversal with exclude and include pattern support, max-depth enforcement
 
 ### Key Algorithms
-1. **File scanning** — BFS directory traversal; entries matched against exclude and include patterns, max-depth enforced
+1. **File scanning** — BFS directory traversal;
-2. **Chunking** — files accumulated until `chunk_size` threshold, then flushed
+entries matched against exclude and include patterns,
-3. **Compression** — streaming zstd via `ZSTD_compressStream2` / `ZSTD_decompressStream`
+    max - depth enforced 2. * *Chunking ** — files accumulated until `chunk_size` threshold,
-4. **Network protocol** — status-code-driven exchange with metadata packing, keep-alive, and abort support
+    then flushed 3. *
-5. **Incremental check** — client sends `STATUS_CHECK` + path + size + mtime and, with `--checksum`, XXH64 content checksum; server compares against destination. Can be batched via `STATUS_CHECK_BATCH` for reduced round-trips.
+            *Compression ** — streaming zstd
+                via `ZSTD_compressStream2` / `ZSTD_decompressStream` 4. *
+            *Network protocol ** — status -
+        code - driven exchange with metadata packing,
+    keep - alive,
+    and abort support 5. * *Incremental check ** — client sends `STATUS_CHECK` + path + size +
+        mtime and,
+    with `--checksum`, XXH64 content checksum; server compares against destination. Can be batched via `STATUS_CHECK_BATCH` for reduced round-trips.
 6. **Bandwidth limiting** — token-bucket algorithm with `nanosleep` throttling on 64 KB write chunks
 7. **Metadata restoration** — `chmod()`, `chown()`, `utimensat()` on the receiving side
-8. **`--delete`** — sender tracks all sent paths; receiver walks destination tree and removes unlisted files/directories
+8. **`--delete`** — sender tracks all sent paths;
-9. **SSH transport** — `socketpair()` + `fork()` + `execvp("ssh", ...)` with `ControlMaster` and port support
+receiver walks destination tree and removes unlisted files / directories 9. *
-10. **TLS transport** — OpenSSL `SSL_CTX` with TLS 1.2 minimum, optional CA verification, transparent `SSL_read`/`SSL_write` via `io_set_ssl()`
+        *SSH transport *
-11. **Path traversal protection** — `has_path_traversal()` rejects any file path containing `..` components, preventing directory escape attacks
+            * — `socketpair()` + `fork()` + `execvp("ssh",
-12. **Connection limiting** — server tracks active connections and rejects new ones beyond `max_connections` (default 100)
+                                                    ...)` with `ControlMaster` and port support
-13. **Keep-alive** — idle connections receive periodic `STATUS_KEEPALIVE` to detect half-open TCP connections
+                                                10. *
-14. **Abort handling** — `SIGINT` sets an abort flag; the next protocol operation sends `STATUS_ABORT` for clean server cleanup
+                                                *TLS transport ** — OpenSSL `SSL_CTX` with TLS
+                                                1.2 minimum,
+    mutual CA verification,
+    transparent `SSL_read`/`SSL_write` via `io_set_ssl()` 11. *
+        *Path traversal protection ** — `has_path_traversal()` rejects any file path
+         containing `..` components,
+    preventing directory escape attacks 12. *
+            *Connection limiting ** — server tracks active connections and rejects
+            new ones beyond `max_connections` (default 100)13. *
+            *Keep
+        - alive ** — idle connections receive periodic `STATUS_KEEPALIVE` to detect half
+        - open TCP connections 14. * *Abort handling ** — `SIGINT` sets an abort flag; the next protocol operation sends `STATUS_ABORT` for clean server cleanup
 15. **Atomic writes** — files are written to a `.tmp` suffix then atomically renamed via `rename()`, preventing partial files
 16. **Backup** — before overwriting, existing files are moved to `--backup-dir` (or same directory with `~` suffix) preserving the original
 
@@ -202,7 +216,7 @@ Config negotiation is sender-driven: the client serializes transfer options and
 All received file paths are validated by `has_path_traversal()` before any disk operation. Any path containing `..` components is rejected with `STATUS_ERROR`, preventing directory escape attacks.
 
 ### TLS Certificate Verification
-When `--ca` is provided, the server performs mutual TLS verification (`SSL_VERIFY_PEER` with depth 4). Without `--ca`, TLS is still encrypted but peer certificates are not verified.
+TLS requires `--ca` and performs mutual TLS verification (`SSL_VERIFY_PEER` with depth 4). Connections without certificate verification are rejected.
 
 ### Connection Limits
 The server enforces a maximum of 100 concurrent connections (configurable via `max_connections` in `Server`). When the limit is reached, new connections are immediately rejected and closed.
@@ -237,127 +251,315 @@ nix-shell  # provides zstd, openssl, cmake, gcc
 ## Building
 
 ```bash
-cmake -B build -S . && cmake --build build -j$(nproc)
+cmake -B build -S .
+cmake --build build -j$(nproc)
 ```
 
-## Running
+With Nix:
 
-### Server (TCP mode)
 ```bash
-./build/server
+nix-shell
+cmake -B build -S .
+cmake --build build -j$(nproc)
 ```
 
-### Server with TLS
+### SSH transfer
+
+The remote host must have `fastsync-server` available in `PATH`, or use
+`--fastsync-server-path`. SSH starts `fastsync-server --stdio` in its remote
+working directory, so use a destination below that directory unless the
+remote server is otherwise configured with a matching authorized root.
+
 ```bash
-./build/server --tls --cert server.pem --key server-key.pem
+ssh user@host 'mkdir -p destination'
+./build/client /path/to/source user@host:destination
 ```
 
-### Server via SSH
+### TCP transfer
-Place the `fastsync-server` binary in the remote `$PATH`. The client runs `ssh user@host fastsync-server --stdio` automatically when an SSH-style destination is given.
+
+Start the FastSync server:
 
-### Client — SSH (rsync-style)
 ```bash
-./build/client /path/to/send user@host:/path/to/receive
+./build/server --destination-root /path/to -p 8080
 ```
 
-### Client — TCP
+Then run the client:
+
 ```bash
-./build/client --source-dir /path/to/send --dest-dir /path/to/receive --save-to-disk
+./build/client --server-host 127.0.0.1 --server-port 8080 \
+  --source-dir /path/to/source --dest-dir /path/to/destination \
+  --save-to-disk
 ```
 
-### Client — TCP with TLS
+Plain TCP requires the explicit `--allow-unauthenticated` server option. Use TLS for
+authenticated network connections.
+
+### TLS transfer
 ```bash
+./build/server --destination-root /path/to --tls --cert server.pem --key server-key.pem -p 8443
 ./build/client --tls --cert client.pem --key client-key.pem --ca ca.pem \
-  --source-dir /path/to/send --dest-dir /path/to/receive --save-to-disk
+  --server-host example.com --server-port 8443 \
+  --source-dir /path/to/source --dest-dir /path/to/destination \
+  --save-to-disk
 ```
 
-### Common Options
+## Common Workflows
+
+These examples show the intended rsync-style workflow. Options marked as
+FastSync-native are optional performance or transport extensions.
+
 ```bash
-# Archive mode (compression + multithreading + metadata)
+#Basic synchronization
-./build/client -a /path/to/send user@host:/path
+./build/client /source/ /destination/
 
-# Dry run
+#Archive - style synchronization(current FastSync archive behavior)
-./build/client -n /path/to/send /path/to/receive
+./build/client -a /source/ user@host:destination/
 
-# With progress and custom chunk size
+#Preview a transfer without changing the destination
-./build/client --progress --chunk-size 2097152 /src user@host:/dst
+./build/client -n /source/ /destination/
 
-# Exclude temporary files + delete extras on receiver
+#Exclude temporary and object files
-./build/client --exclude "*.tmp" --exclude "*.o" --delete /src user@host:/dst
+./build/client --exclude '*.tmp' --exclude '*.o' \
+  /source/ user@host:destination/
 
-# Incremental sync (skip unchanged files)
+#Remove destination entries not present in the source
-./build/client --incremental /src user@host:/dst
+./build/client --delete /source/ user@host:destination/
 
-# Bandwidth limit to 1 MB/s
+#Skip unchanged files using size and modification time
-./build/client --bwlimit 1024 /src user@host:/dst
+./build/client --incremental /source/ user@host:destination/
 
-# With timeouts and stats
+#Verify content when size and time are not sufficient
-./build/client --timeout 60 --contimeout 15 --stats /src user@host:/dst
+./build/client --incremental --checksum /source/ user@host:destination/
 
-# Backup overwritten files to a directory
+#Preserve supported mode and timestamp metadata
-./build/client --backup --backup-dir /backups /src user@host:/dst
+./build/client -M /source/ user@host:destination/
 
-# Exclude patterns from file, limit depth
+#Keep backups of overwritten destination files
-./build/client --exclude-from ignore.txt --max-depth 3 /src user@host:/dst
+./build/client --backup --backup-dir backups \
-
+  /source/ user@host:destination/
-# Log to file
-./build/client --log-file /tmp/fastsync.log /src user@host:/dst
-
-# All features
-./build/client -a --progress --chunk-size 5242880 --exclude "*.log" --delete /src /dst
 ```
 
+## FastSync Extensions
+
+FastSync-native options are intended to add performance or operational
+features without changing the meaning of ordinary compatibility options.
+
+| Option | Purpose |
+|---|---|
+| `-m` | Enable the multithreaded scanner/loader/sender pipeline. |
+| `-c [level]`, `-z [level]` | Enable streaming zstd compression, levels 1-22. |
+| `--compress-level <n>` | Set the zstd compression level. |
+| `--zc <alg>` | Alias for `--compress-choice`. FastSync supports `zstd` and `none`. |
+| `--zl <n>` | Alias for `--compress-level`. |
+| `--skip-compress <list>` | Skip compression for comma-separated suffixes; incompatible with `-s`. |
+| `--compress-threads <n>` | Use `n` zstd compression workers. Requires compression and a zstd build with threaded support; the setting affects sender CPU work only. |
+| `--chunk-size <bytes>` | Set the transfer chunk size. |
+| `-s` | Enable FastSync chunk serialization. |
+| `-f`, `--sendfile` | Use TCP `sendfile()` zero-copy transfer. Incompatible with compression and chunk serialization. |
+| `--delta` | Use FastSync-native block delta transfer. Requires `--incremental`. |
+| `--delta-block <bytes>` | Set the FastSync delta block size. |
+| `--delta-max <bytes>` | Limit files eligible for FastSync delta transfer. |
+| `--server-host <host>` | Select the TCP server host. |
+| `--server-port <port>` | Select the TCP server port. |
+| `--tls` | Enable TLS for TCP transport. |
+| `--bwlimit <KB/s>` | Apply token-bucket bandwidth limiting. |
+| `--progress` | Show transfer progress and throughput. |
+| `--stats` | Print transfer statistics. |
+| `--timeout <seconds>` | Set I/O timeout. |
+| `--contimeout <seconds>` | Set connection timeout. |
+
+Current short-option conflicts are tracked as compatibility work. In
+particular, FastSync currently uses `-p` for SSH port, `-s` for chunk
+serialization, and `-S` for sparse handling. These meanings must be reconciled
+before FastSync can claim full rsync CLI compatibility.
+
+`--secluded-args` is accepted as a long-form compatibility no-op. It does not
+change FastSync's transport or protocol behavior. The rsync short form `-s` is
+intentionally not aliased because it remains FastSync's chunk-serialization
+option.
+
+## Client Options
+
+### Selection and transfer
+
+| Option | Description |
+|---|---|
+| `-a`, `--archive` | Enable current archive preset. Full rsync archive semantics are planned. |
+| `-n`, `--dry-run` | Scan and report without writing files. |
+| `--delete` | Request removal of destination entries absent from the source. The server must allow deletion. |
+| `--exclude <pattern>` | Exclude matching paths. Repeatable. |
+| `--include <pattern>` | Include matching paths. Repeatable. |
+| `--exclude-from <file>` | Read exclude patterns from a file. |
+| `--include-from <file>` | Read include patterns from a file. |
+| `--max-size <bytes>` | Skip files larger than the limit. |
+| `--min-size <bytes>` | Skip files smaller than the limit. |
+| `--max-depth <n>` | Limit recursive scanning depth;
+zero means unlimited.| | `--incremental` | Skip files matching destination size and mtime.|
+    | `--checksum` | Include xxHash64 content checks in incremental comparisons.| | `--backup` |
+    Back up overwritten files.| | `--backup - dir<dir>` | Store backups under a separate directory.|
+    | `--suffix<suffix>` | Set the backup filename suffix.| | `--partial` |
+    Select partial - transfer handling.With `--partial - dir`,
+    completed files are written there;
+resumable transfers are not implemented.| | `--partial - dir<dir>` |
+    Set a relative partial - transfer directory below the server destination root;
+use with `--partial`. |
+| `--inplace` | Write directly to the destination instead of using a temporary file. |
+
+### Metadata and links
+
+| Option | Description |
+|---|---|
+| `-M`, `--preserve` | Preserve supported file metadata, currently mode and modification time. |
+| `-l`, `--links` | Request symlink preservation;
+link-target transfer remains incomplete. |
+| `--copy-links` | Copy symlink referents. |
+| `--safe-links` | Skip symlinks that point outside the transfer tree. |
+| `--copy-unsafe-links` | Copy unsafe symlink referents. |
+| `-S`, `--sparse` | Request sparse-file handling; full hole preservation is planned. |
+
+### Output and logging
+
+| Option | Description |
+|---|---|
+| `-v`, `--verbose` | Enable debug logging. |
+| `--progress` | Show live transfer progress. |
+| `--stats` | Print transfer statistics. |
+| `--log-file <path>` | Write log output to a file. |
+| `-V`, `--version` | Print the FastSync protocol version. |
+| `--help` | Print command usage. |
+
+### Paths and transport
+
+| Option | Description |
+|---|---|
+| `-p <port>` | SSH port in the current CLI. This conflicts with rsync's `-p` permissions option and is planned for correction. |
+| `--fastsync-server-path <path>` | Remote FastSync server path for SSH mode. |
+| `--source-dir <path>` | Set the source directory explicitly. |
+| `--dest-dir <path>` | Set the destination directory explicitly. |
+| `--save-to-disk` | Enable server-side disk persistence. |
+| `--server-host <host>` | TCP server address. |
+| `--server-port <port>` | TCP server port. |
+| `--tls` | Enable TLS. Requires `--cert` and `--key`. |
+| `--cert <path>` | TLS certificate file. |
+| `--key <path>` | TLS private key file. |
+| `--ca <path>` | CA file for peer verification. |
+
+## Server Options
+
+| Option | Description |
+|---|---|
+| `--stdio` | Serve one SSH connection over standard input/output. |
+| `-p <port>` | TCP listen port. |
+| `--tls` | Enable TLS. |
+| `--cert <path>` | TLS certificate file. |
+| `--key <path>` | TLS private key file. |
+| `--ca <path>` | CA file for peer verification. |
+| `--destination-root <path>` | Confine received files to this server-side root;
+defaults to the current directory. |
+| `--allow-delete` | Permit client delete manifests. Deletion is refused by default. |
+| `-v`, `--verbose` | Enable debug logging. |
+| `--help` | Print server usage. |
+
+## Architecture
+
+### Client
+
+- Recursively scans the source tree with include, exclude, size, and depth
+  filters.
+- Sends individual files or serialized chunks.
+- Performs incremental checks and optional content checksums.
+- Uses a multithreaded producer-consumer pipeline when requested.
+- Sends over TCP, TLS-wrapped TCP, or an SSH subprocess.
+- Supports progress, statistics, backups, timeouts, and bandwidth limiting.
+
+### Server
+
+- Runs as a TCP listener or one-shot SSH `--stdio` server.
+- Receives and reassembles files and decompresses streaming zstd data.
+- Applies supported metadata and writes files through a confined destination
+  root.
+- Uses temporary files and atomic rename by default.
+- Handles delete manifests only when explicitly authorized.
+- Enforces connection, message-size, and path-safety limits.
+
+## Protocol and Security
+
+FastSync protocol version `2.5.0` is shared by the client and server. The
+current protocol is sender-driven and includes configuration negotiation,
+including the maximum allocation limit, incremental checks, checksums,
+manifests, keep-alives, abort handling, per-file remove-source results, and
+FastSync-native delta messages.
+Client and server versions must currently match exactly.
+
+TLS provides encrypted TCP transport. Supplying `--ca` enables certificate
+verification; without it, traffic is encrypted but peer identity is not
+verified. Use certificate verification for deployments where authentication
+matters. The default TCP transport is not encrypted.
+
+The receiver protects its destination root with path validation, `openat()`
+directory traversal, `O_NOFOLLOW`, temporary files, and atomic renames. Delete
+operations require the server's explicit `--allow-delete` policy.
+
+## Compatibility Roadmap
+
+The project will reach the drop-in replacement goal in stages:
+
+1. Correct rsync option meanings, including short options, combined options,
+   and `--option=value` syntax.
+2. Add differential tests that compare FastSync and rsync contents, metadata,
+   links, deletes, filters, dry runs, and exit codes.
+3. Make `-a` implement the expected recursive, links, permissions, times,
+   owner/group, and supported special-file behavior.
+4. Complete symlink, sparse-file, metadata, delete-policy, and resumable-write
+   semantics.
+5. Add rsync remote-shell and daemon protocol interoperability.
+6. Keep FastSync performance options as negotiated, optional extensions.
+
+The exhaustive implementation matrix and compatibility notes are in
+[`RSYNC_COMPAT.md`](RSYNC_COMPAT.md).
+
 ## Testing
 
-```bash
+Run the unit test binary:
-# Unit tests (18 suites — array_list, chunk, compression, config, data, delta, file, glob,
-#                      metadata, property, protocol, queue, robustness, scanner,
-#                      shared_utils, stress, transport_tcp, transport_ssh, transport_tls)
-./build/tests
 
-# Integration + benchmark suite
+```bash
-python3 test.py
+./build/tests
 ```
 
-The benchmark prints throughput metrics, best configuration, and speedup vs rsync.
+Run the Python integration suite:
 
-## Performance Considerations
+```bash
+python3 -m pytest tests/
+```
 
-1. Chunk size (~10 MB default) balances memory and transfer efficiency
+For stricter local validation:
-2. Compression level trades CPU for bandwidth
-3. `sendfile()` bypasses userspace — ~2× faster on localhost for large files
-4. Multithreading scales with core count and uses memory-based pipeline sizing
-5. Metadata transfer adds negligible overhead (~24 bytes per file when enabled)
-6. SSH socketpair buffer set to 1 MB for improved pipe throughput
-7. SSH ControlMaster reuses connections across repeated invocations
-8. Incremental sync eliminates redundant transfers entirely
-9. Batch incremental reduces round-trips by grouping multiple checks into one message
-10. Bandwidth limiting uses token-bucket with nanosleep for accurate throttling
-11. Atomic writes add a single `rename()` per file — negligible overhead
-12. Path traversal check is O(n) in path length with negligible cost
 
-## Benchmark Results
+```bash
+cmake -B build-strict -S . -DSTRICT_WARNINGS=ON
+cmake --build build-strict -j$(nproc)
+cmake -B build-asan -S . -DSANITIZER=address
+cmake --build build-asan -j$(nproc)
+```
 
-25 MB of mixed file sizes over `localhost` with disk I/O throttled (reads ≤ 15 MB/s, writes ≤ 10 MB/s) and network emulation via `tc netem`. Each test was run 3×; the median is reported below.
+The benchmark tool compares FastSync configurations with rsync under
+controlled local and network conditions:
 
-### LAN (1000 Mbit, 20 ms ±1 ms, 0.1% loss)
+```bash
+python3 benchmark/bench.py --help
+```
 
-| Configuration | Time | vs rsync (archive) | vs rsync (compress) |
+Benchmark results measure transfer performance only. They do not establish
-|---|---|---|---|
+rsync protocol or filesystem-semantic compatibility.
-| **Best: `-m -c`** | **0.20 s** | **11.2× faster** | **3.6× faster** |
-| Compression (`-c`) | 0.31 s | 7.3× faster | 2.3× faster |
-| Standard | 1.27 s | 1.8× faster | — |
-| rsync (archive) | 2.27 s | — | — |
-| rsync (archive + compress) | 0.72 s | — | — |
 
-### WAN (100 Mbit, 50 ms ±10 ms, 1% loss)
+## Performance Guidance
 
-| Configuration | Time | vs rsync (archive) | vs rsync (compress) |
+- Use `-m` for workloads with many files or enough CPU parallelism.
-|---|---|---|---|
+- Use `-c` or `-z` when network bandwidth is more constrained than CPU.
-| **Best: `-m -c`** | **0.39 s** | **44.8× faster** | **3.8× faster** |
+- Tune `--chunk-size` for file sizes, memory limits, and network latency.
-| Compression (`-c`) | 0.64 s | 27.3× faster | 2.3× faster |
+- Use `-f` for large uncompressed TCP transfers where zero-copy I/O helps.
-| Standard | 7.12 s | 2.4× faster | — |
+- Use `--incremental` to avoid retransmitting unchanged files.
-| rsync (archive) | 17.44 s | — | — |
+- Use `--delta` for changed files when both endpoints are FastSync peers.
-| rsync (archive + compress) | 1.47 s | — | — |
+- Use `--bwlimit` when sharing a link with other traffic.
 
-Compression reduces the data on the wire enough that the transfer becomes latency-bound rather than bandwidth-bound. On WAN, the best configuration runs 10.8× faster than the theoretical limit for uncompressed data, since zstd shrinks the 25 MB payload to a fraction of its original size over the wire.
+Always validate the compatibility behavior required by a deployment before
+replacing an existing rsync job.

RSYNC_COMPAT.md

@@ -6,11 +6,12 @@ This document maps rsync's full feature set to FastSync's current implementation
 
 | Status | Count | Description |
 |--------|-------|-------------|
-| ✅ Implemented | 34 | Feature works end-to-end |
+| ✅ Implemented | 54 | Feature works end-to-end |
 | 🔀 Alt Arg | 3 | Functionality exists but under different flag/semantics |
-| ⚠️ Partial | 1 | Flag parsed/stored but behavior incomplete |
+| ⚠️ Partial | 5 | Flag parsed/stored but behavior incomplete |
-| ❌ Not Implemented | 98 | Flag not recognized or no behavior |
+| 🔄 Compatibility No-op | 1 | Flag is accepted for CLI compatibility but has no effect |
-| **Total** | **136** | |
+| ❌ Not Implemented | 84 | Flag not recognized or no behavior |
+| **Total** | **147** | |
 
 ---
 
@@ -20,12 +21,12 @@ This document maps rsync's full feature set to FastSync's current implementation
 |------|-------------------|-----------------|-------|
 | `-a`, `--archive` | Archive mode is -rlptgoD | 🔀 Alt Arg | Maps to -c -m -M (compression + multithread + metadata) |
 | `-v`, `--verbose` | Increase verbosity | ✅ Implemented | Sets `log_level=DEBUG` |
-| `-q`, `--quiet` | Suppress non-error messages | ❌ Not Implemented | Removed because it had no effect |
+| `-q`, `--quiet` | Suppress non-error messages | ✅ Implemented | Suppresses client output while preserving errors |
 | `--help` | Show help | ✅ Implemented | Prints usage and exits; `-h` is not accepted |
 | `-V`, `--version` | Print version | ✅ Implemented | |
-| `--info=FLAGS` | Fine-grained info verbosity | ❌ Not Implemented | Removed because it had no effect |
+| `--info=FLAGS` | Fine-grained info verbosity | ✅ Implemented | Supports `copy`, `misc`, `skip`, `stats`, `all`, and `none`; explicit flags override `--verbose`, and `none` suppresses info output; unsupported names are rejected |
-| `--debug=FLAGS` | Fine-grained debug verbosity | ❌ Not Implemented | Removed because it had no effect |
+| `--debug=FLAGS` | Fine-grained debug verbosity | ✅ Implemented | `io`, `proto`, `pack`, and `util` are supported; `--debug=help` lists flags; other rsync categories are rejected |
-| `--stderr=MODE` | Change stderr output mode | ❌ Not Implemented | |
+| `--stderr=MODE` | Change stderr output mode | ⚠️ Partial | `errors` (default) and `all` are supported; `client` is rejected because FastSync has no rsync message channel |
 | `--no-motd` | Suppress daemon MOTD | ❌ Not Implemented | |
 | `--exclude=PATTERN` | Exclude files matching pattern | ✅ Implemented | Glob matching in scanner |
 | `--include=PATTERN` | Include files matching pattern | ✅ Implemented | Glob matching in scanner |
@@ -36,15 +37,15 @@ This document maps rsync's full feature set to FastSync's current implementation
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
 | `--stats` | Give transfer stats | ✅ Implemented | Prints file/byte counts |
-| `-h`, `--human-readable` | Human-readable numbers | ❌ Not Implemented | Removed because it had no effect |
+| `-h`, `--human-readable` | Human-readable numbers | ✅ Implemented | Formats transfer byte sizes using binary units |
-| `-i`, `--itemize-changes` | Per-file change summary | ❌ Not Implemented | Removed because it had no effect |
+| `-i`, `--itemize-changes` | Per-file change summary | ✅ Implemented | Prints rsync-style `>f+++++++++` lines to stdout only for files actually sent (also under `-m`); unchanged files print nothing, matching single-`-i` behavior |
 | `--progress` | Show progress | ✅ Implemented | Progress callback in sender |
-| `-P` | Same as --partial --progress | ❌ Not Implemented | |
+| `-P` | Same as --partial --progress | ⚠️ Partial | Parses and enables progress, but interrupted files are not retained for resumable transfers |
-| `--out-format=FORMAT` | Custom output format | ❌ Not Implemented | Removed because it had no effect |
+| `--out-format=FORMAT` | Custom output format | ✅ Implemented | Per-transfer template on stdout; tokens `%f` `%n` `%l` `%b` `%M` `%%` (`%b` is the source length, always `== %l`; post-compression/delta wire bytes are not counted); unknown escapes preserved |
 | `--log-file=FILE` | Log to file | ✅ Implemented | `log_file` config field |
-| `--log-file-format=FMT` | Log format | ❌ Not Implemented | |
+| `--log-file-format=FMT` | Log format | ✅ Implemented | Requires `--log-file`; writes one template line per transferred file using the same token set as `--out-format` (including `%b` `==` source length) |
-| `--8-bit-output` | Leave high-bit chars unescaped | ❌ Not Implemented | |
+| `--8-bit-output`, `-8` | Leave high-bit chars unescaped | ✅ Implemented | Applies to displayed paths and protocol debug output |
-| `--list-only` | List files instead of copying | ❌ Not Implemented | Removed because it had no effect |
+| `--list-only` | List files instead of copying | ✅ Implemented | `ls -l`-style listing of files that would be transferred; scans the source only, contacts no server, writes nothing; also works with `-n` |
 
 ## 3. File Selection
 
@@ -58,11 +59,13 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `--max-size=SIZE` | Skip files larger than SIZE | ✅ Implemented | `max_size` in scanner |
 | `--min-size=SIZE` | Skip files smaller than SIZE | ✅ Implemented | `min_size` in scanner |
 | `-I`, `--ignore-times` | Don't skip files matching size+time | ❌ Not Implemented | |
-| `--size-only` | Skip based on size only | ❌ Not Implemented | |
+| `--size-only` | Skip based on size only | ✅ Implemented | With `--incremental`, ignores mtime |
-| `-@`, `--modify-window=NUM` | Mod-time comparison accuracy | ❌ Not Implemented | |
+| `-@`, `--modify-window=NUM` | Mod-time comparison accuracy | ✅ Implemented | Whole-second tolerance with nanosecond-aware comparisons |
-| `--existing` | Skip creating new files on receiver | ❌ Not Implemented | |
+| `--existing` | Skip creating new files on receiver | ✅ Implemented | Existing destination files continue through normal update handling |
 | `--ignore-existing` | Skip updating existing files | ❌ Not Implemented | |
-| `--remove-source-files` | Sender removes synced files | ❌ Not Implemented | |
+| `--remove-source-files` | Sender removes regular files after confirmed transfer | ✅ Implemented | |
+| `-x`, `--one-file-system` | Do not cross filesystem boundaries | ❌ Not Implemented | |
+| `-F` | Add the default `.rsync-filter` rules | ❌ Not Implemented | |
 
 ## 4. Directory Options
 
@@ -71,7 +74,7 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `-r`, `--recursive` | Recurse into directories | ✅ Implemented | Default behavior |
 | `-R`, `--relative` | Use relative path names | ❌ Not Implemented | Removed because it had no effect |
 | `--no-implied-dirs` | Don't send implied dirs with -R | ❌ Not Implemented | |
-| `-d`, `--dirs` | Transfer dirs without recursing | ❌ Not Implemented | |
+| `-d`, `--dirs`, `--old-dirs`, `--old-d` | Transfer dirs without recursing | ❌ Not Implemented | The aliases are recognized and rejected explicitly; they depend on the unimplemented `--dirs` behavior |
 | `--mkpath` | Create missing path components | ❌ Not Implemented | |
 
 ## 5. Transfer Modifications
@@ -94,6 +97,7 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `--backup-dir=DIR` | Backup directory hierarchy | ✅ Implemented | `backup_dir` config field |
 | `--suffix=SUFFIX` | Backup suffix (default ~) | ✅ Implemented | `suffix` config field |
 | `--delay-updates` | Put updated files in place at end | ❌ Not Implemented | |
+| `-T`, `--temp-dir=DIR` | Create temporary files in DIR | ❌ Not Implemented | `-T` is FastSync's timeout alias |
 
 ## 7. Deletion
 
@@ -101,7 +105,7 @@ This document maps rsync's full feature set to FastSync's current implementation
 |------|-------------------|-----------------|-------|
 | `--delete` | Delete extraneous files from dest | ✅ Implemented | `use_delete` config field |
 | `--delete-before` | Delete before transfer | ❌ Not Implemented | Removed because it had no effect |
-| `--delete-during` | Delete during transfer | ❌ Not Implemented | |
+| `--del`, `--delete-during` | Delete during transfer | ❌ Not Implemented | Both flags are recognized but rejected; delete timing is not implemented |
 | `--delete-delay` | Find deletions during, delete after | ❌ Not Implemented | |
 | `--delete-after` | Delete after transfer | ❌ Not Implemented | Removed because it had no effect |
 | `--delete-excluded` | Also delete excluded files | ❌ Not Implemented | Removed because it had no effect |
@@ -119,8 +123,8 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `-o`, `--owner` | Preserve owner | ✅ Implemented | Part of -M |
 | `-g`, `--group` | Preserve group | ✅ Implemented | Part of -M |
 | `-t`, `--times` | Preserve modification times | ✅ Implemented | Part of -M |
-| `-E`, `--executability` | Preserve executability | ❌ Not Implemented | |
+| `-E`, `--executability` | Preserve executability | ✅ Implemented | Preserves executable permission bits (implies metadata preservation) |
-| `--chmod=CHMOD` | Affect file permissions | ❌ Not Implemented | |
+| `--chmod=CHMOD` | Affect file permissions | ✅ Implemented | Supports numeric and symbolic `ugo` `rwx` changes; retains receiver safety masking |
 | `-A`, `--acls` | Preserve ACLs | ❌ Not Implemented | Removed because it had no effect |
 | `-X`, `--xattrs` | Preserve extended attributes | ❌ Not Implemented | Removed because it had no effect |
 | `-H`, `--hard-links` | Preserve hard links | ❌ Not Implemented | Removed because it had no effect |
@@ -135,6 +139,12 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `-J`, `--omit-link-times` | Omit symlinks from --times | ❌ Not Implemented | |
 | `--super` | Receiver attempts super-user activities | ❌ Not Implemented | |
 | `--fake-super` | Store/recover privileged attrs via xattrs | ❌ Not Implemented | |
+| `--open-noatime` | Avoid changing access time when opening files | ❌ Not Implemented | |
+| `--numeric-ids` | Do not map uid/gid by name | ❌ Not Implemented | |
+| `--usermap=STRING` | Map usernames | ❌ Not Implemented | |
+| `--groupmap=STRING` | Map group names | ❌ Not Implemented | |
+| `--chown=USER:GROUP` | Map owner and group | ❌ Not Implemented | |
+| `--copy-as=USER[:GROUP]` | Perform the copy as another user/group | ❌ Not Implemented | |
 
 ## 9. Symlink Handling
 
@@ -152,14 +162,14 @@ This document maps rsync's full feature set to FastSync's current implementation
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `-S`, `--sparse` | Sparse block handling | ✅ Implemented | `preserve_sparse` config field |
+| `-S`, `--sparse` | Sparse block handling | ⚠️ Partial | Flag is accepted, but full hole preservation is not implemented |
 | `--preallocate` | Allocate dest files before writing | ❌ Not Implemented | |
 
 ## 11. Checksum & Comparison
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `--checksum` | Skip based on checksum | ❌ Not Implemented | Removed because it had no effect; `-c` means compression |
+| `--checksum` | Skip based on checksum | ✅ Implemented | With `--incremental`, compares xxHash64 content checksums; `-c` remains compression |
 | `--checksum-choice=STR` | Choose checksum algorithm | ❌ Not Implemented | xxHash used internally |
 | `--compare-dest=DIR` | Compare dest files relative to DIR | ❌ Not Implemented | Removed because it had no effect |
 | `--copy-dest=DIR` | Include copies of unchanged files | ❌ Not Implemented | Removed because it had no effect |
@@ -171,10 +181,10 @@ This document maps rsync's full feature set to FastSync's current implementation
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
 | `-z`, `--compress` | Compress file data | 🔀 Alt Arg | Always uses zstd (rsync supports multiple algorithms) |
-| `--compress-choice=STR` | Choose compression algorithm | ❌ Not Implemented | Removed because it had no effect; FastSync always uses zstd |
+| `--compress-choice=STR`, `--zc=STR` | Choose compression algorithm | ✅ Implemented | FastSync supports `zstd` and `none` |
-| `--compress-level=NUM` | Set compression level | ✅ Implemented | 1-22, default 5 |
+| `--compress-level=NUM`, `--zl=NUM` | Set compression level | ✅ Implemented | 1-22, default 5 |
 | `--compress-threads=NUM` | Set compression threads | ❌ Not Implemented | |
-| `--skip-compress=LIST` | Skip compress for suffixes | ❌ Not Implemented | Internal skip for hardcoded types; not user-configurable |
+| `--skip-compress=LIST` | Skip compress for suffixes | ✅ Implemented | Comma-separated, case-insensitive suffix list; empty list skips none; incompatible with FastSync chunk serialization (`-s`) |
 
 ## 13. Connectivity
 
@@ -189,6 +199,7 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `--address=ADDRESS` | Bind address for outgoing socket | ❌ Not Implemented | Removed because it had no effect |
 | `-4`, `--ipv4` | Prefer IPv4 | ❌ Not Implemented | Removed because it had no effect |
 | `-6`, `--ipv6` | Prefer IPv6 | ❌ Not Implemented | Removed because it had no effect |
+| `--remote-option=OPT`, `-M` | Send an option only to the remote side | ❌ Not Implemented | `-M` is FastSync's metadata-preservation flag |
 
 ## 14. Daemon Mode
 
@@ -210,8 +221,9 @@ This document maps rsync's full feature set to FastSync's current implementation
 | Protocol version check | Verify compatible versions | ✅ Implemented | `config_receive()` |
 | Max data/string/chunk sizes | Prevent OOM attacks | ✅ Implemented | Per-message limits |
 | Per-connection memory limit | 1GB per connection | ✅ Implemented | `MAX_CONNECTION_MEMORY` |
+| `--max-alloc=SIZE` | Limit a single memory allocation | ✅ Implemented | Caps the largest single allocation; binary units, default 1G |
 | `--trust-sender` | Trust remote sender's file list | ❌ Not Implemented | |
-| `--old-args` | Disable modern arg protection | ❌ Not Implemented | |
+| `--old-args` | Disable modern arg protection | ✅ Implemented | SSH-only legacy mode; restores raw remote command construction and permits shell interpretation of the configured server path |
 | `--ignore-missing-args` | Ignore missing source args | ❌ Not Implemented | |
 | `--delete-missing-args` | Delete missing source args | ❌ Not Implemented | |
 
@@ -229,12 +241,118 @@ This document maps rsync's full feature set to FastSync's current implementation
 |------|-------------------|-----------------|-------|
 | `--stop-after=MINS` | Stop after N minutes | ❌ Not Implemented | |
 | `--stop-at=TIME` | Stop at specified time | ❌ Not Implemented | |
-| `--fsync` | Fsync every written file | ❌ Not Implemented | |
+| `--fsync` | Fsync every written file before publication | ✅ Implemented | |
 | `--protocol=NUM` | Force older protocol version | ❌ Not Implemented | |
 | `--iconv=CONVERT_SPEC` | Charset conversion | ❌ Not Implemented | |
 | `--checksum-seed=NUM` | Set checksum seed | ❌ Not Implemented | |
-| `-s`, `--secluded-args` | Use protocol to send args | ❌ Not Implemented | |
+| `--secluded-args` | Use protocol to send args | 🔄 Compatibility No-op | Accepted for CLI compatibility; it does not change FastSync transport or protocol behavior. `-s` remains chunk serialization. |
-| `--no-OPTION` | Turn off implied option | ❌ Not Implemented | |
+| `--no-OPTION` | Turn off implied option | ✅ Supported | Supported boolean FastSync options and archive-implied options; unsafe or value-taking options are rejected. |
+
+---
+
+## Implementation Difficulty Plan
+
+The estimates below cover the currently unimplemented features in this document. They assume one engineer familiar with the codebase, include implementation and focused tests, and exclude production rollout time. A feature should not be marked implemented until its behavior is tested in both local and SSH/TCP paths where applicable.
+
+> **Note:** This plan is a superset snapshot written while several of the listed features were still outstanding. The Summary matrix above is the authoritative record of what is already shipped (for example quiet/info/debug output, `--existing`, `--remove-source-files`, `-h`, and `--size-only` are now implemented on `dev`). Treat the phases as sequencing guidance for the work that remains unimplemented.
+
+| Effort | Typical duration | Meaning |
+|--------|------------------|---------|
+| XS | 0.5-1 day | CLI alias or a local formatting/validation change |
+| S | 1-3 days | Isolated behavior with little or no protocol change |
+| M | 3-7 days | Cross-cutting client, server, or scanner behavior |
+| L | 1-3 weeks | Protocol, filesystem, privilege, or compatibility work |
+| XL | 3+ weeks | New transfer mode, daemon subsystem, or broad interoperability effort |
+
+### Phase 1: Low-Risk CLI and Local Behavior
+
+These are the best first changes because they require limited wire-format work and can be tested with existing transfer fixtures.
+
+| Features | Effort | Implementation plan |
+|----------|--------|--------------------|
+| `--quiet`, `-q`; `--human-readable`, `-h`; `--8-bit-output`, `-8`; `--stderr=MODE`; `--info=FLAGS`; `--debug=FLAGS` | S | Extend logging and output formatting without changing transferred data. |
+| `--no-OPTION`; `--old-args`; `--secluded-args`, `-s` | M | Add option implication/negation and safely serialize or protect remote arguments. `-s` currently has FastSync-specific semantics and needs a compatibility decision. |
+| `-P`; `--del`; `--old-dirs`, `--old-d`; `--cc`; `--zc`; `--zl` | XS | Add aliases and composed behaviors after the underlying options exist. |
+| `--whole-file`, `-W`; `--ignore-times`, `-I`; `--size-only`; `--modify-window`, `-@`; `--update`, `-u` | S | Extend the existing incremental comparison decision. |
+| `--existing`; `--ignore-existing`; `--remove-source-files` | S | Add scanner/receiver eligibility checks and remove successfully synchronized source files. |
+| `--executability`, `-E`; `--chmod=CHMOD` | M | Apply permission transformations safely while preserving current metadata behavior. |
+| `--skip-compress=LIST`; `--compress-threads=NUM` | S | Make compression selection configurable and validate the thread setting against zstd behavior. |
+| `--max-alloc=SIZE`; `--fsync` | S | Reuse existing allocation limits and add an explicit durability step after file writes. |
+
+### Phase 2: Filesystem Selection and Update Semantics
+
+These features are moderate because they affect traversal, temporary files, manifests, or the receiver's update policy.
+
+| Features | Effort | Implementation plan |
+|----------|--------|--------------------|
+| `--one-file-system`, `-x` | M | Track the source device during scanner traversal and skip mount-point crossings. |
+| `--relative`, `-R`; `--no-implied-dirs`; `--dirs`, `-d`; `--mkpath` | M | Extend path-list construction and destination directory creation while preserving traversal safety. |
+| `--temp-dir`, `-T` | M | Separate temporary-file placement from FastSync's timeout alias and define collision, permissions, and cleanup rules. |
+| `--delay-updates` | L | Stage all successful updates and publish them at completion, including crash and cancellation cleanup. |
+| `--files-from=FILE`; `--from0`, `-0`; `--filter=RULE`, `-f`; `-F`; `--cvs-exclude`, `-C` | L | Build a complete filter/parser layer and integrate it with scanner pruning, manifests, and delete behavior. `-f` conflicts with FastSync sendfile mode. |
+| `--list-only`; `--itemize-changes`, `-i`; `--out-format=FORMAT`; `--log-file-format=FMT` | M | Add a structured change-event model so output modes share one source of truth. |
+
+### Phase 3: Deletion, Comparison, and Delta Compatibility
+
+These features require careful interaction with manifests, incremental checks, backups, and the existing delta protocol.
+
+| Features | Effort | Implementation plan |
+|----------|--------|--------------------|
+| `--delete-during`; `--delete-before`; `--delete-after`; `--delete-delay`; `--del` | L | Add deletion timing to the transfer state machine and ensure failures cannot remove files unexpectedly. |
+| `--delete-excluded`; `--max-delete=NUM`; `--ignore-errors`; `--force`; `--prune-empty-dirs`, `-m` | M | Extend delete walks with policy limits, error handling, empty-directory pruning, and the `-m` short-flag conflict. |
+| `--ignore-missing-args`; `--delete-missing-args` | M | Distinguish missing source arguments from traversal errors and apply explicit deletion policy. |
+| `--compare-dest=DIR`; `--copy-dest=DIR`; `--link-dest=DIR` | L | Add alternate basis roots and hard-link handling, including metadata and cross-filesystem failures. |
+| `--fuzzy`, `-y`; `--no-fuzzy` | L | Index candidate files and select a safe similar basis without making transfer time unbounded. |
+| `--append`; `--append-verify` | M | Negotiate file length and verify the retained prefix before resuming. |
+| `--checksum-choice=STR`, `--cc`; `--checksum-seed=NUM` | M | Negotiate checksum algorithms/seeds and preserve compatibility with existing xxHash checks. |
+
+### Phase 4: Metadata, Links, and Devices
+
+These features are platform-sensitive and need Linux permission, ACL, xattr, and special-file integration tests.
+
+| Features | Effort | Implementation plan |
+|----------|--------|--------------------|
+| `--numeric-ids`; `--usermap=STRING`; `--groupmap=STRING`; `--chown=USER:GROUP` | L | Define identity mapping, privilege failures, and wire representation before applying ownership. |
+| `--open-noatime`; `--atimes`, `-U`; `--crtimes`, `-N`; `--omit-dir-times`, `-O`; `--omit-link-times`, `-J` | L | Extend metadata capture/apply with platform capability checks and explicit unsupported-attribute handling. |
+| `--acls`, `-A`; `--xattrs`, `-X`; `--fake-super` | XL | Add portable serialization, size limits, privilege behavior, and security tests for ACL/xattr data. |
+| `--hard-links`, `-H` | L | Preserve inode relationships across the file list and coordinate hard-link creation order. |
+| `--munge-links`; `--copy-dirlinks`, `-k`; `--keep-dirlinks`, `-K` | L | Define symlink trust boundaries and receiver-side directory/link collision behavior. |
+| `--devices`; `--specials`; `-D`; `--copy-devices`; `--write-devices` | XL | Add privileged special-file handling with strict type, path, and authorization checks. |
+| `--super`; `--copy-as=USER[:GROUP]` | XL | Requires a deliberate privilege model, identity switching, and refusal paths; do not implement by blindly elevating the process. |
+| `--preallocate` | S | Use platform allocation APIs before writes and fall back cleanly when unsupported. |
+
+### Phase 5: Connectivity and Daemon Compatibility
+
+These options affect process startup, authentication, sockets, and remote execution. They should follow the filesystem and protocol work rather than being added as parser-only flags.
+
+| Features | Effort | Implementation plan |
+|----------|--------|--------------------|
+| `--rsh=COMMAND`, `-e`; `--rsync-path=PROGRAM`; `--blocking-io`; `--outbuf=N\|L\|B` | M | Generalize SSH command construction and subprocess I/O while retaining argument escaping and timeout guarantees. |
+| `--address=ADDRESS`; `--ipv4`, `-4`; `--ipv6`, `-6`; `--sockopts=OPTIONS`; `--port=PORT` daemon semantics | M | Add explicit socket-family/bind configuration and validate it independently for TCP client and daemon modes. |
+| `--remote-option=OPT`, `-M`; `--trust-sender` | L | Add authenticated remote-option/config negotiation and reject unsafe sender-controlled values. `-M` conflicts with FastSync metadata mode. |
+| `--daemon`; `--config=FILE`; `--dparam=OVERRIDE`; `--no-detach`; `--password-file=FILE`; `--early-input=FILE`; `--no-motd` | XL | Implement a real daemon lifecycle, module configuration, authentication, privilege separation, and process management. |
+
+### Phase 6: Batch, Encoding, and Protocol Interoperability
+
+These are the hardest compatibility items because they require durable formats or behavior that must interoperate with rsync itself.
+
+| Features | Effort | Implementation plan |
+|----------|--------|--------------------|
+| `--write-batch=FILE`; `--only-write-batch=FILE`; `--read-batch=FILE` | XL | Specify a versioned batch format, persist all required metadata, and test replay, corruption, and partial application. |
+| `--protocol=NUM` | XL | Add protocol-version negotiation and compatibility branches without weakening current validation. |
+| `--iconv=CONVERT_SPEC` | L | Convert filenames at the protocol boundary with invalid-sequence and normalization tests. |
+| `--stop-after=MINS`; `--stop-at=TIME` | M | Add deadline propagation, interruptible I/O, and safe checkpoint/cleanup behavior. |
+| `--early-input=FILE`; `--password-file=FILE` | M | Securely read startup credentials/input with permission checks and no secret disclosure in logs. |
+
+### Recommended Delivery Order
+
+1. Resolve short-option conflicts (`-m`, `-M`, `-T`, `-f`, `-s`) and define the compatibility contract.
+2. Implement Phase 1 comparison, update, output, and alias features with unit and integration coverage.
+3. Implement Phase 2 traversal/filtering and Phase 3 deletion semantics.
+4. Implement metadata and link features that are safe on the supported platforms.
+5. Treat daemon mode, special files, batch mode, and protocol-version compatibility as separate projects.
+
+The existing priority list below is a feature shortlist, not an implementation schedule; this plan supersedes it for effort and sequencing.
 
 ---
 
@@ -247,13 +365,14 @@ Ranked by user demand, implementation complexity, and interoperability impact:
 | 1 | `--whole-file` / `-W` | Low | High — users expect opt-out of delta |
 | 2 | `--ignore-times` / `-I` | Low | Medium — useful for forcing re-transfer |
 | 3 | `--size-only` | Low | Medium — common migration scenario |
-| 4 | `--existing` / `--ignore-existing` | Low | Medium — common sync patterns |
+| 4 | `--ignore-existing` | Low | Medium — common sync patterns |
-| 5 | `--remove-source-files` | Low | High — common for moves/backup |
+| 5 | `--existing` | Low | Medium — common sync patterns |
-| 6 | `--delete-during` | Medium | High — performance improvement |
+| 6 | `--remove-source-files` | Low | High — common for moves/backup |
-| 7 | `--delay-updates` | Medium | High — atomic updates |
+| 7 | `--delete-during` | Medium | High — performance improvement |
-| 8 | `--chmod` | Low | Medium — permission flexibility |
+| 8 | `--delay-updates` | Medium | High — atomic updates |
-| 9 | `--executability` / `-E` | Low | Low — simple flag |
+| 9 | `--chmod` | Low | Medium — permission flexibility |
-| 10 | `--skip-compress` | Low | Medium — performance tuning |
+| 10 | `--executability` / `-E` | Low | Low — simple flag |
+| 11 | `--skip-compress` | Low | Medium — performance tuning |
 
 ---
 

src/client/change_list.c

@@ -0,0 +1,310 @@
+#include "change_list.h"
+#include "utils.h"
+#include <limits.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <time.h>
+
+/* Itemize code emitted for a transferred regular file.
+ *
+ * Layout (rsync-compatible 11-char item): `>f` marks a regular file that was
+ * transferred to the remote host; the trailing nine markers are, in order,
+ * c(hecksum) s(ize) t(ime) p(erms) o(wner) g(roup) u(ser/acl) a(ttrs) x(attrs).
+ * Every marker is `+` (FastSync does not compare each attribute on the
+ * receiving side, so a sent file is reported as fully updated).  Files that
+ * are already up to date print no line at all, matching rsync's single -i
+ * which only itemizes changes.
+ *
+ * Because the scanner only yields regular-file transfer candidates, `>d`
+ * (directory) lines are never produced; directories are not transferred as
+ * items by FastSync. */
+#define ITEMIZE_SENT_FILE ">f+++++++++"
+
+typedef struct {
+  char* data;
+  size_t length;
+  size_t capacity;
+} StrBuf;
+
+static void strbuf_free(StrBuf* buf) {
+  if (buf == NULL)
+    return;
+  free(buf->data);
+  buf->data = NULL;
+  buf->length = 0;
+  buf->capacity = 0;
+}
+
+static bool strbuf_reserve(StrBuf* buf, size_t extra) {
+  if (buf->length > SIZE_MAX - extra - 1)
+    return false;
+  size_t need = buf->length + extra + 1;
+  if (need <= buf->capacity)
+    return true;
+  size_t capacity = buf->capacity > 0 ? buf->capacity : 32;
+  while (capacity < need) {
+    if (capacity > SIZE_MAX / 2) {
+      capacity = need;
+      break;
+    }
+    capacity *= 2;
+  }
+  char* grown = realloc(buf->data, capacity);
+  if (!grown)
+    return false;
+  buf->data = grown;
+  buf->capacity = capacity;
+  return true;
+}
+
+static bool strbuf_append_char(StrBuf* buf, char c) {
+  if (!strbuf_reserve(buf, 1))
+    return false;
+  buf->data[buf->length++] = c;
+  buf->data[buf->length] = '\0';
+  return true;
+}
+
+static bool strbuf_append(StrBuf* buf, const char* text) {
+  if (text == NULL)
+    return true;
+  size_t length = strlen(text);
+  if (!strbuf_reserve(buf, length))
+    return false;
+  memcpy(buf->data + buf->length, text, length);
+  buf->length += length;
+  buf->data[buf->length] = '\0';
+  return true;
+}
+
+static bool strbuf_append_ull(StrBuf* buf, unsigned long long value) {
+  char digits[32];
+  int written = snprintf(digits, sizeof(digits), "%llu", value);
+  if (written < 0 || (size_t)written >= sizeof(digits))
+    return false;
+  return strbuf_append(buf, digits);
+}
+
+static bool strbuf_append_longlong(StrBuf* buf, long long value) {
+  char digits[32];
+  int written = snprintf(digits, sizeof(digits), "%lld", value);
+  if (written < 0 || (size_t)written >= sizeof(digits))
+    return false;
+  return strbuf_append(buf, digits);
+}
+
+bool change_list_enabled(const Config* config) {
+  return config != NULL && (config->itemize_changes || config->out_format != NULL ||
+                            (config->log_file != NULL && config->log_file_format != NULL));
+}
+
+char* change_render_itemize(const ChangeEvent* event) {
+  if (event == NULL || event->decision != CHANGE_SENT)
+    return str_dup("");
+  const char* code = event->is_directory ? ">d+++++++++" : ITEMIZE_SENT_FILE;
+  StrBuf line = {0};
+  bool ok = strbuf_append(&line, code) && strbuf_append(&line, " ") &&
+            strbuf_append(&line, event->path != NULL ? event->path : "");
+  if (!ok) {
+    strbuf_free(&line);
+    return NULL;
+  }
+  return line.data;
+}
+
+static const char* leaf_name(const char* path) {
+  if (path == NULL)
+    return "";
+  const char* slash = strrchr(path, '/');
+  return slash != NULL && slash[1] != '\0' ? slash + 1 : path;
+}
+
+char* change_render_format(const char* format, const ChangeEvent* event) {
+  if (format == NULL)
+    return NULL;
+  StrBuf line = {0};
+  bool ok = true;
+  for (const char* p = format; *p != '\0' && ok;) {
+    if (*p != '%') {
+      ok = strbuf_append_char(&line, *p);
+      p++;
+      continue;
+    }
+    char token = p[1];
+    if (token == '\0') {
+      ok = strbuf_append_char(&line, '%');
+      break;
+    }
+    switch (token) {
+    case '%':
+      ok = strbuf_append_char(&line, '%');
+      break;
+    case 'f':
+      ok = strbuf_append(&line, event->path != NULL ? event->path : "");
+      break;
+    case 'n':
+      ok = strbuf_append(&line, leaf_name(event->path));
+      break;
+    case 'l':
+      ok = strbuf_append_ull(&line, event->size);
+      break;
+    case 'b':
+      ok = strbuf_append_ull(&line, event->bytes_sent);
+      break;
+    case 'M':
+      ok = strbuf_append_longlong(&line, (long long)event->mtime_sec);
+      break;
+    default:
+      /* Unknown escape sequences are preserved verbatim. */
+      ok = strbuf_append_char(&line, '%') && strbuf_append_char(&line, token);
+      break;
+    }
+    p += 2;
+  }
+  if (!ok) {
+    strbuf_free(&line);
+    return NULL;
+  }
+  if (line.data == NULL) {
+    line.data = str_dup("");
+    if (!line.data)
+      return NULL;
+  }
+  return line.data;
+}
+
+/* Format a mode as an `ls -l` permission string, e.g. `-rw-r--r--`. */
+static void mode_to_ls_string(mode_t mode, char out[11]) {
+  out[0] = S_ISDIR(mode)    ? 'd'
+           : S_ISLNK(mode)  ? 'l'
+           : S_ISCHR(mode)  ? 'c'
+           : S_ISBLK(mode)  ? 'b'
+           : S_ISFIFO(mode) ? 'p'
+           : S_ISSOCK(mode) ? 's'
+                            : '-';
+  mode_t bits = mode & 07777;
+  out[1] = (bits & S_IRUSR) ? 'r' : '-';
+  out[2] = (bits & S_IWUSR) ? 'w' : '-';
+  out[3] = (bits & S_IXUSR) ? (bits & S_ISUID ? 's' : 'x') : (bits & S_ISUID ? 'S' : '-');
+  out[4] = (bits & S_IRGRP) ? 'r' : '-';
+  out[5] = (bits & S_IWGRP) ? 'w' : '-';
+  out[6] = (bits & S_IXGRP) ? (bits & S_ISGID ? 's' : 'x') : (bits & S_ISGID ? 'S' : '-');
+  out[7] = (bits & S_IROTH) ? 'r' : '-';
+  out[8] = (bits & S_IWOTH) ? 'w' : '-';
+  out[9] = (bits & S_IXOTH) ? (bits & S_ISVTX ? 't' : 'x') : (bits & S_ISVTX ? 'T' : '-');
+  out[10] = '\0';
+}
+
+char* change_render_list_line(mode_t mode, unsigned long long size, time_t mtime,
+                              const char* path) {
+  char permission[11];
+  mode_to_ls_string(mode, permission);
+  char date[32];
+  struct tm broken_down;
+  if (localtime_r(&mtime, &broken_down) != NULL) {
+    if (strftime(date, sizeof(date), "%Y/%m/%d %H:%M:%S", &broken_down) == 0)
+      snprintf(date, sizeof(date), "?");
+  } else {
+    snprintf(date, sizeof(date), "?");
+  }
+  StrBuf line = {0};
+  char size_field[32];
+  int written = snprintf(size_field, sizeof(size_field), "%llu", size);
+  if (written < 0 || (size_t)written >= sizeof(size_field)) {
+    strbuf_free(&line);
+    return NULL;
+  }
+  bool ok = strbuf_append(&line, permission) && strbuf_append_char(&line, ' ') &&
+            strbuf_append(&line, size_field) && strbuf_append_char(&line, ' ') &&
+            strbuf_append(&line, date) && strbuf_append_char(&line, ' ') &&
+            strbuf_append(&line, path != NULL ? path : "");
+  if (!ok) {
+    strbuf_free(&line);
+    return NULL;
+  }
+  return line.data;
+}
+
+static void print_escaped_line(FILE* stream, const char* line, bool eight_bit_output) {
+  char* escaped = output_escape(line, eight_bit_output);
+  if (escaped != NULL) {
+    fprintf(stream, "%s\n", escaped);
+    free(escaped);
+  } else {
+    fprintf(stream, "%s\n", line);
+  }
+  fflush(stream);
+}
+
+void change_emit(const Config* config, const ChangeEvent* event) {
+  if (event == NULL || !change_list_enabled(config))
+    return;
+  if (event->decision == CHANGE_UP_TO_DATE)
+    return;
+  bool to_stdout = config->itemize_changes || config->out_format != NULL;
+  bool to_log = config->log_file != NULL && config->log_file_format != NULL;
+  if (to_stdout) {
+    char* line = config->out_format != NULL ? change_render_format(config->out_format, event)
+                                            : change_render_itemize(event);
+    if (line != NULL) {
+      print_escaped_line(stdout, line, config->eight_bit_output);
+      free(line);
+    }
+  }
+  if (to_log) {
+    char* line = change_render_format(config->log_file_format, event);
+    if (line != NULL) {
+      print_escaped_line(config->log_file, line, config->eight_bit_output);
+      free(line);
+    }
+  }
+}
+
+static bool format_uses_mtime(const char* format) {
+  if (format == NULL)
+    return false;
+  /* Mirror change_render_format's tokenizer: "%%" is a literal percent (so
+   * "%%M" does NOT expand %M) and unknown "%X" escapes consume both chars.
+   * This keeps the optional stat() fallback below in step with the renderer. */
+  for (const char* p = format; *p != '\0';) {
+    if (*p != '%') {
+      p++;
+      continue;
+    }
+    char token = p[1];
+    if (token == '\0')
+      break;
+    if (token == 'M')
+      return true;
+    p += 2;
+  }
+  return false;
+}
+
+void change_emit_file_sent(const Config* config, const File* file) {
+  if (file == NULL || !change_list_enabled(config))
+    return;
+  ChangeEvent event;
+  memset(&event, 0, sizeof(event));
+  event.path = file->path;
+  event.decision = CHANGE_SENT;
+  event.is_directory = false;
+  event.size = file->data != NULL ? file->data->size : 0;
+  /* FastSync has no wire-byte counter yet, so %b reports the source length
+   * that had to be delivered (always equal to %l); the actual bytes written
+   * to the socket (compressed/delta) are not measured. */
+  event.bytes_sent = event.size;
+  if (file->metadata != NULL) {
+    event.mtime_sec = file->metadata->mtime_sec;
+  } else if (format_uses_mtime(config->out_format) || format_uses_mtime(config->log_file_format)) {
+    /* Best-effort fallback for %M when no metadata was captured (no -M): the
+     * path is stat()ed just to fill the field, and any failure leaves 0. */
+    struct stat st;
+    if (file->path != NULL && stat(file->path, &st) == 0)
+      event.mtime_sec = st.st_mtime;
+  }
+  change_emit(config, &event);
+}

src/client/change_list.h

@@ -0,0 +1,75 @@
+#ifndef CHANGE_LIST_H
+#define CHANGE_LIST_H
+
+#include "config.h"
+#include "file_types.h"
+#include <stdbool.h>
+#include <sys/stat.h>
+#include <time.h>
+
+/*
+ * Shared per-file change-event / output model (rsync --itemize-changes,
+ * --out-format, --log-file-format, and --list-only all render from here).
+ *
+ * FastSync is a push-style tool: the client sends files from the source tree
+ * to a server that writes them under the destination root.  Events are
+ * emitted by whichever code path decides a file's fate (the single-threaded
+ * send loop and the `-m` sender thread both call the same per-file sender), so
+ * all change events are emitted by exactly one thread and itemize/out-format
+ * lines never interleave with each other.  They may still interleave with
+ * legacy log messages (log.c) that share the same stdout/log-file stream.
+ */
+
+typedef enum {
+  CHANGE_SENT,       /* file data (full or delta) was transmitted */
+  CHANGE_UP_TO_DATE, /* receiver already had an identical file; skipped */
+} ChangeDecision;
+
+typedef struct {
+  const char* path; /* full source path */
+  ChangeDecision decision;
+  bool is_directory;
+  unsigned long long size; /* source file length in bytes */
+  /* The number of bytes reported for a sent file. FastSync has no wire-byte
+   * counter, so this is always the source length (== size / %l); actual
+   * post-compression/delta bytes on the wire are not counted. */
+  unsigned long long bytes_sent;
+  time_t mtime_sec; /* 0 when unknown */
+} ChangeEvent;
+
+/* True when any output mode is active and per-file events matter. */
+bool change_list_enabled(const Config* config);
+
+/* Render the rsync-style itemize line for a transferred file:
+ *   `>f+++++++++ <path>`
+ * The 11-char code is `>f` (regular file transferred to the remote host)
+ * followed by c/s/t/p/o/g/u/a/x markers that are all `+` (value will be set
+ * / differs) because FastSync does not separately compare checksums, size,
+ * mtime, perms, owner, group, uid, acl, or xattr on the receiving side, so a
+ * sent file is reported as fully updated.  Up-to-date files print no line
+ * (rsync single `-i` only shows changes).  Caller frees the result. */
+char* change_render_itemize(const ChangeEvent* event);
+
+/* Expand an --out-format/--log-file-format template.  Tokens:
+ *   %f  full source path        %b  "bytes sent" == the source length (%l);
+ *   %n  leaf (base) name            actual post-compression/delta wire bytes
+ *   %l  file length in bytes        are not counted
+ *   %M  mtime in whole seconds      %%  a literal percent sign
+ * Unknown %X sequences are preserved verbatim.  Caller frees the result. */
+char* change_render_format(const char* format, const ChangeEvent* event);
+
+/* Render one --list-only long-listing entry:
+ *   `-rw-r--r--           12 2026/09/06 10:00:00 <path>`
+ * (ls -l style columns; mtime in the local time zone).  Caller frees it. */
+char* change_render_list_line(mode_t mode, unsigned long long size, time_t mtime, const char* path);
+
+/* Emit an event to every active destination:
+ *   stdout: --itemize-changes line, or the --out-format expansion when set;
+ *   log file: the --log-file-format expansion (requires --log-file).
+ * CHANGE_UP_TO_DATE events produce no output. */
+void change_emit(const Config* config, const ChangeEvent* event);
+
+/* Build and emit a CHANGE_SENT event for a file the client just sent. */
+void change_emit_file_sent(const Config* config, const File* file);
+
+#endif

src/client/client_send.c

@@ -1,5 +1,6 @@
 #include "client_send.h"
 #include "array_list.h"
+#include "change_list.h"
 #include "chunk.h"
 #include "compression.h"
 #include "config.h"
@@ -16,11 +17,14 @@
 #include "transport_ssh.h"
 #include "transport_tls.h"
 #include "utils.h"
+#include <fcntl.h>
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <threads.h>
 #include <time.h>
+#include <sys/stat.h>
 #include <unistd.h>
 
 #define STREAM_THRESHOLD (64ULL * 1024 * 1024)
@@ -28,6 +32,14 @@
 /* Forward declaration for progress-reporting thread used in multithreaded send. */
 static int progress_thread_fn(void* arg);
 
+static const char* display_bytes(unsigned long long bytes, bool human_readable, char* buffer,
+                                 size_t buffer_size) {
+  if (human_readable && format_human_bytes(bytes, buffer, buffer_size))
+    return buffer;
+  snprintf(buffer, buffer_size, "%.1f MB", bytes / 1048576.0);
+  return buffer;
+}
+
 static ScannerOptions scanner_options_from_config(const Config* config, int num_threads) {
   ScannerOptions options = {
       config->use_metadata,  config->chunk_size,        config->exclude_patterns,
@@ -42,11 +54,11 @@ static ScannerOptions scanner_options_from_config(const Config* config, int num_
 static Client* connect_transfer_client(const Config* config) {
   if (config->transport == TRANSPORT_SSH) {
     if (config->use_sendfile) {
-      fprintf(stderr, "Error: -f/--sendfile is not supported with SSH transport\n");
+      log_message(LOG_LEVEL_ERROR, "-f/--sendfile is not supported with SSH transport");
       return NULL;
     }
     return client_connect_ssh(config->ssh_destination, config->ssh_port,
-                              config->fastsync_server_path);
+                              config->fastsync_server_path, config->old_args);
   }
 
   Client* client = client_create();
@@ -60,6 +72,7 @@ static Client* connect_transfer_client(const Config* config) {
     connected = client_connect(client, config->server_host, config->server_port);
   }
   if (!connected) {
+    client_disconnect(client);
     client_delete(client);
     return NULL;
   }
@@ -97,10 +110,92 @@ static bool add_chunk_to_manifest(ArrayList* manifest, const Chunk* chunk) {
   return true;
 }
 
-static bool finalize_transfer(Client* client) {
+/* (finalize_transfer is defined after the SourceFile helpers below.) */
-  Status status;
+
-  return send_status(client->file_descriptor, STATUS_FINISHED) &&
+typedef struct SourceFile {
-         receive_status(client->file_descriptor, &status) && status == STATUS_OK;
+  char* path;
+  dev_t device;
+  ino_t inode;
+  bool skipped; /* receiver reported the file was not written */
+} SourceFile;
+
+static void source_file_destroy(void* item) {
+  SourceFile* source = item;
+  if (source) {
+    free(source->path);
+    free(source);
+  }
+}
+
+/* Remove only the same regular source file that was sent. */
+static void remove_transferred_sources(const Config* config, ArrayList* paths) {
+  if (!config->remove_source_files || !paths)
+    return;
+  for (int i = 0; i < paths->size; i++) {
+    SourceFile* source = paths->items[i];
+    if (source->skipped)
+      continue;
+    const char* slash = strrchr(source->path, '/');
+    const char* leaf = slash ? slash + 1 : source->path;
+    char parent[PATH_MAX];
+    if (slash) {
+      size_t parent_length = (size_t)(slash - source->path);
+      if (parent_length == 0)
+        parent_length = 1;
+      if (parent_length >= sizeof(parent))
+        continue;
+      memcpy(parent, source->path, parent_length);
+      parent[parent_length] = '\0';
+    } else {
+      (void)snprintf(parent, sizeof(parent), ".");
+    }
+
+    int dirfd = open(parent, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+    if (dirfd < 0)
+      continue;
+    struct stat st;
+    if (fstatat(dirfd, leaf, &st, AT_SYMLINK_NOFOLLOW) != 0 || !S_ISREG(st.st_mode) ||
+        st.st_dev != source->device || st.st_ino != source->inode) {
+      close(dirfd);
+      continue;
+    }
+    if (unlinkat(dirfd, leaf, 0) != 0)
+      log_message(LOG_LEVEL_WARNING, "Could not remove source file %s", source->path);
+    close(dirfd);
+  }
+}
+
+static SourceFile* source_file_create(const File* file) {
+  if (!file || !file->path)
+    return NULL;
+  struct stat st;
+  if (lstat(file->path, &st) != 0 || !S_ISREG(st.st_mode))
+    return NULL;
+  SourceFile* source = malloc(sizeof(*source));
+  if (!source)
+    return NULL;
+  source->path = str_dup(file->path);
+  source->device = st.st_dev;
+  source->inode = st.st_ino;
+  source->skipped = false;
+  if (!source->path) {
+    source_file_destroy(source);
+    return NULL;
+  }
+  return source;
+}
+
+static bool remember_source_file(ArrayList* paths, const File* file) {
+  if (!paths || !file || !file->path)
+    return true;
+  SourceFile* source = source_file_create(file);
+  if (!source)
+    return true;
+  if (!array_list_add(paths, source)) {
+    source_file_destroy(source);
+    return false;
+  }
+  return true;
 }
 
 static void mark_sender_done(PipelineContextSender* context) {
@@ -109,6 +204,33 @@ static void mark_sender_done(PipelineContextSender* context) {
   mtx_unlock(&context->mutex_progress);
 }
 
+/* Send the final STATUS_FINISHED frame and await the receiver's verdict.
+   When --remove-source-files is active the receiver acknowledges each data
+   file it processed, in send order: STATUS_NEXT means the file was written,
+   STATUS_OK means the file was skipped/unchanged.  Skipped sources are marked
+   so the later removal pass keeps them. */
+static bool finalize_transfer(Client* client, const Config* config, ArrayList* remove_sources) {
+  if (!send_status(client->file_descriptor, STATUS_FINISHED))
+    return false;
+  if (config->remove_source_files && remove_sources) {
+    for (int i = 0; i < remove_sources->size; i++) {
+      Status per_file;
+      if (!receive_status(client->file_descriptor, &per_file))
+        return false;
+      if (per_file == STATUS_ERROR)
+        return false;
+      if (per_file == STATUS_OK) {
+        ((SourceFile*)remove_sources->items[i])->skipped = true;
+      } else if (per_file != STATUS_NEXT) {
+        log_message(LOG_LEVEL_ERROR, "Unexpected per-file status from receiver");
+        return false;
+      }
+    }
+  }
+  Status status;
+  return receive_status(client->file_descriptor, &status) && status == STATUS_OK;
+}
+
 static void pipeline_cancel(PipelineContextSender* context) {
   mtx_lock(&context->mutex_scanner);
   mtx_lock(&context->mutex_loader);
@@ -133,22 +255,153 @@ static int send_dry_run_manifest(const Config* config) {
   Chunk* chunk;
   int file_count = 0;
   unsigned long long total_bytes = 0;
+  char size_buffer[32];
+  if (!config->quiet)
     printf("Dry run: files to be transferred\n");
   while ((chunk = directory_scanner_next(scanner)) != NULL) {
     for (int i = 0; i < chunk->element_count; i++) {
-      printf("  %s (%zu bytes)\n", chunk->items[i]->path, chunk->items[i]->data->size);
+      if (!config->quiet) {
+        char* escaped_path = output_escape(chunk->items[i]->path, config->eight_bit_output);
+        if (!escaped_path) {
+          chunk_destroy(chunk);
+          directory_scanner_destroy(scanner);
+          return -1;
+        }
+        if (config->human_readable)
+          printf(
+              "  %s (%s)\n", escaped_path,
+              display_bytes(chunk->items[i]->data->size, true, size_buffer, sizeof(size_buffer)));
+        else
+          printf("  %s (%zu bytes)\n", escaped_path, chunk->items[i]->data->size);
+        free(escaped_path);
+      }
       total_bytes += chunk->items[i]->data->size;
       file_count++;
     }
     chunk_destroy(chunk);
   }
   directory_scanner_destroy(scanner);
+  if (!config->quiet) {
+    if (config->human_readable)
+      printf("Total: %d files, %s\n", file_count,
+             display_bytes(total_bytes, true, size_buffer, sizeof(size_buffer)));
+    else
       printf("Total: %d files, %.1f MB\n", file_count, total_bytes / 1048576.0);
+  }
+  return 0;
+}
+
+typedef struct {
+  char* path;
+  mode_t mode;
+  unsigned long long size;
+  time_t mtime;
+} ListEntry;
+
+static void list_entries_destroy(ListEntry* entries, size_t count) {
+  if (entries == NULL)
+    return;
+  for (size_t i = 0; i < count; i++)
+    free(entries[i].path);
+  free(entries);
+}
+
+static int compare_list_entries(const void* left, const void* right) {
+  const ListEntry* a = (const ListEntry*)left;
+  const ListEntry* b = (const ListEntry*)right;
+  return strcmp(a->path, b->path);
+}
+
+/* --list-only: print an ls-style listing of the files that WOULD be
+ * transferred and exit without contacting the server or writing anything.
+ * Directory lines are not printed because the scanner only yields regular
+ * transfer candidates. Returns 0 on success, 1 on error. */
+static int send_list_only(const Config* config) {
+  ScannerOptions options = scanner_options_from_config(config, 0);
+  options.use_metadata = true; /* capture mode + mtime for the listing */
+  DirectoryScanner* scanner =
+      directory_scanner_create_with_options(config->send_directory, &options);
+  if (!scanner)
+    return 1;
+  ListEntry* entries = NULL;
+  size_t count = 0;
+  size_t capacity = 0;
+  Chunk* chunk;
+  bool oom = false;
+  while ((chunk = directory_scanner_next(scanner)) != NULL) {
+    for (int i = 0; i < chunk->element_count; i++) {
+      File* f = chunk->items[i];
+      if (f == NULL)
+        continue;
+      if (count == capacity) {
+        size_t new_capacity = capacity > 0 ? capacity * 2 : 64;
+        if (new_capacity <= capacity) {
+          oom = true;
+          break;
+        }
+        ListEntry* grown = realloc(entries, new_capacity * sizeof(ListEntry));
+        if (!grown) {
+          oom = true;
+          break;
+        }
+        entries = grown;
+        capacity = new_capacity;
+      }
+      char* path = str_dup(f->path);
+      if (!path) {
+        oom = true;
+        break;
+      }
+      mode_t mode = 0;
+      time_t mtime = 0;
+      if (f->metadata != NULL) {
+        mode = f->metadata->mode;
+        mtime = f->metadata->mtime_sec;
+      } else {
+        struct stat st;
+        if (stat(f->path, &st) == 0) {
+          mode = st.st_mode;
+          mtime = st.st_mtime;
+        }
+      }
+      entries[count].path = path;
+      entries[count].mode = mode;
+      entries[count].mtime = mtime;
+      entries[count].size = f->data != NULL ? f->data->size : 0;
+      count++;
+    }
+    chunk_destroy(chunk);
+    if (oom)
+      break;
+  }
+  bool failed = oom || directory_scanner_failed(scanner);
+  directory_scanner_destroy(scanner);
+  if (failed) {
+    list_entries_destroy(entries, count);
+    if (oom)
+      log_message(LOG_LEVEL_ERROR, "memory allocation failed while listing");
+    return 1;
+  }
+  if (count > 1)
+    qsort(entries, count, sizeof(ListEntry), compare_list_entries);
+  for (size_t i = 0; i < count; i++) {
+    char* line = change_render_list_line(entries[i].mode, entries[i].size, entries[i].mtime,
+                                         entries[i].path);
+    if (line != NULL) {
+      char* escaped = output_escape(line, config->eight_bit_output);
+      printf("%s\n", escaped != NULL ? escaped : line);
+      free(escaped);
+      free(line);
+    }
+  }
+  list_entries_destroy(entries, count);
   return 0;
 }
 
 /* Send the delete manifest (list of files) to the server. Returns 0 on success, -1 on failure. */
 static int send_delete_manifest(int fd, ArrayList* manifest) {
+  if (!manifest)
+    return -1;
   if (!send_status(fd, STATUS_MANIFEST))
     return -1;
   if (!send_int(fd, manifest->size))
@@ -169,10 +422,13 @@ static int incremental_check(Client* client, File* file, const Config* config,
     return -1;
   unsigned long long fsize = file->data->size;
   long long mtime = file->metadata ? file->metadata->mtime_sec : 0;
+  long long mtime_nsec = file->metadata ? file->metadata->mtime_nsec : 0;
   if (!send_n_data(client->file_descriptor, &fsize, sizeof(fsize)))
     return -1;
   if (!send_n_data(client->file_descriptor, &mtime, sizeof(mtime)))
     return -1;
+  if (!send_n_data(client->file_descriptor, &mtime_nsec, sizeof(mtime_nsec)))
+    return -1;
   if (config->checksum) {
     uint64_t checksum;
     if (!file_checksum(file, &checksum) ||
@@ -190,17 +446,22 @@ static int incremental_check(Client* client, File* file, const Config* config,
     return 1;
   if (s == STATUS_DELTA_SIGNATURE) {
     Data* sig_data = receive_data(client->file_descriptor);
-    if (!sig_data)
+    if (!sig_data) {
+      send_status(client->file_descriptor, STATUS_ERROR);
       return -1;
+    }
     DeltaSignature* sig = delta_signature_deserialize(sig_data);
     data_destroy(sig_data);
-    if (!sig)
+    if (!sig) {
+      send_status(client->file_descriptor, STATUS_ERROR);
       return -1;
+    }
     *out_sig = sig;
     return 2;
   }
   if (s != STATUS_NEXT) {
     log_message(LOG_LEVEL_ERROR, "Unexpected server status");
+    send_status(client->file_descriptor, STATUS_ERROR);
     return -1;
   }
   return 0;
@@ -208,8 +469,10 @@ static int incremental_check(Client* client, File* file, const Config* config,
 
 static int send_delta(Client* client, File* file, DeltaSignature* sig, Config* config) {
   Delta* delta = delta_compute(file->data->data, file->data->size, sig, config->delta_block_size);
+  /* The receiver is blocked after sending the signature.  Every local
+     fallback therefore needs the explicit NEXT response before full data. */
   if (!delta)
-    return 1;
+    return send_status(client->file_descriptor, STATUS_NEXT) ? 1 : -1;
 
   if (!delta_is_worthwhile(delta, file->data->size)) {
     delta_destroy(delta);
@@ -221,14 +484,17 @@ static int send_delta(Client* client, File* file, DeltaSignature* sig, Config* c
   Data* delta_data = delta_serialize(delta);
   delta_destroy(delta);
   if (!delta_data)
-    return -1;
+    return send_status(client->file_descriptor, STATUS_NEXT) ? 1 : -1;
 
   Data* to_send = delta_data;
-  if (config->use_compression) {
+  int skip_count = config->skip_compress_set ? config->skip_compress_count : -1;
-    to_send = data_compress(delta_data, config->compression_level);
+  if (config->use_compression && !compression_should_skip_with_suffixes(
+                                     file->path, config->skip_compress_suffixes, skip_count)) {
+    to_send = data_compress_with_threads(delta_data, config->compression_level,
+                                         config->compression_threads);
     data_destroy(delta_data);
     if (!to_send)
-      return -1;
+      return send_status(client->file_descriptor, STATUS_NEXT) ? 1 : -1;
   }
 
   bool ok = send_status(client->file_descriptor, STATUS_DELTA_DATA) &&
@@ -241,20 +507,25 @@ static int send_delta(Client* client, File* file, DeltaSignature* sig, Config* c
   return ok ? 0 : -1;
 }
 
-typedef bool (*file_send_fn)(File*, int, bool, int, bool);
-
 // Send a single file directly (non-incremental path).
-static bool send_file_direct(File* file, int fd, bool use_metadata, int compression_level) {
+static bool send_file_direct(File* file, int fd, bool use_metadata, int compression_level,
+                             const Config* config) {
   if (!send_status(fd, STATUS_NEXT))
     return false;
-  return file_send_single_calls(file, fd, use_metadata, compression_level, true);
+  int skip_count = config->skip_compress_set ? config->skip_compress_count : -1;
+  return file_send_single_calls_with_skip(file, fd, use_metadata, compression_level, true,
+                                          config->skip_compress_suffixes, skip_count,
+                                          config->compression_threads);
 }
 
 // Send a single file directly via sendfile (non-incremental path).
-static bool send_file_direct_sendfile(File* file, int fd, bool use_metadata) {
+static bool send_file_direct_sendfile(File* file, int fd, bool use_metadata, const Config* config) {
   if (!send_status(fd, STATUS_NEXT))
     return false;
-  return file_send_sendfile(file, fd, use_metadata, 0, true);
+  int skip_count = config->skip_compress_set ? config->skip_compress_count : -1;
+  return file_send_sendfile_with_skip(file, fd, use_metadata, 0, true,
+                                      config->skip_compress_suffixes, skip_count,
+                                      config->compression_threads);
 }
 
 // Process one file in a chunk: either via incremental check or direct send.
@@ -262,13 +533,16 @@ static bool send_file_direct_sendfile(File* file, int fd, bool use_metadata) {
 static int send_single_file(Client* client, File* file, Config* config, bool use_incremental,
                             bool use_sendfile) {
   int compression_level = config->use_compression ? config->compression_level : 0;
+  log_info_message(LOG_INFO_COPY, "Transferring %s", file->path);
 
   if (!use_incremental) {
     if (use_sendfile) {
-      return send_file_direct_sendfile(file, client->file_descriptor, config->use_metadata) ? 0
+      return send_file_direct_sendfile(file, client->file_descriptor, config->use_metadata, config)
+                 ? 0
                  : -1;
     }
-    return send_file_direct(file, client->file_descriptor, config->use_metadata, compression_level)
+    return send_file_direct(file, client->file_descriptor, config->use_metadata, compression_level,
+                            config)
                ? 0
                : -1;
   }
@@ -278,6 +552,7 @@ static int send_single_file(Client* client, File* file, Config* config, bool use
     DeltaSignature* sig = NULL;
     int rc = incremental_check(client, file, config, &sig);
     if (rc == 1) {
+      log_info_message(LOG_INFO_SKIP, "Skipping unchanged %s", file->path);
       delta_signature_destroy(sig);
       return 1;
     }
@@ -294,13 +569,15 @@ static int send_single_file(Client* client, File* file, Config* config, bool use
         return -1;
     }
     // Fall through: send full file via sendfile (pass 0 for compression_level)
-    if (!file_send_sendfile(file, client->file_descriptor, config->use_metadata, 0, false))
+    int skip_count = config->skip_compress_set ? config->skip_compress_count : -1;
+    if (!file_send_sendfile_with_skip(file, client->file_descriptor, config->use_metadata, 0, false,
+                                      config->skip_compress_suffixes, skip_count,
+                                      config->compression_threads))
       return -1;
     return 0;
   }
 
   // Incremental path with single_calls (supports compression and delta)
-  file_send_fn send_fn = (file_send_fn)file_send_single_calls;
   DeltaSignature* sig = NULL;
   int rc = incremental_check(client, file, config, &sig);
   if (rc < 0) {
@@ -308,10 +585,11 @@ static int send_single_file(Client* client, File* file, Config* config, bool use
     return -1;
   }
   if (rc == 1) {
+    log_info_message(LOG_INFO_SKIP, "Skipping unchanged %s", file->path);
     delta_signature_destroy(sig);
     return 1;
   }
-  if (rc == 2 && config->use_delta) {
+  if (rc == 2 && config->use_delta && !config->whole_file) {
     int drc = send_delta(client, file, sig, config);
     delta_signature_destroy(sig);
     if (drc == 0)
@@ -328,18 +606,29 @@ static int send_single_file(Client* client, File* file, Config* config, bool use
         return -1;
     }
   }
-  if (!send_fn(file, client->file_descriptor, config->use_metadata, compression_level, false))
+  int skip_count = config->skip_compress_set ? config->skip_compress_count : -1;
+  if (!file_send_single_calls_with_skip(file, client->file_descriptor, config->use_metadata,
+                                        compression_level, false, config->skip_compress_suffixes,
+                                        skip_count, config->compression_threads))
     return -1;
   return 0;
 }
 
-int send_chunk(Client* client, Chunk* chunk, Config* config) {
+static int send_chunk_with_removal(Client* client, Chunk* chunk, Config* config,
+                                   ArrayList* remove_sources) {
   if (config->use_chunk_serialization) {
+    if (remove_sources) {
+      for (int i = 0; i < chunk->element_count; i++) {
+        if (!remember_source_file(remove_sources, chunk->items[i]))
+          return -1;
+      }
+    }
     if (!send_status(client->file_descriptor, STATUS_CHUNK))
       return -1;
     Data* data;
     if (config->use_compression) {
-      data = chunk_compress(chunk, config->compression_level, config->use_metadata);
+      data = chunk_compress_with_threads(chunk, config->compression_level, config->use_metadata,
+                                         config->compression_threads);
     } else {
       data = chunk_serialize(chunk, config->use_metadata);
     }
@@ -350,6 +639,10 @@ int send_chunk(Client* client, Chunk* chunk, Config* config) {
       return -1;
     }
     data_destroy(data);
+    for (int i = 0; i < chunk->element_count; i++) {
+      if (chunk->items[i] != NULL)
+        change_emit_file_sent(config, chunk->items[i]);
+    }
     return 0;
   }
 
@@ -358,23 +651,39 @@ int send_chunk(Client* client, Chunk* chunk, Config* config) {
     if (f == NULL)
       continue;
     bool stream = f->data->data == NULL && f->data->size > 0;
-    bool use_sendfile = (config->use_sendfile && !config->use_compression) || stream;
+    bool use_sendfile =
+        (config->use_sendfile && !config->use_compression) || (stream && !config->use_compression);
+    SourceFile* source = remove_sources ? source_file_create(f) : NULL;
     int rc = send_single_file(client, f, config, config->use_incremental, use_sendfile);
-    if (rc == 1)
+    if (rc == 1) {
+      source_file_destroy(source);
       continue;
-    if (rc < 0)
+    }
+    if (rc < 0) {
+      source_file_destroy(source);
       return -1;
     }
+    change_emit_file_sent(config, f);
+    if (source && !array_list_add(remove_sources, source)) {
+      source_file_destroy(source);
+      return -1;
+    }
+  }
   return 0;
 }
 
+int send_chunk(Client* client, Chunk* chunk, Config* config) {
+  return send_chunk_with_removal(client, chunk, config, NULL);
+}
+
 static int send_chunks_multithreaded(void* pipeline_context) {
   PipelineContextSender* context = (PipelineContextSender*)pipeline_context;
   Client* client = connect_transfer_client(context->config);
   if (!client) {
     if (context->config->transport == TRANSPORT_TCP)
-      fprintf(stderr, "Error: could not connect to server%s\n",
+      log_message(LOG_LEVEL_ERROR, "could not connect to server%s",
                   context->config->use_tls ? " via TLS" : "");
+    pipeline_cancel(context);
     mark_sender_done(context);
     return thrd_error;
   }
@@ -383,6 +692,7 @@ static int send_chunks_multithreaded(void* pipeline_context) {
   protocol_session_set_ssl(&session, (SSL*)client->ssl);
   protocol_session_bind(&session);
   if (!config_send(client->file_descriptor, context->config)) {
+    pipeline_cancel(context);
     disconnect_transfer_client(client);
     mark_sender_done(context);
     protocol_session_unbind();
@@ -394,11 +704,28 @@ static int send_chunks_multithreaded(void* pipeline_context) {
         context->queue_loader, &context->mutex_loader, &context->condition_not_empty_loader,
         &context->condition_not_full_loader, &context->loader_done);
     if (current_chunk == NULL) {
+      if (atomic_load(&context->cancelled)) {
+        pipeline_cancel(context);
+        disconnect_transfer_client(client);
+        mark_sender_done(context);
+        protocol_session_unbind();
+        return thrd_error;
+      }
       if (context->config->use_delete) {
         if (send_delete_manifest(client->file_descriptor, context->manifest) != 0)
           goto send_fail;
       }
-      bool ok = finalize_transfer(client);
+      bool ok = finalize_transfer(client, context->config, context->remove_source_files);
+      if (ok)
+        remove_transferred_sources(context->config, context->remove_source_files);
+      mtx_lock(&context->mutex_progress);
+      int total_files = context->total_files;
+      unsigned long long total_bytes = context->total_bytes;
+      mtx_unlock(&context->mutex_progress);
+      if (context->config->stats)
+        fprintf(stderr, "Stats: %d files, %.1f MB\n", total_files, total_bytes / 1048576.0);
+      log_info_message(LOG_INFO_STATS, "Transfer summary: %d files, %.1f MB", total_files,
+                       total_bytes / 1048576.0);
       disconnect_transfer_client(client);
       mark_sender_done(context);
       protocol_session_unbind();
@@ -411,8 +738,9 @@ static int send_chunks_multithreaded(void* pipeline_context) {
       protocol_session_unbind();
       return thrd_error;
     }
-    if (send_chunk(client, current_chunk, context->config) != 0) {
+    if (send_chunk_with_removal(client, current_chunk, context->config,
-      fprintf(stderr, "Error: unexpected error while sending chunk\n");
+                                context->remove_source_files) != 0) {
+      log_message(LOG_LEVEL_ERROR, "unexpected error while sending chunk");
       chunk_destroy(current_chunk);
       pipeline_cancel(context);
       disconnect_transfer_client(client);
@@ -420,30 +748,35 @@ static int send_chunks_multithreaded(void* pipeline_context) {
       protocol_session_unbind();
       return thrd_error;
     }
-    if (context->config->show_progress) {
     unsigned long long chunk_bytes = 0;
+    int chunk_files = 0;
     for (int i = 0; i < current_chunk->element_count; i++) {
-        if (current_chunk->items[i] && current_chunk->items[i]->data)
+      if (current_chunk->items[i] && current_chunk->items[i]->data) {
+        chunk_files++;
         chunk_bytes += current_chunk->items[i]->data->size;
       }
-      mtx_lock(&context->mutex_progress);
-      context->progress_bytes += chunk_bytes;
-      mtx_unlock(&context->mutex_progress);
     }
+    mtx_lock(&context->mutex_progress);
+    context->total_files += chunk_files;
+    context->total_bytes += chunk_bytes;
+    context->progress_bytes = context->total_bytes;
+    mtx_unlock(&context->mutex_progress);
     chunk_destroy(current_chunk);
   }
 }
 
 static int scan_directory_multithreaded(void* pipeline_context) {
   PipelineContextSender* context = (PipelineContextSender*)pipeline_context;
+  protocol_session_bind(&context->allocation_session);
   ScannerOptions options = scanner_options_from_config(context->config, 4);
-  ParallelScanner* scanner =
+  ParallelScanner* scanner = parallel_scanner_create_with_options(
-      parallel_scanner_create_with_options(context->config->send_directory, &options);
+      context->config->send_directory, &options, &context->allocation_session);
 
   Chunk* current_chunk;
   if (scanner == NULL) {
     log_message(LOG_LEVEL_ERROR, "Failed to create parallel scanner");
     pipeline_cancel(context);
+    protocol_session_unbind();
     return thrd_error;
   }
   while ((current_chunk = parallel_scanner_next(scanner)) != NULL) {
@@ -455,6 +788,7 @@ static int scan_directory_multithreaded(void* pipeline_context) {
         pipeline_cancel(context);
         chunk_destroy(current_chunk);
         parallel_scanner_destroy(scanner);
+        protocol_session_unbind();
         return thrd_error;
       }
     }
@@ -465,6 +799,7 @@ static int scan_directory_multithreaded(void* pipeline_context) {
       chunk_destroy(current_chunk);
       pipeline_cancel(context);
       parallel_scanner_destroy(scanner);
+      protocol_session_unbind();
       return thrd_error;
     }
   }
@@ -476,6 +811,7 @@ static int scan_directory_multithreaded(void* pipeline_context) {
     cnd_broadcast(&context->condition_not_full_scanner);
     mtx_unlock(&context->mutex_scanner);
     pipeline_cancel(context);
+    protocol_session_unbind();
     return thrd_error;
   }
   mtx_lock(&context->mutex_scanner);
@@ -484,11 +820,13 @@ static int scan_directory_multithreaded(void* pipeline_context) {
   mtx_unlock(&context->mutex_scanner);
 
   parallel_scanner_destroy(scanner);
+  protocol_session_unbind();
   return thrd_success;
 }
 
 static int load_files_multithreaded(void* pipeline_context) {
   PipelineContextSender* context = (PipelineContextSender*)pipeline_context;
+  protocol_session_bind(&context->allocation_session);
   while (true) {
     Chunk* chunk = queue_dequeue_multithreaded(
         context->queue_scanner, &context->mutex_scanner, &context->condition_not_empty_scanner,
@@ -498,17 +836,20 @@ static int load_files_multithreaded(void* pipeline_context) {
       context->loader_done = true;
       cnd_signal(&context->condition_not_empty_loader);
       mtx_unlock(&context->mutex_loader);
+      protocol_session_unbind();
       return thrd_success;
     }
     if (!context->config->use_sendfile) {
       for (int i = 0; i < chunk->element_count; i++) {
         File* f = chunk->items[i];
-        if (f->data->size > STREAM_THRESHOLD)
+        if (f->data->size > STREAM_THRESHOLD && !context->config->use_compression)
           continue;
         if (!file_load_data(f)) {
-          log_message(LOG_LEVEL_ERROR, "Failed to load file data, skipping");
+          log_message(LOG_LEVEL_ERROR, "Failed to load file data");
-          file_destroy(f);
+          chunk_destroy(chunk);
-          chunk->items[i] = NULL;
+          pipeline_cancel(context);
+          protocol_session_unbind();
+          return thrd_error;
         }
       }
     }
@@ -517,14 +858,34 @@ static int load_files_multithreaded(void* pipeline_context) {
                                             &context->condition_not_full_loader,
                                             &context->cancelled)) {
       chunk_destroy(chunk);
-      atomic_store(&context->cancelled, true);
+      pipeline_cancel(context);
-      cnd_broadcast(&context->condition_not_full_loader);
+      protocol_session_unbind();
-      cnd_broadcast(&context->condition_not_empty_loader);
       return thrd_error;
     }
   }
 }
 
+/* Print a one-line transfer progress report to stderr. `suffix` ends the
+   line (e.g. "Done.\n") or is "" for in-place refresh. Shared by the
+   single-threaded loop and the multithreaded progress thread. */
+static void print_transfer_progress(unsigned long long total_bytes, time_t start,
+                                    const char* suffix, bool human_readable) {
+  double elapsed = difftime(time(NULL), start);
+  double rate = elapsed > 0.0 ? total_bytes / (1048576.0 * elapsed) : 0.0;
+  if (human_readable) {
+    char total_buffer[32];
+    char rate_buffer[32];
+    fprintf(stderr, "\rSent %s  (%s/s)  %s",
+            display_bytes(total_bytes, true, total_buffer, sizeof(total_buffer)),
+            display_bytes((unsigned long long)(rate * 1048576.0), true, rate_buffer,
+                          sizeof(rate_buffer)),
+            suffix);
+  } else {
+    fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  %s", total_bytes / 1048576.0, rate, suffix);
+  }
+  fflush(stderr);
+}
+
 /* Progress-reporting thread for multithreaded send. Runs in parallel with
    the scanner/loader/sender threads and prints periodic progress to stderr. */
 static int progress_thread_fn(void* arg) {
@@ -539,20 +900,14 @@ static int progress_thread_fn(void* arg) {
     mtx_unlock(&context->mutex_progress);
 
     if (done) {
-      time_t now = time(NULL);
+      print_transfer_progress(total, start, "Done.\n", context->config->human_readable);
-      double elapsed = difftime(now, start);
-      double rate = elapsed > 0.0 ? total / (1048576.0 * elapsed) : 0.0;
-      fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  Done.\n", total / 1048576.0, rate);
       break;
     }
 
     time_t now = time(NULL);
     if (now - last_progress >= 1) {
       last_progress = now;
-      double elapsed = difftime(now, start);
+      print_transfer_progress(total, start, "", context->config->human_readable);
-      double rate = elapsed > 0.0 ? total / (1048576.0 * elapsed) : 0.0;
-      fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  ", total / 1048576.0, rate);
-      fflush(stderr);
     }
 
     struct timespec ts = {0, 100 * 1000000L}; /* 100 ms */
@@ -562,42 +917,41 @@ static int progress_thread_fn(void* arg) {
 }
 
 int send_files(Config* config) {
+  if (config->list_only)
+    return send_list_only(config);
   if (config->dry_run)
     return send_dry_run_manifest(config);
 
   Client* client = connect_transfer_client(config);
   if (!client) {
     if (config->transport == TRANSPORT_TCP)
-      fprintf(stderr, "Error: could not connect to server%s\n", config->use_tls ? " via TLS" : "");
+      log_message(LOG_LEVEL_ERROR, "could not connect to server%s",
+                  config->use_tls ? " via TLS" : "");
     return 1;
   }
   ProtocolSession session;
   protocol_session_init(&session, client->file_descriptor, client->file_descriptor);
   protocol_session_set_ssl(&session, (SSL*)client->ssl);
   protocol_session_bind(&session);
-  if (!config_send(client->file_descriptor, config)) {
+  int ret = 1;
-    disconnect_transfer_client(client);
+  DirectoryScanner* scanner = NULL;
-    protocol_session_unbind();
+  ArrayList* manifest = NULL;
-    return 1;
+  ArrayList* remove_sources = NULL;
-  }
+  if (!config_send(client->file_descriptor, config))
+    goto send_fail;
   ScannerOptions scanner_options = scanner_options_from_config(config, 0);
-  DirectoryScanner* scanner =
+  scanner = directory_scanner_create_with_options(config->send_directory, &scanner_options);
-      directory_scanner_create_with_options(config->send_directory, &scanner_options);
+  manifest = create_transfer_manifest(config);
+  if (config->remove_source_files)
+    remove_sources = array_list_create(source_file_destroy);
+  if (!scanner || (config->use_delete && !manifest) ||
+      (config->remove_source_files && !remove_sources))
+    goto send_fail;
   Chunk* current_chunk;
   unsigned long long total_bytes = 0;
   int total_files = 0;
   time_t last_progress = 0;
   time_t start = time(NULL);
-  ArrayList* manifest = create_transfer_manifest(config);
-  if (!scanner || (config->use_delete && !manifest)) {
-    if (scanner)
-      directory_scanner_destroy(scanner);
-    if (manifest)
-      array_list_delete(manifest);
-    disconnect_transfer_client(client);
-    protocol_session_unbind();
-    return 1;
-  }
   while ((current_chunk = directory_scanner_next(scanner)) != NULL) {
     unsigned long long chunk_bytes = 0;
     for (int i = 0; i < current_chunk->element_count; i++) {
@@ -609,17 +963,23 @@ int send_files(Config* config) {
       goto send_fail;
     }
     if (!config->use_sendfile) {
+      bool load_ok = true;
       for (int i = 0; i < current_chunk->element_count; i++) {
         File* f = current_chunk->items[i];
-        if (f->data->size > STREAM_THRESHOLD)
+        if (f->data->size > STREAM_THRESHOLD && !config->use_compression)
           continue;
         if (!file_load_data(f)) {
           log_message(LOG_LEVEL_ERROR, "Failed to load file data");
-          continue;
+          load_ok = false;
+          break;
         }
       }
+      if (!load_ok) {
+        chunk_destroy(current_chunk);
+        goto send_fail;
       }
-    if (send_chunk(client, current_chunk, config) != 0) {
+    }
+    if (send_chunk_with_removal(client, current_chunk, config, remove_sources) != 0) {
       log_message(LOG_LEVEL_ERROR, "Failed to send chunk");
       chunk_destroy(current_chunk);
       if (manifest)
@@ -627,15 +987,12 @@ int send_files(Config* config) {
       manifest = NULL;
       break;
     }
-    if (config->show_progress) {
     total_bytes += chunk_bytes;
+    if (config->show_progress && !config->quiet) {
       time_t now = time(NULL);
       if (now - last_progress >= 1) {
         last_progress = now;
-        double elapsed = difftime(now, start);
+        print_transfer_progress(total_bytes, start, "", config->human_readable);
-        double rate = elapsed > 0 ? total_bytes / (1048576.0 * elapsed) : 0;
-        fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  ", total_bytes / 1048576.0, rate);
-        fflush(stderr);
       }
     }
     chunk_destroy(current_chunk);
@@ -645,37 +1002,56 @@ int send_files(Config* config) {
   if (config->use_delete) {
     if (send_delete_manifest(client->file_descriptor, manifest) != 0) {
       array_list_delete(manifest);
+      manifest = NULL;
       goto send_fail;
     }
     array_list_delete(manifest);
     manifest = NULL;
   }
-  bool ok = finalize_transfer(client);
+  bool ok = finalize_transfer(client, config, remove_sources);
+  if (ok)
+    remove_transferred_sources(config, remove_sources);
+  if (config->show_progress && !config->quiet)
+    print_transfer_progress(total_bytes, start, "Done.\n", config->human_readable);
+  if (config->stats && !config->quiet) {
     double elapsed_total = difftime(time(NULL), start);
-  if (config->show_progress) {
-    double rate = elapsed_total > 0 ? total_bytes / (1048576.0 * elapsed_total) : 0;
-    fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  Done.\n", total_bytes / 1048576.0, rate);
-  }
-  if (config->stats) {
     double rate = elapsed_total > 0 ? total_bytes / (1048576.0 * elapsed_total) : 0;
+    if (config->human_readable) {
+      char total_buffer[32];
+      char rate_buffer[32];
+      fprintf(stderr, "Stats: %d files, %s, %s/s\n", total_files,
+              display_bytes(total_bytes, true, total_buffer, sizeof(total_buffer)),
+              display_bytes((unsigned long long)(rate * 1048576.0), true, rate_buffer,
+                            sizeof(rate_buffer)));
+    } else {
       fprintf(stderr, "Stats: %d files, %.1f MB, %.1f MB/s\n", total_files, total_bytes / 1048576.0,
               rate);
     }
-  directory_scanner_destroy(scanner);
+  }
-  disconnect_transfer_client(client);
+  log_info_message(LOG_INFO_STATS, "Transfer summary: %d files, %.1f MB", total_files,
-  protocol_session_unbind();
+                   total_bytes / 1048576.0);
-  return ok ? 0 : 1;
+  ret = ok ? 0 : 1;
 
 send_fail:
+  /* Single cleanup path for all exits. The manifest is intentionally deleted
+     here even on success without --delete, fixing a pre-existing leak. */
   if (manifest)
     array_list_delete(manifest);
+  if (remove_sources)
+    array_list_delete(remove_sources);
+  if (scanner)
     directory_scanner_destroy(scanner);
   disconnect_transfer_client(client);
   protocol_session_unbind();
-  return 1;
+  return ret;
 }
 
-int send_files_multithreaded(Config* config) {
+int send_files_multithreaded(Config** config_ptr) {
+  if (!config_ptr || !*config_ptr)
+    return 1;
+  Config* config = *config_ptr;
+  if (config->list_only)
+    return send_list_only(config);
   if (config->dry_run)
     return send_dry_run_manifest(config);
 
@@ -706,8 +1082,16 @@ int send_files_multithreaded(Config* config) {
     queue_destroy(q2);
     return 1;
   }
+  *config_ptr = NULL; /* context now owns config through all remaining paths */
   if (config->use_delete)
-    context->manifest = create_transfer_manifest(config);
+    context->manifest = array_list_create(free);
+  if (config->remove_source_files)
+    context->remove_source_files = array_list_create(source_file_destroy);
+  if ((config->use_delete && !context->manifest) ||
+      (config->remove_source_files && !context->remove_source_files)) {
+    pipeline_context_sender_destroy(context);
+    return 1;
+  }
 
   thrd_t scanner, loader, sender;
   bool scanner_created = false;
@@ -721,7 +1105,7 @@ int send_files_multithreaded(Config* config) {
     sender_created = (thrd_create(&sender, send_chunks_multithreaded, context) == thrd_success);
 
   if (!scanner_created || !loader_created || !sender_created) {
-    perror("Error creating threads.\n");
+    log_perror("Error creating threads");
     pipeline_cancel(context);
     mtx_lock(&context->mutex_progress);
     context->sender_done = true;
@@ -738,10 +1122,10 @@ int send_files_multithreaded(Config* config) {
 
   thrd_t progress;
   bool progress_created = false;
-  if (config->show_progress) {
+  if (config->show_progress && !config->quiet) {
     progress_created = (thrd_create(&progress, progress_thread_fn, context) == thrd_success);
     if (!progress_created) {
-      perror("Error creating progress thread.\n");
+      log_perror("Error creating progress thread");
       /* Non-fatal; continue without progress reporting */
     }
   }

src/client/client_send.h

@@ -7,6 +7,7 @@
 
 int send_chunk(Client* client, Chunk* chunk, Config* config);
 int send_files(Config* config);
-int send_files_multithreaded(Config* config);
+/* Takes ownership only when *config is set to NULL on return. */
+int send_files_multithreaded(Config** config);
 
 #endif

src/client/client_validation.c

@@ -1,37 +1,51 @@
 #include "client_validation.h"
+#include "log.h"
 #include "usage.h"
 #include <stdio.h>
 
 /* Validate config after parsing. Returns true if valid. */
 bool validate_config(const Config* config) {
   if (!config->send_directory || !config->receive_root_directory) {
-    fprintf(stderr, "Error: source and destination directories are required\n");
+    log_message(LOG_LEVEL_ERROR, "source and destination directories are required");
     print_usage();
     return false;
   }
   if (config->use_sendfile && (config->use_chunk_serialization || config->use_compression)) {
-    fprintf(stderr, "Error: -f/--sendfile cannot be combined with -c (compression) or -s (chunk "
+    log_message(LOG_LEVEL_ERROR, "-f/--sendfile cannot be combined with -c (compression) or -s "
-                    "serialization)\n");
+                                 "(chunk serialization)");
+    return false;
+  }
+  if (config->compression_threads > 0 && !config->use_compression) {
+    log_message(LOG_LEVEL_ERROR, "--compress-threads requires compression (-c or -z)");
     return false;
   }
   if (config->transport == TRANSPORT_SSH && config->use_sendfile) {
-    fprintf(stderr, "Error: -f/--sendfile is not supported with SSH transport\n");
+    log_message(LOG_LEVEL_ERROR, "-f/--sendfile is not supported with SSH transport");
     return false;
   }
   if (config->use_incremental && config->use_chunk_serialization) {
-    fprintf(stderr, "Error: --incremental is not supported with -s (chunk serialization)\n");
+    log_message(LOG_LEVEL_ERROR, "--incremental is not supported with -s (chunk serialization)");
     return false;
   }
-  if (config->use_delta && !config->use_incremental) {
+  if (config->skip_compress_set && config->use_chunk_serialization) {
-    fprintf(stderr, "Error: --delta requires --incremental\n");
+    log_message(LOG_LEVEL_ERROR,
+                "--skip-compress cannot be combined with -s (chunk serialization)");
     return false;
   }
-  if (config->use_delta && config->use_chunk_serialization) {
+  if (config->use_delta && !config->whole_file && !config->use_incremental) {
-    fprintf(stderr, "Error: --delta cannot be combined with -s (chunk serialization)\n");
+    log_message(LOG_LEVEL_ERROR, "--delta requires --incremental");
     return false;
   }
-  if (config->use_delta && config->use_sendfile) {
+  if (config->use_delta && !config->whole_file && config->use_chunk_serialization) {
-    fprintf(stderr, "Error: --delta cannot be combined with -f (sendfile)\n");
+    log_message(LOG_LEVEL_ERROR, "--delta cannot be combined with -s (chunk serialization)");
+    return false;
+  }
+  if (config->use_delta && !config->whole_file && config->use_sendfile) {
+    log_message(LOG_LEVEL_ERROR, "--delta cannot be combined with -f (sendfile)");
+    return false;
+  }
+  if (config->log_file_format && !config->log_file) {
+    log_message(LOG_LEVEL_ERROR, "--log-file-format requires --log-file");
     return false;
   }
   if (config->append || config->append_verify) {
@@ -41,8 +55,8 @@ bool validate_config(const Config* config) {
     return false;
   }
   if (config->use_tls) {
-    if (!config->tls_cert || !config->tls_key) {
+    if (!config->tls_cert || !config->tls_key || !config->tls_ca) {
-      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      log_message(LOG_LEVEL_ERROR, "--tls requires --cert, --key, and --ca");
       return false;
     }
   }

src/client/scanner.c

@@ -1,3 +1,4 @@
+#include "log.h"
 #include "scanner.h"
 #include "array_list.h"
 #include "chunk.h"
@@ -226,7 +227,7 @@ static int open_next_directory(DirectoryScanner* scanner) {
   free(de);
   scanner->current_dir = opendir(scanner->current_path);
   if (scanner->current_dir == NULL) {
-    perror("Could not open directory");
+    log_perror("Could not open directory");
     free(scanner->current_path);
     scanner->current_path = NULL;
     scanner->failed = true;
@@ -350,10 +351,14 @@ typedef struct {
   char** dirs;
   int dir_count;
   ScannerOptions options;
+  ProtocolSession* allocation_session;
 } ParallelWorkerArg;
 
 static int parallel_worker_thread(void* arg) {
   ParallelWorkerArg* wa = (ParallelWorkerArg*)arg;
+  ProtocolSession* allocation_session = wa->allocation_session;
+  if (allocation_session)
+    protocol_session_bind(allocation_session);
   for (int i = 0; i < wa->dir_count; i++) {
     DirectoryScanner* ds = directory_scanner_create_with_options(wa->dirs[i], &wa->options);
     if (!ds) {
@@ -363,6 +368,8 @@ static int parallel_worker_thread(void* arg) {
       cnd_broadcast(&wa->ps->result_not_empty);
       cnd_broadcast(&wa->ps->result_not_full);
       mtx_unlock(&wa->ps->result_mutex);
+      for (int j = i; j < wa->dir_count; j++)
+        free(wa->dirs[j]);
       break;
     }
     Chunk* chunk;
@@ -395,21 +402,28 @@ static int parallel_worker_thread(void* arg) {
     cnd_signal(&ps->result_not_empty);
   }
   mtx_unlock(&ps->result_mutex);
+  if (allocation_session)
+    protocol_session_unbind();
   return thrd_success;
 }
 
-ParallelScanner* parallel_scanner_create_with_options(const char* root_directory,
+static void parallel_scanner_creation_failed(ParallelScanner* ps) {
-                                                      const ScannerOptions* options) {
+  mtx_lock(&ps->result_mutex);
-  if (!root_directory || !options)
+  ps->failed = true;
-    return NULL;
+  atomic_store(&ps->cancelled, true);
-  ParallelScanner* ps = calloc(1, sizeof(ParallelScanner));
+  ps->expected_threads = ps->created_threads;
-  if (!ps)
+  if (ps->completed >= ps->expected_threads)
-    return NULL;
+    ps->done = true;
-  ps->result_queue = queue_create(100, chunk_destroy);
+  cnd_broadcast(&ps->result_not_empty);
-  if (!ps->result_queue) {
+  cnd_broadcast(&ps->result_not_full);
-    free(ps);
+  mtx_unlock(&ps->result_mutex);
-    return NULL;
 }
+
+/* Initialize result queue and synchronization primitives. Returns true on success. */
+static bool parallel_scanner_init(ParallelScanner* ps) {
+  ps->result_queue = queue_create(100, chunk_destroy);
+  if (!ps->result_queue)
+    return false;
   atomic_init(&ps->cancelled, false);
   int init = 0;
   bool ok = true;
@@ -434,93 +448,37 @@ ParallelScanner* parallel_scanner_create_with_options(const char* root_directory
     if (init >= 1)
       mtx_destroy(&ps->result_mutex);
     queue_destroy(ps->result_queue);
-    free(ps);
+    ps->result_queue = NULL;
-    return NULL;
+    return false;
+  }
+  return true;
 }
 
-  DIR* dir = opendir(root_directory);
+/* Split files into chunks of roughly chunk_size bytes. Returns the first chunk (also stored
-  if (!dir) {
+ * chunks beyond the first are enqueued on `queue`). Nulls out consumed entries in `files`.
-    perror("Could not open root directory for parallel scan");
+ * Sets *failed on allocation/enqueue errors. */
-    parallel_scanner_destroy(ps);
+static Chunk* batch_files(ArrayList* files, unsigned long long chunk_size, Queue* queue,
+                          bool* failed) {
+  Chunk* first = NULL;
+  if (files->size <= 0)
     return NULL;
-  }
-
-  ArrayList* root_files = array_list_create(file_destroy);
-  ArrayList* subdirs = array_list_create(free);
-  if (!root_files || !subdirs) {
-    array_list_delete(root_files);
-    array_list_delete(subdirs);
-    closedir(dir);
-    parallel_scanner_destroy(ps);
-    return NULL;
-  }
-  const struct dirent* entry;
-  while ((entry = readdir(dir)) != NULL) {
-    if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
-      continue;
-    ScannerEntry inspected;
-    int inspection =
-        scanner_inspect_entry(options, root_directory, root_directory, entry->d_name, &inspected);
-    if (inspection < 0) {
-      ps->failed = true;
-      continue;
-    }
-    if (inspection == 0)
-      continue;
-    char* cur_path = inspected.path;
-    struct stat st = inspected.stats;
-    if (inspected.is_directory) {
-      if (!array_list_add(subdirs, cur_path)) {
-        free(cur_path);
-        ps->failed = true;
-      }
-    } else {
-      File* file = file_create(cur_path);
-      free(cur_path);
-      if (!file) {
-        ps->failed = true;
-        continue;
-      }
-      file->data->size = st.st_size;
-      if (options->use_metadata)
-        file->metadata = file_metadata_create(&st);
-      if (options->use_metadata && !file->metadata) {
-        file_destroy(file);
-        ps->failed = true;
-        continue;
-      }
-      if (!array_list_add(root_files, file)) {
-        file_destroy(file);
-        ps->failed = true;
-      }
-    }
-  }
-  closedir(dir);
-
-  unsigned long long cs = options->chunk_size > 0 ? options->chunk_size : DESIRED_CHUNK_SIZE;
-  if (root_files->size > 0) {
   ArrayList* batch = array_list_create(NULL);
   if (!batch) {
-      ps->failed = true;
+    *failed = true;
-      array_list_delete(root_files);
-      array_list_delete(subdirs);
-      parallel_scanner_destroy(ps);
     return NULL;
   }
   unsigned long long batch_size = 0;
-    Chunk* first = NULL;
+  for (int i = 0; i < files->size; i++) {
-    for (int i = 0; i < root_files->size; i++) {
+    File* f = (File*)files->items[i];
-      File* f = (File*)root_files->items[i];
     if (!array_list_add(batch, f)) {
-        ps->failed = true;
+      *failed = true;
       break;
     }
     batch_size += f->data->size;
-      if (batch_size >= cs || i == root_files->size - 1) {
+    if (batch_size >= chunk_size || i == files->size - 1) {
       void** items = array_list_to_array(batch);
       if (!items) {
-          ps->failed = true;
+        *failed = true;
-          batch->item_destroyer = file_destroy;
         array_list_delete(batch);
         batch = NULL;
         break;
@@ -528,27 +486,29 @@ ParallelScanner* parallel_scanner_create_with_options(const char* root_directory
       Chunk* c = chunk_create((File**)items, batch->size);
       free(items);
       if (!c) {
-          ps->failed = true;
+        *failed = true;
-          batch->item_destroyer = file_destroy;
         array_list_delete(batch);
         batch = NULL;
         break;
       }
+      int batch_start = i - batch->size + 1;
+      for (int j = batch_start; j <= i; j++)
+        files->items[j] = NULL;
       batch->item_destroyer = NULL;
       array_list_delete(batch);
       batch = NULL;
       if (!first) {
         first = c;
       } else {
-          if (!queue_enqueue(ps->result_queue, c)) {
+        if (!queue_enqueue(queue, c)) {
           chunk_destroy(c);
-            ps->failed = true;
+          *failed = true;
         }
       }
-        if (i < root_files->size - 1) {
+      if (i < files->size - 1) {
         batch = array_list_create(NULL);
         if (!batch) {
-            ps->failed = true;
+          *failed = true;
           break;
         }
         batch_size = 0;
@@ -559,23 +519,88 @@ ParallelScanner* parallel_scanner_create_with_options(const char* root_directory
     batch->item_destroyer = NULL;
     array_list_delete(batch);
   }
-    ps->initial_chunk = first;
+  return first;
-    root_files->item_destroyer = NULL;
 }
-  array_list_delete(root_files);
 
+/* Scan one root-directory entry into either the subdirs or files list. */
+static void scan_root_entry(const ScannerOptions* options, const char* root_directory,
+                            const struct dirent* entry, ArrayList* root_files, ArrayList* subdirs,
+                            ParallelScanner* ps) {
+  ScannerEntry inspected;
+  int inspection =
+      scanner_inspect_entry(options, root_directory, root_directory, entry->d_name, &inspected);
+  if (inspection < 0) {
+    ps->failed = true;
+    return;
+  }
+  if (inspection == 0)
+    return;
+  char* cur_path = inspected.path;
+  struct stat st = inspected.stats;
+  if (inspected.is_directory) {
+    if (!array_list_add(subdirs, cur_path)) {
+      free(cur_path);
+      ps->failed = true;
+    }
+    return;
+  }
+  File* file = file_create(cur_path);
+  free(cur_path);
+  if (!file) {
+    ps->failed = true;
+    return;
+  }
+  file->data->size = st.st_size;
+  if (options->use_metadata)
+    file->metadata = file_metadata_create(&st);
+  if (options->use_metadata && !file->metadata) {
+    file_destroy(file);
+    ps->failed = true;
+    return;
+  }
+  if (!array_list_add(root_files, file)) {
+    file_destroy(file);
+    ps->failed = true;
+  }
+}
+
+/* Scan the root directory itself, collecting root files and subdirectories.
+ * Returns false if the root directory could not be opened. */
+static bool scan_root_directory(ParallelScanner* ps, const char* root_directory,
+                                const ScannerOptions* options, ArrayList* root_files,
+                                ArrayList* subdirs) {
+  DIR* dir = opendir(root_directory);
+  if (!dir) {
+    log_perror("Could not open root directory for parallel scan");
+    return false;
+  }
+  const struct dirent* entry;
+  while ((entry = readdir(dir)) != NULL) {
+    if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
+      continue;
+    scan_root_entry(options, root_directory, entry, root_files, subdirs, ps);
+  }
+  closedir(dir);
+  return true;
+}
+
+/* Spawn worker threads, one per group of subdirectories. */
+static void spawn_parallel_workers(ParallelScanner* ps, ArrayList* subdirs,
+                                   const ScannerOptions* options, unsigned long long cs) {
+  if (subdirs->size <= 0)
+    return;
   int n = options->num_threads > 0 ? options->num_threads : 4;
   if (n > subdirs->size)
-    n = subdirs->size > 0 ? subdirs->size : 1;
+    n = subdirs->size;
 
-  if (subdirs->size > 0) {
   ps->num_threads = n;
   ps->expected_threads = n;
   ps->threads = calloc(n, sizeof(thrd_t));
   if (!ps->threads) {
-      array_list_delete(subdirs);
+    ps->num_threads = 0;
-      parallel_scanner_destroy(ps);
+    ps->expected_threads = 0;
-      return NULL;
+    ps->failed = true;
+    return;
   }
   int dirs_per_thread = subdirs->size / n;
   int remainder = subdirs->size % n;
@@ -587,14 +612,14 @@ ParallelScanner* parallel_scanner_create_with_options(const char* root_directory
       break;
     ParallelWorkerArg* wa = calloc(1, sizeof(ParallelWorkerArg));
     if (!wa) {
-        ps->failed = true;
+      parallel_scanner_creation_failed(ps);
       break;
     }
     wa->ps = ps;
     wa->dirs = calloc(count, sizeof(char*));
     if (!wa->dirs) {
       free(wa);
-        ps->failed = true;
+      parallel_scanner_creation_failed(ps);
       break;
     }
     bool dup_ok = true;
@@ -608,47 +633,64 @@ ParallelScanner* parallel_scanner_create_with_options(const char* root_directory
         free(wa->dirs[j]);
       free(wa->dirs);
       free(wa);
-        ps->failed = true;
+      parallel_scanner_creation_failed(ps);
       break;
     }
     wa->dir_count = count;
     wa->options = *options;
     wa->options.chunk_size = cs;
+    wa->allocation_session = ps->allocation_session;
     start += count;
     if (thrd_create(&ps->threads[t], parallel_worker_thread, wa) != thrd_success) {
       for (int j = 0; j < count; j++)
         free(wa->dirs[j]);
       free(wa->dirs);
       free(wa);
-        ps->failed = true;
+      parallel_scanner_creation_failed(ps);
-        atomic_store(&ps->cancelled, true);
-        ps->expected_threads = ps->created_threads;
-        mtx_lock(&ps->result_mutex);
-        cnd_broadcast(&ps->result_not_empty);
-        cnd_broadcast(&ps->result_not_full);
-        mtx_unlock(&ps->result_mutex);
       break;
     }
     ps->num_threads++;
     ps->created_threads++;
   }
 }
+
+ParallelScanner* parallel_scanner_create_with_options(const char* root_directory,
+                                                      const ScannerOptions* options,
+                                                      ProtocolSession* allocation_session) {
+  if (!root_directory || !options)
+    return NULL;
+  ParallelScanner* ps = calloc(1, sizeof(ParallelScanner));
+  if (!ps)
+    return NULL;
+  if (!parallel_scanner_init(ps)) {
+    free(ps);
+    return NULL;
+  }
+  ps->allocation_session = allocation_session;
+
+  ArrayList* root_files = array_list_create(file_destroy);
+  ArrayList* subdirs = array_list_create(free);
+  if (!root_files || !subdirs) {
+    array_list_delete(root_files);
     array_list_delete(subdirs);
-  return ps;
+    parallel_scanner_destroy(ps);
+    return NULL;
   }
 
-ParallelScanner* parallel_scanner_create(const char* root_directory, bool use_metadata,
+  if (!scan_root_directory(ps, root_directory, options, root_files, subdirs)) {
-                                         unsigned long long chunk_size, char** exclude_patterns,
+    array_list_delete(root_files);
-                                         int exclude_count, char** include_patterns,
+    array_list_delete(subdirs);
-                                         int include_count, unsigned long long max_size,
+    parallel_scanner_destroy(ps);
-                                         unsigned long long min_size, int max_depth,
+    return NULL;
-                                         int num_threads, bool follow_symlinks, bool copy_links,
+  }
-                                         bool safe_links, bool copy_unsafe_links, bool checksum) {
+
-  ScannerOptions options = {use_metadata,     chunk_size,        exclude_patterns, exclude_count,
+  unsigned long long cs = options->chunk_size > 0 ? options->chunk_size : DESIRED_CHUNK_SIZE;
-                            include_patterns, include_count,     max_size,         min_size,
+  ps->initial_chunk = batch_files(root_files, cs, ps->result_queue, &ps->failed);
-                            max_depth,        num_threads,       follow_symlinks,  copy_links,
+  array_list_delete(root_files);
-                            safe_links,       copy_unsafe_links, checksum};
+
-  return parallel_scanner_create_with_options(root_directory, &options);
+  spawn_parallel_workers(ps, subdirs, options, cs);
+  array_list_delete(subdirs);
+  return ps;
 }
 
 Chunk* parallel_scanner_next(ParallelScanner* ps) {
@@ -659,6 +701,11 @@ Chunk* parallel_scanner_next(ParallelScanner* ps) {
   }
   if (ps->num_threads == 0) {
     mtx_lock(&ps->result_mutex);
+    if (!queue_is_empty(ps->result_queue)) {
+      Chunk* chunk = queue_dequeue(ps->result_queue);
+      mtx_unlock(&ps->result_mutex);
+      return chunk;
+    }
     ps->done = true;
     mtx_unlock(&ps->result_mutex);
     return NULL;

src/client/scanner.h

@@ -2,6 +2,7 @@
 #define SCANNER_H
 
 #include "chunk.h"
+#include "protocol.h"
 #include "queue.h"
 #include <dirent.h>
 #include <stdbool.h>
@@ -62,6 +63,7 @@ typedef struct {
   atomic_bool cancelled;
   int completed;
   Chunk* initial_chunk;
+  ProtocolSession* allocation_session;
 } ParallelScanner;
 
 DirectoryScanner* directory_scanner_create(const char* root_directory, bool use_metadata,
@@ -77,15 +79,9 @@ Chunk* directory_scanner_next(DirectoryScanner* scanner);
 bool directory_scanner_failed(const DirectoryScanner* scanner);
 void directory_scanner_destroy(DirectoryScanner* scanner);
 
-ParallelScanner* parallel_scanner_create(const char* root_directory, bool use_metadata,
-                                         unsigned long long chunk_size, char** exclude_patterns,
-                                         int exclude_count, char** include_patterns,
-                                         int include_count, unsigned long long max_size,
-                                         unsigned long long min_size, int max_depth,
-                                         int num_threads, bool follow_symlinks, bool copy_links,
-                                         bool safe_links, bool copy_unsafe_links, bool checksum);
 ParallelScanner* parallel_scanner_create_with_options(const char* root_directory,
-                                                      const ScannerOptions* options);
+                                                      const ScannerOptions* options,
+                                                      ProtocolSession* allocation_session);
 Chunk* parallel_scanner_next(ParallelScanner* scanner);
 bool parallel_scanner_failed(const ParallelScanner* scanner);
 void parallel_scanner_destroy(ParallelScanner* scanner);

src/client/usage.c

@@ -18,26 +18,51 @@ void print_usage(void) {
   printf("  -z [level]          Alias for -c\n");
   printf("  -a, --archive       Archive mode (-c -m -M)\n");
   printf("  -n, --dry-run       Show what would be transferred\n");
+  printf("  --remove-source-files  Remove regular source files after successful transfer\n");
   printf("  -p <port>           SSH port (default: 22)\n");
   printf("  --progress          Show transfer progress\n");
+  printf("  -P                  Partial mode with progress (retention incomplete)\n");
+  printf("  -8, --8-bit-output  Leave high-bit characters unescaped in output\n");
   printf("  --delete            Delete files on receiver not in source\n");
+  printf("  --ignore-existing  Skip files that already exist on receiver\n");
+  printf(
+      "  --dirs, --old-dirs, --old-d  Transfer directories without recursing (not implemented)\n");
+  printf("  --del               Alias for --delete-during (not implemented)\n");
   printf("  --exclude <pattern> Exclude files matching pattern\n");
   printf("  --include <pattern> Only include files matching pattern\n");
   printf("  --exclude-from <file> Read exclude patterns from file\n");
   printf("  --include-from <file> Read include patterns from file\n");
   printf("  --max-size <n>      Skip files larger than n bytes\n");
   printf("  --min-size <n>      Skip files smaller than n bytes\n");
+  printf("  --max-alloc <SIZE>  Maximum single allocation (default: 1G)\n");
   printf("  --incremental       Skip files unchanged since last transfer\n");
+  printf("  --size-only         Skip incremental files matching in size, ignoring mtime\n");
+  printf("  -I, --ignore-times  Transfer files even when size and mtime match\n");
+  printf("  -@, --modify-window <sec>  Modification time tolerance\n");
+  printf("  -u, --update        Skip files newer than the source on receiver\n");
+  printf("  --existing          Skip files not already present at destination\n");
+  printf("  --checksum-choice, --cc <alg>  Checksum algorithm (not supported yet; xxHash64 is "
+         "used)\n");
   printf("  --delta             Delta transfer for changed files (requires --incremental)\n");
+  printf("  -W, --whole-file    Transfer changed files without delta processing\n");
   printf("  --delta-block <n>   Delta block size in bytes (default: %d)\n",
          DELTA_BLOCK_SIZE_DEFAULT);
   printf("  --delta-max <n>     Max file size for delta transfer (default: %llu)\n",
          DELTA_MAX_FILE_SIZE);
   printf("  -m                  Enable multithreading\n");
   printf("  -s                  Enable chunk serialization\n");
+  printf("  --secluded-args    Accept rsync compatibility option (no effect)\n");
   printf("  -f                  Enable sendfile (TCP only, not with -c or -s)\n");
+  printf("  --compress-choice <alg>  Compression algorithm (default: zstd)\n");
+  printf("  --zc <alg>          Alias for --compress-choice\n");
   printf("  -v, --verbose       Enable debug logging\n");
+  printf("  -q, --quiet         Suppress non-error output\n");
+  printf("  --debug=FLAGS       Fine-grained debug logging (use --debug=help for flags)\n");
+  printf("  --info=FLAGS        Fine-grained info: copy,misc,skip,stats,all,none\n");
+  printf("                      none suppresses info even with --verbose\n");
   printf("  -M, --preserve      Preserve file metadata\n");
+  printf("  -E, --executability Preserve executable permission bits\n");
+  printf("  --chmod <changes>   Modify transferred permissions (rsync syntax)\n");
   printf("  --chunk-size <n>    Chunk size in bytes (default: %d)\n", DEFAULT_CHUNK_SIZE);
   printf("  --source-dir <path> Source directory\n");
   printf("  --dest-dir <path>   Destination directory\n");
@@ -56,19 +81,38 @@ void print_usage(void) {
   printf("  --backup-dir <dir>  Directory for backups (requires --backup)\n");
   printf("  --suffix <str>      Backup suffix (default: ~)\n");
   printf("  --stats             Print transfer statistics at end\n");
+  printf("  -i, --itemize-changes  Print an rsync-style per-file change line\n");
+  printf("  --out-format=FORMAT Output format for changed files (%%f %%n %%l %%b %%M %%%%)\n");
+  printf("  --list-only         List source files instead of transferring\n");
+  printf("  --log-file-format=FORMAT  Per-file log line format (needs --log-file)\n");
+  printf("  -h, --human-readable  Print byte sizes in human-readable form\n");
   printf("  --max-depth <n>     Maximum directory depth (0=unlimited)\n");
   printf("  --log-file <path>   Write log messages to file\n");
+  printf("  --stderr=MODE       Route logging to stderr: errors or all\n");
   printf("  --partial           Keep partial files on interrupted transfer\n");
   printf("  --partial-dir <dir> Directory for partial files\n");
   printf("  --fastsync-server-path <path>\n");
   printf("                      Path to fastsync-server on remote (default: fastsync-server)\n");
+  printf(
+      "  --old-args          Disable safe SSH command argument quoting (legacy compatibility)\n");
   printf("  -l, --links         Copy symlinks as symlinks\n");
   printf("  --copy-links        Transform symlinks into referent files\n");
   printf("  --safe-links        Skip symlinks that point outside transfer tree\n");
   printf("  --copy-unsafe-links  Only transform unsafe symlinks into referent files\n");
   printf("  -S, --sparse        Handle sparse files efficiently\n");
   printf("  --inplace           Update files in-place (no temp+rename)\n");
+  printf("  --fsync             Fsync every written file before publication\n");
   printf("  --compress-level <n>    Compression level (default: 5)\n");
+  printf("  --zl <n>             Alias for --compress-level\n");
+  printf("  --skip-compress=LIST    Skip compression for comma-separated suffixes\n");
+  printf("  --compress-threads <n> Compression worker threads (requires zstd threaded support)\n");
+  printf("  --no-OPTION         Disable a supported boolean option\n");
   printf("  --help              Show this help\n");
   printf("  -V, --version       Show version\n");
 }
+
+void print_debug_usage(void) {
+  printf("Supported debug flags: IO,PROTO,PACK,UTIL,ALL,NONE\n");
+  printf("Flags may be comma-separated, for example: --debug=io,proto\n");
+  printf("Other rsync debug flags are unsupported and rejected.\n");
+}

src/client/usage.h

@@ -2,5 +2,6 @@
 #define USAGE_H
 
 void print_usage(void);
+void print_debug_usage(void);
 
 #endif

src/server/receiver.c

@@ -1,15 +1,65 @@
 #include "receiver.h"
 
 #include "chunk.h"
+#include "file_receive.h"
 #include "log.h"
+#include "metadata.h"
 #include "protocol.h"
 #include "utils.h"
 #include <stdlib.h>
 #include <sys/stat.h>
 
+bool receiver_outcomes_append(ReceiverOutcomes* outcomes, unsigned char code) {
+  if (!outcomes)
+    return false;
+  if (outcomes->count == outcomes->capacity) {
+    size_t new_capacity = outcomes->capacity == 0 ? 64 : outcomes->capacity * 2;
+    if (new_capacity < outcomes->capacity)
+      return false;
+    unsigned char* grown = realloc(outcomes->entries, new_capacity);
+    if (!grown)
+      return false;
+    outcomes->entries = grown;
+    outcomes->capacity = new_capacity;
+  }
+  outcomes->entries[outcomes->count++] = code;
+  return true;
+}
+
+void receiver_outcomes_destroy(ReceiverOutcomes* outcomes) {
+  if (!outcomes)
+    return;
+  free(outcomes->entries);
+  outcomes->entries = NULL;
+  outcomes->count = 0;
+  outcomes->capacity = 0;
+}
+
+/* End-of-transfer success frame.  When --remove-source-files was negotiated
+   each processed data file is acknowledged first (STATUS_NEXT = written,
+   STATUS_OK = skipped) so the sender never removes a source the receiver did
+   not actually store.  The frame always ends with a plain STATUS_OK. */
+bool receiver_send_final_success(int fd, const Config* config, const ReceiverOutcomes* outcomes) {
+  if (!config->remove_source_files)
+    return send_status(fd, STATUS_OK);
+  size_t count = outcomes ? outcomes->count : 0;
+  for (size_t i = 0; i < count; i++) {
+    Status per_file = outcomes->entries[i] == FILE_SAVE_WRITTEN ? STATUS_NEXT : STATUS_OK;
+    if (!send_status(fd, per_file))
+      return false;
+  }
+  return send_status(fd, STATUS_OK);
+}
+
 static bool receiver_process_chunk(Chunk* chunk, const ReceiverSink* sink) {
+  if (!chunk || !sink || !sink->store_file)
+    return false;
   for (int i = 0; i < chunk->element_count; i++) {
     File* file = chunk->items[i];
+    if (!file) {
+      chunk_destroy(chunk);
+      return false;
+    }
     chunk->items[i] = NULL;
     if (!sink->store_file(file, sink->context)) {
       chunk_destroy(chunk);
@@ -31,9 +81,13 @@ static bool receiver_process_batch(Config* config, int file_descriptor) {
       return false;
     unsigned long long check_size;
     long long check_mtime;
+    long long check_mtime_nsec;
     if (!receive_n_data(file_descriptor, &check_size, sizeof(check_size)) ||
-        !receive_n_data(file_descriptor, &check_mtime, sizeof(check_mtime))) {
+        !receive_n_data(file_descriptor, &check_mtime, sizeof(check_mtime)) ||
+        !receive_n_data(file_descriptor, &check_mtime_nsec, sizeof(check_mtime_nsec)) ||
+        check_mtime_nsec < 0 || check_mtime_nsec >= 1000000000LL) {
       free(check_path);
+      send_status(file_descriptor, STATUS_ERROR);
       return false;
     }
     if (!utils_valid_batch_path(check_path)) {
@@ -41,11 +95,28 @@ static bool receiver_process_batch(Config* config, int file_descriptor) {
       send_status(file_descriptor, STATUS_ERROR);
       return false;
     }
+    if (check_size > MAX_RECEIVE_WHOLE_FILE_SIZE) {
+      free(check_path);
+      send_status(file_descriptor, STATUS_ERROR);
+      return false;
+    }
     char* full_path = path_cat(config->receive_root_directory, check_path);
+    if (!full_path) {
+      free(check_path);
+      send_status(file_descriptor, STATUS_ERROR);
+      return false;
+    }
     struct stat st;
-    bool has_old = full_path && lstat(full_path, &st) == 0;
+    bool has_old = file_stat_secure(full_path, &st);
-    bool match = has_old && (unsigned long long)st.st_size == check_size &&
+    long long old_mtime_nsec = 0;
-                 (long long)st.st_mtime == check_mtime;
+    if (has_old) {
+#ifdef __linux__
+      old_mtime_nsec = st.st_mtim.tv_nsec;
+#endif
+    }
+    bool match = !config->ignore_times && has_old && (unsigned long long)st.st_size == check_size &&
+                 metadata_mtime_matches(st.st_mtime, old_mtime_nsec, (time_t)check_mtime,
+                                        (long)check_mtime_nsec, config->modify_window);
     bool sent = send_status(file_descriptor, match ? STATUS_OK : STATUS_NEXT);
     free(full_path);
     free(check_path);
@@ -102,8 +173,14 @@ int receiver_process(Config* config, int file_descriptor, const ReceiverSink* si
     log_message(LOG_LEVEL_ERROR, "Did not receive FINISHED Status");
     goto receive_error;
   }
-  if (sink->send_success && !send_status(file_descriptor, STATUS_OK))
+  if (sink->send_success) {
+    if (sink->send_success_frame) {
+      if (!sink->send_success_frame(file_descriptor, sink->context))
         return -1;
+    } else if (!send_status(file_descriptor, STATUS_OK)) {
+      return -1;
+    }
+  }
   return 0;
 
 receive_error:
@@ -112,15 +189,41 @@ receive_error:
   return -1;
 }
 
-static bool receiver_save_file(File* file, void* context) {
+/* ---- Single-threaded sink (used by receiver_receive_files) ---- */
-  Config* config = context;
+
-  bool success =
+typedef struct {
-      !config->save_to_disk || file_save_to_disk(config->receive_root_directory, file, config);
+  Config* config;
+  ReceiverOutcomes outcomes;
+} ReceiverSaveContext;
+
+static bool receiver_save_file(File* file, void* context_pointer) {
+  ReceiverSaveContext* context = context_pointer;
+  FileSaveResult result = FILE_SAVE_ERROR;
+  if (!context->config->save_to_disk) {
+    /* Nothing is stored; report the file as not-written so a
+       --remove-source-files sender keeps its source. */
+    result = FILE_SAVE_SKIPPED;
+  } else {
+    result = file_save_to_disk_full(context->config->receive_root_directory, file, context->config);
+  }
+  if (result != FILE_SAVE_ERROR && context->config->remove_source_files &&
+      !receiver_outcomes_append(&context->outcomes, (unsigned char)result)) {
     file_destroy(file);
-  return success;
+    return false;
+  }
+  file_destroy(file);
+  return result != FILE_SAVE_ERROR;
+}
+
+static bool receiver_send_success_frame(int fd, void* context_pointer) {
+  ReceiverSaveContext* context = context_pointer;
+  return receiver_send_final_success(fd, context->config, &context->outcomes);
 }
 
 int receiver_receive_files(Config* config, int file_descriptor) {
-  ReceiverSink sink = {receiver_save_file, config, true, true};
+  ReceiverSaveContext context = {.config = config, .outcomes = {0}};
-  return receiver_process(config, file_descriptor, &sink);
+  ReceiverSink sink = {receiver_save_file, &context, true, true, receiver_send_success_frame};
+  int ret = receiver_process(config, file_descriptor, &sink);
+  receiver_outcomes_destroy(&context.outcomes);
+  return ret;
 }

src/server/receiver.h

@@ -3,16 +3,37 @@
 
 #include "config.h"
 #include "file.h"
+#include "file_receive.h"
 
 typedef bool (*ReceiverFileSink)(File* file, void* context);
 
+/* Ordered per-file save outcomes for one connection.  One entry is appended
+   for every data-bearing file the receiver processes (in the order the files
+   were sent) so the sender of a --remove-source-files transfer can be told
+   which sources were actually written versus skipped on the receiver. */
+typedef struct {
+  unsigned char* entries; /* FILE_SAVE_WRITTEN or FILE_SAVE_SKIPPED */
+  size_t count;
+  size_t capacity;
+} ReceiverOutcomes;
+
+typedef bool (*ReceiverSuccessFrame)(int fd, void* context);
+
 typedef struct {
   ReceiverFileSink store_file;
   void* context;
   bool send_error;
   bool send_success;
+  /* Emits the end-of-transfer success frame.  When the sender requested
+     --remove-source-files this includes one per-file status per processed
+     data file followed by the final STATUS_OK; otherwise just STATUS_OK. */
+  ReceiverSuccessFrame send_success_frame;
 } ReceiverSink;
 
+bool receiver_outcomes_append(ReceiverOutcomes* outcomes, unsigned char code);
+void receiver_outcomes_destroy(ReceiverOutcomes* outcomes);
+bool receiver_send_final_success(int fd, const Config* config, const ReceiverOutcomes* outcomes);
+
 int receiver_process(Config* config, int file_descriptor, const ReceiverSink* sink);
 int receiver_receive_files(Config* config, int file_descriptor);
 

src/server/server.c

@@ -2,11 +2,11 @@
 #include "file.h"
 #include "log.h"
 #include "multiprocessing.h"
+#include "protocol.h"
 #include "queue.h"
 #include "receiver.h"
 #include "transport_tcp.h"
 #include "transport_tls.h"
-#include "unistd.h"
 #include "utils.h"
 #include <fcntl.h>
 #include <limits.h>
@@ -14,11 +14,48 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/stat.h>
+#include <unistd.h>
+#include <openssl/x509.h>
 
 static char* authorized_root;
 static int authorized_root_fd = -1;
 static bool allow_delete;
+static bool allow_unauthenticated;
+static const char* required_client_cn;
+
+/* Aggregate payload bytes the multithreaded receiver may buffer ahead of the
+   slow disk writer.  Receiving one more chunk adds up to ~2 * MAX_CHUNK_SIZE
+   of transient wire/decompression buffers on top of the queued payloads, so
+   this ceiling keeps total per-connection receive memory (decompressed and
+   per-file copied chunk buffers included) within MAX_CONNECTION_MEMORY. */
+#define RECEIVER_QUEUE_MAX_BYTES (MAX_CONNECTION_MEMORY - 2 * MAX_CHUNK_SIZE)
+
+static bool tls_client_identity_allowed(SSL* ssl) {
+  if (!ssl || !required_client_cn)
+    return false;
+  X509* certificate = SSL_get1_peer_certificate(ssl);
+  if (!certificate)
+    return false;
+  char common_name[256];
+  int length = X509_NAME_get_text_by_NID(X509_get_subject_name(certificate), NID_commonName,
+                                         common_name, sizeof(common_name));
+  size_t required_length = strlen(required_client_cn);
+  bool allowed = length >= 0 && (size_t)length == required_length &&
+                 required_length < sizeof(common_name) &&
+                 memcmp(common_name, required_client_cn, required_length) == 0;
+  X509_free(certificate);
+  return allowed;
+}
+
+static void release_authorization(void) {
+  file_set_authorized_root(-1, NULL);
+  utils_set_authorized_root_fd(-1);
+  if (authorized_root_fd >= 0)
+    close(authorized_root_fd);
+  authorized_root_fd = -1;
+  free(authorized_root);
+  authorized_root = NULL;
+}
 
 static bool path_is_within(const char* root, const char* path) {
   size_t n = strlen(root);
@@ -27,19 +64,44 @@ static bool path_is_within(const char* root, const char* path) {
 
 static bool __attribute__((unused)) configure_authorization(const char* root) {
   char resolved[PATH_MAX];
-  if (!root || !realpath(root, resolved))
+  if (!root) {
+    file_set_authorized_root(-1, NULL);
+    utils_set_authorized_root(-1, NULL);
     return false;
+  }
+  int root_fd = open(root, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+  if (root_fd < 0) {
+    file_set_authorized_root(-1, NULL);
+    utils_set_authorized_root(-1, NULL);
+    return false;
+  }
+  char fd_path[64];
+  int fd_path_length = snprintf(fd_path, sizeof(fd_path), "/proc/self/fd/%d", root_fd);
+  if (fd_path_length < 0 || (size_t)fd_path_length >= sizeof(fd_path) ||
+      !realpath(fd_path, resolved)) {
+    close(root_fd);
+    file_set_authorized_root(-1, NULL);
+    utils_set_authorized_root(-1, NULL);
+    return false;
+  }
   authorized_root = str_dup(resolved);
-  if (!authorized_root)
+  if (!authorized_root) {
+    close(root_fd);
+    file_set_authorized_root(-1, NULL);
+    utils_set_authorized_root(-1, NULL);
     return false;
-  authorized_root_fd = open(resolved, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+  }
-  if (authorized_root_fd < 0) {
+  authorized_root_fd = root_fd;
+  if (!file_set_authorized_root(authorized_root_fd, authorized_root) ||
+      !utils_set_authorized_root(authorized_root_fd, authorized_root)) {
+    file_set_authorized_root(-1, NULL);
+    utils_set_authorized_root(-1, NULL);
+    close(authorized_root_fd);
+    authorized_root_fd = -1;
     free(authorized_root);
     authorized_root = NULL;
     return false;
   }
-  file_set_authorized_root(authorized_root_fd, authorized_root);
-  utils_set_authorized_root_fd(authorized_root_fd);
   return true;
 }
 
@@ -56,6 +118,7 @@ void handler(int file_descriptor) {
     protocol_session_unbind();
     return;
   }
+  protocol_set_8_bit_output(config->eight_bit_output);
   if (!authorized_root) {
     log_message(LOG_LEVEL_ERROR, "No server-side destination root configured");
     config_delete(config);
@@ -63,25 +126,37 @@ void handler(int file_descriptor) {
     protocol_session_unbind();
     return;
   }
-  char resolved_destination[PATH_MAX];
+  if (!allow_unauthenticated && ssl == NULL) {
-  char* canonical_destination = realpath(config->receive_root_directory, NULL);
+    log_message(LOG_LEVEL_ERROR, "Rejected unauthenticated plaintext connection");
-  const char* destination =
-      canonical_destination ? canonical_destination : config->receive_root_directory;
-  if (has_path_traversal(destination) || !path_is_within(authorized_root, destination)) {
-    log_message(LOG_LEVEL_ERROR, "Rejected destination outside authorized root");
-    free(canonical_destination);
     config_delete(config);
     close(file_descriptor);
     protocol_session_unbind();
     return;
   }
-  if (canonical_destination)
+  if (ssl && required_client_cn && !tls_client_identity_allowed(ssl)) {
-    snprintf(resolved_destination, sizeof(resolved_destination), "%s", canonical_destination);
+    log_message(LOG_LEVEL_ERROR, "Rejected TLS client with unauthorized identity");
-  else
+    config_delete(config);
-    snprintf(resolved_destination, sizeof(resolved_destination), "%s", destination);
+    close(file_descriptor);
-  free(canonical_destination);
+    return;
+  }
+  char* destination = config->receive_root_directory;
+  char* joined_destination = NULL;
+  if (destination && destination[0] != '/')
+    joined_destination = path_cat(authorized_root, destination);
+  if (joined_destination)
+    destination = joined_destination;
+  if (!destination || has_path_traversal(destination) ||
+      !path_is_within(authorized_root, destination)) {
+    log_message(LOG_LEVEL_ERROR, "Rejected destination outside authorized root");
+    free(joined_destination);
+    config_delete(config);
+    close(file_descriptor);
+    return;
+  }
+  if (joined_destination) {
     free(config->receive_root_directory);
-  config->receive_root_directory = str_dup(resolved_destination);
+    config->receive_root_directory = joined_destination;
+  }
   if (!config->receive_root_directory) {
     config_delete(config);
     close(file_descriptor);
@@ -106,13 +181,17 @@ void handler(int file_descriptor) {
       protocol_session_unbind();
       return;
     }
+    protocol_session_set_max_alloc(&context->session, config->max_alloc);
+    atomic_store(&context->session.total_allocated_bytes,
+                 atomic_load(&session.total_allocated_bytes));
+    pipeline_context_receiver_set_queue_byte_limit(context, RECEIVER_QUEUE_MAX_BYTES);
     thrd_t receiver, writer;
     bool receiver_created = thrd_create(&receiver, receive_thread, context) == thrd_success;
     bool writer_created = false;
     if (receiver_created)
       writer_created = thrd_create(&writer, write_thread, context) == thrd_success;
     if (!receiver_created || !writer_created) {
-      perror("Error creating Threads");
+      log_perror("Error creating Threads");
       if (receiver_created) {
         mtx_lock(&context->mutex);
         atomic_store(&context->cancelled, true);
@@ -134,9 +213,15 @@ void handler(int file_descriptor) {
     int writer_result;
     thrd_join(receiver, &receiver_result);
     thrd_join(writer, &writer_result);
-    send_status(file_descriptor, receiver_result == thrd_success && writer_result == thrd_success
+    bool transfer_ok = receiver_result == thrd_success && writer_result == thrd_success;
-                                     ? STATUS_OK
+    if (transfer_ok) {
-                                     : STATUS_ERROR);
+      if (!receiver_send_final_success(file_descriptor, config, &context->outcomes))
+        transfer_ok = false;
+    } else {
+      send_status(file_descriptor, STATUS_ERROR);
+    }
+    if (!transfer_ok)
+      log_message(LOG_LEVEL_ERROR, "Transfer failed");
     pipeline_context_receiver_destroy(context);
   } else {
     if (receiver_receive_files(config, file_descriptor) != 0)
@@ -167,8 +252,10 @@ static void print_server_usage(void) {
   printf("  --cert <path>       TLS certificate file (PEM)\n");
   printf("  --key <path>        TLS private key file (PEM)\n");
   printf("  --ca <path>         TLS CA certificate file (PEM)\n");
+  printf("  --client-cn <name>  Required TLS client certificate CN\n");
   printf("  --destination-root <path>  Authorized destination root (default: .)\n");
   printf("  --allow-delete      Permit manifest deletion\n");
+  printf("  --allow-unauthenticated  Allow plaintext/anonymous network clients\n");
   printf("  -v, --verbose       Enable debug logging\n");
   printf("  --help              Show this help\n");
 }
@@ -189,6 +276,7 @@ int main(int argc, char* argv[]) {
       stdio_mode = true;
     } else if (strcmp(argv[i], "-v") == 0 || strcmp(argv[i], "--verbose") == 0) {
       set_log_level(LOG_LEVEL_DEBUG);
+      set_log_debug_flags(LOG_DEBUG_ALL);
     } else if (strcmp(argv[i], "--tls") == 0) {
       use_tls = true;
     } else if (strcmp(argv[i], "--cert") == 0 && i + 1 < argc) {
@@ -197,20 +285,29 @@ int main(int argc, char* argv[]) {
       tls_key = argv[++i];
     } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) {
       tls_ca = argv[++i];
+    } else if (strcmp(argv[i], "--client-cn") == 0 && i + 1 < argc) {
+      required_client_cn = argv[++i];
     } else if (strcmp(argv[i], "--destination-root") == 0 && i + 1 < argc) {
       destination_root = argv[++i];
     } else if (strcmp(argv[i], "--allow-delete") == 0) {
       allow_delete = true;
+    } else if (strcmp(argv[i], "--allow-unauthenticated") == 0) {
+      allow_unauthenticated = true;
     } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) {
       char* end;
       long p = strtol(argv[++i], &end, 10);
       if (*end || p <= 0 || p > 65535) {
-        fprintf(stderr, "Error: invalid port '%s' (must be 1-65535)\n", argv[i]);
+        char* escaped = output_escape(argv[i], false);
+        fprintf(stderr, "Error: invalid port '%s' (must be 1-65535)\n",
+                escaped ? escaped : "<allocation failed>");
+        free(escaped);
         return 1;
       }
       port = (int)p;
     } else if (argv[i][0] == '-') {
-      fprintf(stderr, "Unknown option: %s\n", argv[i]);
+      char* escaped = output_escape(argv[i], false);
+      fprintf(stderr, "Unknown option: %s\n", escaped ? escaped : "<allocation failed>");
+      free(escaped);
       print_server_usage();
       return 1;
     }
@@ -220,39 +317,46 @@ int main(int argc, char* argv[]) {
   signal(SIGINT, cleanup);
   signal(SIGTERM, cleanup);
   if (!configure_authorization(destination_root)) {
-    fprintf(stderr, "Error: invalid destination root '%s'\n", destination_root);
+    char* escaped = output_escape(destination_root, false);
+    fprintf(stderr, "Error: invalid destination root '%s'\n",
+            escaped ? escaped : "<allocation failed>");
+    free(escaped);
     return 1;
   }
   if (stdio_mode) {
+    /* SSH authenticates the stdio transport outside of FastSync. */
+    allow_unauthenticated = true;
     io_set_fds(STDIN_FILENO, STDOUT_FILENO);
     handler(STDIN_FILENO);
-    file_set_authorized_root(-1, NULL);
+    release_authorization();
-    utils_set_authorized_root_fd(-1);
-    close(authorized_root_fd);
-    free(authorized_root);
     return 0;
   }
   g_server = server_create(port);
   if (!g_server) {
     log_message(LOG_LEVEL_ERROR, "Failed to create server");
+    release_authorization();
     return 1;
   }
   if (use_tls) {
-    if (!tls_cert || !tls_key) {
+    if (!tls_cert || !tls_key || !tls_ca || !required_client_cn) {
-      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      fprintf(stderr, "Error: --tls requires --cert, --key, --ca, and --client-cn\n");
       server_delete(&g_server);
+      release_authorization();
       return 1;
     }
     tls_global_init();
     if (!server_create_tls(g_server, tls_cert, tls_key, tls_ca)) {
       log_message(LOG_LEVEL_ERROR, "Failed to set up TLS");
       server_delete(&g_server);
+      release_authorization();
       return 1;
     }
     server_listen_tls(g_server, handler);
   } else {
     server_listen(g_server, handler);
   }
+  server_delete(&g_server);
+  release_authorization();
   return 0;
 }
 #endif

src/shared/array_list.c

@@ -1,16 +1,18 @@
+#include "log.h"
 #include "array_list.h"
+#include "protocol.h"
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
 ArrayList* array_list_create(void (*item_destroyer)(void* item)) {
-  ArrayList* list = (ArrayList*)malloc(sizeof(ArrayList));
+  ArrayList* list = (ArrayList*)protocol_alloc(sizeof(ArrayList));
   if (list == NULL) {
-    perror("ERROR: Could not allocate memory for array list struct");
+    log_perror("ERROR: Could not allocate memory for array list struct");
     return NULL;
   }
 
-  list->items = malloc(INITIAL_ARRAY_SIZE * sizeof(void*));
+  list->items = protocol_alloc(INITIAL_ARRAY_SIZE * sizeof(void*));
   if (list->items == NULL) {
     free(list);
     return NULL;
@@ -34,15 +36,15 @@ void array_list_delete(ArrayList* array_list) {
   free(array_list);
 }
 
-bool array_list_extend(ArrayList* array_list) {
+static bool array_list_extend(ArrayList* array_list) {
   if (array_list == NULL)
     return false;
   int new_capacity = array_list->capacity * 2;
   if (new_capacity == 0)
     new_capacity = INITIAL_ARRAY_SIZE;
-  void* new_items = realloc(array_list->items, new_capacity * sizeof(void*));
+  void* new_items = protocol_realloc(array_list->items, new_capacity * sizeof(void*));
   if (new_items == NULL) {
-    perror("ERROR: Could not reallocate memory for array list items");
+    log_perror("ERROR: Could not reallocate memory for array list items");
     return false;
   }
   array_list->items = new_items;
@@ -66,9 +68,9 @@ void** array_list_to_array(const ArrayList* array_list) {
   if (array_list == NULL) {
     return NULL;
   }
-  void** array = malloc(array_list->size * sizeof(void*));
+  void** array = protocol_alloc(array_list->size * sizeof(void*));
   if (array == NULL) {
-    perror("Could not malloc space for array from array list!");
+    log_perror("Could not malloc space for array from array list!");
     return NULL;
   }
   memcpy(array, array_list->items, array_list->size * sizeof(void*));

src/shared/array_list.h

@@ -14,7 +14,6 @@ typedef struct ArrayList {
 
 ArrayList* array_list_create(void (*item_destroyer)(void* item));
 void array_list_delete(ArrayList* array_list);
-bool array_list_extend(ArrayList* array_list);
 bool array_list_add(ArrayList* array_list, void* item);
 void** array_list_to_array(const ArrayList* array_list);
 

src/shared/chmod.c

@@ -0,0 +1,90 @@
+#include "chmod.h"
+#include <stddef.h>
+#include <string.h>
+
+static bool parse_clause(mode_t* mode, const char* begin, const char* end) {
+  const char* p = begin;
+  unsigned who = 0;
+  while (p < end && strchr("ugoa", *p)) {
+    if (*p == 'a')
+      who = 7;
+    else
+      who |= *p == 'u' ? 1U : (*p == 'g' ? 2U : 4U);
+    p++;
+  }
+  if (who == 0)
+    who = 7;
+  if (p == end || (*p != '+' && *p != '-' && *p != '='))
+    return false;
+  char operation = *p++;
+  mode_t bits = 0;
+  while (p < end) {
+    mode_t bit;
+    switch (*p++) {
+    case 'r':
+      bit = 4;
+      break;
+    case 'w':
+      bit = 2;
+      break;
+    case 'x':
+      bit = 1;
+      break;
+    default:
+      return false;
+    }
+    bits |= bit;
+  }
+  for (unsigned class_index = 0; class_index < 3; class_index++) {
+    unsigned class_bit = 1U << class_index;
+    if (!(who & class_bit))
+      continue;
+    mode_t shift = (mode_t)((2U - class_index) * 3U);
+    mode_t mask = (mode_t)(7U << shift);
+    mode_t class_bits = (mode_t)(bits << shift);
+    if (operation == '+')
+      *mode |= class_bits;
+    else if (operation == '-')
+      *mode &= ~class_bits;
+    else
+      *mode = (*mode & ~mask) | class_bits;
+  }
+  return true;
+}
+
+bool chmod_apply(mode_t mode, const char* spec, mode_t* result) {
+  if (!spec || !*spec || !result)
+    return false;
+  bool numeric = true;
+  size_t length = strlen(spec);
+  if (length > 4)
+    numeric = false;
+  for (size_t i = 0; i < length && numeric; i++)
+    numeric = spec[i] >= '0' && spec[i] <= '7';
+  if (numeric) {
+    if (length == 0 || length > 4)
+      return false;
+    mode_t parsed = 0;
+    for (size_t i = 0; i < length; i++)
+      parsed = (mode_t)((parsed << 3) | (spec[i] - '0'));
+    *result = parsed;
+    return true;
+  }
+
+  mode_t changed = mode;
+  const char* begin = spec;
+  while (*begin) {
+    const char* end = strchr(begin, ',');
+    if (!end)
+      end = begin + strlen(begin);
+    if (!parse_clause(&changed, begin, end))
+      return false;
+    if (*end == '\0')
+      break;
+    begin = end + 1;
+    if (!*begin)
+      return false;
+  }
+  *result = changed;
+  return true;
+}

src/shared/chmod.h

@@ -0,0 +1,10 @@
+#ifndef CHMOD_H
+#define CHMOD_H
+
+#include <stdbool.h>
+#include <sys/stat.h>
+
+/* Apply the supported rsync --chmod syntax to a permission mode. */
+bool chmod_apply(mode_t mode, const char* spec, mode_t* result);
+
+#endif

src/shared/chunk.c

@@ -1,4 +1,6 @@
 #include <stddef.h>
+#include <stdint.h>
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -11,22 +13,34 @@
 #include "log.h"
 #include "metadata.h"
 #include "protocol.h"
+#include "utils.h"
 
 /* Maximum individual file data size within a chunk (64 MB) */
 #define MAX_FILE_DATA_SIZE (64ULL * 1024 * 1024)
+#define MAX_FILES_PER_CHUNK 65536U
 
 Chunk* chunk_create(File** items, int element_count) {
-  Chunk* chunk = (Chunk*)malloc(sizeof(Chunk));
+  if (element_count < 0 || (element_count > 0 && items == NULL))
+    return NULL;
+  Chunk* chunk = (Chunk*)protocol_alloc(sizeof(Chunk));
   if (chunk == NULL) {
-    perror("ERROR: Could not allocate memory for chunk structure");
+    log_perror("ERROR: Could not allocate memory for chunk structure");
     return NULL;
   }
 
-  chunk->items = (File**)malloc(element_count * sizeof(File*));
+  if (element_count == 0) {
+    chunk->items = NULL;
+  } else {
+    if ((size_t)element_count > SIZE_MAX / sizeof(File*)) {
+      free(chunk);
+      return NULL;
+    }
+    chunk->items = (File**)protocol_alloc((size_t)element_count * sizeof(File*));
     if (chunk->items == NULL) {
       free(chunk);
       return NULL;
     }
+  }
 
   for (int i = 0; i < element_count; i++) {
     chunk->items[i] = items[i];
@@ -50,15 +64,37 @@ void chunk_destroy(void* item) {
 }
 
 static unsigned long long per_file_serialize_size(File* file, bool use_metadata) {
-  return sizeof(size_t) + strlen(file->path) +
+  unsigned long long size = sizeof(size_t);
-         (use_metadata ? sizeof(int) + (file->metadata ? FILE_METADATA_WIRE_SIZE : 0) : 0) +
+  size_t path_len = strlen(file->path);
-         sizeof(size_t) + file->data->size;
+  unsigned long long metadata_size =
+      use_metadata ? sizeof(int) + (file->metadata ? FILE_METADATA_WIRE_SIZE : 0) : 0;
+  if ((unsigned long long)path_len > ULLONG_MAX - size)
+    return 0;
+  size += path_len;
+  if (metadata_size > ULLONG_MAX - size)
+    return 0;
+  size += metadata_size;
+  if (sizeof(size_t) > ULLONG_MAX - size)
+    return 0;
+  size += sizeof(size_t);
+  if ((unsigned long long)file->data->size > ULLONG_MAX - size)
+    return 0;
+  return size + file->data->size;
 }
 
 Data* chunk_serialize(Chunk* chunk, bool use_metadata) {
+  if (!chunk || chunk->element_count < 0 || (chunk->element_count > 0 && chunk->items == NULL))
+    return NULL;
   unsigned long long data_size = 0;
   for (int i = 0; i < chunk->element_count; i++) {
-    data_size += per_file_serialize_size(chunk->items[i], use_metadata);
+    if (!chunk->items[i] || !chunk->items[i]->path || !chunk->items[i]->data ||
+        (chunk->items[i]->data->size > 0 && !chunk->items[i]->data->data) ||
+        chunk->items[i]->path[0] == '\0' || has_path_traversal(chunk->items[i]->path))
+      return NULL;
+    unsigned long long file_size = per_file_serialize_size(chunk->items[i], use_metadata);
+    if (file_size == 0 || file_size > ULLONG_MAX - data_size || data_size + file_size > SIZE_MAX)
+      return NULL;
+    data_size += file_size;
   }
   Data* data = data_create_empty(data_size);
   if (data == NULL) {
@@ -87,11 +123,20 @@ Data* chunk_serialize(Chunk* chunk, bool use_metadata) {
 }
 
 Chunk* chunk_deserialize(Data* data, bool use_metadata) {
+  if (!data || (!data->data && data->size != 0))
+    return NULL;
   ArrayList* files = array_list_create(file_destroy);
+  if (files == NULL)
+    return NULL;
   char* data_pointer = data->data;
   size_t remaining_size = data->size;
 
   while (remaining_size > 0) {
+    if ((unsigned int)files->size >= MAX_FILES_PER_CHUNK) {
+      log_message(LOG_LEVEL_ERROR, "Chunk contains too many files");
+      array_list_delete(files);
+      return NULL;
+    }
     if (remaining_size < sizeof(size_t)) {
       log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for path length");
       array_list_delete(files);
@@ -103,48 +148,77 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
     data_pointer += sizeof(size_t);
     remaining_size -= sizeof(size_t);
 
-    if (remaining_size < path_len) {
+    if (path_len > SIZE_MAX - 1 || remaining_size < path_len) {
       log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for path");
       array_list_delete(files);
       return NULL;
     }
 
-    char* path = malloc(path_len + 1);
+    if (path_len == SIZE_MAX) {
+      array_list_delete(files);
+      return NULL;
+    }
+    char* path = protocol_alloc(path_len + 1);
     if (path == NULL) {
-      perror("Could not allocate memory for file path");
+      log_perror("Could not allocate memory for file path");
       array_list_delete(files);
       return NULL;
     }
     memcpy(path, data_pointer, path_len);
     path[path_len] = '\0';
+    if (memchr(path, '\0', path_len) != NULL) {
+      free(path);
+      array_list_delete(files);
+      return NULL;
+    }
     data_pointer += path_len;
     remaining_size -= path_len;
 
+    if (path_len == 0 || has_path_traversal(path)) {
+      free(path);
+      array_list_delete(files);
+      return NULL;
+    }
+
     File* file = file_create(path);
     free(path);
+    if (file == NULL) {
+      array_list_delete(files);
+      return NULL;
+    }
 
     if (use_metadata) {
       if (remaining_size < sizeof(int)) {
         log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for metadata");
+        file_destroy(file);
         array_list_delete(files);
         return NULL;
       }
       // Peek at present flag to determine total size needed before reading
       int present_flag;
       memcpy(&present_flag, data_pointer, sizeof(int));
-      if (present_flag && remaining_size < sizeof(int) + FILE_METADATA_WIRE_SIZE) {
+      if ((present_flag != 0 && present_flag != 1) ||
+          (present_flag == 1 && remaining_size < sizeof(int) + FILE_METADATA_WIRE_SIZE)) {
         log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for metadata body");
+        file_destroy(file);
         array_list_delete(files);
         return NULL;
       }
       file->metadata = metadata_from_buf(&data_pointer);
       remaining_size -= sizeof(int);
-      if (file->metadata)
+      if (present_flag == 1) {
+        if (file->metadata == NULL) {
+          file_destroy(file);
+          array_list_delete(files);
+          return NULL;
+        }
         remaining_size -= FILE_METADATA_WIRE_SIZE;
       }
+    }
 
     if (remaining_size < sizeof(size_t)) {
       log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for data size");
+      file_destroy(file);
       array_list_delete(files);
       return NULL;
     }
@@ -156,6 +230,7 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
 
     if (remaining_size < file_data_size) {
       log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for file content");
+      file_destroy(file);
       array_list_delete(files);
       return NULL;
     }
@@ -164,29 +239,50 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
     if (file_data_size > MAX_FILE_DATA_SIZE) {
       log_message(LOG_LEVEL_ERROR, "File data size %zu exceeds maximum %llu", file_data_size,
                   (unsigned long long)MAX_FILE_DATA_SIZE);
+      file_destroy(file);
       array_list_delete(files);
       return NULL;
     }
 
-    void* file_data = malloc(file_data_size);
+    size_t allocation_size = file_data_size > 0 ? file_data_size : 1;
+    void* file_data = protocol_alloc(allocation_size);
     if (file_data == NULL) {
-      perror("Could not allocate memory for file data");
+      log_perror("Could not allocate memory for file data");
+      file_destroy(file);
       array_list_delete(files);
       return NULL;
     }
     memcpy(file_data, data_pointer, file_data_size);
+    Data* replacement = data_create(file_data, file_data_size);
+    if (replacement == NULL) {
+      file_destroy(file);
+      array_list_delete(files);
+      return NULL;
+    }
     data_destroy(file->data);
-    file->data = data_create(file_data, file_data_size);
+    file->data = replacement;
     data_pointer += file_data_size;
     remaining_size -= file_data_size;
 
-    array_list_add(files, file);
+    if (!array_list_add(files, file)) {
+      file_destroy(file);
+      array_list_delete(files);
+      return NULL;
+    }
   }
 
   File** file_array = (File**)array_list_to_array(files);
+  if (files->size > 0 && file_array == NULL) {
+    array_list_delete(files);
+    return NULL;
+  }
   Chunk* chunk = chunk_create(file_array, files->size);
 
   free(file_array);
+  if (chunk == NULL) {
+    array_list_delete(files);
+    return NULL;
+  }
   files->item_destroyer = NULL;
   array_list_delete(files);
 
@@ -194,27 +290,32 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
 }
 
 Data* chunk_compress(Chunk* chunk, int compression_level, bool use_metadata) {
+  return chunk_compress_with_threads(chunk, compression_level, use_metadata, 0);
+}
+
+Data* chunk_compress_with_threads(Chunk* chunk, int compression_level, bool use_metadata,
+                                  int compression_threads) {
   log_message(LOG_LEVEL_DEBUG, "Starting to compress chunk");
   Data* serialized = chunk_serialize(chunk, use_metadata);
   if (serialized == NULL)
     return NULL;
-  Data* compressed = data_compress(serialized, compression_level);
+  Data* compressed = data_compress_with_threads(serialized, compression_level, compression_threads);
   data_destroy(serialized);
   if (compressed == NULL)
     return NULL;
-  log_message(LOG_LEVEL_DEBUG, "Chunk successfully compressed");
+  log_debug_message(LOG_DEBUG_PACK, "Chunk successfully compressed");
   return compressed;
 }
 
 Chunk* receive_chunk_data(int fd, const Config* config) {
-  Data* chunk_data = receive_data(fd);
+  Data* chunk_data = receive_data_limited(fd, MAX_CHUNK_SIZE);
   if (chunk_data == NULL) {
     log_message(LOG_LEVEL_ERROR, "Failed to receive chunk data");
     return NULL;
   }
   Data* data_to_process = chunk_data;
   if (config->use_compression) {
-    data_to_process = data_decompress(chunk_data);
+    data_to_process = data_decompress_limited(chunk_data, MAX_CHUNK_SIZE);
     data_destroy(chunk_data);
     if (data_to_process == NULL) {
       log_message(LOG_LEVEL_ERROR, "Failed to decompress chunk");

src/shared/chunk.h

@@ -19,6 +19,8 @@ void chunk_destroy(void* chunk);
 Data* chunk_serialize(Chunk* chunk, bool use_metadata);
 Chunk* chunk_deserialize(Data* data, bool use_metadata);
 Data* chunk_compress(Chunk* chunk, int compression_level, bool use_metadata);
+Data* chunk_compress_with_threads(Chunk* chunk, int compression_level, bool use_metadata,
+                                  int compression_threads);
 Chunk* receive_chunk_data(int fd, const Config* config);
 
 #endif

src/shared/compression.c

@@ -1,31 +1,53 @@
 #include "compression.h"
 #include "data.h"
 #include "log.h"
+#include "protocol.h"
 #include <stdlib.h>
+#include <limits.h>
+#include <stdint.h>
 #include <string.h>
 #include <strings.h>
+#include <unistd.h>
 #include <zstd.h>
 
 #define INITIAL_DECOMPRESS_BUF_SIZE (1024 * 1024)
 #define MAX_DECOMPRESSED_SIZE (100ULL * 1024 * 1024) /* 100 MB hard ceiling */
 
-static const char* SKIP_COMPRESSION_EXTENSIONS[] = {".jpg", ".jpeg", ".png", ".gif", ".mp4", ".mkv",
+static char* SKIP_COMPRESSION_EXTENSIONS[] = {".jpg", ".jpeg", ".png", ".gif", ".mp4", ".mkv",
                                               ".zip", ".gz",   ".xz",  ".zst", NULL};
 
 bool compression_should_skip(const char* path) {
+  return compression_should_skip_with_suffixes(path, NULL, -1);
+}
+
+bool compression_should_skip_with_suffixes(const char* path, char* const* suffixes, int count) {
   if (!path)
     return false;
   const char* dot = strrchr(path, '.');
   if (!dot)
     return false;
-  for (int i = 0; SKIP_COMPRESSION_EXTENSIONS[i]; i++) {
+  if (count < 0) {
-    if (strcasecmp(dot, SKIP_COMPRESSION_EXTENSIONS[i]) == 0)
+    suffixes = SKIP_COMPRESSION_EXTENSIONS;
+    count = 0;
+    while (SKIP_COMPRESSION_EXTENSIONS[count])
+      count++;
+  }
+  for (int i = 0; i < count; i++) {
+    if (strcasecmp(dot, suffixes[i]) == 0)
       return true;
   }
   return false;
 }
 
 Data* data_compress(Data* data_to_compress, int compression_level) {
+  return data_compress_with_threads(data_to_compress, compression_level, 0);
+}
+
+Data* data_compress_with_threads(Data* data_to_compress, int compression_level,
+                                 int compression_threads) {
+  if (!data_to_compress || (!data_to_compress->data && data_to_compress->size != 0) ||
+      compression_threads < 0 || compression_threads > COMPRESSION_MAX_THREADS)
+    return NULL;
   log_message(LOG_LEVEL_DEBUG, "Starting to compress data");
   size_t dst_size = ZSTD_compressBound(data_to_compress->size);
   Data* compressed_data = data_create_empty(dst_size);
@@ -47,6 +69,30 @@ Data* data_compress(Data* data_to_compress, int compression_level) {
     return NULL;
   }
 
+  if (compression_threads > 0) {
+    long online_cpus = sysconf(_SC_NPROCESSORS_ONLN);
+    int available_threads = online_cpus > 0 && online_cpus < compression_threads
+                                ? (int)online_cpus
+                                : compression_threads;
+    zret = ZSTD_CCtx_setParameter(cctx, ZSTD_c_nbWorkers, available_threads);
+    if (ZSTD_isError(zret)) {
+      log_message(LOG_LEVEL_ERROR, "Failed to set compression threads: %s",
+                  ZSTD_getErrorName(zret));
+      ZSTD_freeCCtx(cctx);
+      data_destroy(compressed_data);
+      return NULL;
+    }
+    /* Streaming compression needs the source size before threaded mode can end a frame. */
+    zret = ZSTD_CCtx_setPledgedSrcSize(cctx, data_to_compress->size);
+    if (ZSTD_isError(zret)) {
+      log_message(LOG_LEVEL_ERROR, "Failed to set compression source size: %s",
+                  ZSTD_getErrorName(zret));
+      ZSTD_freeCCtx(cctx);
+      data_destroy(compressed_data);
+      return NULL;
+    }
+  }
+
   ZSTD_inBuffer input = {data_to_compress->data, data_to_compress->size, 0};
   ZSTD_outBuffer output = {compressed_data->data, dst_size, 0};
 
@@ -64,13 +110,16 @@ Data* data_compress(Data* data_to_compress, int compression_level) {
   compressed_data->size = output.pos;
   ZSTD_freeCCtx(cctx);
 
-  log_message(LOG_LEVEL_DEBUG, "Data succesfully compressed from %zu to %zu",
+  log_debug_message(LOG_DEBUG_UTIL, "Data succesfully compressed from %zu to %zu",
                     data_to_compress->size, compressed_data->size);
   return compressed_data;
 }
 
-Data* data_decompress(Data* compressed_data) {
+Data* data_decompress_limited(Data* compressed_data, size_t maximum_size) {
-  log_message(LOG_LEVEL_DEBUG, "Start to decompress data");
+  if (!compressed_data || (!compressed_data->data && compressed_data->size != 0) ||
+      maximum_size == 0)
+    return NULL;
+  log_debug_message(LOG_DEBUG_UTIL, "Start to decompress data");
   unsigned long long dst_size =
       ZSTD_getFrameContentSize(compressed_data->data, compressed_data->size);
   if (ZSTD_isError(dst_size)) {
@@ -82,15 +131,16 @@ Data* data_decompress(Data* compressed_data) {
   // ZSTD_CONTENTSIZE_UNKNOWN (~2^64) can cause massive allocation;
   // fall back to a conservative estimate (3x compressed size) when unknown.
   if (dst_size == ZSTD_CONTENTSIZE_UNKNOWN) {
+    if (compressed_data->size > ULLONG_MAX / 3)
+      return NULL;
     dst_size = compressed_data->size * 3;
     if (dst_size < INITIAL_DECOMPRESS_BUF_SIZE)
       dst_size = INITIAL_DECOMPRESS_BUF_SIZE;
-    if (dst_size > MAX_DECOMPRESSED_SIZE)
-      dst_size = MAX_DECOMPRESSED_SIZE;
   }
-  if (dst_size > MAX_DECOMPRESSED_SIZE) {
+  unsigned long long hard_limit =
-    log_message(LOG_LEVEL_ERROR, "Declared decompressed size exceeds %llu bytes",
+      maximum_size < MAX_DECOMPRESSED_SIZE ? maximum_size : MAX_DECOMPRESSED_SIZE;
-                (unsigned long long)MAX_DECOMPRESSED_SIZE);
+  if (dst_size > hard_limit) {
+    log_message(LOG_LEVEL_ERROR, "Declared decompressed size exceeds %llu bytes", hard_limit);
     return NULL;
   }
 
@@ -101,6 +151,8 @@ Data* data_decompress(Data* compressed_data) {
   }
 
   size_t buf_size = (dst_size > 0) ? (size_t)dst_size : INITIAL_DECOMPRESS_BUF_SIZE;
+  if (buf_size > maximum_size)
+    buf_size = maximum_size;
   Data* uncompressed_data = data_create_empty(buf_size);
   if (!uncompressed_data) {
     log_message(LOG_LEVEL_ERROR, "Failed to allocate decompression buffer");
@@ -121,7 +173,7 @@ Data* data_decompress(Data* compressed_data) {
       return NULL;
     }
     if (ret > 0 && output.pos == output.size) {
-      if (buf_size >= MAX_DECOMPRESSED_SIZE) {
+      if (buf_size >= hard_limit || buf_size > SIZE_MAX / 2) {
         log_message(LOG_LEVEL_ERROR, "Decompressed data exceeds %llu bytes",
                     (unsigned long long)MAX_DECOMPRESSED_SIZE);
         ZSTD_freeDCtx(dctx);
@@ -129,9 +181,9 @@ Data* data_decompress(Data* compressed_data) {
         return NULL;
       }
       buf_size *= 2;
-      if (buf_size > MAX_DECOMPRESSED_SIZE)
+      if (buf_size > hard_limit)
-        buf_size = MAX_DECOMPRESSED_SIZE;
+        buf_size = (size_t)hard_limit;
-      void* new_data = realloc(uncompressed_data->data, buf_size);
+      void* new_data = protocol_realloc(uncompressed_data->data, buf_size);
       if (!new_data) {
         log_message(LOG_LEVEL_ERROR, "Failed to grow decompression buffer");
         ZSTD_freeDCtx(dctx);
@@ -147,6 +199,10 @@ Data* data_decompress(Data* compressed_data) {
   uncompressed_data->size = output.pos;
   ZSTD_freeDCtx(dctx);
 
-  log_message(LOG_LEVEL_DEBUG, "Decompressed data successfully");
+  log_debug_message(LOG_DEBUG_UTIL, "Decompressed data successfully");
   return uncompressed_data;
 }
+
+Data* data_decompress(Data* compressed_data) {
+  return data_decompress_limited(compressed_data, MAX_DECOMPRESSED_SIZE);
+}

src/shared/compression.h

@@ -4,8 +4,14 @@
 #include "data.h"
 #include <stdbool.h>
 
+#define COMPRESSION_MAX_THREADS 64
+
 Data* data_compress(Data* data_to_compress, int compression_level);
+Data* data_compress_with_threads(Data* data_to_compress, int compression_level,
+                                 int compression_threads);
 Data* data_decompress(Data* compressed_data);
+Data* data_decompress_limited(Data* compressed_data, size_t maximum_size);
 bool compression_should_skip(const char* path);
+bool compression_should_skip_with_suffixes(const char* path, char* const* suffixes, int count);
 
 #endif

src/shared/config.c

@@ -1,4 +1,5 @@
 #include "config.h"
+#include "chmod.h"
 #include "delta.h"
 #include "log.h"
 #include "protocol.h"
@@ -17,10 +18,14 @@ static void config_set_defaults(Config* config) {
   config->use_chunk_serialization = false;
   config->use_compression = false;
   config->use_metadata = false;
+  config->use_executability = false;
+  config->metadata_explicitly_disabled = false;
   config->show_progress = false;
   config->dry_run = false;
+  config->remove_source_files = false;
   config->use_delete = false;
   config->compression_level = 5;
+  config->compression_threads = 0;
   config->use_sendfile = false;
   config->chunk_size = DEFAULT_CHUNK_SIZE;
   config->ssh_port = 22;
@@ -33,8 +38,13 @@ static void config_set_defaults(Config* config) {
   config->include_count = 0;
   config->max_size = 0;
   config->min_size = 0;
+  config->max_alloc = DEFAULT_MAX_ALLOC;
   config->use_incremental = false;
+  config->ignore_times = false;
+  config->size_only = false;
   config->use_delta = false;
+  config->whole_file = false;
+  config->modify_window = 0;
   config->delta_block_size = DELTA_BLOCK_SIZE_DEFAULT;
   config->delta_max_file_size = DELTA_MAX_FILE_SIZE;
   config->use_tls = false;
@@ -64,12 +74,17 @@ static void config_set_defaults(Config* config) {
   config->preserve_sparse = false;
   config->itemize_changes = false;
   config->out_format = NULL;
+  config->log_file_format = NULL;
   config->info_level = 0;
   config->debug_level = 0;
   config->list_only = false;
   config->human_readable = false;
+  config->eight_bit_output = false;
+  config->existing = false;
+  config->ignore_existing = false;
   config->update = false;
   config->inplace = false;
+  config->use_fsync = false;
   config->append = false;
   config->append_verify = false;
   config->delete_excluded = false;
@@ -82,6 +97,7 @@ static void config_set_defaults(Config* config) {
   config->relative = false;
   config->rsh_command = NULL;
   config->rsync_path = NULL;
+  config->old_args = false;
   config->temp_dir = NULL;
   config->compare_dest = NULL;
   config->copy_dest = NULL;
@@ -98,6 +114,56 @@ static void config_set_defaults(Config* config) {
   config->server_mode = false;
   config->checksum = false;
   config->compress_choice = NULL;
+  config->chmod_spec = NULL;
+  config->skip_compress_suffixes = NULL;
+  config->skip_compress_count = 0;
+  config->skip_compress_set = false;
+}
+
+static bool valid_wire_bool(int value) {
+  return value == 0 || value == 1;
+}
+
+static bool receive_wire_bool(int fd, bool* value) {
+  int wire_value;
+  if (!receive_int(fd, &wire_value) || !valid_wire_bool(wire_value))
+    return false;
+  *value = wire_value != 0;
+  return true;
+}
+
+static bool validate_received_config(const Config* config) {
+  return valid_wire_bool(config->save_to_disk) && valid_wire_bool(config->use_multithreading) &&
+         valid_wire_bool(config->use_chunk_serialization) &&
+         valid_wire_bool(config->use_compression) && valid_wire_bool(config->use_metadata) &&
+         valid_wire_bool(config->use_executability) && valid_wire_bool(config->use_sendfile) &&
+         valid_wire_bool(config->use_delete) && valid_wire_bool(config->use_incremental) &&
+         valid_wire_bool(config->size_only) && valid_wire_bool(config->ignore_times) &&
+         valid_wire_bool(config->use_delta) && valid_wire_bool(config->backup) &&
+         valid_wire_bool(config->remove_source_files) && valid_wire_bool(config->follow_symlinks) &&
+         valid_wire_bool(config->copy_links) && valid_wire_bool(config->safe_links) &&
+         valid_wire_bool(config->copy_unsafe_links) &&
+         valid_wire_bool(config->preserve_hard_links) && valid_wire_bool(config->preserve_acls) &&
+         valid_wire_bool(config->preserve_xattrs) && valid_wire_bool(config->preserve_devices) &&
+         valid_wire_bool(config->preserve_sparse) && valid_wire_bool(config->ignore_existing) &&
+         valid_wire_bool(config->existing) && valid_wire_bool(config->update) &&
+         valid_wire_bool(config->inplace) && valid_wire_bool(config->append) &&
+         valid_wire_bool(config->use_fsync) && valid_wire_bool(config->append_verify) &&
+         valid_wire_bool(config->delete_excluded) && valid_wire_bool(config->delete_after) &&
+         valid_wire_bool(config->relative) && valid_wire_bool(config->prune_empty_dirs) &&
+         valid_wire_bool(config->partial) && valid_wire_bool(config->delete_before) &&
+         valid_wire_bool(config->checksum) && valid_wire_bool(config->eight_bit_output) &&
+         !(config->skip_compress_set && config->use_chunk_serialization) &&
+         (!config->use_compression ||
+          (config->compression_level >= 1 && config->compression_level <= 22)) &&
+         config->chunk_size > 0 && config->chunk_size <= MAX_CHUNK_SIZE &&
+         config->delta_block_size >= DELTA_BLOCK_SIZE_MIN &&
+         config->delta_block_size <= DELTA_BLOCK_SIZE_MAX &&
+         config->delta_max_file_size <= DELTA_MAX_FILE_SIZE && config->modify_window >= 0 &&
+         config->max_delete >= 0 && config->skip_compress_count >= 0 &&
+         config->skip_compress_count <= 10000 && config->max_alloc > 0 &&
+         (!config->chmod_spec || !*config->chmod_spec ||
+          chmod_apply(0, config->chmod_spec, &(mode_t){0}));
 }
 
 Config* config_create(void) {
@@ -108,7 +174,7 @@ Config* config_create(void) {
   return config;
 }
 
-bool is_remote_dest(const char* s) {
+bool config_is_remote_dest(const char* s) {
   if (s == NULL)
     return false;
   const char* colon = strchr(s, ':');
@@ -124,7 +190,7 @@ bool is_remote_dest(const char* s) {
 }
 
 void config_parse_ssh_dest(Config* config) {
-  if (!is_remote_dest(config->receive_root_directory))
+  if (!config_is_remote_dest(config->receive_root_directory))
     return;
   config->transport = TRANSPORT_SSH;
   config->ssh_destination = str_dup(config->receive_root_directory);
@@ -137,6 +203,10 @@ void config_parse_ssh_dest(Config* config) {
 void config_delete(Config* config) {
   if (config == NULL)
     return;
+  if (config->log_file) {
+    fclose(config->log_file);
+    config->log_file = NULL;
+  }
   free(config->version);
   free(config->send_directory);
   free(config->receive_root_directory);
@@ -154,6 +224,7 @@ void config_delete(Config* config) {
   free(config->backup_dir);
   free(config->server_host);
   free(config->out_format);
+  free(config->log_file_format);
   free(config->files_from);
   free(config->rsh_command);
   free(config->rsync_path);
@@ -167,6 +238,12 @@ void config_delete(Config* config) {
   free(config->bind_address);
   free(config->daemon_config);
   free(config->compress_choice);
+  free(config->chmod_spec);
+  if (config->skip_compress_suffixes) {
+    for (int i = 0; i < config->skip_compress_count; i++)
+      free(config->skip_compress_suffixes[i]);
+    free(config->skip_compress_suffixes);
+  }
   if (config->filters) {
     array_list_delete(config->filters);
   }
@@ -177,149 +254,209 @@ void config_delete(Config* config) {
  * helper call order in config_send and config_receive unchanged when adding
  * fields. */
 static bool send_core_fields(int fd, const Config* c) {
-  return send_str(fd, c->version) && send_str(fd, c->send_directory) &&
+  if (!send_str(fd, c->version) || !send_int(fd, c->eight_bit_output))
-         send_str(fd, c->receive_root_directory) && send_int(fd, c->save_to_disk) &&
+    return false;
-         send_int(fd, c->use_multithreading) && send_int(fd, c->use_chunk_serialization) &&
+  protocol_set_8_bit_output(c->eight_bit_output);
-         send_int(fd, c->use_compression) && send_int(fd, c->use_metadata) &&
+  if (!send_n_data(fd, &c->max_alloc, sizeof(c->max_alloc)))
+    return false;
+  return send_str(fd, c->send_directory) && send_str(fd, c->receive_root_directory) &&
+         send_int(fd, c->save_to_disk) && send_int(fd, c->use_multithreading) &&
+         send_int(fd, c->use_chunk_serialization) && send_int(fd, c->use_compression) &&
+         send_int(fd, c->use_metadata) && send_int(fd, c->use_executability) &&
          send_int(fd, c->compression_level) &&
          send_n_data(fd, &c->chunk_size, sizeof(c->chunk_size)) && send_int(fd, c->use_sendfile);
 }
 
 static bool send_delta_fields(int fd, const Config* c) {
   return send_int(fd, c->use_delete) && send_int(fd, c->use_incremental) &&
-         send_int(fd, c->use_delta) &&
+         send_int(fd, c->size_only) && send_int(fd, c->ignore_times) &&
+         send_int(fd, c->use_delta && !c->whole_file) &&
          send_n_data(fd, &c->delta_block_size, sizeof(c->delta_block_size)) &&
          send_n_data(fd, &c->delta_max_file_size, sizeof(unsigned long long));
 }
 
 static bool send_file_options(int fd, const Config* c) {
   return send_int(fd, c->backup) && send_str(fd, c->backup_dir ? c->backup_dir : "") &&
-         send_int(fd, c->follow_symlinks) && send_int(fd, c->copy_links) &&
+         send_int(fd, c->remove_source_files) && send_int(fd, c->follow_symlinks) &&
-         send_int(fd, c->safe_links) && send_int(fd, c->copy_unsafe_links) &&
+         send_int(fd, c->copy_links) && send_int(fd, c->safe_links) &&
-         send_int(fd, c->preserve_hard_links) && send_int(fd, c->preserve_acls) &&
+         send_int(fd, c->copy_unsafe_links) && send_int(fd, c->preserve_hard_links) &&
-         send_int(fd, c->preserve_xattrs) && send_int(fd, c->preserve_devices) &&
+         send_int(fd, c->preserve_acls) && send_int(fd, c->preserve_xattrs) &&
-         send_int(fd, c->preserve_sparse);
+         send_int(fd, c->preserve_devices) && send_int(fd, c->preserve_sparse);
 }
 
 static bool send_selection_options(int fd, const Config* c) {
-  return send_int(fd, c->update) && send_int(fd, c->inplace) && send_int(fd, c->append) &&
+  return send_int(fd, c->ignore_existing) && send_int(fd, c->existing) && send_int(fd, c->update) &&
+         send_int(fd, c->inplace) && send_int(fd, c->append) && send_int(fd, c->use_fsync) &&
          send_int(fd, c->append_verify) && send_int(fd, c->delete_excluded) &&
          send_int(fd, c->delete_after) && send_n_data(fd, &c->max_delete, sizeof(c->max_delete)) &&
          send_int(fd, c->relative) && send_int(fd, c->prune_empty_dirs);
 }
 
+static bool send_skip_compress_options(int fd, const Config* c) {
+  if (!send_int(fd, c->skip_compress_set) || !send_int(fd, c->skip_compress_count))
+    return false;
+  for (int i = 0; i < c->skip_compress_count; i++) {
+    if (!send_str(fd, c->skip_compress_suffixes[i]))
+      return false;
+  }
+  return true;
+}
+
 static bool send_resume_options(int fd, const Config* c) {
   return send_str(fd, c->temp_dir ? c->temp_dir : "") && send_int(fd, c->partial) &&
          send_str(fd, c->partial_dir ? c->partial_dir : "") &&
          send_str(fd, c->suffix ? c->suffix : "") && send_int(fd, c->delete_before) &&
-         send_int(fd, c->checksum) && send_str(fd, c->compress_choice ? c->compress_choice : "");
+         send_int(fd, c->checksum) && send_int(fd, c->modify_window) &&
+         send_str(fd, c->compress_choice ? c->compress_choice : "") &&
+         send_str(fd, c->chmod_spec ? c->chmod_spec : "") && send_skip_compress_options(fd, c);
 }
 
 static bool receive_core_fields(int fd, Config* c) {
   int value;
+  if (!receive_wire_bool(fd, &c->eight_bit_output))
+    return false;
+  protocol_set_8_bit_output(c->eight_bit_output);
+  if (!receive_n_data(fd, &c->max_alloc, sizeof(c->max_alloc)) || c->max_alloc == 0)
+    return false;
+  if (c->max_alloc > MAX_SERVER_ALLOC)
+    c->max_alloc = MAX_SERVER_ALLOC;
+  protocol_session_set_max_alloc(NULL, c->max_alloc);
   c->send_directory = receive_str(fd);
   c->receive_root_directory = receive_str(fd);
   if (!c->send_directory || !c->receive_root_directory)
     return false;
-  if (!receive_int(fd, &value))
+  if (!receive_wire_bool(fd, &c->save_to_disk) || !receive_wire_bool(fd, &c->use_multithreading) ||
+      !receive_wire_bool(fd, &c->use_chunk_serialization) ||
+      !receive_wire_bool(fd, &c->use_compression) || !receive_wire_bool(fd, &c->use_metadata) ||
+      !receive_wire_bool(fd, &c->use_executability))
     return false;
-  c->save_to_disk = value;
-  if (!receive_int(fd, &value))
-    return false;
-  c->use_multithreading = value;
-  if (!receive_int(fd, &value))
-    return false;
-  c->use_chunk_serialization = value;
-  if (!receive_int(fd, &value))
-    return false;
-  c->use_compression = value;
-  if (!receive_int(fd, &value))
-    return false;
-  c->use_metadata = value;
   if (!receive_int(fd, &value))
     return false;
   c->compression_level = value;
   if (!receive_n_data(fd, &c->chunk_size, sizeof(c->chunk_size)))
     return false;
-  if (!receive_int(fd, &value))
+  if (!receive_wire_bool(fd, &c->use_sendfile))
     return false;
-  c->use_sendfile = value;
   return true;
 }
 
 static bool receive_delta_fields(int fd, Config* c) {
-  int value;
+  if (!receive_wire_bool(fd, &c->use_delete))
-  if (!receive_int(fd, &value))
     return false;
-  c->use_delete = value;
+  if (!receive_wire_bool(fd, &c->use_incremental))
-  if (!receive_int(fd, &value))
     return false;
-  c->use_incremental = value;
+  if (!receive_wire_bool(fd, &c->size_only))
-  if (!receive_int(fd, &value))
+    return false;
+  if (!receive_wire_bool(fd, &c->ignore_times))
+    return false;
+  if (!receive_wire_bool(fd, &c->use_delta))
     return false;
-  c->use_delta = value;
   return receive_n_data(fd, &c->delta_block_size, sizeof(c->delta_block_size)) &&
          receive_n_data(fd, &c->delta_max_file_size, sizeof(unsigned long long));
 }
 
 static bool receive_file_options(int fd, Config* c) {
-  int value;
+  if (!receive_wire_bool(fd, &c->backup))
-  if (!receive_int(fd, &value))
     return false;
-  c->backup = value;
+  char* backup_dir = receive_str(fd);
-  c->backup_dir = receive_str(fd);
+  if (!backup_dir)
-  if (!c->backup_dir)
+    return false;
+  if (*backup_dir != '\0') {
+    c->backup_dir = backup_dir;
+  } else {
+    /* The sender serializes an unset (NULL) string as "", so canonicalize the
+       empty wire value back to NULL to preserve NULL-vs-empty semantics. */
+    free(backup_dir);
+  }
+  if (!receive_wire_bool(fd, &c->remove_source_files))
     return false;
   bool* flags[] = {&c->follow_symlinks,   &c->copy_links,          &c->safe_links,
                    &c->copy_unsafe_links, &c->preserve_hard_links, &c->preserve_acls,
                    &c->preserve_xattrs,   &c->preserve_devices,    &c->preserve_sparse};
   for (size_t i = 0; i < sizeof(flags) / sizeof(flags[0]); i++) {
-    if (!receive_int(fd, &value))
+    if (!receive_wire_bool(fd, flags[i]))
       return false;
-    *flags[i] = value;
   }
   return true;
 }
 
 static bool receive_selection_options(int fd, Config* c) {
-  int value;
+  bool* flags[] = {&c->ignore_existing, &c->existing,        &c->update,
-  bool* flags[] = {&c->update,        &c->inplace,         &c->append,
+                   &c->inplace,         &c->append,          &c->use_fsync,
                    &c->append_verify,   &c->delete_excluded, &c->delete_after};
   for (size_t i = 0; i < sizeof(flags) / sizeof(flags[0]); i++) {
-    if (!receive_int(fd, &value))
+    if (!receive_wire_bool(fd, flags[i]))
       return false;
-    *flags[i] = value;
   }
   if (!receive_n_data(fd, &c->max_delete, sizeof(c->max_delete)))
     return false;
-  if (!receive_int(fd, &value))
+  if (!receive_wire_bool(fd, &c->relative))
     return false;
-  c->relative = value;
+  if (!receive_wire_bool(fd, &c->prune_empty_dirs))
-  if (!receive_int(fd, &value))
     return false;
-  c->prune_empty_dirs = value;
   return true;
 }
 
 static bool receive_resume_options(int fd, Config* c) {
-  int value;
+  char* temp_dir = receive_str(fd);
-  c->temp_dir = receive_str(fd);
+  if (!temp_dir)
-  if (!c->temp_dir || !receive_int(fd, &value))
     return false;
-  c->partial = value;
+  if (*temp_dir != '\0') {
-  c->partial_dir = receive_str(fd);
+    c->temp_dir = temp_dir;
-  c->suffix = c->partial_dir ? receive_str(fd) : NULL;
+  } else {
-  if (!c->partial_dir || !c->suffix || !receive_int(fd, &value))
+    free(temp_dir);
+  }
+  if (!receive_wire_bool(fd, &c->partial))
     return false;
-  c->delete_before = value;
+  /* These options have NULL client defaults, so the sender transmits an empty
-  if (!receive_int(fd, &value))
+     string for "unset".  Canonicalize the empty wire value back to NULL so
+     receivers observe exactly what the client configured (plain --backup, for
+     example, must not look like --backup-dir ""). */
+  char* partial_dir = receive_str(fd);
+  if (!partial_dir)
+    return false;
+  if (*partial_dir != '\0') {
+    c->partial_dir = partial_dir;
+  } else {
+    free(partial_dir);
+  }
+  char* suffix = receive_str(fd);
+  if (!suffix)
+    return false;
+  if (*suffix != '\0') {
+    c->suffix = suffix;
+  } else {
+    free(suffix);
+  }
+  if (!receive_wire_bool(fd, &c->delete_before))
+    return false;
+  if (!receive_wire_bool(fd, &c->checksum))
+    return false;
+  if (!receive_n_data(fd, &c->modify_window, sizeof(c->modify_window)))
     return false;
-  c->checksum = value;
   c->compress_choice = receive_str(fd);
-  return c->compress_choice != NULL;
+  if (!c->compress_choice)
+    return false;
+  c->chmod_spec = receive_str(fd);
+  if (!c->chmod_spec || !receive_wire_bool(fd, &c->skip_compress_set) ||
+      !receive_int(fd, &c->skip_compress_count) || c->skip_compress_count < 0 ||
+      c->skip_compress_count > 10000)
+    return false;
+  if (c->skip_compress_count > 0) {
+    c->skip_compress_suffixes = calloc((size_t)c->skip_compress_count, sizeof(char*));
+    if (!c->skip_compress_suffixes)
+      return false;
+    for (int i = 0; i < c->skip_compress_count; i++) {
+      c->skip_compress_suffixes[i] = receive_str(fd);
+      if (!c->skip_compress_suffixes[i])
+        return false;
+    }
+  }
+  return true;
 }
 
 bool config_send(int file_descriptor, const Config* config) {
+  protocol_session_set_max_alloc(NULL, config->max_alloc);
   if (!send_core_fields(file_descriptor, config) || !send_delta_fields(file_descriptor, config) ||
       !send_file_options(file_descriptor, config) ||
       !send_selection_options(file_descriptor, config) ||
@@ -344,8 +481,10 @@ Config* config_receive(int file_descriptor) {
   if (!config->version)
     goto error;
   if (strcmp(config->version, PROTOCOL_VERSION) != 0) {
-    fprintf(stderr, "Protocol version mismatch: client=%s, server=%s\n", config->version,
+    char* escaped_version = output_escape(config->version, false);
-            PROTOCOL_VERSION);
+    fprintf(stderr, "Protocol version mismatch: client=%s, server=%s\n",
+            escaped_version ? escaped_version : "<allocation failed>", PROTOCOL_VERSION);
+    free(escaped_version);
     send_status(file_descriptor, STATUS_ERROR);
     goto error;
   }
@@ -357,7 +496,15 @@ Config* config_receive(int file_descriptor) {
     goto error;
   if (config->compress_choice[0] != '\0' && strcmp(config->compress_choice, "zstd") != 0 &&
       strcmp(config->compress_choice, "none") != 0) {
-    fprintf(stderr, "Unsupported compression choice: %s\n", config->compress_choice);
+    char* escaped_choice = output_escape(config->compress_choice, config->eight_bit_output);
+    fprintf(stderr, "Unsupported compression choice: %s\n",
+            escaped_choice ? escaped_choice : "<allocation failed>");
+    free(escaped_choice);
+    send_status(file_descriptor, STATUS_ERROR);
+    goto error;
+  }
+  if (!validate_received_config(config)) {
+    fprintf(stderr, "Invalid configuration received from client\n");
     send_status(file_descriptor, STATUS_ERROR);
     goto error;
   }

src/shared/config.h

@@ -18,10 +18,14 @@ typedef struct Config {
   bool use_compression;
   bool use_sendfile;
   bool use_metadata;
+  bool use_executability;
+  bool metadata_explicitly_disabled;
   bool show_progress;
   bool dry_run;
+  bool remove_source_files;
   bool use_delete;
   int compression_level;
+  int compression_threads;
   unsigned long long chunk_size;
   int ssh_port;
   TransportType transport;
@@ -33,8 +37,13 @@ typedef struct Config {
   int include_count;
   unsigned long long max_size;
   unsigned long long min_size;
+  unsigned long long max_alloc;
   bool use_incremental;
+  bool ignore_times;
+  bool size_only;
   bool use_delta;
+  bool whole_file;
+  int modify_window;
   uint32_t delta_block_size;
   unsigned long long delta_max_file_size;
   bool use_tls;
@@ -70,14 +79,19 @@ typedef struct Config {
   // Issue #122: Output/logging options
   bool itemize_changes;
   char* out_format;
+  char* log_file_format;
   int info_level;
   int debug_level;
   bool list_only;
   bool human_readable;
+  bool eight_bit_output;
 
   // Issue #127: Transfer modes
+  bool existing;
+  bool ignore_existing;
   bool update;
   bool inplace;
+  bool use_fsync;
   bool append;
   bool append_verify;
 
@@ -96,6 +110,7 @@ typedef struct Config {
   // Issue #130: Remote shell/connection options
   char* rsh_command;
   char* rsync_path;
+  bool old_args;
   char* temp_dir;
   char* compare_dest;
   char* copy_dest;
@@ -126,16 +141,21 @@ typedef struct Config {
 
   // PR #184: Compression algorithm negotiation
   char* compress_choice;
+  char* chmod_spec;
+
+  char** skip_compress_suffixes;
+  int skip_compress_count;
+  bool skip_compress_set;
 } Config;
 
-#define PROTOCOL_VERSION "2.2.0"
+#define PROTOCOL_VERSION "2.5.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 
 Config* config_create(void);
 void config_delete(Config* config);
 bool config_send(int file_descriptor, const Config* config);
 Config* config_receive(int file_descriptor);
-bool is_remote_dest(const char* s);
+bool config_is_remote_dest(const char* s);
 void config_parse_ssh_dest(Config* config);
 
 #endif

src/shared/data.c

@@ -1,11 +1,12 @@
 #include "data.h"
 #include "log.h"
+#include "protocol.h"
 #include <stdlib.h>
 
 Data* data_create_empty(size_t data_size) {
   /* malloc(0) is UB; allocate at least 1 byte but preserve requested size */
   size_t alloc_size = data_size > 0 ? data_size : 1;
-  void* data = malloc(alloc_size);
+  void* data = protocol_alloc(alloc_size);
   if (data == NULL) {
     log_message(LOG_LEVEL_ERROR, "Could not allocate memory for empty data");
     return NULL;
@@ -14,18 +15,19 @@ Data* data_create_empty(size_t data_size) {
 }
 
 Data* data_create_reserve(size_t size) {
-  Data* d = malloc(sizeof(Data));
+  Data* d = protocol_alloc(sizeof(Data));
   if (d == NULL) {
     log_message(LOG_LEVEL_ERROR, "Could not allocate memory for data");
     return NULL;
   }
   d->data = NULL;
   d->size = size;
+  d->protocol_charge = 0;
   return d;
 }
 
 Data* data_create(void* data, size_t data_size) {
-  Data* new_data = malloc(sizeof(Data));
+  Data* new_data = protocol_alloc(sizeof(Data));
   if (new_data == NULL) {
     log_message(LOG_LEVEL_ERROR, "Could not allocate memory for data");
     free(data);
@@ -33,12 +35,15 @@ Data* data_create(void* data, size_t data_size) {
   }
   new_data->data = data;
   new_data->size = data_size;
+  new_data->protocol_charge = 0;
   return new_data;
 }
 
 void data_destroy(Data* data) {
   if (data == NULL)
     return;
+  if (data->protocol_charge != 0)
+    protocol_release_memory(data->protocol_charge);
   free(data->data);
   free(data);
 }

src/shared/data.h

@@ -6,11 +6,14 @@
 typedef struct {
   void* data;
   size_t size;
+  /* Non-zero only for a buffer charged to the protocol connection budget. */
+  size_t protocol_charge;
 } Data;
 
 Data* data_create_empty(size_t data_size);
 Data* data_create_reserve(size_t size);
 Data* data_create(void* data, size_t data_size);
 void data_destroy(Data* data);
+void protocol_release_memory(size_t charge);
 
 #endif

src/shared/delta.c

@@ -1,6 +1,8 @@
 #include "delta.h"
 #include "log.h"
+#include "protocol.h"
 #include <stdint.h>
+#include <limits.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -36,16 +38,24 @@ DeltaSignature* delta_signature_create(const void* old_file_data, uint64_t old_f
   if (old_file_data == NULL || old_file_size == 0 || block_size == 0)
     return NULL;
 
+  if (old_file_size > DELTA_MAX_FILE_SIZE || block_size > DELTA_BLOCK_SIZE_MAX ||
+      old_file_size > UINT32_MAX * (uint64_t)block_size)
+    return NULL;
+
   uint32_t block_count = (uint32_t)((old_file_size + block_size - 1) / block_size);
 
-  DeltaSignature* sig = malloc(sizeof(DeltaSignature));
+  DeltaSignature* sig = protocol_alloc(sizeof(DeltaSignature));
   if (!sig)
     return NULL;
 
   sig->file_size = old_file_size;
   sig->block_size = block_size;
   sig->block_count = block_count;
-  sig->blocks = malloc(block_count * sizeof(DeltaBlockSig));
+  if (block_count == 0) {
+    free(sig);
+    return NULL;
+  }
+  sig->blocks = protocol_alloc((size_t)block_count * sizeof(DeltaBlockSig));
   if (!sig->blocks) {
     free(sig);
     return NULL;
@@ -67,10 +77,13 @@ Data* delta_signature_serialize(const DeltaSignature* sig) {
   if (!sig)
     return NULL;
 
-  uint64_t total = sizeof(uint64_t) + sizeof(uint32_t) + sizeof(uint32_t) +
+  uint64_t block_bytes = (uint64_t)sig->block_count * (sizeof(uint32_t) + sizeof(uint32_t));
-                   (uint64_t)sig->block_count * (sizeof(uint32_t) + sizeof(uint32_t));
+  uint64_t total = sizeof(uint64_t) + sizeof(uint32_t) + sizeof(uint32_t) + block_bytes;
+  if (block_bytes > UINT64_MAX - (sizeof(uint64_t) + sizeof(uint32_t) + sizeof(uint32_t)) ||
+      total > SIZE_MAX)
+    return NULL;
 
-  uint8_t* buf = malloc((size_t)total);
+  uint8_t* buf = protocol_alloc((size_t)total);
   if (!buf)
     return NULL;
 
@@ -99,7 +112,7 @@ DeltaSignature* delta_signature_deserialize(const Data* data) {
   const uint8_t* buf = (const uint8_t*)data->data;
   size_t pos = 0;
 
-  DeltaSignature* sig = malloc(sizeof(DeltaSignature));
+  DeltaSignature* sig = protocol_alloc(sizeof(DeltaSignature));
   if (!sig)
     return NULL;
 
@@ -118,6 +131,13 @@ DeltaSignature* delta_signature_deserialize(const Data* data) {
     return NULL;
   }
 
+  if (sig->block_size == 0 || sig->block_size > DELTA_BLOCK_SIZE_MAX ||
+      sig->file_size > DELTA_MAX_FILE_SIZE || sig->file_size == 0 ||
+      (sig->file_size + sig->block_size - 1) / sig->block_size != sig->block_count) {
+    free(sig);
+    return NULL;
+  }
+
   uint64_t expected = sizeof(uint64_t) + sizeof(uint32_t) + sizeof(uint32_t) +
                       (uint64_t)sig->block_count * (sizeof(uint32_t) + sizeof(uint32_t));
   if (data->size < expected) {
@@ -130,7 +150,7 @@ DeltaSignature* delta_signature_deserialize(const Data* data) {
     free(sig);
     return NULL;
   }
-  sig->blocks = malloc((size_t)blocks_size);
+  sig->blocks = protocol_alloc((size_t)blocks_size);
   if (!sig->blocks) {
     free(sig);
     return NULL;
@@ -156,8 +176,10 @@ void delta_signature_destroy(DeltaSignature* sig) {
 static bool ensure_capacity(DeltaInstruction** instrs, uint32_t* capacity, uint32_t count) {
   if (count < *capacity)
     return true;
+  if (*capacity > MAX_DELTA_INSTRUCTIONS / 2)
+    return false;
   uint32_t new_cap = *capacity * 2;
-  DeltaInstruction* tmp = realloc(*instrs, new_cap * sizeof(DeltaInstruction));
+  DeltaInstruction* tmp = protocol_realloc(*instrs, (size_t)new_cap * sizeof(DeltaInstruction));
   if (!tmp)
     return false;
   *instrs = tmp;
@@ -169,10 +191,12 @@ static bool flush_literal(DeltaInstruction** instrs, uint32_t* capacity, uint32_
                           const uint8_t* data, uint64_t start, uint64_t end) {
   if (start >= end)
     return true;
+  if (end - start > UINT32_MAX || *count >= MAX_DELTA_INSTRUCTIONS)
+    return false;
   uint32_t lit_len = (uint32_t)(end - start);
   if (!ensure_capacity(instrs, capacity, *count))
     return false;
-  uint8_t* lit_data = malloc(lit_len);
+  uint8_t* lit_data = protocol_alloc(lit_len);
   if (!lit_data)
     return false;
   memcpy(lit_data, data + start, lit_len);
@@ -183,19 +207,161 @@ static bool flush_literal(DeltaInstruction** instrs, uint32_t* capacity, uint32_
   return true;
 }
 
+static void free_instructions(DeltaInstruction* instrs, uint32_t count) {
+  if (!instrs)
+    return;
+  for (uint32_t i = 0; i < count; i++)
+    if (instrs[i].type == DELTA_INSTR_LITERAL)
+      free(instrs[i].literal.data);
+  free(instrs);
+}
+
+/* Sentinel meaning "no signature block" in the lookup index chains.  Block
+ * counts are bounded well below UINT32_MAX, so it doubles as a null link. */
+#define DELTA_NO_BLOCK UINT32_MAX
+
+/* Avalanche mix for the rolling checksum so blocks do not cluster in the
+ * bucket table when the weak checksum has little entropy (e.g. all-zero or
+ * patterned files). */
+static uint32_t delta_adler_mix(uint32_t h) {
+  h ^= h >> 16;
+  h *= 0x7feb352dU;
+  h ^= h >> 15;
+  h *= 0x846ca68bU;
+  h ^= h >> 16;
+  return h;
+}
+
+/* Smallest power of two >= v.  v must be non-zero. */
+static uint32_t delta_next_pow2(uint32_t v) {
+  v--;
+  v |= v >> 1;
+  v |= v >> 2;
+  v |= v >> 4;
+  v |= v >> 8;
+  v |= v >> 16;
+  return v + 1;
+}
+
+/* Build a hash index over sig->blocks keyed by the (mixed) rolling checksum.
+ * All blocks sharing an Adler-32 value land in the same bucket; collisions
+ * are chained through a single contiguous allocation:
+ *
+ *   [0, bucket_count)                 heads (first block per bucket)
+ *   [bucket_count, 2*bucket_count)    tails (last block per bucket)
+ *   [2*bucket_count, ...)             per-block chain links
+ *
+ * Blocks are inserted in ascending index order so every bucket chain is
+ * ordered exactly like the historical linear scan.  Returns the base pointer
+ * (also the heads array) or NULL when no index could be allocated; callers
+ * then fall back to the linear scan. */
+static uint32_t* delta_build_index(const DeltaSignature* sig, uint32_t bucket_count) {
+  if (sig->block_count == 0 || bucket_count == 0)
+    return NULL;
+
+  size_t entries = (size_t)2 * bucket_count + sig->block_count;
+  if (entries > SIZE_MAX / sizeof(uint32_t))
+    return NULL;
+
+  uint32_t* index = protocol_alloc(entries * sizeof(uint32_t));
+  if (!index)
+    return NULL;
+
+  uint32_t* heads = index;
+  uint32_t* tails = index + bucket_count;
+  uint32_t* next = index + 2 * bucket_count;
+  uint32_t mask = bucket_count - 1;
+
+  memset(heads, 0xFF, (size_t)bucket_count * sizeof(uint32_t));
+  memset(tails, 0xFF, (size_t)bucket_count * sizeof(uint32_t));
+
+  for (uint32_t j = 0; j < sig->block_count; j++) {
+    uint32_t b = delta_adler_mix(sig->blocks[j].adler32) & mask;
+    if (heads[b] == DELTA_NO_BLOCK)
+      heads[b] = j;
+    else
+      next[tails[b]] = j;
+    tails[b] = j;
+    next[j] = DELTA_NO_BLOCK;
+  }
+  return index;
+}
+
+/* Locate the signature block matching the byte window at new_data[i].
+ *
+ * Mirrors the original per-window behaviour exactly: only a full block_size
+ * window can match, candidates are accepted only when the weak (Adler-32) and
+ * strong (xxHash32) checksums both agree, and the lowest block index wins so
+ * the emitted op stream is byte-identical to the linear scan.  When heads is
+ * non-NULL the candidate set is reached through the bucket index (expected
+ * O(1) per window); otherwise an exact linear scan is used. */
+static uint32_t delta_find_match(const uint8_t* window, uint32_t window_len, uint32_t adler,
+                                 bool full_window, const DeltaSignature* sig, const uint32_t* heads,
+                                 const uint32_t* next, uint32_t mask) {
+  if (!full_window || sig->block_count == 0)
+    return DELTA_NO_BLOCK;
+
+  if (heads) {
+    uint32_t b = delta_adler_mix(adler) & mask;
+    uint32_t window_xxh = 0;
+    bool have_xxh = false;
+    for (uint32_t j = heads[b]; j != DELTA_NO_BLOCK; j = next[j]) {
+      if (sig->blocks[j].adler32 != adler)
+        continue;
+      if (!have_xxh) {
+        window_xxh = delta_xxhash32(window, window_len);
+        have_xxh = true;
+      }
+      if (window_xxh == sig->blocks[j].xxhash)
+        return j;
+    }
+    return DELTA_NO_BLOCK;
+  }
+
+  /* Fallback used when the index could not be allocated. */
+  for (uint32_t j = 0; j < sig->block_count; j++) {
+    if (sig->blocks[j].adler32 == adler) {
+      uint32_t window_xxh = delta_xxhash32(window, window_len);
+      if (window_xxh == sig->blocks[j].xxhash)
+        return j;
+    }
+  }
+  return DELTA_NO_BLOCK;
+}
+
 Delta* delta_compute(const void* new_file_data, uint64_t new_file_size, const DeltaSignature* sig,
                      uint32_t block_size) {
-  if (!new_file_data || !sig || new_file_size == 0 || block_size == 0)
+  if (!new_file_data || !sig || !sig->blocks || new_file_size == 0 || block_size == 0 ||
+      block_size > DELTA_BLOCK_SIZE_MAX || sig->block_size != block_size)
     return NULL;
 
   const uint8_t* new_data = (const uint8_t*)new_file_data;
 
   uint32_t capacity = 64;
   uint32_t count = 0;
-  DeltaInstruction* instrs = malloc(capacity * sizeof(DeltaInstruction));
+  DeltaInstruction* instrs = protocol_alloc((size_t)capacity * sizeof(DeltaInstruction));
   if (!instrs)
     return NULL;
 
+  /* Build a one-time bucket index over the signature blocks keyed by the weak
+   * checksum.  This turns the per-byte-window candidate lookup from an
+   * O(block_count) linear scan into an expected O(1) probe, which dominates
+   * the cost for large mostly-matching files (the diff steps one byte at a
+   * time through changed regions).  On allocation failure the probe falls back
+   * to the original linear scan, so behaviour is unchanged under memory
+   * pressure. */
+  uint32_t* index = NULL;
+  const uint32_t* chain_next = NULL;
+  uint32_t mask = 0;
+  if (sig->block_count > 0) {
+    uint32_t bucket_count = delta_next_pow2(sig->block_count);
+    index = delta_build_index(sig, bucket_count);
+    if (index) {
+      chain_next = index + 2 * bucket_count;
+      mask = bucket_count - 1;
+    }
+  }
+
   uint64_t literal_start = 0;
   bool has_literal = false;
 
@@ -230,24 +396,25 @@ Delta* delta_compute(const void* new_file_data, uint64_t new_file_size, const De
     }
 
     bool matched = false;
-    for (uint32_t j = 0; j < sig->block_count; j++) {
+    uint32_t match_block = delta_find_match(new_data + i, window_len, adler, full_window, sig,
-      if (adler == sig->blocks[j].adler32 && full_window) {
+                                            index, chain_next, mask);
-        uint32_t xxh = delta_xxhash32(new_data + i, window_len);
+    if (match_block != DELTA_NO_BLOCK) {
-        if (xxh == sig->blocks[j].xxhash) {
       if (has_literal) {
         if (!flush_literal(&instrs, &capacity, &count, new_data, literal_start, i)) {
-              free(instrs);
+          free_instructions(instrs, count);
+          free(index);
           return NULL;
         }
         has_literal = false;
       }
 
       if (!ensure_capacity(&instrs, &capacity, count)) {
-            free(instrs);
+        free_instructions(instrs, count);
+        free(index);
         return NULL;
       }
       instrs[count].type = DELTA_INSTR_BLOCK_MATCH;
-          instrs[count].match.block_index = j;
+      instrs[count].match.block_index = match_block;
       instrs[count].match.block_offset = 0;
       instrs[count].match.length = window_len;
       count++;
@@ -255,9 +422,6 @@ Delta* delta_compute(const void* new_file_data, uint64_t new_file_size, const De
       i += window_len;
       rolling_valid = false;
       matched = true;
-          break;
-        }
-      }
     }
 
     if (!matched) {
@@ -269,20 +433,18 @@ Delta* delta_compute(const void* new_file_data, uint64_t new_file_size, const De
     }
   }
 
+  free(index);
+
   if (has_literal) {
     if (!flush_literal(&instrs, &capacity, &count, new_data, literal_start, new_file_size)) {
-      free(instrs);
+      free_instructions(instrs, count);
       return NULL;
     }
   }
 
-  Delta* delta = malloc(sizeof(Delta));
+  Delta* delta = protocol_alloc(sizeof(Delta));
   if (!delta) {
-    for (uint32_t k = 0; k < count; k++) {
+    free_instructions(instrs, count);
-      if (instrs[k].type == DELTA_INSTR_LITERAL)
-        free(instrs[k].literal.data);
-    }
-    free(instrs);
     return NULL;
   }
 
@@ -292,11 +454,24 @@ Delta* delta_compute(const void* new_file_data, uint64_t new_file_size, const De
   delta->delta_size = 0;
 
   for (uint32_t k = 0; k < count; k++) {
+    if (delta->delta_size == UINT64_MAX) {
+      delta_destroy(delta);
+      return NULL;
+    }
     delta->delta_size += 1;
     if (instrs[k].type == DELTA_INSTR_BLOCK_MATCH) {
+      if (delta->delta_size > UINT64_MAX - sizeof(uint32_t) * 3) {
+        delta_destroy(delta);
+        return NULL;
+      }
       delta->delta_size += sizeof(uint32_t) * 3;
     } else {
-      delta->delta_size += sizeof(uint32_t) + instrs[k].literal.length;
+      uint64_t extra = sizeof(uint32_t) + instrs[k].literal.length;
+      if (delta->delta_size > UINT64_MAX - extra) {
+        delta_destroy(delta);
+        return NULL;
+      }
+      delta->delta_size += extra;
     }
   }
 
@@ -307,8 +482,13 @@ Data* delta_serialize(const Delta* delta) {
   if (!delta)
     return NULL;
 
-  uint64_t total = sizeof(uint64_t) + sizeof(uint32_t) + delta->delta_size;
+  if (delta->instruction_count > 0 && !delta->instructions)
-  uint8_t* buf = malloc((size_t)total);
+    return NULL;
+  uint64_t header_size = sizeof(uint64_t) + sizeof(uint32_t);
+  if (delta->delta_size > UINT64_MAX - header_size || header_size + delta->delta_size > SIZE_MAX)
+    return NULL;
+  uint64_t total = header_size + delta->delta_size;
+  uint8_t* buf = protocol_alloc((size_t)total);
   if (!buf)
     return NULL;
 
@@ -348,7 +528,7 @@ Delta* delta_deserialize(const Data* data) {
   const uint8_t* buf = (const uint8_t*)data->data;
   size_t pos = 0;
 
-  Delta* delta = malloc(sizeof(Delta));
+  Delta* delta = protocol_alloc(sizeof(Delta));
   if (!delta)
     return NULL;
 
@@ -365,8 +545,11 @@ Delta* delta_deserialize(const Data* data) {
     return NULL;
   }
 
-  delta->instructions = malloc(delta->instruction_count * sizeof(DeltaInstruction));
+  delta->instructions =
-  if (!delta->instructions) {
+      delta->instruction_count == 0
+          ? NULL
+          : protocol_alloc((size_t)delta->instruction_count * sizeof(DeltaInstruction));
+  if (delta->instruction_count > 0 && !delta->instructions) {
     free(delta);
     return NULL;
   }
@@ -375,11 +558,7 @@ Delta* delta_deserialize(const Data* data) {
 
   for (uint32_t i = 0; i < delta->instruction_count; i++) {
     if (pos >= data->size) {
-      for (uint32_t k = 0; k < i; k++) {
+      free_instructions(delta->instructions, i);
-        if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
-          free(delta->instructions[k].literal.data);
-      }
-      free(delta->instructions);
       free(delta);
       return NULL;
     }
@@ -391,12 +570,8 @@ Delta* delta_deserialize(const Data* data) {
     delta->delta_size += 1;
 
     if (type == DELTA_OP_BLOCK_MATCH) {
-      if (pos + sizeof(uint32_t) * 3 > data->size) {
+      if (data->size - pos < sizeof(uint32_t) * 3) {
-        for (uint32_t k = 0; k < i; k++) {
+        free_instructions(delta->instructions, i);
-          if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
-            free(delta->instructions[k].literal.data);
-        }
-        free(delta->instructions);
         free(delta);
         return NULL;
       }
@@ -409,12 +584,8 @@ Delta* delta_deserialize(const Data* data) {
       pos += sizeof(uint32_t);
       delta->delta_size += sizeof(uint32_t) * 3;
     } else if (type == DELTA_OP_LITERAL) {
-      if (pos + sizeof(uint32_t) > data->size) {
+      if (data->size - pos < sizeof(uint32_t)) {
-        for (uint32_t k = 0; k < i; k++) {
+        free_instructions(delta->instructions, i);
-          if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
-            free(delta->instructions[k].literal.data);
-        }
-        free(delta->instructions);
         free(delta);
         return NULL;
       }
@@ -423,23 +594,15 @@ Delta* delta_deserialize(const Data* data) {
       pos += sizeof(uint32_t);
 
       uint32_t lit_len = delta->instructions[i].literal.length;
-      if (pos + lit_len > data->size) {
+      if (lit_len > data->size - pos) {
-        for (uint32_t k = 0; k < i; k++) {
+        free_instructions(delta->instructions, i);
-          if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
-            free(delta->instructions[k].literal.data);
-        }
-        free(delta->instructions);
         free(delta);
         return NULL;
       }
-      delta->instructions[i].literal.data = malloc(lit_len);
+      delta->instructions[i].literal.data = protocol_alloc(lit_len ? lit_len : 1);
       if (!delta->instructions[i].literal.data) {
         log_message(LOG_LEVEL_ERROR, "Failed to allocate %u bytes for literal data", lit_len);
-        for (uint32_t k = 0; k < i; k++) {
+        free_instructions(delta->instructions, i);
-          if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
-            free(delta->instructions[k].literal.data);
-        }
-        free(delta->instructions);
         free(delta);
         return NULL;
       }
@@ -447,11 +610,7 @@ Delta* delta_deserialize(const Data* data) {
       pos += lit_len;
       delta->delta_size += sizeof(uint32_t) + lit_len;
     } else {
-      for (uint32_t k = 0; k < i; k++) {
+      free_instructions(delta->instructions, i);
-        if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
-          free(delta->instructions[k].literal.data);
-      }
-      free(delta->instructions);
       free(delta);
       return NULL;
     }
@@ -463,10 +622,11 @@ Delta* delta_deserialize(const Data* data) {
 void* delta_apply(const void* old_data, uint64_t old_size, const Delta* delta,
                   uint32_t block_size) {
   if (!old_data || !delta || (delta->new_file_size > 0 && delta->instructions == NULL) ||
-      (delta->instruction_count > 0 && block_size == 0))
+      (delta->instruction_count > 0 && block_size == 0) ||
+      delta->new_file_size > DELTA_MAX_FILE_SIZE || delta->new_file_size > SIZE_MAX)
     return NULL;
 
-  void* output = malloc((size_t)delta->new_file_size);
+  void* output = protocol_alloc(delta->new_file_size ? (size_t)delta->new_file_size : 1);
   if (!output)
     return NULL;
 
@@ -491,7 +651,7 @@ void* delta_apply(const void* old_data, uint64_t old_size, const Delta* delta,
       }
       memcpy(out + out_pos, old + src_offset, len);
       out_pos += len;
-    } else {
+    } else if (delta->instructions[i].type == DELTA_INSTR_LITERAL) {
       uint32_t len = delta->instructions[i].literal.length;
       if (out_pos > delta->new_file_size || (uint64_t)len > delta->new_file_size - out_pos) {
         free(output);
@@ -499,6 +659,9 @@ void* delta_apply(const void* old_data, uint64_t old_size, const Delta* delta,
       }
       memcpy(out + out_pos, delta->instructions[i].literal.data, len);
       out_pos += len;
+    } else {
+      free(output);
+      return NULL;
     }
   }
 
@@ -534,7 +697,7 @@ bool delta_should_attempt(uint64_t old_size, uint64_t new_size, uint64_t max_fil
 }
 
 bool delta_is_worthwhile(const Delta* delta, uint64_t new_file_size) {
-  if (!delta || delta->instruction_count == 0)
+  if (!delta || delta->instruction_count == 0 || new_file_size == 0)
     return false;
 
   bool has_match = false;

src/shared/file.h

@@ -1,45 +1,51 @@
 #ifndef FILE_H
 #define FILE_H
 
-#include "config.h"
+#include "file_send.h"
-#include "data.h"
+#include "file_receive.h"
+#include "file_types.h"
 #include <stdbool.h>
+#include <stdint.h>
 #include <sys/stat.h>
 
-typedef enum { FILE_TYPE_REGULAR, FILE_TYPE_SYMLINK, FILE_TYPE_DIR } FileType;
+/* File/FileMetadata lifecycle, local disk helpers, and secure filesystem
-
+   primitives shared by the send/receive pipelines. */
-typedef struct {
-  mode_t mode;
-  uid_t uid;
-  gid_t gid;
-  time_t mtime_sec;
-  long mtime_nsec;
-} FileMetadata;
-
-typedef struct {
-  char* path;
-  Data* data;
-  FileMetadata* metadata;
-  bool skip;
-} File;
 
 File* file_create(const char* path);
 void file_destroy(void* item);
 bool file_load_data(File* file);
 bool file_checksum(File* file, uint64_t* checksum);
-File* file_receive(const Config* config, int file_descriptor);
-bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
-                            int compression_level, bool send_path);
-bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int compression_level,
-                        bool send_path);
 size_t file_content_to_buffer(File* file);
 FileMetadata* file_metadata_create(const struct stat* stats);
 void file_metadata_destroy(void* metadata);
-bool to_disk(const char* path, const void* data, unsigned long long data_size, bool inplace,
+bool file_write_to_disk(const char* path, const void* data, unsigned long long data_size,
-             bool sparse);
+                        bool inplace, bool sparse);
-bool file_save_to_disk(const char* root_directory, const File* file, const Config* config);
+
-void file_set_authorized_root(int fd, const char* canonical_path);
+/* A configured fd without a canonical identity deliberately rejects paths. */
-File* receive_incremental_check(int fd, const Config* config, bool* skipped);
+bool file_set_authorized_root(int fd, const char* canonical_path);
-int receive_manifest(int fd, const Config* config, int* next_status);
+
+/* Secure path/filesystem primitives (symlink-safe, O_NOFOLLOW, root-confined). */
+bool file_path_exists_secure(const char* path);
+bool file_stat_secure(const char* path, struct stat* st);
+bool file_destination_is_newer_secure(const char* path, const FileMetadata* metadata);
+int file_open_secure_parent(const char* path, char** leaf_out, bool create_dirs);
+bool file_ensure_directory_secure(const char* path);
+bool file_rename_secure(const char* old_path, const char* new_path);
+bool file_to_disk_secure(const char* path, const void* data, unsigned long long data_size,
+                         bool inplace, bool sparse, const FileMetadata* metadata,
+                         bool preserve_executability);
+bool file_to_disk_secure_with_fsync(const char* path, const void* data,
+                                    unsigned long long data_size, bool inplace, bool sparse,
+                                    const FileMetadata* metadata, bool preserve_executability,
+                                    bool use_fsync);
+/* With update enabled, an existing newer destination is left untouched.  The
+   check is descriptor-based for inplace writes; atomic replacement still has
+   an unavoidable final rename race without filesystem locking. */
+bool file_to_disk_secure_update(const char* path, const void* data, unsigned long long data_size,
+                                bool inplace, bool sparse, const FileMetadata* metadata,
+                                bool preserve_executability);
+bool file_to_disk_secure_no_replace(const char* path, const void* data,
+                                    unsigned long long data_size, bool sparse,
+                                    const FileMetadata* metadata, bool preserve_executability);
 
 #endif

src/shared/file_receive.c

@@ -0,0 +1,700 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <libgen.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include "array_list.h"
+#include "chmod.h"
+#include "compression.h"
+#include "config.h"
+#include "data.h"
+#include "delta.h"
+#include "file.h"
+#include "log.h"
+#include "metadata.h"
+#include "protocol.h"
+#include "utils.h"
+
+#define MAX_SERVER_DELETE_COUNT 100000U
+#define MAX_FILE_DATA_SIZE MAX_RECEIVE_WHOLE_FILE_SIZE
+
+bool file_save_to_disk(const char* root_directory, const File* file, const Config* config) {
+  return file_save_to_disk_full(root_directory, file, config) != FILE_SAVE_ERROR;
+}
+
+FileSaveResult file_save_to_disk_full(const char* root_directory, const File* file,
+                                      const Config* config) {
+  /* Backups are incompatible with ignore-existing: moving the entry first
+     would make a concurrent no-replace commit overwrite its old name. */
+  bool backup_enabled = config && config->backup && !config->ignore_existing;
+  bool inplace = config && config->inplace;
+  bool sparse = config && config->preserve_sparse;
+  bool preserve_executability = config && config->use_executability;
+  const char* backup_suffix = (config && config->suffix) ? config->suffix : "~";
+  const char* backup_dir = (config && config->backup_dir) ? config->backup_dir : NULL;
+  const char* partial_dir = (config && config->partial_dir) ? config->partial_dir : NULL;
+  bool use_partial_root = partial_dir && config && config->partial;
+  char *confined_backup = NULL, *confined_partial = NULL, *disk_path = NULL;
+  char* destination_path = NULL;
+  char *backup_path = NULL, *parent_copy = NULL;
+
+  if (!file || !file->path || !file->data || (file->data->size != 0 && !file->data->data) ||
+      has_path_traversal(file->path) ||
+      (backup_enabled &&
+       (!backup_suffix || backup_suffix[0] == '\0' || strchr(backup_suffix, '/') != NULL ||
+        strcmp(backup_suffix, ".") == 0 || strcmp(backup_suffix, "..") == 0))) {
+    log_message(LOG_LEVEL_ERROR, "Invalid file or path received");
+    return FILE_SAVE_ERROR;
+  }
+
+  /* These options arrive from the client.  They are names below the server
+     root, never independent filesystem roots. */
+  if ((backup_dir && (backup_dir[0] == '/' || has_path_traversal(backup_dir))) ||
+      (partial_dir && (partial_dir[0] == '/' || has_path_traversal(partial_dir))))
+    return FILE_SAVE_ERROR;
+  if (backup_dir && !(confined_backup = path_cat(root_directory, backup_dir)))
+    return FILE_SAVE_ERROR;
+  if (partial_dir && !(confined_partial = path_cat(root_directory, partial_dir))) {
+    free(confined_backup);
+    return FILE_SAVE_ERROR;
+  }
+
+  const char* actual_root = use_partial_root ? confined_partial : root_directory;
+  destination_path = path_cat(root_directory, file->path);
+  disk_path = path_cat(actual_root, file->path);
+  if (destination_path == NULL || disk_path == NULL) {
+    free(confined_backup);
+    free(confined_partial);
+    free(destination_path);
+    free(disk_path);
+    return FILE_SAVE_ERROR;
+  }
+
+  /* --existing checks the final destination, not a temporary partial path. */
+  if (config && config->existing && !file_path_exists_secure(destination_path)) {
+    free(confined_backup);
+    free(confined_partial);
+    free(destination_path);
+    free(disk_path);
+    return FILE_SAVE_SKIPPED;
+  }
+
+  /* --ignore-existing checks the final destination before partial files or
+     overwrite policies can modify it. */
+  if (config && config->ignore_existing) {
+    bool exists = file_path_exists_secure(destination_path);
+    if (exists) {
+      free(confined_backup);
+      free(confined_partial);
+      free(destination_path);
+      free(disk_path);
+      return FILE_SAVE_SKIPPED;
+    }
+  }
+
+  /* --update is receiver-side policy: never replace a newer destination.
+     In partial-dir mode the entry that would be replaced is the real
+     destination, not the temporary partial file.  The secure stat does not
+     require read permission on the destination. */
+  const char* update_target = use_partial_root ? destination_path : disk_path;
+  if (config && config->update && file_destination_is_newer_secure(update_target, file->metadata)) {
+    free(confined_backup);
+    free(confined_partial);
+    free(destination_path);
+    free(disk_path);
+    return FILE_SAVE_SKIPPED;
+  }
+
+  if (backup_enabled) {
+    /* Back up the entry that the incoming write will replace.  When writing
+       through a partial dir the pre-existing destination file is the one to
+       preserve; any stale partial file is overwritten without a backup. */
+    const char* replace_target = use_partial_root ? destination_path : disk_path;
+    struct stat backup_stat;
+    if (file_stat_secure(replace_target, &backup_stat)) {
+      if (backup_dir) {
+        backup_path = path_cat(confined_backup, file->path);
+      } else {
+        size_t path_len = strlen(replace_target);
+        size_t suffix_len = strlen(backup_suffix);
+        if (path_len > SIZE_MAX - suffix_len - 1)
+          goto fail;
+        backup_path = malloc(path_len + suffix_len + 1);
+        if (backup_path) {
+          memcpy(backup_path, replace_target, path_len);
+          memcpy(backup_path + path_len, backup_suffix, suffix_len + 1);
+        }
+      }
+      if (!backup_path)
+        goto fail;
+      parent_copy = str_dup(backup_path);
+      if (!parent_copy || !file_ensure_directory_secure(dirname(parent_copy)))
+        goto fail;
+      free(parent_copy);
+      parent_copy = NULL;
+      if (!file_rename_secure(replace_target, backup_path))
+        goto fail;
+      free(backup_path);
+      backup_path = NULL;
+    }
+  }
+
+  FileMetadata adjusted_metadata;
+  const FileMetadata* metadata = file->metadata;
+  if (metadata && config && config->chmod_spec && *config->chmod_spec) {
+    adjusted_metadata = *metadata;
+    if (!chmod_apply(adjusted_metadata.mode, config->chmod_spec, &adjusted_metadata.mode))
+      goto fail;
+    metadata = &adjusted_metadata;
+  }
+  bool ok = config && config->ignore_existing
+                ? file_to_disk_secure_no_replace(disk_path, file->data->data, file->data->size,
+                                                 sparse, metadata, preserve_executability)
+            : config && config->update
+                ? file_to_disk_secure_update(disk_path, file->data->data, file->data->size, inplace,
+                                             sparse, metadata, preserve_executability)
+                : file_to_disk_secure_with_fsync(disk_path, file->data->data, file->data->size,
+                                                 inplace, sparse, metadata, preserve_executability,
+                                                 config && config->use_fsync);
+  if (!ok)
+    goto fail;
+
+  /* --partial --partial-dir writes the complete file under the partial dir so
+     interrupted transfers leave a resumable copy there.  Once the file is
+     fully written it must be atomically installed at the real destination;
+     otherwise completed transfers would linger under the partial dir. */
+  if (use_partial_root) {
+    if (!file_rename_secure(disk_path, destination_path))
+      goto fail;
+  }
+
+  free(parent_copy);
+  free(backup_path);
+  free(confined_backup);
+  free(confined_partial);
+  free(destination_path);
+  free(disk_path);
+  return FILE_SAVE_WRITTEN;
+
+fail:
+  free(parent_copy);
+  free(backup_path);
+  free(confined_backup);
+  free(confined_partial);
+  free(destination_path);
+  free(disk_path);
+  return FILE_SAVE_ERROR;
+}
+
+static File* receive_delta_file(int fd, const Config* config, const char* check_path,
+                                void* old_data, unsigned long long old_size, bool* failed) {
+  if (!old_data) {
+    *failed = true;
+    return NULL;
+  }
+
+  DeltaSignature* sig = delta_signature_create(old_data, old_size, config->delta_block_size);
+  if (!sig) {
+    free(old_data);
+    *failed = true;
+    return NULL;
+  }
+
+  Data* sig_data = delta_signature_serialize(sig);
+  if (!sig_data) {
+    delta_signature_destroy(sig);
+    free(old_data);
+    *failed = true;
+    return NULL;
+  }
+
+  bool sig_sent = send_status(fd, STATUS_DELTA_SIGNATURE) && send_data(fd, sig_data);
+  data_destroy(sig_data);
+
+  if (!sig_sent) {
+    delta_signature_destroy(sig);
+    free(old_data);
+    *failed = true;
+    return NULL;
+  }
+
+  Status resp;
+  if (!receive_status(fd, &resp)) {
+    delta_signature_destroy(sig);
+    free(old_data);
+    *failed = true;
+    return NULL;
+  }
+
+  if (resp == STATUS_DELTA_DATA) {
+    Data* delta_data = receive_data_limited(fd, MAX_RECEIVE_WHOLE_FILE_SIZE);
+    if (!delta_data) {
+      delta_signature_destroy(sig);
+      free(old_data);
+      *failed = true;
+      return NULL;
+    }
+
+    Data* raw_delta = delta_data;
+    if (config->use_compression &&
+        !compression_should_skip_with_suffixes(
+            check_path, config->skip_compress_suffixes,
+            config->skip_compress_set ? config->skip_compress_count : -1)) {
+      raw_delta = data_decompress_limited(delta_data, MAX_RECEIVE_WHOLE_FILE_SIZE);
+      data_destroy(delta_data);
+      if (!raw_delta) {
+        free(old_data);
+        delta_signature_destroy(sig);
+        *failed = true;
+        return NULL;
+      }
+    }
+
+    Delta* delta = delta_deserialize(raw_delta);
+    data_destroy(raw_delta);
+    if (!delta) {
+      free(old_data);
+      delta_signature_destroy(sig);
+      *failed = true;
+      return NULL;
+    }
+
+    uint64_t new_size = delta->new_file_size;
+    if (new_size > MAX_RECEIVE_WHOLE_FILE_SIZE || new_size > SIZE_MAX) {
+      delta_destroy(delta);
+      free(old_data);
+      delta_signature_destroy(sig);
+      send_status(fd, STATUS_ERROR);
+      *failed = true;
+      return NULL;
+    }
+    void* new_data = delta_apply(old_data, old_size, delta, config->delta_block_size);
+    delta_destroy(delta);
+
+    if (!new_data) {
+      free(old_data);
+      delta_signature_destroy(sig);
+      *failed = true;
+      return NULL;
+    }
+
+    File* file = file_create(check_path);
+    if (!file) {
+      free(new_data);
+      free(old_data);
+      delta_signature_destroy(sig);
+      *failed = true;
+      return NULL;
+    }
+
+    if (config->use_metadata) {
+      int meta_ok = 1;
+      file->metadata = metadata_receive(fd, &meta_ok);
+      if (!meta_ok) {
+        file_destroy(file);
+        free(new_data);
+        free(old_data);
+        delta_signature_destroy(sig);
+        *failed = true;
+        return NULL;
+      }
+    }
+
+    Data* replacement = data_create(new_data, (size_t)new_size);
+    if (replacement == NULL) {
+      file_destroy(file);
+      free(old_data);
+      delta_signature_destroy(sig);
+      send_status(fd, STATUS_ERROR);
+      *failed = true;
+      return NULL;
+    }
+    data_destroy(file->data);
+    file->data = replacement;
+
+    free(old_data);
+    delta_signature_destroy(sig);
+    return file;
+  }
+
+  if (resp == STATUS_NEXT) {
+    delta_signature_destroy(sig);
+    free(old_data);
+
+    File* file = file_create(check_path);
+    if (!file) {
+      *failed = true;
+      return NULL;
+    }
+
+    if (config->use_metadata) {
+      int meta_ok = 1;
+      file->metadata = metadata_receive(fd, &meta_ok);
+      if (!meta_ok) {
+        file_destroy(file);
+        *failed = true;
+        return NULL;
+      }
+    }
+
+    Data* file_data = receive_data_limited(fd, MAX_RECEIVE_WHOLE_FILE_SIZE);
+    if (file_data == NULL) {
+      file_destroy(file);
+      *failed = true;
+      return NULL;
+    }
+
+    if (config->use_compression &&
+        !compression_should_skip_with_suffixes(
+            file->path, config->skip_compress_suffixes,
+            config->skip_compress_set ? config->skip_compress_count : -1)) {
+      Data* uncompressed = data_decompress_limited(file_data, MAX_RECEIVE_WHOLE_FILE_SIZE);
+      data_destroy(file_data);
+      if (uncompressed == NULL) {
+        file_destroy(file);
+        *failed = true;
+        return NULL;
+      }
+      if (uncompressed->size > MAX_FILE_DATA_SIZE) {
+        data_destroy(uncompressed);
+        file_destroy(file);
+        send_status(fd, STATUS_ERROR);
+        *failed = true;
+        return NULL;
+      }
+      file_data = uncompressed;
+    }
+
+    data_destroy(file->data);
+    file->data = file_data;
+    return file;
+  }
+
+  delta_signature_destroy(sig);
+  free(old_data);
+  send_status(fd, STATUS_ERROR);
+  *failed = true;
+  return NULL;
+}
+
+File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
+  if (!config || !skipped) {
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+  *skipped = false;
+  char* check_path = receive_str(fd);
+  if (check_path == NULL) {
+    return NULL;
+  }
+
+  unsigned long long check_size;
+  long long check_mtime;
+  long long check_mtime_nsec;
+  uint64_t check_checksum = 0;
+  if (!receive_n_data(fd, &check_size, sizeof(check_size)) ||
+      !receive_n_data(fd, &check_mtime, sizeof(check_mtime))) {
+    free(check_path);
+    return NULL;
+  }
+  if (!receive_n_data(fd, &check_mtime_nsec, sizeof(check_mtime_nsec)) || check_mtime_nsec < 0 ||
+      check_mtime_nsec >= 1000000000LL) {
+    free(check_path);
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+  if (config->checksum && !receive_n_data(fd, &check_checksum, sizeof(check_checksum))) {
+    free(check_path);
+    return NULL;
+  }
+
+  if (check_size > MAX_RECEIVE_WHOLE_FILE_SIZE) {
+    free(check_path);
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+
+  if (has_path_traversal(check_path)) {
+    char* escaped_path = output_escape(check_path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_ERROR, "Path traversal detected: %s",
+                escaped_path ? escaped_path : "<allocation failed>");
+    free(escaped_path);
+    free(check_path);
+    return NULL;
+  }
+
+  char* full_path = path_cat(config->receive_root_directory, check_path);
+  if (!full_path) {
+    free(check_path);
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+
+  /* Open the existing destination entry (if any) once and keep the descriptor
+     until the quick-check below decides whether the old contents are needed. */
+  struct stat st;
+  bool has_old_file = false;
+  int old_fd = -1;
+  char* leaf = NULL;
+  int parent_fd = file_open_secure_parent(full_path, &leaf, false);
+  if (parent_fd >= 0) {
+    old_fd = openat(parent_fd, leaf, O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
+    free(leaf);
+    close(parent_fd);
+    has_old_file = old_fd >= 0 && fstat(old_fd, &st) == 0 && S_ISREG(st.st_mode);
+  }
+  if (!has_old_file && old_fd >= 0) {
+    close(old_fd);
+    old_fd = -1;
+  }
+  unsigned long long old_size = has_old_file ? (unsigned long long)st.st_size : 0;
+
+  /* Decide from metadata alone whether the receiver already holds the file
+     the sender is offering.  The old contents are only read into memory when
+     a checksum comparison or a delta transfer actually requires them. */
+  bool size_equal = has_old_file && old_size == check_size;
+  bool match_by_metadata = false;
+  if (size_equal && !config->ignore_times && !config->size_only) {
+    long long old_mtime_nsec = 0;
+#ifdef __linux__
+    old_mtime_nsec = st.st_mtim.tv_nsec;
+#endif
+    match_by_metadata = metadata_mtime_matches(st.st_mtime, old_mtime_nsec, (time_t)check_mtime,
+                                               (long)check_mtime_nsec, config->modify_window);
+  }
+
+  bool try_delta = config->use_delta && !config->whole_file && has_old_file &&
+                   delta_should_attempt(old_size, check_size, config->delta_max_file_size);
+  bool checksum_needs_read = size_equal && !config->ignore_times && config->checksum;
+  bool need_old_data = checksum_needs_read || try_delta;
+
+  void* old_data = NULL;
+  if (need_old_data && has_old_file && old_size > 0 && old_size <= MAX_RECEIVE_WHOLE_FILE_SIZE &&
+      old_size <= SIZE_MAX) {
+    old_data = protocol_alloc((size_t)old_size);
+    if (old_data) {
+      size_t got = 0;
+      while (got < (size_t)old_size) {
+        ssize_t n = read(old_fd, (char*)old_data + got, (size_t)old_size - got);
+        if (n <= 0) {
+          free(old_data);
+          old_data = NULL;
+          break;
+        }
+        got += (size_t)n;
+      }
+    }
+  }
+
+  /* Quick-skip decision.  If no content comparison is required this is final
+     and the old file was never read; if the read failed the file is not
+     skipped and the transfer proceeds with the full new contents. */
+  bool match = false;
+  if (checksum_needs_read) {
+    if (old_size == 0)
+      match = delta_xxhash64("", 0) == check_checksum;
+    else
+      match = old_data != NULL && delta_xxhash64(old_data, (size_t)old_size) == check_checksum;
+  } else if (size_equal && !config->ignore_times) {
+    match = config->size_only || match_by_metadata;
+  }
+
+  if (match) {
+    free(old_data);
+    if (!send_status(fd, STATUS_OK)) {
+      close(old_fd);
+      free(full_path);
+      free(check_path);
+      return NULL;
+    }
+    close(old_fd);
+    free(full_path);
+    free(check_path);
+    *skipped = true;
+    return NULL;
+  }
+
+  if (try_delta && old_data != NULL) {
+    bool delta_failed = false;
+    File* delta_file =
+        receive_delta_file(fd, config, check_path, old_data, old_size, &delta_failed);
+    old_data = NULL; /* receive_delta_file consumes the snapshot on every path */
+    if (delta_file) {
+      close(old_fd);
+      free(full_path);
+      free(check_path);
+      return delta_file;
+    }
+    if (delta_failed) {
+      close(old_fd);
+      free(full_path);
+      free(check_path);
+      return NULL;
+    }
+  }
+  free(old_data);
+  old_data = NULL;
+
+  if (!send_status(fd, STATUS_NEXT)) {
+    close(old_fd);
+    free(full_path);
+    free(check_path);
+    return NULL;
+  }
+  close(old_fd);
+
+  File* file = file_create(check_path);
+  free(check_path);
+  free(full_path);
+  if (file == NULL) {
+    return NULL;
+  }
+
+  if (config->use_metadata) {
+    int meta_ok = 1;
+    file->metadata = metadata_receive(fd, &meta_ok);
+    if (!meta_ok) {
+      file_destroy(file);
+      return NULL;
+    }
+  }
+
+  Data* file_data = receive_data_limited(fd, MAX_RECEIVE_WHOLE_FILE_SIZE);
+  if (file_data == NULL) {
+    file_destroy(file);
+    return NULL;
+  }
+
+  if (config->use_compression &&
+      !compression_should_skip_with_suffixes(file->path, config->skip_compress_suffixes,
+                                             config->skip_compress_set ? config->skip_compress_count
+                                                                       : -1)) {
+    Data* uncompressed = data_decompress_limited(file_data, MAX_RECEIVE_WHOLE_FILE_SIZE);
+    data_destroy(file_data);
+    if (uncompressed == NULL) {
+      file_destroy(file);
+      return NULL;
+    }
+    if (uncompressed->size > MAX_FILE_DATA_SIZE) {
+      data_destroy(uncompressed);
+      file_destroy(file);
+      return NULL;
+    }
+    file_data = uncompressed;
+  }
+
+  data_destroy(file->data);
+  file->data = file_data;
+  return file;
+}
+
+File* file_receive(const Config* config, int file_descriptor) {
+  char* path = receive_str(file_descriptor);
+  if (path == NULL)
+    return NULL;
+  if (path[0] == '\0' || has_path_traversal(path)) {
+    char* escaped_path = output_escape(path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_ERROR, "Invalid received file path: %s",
+                escaped_path ? escaped_path : "<allocation failed>");
+    free(escaped_path);
+    free(path);
+    return NULL;
+  }
+  File* file = file_create(path);
+  free(path);
+  if (file == NULL)
+    return NULL;
+  if (config->use_metadata) {
+    int meta_ok = 1;
+    file->metadata = metadata_receive(file_descriptor, &meta_ok);
+    if (!meta_ok) {
+      file_destroy(file);
+      return NULL;
+    }
+  }
+  Data* file_data = receive_data_limited(file_descriptor, MAX_RECEIVE_WHOLE_FILE_SIZE);
+  if (file_data == NULL) {
+    file_destroy(file);
+    return NULL;
+  }
+  if (config->use_compression &&
+      !compression_should_skip_with_suffixes(file->path, config->skip_compress_suffixes,
+                                             config->skip_compress_set ? config->skip_compress_count
+                                                                       : -1)) {
+    Data* file_data_uncompressed = data_decompress_limited(file_data, MAX_RECEIVE_WHOLE_FILE_SIZE);
+    data_destroy(file_data);
+    if (file_data_uncompressed == NULL) {
+      file_destroy(file);
+      return NULL;
+    }
+    if (file_data_uncompressed->size > MAX_FILE_DATA_SIZE) {
+      data_destroy(file_data_uncompressed);
+      file_destroy(file);
+      return NULL;
+    }
+    file_data = file_data_uncompressed;
+  }
+  data_destroy(file->data);
+  file->data = file_data;
+  return file;
+}
+
+int receive_manifest(int fd, const Config* config, int* next_status) {
+  if (!config) {
+    send_status(fd, STATUS_ERROR);
+    return -1;
+  }
+  int received_status = STATUS_ERROR;
+  int* status_out = next_status ? next_status : &received_status;
+  int count;
+  if (!receive_int(fd, &count)) {
+    send_status(fd, STATUS_ERROR);
+    return -1;
+  }
+  if (count < 0 || count > MAX_MANIFEST_ENTRIES) {
+    send_status(fd, STATUS_ERROR);
+    return -1;
+  }
+  ArrayList* manifest = array_list_create(free);
+  if (!manifest) {
+    send_status(fd, STATUS_ERROR);
+    return -1;
+  }
+  size_t manifest_bytes = 0;
+  for (int i = 0; i < count; i++) {
+    char* s = receive_str(fd);
+    size_t entry_size = s ? strlen(s) : 0;
+    if (!s || s[0] == '\0' || s[0] == '/' || has_path_traversal(s) ||
+        entry_size > MAX_MANIFEST_BYTES - manifest_bytes ||
+        (manifest_bytes += entry_size) > MAX_MANIFEST_BYTES || !array_list_add(manifest, s)) {
+      free(s);
+      array_list_delete(manifest);
+      send_status(fd, STATUS_ERROR);
+      return -1;
+    }
+  }
+  if (!receive_status(fd, status_out)) {
+    array_list_delete(manifest);
+    send_status(fd, STATUS_ERROR);
+    return -1;
+  }
+  /* Deletion is a commit operation: never perform it until the sender has
+     completed the manifest frame successfully. */
+  if (*status_out != STATUS_FINISHED || !config->use_delete) {
+    array_list_delete(manifest);
+    if (*status_out != STATUS_FINISHED)
+      send_status(fd, STATUS_ERROR);
+    return *status_out == STATUS_FINISHED ? 0 : -1;
+  }
+  fprintf(stderr, "Deleting files not in manifest...\n");
+  bool deletion_ok =
+      delete_extras_limited(config->receive_root_directory, manifest, MAX_SERVER_DELETE_COUNT);
+  array_list_delete(manifest);
+  if (!deletion_ok)
+    send_status(fd, STATUS_ERROR);
+  return deletion_ok ? 0 : -1;
+}

src/shared/file_receive.h

@@ -0,0 +1,23 @@
+#ifndef FILE_RECEIVE_H
+#define FILE_RECEIVE_H
+
+#include "config.h"
+#include "file_types.h"
+#include <stdbool.h>
+
+/* Server-side file receive/save path. */
+
+File* file_receive(const Config* config, int file_descriptor);
+File* receive_incremental_check(int fd, const Config* config, bool* skipped);
+int receive_manifest(int fd, const Config* config, int* next_status);
+
+/* Outcome of a single file_save_to_disk operation.  The receiver needs to
+   distinguish "written" from "skipped" so --remove-source-files can be told
+   which sources were actually stored. */
+typedef enum { FILE_SAVE_ERROR = 0, FILE_SAVE_WRITTEN = 1, FILE_SAVE_SKIPPED = 2 } FileSaveResult;
+
+FileSaveResult file_save_to_disk_full(const char* root_directory, const File* file,
+                                      const Config* config);
+bool file_save_to_disk(const char* root_directory, const File* file, const Config* config);
+
+#endif

src/shared/file_send.c

@@ -0,0 +1,154 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <poll.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/sendfile.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <unistd.h>
+
+#include "compression.h"
+#include "data.h"
+#include "file.h"
+#include "log.h"
+#include "metadata.h"
+#include "protocol.h"
+
+bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
+                            int compression_level, bool send_path) {
+  return file_send_single_calls_with_skip(file, file_descriptor, use_metadata, compression_level,
+                                          send_path, NULL, -1, 0);
+}
+
+bool file_send_single_calls_with_skip(File* file, int file_descriptor, bool use_metadata,
+                                      int compression_level, bool send_path,
+                                      char* const* skip_suffixes, int skip_count,
+                                      int compression_threads) {
+  if (!file || !file->path || !file->data || (file->data->size != 0 && !file->data->data))
+    return false;
+  const Data* data_to_send = file->data;
+  Data* compressed_data = NULL;
+  if (compression_level > 0 &&
+      !compression_should_skip_with_suffixes(file->path, skip_suffixes, skip_count)) {
+    compressed_data =
+        data_compress_with_threads(file->data, compression_level, compression_threads);
+    if (compressed_data == NULL) {
+      log_message(LOG_LEVEL_ERROR, "Failed to compress file data");
+      return false;
+    }
+    data_to_send = compressed_data;
+  }
+  if (send_path && !send_str(file_descriptor, file->path)) {
+    data_destroy(compressed_data);
+    return false;
+  }
+  if (use_metadata && !metadata_send(file_descriptor, file->metadata)) {
+    data_destroy(compressed_data);
+    return false;
+  }
+  if (!send_data(file_descriptor, data_to_send)) {
+    data_destroy(compressed_data);
+    return false;
+  }
+  data_destroy(compressed_data);
+  return true;
+}
+
+bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int compression_level,
+                        bool send_path) {
+  return file_send_sendfile_with_skip(file, file_descriptor, use_metadata, compression_level,
+                                      send_path, NULL, -1, 0);
+}
+
+bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_metadata,
+                                  int compression_level, bool send_path, char* const* skip_suffixes,
+                                  int skip_count, int compression_threads) {
+  if (!file || !file->path || !file->data)
+    return false;
+  if (compression_level > 0)
+    return file_send_single_calls_with_skip(file, file_descriptor, use_metadata, compression_level,
+                                            send_path, skip_suffixes, skip_count,
+                                            compression_threads);
+
+  if (send_path && !send_str(file_descriptor, file->path))
+    return false;
+  if (use_metadata && !metadata_send(file_descriptor, file->metadata))
+    return false;
+
+  int fd = open(file->path, O_RDONLY);
+  if (fd == -1) {
+    log_perror("Could not open file for sendfile");
+    return false;
+  }
+
+  unsigned long long file_size = file->data->size;
+  struct stat source_stat;
+  if (fstat(fd, &source_stat) != 0 || !S_ISREG(source_stat.st_mode) ||
+      (unsigned long long)source_stat.st_size < file_size) {
+    close(fd);
+    return false;
+  }
+  if (!send_n_data(file_descriptor, &file_size, sizeof(unsigned long long))) {
+    close(fd);
+    return false;
+  }
+
+  /* sendfile cannot encrypt TLS records.  Keep the framing identical but
+     route encrypted transfers through the deadline-aware IO layer. */
+  if (io_get_ssl() != NULL) {
+    unsigned char buffer[64 * 1024];
+    unsigned long long remaining = file_size;
+    bool ok = true;
+    while (remaining > 0) {
+      size_t want = remaining > sizeof(buffer) ? sizeof(buffer) : (size_t)remaining;
+      ssize_t got = read(fd, buffer, want);
+      if (got <= 0 || !send_n_data(file_descriptor, buffer, (size_t)got)) {
+        ok = false;
+        break;
+      }
+      remaining -= (unsigned long long)got;
+    }
+    close(fd);
+    return ok;
+  }
+
+  off_t offset = 0;
+  struct timespec deadline;
+  clock_gettime(CLOCK_MONOTONIC, &deadline);
+  deadline.tv_sec += 60;
+  while ((unsigned long long)offset < file_size) {
+    struct timespec now;
+    clock_gettime(CLOCK_MONOTONIC, &now);
+    long long remaining = (long long)(deadline.tv_sec - now.tv_sec) * 1000LL +
+                          (deadline.tv_nsec - now.tv_nsec) / 1000000LL;
+    if (remaining <= 0) {
+      close(fd);
+      return false;
+    }
+    struct pollfd pfd = {.fd = file_descriptor, .events = POLLOUT};
+    int timeout = remaining > INT_MAX ? INT_MAX : (int)remaining;
+    int polled = poll(&pfd, 1, timeout);
+    if (polled <= 0 || (pfd.revents & (POLLERR | POLLHUP | POLLNVAL))) {
+      close(fd);
+      return false;
+    }
+    ssize_t sent = sendfile(file_descriptor, fd, &offset, file_size - offset);
+    if (sent == -1) {
+      if (errno == EAGAIN || errno == EINTR)
+        continue;
+      log_perror("sendfile failed");
+      close(fd);
+      return false;
+    }
+    if (sent == 0) {
+      close(fd);
+      return false;
+    }
+  }
+
+  close(fd);
+  return true;
+}

src/shared/file_send.h

@@ -0,0 +1,21 @@
+#ifndef FILE_SEND_H
+#define FILE_SEND_H
+
+#include "file_types.h"
+#include <stdbool.h>
+
+/* Client-side file send path. */
+
+bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
+                            int compression_level, bool send_path);
+bool file_send_single_calls_with_skip(File* file, int file_descriptor, bool use_metadata,
+                                      int compression_level, bool send_path,
+                                      char* const* skip_suffixes, int skip_count,
+                                      int compression_threads);
+bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int compression_level,
+                        bool send_path);
+bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_metadata,
+                                  int compression_level, bool send_path, char* const* skip_suffixes,
+                                  int skip_count, int compression_threads);
+
+#endif

src/shared/file_store.c

@@ -20,10 +20,18 @@ static bool path_is_within_root(const char* root, const char* path) {
          (path[root_length] == '\0' || path[root_length] == '/');
 }
 
-void file_store_set_authorized_root(int fd, const char* canonical_path) {
+bool file_store_set_authorized_root(int fd, const char* canonical_path) {
-  authorized_root_fd = fd;
+  char* new_path = canonical_path ? str_dup(canonical_path) : NULL;
+  if (canonical_path && !new_path) {
+    authorized_root_fd = -1;
     free(authorized_root_path);
-  authorized_root_path = canonical_path ? str_dup(canonical_path) : NULL;
+    authorized_root_path = NULL;
+    return false;
+  }
+  free(authorized_root_path);
+  authorized_root_path = new_path;
+  authorized_root_fd = fd;
+  return true;
 }
 
 int file_store_open_secure_parent(const char* path, char** leaf_out) {
@@ -38,9 +46,19 @@ int file_store_open_secure_parent(const char* path, char** leaf_out) {
     return -1;
   }
   int fd;
-  if (authorized_root_fd >= 0 && authorized_root_path && path[0] == '/' &&
+  if (authorized_root_fd >= 0) {
-      path_is_within_root(authorized_root_path, path)) {
+    if (!authorized_root_path || path[0] != '/' ||
+        !path_is_within_root(authorized_root_path, path)) {
+      free(copy);
+      free(leaf);
+      return -1;
+    }
     fd = dup(authorized_root_fd);
+    if (fd < 0) {
+      free(copy);
+      free(leaf);
+      return -1;
+    }
     size_t root_length = strlen(authorized_root_path);
     char* relative = str_dup(path + root_length);
     if (!relative) {
@@ -64,10 +82,18 @@ int file_store_open_secure_parent(const char* path, char** leaf_out) {
   char* save = NULL;
   char* component = strtok_r(parent, "/", &save);
   while (component) {
-    if (strcmp(component, ".") != 0 && strcmp(component, "..") != 0) {
+    if (strcmp(component, "..") == 0) {
+      close(fd);
+      free(copy);
+      free(leaf);
+      return -1;
+    }
+    if (strcmp(component, ".") != 0) {
       int next = openat(fd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-      if (next < 0 && errno == ENOENT && mkdirat(fd, component, 0755) == 0)
+      if (next < 0 && errno == ENOENT) {
+        if (mkdirat(fd, component, 0755) == 0 || errno == EEXIST)
           next = openat(fd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+      }
       if (next < 0) {
         close(fd);
         free(copy);
@@ -114,7 +140,8 @@ static bool write_all(int fd, const void* data, unsigned long long size) {
 }
 
 bool file_store_write_secure(const char* path, const void* data, unsigned long long data_size,
-                             bool inplace, bool sparse, const FileMetadata* metadata) {
+                             bool inplace, bool sparse, const FileMetadata* metadata,
+                             bool preserve_executability) {
   char* leaf = NULL;
   int dirfd = file_store_open_secure_parent(path, &leaf);
   if (dirfd < 0)
@@ -127,12 +154,23 @@ bool file_store_write_secure(const char* path, const void* data, unsigned long l
       if (!sparse || data_size == 0 || ftruncate(fd, (off_t)data_size) == 0)
         ok = write_all(fd, data, data_size);
       if (ok && metadata)
-        ok = file_restore_metadata_fd(fd, metadata);
+        ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
     }
   } else {
-    char tmp[NAME_MAX];
+    int tmp_size = snprintf(NULL, 0, ".%s.tmp.%ld.%u", leaf, (long)getpid(), 99U);
+    if (tmp_size < 0) {
+      close(dirfd);
+      free(leaf);
+      return false;
+    }
+    char* tmp = malloc((size_t)tmp_size + 1);
+    if (!tmp) {
+      close(dirfd);
+      free(leaf);
+      return false;
+    }
     for (unsigned int i = 0; i < 100 && !ok; ++i) {
-      snprintf(tmp, sizeof(tmp), ".%s.tmp.%ld.%u", leaf, (long)getpid(), i);
+      snprintf(tmp, (size_t)tmp_size + 1, ".%s.tmp.%ld.%u", leaf, (long)getpid(), i);
       fd = openat(dirfd, tmp, O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC | O_NOFOLLOW, 0600);
       if (fd < 0)
         continue;
@@ -141,7 +179,7 @@ bool file_store_write_secure(const char* path, const void* data, unsigned long l
       if (ok || (!sparse || data_size == 0))
         ok = write_all(fd, data, data_size);
       if (ok && metadata)
-        ok = file_restore_metadata_fd(fd, metadata);
+        ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
       if (close(fd) != 0)
         ok = false;
       fd = -1;
@@ -150,6 +188,7 @@ bool file_store_write_secure(const char* path, const void* data, unsigned long l
       if (!ok)
         unlinkat(dirfd, tmp, 0);
     }
+    free(tmp);
   }
   if (fd >= 0)
     close(fd);

src/shared/file_store.h

@@ -4,10 +4,11 @@
 #include "file.h"
 #include <stdbool.h>
 
-void file_store_set_authorized_root(int fd, const char* canonical_path);
+bool file_store_set_authorized_root(int fd, const char* canonical_path);
 int file_store_open_secure_parent(const char* path, char** leaf_out);
 bool file_store_rename_secure(const char* old_path, const char* new_path);
 bool file_store_write_secure(const char* path, const void* data, unsigned long long data_size,
-                             bool inplace, bool sparse, const FileMetadata* metadata);
+                             bool inplace, bool sparse, const FileMetadata* metadata,
+                             bool preserve_executability);
 
 #endif

src/shared/file_types.h

@@ -0,0 +1,25 @@
+#ifndef FILE_TYPES_H
+#define FILE_TYPES_H
+
+#include "data.h"
+#include <stdbool.h>
+#include <sys/stat.h>
+
+typedef enum { FILE_TYPE_REGULAR, FILE_TYPE_SYMLINK, FILE_TYPE_DIR } FileType;
+
+typedef struct {
+  mode_t mode;
+  uid_t uid;
+  gid_t gid;
+  time_t mtime_sec;
+  long mtime_nsec;
+} FileMetadata;
+
+typedef struct {
+  char* path;
+  Data* data;
+  FileMetadata* metadata;
+  bool skip;
+} File;
+
+#endif

src/shared/log.c

@@ -1,20 +1,61 @@
 #include "log.h"
+#include <errno.h>
+#include <stdbool.h>
 #include <stdarg.h>
 #include <stdio.h>
+#include <string.h>
 #include <time.h>
 
 static const char* log_level_strings[] = {"DEBUG", "INFO", "WARN", "ERROR"};
 static LogLevel current_log_level = LOG_LEVEL_WARNING;
+static uint32_t current_debug_flags = 0;
+static uint32_t info_flags = 0;
+static bool info_flags_explicit = false;
 static FILE* log_fp = NULL;
+static _Thread_local bool eight_bit_output;
+static LogStderrMode stderr_mode = LOG_STDERR_ERRORS;
 
 void set_log_level(LogLevel level) {
   current_log_level = level;
 }
 
+void set_log_debug_flags(uint32_t flags) {
+  current_debug_flags = flags;
+}
+
+uint32_t get_log_debug_flags(void) {
+  return current_debug_flags;
+}
+
+void set_log_info_flags(uint32_t flags) {
+  info_flags = flags;
+  info_flags_explicit = true;
+}
+
+uint32_t get_log_info_flags(void) {
+  return info_flags;
+}
+
 void log_set_file(FILE* fp) {
   log_fp = fp;
 }
 
+void log_set_8_bit_output(bool enabled) {
+  eight_bit_output = enabled;
+}
+
+bool log_get_8_bit_output(void) {
+  return eight_bit_output;
+}
+
+void log_set_stderr_mode(LogStderrMode mode) {
+  stderr_mode = mode;
+}
+
+LogStderrMode log_get_stderr_mode(void) {
+  return stderr_mode;
+}
+
 static inline void write_message(FILE* dest_io, LogLevel log_level, struct tm t, const char* format,
                                  va_list args) {
   fprintf(dest_io, "%04d-%02d-%02d %02d:%02d:%02d [%s]: ", t.tm_year + 1900, t.tm_mon + 1,
@@ -35,7 +76,7 @@ void log_message(LogLevel log_level, const char* format, ...) {
     return;
 
   FILE* dest_io = stdout;
-  if (log_level == LOG_LEVEL_ERROR) {
+  if (stderr_mode == LOG_STDERR_ALL || log_level == LOG_LEVEL_ERROR) {
     dest_io = stderr;
   }
 
@@ -50,3 +91,50 @@ void log_message(LogLevel log_level, const char* format, ...) {
     va_end(args);
   }
 }
+
+void log_debug_message(LogDebugFlag flag, const char* format, ...) {
+  if (current_log_level > LOG_LEVEL_DEBUG || !(current_debug_flags & flag))
+    return;
+
+  time_t now = time(NULL);
+  struct tm t;
+  if (!localtime_r(&now, &t))
+    return;
+
+  va_list args;
+  va_start(args, format);
+  write_message(stdout, LOG_LEVEL_DEBUG, t, format, args);
+  va_end(args);
+
+  if (log_fp) {
+    va_start(args, format);
+    write_message(log_fp, LOG_LEVEL_DEBUG, t, format, args);
+    va_end(args);
+  }
+}
+
+void log_info_message(LogInfoFlag flag, const char* format, ...) {
+  if ((info_flags_explicit && (info_flags & flag) == 0) ||
+      (!info_flags_explicit && current_log_level > LOG_LEVEL_DEBUG))
+    return;
+
+  time_t now = time(NULL);
+  struct tm t;
+  if (!localtime_r(&now, &t))
+    return;
+
+  va_list args;
+  va_start(args, format);
+  write_message(stdout, LOG_LEVEL_INFO, t, format, args);
+  va_end(args);
+
+  if (log_fp) {
+    va_start(args, format);
+    write_message(log_fp, LOG_LEVEL_INFO, t, format, args);
+    va_end(args);
+  }
+}
+
+void log_perror(const char* context) {
+  log_message(LOG_LEVEL_ERROR, "%s: %s", context, strerror(errno));
+}

src/shared/log.h

@@ -2,11 +2,41 @@
 #define LOG_H
 
 #include <stdio.h>
+#include <stdbool.h>
+#include <stdint.h>
 
 typedef enum { LOG_LEVEL_DEBUG, LOG_LEVEL_INFO, LOG_LEVEL_WARNING, LOG_LEVEL_ERROR } LogLevel;
+typedef enum { LOG_STDERR_ERRORS, LOG_STDERR_ALL } LogStderrMode;
+
+typedef enum {
+  LOG_DEBUG_IO = 1u << 0,
+  LOG_DEBUG_PROTO = 1u << 1,
+  LOG_DEBUG_PACK = 1u << 2,
+  LOG_DEBUG_UTIL = 1u << 3,
+  LOG_DEBUG_ALL = (1u << 4) - 1,
+} LogDebugFlag;
+
+typedef enum {
+  LOG_INFO_COPY = 1u << 0,
+  LOG_INFO_MISC = 1u << 1,
+  LOG_INFO_SKIP = 1u << 2,
+  LOG_INFO_STATS = 1u << 3,
+  LOG_INFO_ALL = LOG_INFO_COPY | LOG_INFO_MISC | LOG_INFO_SKIP | LOG_INFO_STATS,
+} LogInfoFlag;
 
 void log_message(LogLevel log_level, const char* message, ...);
+void log_perror(const char* context);
 void set_log_level(LogLevel level);
+void set_log_debug_flags(uint32_t flags);
+uint32_t get_log_debug_flags(void);
+void log_debug_message(LogDebugFlag flag, const char* message, ...);
+void set_log_info_flags(uint32_t flags);
+uint32_t get_log_info_flags(void);
+void log_info_message(LogInfoFlag flag, const char* message, ...);
 void log_set_file(FILE* fp);
+void log_set_8_bit_output(bool enabled);
+bool log_get_8_bit_output(void);
+void log_set_stderr_mode(LogStderrMode mode);
+LogStderrMode log_get_stderr_mode(void);
 
 #endif

src/shared/metadata.c

@@ -2,6 +2,7 @@
 #include "file.h"
 #include "log.h"
 #include "protocol.h"
+#include "utils.h"
 #include <errno.h>
 #include <fcntl.h>
 #include <stdint.h>
@@ -24,6 +25,29 @@ typedef char static_assert_mode_t_fits[(sizeof(mode_t) <= sizeof(int32_t)) ? 1 :
 typedef char static_assert_uid_t_fits[(sizeof(uid_t) <= sizeof(int32_t)) ? 1 : -1];
 typedef char static_assert_gid_t_fits[(sizeof(gid_t) <= sizeof(int32_t)) ? 1 : -1];
 
+bool metadata_mtime_matches(time_t left_sec, long left_nsec, time_t right_sec, long right_nsec,
+                            int modify_window) {
+  int64_t left = (int64_t)left_sec;
+  int64_t right = (int64_t)right_sec;
+  int64_t seconds;
+  int64_t nanoseconds;
+
+  if (left > right || (left == right && left_nsec >= right_nsec)) {
+    seconds = left - right;
+    nanoseconds = (int64_t)left_nsec - (int64_t)right_nsec;
+  } else {
+    seconds = right - left;
+    nanoseconds = (int64_t)right_nsec - (int64_t)left_nsec;
+  }
+  if (nanoseconds < 0) {
+    seconds--;
+    nanoseconds += 1000000000LL;
+  }
+  if (modify_window == 0)
+    return left == right;
+  return seconds < modify_window || (seconds == modify_window && nanoseconds == 0);
+}
+
 void metadata_to_buf(char** buf, const FileMetadata* m) {
   int32_t present = (m != NULL) ? 1 : 0;
   memcpy(*buf, &present, sizeof(present));
@@ -51,9 +75,11 @@ FileMetadata* metadata_from_buf(char** buf) {
   int32_t present;
   memcpy(&present, *buf, sizeof(present));
   *buf += sizeof(present);
+  if (present != 0 && present != 1)
+    return NULL;
   if (!present)
     return NULL;
-  FileMetadata* m = malloc(sizeof(FileMetadata));
+  FileMetadata* m = protocol_alloc(sizeof(FileMetadata));
   if (m == NULL)
     return NULL;
   int32_t mode;
@@ -76,10 +102,15 @@ FileMetadata* metadata_from_buf(char** buf) {
   memcpy(&mtime_nsec, *buf, sizeof(mtime_nsec));
   *buf += sizeof(mtime_nsec);
   m->mtime_nsec = (long)mtime_nsec;
+  if (present != 1 || mtime_nsec < 0 || mtime_nsec >= 1000000000LL || mode < 0 || uid < 0 ||
+      gid < 0) {
+    free(m);
+    return NULL;
+  }
   return m;
 }
 
-bool metadata_send(int file_descriptor, FileMetadata* m) {
+bool metadata_send(int file_descriptor, const FileMetadata* m) {
   if (m == NULL) {
     int32_t zero = 0;
     return send_n_data(file_descriptor, &zero, sizeof(zero));
@@ -115,7 +146,7 @@ FileMetadata* metadata_receive(int file_descriptor, int* ok) {
       *ok = 0;
     return NULL;
   }
-  FileMetadata* m = malloc(sizeof(FileMetadata));
+  FileMetadata* m = protocol_alloc(sizeof(FileMetadata));
   if (m == NULL) {
     if (ok)
       *ok = 0;
@@ -172,11 +203,27 @@ FileMetadata* metadata_receive(int file_descriptor, int* ok) {
   return m;
 }
 
-void file_restore_metadata(const char* path, const FileMetadata* metadata) {
+static mode_t metadata_mode(const FileMetadata* metadata, mode_t current_mode,
+                            bool preserve_executability) {
+  const mode_t execute_bits = S_IXUSR | S_IXGRP | S_IXOTH;
+  if (preserve_executability)
+    return (current_mode & 0777 & ~execute_bits) | (metadata->mode & execute_bits);
+  return metadata->mode & 0777 & ~(S_IWGRP | S_IWOTH);
+}
+
+void file_restore_metadata(const char* path, const FileMetadata* metadata,
+                           bool preserve_executability) {
   if (metadata == NULL)
     return;
-  if (chmod(path, metadata->mode & 07777 & ~(S_ISUID | S_ISGID)) != 0)
+  struct stat current;
-    log_message(LOG_LEVEL_WARNING, "Failed to chmod %s: %s", path, strerror(errno));
+  mode_t current_mode = stat(path, &current) == 0 ? current.st_mode : 0;
+  mode_t safe_mode = metadata_mode(metadata, current_mode, preserve_executability);
+  if (chmod(path, safe_mode) != 0) {
+    char* escaped_path = output_escape(path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_WARNING, "Failed to chmod %s: %s",
+                escaped_path ? escaped_path : "<allocation failed>", strerror(errno));
+    free(escaped_path);
+  }
   /* Never apply client-supplied ownership.  The descriptor API below is the
      receiver write path; retain this legacy API only for compatibility. */
   struct timespec times[2];
@@ -184,15 +231,23 @@ void file_restore_metadata(const char* path, const FileMetadata* metadata) {
   times[0].tv_nsec = UTIME_OMIT;
   times[1].tv_sec = metadata->mtime_sec;
   times[1].tv_nsec = metadata->mtime_nsec;
-  if (utimensat(AT_FDCWD, path, times, 0) != 0)
+  if (utimensat(AT_FDCWD, path, times, 0) != 0) {
-    log_message(LOG_LEVEL_WARNING, "Failed to set timestamps on %s: %s", path, strerror(errno));
+    char* escaped_path = output_escape(path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_WARNING, "Failed to set timestamps on %s: %s",
+                escaped_path ? escaped_path : "<allocation failed>", strerror(errno));
+    free(escaped_path);
+  }
 }
 
-bool file_restore_metadata_fd(int fd, const FileMetadata* metadata) {
+bool file_restore_metadata_fd(int fd, const FileMetadata* metadata, bool preserve_executability) {
   if (fd < 0 || metadata == NULL)
     return metadata == NULL;
   bool ok = true;
-  if (fchmod(fd, metadata->mode & 07777 & ~(S_ISUID | S_ISGID)) != 0)
+  struct stat current;
+  if (fstat(fd, &current) != 0)
+    return false;
+  mode_t safe_mode = metadata_mode(metadata, current.st_mode, preserve_executability);
+  if (fchmod(fd, safe_mode) != 0)
     ok = false;
   /* Client uid/gid values are deliberately not authoritative. */
   struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},

src/shared/metadata.h

@@ -5,6 +5,7 @@
 #include <stdbool.h>
 #include <stdint.h>
 #include <sys/stat.h>
+#include <time.h>
 
 /*
  * Wire format (introduced in protocol version 2.0.0):
@@ -27,9 +28,14 @@
 
 void metadata_to_buf(char** buf, const FileMetadata* m);
 FileMetadata* metadata_from_buf(char** buf);
-bool metadata_send(int file_descriptor, FileMetadata* m);
+bool metadata_send(int file_descriptor, const FileMetadata* m);
 FileMetadata* metadata_receive(int file_descriptor, int* ok);
-void file_restore_metadata(const char* path, const FileMetadata* metadata);
+void file_restore_metadata(const char* path, const FileMetadata* metadata,
-bool file_restore_metadata_fd(int fd, const FileMetadata* metadata);
+                           bool preserve_executability);
+bool file_restore_metadata_fd(int fd, const FileMetadata* metadata, bool preserve_executability);
+
+/* Compare timestamps using rsync's whole-second modification window. */
+bool metadata_mtime_matches(time_t left_sec, long left_nsec, time_t right_sec, long right_nsec,
+                            int modify_window);
 
 #endif

src/shared/multiprocessing.c

@@ -26,9 +26,14 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
   context->scanner_done = false;
   context->loader_done = false;
   context->manifest = NULL;
+  context->remove_source_files = NULL;
+  context->total_files = 0;
   context->progress_bytes = 0;
+  context->total_bytes = 0;
   context->sender_done = false;
   atomic_init(&context->cancelled, false);
+  protocol_session_init(&context->allocation_session, -1, -1);
+  protocol_session_set_max_alloc(&context->allocation_session, config->max_alloc);
   int init = 0;
   if (mtx_init(&context->mutex_scanner, mtx_plain) != thrd_success)
     goto fail;
@@ -55,7 +60,7 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
   return context;
 
 fail:
-  perror("Error initializing synchronization objects");
+  log_perror("Error initializing synchronization objects");
   if (init >= 6)
     cnd_destroy(&context->condition_not_empty_loader);
   if (init >= 5)
@@ -76,6 +81,8 @@ void pipeline_context_sender_destroy(PipelineContextSender* context) {
   if (context->manifest) {
     array_list_delete(context->manifest);
   }
+  if (context->remove_source_files)
+    array_list_delete(context->remove_source_files);
   config_delete(context->config);
   queue_destroy(context->queue_scanner);
   queue_destroy(context->queue_loader);
@@ -98,9 +105,14 @@ PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue*
   context->queue = queue;
   context->file_descriptor = file_descriptor;
   context->ssl = ssl;
+  context->outcomes.entries = NULL;
+  context->outcomes.count = 0;
+  context->outcomes.capacity = 0;
   protocol_session_init(&context->session, file_descriptor, file_descriptor);
   protocol_session_set_ssl(&context->session, ssl);
   context->receiver_done = false;
+  context->queued_bytes = 0;
+  context->max_queue_bytes = 0;
   atomic_init(&context->cancelled, false);
   int init = 0;
   if (mtx_init(&context->mutex, mtx_plain) != thrd_success)
@@ -116,7 +128,7 @@ PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue*
   return context;
 
 fail:
-  perror("Error initializing synchronization objects");
+  log_perror("Error initializing synchronization objects");
   if (init >= 3)
     cnd_destroy(&context->condition_not_empty);
   if (init >= 2)
@@ -130,21 +142,81 @@ fail:
 void pipeline_context_receiver_destroy(PipelineContextReceiver* context) {
   config_delete(context->config);
   queue_destroy(context->queue);
+  receiver_outcomes_destroy(&context->outcomes);
   mtx_destroy(&context->mutex);
   cnd_destroy(&context->condition_not_full);
   cnd_destroy(&context->condition_not_empty);
   free(context);
 }
 
-static bool receiver_enqueue_file(File* file, void* context_pointer) {
+void pipeline_context_receiver_set_queue_byte_limit(PipelineContextReceiver* context,
-  PipelineContextReceiver* context = context_pointer;
+                                                    size_t max_bytes) {
-  if (queue_enqueue_multithreaded_cancel(context->queue, file, &context->mutex,
+  if (context == NULL)
-                                         &context->condition_not_empty,
+    return;
-                                         &context->condition_not_full, &context->cancelled))
+  mtx_lock(&context->mutex);
-    return true;
+  context->max_queue_bytes = max_bytes;
+  context->queued_bytes = 0;
+  cnd_broadcast(&context->condition_not_full);
+  mtx_unlock(&context->mutex);
+}
+
+void pipeline_context_receiver_note_bytes_released(PipelineContextReceiver* context,
+                                                   size_t released_bytes) {
+  if (context == NULL || context->max_queue_bytes == 0 || released_bytes == 0)
+    return;
+  mtx_lock(&context->mutex);
+  if (released_bytes >= context->queued_bytes)
+    context->queued_bytes = 0;
+  else
+    context->queued_bytes -= released_bytes;
+  cnd_signal(&context->condition_not_full);
+  mtx_unlock(&context->mutex);
+}
+
+bool pipeline_context_receiver_enqueue_file(PipelineContextReceiver* context, File* file) {
+  if (context == NULL || file == NULL)
+    return false;
+  size_t file_bytes = file->data ? file->data->size : 0;
+  mtx_lock(&context->mutex);
+  while (!atomic_load(&context->cancelled)) {
+    bool blocked_by_count = queue_is_full(context->queue);
+    bool blocked_by_budget = false;
+    if (context->max_queue_bytes > 0) {
+      size_t budget = context->max_queue_bytes;
+      size_t used = context->queued_bytes;
+      if (used >= budget) {
+        blocked_by_budget = true;
+      } else if (file_bytes > budget - used) {
+        /* A single payload larger than the whole budget (not possible with
+           the per-file receive cap) is only admitted to an empty pipeline so
+           the wait can never deadlock. */
+        blocked_by_budget = used != 0;
+      }
+    }
+    if (!blocked_by_count && !blocked_by_budget)
+      break;
+    cnd_wait(&context->condition_not_full, &context->mutex);
+  }
+  if (atomic_load(&context->cancelled)) {
+    mtx_unlock(&context->mutex);
     file_destroy(file);
     return false;
   }
+  if (!queue_enqueue(context->queue, file)) {
+    mtx_unlock(&context->mutex);
+    file_destroy(file);
+    return false;
+  }
+  context->queued_bytes += file_bytes;
+  cnd_signal(&context->condition_not_empty);
+  mtx_unlock(&context->mutex);
+  return true;
+}
+
+static bool receiver_enqueue_file(File* file, void* context_pointer) {
+  PipelineContextReceiver* context = (PipelineContextReceiver*)context_pointer;
+  return pipeline_context_receiver_enqueue_file(context, file);
+}
 
 static void receiver_thread_fail(PipelineContextReceiver* context) {
   mtx_lock(&context->mutex);
@@ -163,7 +235,7 @@ int receive_thread(void* pipeline_context) {
   const Config* config = context->config;
   mtx_unlock(&context->mutex);
 
-  ReceiverSink sink = {receiver_enqueue_file, context, false, false};
+  ReceiverSink sink = {receiver_enqueue_file, context, false, false, NULL};
   if (receiver_process((Config*)config, file_descriptor, &sink) != 0) {
     receiver_thread_fail(context);
     protocol_session_unbind();
@@ -179,10 +251,21 @@ int receive_thread(void* pipeline_context) {
 
 int write_thread(void* pipeline_context) {
   PipelineContextReceiver* context = (PipelineContextReceiver*)pipeline_context;
+  protocol_session_bind(&context->session);
   mtx_lock(&context->mutex);
   bool save_to_disk = context->config->save_to_disk;
   char* root_directory = str_dup(context->config->receive_root_directory);
   mtx_unlock(&context->mutex);
+  if (save_to_disk && !root_directory) {
+    mtx_lock(&context->mutex);
+    atomic_store(&context->cancelled, true);
+    context->receiver_done = true;
+    cnd_broadcast(&context->condition_not_full);
+    cnd_broadcast(&context->condition_not_empty);
+    mtx_unlock(&context->mutex);
+    protocol_session_unbind();
+    return thrd_error;
+  }
 
   while (true) {
     File* file =
@@ -190,10 +273,16 @@ int write_thread(void* pipeline_context) {
                                     &context->condition_not_full, &context->receiver_done);
     if (file == NULL) {
       free(root_directory);
+      protocol_session_unbind();
       return thrd_success;
     }
-    if (save_to_disk && !file_save_to_disk(root_directory, file, context->config)) {
+    size_t file_bytes = file->data ? file->data->size : 0;
+    FileSaveResult result = FILE_SAVE_SKIPPED;
+    if (save_to_disk) {
+      result = file_save_to_disk_full(root_directory, file, context->config);
+      if (result == FILE_SAVE_ERROR) {
         file_destroy(file);
+        pipeline_context_receiver_note_bytes_released(context, file_bytes);
         mtx_lock(&context->mutex);
         atomic_store(&context->cancelled, true);
         context->receiver_done = true;
@@ -201,8 +290,27 @@ int write_thread(void* pipeline_context) {
         cnd_broadcast(&context->condition_not_empty);
         mtx_unlock(&context->mutex);
         free(root_directory);
+        protocol_session_unbind();
+        return thrd_error;
+      }
+    }
+    /* Record the per-file outcome so a --remove-source-files sender learns
+       which sources were actually written versus skipped on the receiver. */
+    if (context->config->remove_source_files &&
+        !receiver_outcomes_append(&context->outcomes, (unsigned char)result)) {
+      file_destroy(file);
+      pipeline_context_receiver_note_bytes_released(context, file_bytes);
+      mtx_lock(&context->mutex);
+      atomic_store(&context->cancelled, true);
+      context->receiver_done = true;
+      cnd_broadcast(&context->condition_not_full);
+      cnd_broadcast(&context->condition_not_empty);
+      mtx_unlock(&context->mutex);
+      free(root_directory);
+      protocol_session_unbind();
       return thrd_error;
     }
     file_destroy(file);
+    pipeline_context_receiver_note_bytes_released(context, file_bytes);
   }
 }

src/shared/multiprocessing.h

@@ -9,6 +9,7 @@
 #include "file.h"
 #include "protocol.h"
 #include "queue.h"
+#include "receiver.h"
 #include <openssl/ssl.h>
 
 typedef struct {
@@ -24,10 +25,14 @@ typedef struct {
   cnd_t condition_not_empty_loader;
   bool loader_done;
   ArrayList* manifest;
+  ArrayList* remove_source_files;
   mtx_t mutex_progress;
+  int total_files;
   unsigned long long progress_bytes;
+  unsigned long long total_bytes;
   bool sender_done;
   atomic_bool cancelled;
+  ProtocolSession allocation_session;
 } PipelineContextSender;
 
 typedef struct PipelineContextReceiver {
@@ -36,11 +41,20 @@ typedef struct PipelineContextReceiver {
   int file_descriptor;
   SSL* ssl;
   ProtocolSession session;
+  ReceiverOutcomes outcomes;
   mtx_t mutex;
   cnd_t condition_not_full;
   cnd_t condition_not_empty;
   bool receiver_done;
   atomic_bool cancelled;
+  /* Aggregate payload bytes that have been received but not yet released by
+     the disk writer (queued or in the writer's hand).  Guarded by `mutex`.
+     When `max_queue_bytes` is non-zero the receiver blocks before enqueuing
+     once this total would exceed it, so decompressed/copied file payloads
+     buffered ahead of a slow disk writer respect the per-connection memory
+     budget instead of growing without bound. */
+  size_t queued_bytes;
+  size_t max_queue_bytes;
 } PipelineContextReceiver;
 
 PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* queue_scanner,
@@ -49,6 +63,18 @@ void pipeline_context_sender_destroy(PipelineContextSender* context);
 PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue* queue_receiver,
                                                           int file_descriptor, SSL* ssl);
 void pipeline_context_receiver_destroy(PipelineContextReceiver* context);
+/* Bound the bytes buffered ahead of the disk writer (see max_queue_bytes). */
+void pipeline_context_receiver_set_queue_byte_limit(PipelineContextReceiver* context,
+                                                    size_t max_bytes);
+/* Blocking enqueue used by the receive pipeline sink.  Blocks while the queue
+   is full by element count or when adding `file` would push queued_bytes over
+   the configured byte limit; waits until the disk writer releases bytes.
+   Takes ownership of `file` on success and destroys it on failure/cancel. */
+bool pipeline_context_receiver_enqueue_file(PipelineContextReceiver* context, File* file);
+/* Account for `released_bytes` of payload memory that has been freed by the
+   disk writer, unblocking a receiver that is waiting on the byte limit. */
+void pipeline_context_receiver_note_bytes_released(PipelineContextReceiver* context,
+                                                   size_t released_bytes);
 int receive_thread(void* pipeline_context);
 int write_thread(void* pipeline_context);
 #endif

src/shared/protocol.c

@@ -1,5 +1,6 @@
 #include "protocol.h"
 #include "log.h"
+#include "utils.h"
 #include <errno.h>
 #include <limits.h>
 #include <openssl/ssl.h>
@@ -13,21 +14,45 @@
 
 #define RECEIVE_TIMEOUT_SEC 60 /* 60 second per-message timeout */
 #define SEND_TIMEOUT_SEC 60
-#define MAX_CONNECTION_MEMORY (1024ULL * 1024 * 1024) /* 1 GB total per connection */
 
 static __thread int io_read_fd = -1;
 static __thread int io_write_fd = -1;
 static __thread SSL* io_ssl;
 static __thread ProtocolSession* bound_session;
+static __thread ProtocolSession legacy_io_session = {
+    .read_fd = -1, .write_fd = -1, .max_alloc = DEFAULT_MAX_ALLOC};
 
 static unsigned long long io_bwlimit = 0;
-static long long bw_tokens = 0;
-static struct timespec bw_last_refill = {0, 0};
 static mtx_t bw_mutex;
 static once_flag bw_mutex_once = ONCE_FLAG_INIT;
 
-static __thread unsigned long long total_allocated_bytes = 0;
+static unsigned long long global_bwlimit(void);
 
+static bool protocol_reserve_memory(ProtocolSession* session, size_t charge) {
+  unsigned long long allocated = atomic_load(&session->total_allocated_bytes);
+  while (true) {
+    if (allocated > MAX_CONNECTION_MEMORY ||
+        (unsigned long long)charge > MAX_CONNECTION_MEMORY - allocated)
+      return false;
+    if (atomic_compare_exchange_weak(&session->total_allocated_bytes, &allocated,
+                                     allocated + (unsigned long long)charge))
+      return true;
+  }
+}
+
+static void protocol_release_memory_for_session(ProtocolSession* session, size_t charge) {
+  unsigned long long allocated = atomic_load(&session->total_allocated_bytes);
+  while (true) {
+    unsigned long long remaining = (unsigned long long)charge >= allocated ? 0 : allocated - charge;
+    if (atomic_compare_exchange_weak(&session->total_allocated_bytes, &allocated, remaining))
+      break;
+  }
+}
+
+void protocol_release_memory(size_t charge) {
+  ProtocolSession* session = bound_session ? bound_session : &legacy_io_session;
+  protocol_release_memory_for_session(session, charge);
+}
 void io_set_fds(int read_fd, int write_fd) {
   bound_session = NULL;
   io_read_fd = read_fd;
@@ -35,7 +60,13 @@ void io_set_fds(int read_fd, int write_fd) {
   /* A descriptor switch starts a new transport; never reuse a TLS object
      belonging to a previous connection or test pipe. */
   io_ssl = NULL;
-  total_allocated_bytes = 0;
+  legacy_io_session.read_fd = read_fd;
+  legacy_io_session.write_fd = write_fd;
+  legacy_io_session.ssl = NULL;
+  legacy_io_session.eight_bit_output = false;
+  atomic_store(&legacy_io_session.total_allocated_bytes, 0);
+  legacy_io_session.max_alloc = DEFAULT_MAX_ALLOC;
+  protocol_session_set_bwlimit(&legacy_io_session, global_bwlimit());
 }
 
 void protocol_session_init(ProtocolSession* session, int read_fd, int write_fd) {
@@ -44,12 +75,46 @@ void protocol_session_init(ProtocolSession* session, int read_fd, int write_fd)
   memset(session, 0, sizeof(*session));
   session->read_fd = read_fd;
   session->write_fd = write_fd;
-  if (io_bwlimit)
+  session->max_alloc = DEFAULT_MAX_ALLOC;
-    protocol_session_set_bwlimit(session, io_bwlimit);
+  atomic_init(&session->total_allocated_bytes, 0);
+  protocol_session_set_bwlimit(session, global_bwlimit());
+}
+
+void protocol_session_set_max_alloc(ProtocolSession* session, unsigned long long max_alloc) {
+  if (!session)
+    session = bound_session ? bound_session : &legacy_io_session;
+  session->max_alloc = max_alloc;
+}
+
+static bool allocation_allowed(const ProtocolSession* session, size_t size) {
+  return (unsigned long long)size <= session->max_alloc;
+}
+
+static void* protocol_alloc_for_session(const ProtocolSession* session, size_t size) {
+  if (!allocation_allowed(session, size))
+    return NULL;
+  return malloc(size);
+}
+
+static void* protocol_realloc_for_session(const ProtocolSession* session, void* ptr, size_t size) {
+  if (!allocation_allowed(session, size))
+    return NULL;
+  return realloc(ptr, size);
+}
+
+void* protocol_alloc(size_t size) {
+  const ProtocolSession* session = bound_session ? bound_session : &legacy_io_session;
+  return protocol_alloc_for_session(session, size);
+}
+
+void* protocol_realloc(void* ptr, size_t size) {
+  const ProtocolSession* session = bound_session ? bound_session : &legacy_io_session;
+  return protocol_realloc_for_session(session, ptr, size);
 }
 
 void protocol_session_bind(ProtocolSession* session) {
   bound_session = session;
+  log_set_8_bit_output(session && session->eight_bit_output);
 }
 
 void protocol_session_unbind(void) {
@@ -65,26 +130,48 @@ static void bw_mutex_init(void) {
   mtx_init(&bw_mutex, mtx_plain);
 }
 
+static unsigned long long global_bwlimit(void) {
+  unsigned long long limit;
+  call_once(&bw_mutex_once, bw_mutex_init);
+  mtx_lock(&bw_mutex);
+  limit = io_bwlimit;
+  mtx_unlock(&bw_mutex);
+  return limit;
+}
+
 void io_set_bwlimit(unsigned long long bytes_per_sec) {
   call_once(&bw_mutex_once, bw_mutex_init);
   mtx_lock(&bw_mutex);
-  io_bwlimit = bytes_per_sec;
+  io_bwlimit =
-  bw_tokens = (long long)io_bwlimit;
+      bytes_per_sec > (unsigned long long)LLONG_MAX ? (unsigned long long)LLONG_MAX : bytes_per_sec;
-  clock_gettime(CLOCK_MONOTONIC, &bw_last_refill);
   mtx_unlock(&bw_mutex);
 }
 
 void protocol_session_set_bwlimit(ProtocolSession* session, unsigned long long bytes_per_sec) {
   if (!session)
     return;
-  session->bwlimit = bytes_per_sec;
+  session->bwlimit =
-  session->bw_tokens = (long long)bytes_per_sec;
+      bytes_per_sec > (unsigned long long)LLONG_MAX ? (unsigned long long)LLONG_MAX : bytes_per_sec;
+  session->bw_tokens = (long long)session->bwlimit;
   struct timespec now;
   clock_gettime(CLOCK_MONOTONIC, &now);
   session->bw_last_refill_sec = now.tv_sec;
   session->bw_last_refill_nsec = now.tv_nsec;
 }
 
+void protocol_session_set_8_bit_output(ProtocolSession* session, bool enabled) {
+  if (!session)
+    return;
+  session->eight_bit_output = enabled;
+  if (session == bound_session)
+    log_set_8_bit_output(enabled);
+}
+
+void protocol_set_8_bit_output(bool enabled) {
+  ProtocolSession* session = bound_session ? bound_session : &legacy_io_session;
+  protocol_session_set_8_bit_output(session, enabled);
+}
+
 static void bw_throttle_session(ProtocolSession* session, size_t bytes_written) {
   if (session->bwlimit == 0)
     return;
@@ -126,32 +213,31 @@ SSL* io_get_ssl(void) {
   return io_ssl;
 }
 
-static ProtocolSession* legacy_session(void) {
+static ProtocolSession* legacy_session(int read_fd, int write_fd) {
-  static __thread ProtocolSession session;
   if (bound_session)
     return bound_session;
-  session.read_fd = io_read_fd;
+  int target_read_fd = io_read_fd != -1 ? io_read_fd : read_fd;
-  session.write_fd = io_write_fd;
+  int target_write_fd = io_write_fd != -1 ? io_write_fd : write_fd;
-  session.ssl = io_ssl;
+  if (legacy_io_session.read_fd != target_read_fd ||
-  session.bwlimit = io_bwlimit;
+      legacy_io_session.write_fd != target_write_fd) {
-  session.bw_tokens = (unsigned long long)(bw_tokens < 0 ? 0 : bw_tokens);
+    legacy_io_session.read_fd = target_read_fd;
-  session.bw_last_refill_sec = bw_last_refill.tv_sec;
+    legacy_io_session.write_fd = target_write_fd;
-  session.bw_last_refill_nsec = bw_last_refill.tv_nsec;
+    atomic_store(&legacy_io_session.total_allocated_bytes, 0);
-  return &session;
+    legacy_io_session.max_alloc = DEFAULT_MAX_ALLOC;
+    protocol_session_set_bwlimit(&legacy_io_session, global_bwlimit());
+  } else if (legacy_io_session.bwlimit != global_bwlimit()) {
+    protocol_session_set_bwlimit(&legacy_io_session, global_bwlimit());
+  }
+  legacy_io_session.ssl = io_ssl;
+  return &legacy_io_session;
 }
 
 bool send_n_data(int file_descriptor, const void* data, size_t data_size) {
-  ProtocolSession* session = legacy_session();
+  return protocol_send_n_data(legacy_session(-1, file_descriptor), data, data_size);
-  if (session->write_fd == -1)
-    session->write_fd = file_descriptor;
-  return protocol_send_n_data(session, data, data_size);
 }
 
 bool receive_n_data(int file_descriptor, void* data, size_t data_size) {
-  ProtocolSession* session = legacy_session();
+  return protocol_receive_n_data(legacy_session(file_descriptor, -1), data, data_size);
-  if (session->read_fd == -1)
-    session->read_fd = file_descriptor;
-  return protocol_receive_n_data(session, data, data_size);
 }
 
 static int deadline_remaining_ms(const struct timespec* deadline) {
@@ -166,7 +252,9 @@ static int deadline_remaining_ms(const struct timespec* deadline) {
 }
 
 bool protocol_send_n_data(ProtocolSession* session, const void* data, size_t data_size) {
-  log_message(LOG_LEVEL_DEBUG, "    Sending n Data: %zu", data_size);
+  if (!data && data_size != 0)
+    return false;
+  log_debug_message(LOG_DEBUG_IO, "    Sending n Data: %zu", data_size);
   if (!session)
     return false;
   int fd = session->write_fd;
@@ -207,13 +295,15 @@ bool protocol_send_n_data(ProtocolSession* session, const void* data, size_t dat
     }
     bw_throttle_session(session, (size_t)bytes_send);
     total_bytes_send += bytes_send;
+    if (session->ssl)
+      wait_events = POLLOUT;
   }
-  log_message(LOG_LEVEL_DEBUG, "    Send n Data: %zu", total_bytes_send);
+  log_debug_message(LOG_DEBUG_IO, "    Send n Data: %zu", total_bytes_send);
   return true;
 }
 
 bool protocol_receive_n_data(ProtocolSession* session, void* data, size_t data_size) {
-  log_message(LOG_LEVEL_DEBUG, "    Receiving n Data: %zu", data_size);
+  log_debug_message(LOG_DEBUG_IO, "    Receiving n Data: %zu", data_size);
   if (!session)
     return false;
   int fd = session->read_fd;
@@ -225,6 +315,7 @@ bool protocol_receive_n_data(ProtocolSession* session, void* data, size_t data_s
   size_t total_bytes_received = 0;
   short wait_events = POLLIN;
   while (total_bytes_received < data_size) {
+    if (!session->ssl || SSL_pending(session->ssl) == 0) {
       struct pollfd pfd = {.fd = fd, .events = wait_events};
       int poll_result = poll(&pfd, 1, deadline_remaining_ms(&deadline));
       if (poll_result == 0) {
@@ -239,6 +330,7 @@ bool protocol_receive_n_data(ProtocolSession* session, void* data, size_t data_s
       /* POLLHUP may accompany the final readable bytes on pipes/sockets. */
       if (pfd.revents & (POLLERR | POLLNVAL))
         return false;
+    }
 
     ssize_t bytes_received;
     if (session->ssl)
@@ -261,9 +353,11 @@ bool protocol_receive_n_data(ProtocolSession* session, void* data, size_t data_s
         log_message(LOG_LEVEL_ERROR, "Could not receive bytes");
       return false;
     }
-    total_bytes_received += bytes_received;
+    total_bytes_received += (size_t)bytes_received;
+    if (session->ssl)
+      wait_events = POLLIN;
   }
-  log_message(LOG_LEVEL_DEBUG, "    Received n Data: %zu", total_bytes_received);
+  log_debug_message(LOG_DEBUG_IO, "    Received n Data: %zu", total_bytes_received);
   return true;
 }
 
@@ -304,7 +398,7 @@ bool protocol_send_str(ProtocolSession* session, const char* data) {
     return false;
   if (!protocol_send_n_data(session, data, size))
     return false;
-  log_message(LOG_LEVEL_DEBUG, "Send String: %s", data);
+  log_debug_message(LOG_DEBUG_PROTO, "Send String: %s", data);
   return true;
 }
 
@@ -312,125 +406,138 @@ char* protocol_receive_str(ProtocolSession* session) {
   size_t size;
   if (!protocol_receive_n_data(session, &size, sizeof(size_t)))
     return NULL;
-  if (size > MAX_STRING_SIZE || size > SIZE_MAX - 1 ||
+  if (size > MAX_STRING_SIZE || size > SIZE_MAX - 1) {
-      size + 1 > MAX_CONNECTION_MEMORY - session->total_allocated_bytes) {
     log_message(LOG_LEVEL_ERROR, "String size %zu exceeds maximum %llu", size,
                 (unsigned long long)MAX_STRING_SIZE);
     return NULL;
   }
-  char* data = (char*)malloc(size + 1);
+  char* data = (char*)protocol_alloc_for_session(session, size + 1);
   if (data == NULL)
     return NULL;
   if (!protocol_receive_n_data(session, data, size)) {
     free(data);
     return NULL;
   }
+  if (memchr(data, '\0', size) != NULL) {
+    free(data);
+    log_message(LOG_LEVEL_ERROR, "Received string contains an embedded NUL");
+    return NULL;
+  }
   data[size] = '\0';
-  session->total_allocated_bytes += size + 1;
+  log_debug_message(LOG_DEBUG_PROTO, "Received String: %s", data);
-  log_message(LOG_LEVEL_DEBUG, "Received String: %s", data);
   return data;
 }
 
 bool protocol_send_data(ProtocolSession* session, const Data* data) {
+  if (!data || (!data->data && data->size != 0))
+    return false;
+  if (!session)
+    return false;
   unsigned long long data_size = data->size;
   if (!protocol_send_n_data(session, &data_size, sizeof(unsigned long long)))
     return false;
   if (!protocol_send_n_data(session, data->data, data_size))
     return false;
-  log_message(LOG_LEVEL_DEBUG, "Send %lld data", data_size);
+  log_debug_message(LOG_DEBUG_PROTO, "Send %lld data", data_size);
   return true;
 }
 
-Data* protocol_receive_data(ProtocolSession* session) {
+Data* protocol_receive_data_limited(ProtocolSession* session, unsigned long long maximum_size) {
+  if (!session)
+    return NULL;
   unsigned long long size = 0;
   if (!protocol_receive_n_data(session, &size, sizeof(unsigned long long)))
     return NULL;
-  if (size > MAX_DATA_PAYLOAD_SIZE) {
+  if (size > MAX_DATA_PAYLOAD_SIZE || size > maximum_size) {
     log_message(LOG_LEVEL_ERROR, "Data size %llu exceeds maximum %llu", size,
                 (unsigned long long)MAX_DATA_PAYLOAD_SIZE);
     return NULL;
   }
+  if (size > SIZE_MAX)
+    return NULL;
   size_t allocation_size = size == 0 ? 1 : (size_t)size;
-  if (allocation_size > MAX_CONNECTION_MEMORY - session->total_allocated_bytes) {
+  if (!protocol_reserve_memory(session, allocation_size)) {
     log_message(LOG_LEVEL_ERROR, "Per-connection memory limit exceeded (%llu + %llu > %llu)",
-                (unsigned long long)session->total_allocated_bytes, size,
+                (unsigned long long)atomic_load(&session->total_allocated_bytes), size,
                 (unsigned long long)MAX_CONNECTION_MEMORY);
     return NULL;
   }
-  void* data = malloc(allocation_size);
+  void* data = protocol_alloc_for_session(session, allocation_size);
-  if (data == NULL)
+  if (data == NULL) {
+    protocol_release_memory_for_session(session, allocation_size);
     return NULL;
+  }
   if (!protocol_receive_n_data(session, data, (size_t)size)) {
     free(data);
+    protocol_release_memory_for_session(session, allocation_size);
     return NULL;
   }
-  session->total_allocated_bytes += allocation_size;
+  log_debug_message(LOG_DEBUG_PROTO, "Received %lld data", size);
-  log_message(LOG_LEVEL_DEBUG, "Received %lld data", size);
   Data* result = data_create(data, (size_t)size);
   if (!result) {
-    free(data);
+    protocol_release_memory_for_session(session, allocation_size);
-    session->total_allocated_bytes -= allocation_size;
+    return NULL;
   }
+  result->protocol_charge = allocation_size;
   return result;
 }
 
+Data* protocol_receive_data(ProtocolSession* session) {
+  return protocol_receive_data_limited(session, MAX_DATA_PAYLOAD_SIZE);
+}
+
 bool protocol_send_int(ProtocolSession* session, int data) {
   if (!protocol_send_n_data(session, &data, sizeof(int)))
     return false;
-  log_message(LOG_LEVEL_DEBUG, "Send Int: %d", data);
+  log_debug_message(LOG_DEBUG_PROTO, "Send Int: %d", data);
   return true;
 }
 
 bool protocol_receive_int(ProtocolSession* session, int* data) {
   if (!protocol_receive_n_data(session, data, sizeof(int)))
     return false;
-  log_message(LOG_LEVEL_DEBUG, "Received Int: %d", *data);
+  log_debug_message(LOG_DEBUG_PROTO, "Received Int: %d", *data);
   return true;
 }
 
 bool protocol_send_status(ProtocolSession* session, Status status) {
   if (!protocol_send_n_data(session, &status, sizeof(Status)))
     return false;
-  log_message(LOG_LEVEL_DEBUG, "Send Status: %s", status_to_string(status));
+  log_debug_message(LOG_DEBUG_PROTO, "Send Status: %s", status_to_string(status));
   return true;
 }
 
 bool protocol_receive_status(ProtocolSession* session, Status* status) {
   if (!protocol_receive_n_data(session, status, sizeof(Status)))
     return false;
-  log_message(LOG_LEVEL_DEBUG, "Received Status: %s", status_to_string(*status));
+  log_debug_message(LOG_DEBUG_PROTO, "Received Status: %s", status_to_string(*status));
   return true;
 }
 
 bool send_str(int fd, const char* data) {
-  (void)fd;
+  return protocol_send_str(legacy_session(-1, fd), data);
-  return protocol_send_str(legacy_session(), data);
 }
 char* receive_str(int fd) {
-  (void)fd;
+  return protocol_receive_str(legacy_session(fd, -1));
-  return protocol_receive_str(legacy_session());
 }
 bool send_data(int fd, const Data* data) {
-  (void)fd;
+  return protocol_send_data(legacy_session(-1, fd), data);
-  return protocol_send_data(legacy_session(), data);
 }
 Data* receive_data(int fd) {
-  (void)fd;
+  return protocol_receive_data_limited(legacy_session(fd, -1), MAX_DATA_PAYLOAD_SIZE);
-  return protocol_receive_data(legacy_session());
+}
+Data* receive_data_limited(int fd, unsigned long long maximum_size) {
+  return protocol_receive_data_limited(legacy_session(fd, -1), maximum_size);
 }
 bool send_int(int fd, int data) {
-  (void)fd;
+  return protocol_send_int(legacy_session(-1, fd), data);
-  return protocol_send_int(legacy_session(), data);
 }
 bool receive_int(int fd, int* data) {
-  (void)fd;
+  return protocol_receive_int(legacy_session(fd, -1), data);
-  return protocol_receive_int(legacy_session(), data);
 }
 bool send_status(int fd, Status status) {
-  (void)fd;
+  return protocol_send_status(legacy_session(-1, fd), status);
-  return protocol_send_status(legacy_session(), status);
 }
 bool receive_status(int fd, Status* status) {
-  (void)fd;
+  return protocol_receive_status(legacy_session(fd, -1), status);
-  return protocol_receive_status(legacy_session(), status);
 }

src/shared/protocol.h

@@ -4,18 +4,34 @@
 #include "data.h"
 #include <stdbool.h>
 #include <stddef.h>
+#include <stdatomic.h>
 
 /* Maximum allowed string size for receive_str (64 KB) */
 #define MAX_STRING_SIZE (64 * 1024)
 
-/* Maximum allowed data payload size for receive_data (100 MB) */
+/* Maximum uncompressed file payload accepted by the receiver's whole-file
-#define MAX_DATA_PAYLOAD_SIZE (100ULL * 1024 * 1024)
+ * paths.  A single whole file is charged against the per-connection memory
+ * reservation (MAX_CONNECTION_MEMORY) and against the server allocation
+ * ceiling (MAX_SERVER_ALLOC), so this mirrors those 256 MB bounds rather than
+ * the older 64 MB chunk-era cap.  Chunk-serialized payloads keep their own
+ * 64 MB cap (MAX_CHUNK_SIZE). */
+#define MAX_RECEIVE_WHOLE_FILE_SIZE (256ULL * 1024 * 1024)
+
+/* Maximum allowed data payload size for receive_data (whole-file bound) */
+#define MAX_DATA_PAYLOAD_SIZE MAX_RECEIVE_WHOLE_FILE_SIZE
 
 /* Maximum chunk size (64 MB) — prevents unbounded allocation from the wire */
 #define MAX_CHUNK_SIZE (64ULL * 1024 * 1024)
 #define MAX_MANIFEST_ENTRIES (1024 * 1024)
 /* Aggregate bytes retained by one received deletion manifest. */
 #define MAX_MANIFEST_BYTES (16ULL * 1024 * 1024)
+#define DEFAULT_MAX_ALLOC (1ULL * 1024 * 1024 * 1024)
+/* Server policy ceiling for a client-provided allocation limit. */
+#define MAX_SERVER_ALLOC (256ULL * 1024 * 1024)
+/* Bounded cumulative per-connection receive budget.  In-flight wire buffers,
+   decompression buffers and queued (not yet written) file payloads for a
+   connection must stay within this ceiling. */
+#define MAX_CONNECTION_MEMORY (256ULL * 1024 * 1024)
 
 typedef struct ssl_st SSL;
 
@@ -33,7 +49,9 @@ typedef struct ProtocolSession {
   long long bw_tokens;
   long long bw_last_refill_sec;
   long bw_last_refill_nsec;
-  unsigned long long total_allocated_bytes;
+  atomic_ullong total_allocated_bytes;
+  bool eight_bit_output;
+  unsigned long long max_alloc;
 } ProtocolSession;
 
 typedef int Status;
@@ -63,12 +81,18 @@ void protocol_session_bind(ProtocolSession* session);
 void protocol_session_unbind(void);
 void protocol_session_set_ssl(ProtocolSession* session, SSL* ssl);
 void protocol_session_set_bwlimit(ProtocolSession* session, unsigned long long bytes_per_sec);
+void protocol_session_set_max_alloc(ProtocolSession* session, unsigned long long max_alloc);
+void* protocol_alloc(size_t size);
+void* protocol_realloc(void* ptr, size_t size);
+void protocol_session_set_8_bit_output(ProtocolSession* session, bool enabled);
+void protocol_set_8_bit_output(bool enabled);
 bool protocol_send_n_data(ProtocolSession* session, const void* data, size_t data_size);
 bool protocol_receive_n_data(ProtocolSession* session, void* data, size_t data_size);
 bool protocol_send_str(ProtocolSession* session, const char* data);
 char* protocol_receive_str(ProtocolSession* session);
 bool protocol_send_data(ProtocolSession* session, const Data* data);
 Data* protocol_receive_data(ProtocolSession* session);
+Data* protocol_receive_data_limited(ProtocolSession* session, unsigned long long maximum_size);
 bool protocol_send_int(ProtocolSession* session, int data);
 bool protocol_receive_int(ProtocolSession* session, int* data);
 bool protocol_send_status(ProtocolSession* session, Status status);
@@ -80,6 +104,7 @@ bool send_str(int file_descriptor, const char* data);
 char* receive_str(int file_descriptor);
 bool send_data(int file_descriptor, const Data* data);
 Data* receive_data(int file_descriptor);
+Data* receive_data_limited(int file_descriptor, unsigned long long maximum_size);
 bool send_int(int file_descriptor, int data);
 bool receive_int(int file_descriptor, int* data);
 bool send_status(int file_descriptor, Status status);

src/shared/queue.c

@@ -1,3 +1,4 @@
+#include "log.h"
 #include <stdbool.h>
 #include <limits.h>
 #include <stdio.h>
@@ -13,7 +14,7 @@ Queue* queue_create(int capacity, void (*destroyer)(void* item)) {
 
   Queue* queue = (Queue*)malloc(sizeof(Queue));
   if (queue == NULL) {
-    perror("ERROR: Could not allocate memory for queue structure");
+    log_perror("ERROR: Could not allocate memory for queue structure");
     return NULL;
   }
 
@@ -72,7 +73,7 @@ static bool queue_double_capacity(Queue* queue) {
     new_capacity = 100;
   void** new_items = malloc(new_capacity * sizeof(void*));
   if (new_items == NULL) {
-    perror("ERROR: Could not allocate memory for doubling capacity of queue.");
+    log_perror("ERROR: Could not allocate memory for doubling capacity of queue.");
     return false;
   }
   for (int i = 0; i < queue->size; i++)
@@ -127,7 +128,7 @@ bool queue_enqueue_multithreaded_cancel(Queue* queue, void* item, mtx_t* mutex,
 
 void* queue_dequeue(Queue* queue) {
   if (queue == NULL || queue_is_empty(queue)) {
-    perror("ERROR: Could not dequeue from null or empty queue.");
+    log_perror("ERROR: Could not dequeue from null or empty queue.");
     return NULL;
   }
 

src/shared/transport_ssh.c

@@ -1,7 +1,9 @@
+#include "log.h"
 #include "transport_ssh.h"
 #include "utils.h"
 #include <fcntl.h>
 #include <stdio.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/socket.h>
@@ -14,6 +16,12 @@ typedef struct {
   char* remote_path;
 } RemoteDest;
 
+static void ssh_child_setup_failed(int status_fd) {
+  ssize_t wret = write(status_fd, "x", 1);
+  (void)wret;
+  _exit(1);
+}
+
 static void remote_dest_destroy(RemoteDest* r) {
   free(r->user);
   free(r->host);
@@ -67,16 +75,63 @@ static int parse_remote_dest(const char* dest, RemoteDest* r) {
   return 0;
 }
 
-Client* client_connect_ssh(const char* destination, int port, const char* server_path) {
+char* ssh_build_remote_command(const char* server_path, bool old_args) {
+  const char* path = server_path ? server_path : "fastsync-server";
+  const char* suffix = " --stdio";
+  size_t path_len = strlen(path);
+  size_t suffix_len = strlen(suffix);
+
+  if (old_args) {
+    if (path_len > SIZE_MAX - suffix_len - 1)
+      return NULL;
+    char* command = malloc(path_len + suffix_len + 1);
+    if (!command)
+      return NULL;
+    memcpy(command, path, path_len);
+    memcpy(command + path_len, suffix, suffix_len + 1);
+    return command;
+  }
+
+  /* Quote the executable as one remote-shell word. This is the default safety boundary. */
+  size_t quote_count = 0;
+  for (const char* p = path; *p; p++)
+    if (*p == '\'')
+      quote_count++;
+  if (path_len > SIZE_MAX - suffix_len - 4 ||
+      quote_count > (SIZE_MAX - path_len - suffix_len - 4) / 4)
+    return NULL;
+  size_t command_len = path_len + quote_count * 4 + suffix_len + 4;
+  char* command = malloc(command_len + 1);
+  if (!command)
+    return NULL;
+  char* out = command;
+  *out++ = '\'';
+  for (const char* p = path; *p; p++) {
+    if (*p == '\'') {
+      memcpy(out, "'\\''", 4);
+      out += 4;
+    } else {
+      *out++ = *p;
+    }
+  }
+  *out++ = '\'';
+  memcpy(out, suffix, suffix_len + 1);
+  return command;
+}
+
+Client* client_connect_ssh(const char* destination, int port, const char* server_path,
+                           bool old_args) {
   RemoteDest r;
   if (parse_remote_dest(destination, &r) != 0) {
-    fprintf(stderr, "Invalid remote destination: %s\n", destination);
+    char* escaped = output_escape(destination, false);
+    fprintf(stderr, "Invalid remote destination: %s\n", escaped ? escaped : "<allocation failed>");
+    free(escaped);
     return NULL;
   }
 
   int sv[2];
   if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0) {
-    perror("socketpair failed");
+    log_perror("socketpair failed");
     remote_dest_destroy(&r);
     return NULL;
   }
@@ -89,7 +144,7 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
 
   int exec_pipe[2];
   if (pipe(exec_pipe) < 0) {
-    perror("pipe failed");
+    log_perror("pipe failed");
     close(sv[0]);
     close(sv[1]);
     remote_dest_destroy(&r);
@@ -98,7 +153,7 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
 
   pid_t pid = fork();
   if (pid < 0) {
-    perror("fork failed");
+    log_perror("fork failed");
     close(sv[0]);
     close(sv[1]);
     close(exec_pipe[0]);
@@ -110,11 +165,12 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
   if (pid == 0) {
     close(sv[0]);
     close(exec_pipe[0]);
-    fcntl(exec_pipe[1], F_SETFD, FD_CLOEXEC);
+    if (fcntl(exec_pipe[1], F_SETFD, FD_CLOEXEC) < 0)
-    if (sv[1] != STDIN_FILENO)
+      ssh_child_setup_failed(exec_pipe[1]);
-      dup2(sv[1], STDIN_FILENO);
+    if (sv[1] != STDIN_FILENO && dup2(sv[1], STDIN_FILENO) < 0)
-    if (sv[1] != STDOUT_FILENO)
+      ssh_child_setup_failed(exec_pipe[1]);
-      dup2(sv[1], STDOUT_FILENO);
+    if (sv[1] != STDOUT_FILENO && dup2(sv[1], STDOUT_FILENO) < 0)
+      ssh_child_setup_failed(exec_pipe[1]);
     if (sv[1] > 1)
       close(sv[1]);
 
@@ -125,7 +181,7 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
       ssh_user_len = strlen(r.host) + 1;
     char* ssh_user = malloc(ssh_user_len);
     if (!ssh_user)
-      _exit(1);
+      ssh_child_setup_failed(exec_pipe[1]);
     if (r.user && r.user[0] != '\0')
       snprintf(ssh_user, ssh_user_len, "%s@%s", r.user, r.host);
     else
@@ -134,6 +190,9 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
     char* ssh_argv[16];
     int ac = 0;
     char port_str[16];
+    char* remote_command = ssh_build_remote_command(server_path, old_args);
+    if (!remote_command)
+      ssh_child_setup_failed(exec_pipe[1]);
     ssh_argv[ac++] = "ssh";
     ssh_argv[ac++] = "-o";
     ssh_argv[ac++] = "Compression=no";
@@ -147,14 +206,11 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
       ssh_argv[ac++] = port_str;
     }
     ssh_argv[ac++] = ssh_user;
-    ssh_argv[ac++] = (char*)(server_path ? server_path : "fastsync-server");
+    ssh_argv[ac++] = remote_command;
-    ssh_argv[ac++] = "--stdio";
     ssh_argv[ac] = NULL;
     execvp("ssh", ssh_argv);
-    perror("exec of ssh failed");
+    log_perror("exec of ssh failed");
-    ssize_t wret = write(exec_pipe[1], "x", 1);
+    ssh_child_setup_failed(exec_pipe[1]);
-    (void)wret;
-    _exit(1);
   }
 
   close(sv[1]);
@@ -164,12 +220,15 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
   ssize_t n = read(exec_pipe[0], &exec_status, 1);
   close(exec_pipe[0]);
 
-  if (n > 0) {
+  if (n != 0) {
     close(sv[0]);
     waitpid(pid, NULL, 0);
     remote_dest_destroy(&r);
+    const char* path = server_path ? server_path : "fastsync-server";
+    char* escaped = output_escape(path, false);
     fprintf(stderr, "Error: could not launch '%s --stdio' on remote\n",
-            server_path ? server_path : "fastsync-server");
+            escaped ? escaped : "<allocation failed>");
+    free(escaped);
     return NULL;
   }
 

src/shared/transport_ssh.h

@@ -3,6 +3,8 @@
 
 #include "transport_tcp.h"
 
-Client* client_connect_ssh(const char* destination, int port, const char* server_path);
+Client* client_connect_ssh(const char* destination, int port, const char* server_path,
+                           bool old_args);
+char* ssh_build_remote_command(const char* server_path, bool old_args);
 
 #endif

src/shared/transport_tcp.c

@@ -1,6 +1,7 @@
 #include "transport_tcp.h"
 #include "log.h"
 #include "protocol.h"
+#include "utils.h"
 #include <arpa/inet.h>
 #include <errno.h>
 #include <netdb.h>
@@ -30,20 +31,20 @@ static void sigchld_handler(int sig) {
 Server* server_create(int port) {
   Server* server = (Server*)malloc(sizeof(Server));
   if (server == NULL) {
-    perror("Could not allocate space for Server");
+    log_perror("Could not allocate space for Server");
     return NULL;
   }
 
   int file_descriptor = socket(AF_INET, SOCK_STREAM, 0);
   if (file_descriptor < 0) {
-    perror("Could not create Socket!");
+    log_perror("Could not create Socket!");
     free(server);
     return NULL;
   }
   server->file_descriptor = file_descriptor;
   int opt = 1;
   if (setsockopt(server->file_descriptor, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt))) {
-    perror("Error setting a socket option!");
+    log_perror("Error setting a socket option!");
     close(server->file_descriptor);
     free(server);
     return NULL;
@@ -59,7 +60,7 @@ Server* server_create(int port) {
 
   if (bind(server->file_descriptor, (struct sockaddr*)&server->address, server->address_length) <
       0) {
-    perror("Could not bind server");
+    log_perror("Could not bind server");
     close(server->file_descriptor);
     free(server);
     return NULL;
@@ -83,7 +84,7 @@ void server_delete(Server** server) {
 static void accept_loop(Server* server, void (*child_fn)(int, void*), void* child_ctx,
                         const char* log_fmt) {
   if (listen(server->file_descriptor, SOMAXCONN) < 0) {
-    perror("Could not listen on port!");
+    log_perror("Could not listen on port!");
     return;
   }
   signal(SIGCHLD, sigchld_handler);
@@ -92,7 +93,7 @@ static void accept_loop(Server* server, void (*child_fn)(int, void*), void* chil
     socklen_t client_len = sizeof(client_addr);
     int fd = accept(server->file_descriptor, (struct sockaddr*)&client_addr, &client_len);
     if (fd < 0) {
-      perror("Could not accept the connection");
+      log_perror("Could not accept the connection");
       continue;
     }
     tcp_apply_socket_timeout(fd);
@@ -151,6 +152,10 @@ int tcp_get_contimeout_sec(void) {
   return g_contimeout_sec;
 }
 
+int tcp_get_timeout_sec(void) {
+  return g_timeout_sec;
+}
+
 static void tcp_apply_socket_timeout(int fd) {
   struct timeval tv;
   tv.tv_sec = g_timeout_sec;
@@ -186,7 +191,10 @@ bool tcp_connect_socket(Client* client, char* host, int port) {
 
   int err = getaddrinfo(host, port_str, &hints, &result);
   if (err != 0 || result == NULL) {
-    fprintf(stderr, "Could not resolve host: %s (%s)\n", host, gai_strerror(err));
+    char* escaped_host = output_escape(host, false);
+    fprintf(stderr, "Could not resolve host: %s (%s)\n",
+            escaped_host ? escaped_host : "<allocation failed>", gai_strerror(err));
+    free(escaped_host);
     return false;
   }
 
@@ -218,7 +226,7 @@ bool tcp_connect_socket(Client* client, char* host, int port) {
   freeaddrinfo(result);
 
   if (!connected) {
-    perror("Could not connect to Server!");
+    log_perror("Could not connect to Server!");
     return false;
   }
 

src/shared/transport_tcp.h

@@ -35,5 +35,6 @@ void client_disconnect(Client* client);
 void client_delete(Client* client);
 void tcp_set_timeouts(int timeout_sec, int contimeout_sec);
 int tcp_get_contimeout_sec(void);
+int tcp_get_timeout_sec(void);
 
 #endif

src/shared/transport_tls.c

@@ -2,6 +2,7 @@
 #include "log.h"
 #include "protocol.h"
 #include "transport_tcp.h"
+#include "utils.h"
 #include <arpa/inet.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
@@ -9,6 +10,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <time.h>
 #include <unistd.h>
 
 bool tls_global_init(void) {
@@ -31,6 +36,10 @@ static void log_ssl_errors(void) {
 
 static SSL_CTX* create_ssl_ctx(bool is_server, const char* cert, const char* key,
                                const char* ca_path) {
+  if (!is_server && !ca_path) {
+    log_message(LOG_LEVEL_ERROR, "TLS clients require a CA certificate path");
+    return NULL;
+  }
   const SSL_METHOD* method = is_server ? TLS_server_method() : TLS_client_method();
   SSL_CTX* ctx = SSL_CTX_new(method);
   if (!ctx) {
@@ -39,17 +48,37 @@ static SSL_CTX* create_ssl_ctx(bool is_server, const char* cert, const char* key
     return NULL;
   }
 
-  SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
+  if (SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION) != 1) {
+    SSL_CTX_free(ctx);
+    return NULL;
+  }
+  if (SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL:!eNULL:!MD5:!RC4:!3DES") != 1) {
+    SSL_CTX_free(ctx);
+    return NULL;
+  }
 
   if (cert && key) {
+    struct stat key_stat;
+    if (stat(key, &key_stat) != 0 || !S_ISREG(key_stat.st_mode) || key_stat.st_uid != geteuid() ||
+        (key_stat.st_mode & (S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH))) {
+      log_message(LOG_LEVEL_ERROR, "TLS private key must be owned by the current user and private");
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
     if (SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM) <= 0) {
-      log_message(LOG_LEVEL_ERROR, "Failed to load certificate: %s", cert);
+      char* escaped = output_escape(cert, false);
+      log_message(LOG_LEVEL_ERROR, "Failed to load certificate: %s",
+                  escaped ? escaped : "<allocation failed>");
+      free(escaped);
       log_ssl_errors();
       SSL_CTX_free(ctx);
       return NULL;
     }
     if (SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM) <= 0) {
-      log_message(LOG_LEVEL_ERROR, "Failed to load private key: %s", key);
+      char* escaped = output_escape(key, false);
+      log_message(LOG_LEVEL_ERROR, "Failed to load private key: %s",
+                  escaped ? escaped : "<allocation failed>");
+      free(escaped);
       log_ssl_errors();
       SSL_CTX_free(ctx);
       return NULL;
@@ -63,7 +92,10 @@ static SSL_CTX* create_ssl_ctx(bool is_server, const char* cert, const char* key
 
   if (ca_path) {
     if (!SSL_CTX_load_verify_locations(ctx, ca_path, NULL)) {
-      log_message(LOG_LEVEL_ERROR, "Failed to load CA: %s", ca_path);
+      char* escaped = output_escape(ca_path, false);
+      log_message(LOG_LEVEL_ERROR, "Failed to load CA: %s",
+                  escaped ? escaped : "<allocation failed>");
+      free(escaped);
       log_ssl_errors();
       SSL_CTX_free(ctx);
       return NULL;
@@ -83,15 +115,22 @@ static SSL* wrap_fd_with_ssl(int fd, SSL_CTX* ctx, bool is_server, const char* h
     log_message(LOG_LEVEL_ERROR, "Failed to create SSL object");
     return NULL;
   }
-  SSL_set_fd(ssl, fd);
+  if (SSL_set_fd(ssl, fd) != 1) {
+    SSL_free(ssl);
+    return NULL;
+  }
 
   // Enable hostname verification for client connections when a hostname is provided.
   // Must be done before SSL_connect to take effect during the handshake.
   if (!is_server && hostname) {
-    SSL_set1_host(ssl, hostname);
+    if (SSL_set1_host(ssl, hostname) != 1) {
+      SSL_free(ssl);
+      return NULL;
+    }
   }
 
   // Retry SSL_accept/SSL_connect on WANT_READ/WANT_WRITE (non-blocking handshake)
+  time_t deadline = time(NULL) + (is_server ? tcp_get_timeout_sec() : tcp_get_contimeout_sec());
   int ret;
   do {
     if (is_server)
@@ -101,7 +140,8 @@ static SSL* wrap_fd_with_ssl(int fd, SSL_CTX* ctx, bool is_server, const char* h
 
     if (ret <= 0) {
       int ssl_err = SSL_get_error(ssl, ret);
-      if (ssl_err == SSL_ERROR_WANT_READ || ssl_err == SSL_ERROR_WANT_WRITE)
+      if ((ssl_err == SSL_ERROR_WANT_READ || ssl_err == SSL_ERROR_WANT_WRITE) &&
+          time(NULL) < deadline)
         continue;
       log_message(LOG_LEVEL_ERROR, "SSL %s failed", is_server ? "accept" : "connect");
       log_ssl_errors();
@@ -129,8 +169,10 @@ struct tls_child_ctx {
 static void tls_child_fn(int fd, void* arg) {
   struct tls_child_ctx* ctx = (struct tls_child_ctx*)arg;
   SSL* ssl = wrap_fd_with_ssl(fd, ctx->ssl_ctx, true, NULL);
-  if (!ssl)
+  if (!ssl) {
+    io_set_ssl(NULL);
     return;
+  }
   io_set_ssl(ssl);
   ctx->handler(fd);
   SSL_shutdown(ssl);
@@ -146,12 +188,19 @@ bool server_listen_tls(Server* server, void (*handler)(int file_descriptor)) {
 
 bool client_connect_tls(Client* client, char* host, int port, const char* cert_path,
                         const char* key_path, const char* ca_path) {
-  if (!tcp_connect_socket(client, host, port))
+  if (!tcp_connect_socket(client, host, port)) {
+    if (client->file_descriptor >= 0)
+      close(client->file_descriptor);
+    client->file_descriptor = -1;
     return false;
+  }
 
   SSL_CTX* ctx = create_ssl_ctx(false, cert_path, key_path, ca_path);
-  if (!ctx)
+  if (!ctx) {
+    close(client->file_descriptor);
+    client->file_descriptor = -1;
     return false;
+  }
   client->ssl_ctx = ctx;
 
   // Pass the server hostname for TLS hostname verification (SSL_set1_host
@@ -161,6 +210,8 @@ bool client_connect_tls(Client* client, char* host, int port, const char* cert_p
   if (!ssl) {
     SSL_CTX_free(ctx);
     client->ssl_ctx = NULL;
+    close(client->file_descriptor);
+    client->file_descriptor = -1;
     return false;
   }
 

src/shared/utils.c

@@ -1,69 +1,85 @@
 #include "utils.h"
 #include "array_list.h"
-#include "libgen.h"
+#include "log.h"
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <stdint.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
 static int authorized_root_fd = -1;
+static char* authorized_root_path;
+
+bool utils_set_authorized_root(int fd, const char* canonical_path) {
+  char* path_copy = canonical_path ? str_dup(canonical_path) : NULL;
+  if (canonical_path && !path_copy) {
+    authorized_root_fd = -1;
+    free(authorized_root_path);
+    authorized_root_path = NULL;
+    return false;
+  }
+  authorized_root_fd = fd;
+  free(authorized_root_path);
+  authorized_root_path = path_copy;
+  return true;
+}
 
 void utils_set_authorized_root_fd(int fd) {
-  authorized_root_fd = fd;
+  (void)utils_set_authorized_root(fd, NULL);
 }
 
-bool mkdir_r(const char* path) {
+static bool path_is_within_root(const char* root, const char* path) {
-  size_t path_len = strlen(path);
+  size_t root_len = strlen(root);
-  char* path_duplicate = malloc(path_len + 1);
+  return strncmp(root, path, root_len) == 0 && (path[root_len] == '\0' || path[root_len] == '/');
-  if (!path_duplicate)
-    return false;
-  memcpy(path_duplicate, path, path_len + 1);
-  size_t capacity = path_len + 2;
-  char* path_current = (char*)malloc(capacity * sizeof(char));
-  if (!path_current) {
-    free(path_duplicate);
-    return false;
 }
-  char* path_current_position = path_current;
+
-  if (path[0] == '/') {
+static int open_authorized_destination(const char* dest_root) {
-    path_current[0] = '/';
+  if (authorized_root_fd < 0 || !authorized_root_path || !dest_root ||
-    path_current[1] = '\0';
+      !path_is_within_root(authorized_root_path, dest_root))
-    path_current_position += 1;
+    return -1;
-  } else {
+
-    path_current[0] = '\0';
+  int dirfd = dup(authorized_root_fd);
+  if (dirfd < 0)
+    return -1;
+
+  const char* relative_path = dest_root + strlen(authorized_root_path);
+  while (*relative_path == '/')
+    relative_path++;
+  char* relative = str_dup(*relative_path ? relative_path : ".");
+  if (!relative) {
+    close(dirfd);
+    return -1;
   }
-  const char* delimiter = "/";
+
-  char* saveptr;
+  char* saveptr = NULL;
-  const char* part = strtok_r(path_duplicate, delimiter, &saveptr);
+  char* component = strtok_r(relative, "/", &saveptr);
-  bool ok = true;
+  while (component) {
-  while (part != NULL) {
+    if (strcmp(component, "..") == 0) {
-    size_t part_len = strlen(part);
+      free(relative);
-    if ((size_t)(path_current_position - path_current) + part_len + 2 > capacity) {
+      close(dirfd);
-      ok = false;
+      return -1;
-      break;
     }
-    memcpy(path_current_position, part, part_len);
+    if (strcmp(component, ".") == 0) {
-    path_current_position += part_len;
+      component = strtok_r(NULL, "/", &saveptr);
-    path_current_position[0] = '/';
+      continue;
-    path_current_position[1] = '\0';
-    path_current_position++;
-    struct stat st;
-    if (stat(path_current, &st) != 0) {
-      if (mkdir(path_current, 0755) != 0) {
-        perror("Could not create directory");
-        ok = false;
-        break;
     }
+    int next = openat(dirfd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+    if (next < 0) {
+      free(relative);
+      close(dirfd);
+      return -1;
     }
-    part = strtok_r(NULL, delimiter, &saveptr);
+    close(dirfd);
+    dirfd = next;
+    component = strtok_r(NULL, "/", &saveptr);
   }
-  free(path_duplicate);
+
-  free(path_current);
+  free(relative);
-  return ok;
+  return dirfd;
 }
 
 char* str_dup(const char* string) {
@@ -77,6 +93,32 @@ char* str_dup(const char* string) {
   return new_string;
 }
 
+char* output_escape(const char* string, bool eight_bit_output) {
+  if (!string)
+    return NULL;
+  size_t length = strlen(string);
+  if (length > (SIZE_MAX - 1) / 5)
+    return NULL;
+  char* escaped = malloc(length * 5 + 1);
+  if (!escaped)
+    return NULL;
+  size_t out = 0;
+  for (size_t i = 0; i < length; i++) {
+    unsigned char byte = (unsigned char)string[i];
+    if ((byte >= 32 && byte <= 126) || (eight_bit_output && byte >= 128)) {
+      escaped[out++] = (char)byte;
+    } else {
+      escaped[out++] = '\\';
+      escaped[out++] = '#';
+      escaped[out++] = (char)('0' + ((byte >> 6) & 7));
+      escaped[out++] = (char)('0' + ((byte >> 3) & 7));
+      escaped[out++] = (char)('0' + (byte & 7));
+    }
+  }
+  escaped[out] = '\0';
+  return escaped;
+}
+
 /* Match a glob pattern against a string. Supported wildcards:
  *   ?      matches any single character except '/'.
  *   *      matches any sequence of characters within one path component (no '/').
@@ -132,6 +174,25 @@ bool glob_match(const char* pattern, const char* str) {
   return *str == '\0';
 }
 
+bool format_human_bytes(unsigned long long bytes, char* buffer, size_t buffer_size) {
+  static const char* const units[] = {"B", "KB", "MB", "GB", "TB", "PB", "EB"};
+  double value = (double)bytes;
+  size_t unit = 0;
+  int written;
+
+  if (!buffer || buffer_size == 0)
+    return false;
+  while (value >= 1024.0 && unit < sizeof(units) / sizeof(units[0]) - 1) {
+    value /= 1024.0;
+    unit++;
+  }
+  if (unit == 0)
+    written = snprintf(buffer, buffer_size, "%llu %s", bytes, units[unit]);
+  else
+    written = snprintf(buffer, buffer_size, "%.1f %s", value, units[unit]);
+  return written >= 0 && (size_t)written < buffer_size;
+}
+
 static bool is_dir_in_manifest(const char* rel_path, ArrayList* manifest) {
   size_t len = strlen(rel_path);
   for (int i = 0; i < manifest->size; i++) {
@@ -143,7 +204,8 @@ static bool is_dir_in_manifest(const char* rel_path, ArrayList* manifest) {
   return false;
 }
 
-static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifest) {
+static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifest,
+                             size_t max_delete, size_t* deleted_count) {
   int scanfd = dup(dirfd);
   if (scanfd < 0)
     return false;
@@ -152,15 +214,20 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifes
     close(scanfd);
     return false;
   }
-  bool all_removed = true;
   bool operation_ok = true;
   const struct dirent* entry;
   while ((entry = readdir(dir)) != NULL) {
     if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
       continue;
     char* child_rel = path_cat((char*)rel_path, entry->d_name);
+    if (!child_rel) {
+      operation_ok = false;
+      continue;
+    }
     struct stat st;
     if (fstatat(dirfd, entry->d_name, &st, AT_SYMLINK_NOFOLLOW) != 0) {
+      if (errno != ENOENT)
+        operation_ok = false;
       free(child_rel);
       continue;
     }
@@ -173,14 +240,24 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifes
       int childfd = openat(dirfd, entry->d_name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
       bool child_removed = false;
       if (childfd >= 0) {
-        child_removed = delete_extras_fd(childfd, child_rel, manifest);
+        child_removed = delete_extras_fd(childfd, child_rel, manifest, max_delete, deleted_count);
-        close(childfd);
+        if (!child_removed)
-      }
-      if (child_removed && !is_dir_in_manifest(child_rel, manifest) &&
-          unlinkat(dirfd, entry->d_name, AT_REMOVEDIR) != 0 && errno != ENOENT) {
           operation_ok = false;
-      } else if (!child_removed) {
+        close(childfd);
-        all_removed = false;
+      } else if (errno != ENOENT) {
+        operation_ok = false;
+      }
+      if (child_removed && !is_dir_in_manifest(child_rel, manifest)) {
+        if (*deleted_count >= max_delete) {
+          operation_ok = false;
+        } else {
+          if (unlinkat(dirfd, entry->d_name, AT_REMOVEDIR) != 0) {
+            if (errno != ENOENT)
+              operation_ok = false;
+          } else {
+            (*deleted_count)++;
+          }
+        }
       }
     } else {
       // Check if relative path is in manifest
@@ -192,38 +269,61 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifes
         }
       }
       if (!found) {
-        if (unlinkat(dirfd, entry->d_name, 0) != 0 && errno != ENOENT)
+        if (*deleted_count >= max_delete) {
+          operation_ok = false;
+          free(child_rel);
+          continue;
+        }
+        if (unlinkat(dirfd, entry->d_name, 0) != 0) {
+          if (errno != ENOENT)
             operation_ok = false;
-        fprintf(stderr, "  Deleted: %s\n", child_rel);
         } else {
-        all_removed = false;
+          (*deleted_count)++;
+        }
+        char* escaped_path = output_escape(child_rel, log_get_8_bit_output());
+        fprintf(stderr, "  Deleted: %s\n", escaped_path ? escaped_path : "<allocation failed>");
+        free(escaped_path);
       }
     }
     free(child_rel);
   }
   closedir(dir);
-  (void)all_removed;
   return operation_ok;
 }
 
-bool delete_extras(const char* dest_root, ArrayList* manifest) {
+bool delete_extras_limited(const char* dest_root, ArrayList* manifest, size_t max_delete) {
-  int rootfd = authorized_root_fd >= 0
+  if (!manifest)
-                   ? dup(authorized_root_fd)
+    return false;
-                   : open(dest_root, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+  int rootfd;
+  if (authorized_root_fd >= 0) {
+    if (authorized_root_path)
+      rootfd = open_authorized_destination(dest_root);
+    else if (dest_root == NULL)
+      rootfd = dup(authorized_root_fd);
+    else
+      rootfd = -1;
+  } else {
+    rootfd = open(dest_root, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+  }
   if (rootfd < 0)
     return false;
-  bool ok = delete_extras_fd(rootfd, "", manifest);
+  size_t deleted_count = 0;
+  bool ok = delete_extras_fd(rootfd, "", manifest, max_delete, &deleted_count);
   if (close(rootfd) != 0)
     ok = false;
   return ok;
 }
 
+bool delete_extras(const char* dest_root, ArrayList* manifest) {
+  return delete_extras_limited(dest_root, manifest, SIZE_MAX);
+}
+
 bool has_path_traversal(const char* path) {
   if (!path)
-    return false;
+    return true;
   char* dup = str_dup(path);
   if (!dup)
-    return false;
+    return true;
   char* saveptr;
   const char* part = strtok_r(dup, "/", &saveptr);
   while (part) {
@@ -255,6 +355,8 @@ char* path_cat(const char* path1, const char* path2) {
     offset = 1;
     path2_len -= 1;
   }
+  if (path1_len > SIZE_MAX - path2_len - 2)
+    return NULL;
   char* new_path = malloc(path1_len + path2_len + 2);
   if (new_path == NULL)
     return NULL;

src/shared/utils.h

@@ -2,15 +2,21 @@
 #define UTILS_H
 
 #include "array_list.h"
+#include <stddef.h>
 #include <stdbool.h>
 
-bool mkdir_r(const char* path);
 char* str_dup(const char* string);
+char* output_escape(const char* string, bool eight_bit_output);
 char* path_cat(const char* path1, const char* path2);
 bool glob_match(const char* pattern, const char* str);
 bool delete_extras(const char* dest_root, ArrayList* manifest);
+bool delete_extras_limited(const char* dest_root, ArrayList* manifest, size_t max_delete);
+bool utils_set_authorized_root(int fd, const char* canonical_path);
+/* The fd-only compatibility form is fail-closed for path-based operations;
+ * callers should use utils_set_authorized_root with the canonical identity. */
 void utils_set_authorized_root_fd(int fd);
 bool has_path_traversal(const char* path);
 bool utils_valid_batch_path(const char* path);
+bool format_human_bytes(unsigned long long bytes, char* buffer, size_t buffer_size);
 
 #endif

tests/integration/common.py

@@ -25,7 +25,9 @@ class ServerManager:
     def start(self, extra_args=None):
         self.stop()
         self._port = _find_free_port()
-        cmd = SERVER_CMD + ["-p", str(self._port)]
+        # Plain TCP is intentionally explicit in the server; integration tests
+        # exercise that opt-in mode rather than relying on the secure default.
+        cmd = SERVER_CMD + ["-p", str(self._port), "--allow-unauthenticated"]
         if extra_args:
             cmd += extra_args
         self._proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

tests/integration/test_features.py

@@ -1,4 +1,5 @@
 """Feature tests: incremental sync, bandwidth limiting, dry run, metadata, filters."""
+import filecmp
 import os
 import shutil
 import sys
@@ -26,6 +27,12 @@ def setup_test_data():
 
 
 class TestDryRun:
+    def test_human_readable_dry_run(self):
+        result, dur = run_client(SOURCE_DIR, DEST_DIR, flags=["-h", "--dry-run"])
+        assert result.returncode == 0, f"Exit {result.returncode}: {result.stderr[:100]}"
+        assert "Total:" in result.stdout
+        assert "KB" in result.stdout
+
     def test_dry_run(self):
         clean_dir(DEST_DIR)
         result, dur = run_client(
@@ -35,6 +42,118 @@ class TestDryRun:
         assert result.returncode == 0, f"Exit {result.returncode}: {result.stderr[:100]}"
         assert "Dry run:" in result.stdout, f"No dry run output: {result.stdout[:200]}"
 
+    def test_quiet_suppresses_dry_run_output(self):
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-q", "-n", "--progress", "--stats"],
+        )
+        assert result.returncode == 0, f"Exit {result.returncode}: {result.stderr[:100]}"
+        assert result.stdout == ""
+        assert result.stderr == ""
+
+    def test_quiet_preserves_errors(self):
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--quiet", "--server-port", "1"],
+        )
+        assert result.returncode != 0
+        assert result.stderr != ""
+
+    @pytest.mark.parametrize("flags", [["-q", "-v"], ["-v", "-q"]])
+    def test_quiet_successful_transfer_and_verbose_order(self, shared_server, flags):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=flags,
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Exit {result.returncode}: {result.stderr[:100]}"
+        assert result.stdout == ""
+        assert result.stderr == ""
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+
+class TestRemoveSourceFiles:
+    def test_removes_only_transferred_regular_files(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "remove_source")
+        dest = os.path.join(TEST_DATA_DIR, "remove_dest")
+        clean_dir(source)
+        clean_dir(dest)
+        with open(os.path.join(source, "one.txt"), "wb") as f:
+            f.write(b"one")
+        with open(os.path.join(source, "two.txt"), "wb") as f:
+            f.write(b"two")
+        os.makedirs(os.path.join(source, "directory"))
+        os.symlink("one.txt", os.path.join(source, "link.txt"))
+
+        result, _ = run_client(source, dest, flags=["--remove-source-files", "-m"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"Remove-source sync failed: {result.stderr[:200]}"
+        assert not os.path.exists(os.path.join(source, "one.txt"))
+        assert not os.path.exists(os.path.join(source, "two.txt"))
+        assert os.path.isdir(os.path.join(source, "directory"))
+        assert os.path.islink(os.path.join(source, "link.txt"))
+
+    def test_single_threaded_removes_transferred_file(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "remove_single_source")
+        dest = os.path.join(TEST_DATA_DIR, "remove_single_dest")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "file.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"single threaded")
+
+        result, _ = run_client(source, dest, flags=["--remove-source-files"],
+                               port=shared_server.port)
+        assert result.returncode == 0
+        assert not os.path.exists(source_file)
+
+    def test_dry_run_preserves_source_files(self):
+        source = os.path.join(TEST_DATA_DIR, "remove_dry_source")
+        dest = os.path.join(TEST_DATA_DIR, "remove_dry_dest")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "file.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"keep")
+
+        result, _ = run_client(source, dest, flags=["--remove-source-files", "--dry-run"])
+        assert result.returncode == 0
+        assert os.path.isfile(source_file)
+
+    def test_failed_connection_preserves_source_files(self):
+        source = os.path.join(TEST_DATA_DIR, "remove_failed_source")
+        dest = os.path.join(TEST_DATA_DIR, "remove_failed_dest")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "file.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"keep after failure")
+
+        result, _ = run_client(source, dest, flags=["--remove-source-files"], port=1)
+        assert result.returncode != 0
+        assert os.path.isfile(source_file)
+
+    def test_incremental_skip_preserves_source_file(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "remove_skipped_source")
+        dest = os.path.join(TEST_DATA_DIR, "remove_skipped_dest")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "file.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"keep after skip")
+
+        result, _ = run_client(source, dest, port=shared_server.port)
+        assert result.returncode == 0
+        result, _ = run_client(source, dest,
+                               flags=["--remove-source-files", "--incremental"],
+                               port=shared_server.port)
+        assert result.returncode == 0
+        assert os.path.isfile(source_file)
+
 
 class TestArchiveMode:
     def test_archive_mode(self, shared_server):
@@ -51,6 +170,136 @@ class TestArchiveMode:
         assert not missing, f"Missing: {missing}"
         assert not mismatches, f"Mismatch: {mismatches}"
 
+    def test_archive_implied_options_can_be_negated(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--archive", "--no-compress", "--no-m", "--no-preserve"],
+            port=shared_server.port,
+        )
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+
+class TestExecutability:
+    def test_preserves_only_executable_bits(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "executability_source")
+        dest = os.path.join(TEST_DATA_DIR, "executability_dest")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "tool.sh")
+        with open(source_file, "w") as f:
+            f.write("#!/bin/sh\necho test\n")
+        os.chmod(source_file, 0o751)
+
+        result, _ = run_client(source, dest, flags=["-E"], port=shared_server.port)
+        assert result.returncode == 0, f"Executability sync failed: {result.stderr[:200]}"
+        received_file = os.path.join(get_dest_received_dir(dest, source), "tool.sh")
+        received_mode = os.stat(received_file).st_mode
+        assert received_mode & 0o111 == 0o111
+        assert received_mode & 0o600 == 0o600
+        assert received_mode & 0o077 == 0o011
+
+
+class TestChmod:
+    def test_chmod_applies_to_transferred_files(self, shared_server):
+        clean_dir(DEST_DIR)
+        source_file = os.path.join(SOURCE_DIR, "small.txt")
+        os.chmod(source_file, 0o777)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--chmod=u=rw,go=r"],
+            port=shared_server.port,
+        )
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert (os.stat(os.path.join(received, "small.txt")).st_mode & 0o777) == 0o644
+
+
+class TestCompressionChoice:
+    def test_zstd_choice_compresses(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["--zc", "zstd"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"zstd sync failed: {(result.stderr or result.stdout)[:200]}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+    def test_none_choice_disables_compression(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-z", "--compress-choice", "none"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"none sync failed: {(result.stderr or result.stdout)[:200]}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+
+class TestSkipCompress:
+    def test_skip_compress_case_insensitive(self, shared_server):
+        clean_dir(DEST_DIR)
+        with open(os.path.join(SOURCE_DIR, "skip-case.TXT"), "wb") as f:
+            f.write((b"skip compression case test\n" * 100))
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-c", "--skip-compress=.txt"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Skip-compress sync failed: {(result.stderr or result.stdout)[:200]}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        with open(os.path.join(received, "skip-case.TXT"), "rb") as f:
+            assert f.read() == b"skip compression case test\n" * 100
+
+    def test_skip_compress_empty_list(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-c", "--skip-compress="],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Empty skip-compress sync failed: {(result.stderr or result.stdout)[:200]}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+    def test_skip_compress_incremental_full_fallback(self, shared_server):
+        clean_dir(DEST_DIR)
+        path = os.path.join(SOURCE_DIR, "incremental-skip.TXT")
+        with open(path, "wb") as f:
+            f.write(b"original skipped content\n")
+        flags = ["-c", "-M", "--skip-compress=.txt"]
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, f"Initial sync failed: {(result.stderr or result.stdout)[:200]}"
+        with open(path, "wb") as f:
+            f.write(b"updated skipped content\n")
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=flags + ["--incremental"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Incremental sync failed: {(result.stderr or result.stdout)[:200]}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        with open(os.path.join(received, "incremental-skip.TXT"), "rb") as f:
+            assert f.read() == b"updated skipped content\n"
+
+    def test_skip_compress_rejects_chunk_serialization(self, shared_server):
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-c", "-s", "--skip-compress=.txt"],
+            port=shared_server.port,
+        )
+        assert result.returncode != 0
+        assert "cannot be combined" in (result.stderr or result.stdout)
+
 
 class TestExclude:
     def test_exclude_single(self, shared_server):
@@ -213,6 +462,225 @@ class TestIncremental:
         with open(received_file, "rb") as f:
             assert f.read() == b"hello world\n"
 
+    def test_size_only_skips_same_size_with_different_mtime(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        received_file = os.path.join(received, "small.txt")
+        with open(received_file, "wb") as f:
+            f.write(b"different!!\n")
+        os.utime(received_file, (time.time() - 3600, time.time() - 3600))
+
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-M", "--incremental", "--size-only"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Size-only sync failed: {result.stderr[:200]}"
+        with open(received_file, "rb") as f:
+            assert f.read() == b"different!!\n"
+
+    def test_ignore_times_transfers_same_size_and_mtime(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        source_file = os.path.join(SOURCE_DIR, "small.txt")
+        received_file = os.path.join(received, "small.txt")
+        source_stat = os.stat(source_file)
+        with open(received_file, "wb") as f:
+            f.write(b"stale data!\n")
+        os.utime(received_file, (source_stat.st_atime, source_stat.st_mtime))
+
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["-M", "--incremental", "--ignore-times"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"Ignore-times sync failed: {result.stderr[:200]}"
+        with open(received_file, "rb") as f:
+            assert f.read() == b"hello world\n"
+
+    def test_modify_window_allows_subsecond_mtime_difference(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        source_file = os.path.join(SOURCE_DIR, "small.txt")
+        received_file = os.path.join(received, "small.txt")
+        source_stat = os.stat(source_file)
+        with open(received_file, "wb") as f:
+            f.write(b"modified!!!\n")
+        os.utime(received_file, ns=(source_stat.st_atime_ns,
+                                    source_stat.st_mtime_ns - 1500000000))
+
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["-M", "--incremental", "--modify-window=2"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"Modify-window sync failed: {result.stderr[:200]}"
+        with open(received_file, "rb") as f:
+            assert f.read() == b"modified!!!\n"
+
+    def test_whole_file_disables_delta_and_keeps_compression(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0
+
+        source_file = os.path.join(SOURCE_DIR, "medium.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"whole-file replacement\n" * 5000)
+
+        result, _ = run_client(
+            SOURCE_DIR,
+            DEST_DIR,
+            flags=["-M", "--incremental", "--delta", "-W", "-c"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Whole-file sync failed: {(result.stderr or result.stdout)[:200]}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+
+class TestUpdate:
+    def test_update_skips_older_destination_and_allows_equal_or_newer_source(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-u"], port=shared_server.port)
+        assert result.returncode == 0
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        source_file = os.path.join(SOURCE_DIR, "small.txt")
+        received_file = os.path.join(received, "small.txt")
+        source_stat = os.stat(source_file)
+
+        with open(received_file, "wb") as f:
+            f.write(b"newer destination\n")
+        os.utime(received_file, ns=(source_stat.st_atime_ns, source_stat.st_mtime_ns + 10_000_000_000))
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-u"], port=shared_server.port)
+        assert result.returncode == 0
+        with open(received_file, "rb") as f:
+            assert f.read() == b"newer destination\n"
+
+        os.utime(received_file, ns=(source_stat.st_atime_ns, source_stat.st_mtime_ns))
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-u"], port=shared_server.port)
+        assert result.returncode == 0
+        with open(received_file, "rb") as f:
+            assert f.read() == b"hello world\n"
+
+    def test_update_skips_unreadable_newer_destination(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-u"], port=shared_server.port)
+        assert result.returncode == 0
+
+        received_file = os.path.join(get_dest_received_dir(DEST_DIR, SOURCE_DIR), "small.txt")
+        source_stat = os.stat(os.path.join(SOURCE_DIR, "small.txt"))
+        with open(received_file, "wb") as f:
+            f.write(b"protected destination\n")
+        os.utime(received_file, ns=(source_stat.st_atime_ns, source_stat.st_mtime_ns + 10_000_000_000))
+        original_mode = os.stat(received_file).st_mode
+        try:
+            os.chmod(received_file, 0)
+            result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-u"], port=shared_server.port)
+            assert result.returncode == 0
+            os.chmod(received_file, original_mode)
+            with open(received_file, "rb") as f:
+                assert f.read() == b"protected destination\n"
+        finally:
+            os.chmod(received_file, original_mode)
+
+        with open(received_file, "wb") as f:
+            f.write(b"older destination\n")
+        os.utime(received_file, ns=(source_stat.st_atime_ns, source_stat.st_mtime_ns - 10_000_000_000))
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-u"], port=shared_server.port)
+        assert result.returncode == 0
+        with open(received_file, "rb") as f:
+            assert f.read() == b"hello world\n"
+
+
+class TestExisting:
+    def test_existing_updates_existing_and_skips_new(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0, f"Initial sync failed: {(result.stderr or result.stdout)[:200]}"
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        source_file = os.path.join(SOURCE_DIR, "small.txt")
+        new_source_file = os.path.join(SOURCE_DIR, "new-existing-test.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"updated existing content\n")
+        with open(new_source_file, "wb") as f:
+            f.write(b"this file must not be created\n")
+
+        try:
+            result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                                   flags=["-M", "--existing"], port=shared_server.port)
+            assert result.returncode == 0, f"--existing sync failed: {(result.stderr or result.stdout)[:200]}"
+
+            with open(os.path.join(received, "small.txt"), "rb") as f:
+                assert f.read() == b"updated existing content\n"
+            assert not os.path.exists(os.path.join(received, "new-existing-test.txt"))
+        finally:
+            os.unlink(new_source_file)
+            with open(source_file, "wb") as f:
+                f.write(b"hello world\n")
+
+
+class TestIgnoreExisting:
+    def test_ignore_existing_preserves_existing_and_transfers_new(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, port=shared_server.port)
+        assert result.returncode == 0
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        existing_file = os.path.join(received, "small.txt")
+        with open(existing_file, "wb") as f:
+            f.write(b"destination content\n")
+        new_source = os.path.join(SOURCE_DIR, "new.txt")
+        try:
+            with open(new_source, "wb") as f:
+                f.write(b"new file\n")
+
+            result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                                   flags=["--ignore-existing"], port=shared_server.port)
+            assert result.returncode == 0, f"Sync failed: {(result.stderr or result.stdout)[:200]}"
+            with open(existing_file, "rb") as f:
+                assert f.read() == b"destination content\n"
+            with open(os.path.join(received, "new.txt"), "rb") as f:
+                assert f.read() == b"new file\n"
+        finally:
+            if os.path.lexists(new_source):
+                os.unlink(new_source)
+
+
+class TestIgnoreExisting:
+    def test_ignore_existing_preserves_existing_and_transfers_new(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, port=shared_server.port)
+        assert result.returncode == 0
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        existing_file = os.path.join(received, "small.txt")
+        with open(existing_file, "wb") as f:
+            f.write(b"destination content\n")
+        new_source = os.path.join(SOURCE_DIR, "new.txt")
+        try:
+            with open(new_source, "wb") as f:
+                f.write(b"new file\n")
+
+            result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                                   flags=["--ignore-existing"], port=shared_server.port)
+            assert result.returncode == 0, f"Sync failed: {(result.stderr or result.stdout)[:200]}"
+            with open(existing_file, "rb") as f:
+                assert f.read() == b"destination content\n"
+            with open(os.path.join(received, "new.txt"), "rb") as f:
+                assert f.read() == b"new file\n"
+        finally:
+            if os.path.lexists(new_source):
+                os.unlink(new_source)
+
 
 class TestDelete:
     def test_delete_removes_extra_files(self, shared_server):
@@ -263,6 +731,75 @@ class TestProgress:
         assert "Sent " in output and "MB" in output, "--progress produced no stable byte marker"
         assert "Done." in output, "--progress did not report completion"
 
+    def test_human_readable_stats(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-h", "--stats"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Exit {result.returncode}: {result.stderr[:100]}"
+        assert "Stats:" in result.stderr
+        assert "KB" in result.stderr
+
+    def test_human_readable_progress_multithreaded(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-m", "-h", "--progress"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Exit {result.returncode}: {result.stderr[:100]}"
+        output = result.stdout + result.stderr
+        assert "Sent " in output
+        assert "KB" in output
+        assert "Done." in output
+
+
+class TestInfo:
+    def test_info_copy_reports_transfers(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--info=copy"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Info sync failed: {(result.stderr or result.stdout)[:200]}"
+        output = result.stdout + result.stderr
+        assert "[INFO]" in output and "Transferring" in output
+
+    def test_info_stats_reports_multithreaded_transfer(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-m", "--info=stats"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Info stats sync failed: {(result.stderr or result.stdout)[:200]}"
+        output = result.stdout + result.stderr
+        assert "[INFO]" in output and "Transfer summary:" in output
+
+    def test_info_rejects_unknown_flag(self):
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--info=unknown"],
+        )
+        assert result.returncode != 0
+        assert "unsupported --info flag" in result.stderr
+
+    @pytest.mark.parametrize("flags", [
+        ["--info=none", "--verbose"],
+        ["--verbose", "--info=none"],
+    ])
+    def test_info_none_suppresses_verbose_info(self, shared_server, flags):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, f"Info sync failed: {(result.stderr or result.stdout)[:200]}"
+        output = result.stdout + result.stderr
+        assert "[INFO]" not in output
+        assert "Transferring" not in output
+        assert "Transfer summary:" not in output
+
 
 class TestBandwidthLimit:
     def test_bwlimit_runs(self, shared_server):
@@ -277,3 +814,391 @@ class TestBandwidthLimit:
         mismatches, missing = verify_transfer(SOURCE_DIR, received)
         assert not missing, f"Missing: {missing}"
         assert not mismatches, f"Mismatch: {mismatches}"
+
+
+def _read_file(path):
+    with open(path, "rb") as fh:
+        return fh.read()
+
+
+class TestRemoveSourceFilesSkips:
+    """--remove-source-files must not delete sources the receiver skipped
+    (rsync reference behavior)."""
+
+    def test_existing_first_sync_keeps_new_source(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "remove_rsf_existing_src")
+        dest = os.path.join(TEST_DATA_DIR, "remove_rsf_existing_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        with open(os.path.join(source, "only.txt"), "wb") as f:
+            f.write(b"keep me")
+
+        result, _ = run_client(source, dest, flags=["--remove-source-files", "--existing"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"Sync failed: {result.stderr[:200]}"
+        # The file exists only on the source side, so --existing makes the
+        # receiver skip it; the source must therefore not be removed.
+        assert os.path.isfile(os.path.join(source, "only.txt"))
+        received = get_dest_received_dir(dest, source)
+        assert not os.path.exists(os.path.join(received, "only.txt"))
+
+    def test_ignore_existing_keeps_skipped_source(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "remove_rsf_ignore_src")
+        dest = os.path.join(TEST_DATA_DIR, "remove_rsf_ignore_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "file.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"payload")
+
+        result, _ = run_client(source, dest, port=shared_server.port)
+        assert result.returncode == 0
+
+        result, _ = run_client(source, dest, flags=["--remove-source-files", "--ignore-existing"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"Sync failed: {result.stderr[:200]}"
+        # Destination already has the file, so the second run is a receiver
+        # skip; the source file must survive.
+        assert os.path.isfile(source_file)
+        received = get_dest_received_dir(dest, source)
+        assert _read_file(os.path.join(received, "file.txt")) == b"payload"
+
+    def test_update_newer_destination_keeps_source(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "remove_rsf_update_src")
+        dest = os.path.join(TEST_DATA_DIR, "remove_rsf_update_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "file.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"source payload")
+
+        result, _ = run_client(source, dest, port=shared_server.port)
+        assert result.returncode == 0
+
+        received = get_dest_received_dir(dest, source)
+        received_file = os.path.join(received, "file.txt")
+        with open(received_file, "wb") as f:
+            f.write(b"newer destination payload")
+        os.utime(received_file, ns=(time.time_ns() + 10**9, time.time_ns() + 10**9))
+
+        result, _ = run_client(source, dest, flags=["--remove-source-files", "--update"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"Sync failed: {result.stderr[:200]}"
+        # --update skips a destination that is newer than the source, so the
+        # source must not be removed.
+        assert os.path.isfile(source_file)
+        assert _read_file(received_file) == b"newer destination payload"
+
+    def test_multithreaded_ignore_existing_keeps_skipped_source(self, shared_server):
+        """The multithreaded writer path must also report per-file outcomes so a
+        --remove-source-files sender does not delete skipped sources."""
+        source = os.path.join(TEST_DATA_DIR, "remove_rsf_mt_ignore_src")
+        dest = os.path.join(TEST_DATA_DIR, "remove_rsf_mt_ignore_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "file.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"payload")
+
+        result, _ = run_client(source, dest, port=shared_server.port)
+        assert result.returncode == 0
+
+        result, _ = run_client(source, dest,
+                               flags=["--remove-source-files", "--ignore-existing", "-m"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"Sync failed: {result.stderr[:200]}"
+        # Destination already has the file, so the receiver (writer thread)
+        # skips it; the source must survive.
+        assert os.path.isfile(source_file)
+        received = get_dest_received_dir(dest, source)
+        assert _read_file(os.path.join(received, "file.txt")) == b"payload"
+
+
+class TestBackup:
+    def _sync(self, source, dest, flags, port):
+        return run_client(source, dest, flags=flags, port=port)
+
+    def test_plain_backup_keeps_previous_version(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "backup_src")
+        dest = os.path.join(TEST_DATA_DIR, "backup_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "f.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"AAAA")
+
+        result, _ = self._sync(source, dest, ["--backup"], shared_server.port)
+        assert result.returncode == 0, f"Backup sync failed: {result.stderr[:200]}"
+
+        with open(source_file, "wb") as f:
+            f.write(b"BBBB")
+        result, _ = self._sync(source, dest, ["--backup"], shared_server.port)
+        assert result.returncode == 0, f"Backup sync failed: {result.stderr[:200]}"
+
+        received = get_dest_received_dir(dest, source)
+        assert _read_file(os.path.join(received, "f.txt")) == b"BBBB"
+        # rsync default suffix "~" keeps the overwritten version.
+        assert _read_file(os.path.join(received, "f.txt~")) == b"AAAA"
+
+    def test_backup_custom_suffix(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "backup_suffix_src")
+        dest = os.path.join(TEST_DATA_DIR, "backup_suffix_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "f.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"AAAA")
+
+        flags = ["--backup", "--suffix", ".bak"]
+        result, _ = self._sync(source, dest, flags, shared_server.port)
+        assert result.returncode == 0, f"Backup sync failed: {result.stderr[:200]}"
+        with open(source_file, "wb") as f:
+            f.write(b"BBBB")
+        result, _ = self._sync(source, dest, flags, shared_server.port)
+        assert result.returncode == 0, f"Backup sync failed: {result.stderr[:200]}"
+
+        received = get_dest_received_dir(dest, source)
+        assert _read_file(os.path.join(received, "f.txt")) == b"BBBB"
+        assert _read_file(os.path.join(received, "f.txt.bak")) == b"AAAA"
+
+    def test_backup_dir_stores_backups_separately(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "backup_dir_src")
+        dest = os.path.join(TEST_DATA_DIR, "backup_dir_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "f.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"AAAA")
+
+        flags = ["--backup", "--backup-dir", "backups"]
+        result, _ = self._sync(source, dest, flags, shared_server.port)
+        assert result.returncode == 0, f"Backup sync failed: {result.stderr[:200]}"
+        with open(source_file, "wb") as f:
+            f.write(b"BBBB")
+        result, _ = self._sync(source, dest, flags, shared_server.port)
+        assert result.returncode == 0, f"Backup sync failed: {result.stderr[:200]}"
+
+        received = get_dest_received_dir(dest, source)
+        assert _read_file(os.path.join(received, "f.txt")) == b"BBBB"
+        backup = os.path.join(dest, "backups", os.path.relpath(source_file, os.path.sep))
+        assert _read_file(backup) == b"AAAA"
+
+
+class TestPartialDir:
+    def test_completed_transfer_installed_in_destination(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "partial_src")
+        dest = os.path.join(TEST_DATA_DIR, "partial_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "f.txt")
+        with open(source_file, "wb") as f:
+            f.write(b"partial payload")
+
+        result, _ = run_client(source, dest, flags=["--partial", "--partial-dir", ".partial"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"Partial sync failed: {result.stderr[:200]}"
+
+        received = get_dest_received_dir(dest, source)
+        assert _read_file(os.path.join(received, "f.txt")) == b"partial payload"
+        # A completed transfer must not remain under the partial directory.
+        partial = os.path.join(dest, ".partial", os.path.relpath(source_file, os.path.sep))
+        assert not os.path.exists(partial)
+
+
+class TestLargeFile:
+    def test_transfer_100mb_file(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "large_src")
+        dest = os.path.join(TEST_DATA_DIR, "large_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "big.bin")
+        chunk = os.urandom(1024 * 1024)
+        with open(source_file, "wb") as f:
+            for _ in range(100):
+                f.write(chunk)
+
+        result, _ = run_client(source, dest, port=shared_server.port)
+        assert result.returncode == 0, f"Large-file sync failed: {result.stderr[:200]}"
+        received = get_dest_received_dir(dest, source)
+        assert filecmp.cmp(source_file, os.path.join(received, "big.bin"), shallow=False)
+
+
+def _source_files():
+    """All source paths (absolute) that a transfer would send right now."""
+    return [
+        os.path.join(root, name)
+        for root, _dirs, names in os.walk(SOURCE_DIR)
+        for name in names
+    ]
+
+
+class TestListOnly:
+    """--list-only prints every transfer candidate and changes nothing."""
+
+    def test_list_only_prints_each_file_and_does_not_transfer(self):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["--list-only"])
+        assert result.returncode == 0, f"list-only failed: {result.stderr[:200]}"
+        for full_path in _source_files():
+            assert full_path in result.stdout, f"list-only omitted {full_path}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert not os.path.exists(received), "list-only wrote to the destination"
+
+    def test_list_only_with_dry_run_does_not_error(self):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["--list-only", "--dry-run"])
+        assert result.returncode == 0, f"list-only -n failed: {result.stderr[:200]}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert not os.path.exists(received)
+
+    def test_list_only_multithreaded(self):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["--list-only", "-m"])
+        assert result.returncode == 0, f"list-only -m failed: {result.stderr[:200]}"
+        for full_path in _source_files():
+            assert full_path in result.stdout, f"list-only -m omitted {full_path}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert not os.path.exists(received), "list-only -m wrote to the destination"
+
+
+class TestItemizeChanges:
+    """-i/--itemize-changes prints rsync-style lines only for files sent."""
+
+    def test_first_run_prints_sent_lines(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["-M", "-i"], port=shared_server.port)
+        assert result.returncode == 0, f"itemize sync failed: {result.stderr[:200]}"
+        sent_lines = {">f+++++++++ " + p for p in _source_files()}
+        assert sent_lines <= set(result.stdout.splitlines()), (
+            f"missing itemize lines; got {result.stdout[:500]}"
+        )
+
+    def test_incremental_second_run_prints_no_line_for_unchanged(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0, f"seed sync failed: {result.stderr[:200]}"
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["-M", "-i", "--incremental"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"incremental itemize failed: {result.stderr[:200]}"
+        itemized = [line for line in result.stdout.splitlines() if line and line[0] in ">.<c"]
+        assert itemized == [], f"unchanged files were itemized: {itemized[:5]}"
+
+    def test_multithreaded_emits_same_itemize_lines(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["-M", "-i", "-m"], port=shared_server.port)
+        assert result.returncode == 0, f"itemize -m sync failed: {result.stderr[:200]}"
+        sent_lines = {">f+++++++++ " + p for p in _source_files()}
+        assert sent_lines <= set(result.stdout.splitlines()), (
+            f"missing itemize lines in -m mode; got {result.stdout[:500]}"
+        )
+
+    def test_dry_run_with_itemize_does_not_error(self):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-i", "--dry-run"])
+        assert result.returncode == 0, f"dry-run -i failed: {result.stderr[:200]}"
+
+    def test_changed_file_on_second_incremental_run_prints_exactly_one_line(self, shared_server):
+        """A changed file itemizes exactly once on an incremental rerun while
+        unchanged files print nothing (no double emission)."""
+        source = os.path.join(TEST_DATA_DIR, "itemize_change_src")
+        dest = os.path.join(TEST_DATA_DIR, "itemize_change_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        changed = os.path.join(source, "changed.txt")
+        untouched = os.path.join(source, "untouched.txt")
+        with open(changed, "wb") as fh:
+            fh.write(b"original\n")
+        with open(untouched, "wb") as fh:
+            fh.write(b"stable\n")
+
+        result, _ = run_client(source, dest, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0, f"seed sync failed: {result.stderr[:200]}"
+
+        with open(changed, "wb") as fh:
+            fh.write(b"edited payload\n")
+
+        result, _ = run_client(source, dest,
+                               flags=["-M", "-i", "--incremental"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"incremental itemize failed: {result.stderr[:200]}"
+        itemized = [line for line in result.stdout.splitlines() if line.startswith(">f")]
+        assert itemized == [">f+++++++++ " + changed], (
+            f"expected exactly one itemize line for {changed}, got {itemized}"
+        )
+        received = get_dest_received_dir(dest, source)
+        assert _read_file(os.path.join(received, "changed.txt")) == b"edited payload\n"
+        assert _read_file(os.path.join(received, "untouched.txt")) == b"stable\n"
+
+
+class TestOutFormat:
+    """--out-format prints a line per transferred file using the template."""
+
+    def test_out_format_path_and_size(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["--out-format=%f %l"], port=shared_server.port)
+        assert result.returncode == 0, f"out-format sync failed: {result.stderr[:200]}"
+        expected = {f"{p} {os.path.getsize(p)}" for p in _source_files()}
+        got = set(result.stdout.splitlines())
+        assert expected <= got, f"out-format lines missing: expected {len(expected)} got {len(got)}"
+
+    def test_out_format_multithreaded_matches_single(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["--out-format=%f %l", "-m"], port=shared_server.port)
+        assert result.returncode == 0, f"out-format -m sync failed: {result.stderr[:200]}"
+        expected = {f"{p} {os.path.getsize(p)}" for p in _source_files()}
+        got = set(result.stdout.splitlines())
+        assert expected <= got, f"out-format -m lines missing: {result.stdout[:500]}"
+
+
+class TestLogFileFormat:
+    """--log-file plus --log-file-format writes per-file lines to the log."""
+
+    def test_log_file_format_writes_transferred_files(self, shared_server):
+        clean_dir(DEST_DIR)
+        log_path = os.path.join(TEST_DATA_DIR, "itemize_transfer.log")
+        if os.path.exists(log_path):
+            os.unlink(log_path)
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--log-file", log_path, "--log-file-format=%f %l"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"log-file sync failed: {result.stderr[:200]}"
+        assert os.path.exists(log_path), "--log-file created no log"
+        with open(log_path, encoding="utf-8", errors="replace") as fh:
+            content = fh.read()
+        expected = {f"{p} {os.path.getsize(p)}" for p in _source_files()}
+        for line in expected:
+            assert line in content, f"log file missing {line!r}"
+
+    def test_log_file_format_multithreaded_writes_transferred_files(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "itemize_log_mt_src")
+        dest = os.path.join(TEST_DATA_DIR, "itemize_log_mt_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        files = {"a.txt": b"alpha\n", "b.txt": b"beta\n"}
+        for rel, data in files.items():
+            with open(os.path.join(source, rel), "wb") as fh:
+                fh.write(data)
+        log_path = os.path.join(TEST_DATA_DIR, "itemize_mt.log")
+        if os.path.exists(log_path):
+            os.unlink(log_path)
+        result, _ = run_client(
+            source,
+            dest,
+            flags=["--log-file", log_path, "--log-file-format=%f %l", "-m"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"log-file -m sync failed: {result.stderr[:200]}"
+        assert os.path.exists(log_path), "--log-file created no log"
+        with open(log_path, encoding="utf-8", errors="replace") as fh:
+            content = fh.read()
+        expected = {f"{os.path.join(source, rel)} {len(data)}" for rel, data in files.items()}
+        for line in expected:
+            assert line in content, f"log file (-m) missing {line!r}"
+

tests/integration/test_tcp.py

@@ -71,6 +71,11 @@ class TestTCPFlags:
         r = _run_tcp_test("Compression (-c)", shared_server.port, ["-c"])
         assert r["status"] == "Success", r["error"]
 
+    def test_compression_threads(self, shared_server):
+        r = _run_tcp_test("Compression threads (-c --compress-threads=2)", shared_server.port,
+                          ["-c", "--compress-threads=2"])
+        assert r["status"] == "Success", r["error"]
+
     def test_chunk_serialization(self, shared_server):
         r = _run_tcp_test("Chunk Serialization (-s)", shared_server.port, ["-s"])
         assert r["status"] == "Success", r["error"]

tests/integration/test_tls.py

@@ -102,6 +102,7 @@ class TestTLSBasic:
         with ServerManager() as server:
             server.start(extra_args=[
                 "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+                "--ca", certs["ca"], "--client-cn", "fastsync-client",
             ])
             result, dur = run_client(
                 SOURCE_DIR, DEST_DIR,
@@ -125,6 +126,7 @@ class TestTLSBasic:
         with ServerManager() as server:
             server.start(extra_args=[
                 "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+                "--ca", certs["ca"], "--client-cn", "fastsync-client",
             ])
             result, dur = run_client(
                 SOURCE_DIR, DEST_DIR,
@@ -149,6 +151,7 @@ class TestTLSBasic:
         with ServerManager() as server:
             server.start(extra_args=[
                 "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+                "--ca", certs["ca"], "--client-cn", "fastsync-client",
             ])
             result, dur = run_client(
                 SOURCE_DIR, DEST_DIR,

tests/runner.c

@@ -1,5 +1,6 @@
 #include "test_array_list.h"
 #include "test_chunk.h"
+#include "test_change_list.h"
 #include "test_client_cli.h"
 #include "test_compression.h"
 #include "test_config.h"
@@ -40,6 +41,7 @@ int main() {
   RUN_TEST(test_array_list);
   RUN_TEST(test_shared_utils);
   RUN_TEST(test_chunk);
+  RUN_TEST(test_change_list);
   RUN_TEST(test_config);
   RUN_TEST(test_compression);
   RUN_TEST(test_scanner);

tests/test_array_list.c

@@ -17,6 +17,8 @@ void test_array_list() {
 
   // Test adding
   int* val1 = malloc(sizeof(int));
+  if (!val1)
+    return;
   *val1 = 42;
   array_list_add(list, val1);
   EXPECT_EQ_INT(list->size, 1);
@@ -26,6 +28,8 @@ void test_array_list() {
   // Initial capacity is 100. Let's add 105 elements.
   for (int i = 0; i < 105; i++) {
     int* val = malloc(sizeof(int));
+    if (!val)
+      return;
     *val = i;
     array_list_add(list, val);
   }

tests/test_change_list.c

@@ -0,0 +1,101 @@
+#include "test_change_list.h"
+#include "change_list.h"
+#include "test_utils.h"
+#include "utils.h"
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+static ChangeEvent sample_event(void) {
+  ChangeEvent event;
+  memset(&event, 0, sizeof(event));
+  event.path = "/srv/root/sub/file.txt";
+  event.decision = CHANGE_SENT;
+  event.is_directory = false;
+  event.size = 12345;
+  event.bytes_sent = 999;
+  event.mtime_sec = 1700000000;
+  return event;
+}
+
+static void test_format_tokens() {
+  ChangeEvent event = sample_event();
+  char* line = change_render_format("%f %n %l %b %M %%", &event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, "/srv/root/sub/file.txt file.txt 12345 999 1700000000 %");
+  free(line);
+}
+
+static void test_format_unknown_tokens_preserved() {
+  ChangeEvent event = sample_event();
+  char* line = change_render_format("x%q=%f%z", &event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, "x%q=/srv/root/sub/file.txt%z");
+  free(line);
+}
+
+static void test_format_leaf_name() {
+  ChangeEvent event = sample_event();
+  event.path = "bare.txt";
+  char* line = change_render_format("%n|%f", &event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, "bare.txt|bare.txt");
+  free(line);
+}
+
+static void test_render_itemize_sent_file() {
+  ChangeEvent event = sample_event();
+  char* line = change_render_itemize(&event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, ">f+++++++++ /srv/root/sub/file.txt");
+  free(line);
+}
+
+static void test_render_itemize_up_to_date_is_empty() {
+  ChangeEvent event = sample_event();
+  event.decision = CHANGE_UP_TO_DATE;
+  char* line = change_render_itemize(&event);
+  EXPECT_NOT_NULL(line);
+  EXPECT_EQ_STR(line, "");
+  free(line);
+}
+
+static void test_render_list_line() {
+  char* line = change_render_list_line(0100644, 4096, 1700000000, "/srv/x.txt");
+  EXPECT_NOT_NULL(line);
+  EXPECT_TRUE(strncmp(line, "-rw-r--r--", 10) == 0);
+  EXPECT_TRUE(strstr(line, "4096") != NULL);
+  EXPECT_TRUE(strstr(line, "/srv/x.txt") != NULL);
+  free(line);
+}
+
+static void test_change_list_enabled() {
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  EXPECT_FALSE(change_list_enabled(config));
+  config->itemize_changes = true;
+  EXPECT_TRUE(change_list_enabled(config));
+  config->itemize_changes = false;
+  config->out_format = str_dup("%f");
+  EXPECT_TRUE(change_list_enabled(config));
+  free(config->out_format);
+  config->out_format = NULL;
+  EXPECT_FALSE(change_list_enabled(config));
+  /* config_delete() closes log_file, so use a throwaway tmpfile. */
+  config->log_file = tmpfile();
+  EXPECT_NOT_NULL(config->log_file);
+  EXPECT_FALSE(change_list_enabled(config)); /* needs a format too */
+  config->log_file_format = str_dup("%n");
+  EXPECT_TRUE(change_list_enabled(config));
+  config_delete(config); /* closes config->log_file */
+}
+
+void test_change_list() {
+  test_format_tokens();
+  test_format_unknown_tokens_preserved();
+  test_format_leaf_name();
+  test_render_itemize_sent_file();
+  test_render_itemize_up_to_date_is_empty();
+  test_render_list_line();
+  test_change_list_enabled();
+}

tests/test_change_list.h

@@ -0,0 +1,6 @@
+#ifndef TEST_CHANGE_LIST_H
+#define TEST_CHANGE_LIST_H
+
+void test_change_list(void);
+
+#endif

tests/test_chunk.c

@@ -11,7 +11,7 @@ static void test_file_operations() {
   char* test_content = "Hello, Chunk System!";
   unsigned long long test_len = strlen(test_content);
 
-  to_disk(test_path, test_content, test_len, false, false);
+  file_write_to_disk(test_path, test_content, test_len, false, false);
 
   File* f = file_create(test_path);
   EXPECT_NOT_NULL(f);
@@ -43,8 +43,8 @@ static void test_chunk_operations() {
   char* content2 = "chunk item number 2";
   unsigned long long len2 = strlen(content2);
 
-  to_disk(path1, content1, len1, false, false);
+  file_write_to_disk(path1, content1, len1, false, false);
-  to_disk(path2, content2, len2, false, false);
+  file_write_to_disk(path2, content2, len2, false, false);
 
   struct stat st1, st2;
   stat(path1, &st1);

tests/test_compression.c

@@ -13,6 +13,8 @@ static void test_data_compress_decompress_roundtrip() {
   size_t len = strlen(original);
 
   char* buf = malloc(len);
+  if (!buf)
+    return;
   memcpy(buf, original, len);
   Data* original_data = data_create(buf, len);
   EXPECT_NOT_NULL(original_data);
@@ -53,6 +55,31 @@ static void test_data_compress_decompress_large() {
   data_destroy(decompressed);
 }
 
+static void test_skip_compress_suffix_matching() {
+  char* suffixes[] = {".ZIP", ".GZ"};
+  EXPECT_TRUE(compression_should_skip_with_suffixes("archive.zip", suffixes, 2));
+  EXPECT_TRUE(compression_should_skip_with_suffixes("backup.TAR.GZ", suffixes, 2));
+  EXPECT_FALSE(compression_should_skip_with_suffixes("notes.txt", suffixes, 2));
+  EXPECT_FALSE(compression_should_skip_with_suffixes("archive.zip", suffixes, 0));
+}
+
+static void test_data_compress_with_threads_roundtrip() {
+  const size_t size = 8 * 1024 * 1024;
+  Data* input = data_create_empty(size);
+  EXPECT_NOT_NULL(input);
+  for (size_t i = 0; i < size; i++)
+    ((char*)input->data)[i] = (char)((i / 4096) % 7);
+  Data* compressed = data_compress_with_threads(input, 3, 2);
+  EXPECT_NOT_NULL(compressed);
+  Data* decompressed = data_decompress(compressed);
+  EXPECT_NOT_NULL(decompressed);
+  EXPECT_EQ_INT((int)decompressed->size, (int)size);
+  EXPECT_EQ_INT(memcmp(decompressed->data, input->data, size), 0);
+  data_destroy(input);
+  data_destroy(compressed);
+  data_destroy(decompressed);
+}
+
 static void test_chunk_compress_decompress_roundtrip() {
   char* path1 = "temp_comp_test_1.txt";
   char* content1 = "chunk compression test file 1";
@@ -62,8 +89,8 @@ static void test_chunk_compress_decompress_roundtrip() {
   char* content2 = "chunk compression test file 2 with more data";
   unsigned long long len2 = strlen(content2);
 
-  to_disk(path1, content1, len1, false, false);
+  file_write_to_disk(path1, content1, len1, false, false);
-  to_disk(path2, content2, len2, false, false);
+  file_write_to_disk(path2, content2, len2, false, false);
 
   struct stat st1, st2;
   EXPECT_EQ_INT(stat(path1, &st1), 0);
@@ -113,5 +140,7 @@ static void test_chunk_compress_decompress_roundtrip() {
 void test_compression() {
   test_data_compress_decompress_roundtrip();
   test_data_compress_decompress_large();
+  test_skip_compress_suffix_matching();
+  test_data_compress_with_threads_roundtrip();
   test_chunk_compress_decompress_roundtrip();
 }

tests/test_config.c

@@ -95,6 +95,7 @@ static void test_pipeline_sender_lifecycle() {
   EXPECT_EQ_INT(pcs->queue_loader->capacity, 15);
   EXPECT_FALSE(pcs->scanner_done);
   EXPECT_FALSE(pcs->loader_done);
+  EXPECT_EQ_INT((int)pcs->allocation_session.max_alloc, (int)cfg->max_alloc);
 
   pipeline_context_sender_destroy(pcs);
 }
@@ -121,11 +122,25 @@ static void test_config_send_receive() {
   send_cfg->receive_root_directory = str_dup("/send/dst");
   send_cfg->save_to_disk = true;
   send_cfg->use_multithreading = true;
-  send_cfg->use_chunk_serialization = true;
+  send_cfg->use_chunk_serialization = false;
   send_cfg->use_compression = true;
   send_cfg->use_metadata = true;
+  send_cfg->use_executability = true;
+  send_cfg->use_delta = true;
+  send_cfg->whole_file = true;
+  send_cfg->ignore_times = true;
+  send_cfg->size_only = true;
   send_cfg->compression_level = 5;
   send_cfg->chunk_size = 1024;
+  send_cfg->eight_bit_output = true;
+  send_cfg->modify_window = 4;
+  send_cfg->existing = true;
+  send_cfg->ignore_existing = true;
+  send_cfg->skip_compress_set = true;
+  send_cfg->skip_compress_count = 1;
+  send_cfg->skip_compress_suffixes = calloc(1, sizeof(char*));
+  send_cfg->skip_compress_suffixes[0] = str_dup(".zip");
+  send_cfg->max_alloc = MAX_SERVER_ALLOC + 1;
 
   /* Use socketpair for bidirectional communication */
   int p[2];
@@ -154,12 +169,33 @@ static void test_config_send_receive() {
         ok = false;
       if (!recv_cfg->use_multithreading)
         ok = false;
-      if (!recv_cfg->use_chunk_serialization)
+      if (recv_cfg->use_chunk_serialization)
         ok = false;
       if (recv_cfg->compression_level != 5)
         ok = false;
       if (recv_cfg->chunk_size != 1024)
         ok = false;
+      if (!recv_cfg->use_executability)
+        ok = false;
+      if (!recv_cfg->size_only)
+        ok = false;
+      if (!recv_cfg->ignore_times)
+        ok = false;
+      if (!recv_cfg->eight_bit_output)
+        ok = false;
+      if (recv_cfg->use_delta)
+        ok = false;
+      if (recv_cfg->modify_window != 4)
+        ok = false;
+      if (!recv_cfg->existing)
+        ok = false;
+      if (!recv_cfg->ignore_existing)
+        ok = false;
+      if (!recv_cfg->skip_compress_set || recv_cfg->skip_compress_count != 1 ||
+          strcmp(recv_cfg->skip_compress_suffixes[0], ".zip") != 0)
+        ok = false;
+      if (recv_cfg->max_alloc != MAX_SERVER_ALLOC)
+        ok = false;
     }
     config_delete(recv_cfg);
     close(p[0]);
@@ -185,11 +221,11 @@ static void test_config_send_receive() {
 }
 
 static void test_config_send_receive_version_mismatch() {
-  /* Create a config with a different protocol version */
+  /* A peer using the previous wire format must be rejected. */
   Config* cfg = config_create();
   EXPECT_NOT_NULL(cfg);
   free(cfg->version);
-  cfg->version = str_dup("0.0");
+  cfg->version = str_dup("2.3.0");
   cfg->send_directory = str_dup("/src");
   cfg->receive_root_directory = str_dup("/dst");
 
@@ -233,6 +269,8 @@ static void test_config_receive_truncated() {
   /* A valid prefix exercises cleanup after allocated wire strings and a
    * partially received scalar field. */
   EXPECT_TRUE(send_str(p[1], PROTOCOL_VERSION));
+  unsigned long long max_alloc = DEFAULT_MAX_ALLOC;
+  EXPECT_TRUE(send_n_data(p[1], &max_alloc, sizeof(max_alloc)));
   EXPECT_TRUE(send_str(p[1], "/src"));
   EXPECT_TRUE(send_str(p[1], "/dst"));
   EXPECT_TRUE(send_int(p[1], 1));
@@ -244,26 +282,125 @@ static void test_config_receive_truncated() {
   close(p[1]);
 }
 
-static void test_is_remote_dest() {
+static bool config_string_roundtrip_matches(const Config* send_cfg, Config* recv) {
+  /* The sender serializes NULL strings as "" on the wire.  Receivers must
+     canonicalize those empty values back to NULL for the options whose client
+     default is NULL (backup_dir, temp_dir, partial_dir, suffix), while a real
+     non-empty value round-trips unchanged. */
+  const char* fields[4];
+  char* const* recv_fields[4];
+  fields[0] = send_cfg->backup_dir;
+  recv_fields[0] = &recv->backup_dir;
+  fields[1] = send_cfg->temp_dir;
+  recv_fields[1] = &recv->temp_dir;
+  fields[2] = send_cfg->partial_dir;
+  recv_fields[2] = &recv->partial_dir;
+  fields[3] = send_cfg->suffix;
+  recv_fields[3] = &recv->suffix;
+  for (int i = 0; i < 4; i++) {
+    const char* sent = fields[i];
+    const char* got = *recv_fields[i];
+    if (sent == NULL || sent[0] == '\0') {
+      if (got != NULL)
+        return false;
+    } else if (got == NULL || strcmp(sent, got) != 0) {
+      return false;
+    }
+  }
+  return true;
+}
+
+static bool roundtrip_config_ok(const Config* send_cfg) {
+  int p[2];
+  if (socketpair(AF_UNIX, SOCK_STREAM, 0, p) != 0)
+    return false;
+  pid_t pid = fork();
+  if (pid == 0) {
+    close(p[1]);
+    io_set_fds(p[0], p[0]);
+    Config* recv = config_receive(p[0]);
+    bool ok = recv != NULL;
+    if (ok) {
+      ok = recv->version != NULL && strcmp(recv->version, PROTOCOL_VERSION) == 0;
+      ok = ok && recv->send_directory && recv->receive_root_directory;
+      ok = ok && config_string_roundtrip_matches(send_cfg, recv);
+    }
+    config_delete(recv);
+    close(p[0]);
+    _exit(ok ? 0 : 1);
+  } else {
+    close(p[0]);
+    io_set_fds(p[1], p[1]);
+    bool sent = config_send(p[1], send_cfg);
+    int status;
+    waitpid(pid, &status, 0);
+    close(p[1]);
+    return sent && WIFEXITED(status) && WEXITSTATUS(status) == 0;
+  }
+}
+
+/* Issue #252: NULL-vs-empty must survive the wire for backup_dir, temp_dir,
+   partial_dir, and suffix.  NULL and explicitly-empty client values are both
+   serialized as "" and must be reconstructed as NULL so plain --backup (with
+   no --suffix/--backup-dir) works exactly like the client configured it. */
+static void test_config_string_null_vs_empty_roundtrip() {
+  if (is_running_under_valgrind())
+    return;
+
+  /* NULL values on the wire must come back as NULL. */
+  Config* a = config_create();
+  EXPECT_NOT_NULL(a);
+  a->send_directory = str_dup("/src");
+  a->receive_root_directory = str_dup("/dst");
+  EXPECT_TRUE(roundtrip_config_ok(a));
+  config_delete(a);
+
+  /* Explicitly empty strings (indistinguishable on the wire from NULL) must
+     be canonicalized to NULL by the receiver. */
+  Config* b = config_create();
+  EXPECT_NOT_NULL(b);
+  b->send_directory = str_dup("/src");
+  b->receive_root_directory = str_dup("/dst");
+  b->backup_dir = str_dup("");
+  b->temp_dir = str_dup("");
+  b->partial_dir = str_dup("");
+  b->suffix = str_dup("");
+  EXPECT_TRUE(roundtrip_config_ok(b));
+  config_delete(b);
+
+  /* Non-empty values must round-trip unchanged. */
+  Config* c = config_create();
+  EXPECT_NOT_NULL(c);
+  c->send_directory = str_dup("/src");
+  c->receive_root_directory = str_dup("/dst");
+  c->backup_dir = str_dup("backups");
+  c->temp_dir = str_dup("/tmp/fast");
+  c->partial_dir = str_dup(".partial");
+  c->suffix = str_dup(".bak");
+  EXPECT_TRUE(roundtrip_config_ok(c));
+  config_delete(c);
+}
+
+static void test_config_is_remote_dest() {
   /* Valid SSH-style destinations */
-  EXPECT_TRUE(is_remote_dest("user@host:/path"));
+  EXPECT_TRUE(config_is_remote_dest("user@host:/path"));
-  EXPECT_TRUE(is_remote_dest("host:/path"));
+  EXPECT_TRUE(config_is_remote_dest("host:/path"));
-  EXPECT_TRUE(is_remote_dest("user@192.168.1.1:/remote/path"));
+  EXPECT_TRUE(config_is_remote_dest("user@192.168.1.1:/remote/path"));
 
   /* Invalid destinations */
-  EXPECT_FALSE(is_remote_dest(NULL));
+  EXPECT_FALSE(config_is_remote_dest(NULL));
-  EXPECT_FALSE(is_remote_dest(""));
+  EXPECT_FALSE(config_is_remote_dest(""));
-  EXPECT_FALSE(is_remote_dest(":"));
+  EXPECT_FALSE(config_is_remote_dest(":"));
-  EXPECT_FALSE(is_remote_dest("/local/path"));
+  EXPECT_FALSE(config_is_remote_dest("/local/path"));
-  EXPECT_FALSE(is_remote_dest("relative/path"));
+  EXPECT_FALSE(config_is_remote_dest("relative/path"));
   /* C:/windows/path is treated as remote (colon with no preceding slash) */
-  EXPECT_TRUE(is_remote_dest("C:/windows/path"));
+  EXPECT_TRUE(config_is_remote_dest("C:/windows/path"));
 
   /* Edge cases */
-  EXPECT_FALSE(is_remote_dest("noslash"));
+  EXPECT_FALSE(config_is_remote_dest("noslash"));
-  EXPECT_FALSE(is_remote_dest("/"));
+  EXPECT_FALSE(config_is_remote_dest("/"));
-  EXPECT_TRUE(is_remote_dest("host:"));
+  EXPECT_TRUE(config_is_remote_dest("host:"));
-  EXPECT_TRUE(is_remote_dest("user@host:"));
+  EXPECT_TRUE(config_is_remote_dest("user@host:"));
 }
 
 void test_config() {
@@ -277,6 +414,7 @@ void test_config() {
     test_config_send_receive();
     test_config_send_receive_version_mismatch();
     test_config_receive_truncated();
+    test_config_string_null_vs_empty_roundtrip();
   }
-  test_is_remote_dest();
+  test_config_is_remote_dest();
 }

tests/test_delta.c

@@ -343,6 +343,297 @@ static void test_delta_apply_rejects_output_overflow() {
   EXPECT_TRUE(delta_apply(old_data, sizeof(old_data), &delta, 1) == NULL);
 }
 
+/* ---------------------------------------------------------------------------
+ * Hash-index lookup differential tests.
+ *
+ * delta_compute buckets signature blocks by their weak checksum.  These tests
+ * prove the bucket-indexed candidate lookup is behaviour-identical to the
+ * original per-window linear scan: the emitted instruction stream (types,
+ * lengths, literal bytes and chosen block indices) must match a naive linear
+ * reference exactly, and the delta must reconstruct the new buffer.
+ * ------------------------------------------------------------------------- */
+
+#define REF_NO_MATCH UINT32_MAX
+
+typedef struct {
+  DeltaInstruction* items;
+  uint32_t count;
+  uint32_t cap;
+} RefDelta;
+
+static void ref_delta_free(RefDelta* ref) {
+  if (!ref->items)
+    return;
+  for (uint32_t i = 0; i < ref->count; i++)
+    if (ref->items[i].type == DELTA_INSTR_LITERAL)
+      free(ref->items[i].literal.data);
+  free(ref->items);
+  ref->items = NULL;
+  ref->count = 0;
+  ref->cap = 0;
+}
+
+static bool ref_delta_push(RefDelta* ref, DeltaInstruction instr) {
+  if (ref->count == ref->cap) {
+    uint32_t new_cap = ref->cap ? ref->cap * 2 : 16;
+    DeltaInstruction* tmp = realloc(ref->items, (size_t)new_cap * sizeof(DeltaInstruction));
+    if (!tmp)
+      return false;
+    ref->items = tmp;
+    ref->cap = new_cap;
+  }
+  ref->items[ref->count++] = instr;
+  return true;
+}
+
+static bool ref_delta_flush_literal(RefDelta* ref, const uint8_t* data, uint64_t start,
+                                    uint64_t end) {
+  if (start >= end)
+    return true;
+  uint8_t* lit = malloc((size_t)(end - start));
+  if (!lit)
+    return false;
+  memcpy(lit, data + start, (size_t)(end - start));
+  DeltaInstruction instr = {
+      .type = DELTA_INSTR_LITERAL,
+      .literal = {.data = lit, .length = (uint32_t)(end - start)},
+  };
+  return ref_delta_push(ref, instr);
+}
+
+/* Naive O(windows x blocks) re-implementation of the historical delta_compute
+ * candidate scan: only full windows may match, a candidate needs both the weak
+ * (Adler-32) and strong (xxHash32) checksums to agree, and the lowest matching
+ * block index is selected. */
+static bool ref_delta_build(RefDelta* ref, const uint8_t* new_data, uint64_t new_size,
+                            const DeltaSignature* sig) {
+  uint32_t block_size = sig->block_size;
+  uint64_t i = 0;
+  uint64_t literal_start = 0;
+  bool has_literal = false;
+
+  while (i < new_size) {
+    uint32_t window_len = (uint32_t)((new_size - i < block_size) ? (new_size - i) : block_size);
+    bool full_window = (window_len == block_size);
+
+    uint32_t matched = REF_NO_MATCH;
+    if (full_window) {
+      uint32_t adler = delta_adler32(new_data + i, window_len);
+      for (uint32_t j = 0; j < sig->block_count; j++) {
+        if (sig->blocks[j].adler32 == adler &&
+            delta_xxhash32(new_data + i, window_len) == sig->blocks[j].xxhash) {
+          matched = j;
+          break;
+        }
+      }
+    }
+
+    if (matched != REF_NO_MATCH) {
+      if (has_literal) {
+        if (!ref_delta_flush_literal(ref, new_data, literal_start, i))
+          return false;
+        has_literal = false;
+      }
+      DeltaInstruction instr = {
+          .type = DELTA_INSTR_BLOCK_MATCH,
+          .match = {.block_index = matched, .block_offset = 0, .length = window_len},
+      };
+      if (!ref_delta_push(ref, instr))
+        return false;
+      i += window_len;
+    } else {
+      if (!has_literal) {
+        literal_start = i;
+        has_literal = true;
+      }
+      i++;
+    }
+  }
+
+  if (has_literal && !ref_delta_flush_literal(ref, new_data, literal_start, new_size))
+    return false;
+  return true;
+}
+
+static bool ref_delta_matches(const RefDelta* ref, const Delta* delta) {
+  if (ref->count != delta->instruction_count)
+    return false;
+  for (uint32_t i = 0; i < ref->count; i++) {
+    const DeltaInstruction* a = &ref->items[i];
+    const DeltaInstruction* b = &delta->instructions[i];
+    if (a->type != b->type)
+      return false;
+    if (a->type == DELTA_INSTR_BLOCK_MATCH) {
+      if (a->match.block_index != b->match.block_index ||
+          a->match.block_offset != b->match.block_offset || a->match.length != b->match.length)
+        return false;
+    } else {
+      if (a->literal.length != b->literal.length ||
+          memcmp(a->literal.data, b->literal.data, a->literal.length) != 0)
+        return false;
+    }
+  }
+  return true;
+}
+
+static void expect_linear_reference_match(const uint8_t* old_data, uint64_t old_size,
+                                          const uint8_t* new_data, uint64_t new_size,
+                                          uint32_t block_size, const char* label) {
+  DeltaSignature* sig = delta_signature_create(old_data, old_size, block_size);
+  if (!sig) {
+    printf("      [FAIL] %s: signature creation failed\n", label);
+    EXPECT_NOT_NULL(sig);
+    return;
+  }
+  Delta* delta = delta_compute(new_data, new_size, sig, block_size);
+  if (!delta) {
+    printf("      [FAIL] %s: delta_compute returned NULL\n", label);
+    delta_signature_destroy(sig);
+    EXPECT_NOT_NULL(delta);
+    return;
+  }
+  RefDelta ref = {0};
+  bool ok = ref_delta_build(&ref, new_data, new_size, sig);
+  if (ok)
+    ok = ref_delta_matches(&ref, delta);
+  if (!ok) {
+    printf("      [FAIL] %s: instruction stream differs from linear reference "
+           "(linear=%u indexed=%u)\n",
+           label, ref.count, delta->instruction_count);
+  }
+  ref_delta_free(&ref);
+  delta_destroy(delta);
+  delta_signature_destroy(sig);
+  EXPECT_TRUE(ok);
+}
+
+static void fill_delta_pattern(uint8_t* buf, uint64_t size, uint32_t seed) {
+  uint32_t x = seed ? seed : 1;
+  for (uint64_t i = 0; i < size; i++) {
+    x ^= x << 13;
+    x ^= x >> 17;
+    x ^= x << 5;
+    buf[i] = (uint8_t)(x >> 24);
+  }
+}
+
+static void test_delta_hash_index_matches_linear_reference() {
+  /* Identical file (full block alignment). */
+  uint8_t old_a[32768];
+  uint8_t new_a[32768];
+  fill_delta_pattern(old_a, sizeof(old_a), 42);
+  memcpy(new_a, old_a, sizeof(old_a));
+  expect_linear_reference_match(old_a, sizeof(old_a), new_a, sizeof(new_a), 2048,
+                                "identical 32KiB @ 2KiB");
+
+  /* Scattered single-byte edits in the middle of each block. */
+  uint8_t new_b[32768];
+  memcpy(new_b, old_a, sizeof(old_a));
+  for (size_t p = 100; p < sizeof(new_b); p += 4096)
+    new_b[p] ^= 0x5A;
+  expect_linear_reference_match(old_a, sizeof(old_a), new_b, sizeof(new_b), 2048,
+                                "32KiB scattered single-byte edits @ 2KiB");
+
+  /* Non-aligned old file (partial final block) with a single edit. */
+  uint8_t old_c[30000];
+  uint8_t new_c[30000];
+  fill_delta_pattern(old_c, sizeof(old_c), 7);
+  memcpy(new_c, old_c, sizeof(old_c));
+  new_c[15000] ^= 0x3C;
+  expect_linear_reference_match(old_c, sizeof(old_c), new_c, sizeof(new_c), 2048,
+                                "30KiB partial-tail single edit @ 2KiB");
+
+  /* Growth: appended data after an identical prefix. */
+  uint8_t old_d[24576];
+  uint8_t new_d[34576];
+  fill_delta_pattern(old_d, sizeof(old_d), 11);
+  memcpy(new_d, old_d, sizeof(old_d));
+  fill_delta_pattern(new_d + sizeof(old_d), sizeof(new_d) - sizeof(old_d), 23);
+  expect_linear_reference_match(old_d, sizeof(old_d), new_d, sizeof(new_d), 2048,
+                                "24KiB -> 34KiB appended @ 2KiB");
+
+  /* Insertion shifting everything after the edit point (rsync re-sync). */
+  uint8_t old_e[65536];
+  uint8_t new_e[65536 + 3000];
+  fill_delta_pattern(old_e, sizeof(old_e), 99);
+  memcpy(new_e, old_e, 20000);
+  fill_delta_pattern(new_e + 20000, 3000, 101);
+  memcpy(new_e + 23000, old_e + 20000, sizeof(old_e) - 20000);
+  expect_linear_reference_match(old_e, sizeof(old_e), new_e, sizeof(new_e), 2048,
+                                "64KiB + 3KiB insertion @ 2KiB");
+
+  /* Deletion shrinking the file. */
+  uint8_t new_f[sizeof(old_e) - 5000];
+  memcpy(new_f, old_e, 30000);
+  memcpy(new_f + 30000, old_e + 35000, sizeof(old_e) - 35000);
+  expect_linear_reference_match(old_e, sizeof(old_e), new_f, sizeof(new_f), 2048,
+                                "64KiB - 5KiB deletion @ 2KiB");
+
+  /* Repeated identical blocks must resolve to the lowest block index. */
+  uint8_t old_g[4 * 4096];
+  uint8_t new_g[4 * 4096];
+  for (uint32_t b = 0; b < 4; b++)
+    fill_delta_pattern(old_g + b * 4096, 4096, b % 2 == 0 ? 500 : 501); /* block0==block2 */
+  memcpy(new_g, old_g, sizeof(old_g));
+  new_g[4096 + 5] ^= 0x11; /* edit inside the second (duplicated) chunk */
+  expect_linear_reference_match(old_g, sizeof(old_g), new_g, sizeof(new_g), 4096,
+                                "duplicated chunks @ 4KiB");
+
+  /* Block larger than the file: nothing can match, all literal. */
+  uint8_t old_h[1000];
+  uint8_t new_h[1000];
+  fill_delta_pattern(old_h, sizeof(old_h), 3);
+  memcpy(new_h, old_h, sizeof(old_h));
+  expect_linear_reference_match(old_h, sizeof(old_h), new_h, sizeof(new_h), 4096,
+                                "1KiB file @ 4KiB block");
+}
+
+static void test_delta_hash_index_large_mostly_matching() {
+  const uint64_t size = 4ULL * 1024 * 1024;
+  const uint32_t block_size = 8192;
+
+  uint8_t* old_data = malloc((size_t)size);
+  uint8_t* new_data = malloc((size_t)size);
+  EXPECT_TRUE(old_data != NULL && new_data != NULL);
+
+  fill_delta_pattern(old_data, size, 1234);
+  memcpy(new_data, old_data, (size_t)size);
+
+  /* Scattered single-byte changes across the whole buffer.  Each change forces
+   * the diff to re-synchronise by walking one byte at a time through the
+   * affected block, which is exactly the case that used to cost O(bytes x
+   * blocks) with the linear scan. */
+  const uint64_t nchanges = 64;
+  for (uint64_t c = 0; c < nchanges; c++) {
+    uint64_t pos = (c * (size / nchanges)) + (c % 17);
+    new_data[pos] ^= (uint8_t)(0xA0 + (c % 16));
+  }
+
+  DeltaSignature* sig = delta_signature_create(old_data, size, block_size);
+  EXPECT_NOT_NULL(sig);
+  EXPECT_EQ_INT((int)sig->block_count, (int)(size / block_size));
+
+  Delta* delta = delta_compute(new_data, size, sig, block_size);
+  EXPECT_NOT_NULL(delta);
+  EXPECT_EQ_INT((int)delta->new_file_size, (int)size);
+
+  uint32_t match_count = 0;
+  for (uint32_t i = 0; i < delta->instruction_count; i++)
+    if (delta->instructions[i].type == DELTA_INSTR_BLOCK_MATCH)
+      match_count++;
+  EXPECT_TRUE(match_count > 0);
+
+  void* result = delta_apply(old_data, size, delta, block_size);
+  EXPECT_NOT_NULL(result);
+  EXPECT_EQ_INT(memcmp(result, new_data, (size_t)size), 0);
+
+  free(result);
+  delta_destroy(delta);
+  delta_signature_destroy(sig);
+  free(old_data);
+  free(new_data);
+}
+
 void test_delta() {
   test_adler32_basic();
   test_adler32_different_data();
@@ -360,4 +651,6 @@ void test_delta() {
   test_is_worthwhile();
   test_large_file_delta();
   test_delta_apply_rejects_output_overflow();
+  test_delta_hash_index_matches_linear_reference();
+  test_delta_hash_index_large_mostly_matching();
 }

tests/test_file.c

@@ -1,13 +1,16 @@
 #include "test_file.h"
 #include "file.h"
 #include "data.h"
+#include "config.h"
 #include "utils.h"
 #include "protocol.h"
 #include "test_utils.h"
+#include <fcntl.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
+#include <time.h>
 #include <unistd.h>
 
 static void test_file_create() {
@@ -34,7 +37,8 @@ static void test_file_destroy_normal() {
 
 static void test_file_load_data() {
   const char* content = "Hello Load Test";
-  EXPECT_TRUE(to_disk("test_file_load_data.txt", content, strlen(content), false, false));
+  EXPECT_TRUE(
+      file_write_to_disk("test_file_load_data.txt", content, strlen(content), false, false));
 
   struct stat st;
   EXPECT_EQ_INT(stat("test_file_load_data.txt", &st), 0);
@@ -87,15 +91,282 @@ static void test_file_save_to_disk() {
   rmdir("test_save_tmp");
 }
 
-static void test_to_disk_basic() {
+static void test_file_save_to_disk_with_fsync_config() {
-  const char* content = "Basic to_disk test";
+  File* f = file_create("saved_file_fsync.txt");
-  EXPECT_TRUE(to_disk("test_to_disk_basic.txt", content, strlen(content), false, false));
+  EXPECT_NOT_NULL(f);
+  const char* content = "Save to disk with fsync";
+  f->data->data = malloc(strlen(content));
+  EXPECT_NOT_NULL(f->data->data);
+  memcpy(f->data->data, content, strlen(content));
+  f->data->size = strlen(content);
+
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  config->use_fsync = true;
+  EXPECT_TRUE(file_save_to_disk("test_save_fsync_tmp", f, config));
 
   struct stat st;
-  EXPECT_EQ_INT(stat("test_to_disk_basic.txt", &st), 0);
+  EXPECT_EQ_INT(stat("test_save_fsync_tmp/saved_file_fsync.txt", &st), 0);
   EXPECT_EQ_INT((int)st.st_size, (int)strlen(content));
 
-  FILE* fp = fopen("test_to_disk_basic.txt", "rb");
+  file_destroy(f);
+  config_delete(config);
+  unlink("test_save_fsync_tmp/saved_file_fsync.txt");
+  rmdir("test_save_fsync_tmp");
+}
+
+static void test_file_save_to_disk_existing() {
+  const char* root = "test_existing_tmp";
+  const char* existing_path = "test_existing_tmp/existing.txt";
+  const char* missing_path = "test_existing_tmp/missing.txt";
+  EXPECT_TRUE(file_write_to_disk(existing_path, "old", 3, false, false));
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->existing = true;
+
+  File* existing = file_create("existing.txt");
+  EXPECT_NOT_NULL(existing);
+  existing->data->data = malloc(3);
+  EXPECT_NOT_NULL(existing->data->data);
+  memcpy(existing->data->data, "new", 3);
+  existing->data->size = 3;
+  EXPECT_TRUE(file_save_to_disk(root, existing, cfg));
+  file_destroy(existing);
+
+  File* missing = file_create("missing.txt");
+  EXPECT_NOT_NULL(missing);
+  missing->data->data = malloc(7);
+  EXPECT_NOT_NULL(missing->data->data);
+  memcpy(missing->data->data, "skipped", 7);
+  missing->data->size = 7;
+  EXPECT_TRUE(file_save_to_disk(root, missing, cfg));
+  file_destroy(missing);
+
+  FILE* fp = fopen(existing_path, "rb");
+  char content[4] = {0};
+  EXPECT_NOT_NULL(fp);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (fp) {
+    EXPECT_EQ_INT((int)fread(content, 1, 3, fp), 3);
+    fclose(fp);
+  }
+  EXPECT_EQ_STR(content, "new");
+  EXPECT_EQ_INT(access(missing_path, F_OK), -1);
+
+  config_delete(cfg);
+  unlink(existing_path);
+  rmdir("test_existing_tmp");
+}
+
+static void test_file_save_to_disk_ignore_existing() {
+  const char* path = "test_ignore_existing_tmp/existing.txt";
+  EXPECT_TRUE(file_write_to_disk(path, "old", 3, false, false));
+
+  File* file = file_create("existing.txt");
+  EXPECT_NOT_NULL(file);
+  file->data->data = malloc(3);
+  EXPECT_NOT_NULL(file->data->data);
+  memcpy(file->data->data, "new", 3);
+  file->data->size = 3;
+
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  config->ignore_existing = true;
+  EXPECT_TRUE(file_save_to_disk("test_ignore_existing_tmp", file, config));
+
+  FILE* stream = fopen(path, "rb");
+  char content[4] = {0};
+  EXPECT_NOT_NULL(stream);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (stream) {
+    EXPECT_EQ_INT((int)fread(content, 1, 3, stream), 3);
+    fclose(stream);
+  }
+  EXPECT_EQ_STR(content, "old");
+
+  file_destroy(file);
+  config_delete(config);
+  unlink(path);
+  rmdir("test_ignore_existing_tmp");
+}
+
+static void test_file_save_to_disk_ignore_existing_entry_types() {
+  const char* root = "test_ignore_existing_entries_tmp";
+  const char* directory = "test_ignore_existing_entries_tmp/directory";
+  const char* link = "test_ignore_existing_entries_tmp/link";
+  const char* target = "test_ignore_existing_entries_tmp/target";
+  const char* backup = "test_ignore_existing_entries_tmp/backup.txt~";
+  const char* backup_file = "test_ignore_existing_entries_tmp/backup.txt";
+  Config* config = config_create();
+  File* file = file_create("unused");
+
+  unlink(link);
+  unlink(target);
+  unlink(backup);
+  unlink(backup_file);
+  rmdir(directory);
+  rmdir(root);
+  EXPECT_NOT_NULL(config);
+  EXPECT_NOT_NULL(file);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (!config || !file)
+    return;
+  config->ignore_existing = true;
+  config->backup = true;
+  file->data->data = malloc(3);
+  EXPECT_NOT_NULL(file->data->data);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (!file->data->data) {
+    file_destroy(file);
+    config_delete(config);
+    return;
+  }
+  memcpy(file->data->data, "new", 3);
+  file->data->size = 3;
+
+  EXPECT_EQ_INT(mkdir(root, 0755), 0);
+  EXPECT_EQ_INT(mkdir(directory, 0755), 0);
+  EXPECT_TRUE(file_write_to_disk(target, "old", 3, false, false));
+  EXPECT_EQ_INT(symlink("target", link), 0);
+  free(file->path);
+  file->path = str_dup("directory");
+  EXPECT_TRUE(file_save_to_disk(root, file, config));
+  free(file->path);
+  file->path = str_dup("link");
+  EXPECT_TRUE(file_save_to_disk(root, file, config));
+
+  free(file->path);
+  file->path = str_dup("backup.txt");
+  EXPECT_TRUE(file_write_to_disk(backup_file, "old", 3, false, false));
+  EXPECT_TRUE(file_save_to_disk(root, file, config));
+  EXPECT_TRUE(file_path_exists_secure(backup_file));
+  EXPECT_FALSE(file_path_exists_secure(backup));
+
+  file_destroy(file);
+  config_delete(config);
+  unlink(link);
+  unlink(target);
+  unlink(backup_file);
+  rmdir(directory);
+  rmdir(root);
+}
+
+/* Issue #253: with --partial --partial-dir a completed write must be installed
+   at the real destination rather than left under the partial directory. */
+static void test_file_save_to_disk_partial_install() {
+  const char* root = "test_partial_install_tmp";
+  const char* dest_file = "test_partial_install_tmp/file.txt";
+  const char* partial_file = "test_partial_install_tmp/.partial/file.txt";
+  unlink(dest_file);
+  unlink(partial_file);
+  rmdir("test_partial_install_tmp/.partial");
+  rmdir(root);
+
+  File* f = file_create("file.txt");
+  EXPECT_NOT_NULL(f);
+  const char* content = "partial-dir content";
+  f->data->data = malloc(strlen(content));
+  EXPECT_NOT_NULL(f->data->data);
+  memcpy(f->data->data, content, strlen(content));
+  f->data->size = strlen(content);
+
+  Config* config = config_create();
+  EXPECT_NOT_NULL(config);
+  config->partial = true;
+  config->partial_dir = str_dup(".partial");
+
+  EXPECT_EQ_INT(file_save_to_disk_full(root, f, config), FILE_SAVE_WRITTEN);
+
+  FILE* fp = fopen(dest_file, "rb");
+  EXPECT_NOT_NULL(fp);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (fp) {
+    char buf[64] = {0};
+    size_t nread = fread(buf, 1, sizeof(buf) - 1, fp);
+    fclose(fp);
+    EXPECT_EQ_INT((int)nread, (int)strlen(content));
+    EXPECT_EQ_INT(memcmp(buf, content, strlen(content)), 0);
+  }
+  /* A completed transfer must not linger under the partial dir. */
+  EXPECT_EQ_INT(access(partial_file, F_OK), -1);
+
+  file_destroy(f);
+  config_delete(config);
+  unlink(dest_file);
+  rmdir(root);
+}
+
+/* Issue #251: file_save_to_disk_full must distinguish receiver-side skips
+   (--existing/--ignore-existing/--update) from real writes so the sender can
+   decide whether --remove-source-files may unlink its source. */
+static void test_file_save_to_disk_reports_skips() {
+  const char* root = "test_save_skip_tmp";
+  const char* existing_path = "test_save_skip_tmp/existing.txt";
+  unlink(existing_path);
+  rmdir(root);
+  EXPECT_TRUE(file_write_to_disk(existing_path, "old", 3, false, false));
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+
+  File* new_file = file_create("missing.txt");
+  EXPECT_NOT_NULL(new_file);
+  new_file->data->data = malloc(7);
+  EXPECT_NOT_NULL(new_file->data->data);
+  memcpy(new_file->data->data, "skipped", 7);
+  new_file->data->size = 7;
+
+  /* --existing: destination is missing -> skipped, not an error. */
+  cfg->existing = true;
+  EXPECT_EQ_INT(file_save_to_disk_full(root, new_file, cfg), FILE_SAVE_SKIPPED);
+  cfg->existing = false;
+
+  /* --ignore-existing: destination present -> skipped. */
+  File* present = file_create("existing.txt");
+  EXPECT_NOT_NULL(present);
+  present->data->data = malloc(3);
+  EXPECT_NOT_NULL(present->data->data);
+  memcpy(present->data->data, "new", 3);
+  present->data->size = 3;
+  cfg->ignore_existing = true;
+  EXPECT_EQ_INT(file_save_to_disk_full(root, present, cfg), FILE_SAVE_SKIPPED);
+  cfg->ignore_existing = false;
+
+  /* A normal overwrite of an existing file is a real write. */
+  EXPECT_EQ_INT(file_save_to_disk_full(root, present, cfg), FILE_SAVE_WRITTEN);
+
+  /* --update: a newer destination is skipped. */
+  struct stat st;
+  EXPECT_EQ_INT(stat(existing_path, &st), 0);
+  time_t now = time(NULL);
+  FileMetadata metadata = {.mode = st.st_mode,
+                           .uid = st.st_uid,
+                           .gid = st.st_gid,
+                           .mtime_sec = now - 100,
+                           .mtime_nsec = 0};
+  present->metadata = &metadata;
+  cfg->update = true;
+  EXPECT_EQ_INT(file_save_to_disk_full(root, present, cfg), FILE_SAVE_SKIPPED);
+  present->metadata = NULL;
+
+  file_destroy(new_file);
+  file_destroy(present);
+  config_delete(cfg);
+  unlink(existing_path);
+  rmdir(root);
+}
+
+static void test_file_write_to_disk_basic() {
+  const char* content = "Basic file_write_to_disk test";
+  EXPECT_TRUE(file_write_to_disk("test_file_write_to_disk_basic.txt", content, strlen(content),
+                                 false, false));
+
+  struct stat st;
+  EXPECT_EQ_INT(stat("test_file_write_to_disk_basic.txt", &st), 0);
+  EXPECT_EQ_INT((int)st.st_size, (int)strlen(content));
+
+  FILE* fp = fopen("test_file_write_to_disk_basic.txt", "rb");
   EXPECT_NOT_NULL(fp);
   char buf[100];
   size_t nread = fread(buf, 1, sizeof(buf), fp);
@@ -103,12 +374,24 @@ static void test_to_disk_basic() {
   EXPECT_EQ_INT((int)nread, (int)strlen(content));
   EXPECT_EQ_INT(memcmp(buf, content, strlen(content)), 0);
 
-  unlink("test_to_disk_basic.txt");
+  unlink("test_file_write_to_disk_basic.txt");
 }
 
-static void test_to_disk_creates_dirs() {
+static void test_file_write_to_disk_with_fsync() {
+  const char* path = "test_file_write_to_disk_fsync.txt";
+  const char* content = "fsync file content";
+  EXPECT_TRUE(file_to_disk_secure_with_fsync(path, content, strlen(content), false, false, NULL,
+                                             false, true));
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  EXPECT_EQ_INT((int)st.st_size, (int)strlen(content));
+  unlink(path);
+}
+
+static void test_file_write_to_disk_creates_dirs() {
   const char* content = "Nested dir test";
-  EXPECT_TRUE(to_disk("test_nested_tmp/nested/file.txt", content, strlen(content), false, false));
+  EXPECT_TRUE(file_write_to_disk("test_nested_tmp/nested/file.txt", content, strlen(content), false,
+                                 false));
 
   struct stat st;
   EXPECT_EQ_INT(stat("test_nested_tmp/nested/file.txt", &st), 0);
@@ -126,15 +409,15 @@ static void test_to_disk_creates_dirs() {
   rmdir("test_nested_tmp");
 }
 
-static void test_to_disk_does_not_follow_symlink() {
+static void test_file_write_to_disk_does_not_follow_symlink() {
-  const char* outside = "test_to_disk_outside.txt";
+  const char* outside = "test_file_write_to_disk_outside.txt";
-  const char* link = "test_to_disk_link.txt";
+  const char* link = "test_file_write_to_disk_link.txt";
   const char* content = "confined";
   unlink(outside);
   unlink(link);
-  EXPECT_TRUE(to_disk(outside, "outside", 7, false, false));
+  EXPECT_TRUE(file_write_to_disk(outside, "outside", 7, false, false));
   EXPECT_EQ_INT(symlink(outside, link), 0);
-  EXPECT_TRUE(to_disk(link, content, strlen(content), false, false));
+  EXPECT_TRUE(file_write_to_disk(link, content, strlen(content), false, false));
   FILE* fp = fopen(outside, "rb");
   char buf[16] = {0};
   EXPECT_NOT_NULL(fp);
@@ -151,7 +434,7 @@ static void test_to_disk_does_not_follow_symlink() {
 
 static void test_file_content_to_buffer() {
   const char* content = "Buffer content test";
-  EXPECT_TRUE(to_disk("test_buffer_file.txt", content, strlen(content), false, false));
+  EXPECT_TRUE(file_write_to_disk("test_buffer_file.txt", content, strlen(content), false, false));
 
   File* f = file_create("test_buffer_file.txt");
   EXPECT_NOT_NULL(f);
@@ -273,7 +556,7 @@ static void test_file_send_no_path() {
 }
 
 static void test_file_metadata_create() {
-  EXPECT_TRUE(to_disk("test_meta_file.txt", "metadata test", 13, false, false));
+  EXPECT_TRUE(file_write_to_disk("test_meta_file.txt", "metadata test", 13, false, false));
   struct stat st;
   EXPECT_EQ_INT(stat("test_meta_file.txt", &st), 0);
 
@@ -382,7 +665,7 @@ static void test_file_send_single_calls_metadata_and_path() {
   /* Create a real file on disk so we can have metadata */
   const char* content = "File with metadata";
   size_t len = strlen(content);
-  EXPECT_TRUE(to_disk("test_meta_send.txt", content, len, false, false));
+  EXPECT_TRUE(file_write_to_disk("test_meta_send.txt", content, len, false, false));
 
   struct stat st;
   EXPECT_EQ_INT(stat("test_meta_send.txt", &st), 0);
@@ -448,6 +731,161 @@ static void test_file_send_single_calls_metadata_and_path() {
   }
 }
 
+static void test_inplace_overwrite_clears_special_mode_bits() {
+  const char* root = "test_inplace_tmp";
+  const char* path = "test_inplace_tmp/priv.txt";
+  const char* content = "olddata";
+  unlink(path);
+  rmdir(root);
+  EXPECT_EQ_INT(mkdir(root, 0700), 0);
+
+  /* Create a destination carrying setuid + sticky bits. */
+  int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0644);
+  EXPECT_TRUE(fd >= 0);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (fd < 0) {
+    rmdir(root);
+    return;
+  }
+  EXPECT_EQ_INT((int)write(fd, content, strlen(content)), (int)strlen(content));
+  EXPECT_EQ_INT(fchmod(fd, S_ISUID | S_ISVTX | 0755), 0);
+  EXPECT_EQ_INT(close(fd), 0);
+
+  /* Overwrite in place without metadata: the mode must be normalized to a
+     safe default (0644) and the setuid/sticky bits must be gone. */
+  File* f = file_create("priv.txt");
+  EXPECT_NOT_NULL(f);
+  const char* new_content = "newdata";
+  f->data->data = malloc(strlen(new_content));
+  EXPECT_NOT_NULL(f->data->data);
+  memcpy(f->data->data, new_content, strlen(new_content));
+  f->data->size = strlen(new_content);
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->inplace = true;
+  EXPECT_TRUE(file_save_to_disk(root, f, cfg));
+  file_destroy(f);
+  config_delete(cfg);
+
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  EXPECT_EQ_INT((int)(st.st_mode & (S_ISUID | S_ISGID | S_ISVTX)), 0);
+  EXPECT_EQ_INT((int)(st.st_mode & 0777), 0644);
+  FILE* stream = fopen(path, "rb");
+  char buf[16] = {0};
+  EXPECT_NOT_NULL(stream);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (stream) {
+    size_t nread = fread(buf, 1, sizeof(buf) - 1, stream);
+    fclose(stream);
+    EXPECT_EQ_INT((int)nread, (int)strlen(new_content));
+  }
+  EXPECT_EQ_STR(buf, new_content);
+
+  unlink(path);
+  rmdir(root);
+}
+
+static void test_inplace_overwrite_metadata_strips_special_bits() {
+  const char* root = "test_inplace_meta_tmp";
+  const char* path = "test_inplace_meta_tmp/meta.txt";
+  const char* source = "test_inplace_meta_source.txt";
+  unlink(path);
+  unlink(source);
+  rmdir(root);
+  EXPECT_EQ_INT(mkdir(root, 0700), 0);
+
+  /* Existing destination with setuid+sticky set. */
+  int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0644);
+  EXPECT_TRUE(fd >= 0);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (fd < 0) {
+    rmdir(root);
+    return;
+  }
+  EXPECT_EQ_INT((int)write(fd, "olddata", 7), 7);
+  EXPECT_EQ_INT(fchmod(fd, S_ISUID | S_ISVTX | 0755), 0);
+  EXPECT_EQ_INT(close(fd), 0);
+
+  /* Build source metadata carrying a plain executable mode (no specials). */
+  EXPECT_TRUE(file_write_to_disk(source, "source", 6, false, false));
+  EXPECT_EQ_INT(chmod(source, 0755), 0);
+  struct stat source_st;
+  EXPECT_EQ_INT(stat(source, &source_st), 0);
+
+  File* f = file_create("meta.txt");
+  EXPECT_NOT_NULL(f);
+  const char* new_content = "meta";
+  f->data->data = malloc(strlen(new_content));
+  EXPECT_NOT_NULL(f->data->data);
+  memcpy(f->data->data, new_content, strlen(new_content));
+  f->data->size = strlen(new_content);
+  f->metadata = file_metadata_create(&source_st);
+  EXPECT_NOT_NULL(f->metadata);
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->inplace = true;
+  EXPECT_TRUE(file_save_to_disk(root, f, cfg));
+  file_destroy(f);
+  config_delete(cfg);
+  unlink(source);
+
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  /* Metadata-derived mode is applied and never includes setuid/setgid/sticky. */
+  EXPECT_EQ_INT((int)(st.st_mode & (S_ISUID | S_ISGID | S_ISVTX)), 0);
+  EXPECT_EQ_INT((int)(st.st_mode & 0777), 0755);
+
+  unlink(path);
+  rmdir(root);
+}
+
+static void test_inplace_overwrite_truncates_shorter_payload() {
+  const char* root = "test_inplace_trunc_tmp";
+  const char* path = "test_inplace_trunc_tmp/big.txt";
+  unlink(path);
+  rmdir(root);
+  EXPECT_EQ_INT(mkdir(root, 0700), 0);
+
+  const char* old_content = "0123456789abcdef"; /* 16 bytes */
+  EXPECT_TRUE(file_write_to_disk(path, old_content, strlen(old_content), false, false));
+
+  File* f = file_create("big.txt");
+  EXPECT_NOT_NULL(f);
+  const char* new_content = "hi";
+  f->data->data = malloc(strlen(new_content));
+  EXPECT_NOT_NULL(f->data->data);
+  memcpy(f->data->data, new_content, strlen(new_content));
+  f->data->size = strlen(new_content);
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->inplace = true;
+  EXPECT_TRUE(file_save_to_disk(root, f, cfg));
+  file_destroy(f);
+  config_delete(cfg);
+
+  /* A shorter payload must truncate the file: no stale trailing bytes. */
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  EXPECT_EQ_INT((int)st.st_size, (int)strlen(new_content));
+  FILE* stream = fopen(path, "rb");
+  char buf[32] = {0};
+  EXPECT_NOT_NULL(stream);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (stream) {
+    size_t nread = fread(buf, 1, sizeof(buf) - 1, stream);
+    fclose(stream);
+    EXPECT_EQ_INT((int)nread, (int)strlen(new_content));
+  }
+  EXPECT_EQ_STR(buf, new_content);
+
+  unlink(path);
+  rmdir(root);
+}
+
 void test_file() {
   test_file_create();
   test_file_destroy_null();
@@ -455,9 +893,16 @@ void test_file() {
   test_file_load_data();
   test_file_load_data_missing_file();
   test_file_save_to_disk();
-  test_to_disk_basic();
+  test_file_save_to_disk_with_fsync_config();
-  test_to_disk_creates_dirs();
+  test_file_save_to_disk_existing();
-  test_to_disk_does_not_follow_symlink();
+  test_file_save_to_disk_ignore_existing();
+  test_file_save_to_disk_ignore_existing_entry_types();
+  test_file_save_to_disk_partial_install();
+  test_file_save_to_disk_reports_skips();
+  test_file_write_to_disk_basic();
+  test_file_write_to_disk_with_fsync();
+  test_file_write_to_disk_creates_dirs();
+  test_file_write_to_disk_does_not_follow_symlink();
   test_file_content_to_buffer();
   test_file_save_to_disk_path_traversal();
   test_file_save_to_disk_deep_traversal();
@@ -473,4 +918,7 @@ void test_file() {
     test_file_send_single_calls_metadata_and_path();
   }
   test_file_metadata_create();
+  test_inplace_overwrite_clears_special_mode_bits();
+  test_inplace_overwrite_metadata_strips_special_bits();
+  test_inplace_overwrite_truncates_shorter_payload();
 }

tests/test_file_sendfile.c

@@ -15,7 +15,7 @@
 static void test_sendfile_basic() {
   const char* content = "Hello from sendfile test!";
   size_t len = strlen(content);
-  EXPECT_TRUE(to_disk("test_sendfile_basic.txt", content, len, false, false));
+  EXPECT_TRUE(file_write_to_disk("test_sendfile_basic.txt", content, len, false, false));
 
   File* file = file_create("test_sendfile_basic.txt");
   EXPECT_NOT_NULL(file);
@@ -77,7 +77,7 @@ static void test_sendfile_basic() {
 static void test_sendfile_empty_file() {
   const char* content = "";
   size_t len = 0;
-  EXPECT_TRUE(to_disk("test_sendfile_empty.txt", content, len, false, false));
+  EXPECT_TRUE(file_write_to_disk("test_sendfile_empty.txt", content, len, false, false));
 
   File* file = file_create("test_sendfile_empty.txt");
   EXPECT_NOT_NULL(file);
@@ -156,7 +156,7 @@ static void test_sendfile_missing_file() {
 static void test_sendfile_compression_fallback() {
   const char* content = "Compression fallback content";
   size_t len = strlen(content);
-  EXPECT_TRUE(to_disk("test_sendfile_comp.txt", content, len, false, false));
+  EXPECT_TRUE(file_write_to_disk("test_sendfile_comp.txt", content, len, false, false));
 
   struct stat st;
   EXPECT_EQ_INT(stat("test_sendfile_comp.txt", &st), 0);
@@ -222,7 +222,7 @@ static void test_sendfile_compression_fallback() {
 static void test_sendfile_no_path() {
   const char* content = "No path sendfile test";
   size_t len = strlen(content);
-  EXPECT_TRUE(to_disk("test_sendfile_nopath.txt", content, len, false, false));
+  EXPECT_TRUE(file_write_to_disk("test_sendfile_nopath.txt", content, len, false, false));
 
   File* file = file_create("test_sendfile_nopath.txt");
   EXPECT_NOT_NULL(file);

tests/test_fuzz_smoke.c

@@ -101,7 +101,7 @@ static void test_fuzz_delta_deserialize() {
 /* Smoke test for metadata_from_buf fuzz target */
 static void test_fuzz_metadata_from_buf() {
   /* Create a real file to get metadata from */
-  EXPECT_TRUE(to_disk("fuzz_meta_test.txt", "metadata test", 13, false, false));
+  EXPECT_TRUE(file_write_to_disk("fuzz_meta_test.txt", "metadata test", 13, false, false));
 
   struct stat st;
   EXPECT_EQ_INT(stat("fuzz_meta_test.txt", &st), 0);

tests/test_log.c

@@ -1,6 +1,8 @@
 #include "test_log.h"
 #include "log.h"
 #include "test_utils.h"
+#include <string.h>
+#include <unistd.h>
 
 /* Test default log level: WARNING and ERROR should print, DEBUG and INFO should not.
  * We can't easily capture stderr in unit tests, so we verify the functions don't crash
@@ -90,6 +92,29 @@ static void test_log_filtering() {
   EXPECT_TRUE(true);
 }
 
+static void test_log_stderr_mode_all() {
+  int pipe_fds[2];
+  EXPECT_EQ_INT(pipe(pipe_fds), 0);
+  int saved_stderr = dup(STDERR_FILENO);
+  EXPECT_TRUE(saved_stderr >= 0);
+  EXPECT_TRUE(dup2(pipe_fds[1], STDERR_FILENO) >= 0);
+  close(pipe_fds[1]);
+
+  set_log_level(LOG_LEVEL_WARNING);
+  log_set_stderr_mode(LOG_STDERR_ALL);
+  log_message(LOG_LEVEL_WARNING, "warning routed to stderr");
+  fflush(stderr);
+
+  EXPECT_TRUE(dup2(saved_stderr, STDERR_FILENO) >= 0);
+  close(saved_stderr);
+  char output[128] = {0};
+  ssize_t length = read(pipe_fds[0], output, sizeof(output) - 1);
+  close(pipe_fds[0]);
+  EXPECT_TRUE(length > 0);
+  EXPECT_TRUE(strstr(output, "warning routed to stderr") != NULL);
+  log_set_stderr_mode(LOG_STDERR_ERRORS);
+}
+
 /* Test that log_message handles various format strings */
 static void test_log_message_formats() {
   set_log_level(LOG_LEVEL_DEBUG);
@@ -112,5 +137,6 @@ void test_log() {
   test_log_set_level_info();
   test_log_set_level_error();
   test_log_filtering();
+  test_log_stderr_mode_all();
   test_log_message_formats();
 }

tests/test_metadata.c

@@ -1,4 +1,5 @@
 #include "test_metadata.h"
+#include "chmod.h"
 #include "metadata.h"
 #include "protocol.h"
 #include "test_utils.h"
@@ -122,10 +123,22 @@ static void test_metadata_rejects_invalid_values() {
   close(p[1]);
 }
 
+static void test_metadata_mtime_window() {
+  EXPECT_TRUE(metadata_mtime_matches(100, 100000000, 101, 600000000, 2));
+  EXPECT_FALSE(metadata_mtime_matches(100, 100000000, 102, 600000000, 2));
+  EXPECT_TRUE(metadata_mtime_matches(100, 100000000, 102, 100000000, 2));
+  EXPECT_TRUE(metadata_mtime_matches(100, 900000000, 102, 100000000, 2));
+  EXPECT_FALSE(metadata_mtime_matches(100, 100000000, 102, 900000000, 2));
+  EXPECT_TRUE(metadata_mtime_matches(100, 900000000, 102, 900000000, 2));
+  EXPECT_FALSE(metadata_mtime_matches(100, 900000000, 101, 100000001, 0));
+  EXPECT_TRUE(metadata_mtime_matches(100, 100000000, 100, 100000001, 0));
+  EXPECT_TRUE(metadata_mtime_matches(100, 100000000, 100, 100000000, 0));
+}
+
 static void test_file_restore_metadata() {
   const char* path = "temp_meta_restore_test.txt";
   const char* content = "test content";
-  EXPECT_TRUE(to_disk(path, content, strlen(content), false, false));
+  EXPECT_TRUE(file_write_to_disk(path, content, strlen(content), false, false));
 
   FileMetadata m;
   m.mode = 0644;
@@ -134,7 +147,7 @@ static void test_file_restore_metadata() {
   m.mtime_sec = 1234567890;
   m.mtime_nsec = 0;
 
-  file_restore_metadata(path, &m);
+  file_restore_metadata(path, &m, false);
 
   struct stat st;
   EXPECT_EQ_INT(stat(path, &st), 0);
@@ -144,6 +157,56 @@ static void test_file_restore_metadata() {
   unlink(path);
 }
 
+static void test_file_restore_executability_only() {
+  const char* path = "temp_exec_restore_test.txt";
+  EXPECT_TRUE(file_write_to_disk(path, "x", 1, false, false));
+  EXPECT_EQ_INT(chmod(path, 0644), 0);
+
+  FileMetadata m = {
+      .mode = 0751, .uid = getuid(), .gid = getgid(), .mtime_sec = 0, .mtime_nsec = 0};
+  file_restore_metadata(path, &m, true);
+
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  EXPECT_EQ_INT(st.st_mode & 0777, 0755);
+  unlink(path);
+}
+
+static void test_directory_restore_executability_only() {
+  const char* path = "temp_exec_restore_test_dir";
+  EXPECT_EQ_INT(mkdir(path, 0700), 0);
+
+  FileMetadata m = {
+      .mode = 0755, .uid = getuid(), .gid = getgid(), .mtime_sec = 0, .mtime_nsec = 0};
+  file_restore_metadata(path, &m, true);
+
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  EXPECT_EQ_INT(st.st_mode & 0777, 0711);
+  rmdir(path);
+}
+
+static void test_chmod_changes() {
+  mode_t result;
+  EXPECT_TRUE(chmod_apply(0777, "u=rw,go=r", &result));
+  EXPECT_EQ_INT(result, 0644);
+  EXPECT_TRUE(chmod_apply(0644, "a+x", &result));
+  EXPECT_EQ_INT(result, 0755);
+  result = 0777;
+  EXPECT_TRUE(chmod_apply(0777, "0000", &result));
+  EXPECT_EQ_INT(result, 0000);
+  result = 0777;
+  EXPECT_TRUE(chmod_apply(0777, "7777", &result));
+  EXPECT_EQ_INT(result, 07777);
+  result = 0777;
+  EXPECT_TRUE(chmod_apply(0777, "755", &result));
+  EXPECT_EQ_INT(result, 0755);
+  EXPECT_FALSE(chmod_apply(0777, "888", &result));
+  EXPECT_FALSE(chmod_apply(0777, "10000", &result));
+  EXPECT_FALSE(chmod_apply(0777, "a+X", &result));
+  EXPECT_FALSE(chmod_apply(0777, "a+r,", &result));
+}
+
 void test_metadata() {
   test_metadata_to_from_buf_roundtrip();
   test_metadata_to_buf_null();
@@ -151,5 +214,9 @@ void test_metadata() {
   test_metadata_send_receive_roundtrip();
   test_metadata_send_null();
   test_metadata_rejects_invalid_values();
+  test_metadata_mtime_window();
   test_file_restore_metadata();
+  test_file_restore_executability_only();
+  test_directory_restore_executability_only();
+  test_chmod_changes();
 }

tests/test_multiprocessing.c

@@ -250,6 +250,87 @@ static void test_write_thread_done() {
   config_delete(cfg);
 }
 
+typedef struct {
+  PipelineContextReceiver* context;
+  File* file;
+  atomic_bool* done;
+  atomic_bool* result;
+} ByteBudgetEnqueueArg;
+
+static int byte_budget_enqueue_worker(void* arg) {
+  ByteBudgetEnqueueArg* worker = arg;
+  bool ok = pipeline_context_receiver_enqueue_file(worker->context, worker->file);
+  atomic_store(worker->result, ok);
+  atomic_store(worker->done, true);
+  return thrd_success;
+}
+
+/* A receiver must not buffer more decompressed/copied payload bytes ahead of
+   the (slow) disk writer than the configured byte budget: an enqueue that
+   would exceed the budget blocks until the writer releases bytes. */
+static void test_receiver_enqueue_byte_budget() {
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  free(cfg->version);
+  cfg->version = str_dup(PROTOCOL_VERSION);
+  cfg->send_directory = str_dup("/src");
+  cfg->receive_root_directory = str_dup("/dst");
+  cfg->save_to_disk = false;
+
+  Queue* q = queue_create(16, file_destroy);
+  EXPECT_NOT_NULL(q);
+  PipelineContextReceiver* ctx = pipeline_context_receiver_create(cfg, q, -1, NULL);
+  EXPECT_NOT_NULL(ctx);
+  pipeline_context_receiver_set_queue_byte_limit(ctx, 3000);
+  ctx->receiver_done = false;
+
+  File* first = file_create("budget_file_1");
+  EXPECT_NOT_NULL(first);
+  first->data->size = 2000;
+  EXPECT_TRUE(pipeline_context_receiver_enqueue_file(ctx, first));
+  EXPECT_EQ_INT((int)ctx->queued_bytes, 2000);
+
+  /* Second 2000-byte payload would push the pipeline to 4000 > 3000 budget,
+     so the enqueue must block until the first payload is released. */
+  File* second = file_create("budget_file_2");
+  EXPECT_NOT_NULL(second);
+  second->data->size = 2000;
+  atomic_bool done;
+  atomic_bool result;
+  atomic_init(&done, false);
+  atomic_init(&result, false);
+  ByteBudgetEnqueueArg arg = {ctx, second, &done, &result};
+  thrd_t enqueuer;
+  EXPECT_EQ_INT(thrd_create(&enqueuer, byte_budget_enqueue_worker, &arg), thrd_success);
+
+  /* Give a broken (unbounded) implementation every chance to enqueue. */
+  struct timespec wait = {0, 200 * 1000000L};
+  thrd_sleep(&wait, NULL);
+  EXPECT_FALSE(atomic_load(&done));
+  EXPECT_EQ_INT((int)ctx->queued_bytes, 2000); /* budget still honored */
+
+  /* Simulate the disk writer: dequeue + destroy + release the first file. */
+  File* drained = queue_dequeue_multithreaded(q, &ctx->mutex, &ctx->condition_not_empty,
+                                              &ctx->condition_not_full, &ctx->receiver_done);
+  EXPECT_NOT_NULL(drained);
+  file_destroy(drained);
+  pipeline_context_receiver_note_bytes_released(ctx, 2000);
+  EXPECT_EQ_INT((int)ctx->queued_bytes, 0);
+
+  EXPECT_EQ_INT(thrd_join(enqueuer, NULL), thrd_success);
+  EXPECT_TRUE(atomic_load(&done));
+  EXPECT_TRUE(atomic_load(&result));
+  EXPECT_EQ_INT((int)ctx->queued_bytes, 2000); /* second payload now in flight */
+
+  /* Tear down: the second file is still queued and is freed by queue_destroy. */
+  mtx_destroy(&ctx->mutex);
+  cnd_destroy(&ctx->condition_not_full);
+  cnd_destroy(&ctx->condition_not_empty);
+  free(ctx);
+  queue_destroy(q);
+  config_delete(cfg);
+}
+
 void test_multiprocessing() {
   test_sender_create_destroy();
   test_receiver_create_destroy();
@@ -261,4 +342,5 @@ void test_multiprocessing() {
     test_receive_thread_failure_wakes_writer();
   }
   test_write_thread_done();
+  test_receiver_enqueue_byte_budget();
 }

tests/test_property.c

@@ -14,6 +14,8 @@
 static Data* random_data(int min_size, int max_size) {
   int size = min_size + rand() % (max_size - min_size + 1);
   char* buf = malloc(size);
+  if (!buf)
+    return NULL;
   for (int i = 0; i < size; i++)
     buf[i] = (char)(rand() % 256);
   return data_create(buf, size);
@@ -81,10 +83,12 @@ static void test_property_chunk_roundtrip() {
 
     int content_len = 1 + rand() % 4096;
     char* content = malloc(content_len);
+    if (!content)
+      return;
     for (int i = 0; i < content_len; i++)
       content[i] = (char)(rand() % 256);
 
-    to_disk(path, content, content_len, false, false);
+    file_write_to_disk(path, content, content_len, false, false);
 
     struct stat st;
     stat(path, &st);

tests/test_protocol.c

@@ -3,6 +3,60 @@
 #include <limits.h>
 #include <string.h>
 #include <unistd.h>
+#include <threads.h>
+
+typedef struct {
+  ProtocolSession* session;
+  bool allocation_allowed;
+} AllocationWorkerArg;
+
+static int allocation_worker(void* arg) {
+  AllocationWorkerArg* worker = arg;
+  protocol_session_bind(worker->session);
+  void* allocation = protocol_alloc(8);
+  worker->allocation_allowed = allocation != NULL;
+  free(allocation);
+  protocol_session_unbind();
+  return thrd_success;
+}
+
+typedef struct {
+  ProtocolSession* session;
+  int read_fd;
+  bool released;
+} AccountingWorkerArg;
+
+typedef struct {
+  ProtocolSession* session;
+  atomic_int* ready;
+  atomic_bool* release;
+  bool received;
+} ConcurrentAccountingWorkerArg;
+
+static int accounting_worker(void* arg) {
+  AccountingWorkerArg* worker = arg;
+  protocol_session_bind(worker->session);
+  Data* data = protocol_receive_data_limited(worker->session, 8);
+  if (data) {
+    data_destroy(data);
+    worker->released = atomic_load(&worker->session->total_allocated_bytes) == 0;
+  }
+  protocol_session_unbind();
+  return data ? thrd_success : thrd_error;
+}
+
+static int concurrent_accounting_worker(void* arg) {
+  ConcurrentAccountingWorkerArg* worker = arg;
+  protocol_session_bind(worker->session);
+  Data* data = protocol_receive_data_limited(worker->session, 8);
+  worker->received = data != NULL;
+  atomic_fetch_add(worker->ready, 1);
+  while (!atomic_load(worker->release))
+    thrd_yield();
+  data_destroy(data);
+  protocol_session_unbind();
+  return thrd_success;
+}
 
 static void test_send_receive_n_data() {
   int p[2];
@@ -187,6 +241,177 @@ static void test_receive_str_truncated() {
   close(p[0]);
 }
 
+static void test_max_alloc_rejects_single_buffer() {
+  int p[2];
+  EXPECT_EQ_INT(pipe(p), 0);
+  ProtocolSession session;
+  protocol_session_init(&session, p[0], p[1]);
+  protocol_session_set_max_alloc(&session, 4);
+  protocol_session_bind(&session);
+  char payload[8] = {0};
+  EXPECT_TRUE(write(p[1], &(size_t){sizeof(payload)}, sizeof(size_t)) == sizeof(size_t));
+  EXPECT_NULL(protocol_receive_str(&session));
+  protocol_session_unbind();
+  close(p[0]);
+  close(p[1]);
+}
+
+static void test_explicit_session_max_alloc_cannot_be_bypassed() {
+  int p[2];
+  EXPECT_EQ_INT(pipe(p), 0);
+  ProtocolSession explicit_session;
+  ProtocolSession unrelated_session;
+  protocol_session_init(&explicit_session, p[0], p[1]);
+  protocol_session_init(&unrelated_session, p[0], p[1]);
+  protocol_session_set_max_alloc(&explicit_session, 4);
+  protocol_session_set_max_alloc(&unrelated_session, 64);
+  protocol_session_bind(&unrelated_session);
+
+  unsigned long long size = 8;
+  EXPECT_EQ_INT((int)write(p[1], &size, sizeof(size)), (int)sizeof(size));
+  EXPECT_EQ_INT((int)write(p[1], "12345678", 8), 8);
+  EXPECT_NULL(protocol_receive_data_limited(&explicit_session, 8));
+  EXPECT_EQ_INT((int)atomic_load(&explicit_session.total_allocated_bytes), 0);
+
+  protocol_session_unbind();
+  close(p[0]);
+  close(p[1]);
+}
+
+static void test_max_alloc_allows_configured_buffer() {
+  ProtocolSession session;
+  protocol_session_init(&session, -1, -1);
+  protocol_session_set_max_alloc(&session, 4);
+  protocol_session_bind(&session);
+  void* allowed = protocol_alloc(4);
+  const void* rejected = protocol_alloc(5);
+  EXPECT_NOT_NULL(allowed);
+  EXPECT_NULL(rejected);
+  free(allowed);
+  protocol_session_unbind();
+}
+
+static void test_max_alloc_is_bound_in_worker_threads() {
+  enum { WORKER_COUNT = 4 };
+  ProtocolSession sessions[WORKER_COUNT];
+  AllocationWorkerArg args[WORKER_COUNT] = {0};
+  thrd_t threads[WORKER_COUNT];
+  for (int i = 0; i < WORKER_COUNT; i++) {
+    protocol_session_init(&sessions[i], -1, -1);
+    protocol_session_set_max_alloc(&sessions[i], 4);
+    args[i].session = &sessions[i];
+    EXPECT_EQ_INT(thrd_create(&threads[i], allocation_worker, &args[i]), thrd_success);
+  }
+  for (int i = 0; i < WORKER_COUNT; i++) {
+    int result;
+    EXPECT_EQ_INT(thrd_join(threads[i], &result), thrd_success);
+    EXPECT_EQ_INT(result, thrd_success);
+    EXPECT_FALSE(args[i].allocation_allowed);
+  }
+}
+
+static void test_protocol_accounting_is_released_in_worker_threads() {
+  enum { WORKER_COUNT = 4 };
+  ProtocolSession sessions[WORKER_COUNT];
+  AccountingWorkerArg args[WORKER_COUNT] = {0};
+  thrd_t threads[WORKER_COUNT];
+  for (int i = 0; i < WORKER_COUNT; i++) {
+    int p[2];
+    EXPECT_EQ_INT(pipe(p), 0);
+    protocol_session_init(&sessions[i], p[0], p[1]);
+    protocol_session_set_max_alloc(&sessions[i], 64);
+    unsigned long long size = 8;
+    EXPECT_EQ_INT((int)write(p[1], &size, sizeof(size)), (int)sizeof(size));
+    EXPECT_EQ_INT((int)write(p[1], "12345678", 8), 8);
+    close(p[1]);
+    args[i].session = &sessions[i];
+    args[i].read_fd = p[0];
+    EXPECT_EQ_INT(thrd_create(&threads[i], accounting_worker, &args[i]), thrd_success);
+  }
+  for (int i = 0; i < WORKER_COUNT; i++) {
+    int result;
+    EXPECT_EQ_INT(thrd_join(threads[i], &result), thrd_success);
+    EXPECT_EQ_INT(result, thrd_success);
+    EXPECT_TRUE(args[i].released);
+    EXPECT_EQ_INT((int)atomic_load(&sessions[i].total_allocated_bytes), 0);
+    close(args[i].read_fd);
+  }
+}
+
+static void test_protocol_accounting_reservation_is_atomic() {
+  enum { WORKER_COUNT = 8 };
+  int p[2];
+  EXPECT_EQ_INT(pipe(p), 0);
+  ProtocolSession session;
+  protocol_session_init(&session, p[0], p[1]);
+  protocol_session_set_max_alloc(&session, 64);
+  const unsigned long long budget_before = MAX_SERVER_ALLOC - 8;
+  atomic_store(&session.total_allocated_bytes, budget_before);
+
+  for (int i = 0; i < WORKER_COUNT; i++) {
+    unsigned long long size = 8;
+    EXPECT_EQ_INT((int)write(p[1], &size, sizeof(size)), (int)sizeof(size));
+    EXPECT_EQ_INT((int)write(p[1], "12345678", 8), 8);
+  }
+  close(p[1]);
+
+  atomic_int ready;
+  atomic_bool release;
+  atomic_init(&ready, 0);
+  atomic_init(&release, false);
+  ConcurrentAccountingWorkerArg args[WORKER_COUNT] = {0};
+  thrd_t threads[WORKER_COUNT];
+  for (int i = 0; i < WORKER_COUNT; i++) {
+    args[i].session = &session;
+    args[i].ready = &ready;
+    args[i].release = &release;
+    EXPECT_EQ_INT(thrd_create(&threads[i], concurrent_accounting_worker, &args[i]), thrd_success);
+  }
+  while (atomic_load(&ready) != WORKER_COUNT)
+    thrd_yield();
+  bool budget_ok = atomic_load(&session.total_allocated_bytes) == budget_before + 8;
+  atomic_store(&release, true);
+  int received = 0;
+  for (int i = 0; i < WORKER_COUNT; i++) {
+    int result;
+    EXPECT_EQ_INT(thrd_join(threads[i], &result), thrd_success);
+    EXPECT_EQ_INT(result, thrd_success);
+    received += args[i].received ? 1 : 0;
+  }
+  EXPECT_EQ_INT(received, 1);
+  EXPECT_TRUE(budget_ok);
+  EXPECT_EQ_INT((int)atomic_load(&session.total_allocated_bytes), (int)budget_before);
+  close(p[0]);
+}
+
+static void test_protocol_string_accounting_is_transient() {
+  int p[2];
+  EXPECT_EQ_INT(pipe(p), 0);
+  ProtocolSession session;
+  protocol_session_init(&session, p[0], p[1]);
+  protocol_session_set_max_alloc(&session, 64);
+  EXPECT_TRUE(protocol_send_str(&session, "temporary"));
+  char* received = protocol_receive_str(&session);
+  EXPECT_NOT_NULL(received);
+  EXPECT_EQ_STR(received, "temporary");
+  EXPECT_EQ_INT((int)atomic_load(&session.total_allocated_bytes), 0);
+  free(received);
+  close(p[0]);
+  close(p[1]);
+}
+
+static void test_protocol_accounting_release_does_not_underflow() {
+  ProtocolSession session;
+  protocol_session_init(&session, -1, -1);
+  atomic_store(&session.total_allocated_bytes, 4);
+  protocol_session_bind(&session);
+  protocol_release_memory(8);
+  EXPECT_EQ_INT((int)atomic_load(&session.total_allocated_bytes), 0);
+  protocol_release_memory(1);
+  EXPECT_EQ_INT((int)atomic_load(&session.total_allocated_bytes), 0);
+  protocol_session_unbind();
+}
+
 void test_protocol() {
   test_send_receive_n_data();
   test_send_receive_n_data_zero();
@@ -198,4 +423,12 @@ void test_protocol() {
   test_send_receive_status();
   test_receive_n_data_truncated();
   test_receive_str_truncated();
+  test_max_alloc_rejects_single_buffer();
+  test_explicit_session_max_alloc_cannot_be_bypassed();
+  test_max_alloc_allows_configured_buffer();
+  test_max_alloc_is_bound_in_worker_threads();
+  test_protocol_accounting_is_released_in_worker_threads();
+  test_protocol_accounting_reservation_is_atomic();
+  test_protocol_string_accounting_is_transient();
+  test_protocol_accounting_release_does_not_underflow();
 }

tests/test_queue.c

@@ -122,6 +122,8 @@ static void test_queue_destroyer() {
 
   for (int i = 0; i < 3; i++) {
     int* val = malloc(sizeof(int));
+    if (!val)
+      break;
     *val = i;
     queue_enqueue(q, val);
   }
@@ -181,6 +183,8 @@ static void test_queue_multithreaded() {
 
   for (int i = 1; i <= 100; i++) {
     int* val = malloc(sizeof(int));
+    if (!val)
+      break;
     *val = i;
     queue_enqueue_multithreaded(q, val, &mutex, &cnd_empty, &cnd_full);
   }

tests/test_robustness.c

@@ -13,7 +13,7 @@
 static void test_chunk_deserialize_truncated() {
   char* path = "test_rob_trunc.txt";
   char* content = "hello";
-  to_disk(path, content, strlen(content), false, false);
+  file_write_to_disk(path, content, strlen(content), false, false);
 
   struct stat st;
   stat(path, &st);
@@ -109,6 +109,20 @@ static void test_delta_deserialize_garbage() {
   data_destroy(d);
 }
 
+static void test_delta_deserialize_respects_max_alloc() {
+  unsigned char serialized[sizeof(uint64_t) + sizeof(uint32_t)] = {0};
+  Data data = {.data = serialized, .size = sizeof(serialized)};
+  ProtocolSession session;
+  protocol_session_init(&session, -1, -1);
+  protocol_session_set_max_alloc(&session, sizeof(Delta) - 1);
+  protocol_session_bind(&session);
+
+  const Delta* result = delta_deserialize(&data);
+  EXPECT_NULL(result);
+
+  protocol_session_unbind();
+}
+
 static void test_delta_signature_deserialize_truncated() {
   char old_data[4096];
   for (int i = 0; i < 4096; i++)
@@ -206,6 +220,7 @@ void test_robustness() {
   test_delta_deserialize_truncated();
   test_delta_deserialize_empty();
   test_delta_deserialize_garbage();
+  test_delta_deserialize_respects_max_alloc();
   test_delta_deserialize_truncated_instructions();
   test_delta_signature_deserialize_truncated();
   test_delta_apply_null();

tests/test_scanner.c

@@ -7,7 +7,7 @@
 #include <unistd.h>
 
 static void create_test_file(const char* path, const char* content) {
-  (void)to_disk(path, content, strlen(content), false, false);
+  (void)file_write_to_disk(path, content, strlen(content), false, false);
 }
 
 static void test_scanner_single_file() {
@@ -385,6 +385,35 @@ static void test_scanner_no_patterns() {
   rmdir(dir);
 }
 
+static void test_parallel_scanner_root_chunks_without_workers() {
+  const char* dir = "test_parallel_scan_root";
+  const char* file1 = "test_parallel_scan_root/a.txt";
+  const char* file2 = "test_parallel_scan_root/b.txt";
+
+  EXPECT_EQ_INT(mkdir(dir, 0755), 0);
+  create_test_file(file1, "a");
+  create_test_file(file2, "b");
+
+  ScannerOptions options = {false, 1, NULL,  0,     NULL,  0,     0,    0,
+                            0,     0, false, false, false, false, false};
+  ParallelScanner* scanner = parallel_scanner_create_with_options(dir, &options, NULL);
+  EXPECT_NOT_NULL(scanner);
+
+  int total_files = 0;
+  Chunk* chunk;
+  while ((chunk = parallel_scanner_next(scanner)) != NULL) {
+    total_files += chunk->element_count;
+    chunk_destroy(chunk);
+  }
+  EXPECT_EQ_INT(total_files, 2);
+  EXPECT_FALSE(parallel_scanner_failed(scanner));
+
+  parallel_scanner_destroy(scanner);
+  unlink(file1);
+  unlink(file2);
+  rmdir(dir);
+}
+
 void test_scanner() {
   test_scanner_single_file();
   test_scanner_multiple_files();
@@ -399,4 +428,5 @@ void test_scanner() {
   test_scanner_size_range();
   test_scanner_mixed_patterns();
   test_scanner_no_patterns();
+  test_parallel_scanner_root_chunks_without_workers();
 }

tests/test_server.c

@@ -1,14 +1,18 @@
 #include "test_server.h"
 #include "config.h"
+#include "delta.h"
 #include "file.h"
 #include "protocol.h"
 #include "test_utils.h"
 #include "utils.h"
+#include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
 #include <sys/wait.h>
+#include <time.h>
 #include <unistd.h>
 
 #include "receiver.h"
@@ -182,11 +186,286 @@ static void test_receive_manifest_rejects_traversal() {
   config_delete(cfg);
 }
 
+static void test_receive_incremental_check_rejects_invalid_nanoseconds() {
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->receive_root_directory = str_dup("/tmp/dst");
+
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  EXPECT_TRUE(send_str(p[1], "file.txt"));
+  unsigned long long size = 0;
+  long long mtime = 100;
+  long long mtime_nsec = 1000000000LL;
+  EXPECT_TRUE(send_n_data(p[1], &size, sizeof(size)));
+  EXPECT_TRUE(send_n_data(p[1], &mtime, sizeof(mtime)));
+  EXPECT_TRUE(send_n_data(p[1], &mtime_nsec, sizeof(mtime_nsec)));
+
+  bool skipped = false;
+  EXPECT_NULL(receive_incremental_check(p[0], cfg, &skipped));
+  Status status;
+  EXPECT_TRUE(receive_status(p[1], &status));
+  EXPECT_EQ_INT(status, STATUS_ERROR);
+  EXPECT_FALSE(skipped);
+
+  close(p[0]);
+  close(p[1]);
+  config_delete(cfg);
+}
+
+static char* make_check_root(const char* tag) {
+  char tmpl[128];
+  snprintf(tmpl, sizeof(tmpl), "/tmp/fastsync_%s_XXXXXX", tag);
+  char* path = str_dup(tmpl);
+  if (!path)
+    return NULL;
+  if (!mkdtemp(path)) {
+    free(path);
+    return NULL;
+  }
+  return path;
+}
+
+static void write_check_file(const char* dir, const char* name, const char* content) {
+  char path[1024];
+  snprintf(path, sizeof(path), "%s/%s", dir, name);
+  int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  if (fd >= 0) {
+    size_t len = strlen(content);
+    if (write(fd, content, len) != (ssize_t)len) {
+      /* intentionally ignored in tests */
+    }
+    close(fd);
+  }
+}
+
+/* Issue #255: a same-size/mtime match is decided from metadata alone, so the
+   receiver answers STATUS_OK (skip) and never asks for a data body. */
+static void test_incremental_check_quick_skip_by_mtime() {
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  char* root = make_check_root("qskip");
+  EXPECT_NOT_NULL(root);
+  cfg->receive_root_directory = str_dup(root);
+  write_check_file(root, "file.txt", "0123456789abcdef");
+
+  char path[1024];
+  snprintf(path, sizeof(path), "%s/file.txt", root);
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  io_set_bwlimit(0);
+
+  pid_t pid = fork();
+  if (pid == 0) {
+    alarm(30);
+    close(p[1]);
+    io_set_fds(p[0], p[0]);
+    bool skipped = false;
+    File* file = receive_incremental_check(p[0], cfg, &skipped);
+    bool ok = file == NULL && skipped;
+    file_destroy(file);
+    config_delete(cfg);
+    close(p[0]);
+    _exit(ok ? 0 : 1);
+  } else {
+    close(p[0]);
+    io_set_fds(p[1], p[1]);
+    EXPECT_TRUE(send_str(p[1], "file.txt"));
+    unsigned long long size = (unsigned long long)st.st_size;
+    long long mtime = (long long)st.st_mtime;
+    long long mtime_nsec = 0;
+#ifdef __linux__
+    mtime_nsec = (long long)st.st_mtim.tv_nsec;
+#endif
+    EXPECT_TRUE(send_n_data(p[1], &size, sizeof(size)));
+    EXPECT_TRUE(send_n_data(p[1], &mtime, sizeof(mtime)));
+    EXPECT_TRUE(send_n_data(p[1], &mtime_nsec, sizeof(mtime_nsec)));
+    Status s;
+    EXPECT_TRUE(receive_status(p[1], &s));
+    EXPECT_EQ_INT(s, STATUS_OK);
+
+    int status;
+    waitpid(pid, &status, 0);
+    close(p[1]);
+    config_delete(cfg);
+    unlink(path);
+    rmdir(root);
+    free(root);
+    EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+  }
+}
+
+/* Issue #255: a size mismatch cannot be a skip, so the receiver answers
+   STATUS_NEXT and consumes the full data body that follows. */
+static void test_incremental_check_size_mismatch_full_transfer() {
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  char* root = make_check_root("qnext");
+  EXPECT_NOT_NULL(root);
+  cfg->receive_root_directory = str_dup(root);
+  write_check_file(root, "file.txt", "0123456789abcdef");
+
+  char path[1024];
+  snprintf(path, sizeof(path), "%s/file.txt", root);
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  io_set_bwlimit(0);
+
+  pid_t pid = fork();
+  if (pid == 0) {
+    alarm(30);
+    close(p[1]);
+    io_set_fds(p[0], p[0]);
+    bool skipped = false;
+    File* file = receive_incremental_check(p[0], cfg, &skipped);
+    bool ok = file != NULL && !skipped && file->path != NULL && strcmp(file->path, "file.txt") == 0;
+    file_destroy(file);
+    config_delete(cfg);
+    close(p[0]);
+    _exit(ok ? 0 : 1);
+  } else {
+    close(p[0]);
+    io_set_fds(p[1], p[1]);
+    EXPECT_TRUE(send_str(p[1], "file.txt"));
+    unsigned long long size = (unsigned long long)st.st_size + 1;
+    long long mtime = (long long)st.st_mtime;
+    long long mtime_nsec = 0;
+#ifdef __linux__
+    mtime_nsec = (long long)st.st_mtim.tv_nsec;
+#endif
+    EXPECT_TRUE(send_n_data(p[1], &size, sizeof(size)));
+    EXPECT_TRUE(send_n_data(p[1], &mtime, sizeof(mtime)));
+    EXPECT_TRUE(send_n_data(p[1], &mtime_nsec, sizeof(mtime_nsec)));
+    Status s;
+    EXPECT_TRUE(receive_status(p[1], &s));
+    EXPECT_EQ_INT(s, STATUS_NEXT);
+
+    Data* body = data_create_reserve(8);
+    EXPECT_NOT_NULL(body);
+    body->data = malloc(8);
+    EXPECT_NOT_NULL(body->data);
+    memcpy(body->data, "replaced", 8);
+    body->size = 8;
+    EXPECT_TRUE(send_data(p[1], body));
+    data_destroy(body);
+
+    int status;
+    waitpid(pid, &status, 0);
+    close(p[1]);
+    config_delete(cfg);
+    unlink(path);
+    rmdir(root);
+    free(root);
+    EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+  }
+}
+
+/* Issue #256: when a received delta claims a result above the whole-file cap,
+   receive_delta_file must mark the operation failed so the caller aborts with
+   STATUS_ERROR instead of emitting STATUS_NEXT and waiting for a body that
+   never arrives. */
+static void test_incremental_check_delta_oversize_reports_failure() {
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  char* root = make_check_root("qdelta");
+  EXPECT_NOT_NULL(root);
+  cfg->receive_root_directory = str_dup(root);
+  cfg->use_delta = true;
+
+  char content[20000];
+  memset(content, 'a', sizeof(content));
+  content[sizeof(content) - 1] = '\0';
+  write_check_file(root, "file.txt", content);
+
+  char path[1024];
+  snprintf(path, sizeof(path), "%s/file.txt", root);
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  EXPECT_EQ_INT((int)st.st_size, 19999);
+
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  io_set_bwlimit(0);
+
+  pid_t pid = fork();
+  if (pid == 0) {
+    alarm(30);
+    close(p[1]);
+    io_set_fds(p[0], p[0]);
+    bool skipped = false;
+    File* file = receive_incremental_check(p[0], cfg, &skipped);
+    bool ok = file == NULL && !skipped;
+    if (ok)
+      send_status(p[0], STATUS_ERROR); /* mirror the server error path */
+    file_destroy(file);
+    config_delete(cfg);
+    close(p[0]);
+    _exit(ok ? 0 : 1);
+  } else {
+    close(p[0]);
+    io_set_fds(p[1], p[1]);
+    EXPECT_TRUE(send_str(p[1], "file.txt"));
+    unsigned long long size = (unsigned long long)st.st_size;
+    long long mtime = 1; /* different from the file mtime: force a transfer */
+    long long mtime_nsec = 0;
+    EXPECT_TRUE(send_n_data(p[1], &size, sizeof(size)));
+    EXPECT_TRUE(send_n_data(p[1], &mtime, sizeof(mtime)));
+    EXPECT_TRUE(send_n_data(p[1], &mtime_nsec, sizeof(mtime_nsec)));
+
+    Status s;
+    EXPECT_TRUE(receive_status(p[1], &s));
+    EXPECT_EQ_INT(s, STATUS_DELTA_SIGNATURE);
+    Data* sig_data = receive_data(p[1]);
+    EXPECT_NOT_NULL(sig_data);
+    DeltaSignature* sig = delta_signature_deserialize(sig_data);
+    EXPECT_NOT_NULL(sig);
+    delta_signature_destroy(sig);
+    data_destroy(sig_data);
+
+    /* Send a delta whose claimed output size exceeds the whole-file cap. */
+    Delta delta;
+    memset(&delta, 0, sizeof(delta));
+    delta.new_file_size = MAX_RECEIVE_WHOLE_FILE_SIZE + 1;
+    Data* bogus = delta_serialize(&delta);
+    EXPECT_NOT_NULL(bogus);
+    EXPECT_TRUE(send_status(p[1], STATUS_DELTA_DATA));
+    EXPECT_TRUE(bogus != NULL && send_data(p[1], bogus));
+    data_destroy(bogus);
+
+    /* The receiver must answer with an error, never with STATUS_NEXT. */
+    EXPECT_TRUE(receive_status(p[1], &s));
+    EXPECT_EQ_INT(s, STATUS_ERROR);
+
+    int status;
+    waitpid(pid, &status, 0);
+    close(p[1]);
+    config_delete(cfg);
+    unlink(path);
+    rmdir(root);
+    free(root);
+    EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+  }
+}
+
 void test_server() {
   if (!is_running_under_valgrind()) {
     test_receive_files_finished();
     test_receive_files_single_file();
     test_receive_files_abort();
     test_receive_manifest_rejects_traversal();
+    test_receive_incremental_check_rejects_invalid_nanoseconds();
+    test_incremental_check_quick_skip_by_mtime();
+    test_incremental_check_size_mismatch_full_transfer();
+    test_incremental_check_delta_oversize_reports_failure();
   }
 }

tests/test_shared_utils.c

@@ -1,10 +1,66 @@
 #include "test_shared_utils.h"
 #include "utils.h"
+#include "protocol.h"
 #include "test_utils.h"
 #include <stdlib.h>
 #include <string.h>
+#include <threads.h>
+
+typedef struct {
+  bool eight_bit_output;
+  const char* expected;
+  int failed;
+} EscapeThreadArgs;
+
+static int escape_thread(void* arg) {
+  EscapeThreadArgs* args = arg;
+  for (int i = 0; i < 1000; i++) {
+    char* escaped = output_escape("x\xc3\xa9\n", args->eight_bit_output);
+    if (!escaped || strcmp(escaped, args->expected) != 0)
+      args->failed = 1;
+    free(escaped);
+  }
+  return 0;
+}
 
 void test_shared_utils() {
+  char formatted[32];
+  EXPECT_TRUE(format_human_bytes(0, formatted, sizeof(formatted)));
+  EXPECT_EQ_STR(formatted, "0 B");
+  EXPECT_TRUE(format_human_bytes(1024, formatted, sizeof(formatted)));
+  EXPECT_EQ_STR(formatted, "1.0 KB");
+  EXPECT_TRUE(format_human_bytes(1536 * 1024, formatted, sizeof(formatted)));
+  EXPECT_EQ_STR(formatted, "1.5 MB");
+  EXPECT_FALSE(format_human_bytes(1024, formatted, 4));
+
+  char high_bit[] = {'a', (char)0xc3, (char)0xa9, '\n', '\0'};
+  char* escaped = output_escape(high_bit, false);
+  EXPECT_EQ_STR(escaped, "a\\#303\\#251\\#012");
+  free(escaped);
+  escaped = output_escape(high_bit, true);
+  EXPECT_EQ_STR(escaped, "a\xc3\xa9\\#012");
+  free(escaped);
+
+  ProtocolSession safe_session;
+  ProtocolSession eight_bit_session;
+  protocol_session_init(&safe_session, -1, -1);
+  protocol_session_init(&eight_bit_session, -1, -1);
+  protocol_session_set_8_bit_output(&safe_session, false);
+  protocol_session_set_8_bit_output(&eight_bit_session, true);
+  EXPECT_FALSE(safe_session.eight_bit_output);
+  EXPECT_TRUE(eight_bit_session.eight_bit_output);
+
+  EscapeThreadArgs safe_args = {false, "x\\#303\\#251\\#012", 0};
+  EscapeThreadArgs eight_bit_args = {true, "x\xc3\xa9\\#012", 0};
+  thrd_t safe_thread;
+  thrd_t eight_bit_thread;
+  EXPECT_EQ_INT(thrd_create(&safe_thread, escape_thread, &safe_args), thrd_success);
+  EXPECT_EQ_INT(thrd_create(&eight_bit_thread, escape_thread, &eight_bit_args), thrd_success);
+  EXPECT_EQ_INT(thrd_join(safe_thread, NULL), thrd_success);
+  EXPECT_EQ_INT(thrd_join(eight_bit_thread, NULL), thrd_success);
+  EXPECT_FALSE(safe_args.failed);
+  EXPECT_FALSE(eight_bit_args.failed);
+
   // Test str_dup
   const char* dup_null = str_dup(NULL);
   EXPECT_NULL(dup_null);

tests/test_stress.c

@@ -32,6 +32,8 @@ static int mpmc_producer_func(void* arg) {
   ProducerCtx* ctx = (ProducerCtx*)arg;
   for (int i = 1; i <= ITEMS_PER_PRODUCER; i++) {
     int* val = malloc(sizeof(int));
+    if (!val)
+      return thrd_error;
     *val = ctx->producer_id * ITEMS_PER_PRODUCER + i;
     queue_enqueue_multithreaded(ctx->q, val, ctx->mutex, ctx->cnd_empty, ctx->cnd_full);
   }
@@ -121,6 +123,8 @@ static int bp_producer_func(void* arg) {
   BackpressureCtx* ctx = (BackpressureCtx*)arg;
   for (int i = 0; i < 5; i++) {
     int* val = malloc(sizeof(int));
+    if (!val)
+      return thrd_error;
     *val = i + 1;
     queue_enqueue_multithreaded(ctx->q, val, ctx->mutex, ctx->cnd_empty, ctx->cnd_full);
     ctx->items_sent++;
@@ -194,6 +198,8 @@ static void test_queue_rapid_create_destroy() {
 
     for (int j = 0; j < 3; j++) {
       int* val = malloc(sizeof(int));
+      if (!val)
+        break;
       *val = j;
       queue_enqueue(q, val);
     }

tests/test_transport_ssh.c

@@ -4,34 +4,39 @@
 
 static void test_ssh_connect_invalid_dest_no_colon() {
   /* cppcheck-suppress constVariablePointer */
-  Client* client = client_connect_ssh("invalid-destination-no-colon", 22, NULL);
+  Client* client = client_connect_ssh("invalid-destination-no-colon", 22, NULL, false);
   EXPECT_NULL(client);
 }
 
 static void test_ssh_connect_invalid_dest_empty() {
   /* cppcheck-suppress constVariablePointer */
-  Client* client = client_connect_ssh("", 22, NULL);
+  Client* client = client_connect_ssh("", 22, NULL, false);
   EXPECT_NULL(client);
 }
 
-/* Test client_connect_ssh with malformed destination (just a colon).
+/* A child that cannot exec ssh must not be returned as a successful client. */
- * parse_remote_dest succeeds, ssh is exec'd and fails, but the function
- * creates a Client that must be cleaned up. */
 static void test_ssh_connect_malformed() {
-  Client* client = client_connect_ssh(":", 22, NULL);
+  const char* old_path = getenv("PATH");
-  /* ssh binary exists, so exec succeeds; the function returns a Client.
+  char* saved_path = old_path ? strdup(old_path) : NULL;
-   * We just verify it doesn't crash and clean up properly. */
+  setenv("PATH", "", 1);
-  if (client != NULL) {
+
-    client_disconnect(client);
+  /* cppcheck-suppress constVariablePointer */
-    client_delete(client);
+  Client* client = client_connect_ssh(":", 22, NULL, false);
+
+  if (saved_path) {
+    setenv("PATH", saved_path, 1);
+    free(saved_path);
+  } else {
+    unsetenv("PATH");
   }
-  EXPECT_TRUE(true);
+
+  EXPECT_NULL(client);
 }
 
 /* Test client_connect_ssh with valid format but unreachable host.
  * The function launches ssh which will fail to connect, returns a Client. */
 static void test_ssh_connect_unreachable() {
-  Client* client = client_connect_ssh("nonexistent.invalid:/remote/path", 22, NULL);
+  Client* client = client_connect_ssh("nonexistent.invalid:/remote/path", 22, NULL, false);
   if (client != NULL) {
     client_disconnect(client);
     client_delete(client);
@@ -39,9 +44,24 @@ static void test_ssh_connect_unreachable() {
   EXPECT_TRUE(true);
 }
 
+static void test_ssh_remote_command_argument_modes() {
+  char* command = ssh_build_remote_command("fast sync; touch /tmp/pwned", false);
+  EXPECT_EQ_STR(command, "'fast sync; touch /tmp/pwned' --stdio");
+  free(command);
+
+  command = ssh_build_remote_command("fast'sync", false);
+  EXPECT_EQ_STR(command, "'fast'\\''sync' --stdio");
+  free(command);
+
+  command = ssh_build_remote_command("fast sync; touch /tmp/pwned", true);
+  EXPECT_EQ_STR(command, "fast sync; touch /tmp/pwned --stdio");
+  free(command);
+}
+
 void test_transport_ssh() {
   test_ssh_connect_invalid_dest_no_colon();
   test_ssh_connect_invalid_dest_empty();
   test_ssh_connect_malformed();
   test_ssh_connect_unreachable();
+  test_ssh_remote_command_argument_modes();
 }