Release v2.29.0 (#312 )

Release v2.29.0
- Transport I/O vtable over TCP/TLS; TLS multithreaded sendfile fixed - Symlink-xattr wire block (protocol 2.29.0; config frame unchanged) - No-wire parity burn-down: --inc-recursive, in-root --temp-dir, --delete-before phase-0, rsync-interoperable --fake-super, --devices per-entry failure, rsyncd.conf key subset (read-only default) - Protocol version: 2.29.0 - Tested: unit, integration, ASan, UBSan, valgrind, differential parity
2026-09-23 02:05:14 +02:00 · 2026-09-23 01:59:54 +02:00 · 2026-09-23 01:50:51 +02:00 · 2026-09-23 01:45:30 +02:00 · 2026-09-23 01:36:25 +02:00 · 2026-09-23 01:36:25 +02:00
108 changed files with 17330 additions and 8976 deletions
@@ -12,3 +12,12 @@ build_docker2/
 # Test/run artifacts
 root/
 test_partial_install_tmp/
+
+# Editor/tooling + test caches/artifacts
+.pytest_cache/
+*.gcda
+*.gcno
+*.gcov
+di/
+test_data-manual/
+*.log
@@ -16,7 +16,7 @@ Ask the user or determine from context:
 - **Minor** (x.Y.0) — new features, backward compatible
 - **Patch** (x.y.Z) — bug fixes, no protocol changes

-Current version: `PROTOCOL_VERSION "2.26.0"` in `src/shared/config.h`
+Current version: `PROTOCOL_VERSION "2.29.0"` in `src/shared/config.h`

 ### Step 2: Check Protocol Version

@@ -4,9 +4,9 @@ FastSync is a high-performance file synchronization system written in C11. It su

 ## Dependency installation

-**CI rule:** never add `apt-get install` / `pip install` steps to CI workflows — use the custom Docker image instead. The image is built from the repo-root `Dockerfile` and is the same image CI uses: `gitea.tap-tap.win/taptap/fastsync-ci:v11`. It contains the full toolchain: gcc/g++, CMake, libzstd-dev, libssl-dev, make, git, cppcheck, clang-format, python3 + pytest + pytest-xdist, openssh-client, Node.js, plus `rsync` 3.4.1 (with zstd/xxhash/lz4), `acl` and `attr` (setfacl/getfacl, setfattr/getfattr) for drop-in parity tests.
+**CI rule:** never add `apt-get install` / `pip install` steps to CI workflows — use the custom Docker image instead. The image is built from the repo-root `Dockerfile` and is the same image CI uses: `gitea.tap-tap.win/taptap/fastsync-ci:v11`. It contains the full toolchain: gcc/g++, CMake, libzstd-dev, zlib1g-dev, liblz4-dev, libxxhash-dev, libssl-dev, make, git, cppcheck, clang-format, python3 + pytest + pytest-xdist, openssh-client, Node.js, plus `rsync` 3.4.1 (with zstd/xxhash/lz4), `acl` and `attr` (setfacl/getfacl, setfattr/getfattr) for drop-in parity tests. (CMake hard-requires zstd, zlib, and lz4; xxHash is fetched via `FetchContent`.)

-**Host rule:** for local development, use `nix-shell` (see `README.md`) which provides zstd, OpenSSL, CMake, and gcc. The Docker image can also be used locally for CI parity.
+**Host rule:** for local development, use `nix-shell` (see `README.md`) which provides zstd, zlib, lz4, OpenSSL, CMake, and gcc. The Docker image can also be used locally for CI parity.

 ```bash
 # Use the prebuilt CI image directly (faster, guaranteed CI parity)
@@ -38,11 +38,12 @@ If a dependency is missing from the CI image, add it to the `Dockerfile` (and re
 When configuring for CI parity, use:
 ```bash
 cmake -B build -S . -DSTRICT_WARNINGS=ON        # -Wextra -Wpedantic -Werror
-cmake -B build -S . -DSANITIZER=address           # AddressSanitizer (ASan)
-cmake -B build -S . -DSANITIZER=thread            # ThreadSanitizer (TSan)
+cmake -B build -S . -DSANITIZER=address           # AddressSanitizer (ASan); in the CI matrix
+cmake -B build -S . -DSANITIZER=undefined         # UndefinedBehaviorSanitizer (UBSan); in the CI matrix
+cmake -B build -S . -DSANITIZER=thread            # ThreadSanitizer (TSan); local-only, NOT in CI
 ```

-The CI workflow (`.gitea/workflows/ci.yaml`) runs lint (clang-format, cppcheck), then a **fast PR gate** — build + unit + a representative subset of integration tests marked `@pytest.mark.ci`, parallelized with pytest-xdist (`-n 4 --dist=load`). The full coverage jobs (full integration suite as `-m "not setpriv"`, sanitizer, fuzz, coverage, valgrind) run **only on push to `dev`/`main`**; pull requests skip them to keep PR CI under ~3 minutes. The two `setpriv` privilege tests are excluded from CI via a marker because their result depends on the runner/container uid and host mount permissions.
+The CI workflow (`.gitea/workflows/ci.yaml`) runs lint (clang-format, cppcheck), then a **fast PR gate** — build + unit + a representative subset of integration tests marked `@pytest.mark.ci`, parallelized with pytest-xdist (`-n 4 --dist=load`). The full coverage jobs (full integration suite as `-m "not setpriv"`, the `address`+`undefined` sanitizer matrix, fuzz, coverage, valgrind) run **only on push to `dev`/`main`**; pull requests skip them to keep PR CI under ~3 minutes. TSan is not part of the CI matrix and is a local-only configuration. The `setpriv`-marked privilege tests (four decorated functions, collecting to eight instances because two are parametrized) are excluded from CI via a marker because their result depends on the runner/container uid and host mount permissions.

 ## Build

@@ -105,7 +106,7 @@ Two main branches: `dev` (integration) and `main` (stable releases).

 ### Rules
 - **All PRs target `dev`** — never target `main` directly
- **`dev` is the default branch** in Gitea repo settings
+- **`dev` is intended to be the default branch** in Gitea repo settings — verify in the repo settings, since this clone's `origin/HEAD` still points at `main`
 - **`main` is protected** — only merged from `dev` via PR with 2 approvals + full CI pass
 - **Feature/bug branches** branch from `dev`, PR back to `dev`
 - **`dev` → `main` merges** happen on-demand or weekly, requiring full CI + review
@@ -4,6 +4,207 @@ All notable changes to FastSync are documented here. Versions match
 `PROTOCOL_VERSION` (printed by `fastsync --version`); the client and server must
 run the same version because the handshake is strict.

+## [Unreleased]
+
+## [2.29.0] - 2026-09-23
+
+The rsync-parity cycle 2.29 (no wire change; `PROTOCOL_VERSION` stays 2.28.0).
+`RSYNC_COMPAT.md` moves from **116 ✅ / 14 ⚠️ / 27 ❌** to
+**120 ✅ / 10 ⚠️ / 27 ❌** of 157 rows.
+
+An audit cycle follows on the same wire version (`PROTOCOL_VERSION` stays
+2.28.0): a security-and-correctness pass over the parity-2.29 baseline, plus a
+set of audit follow-ups (filter merge modifiers, the `--inplace`/`--partial-dir`
+conflict, credential-file hardening, and small leak/log/test fixes). It fixes
+a `--temp-dir` symlink escape, gates client-controlled special permission bits,
+corrects `--partial-dir`/`--bwlimit`/`-z` behavior, handles unsupported filter
+modifiers, and tightens client and wire validation. The only parity
+reclassification is `--filter=RULE` moving ✅ → ⚠️, because its merge-only
+`e`/`n`/`w`/`-` modifiers are now accepted and consumed but their semantics
+remain unimplemented (accepted-but-ignored); the matrix is therefore **119 ✅ /
+11 ⚠️ / 27 ❌** of 157 rows. The affected rows' notes and the summary tally in
+`RSYNC_COMPAT.md` were updated. A following triage-fix cycle (see **Triage
+fixes** below) moves `-F` and `-i` to ⚠️, for a final **117 ✅ / 13 ⚠️ / 27 ❌**
+of 157 rows.
+
+A no-wire parity burn-down cycle follows on 2.28.0: it accepts
+`--inc-recursive`/`--no-inc-recursive` as inert no-ops, accepts an absolute
+`--temp-dir` that canonicalizes inside the receive root, closes the
+`--delete-before` phase-0 divergence (both the single-threaded and `--threads`
+data passes replay the pre-scan list), makes `--fake-super` interoperable with
+rsync's `user.rsync.%stat` key/grammar (regular files and char/block devices
+faked as regular files), turns a failed device `mknod` into a continuing
+per-entry failure, and accepts a practical subset of rsync's `rsyncd.conf`
+grammar (modules are read-only by default, and accepted-but-unenforced
+access-control keys emit a startup warning). The matrix moves to **119 ✅ /
+14 ⚠️ / 24 ❌** of 157 rows.
+
+A structural cycle then lands a transport I/O vtable over TCP/TLS (fixing the
+TLS-multithreaded sendfile path and making the per-thread SSL resolution
+explicit) and bumps the wire to **2.29.0**: the `STATUS_SYMLINK` frame grows an
+optional symlink-xattr block (captured no-follow with `llistxattr`/`lgetxattr`,
+applied no-follow with `lsetxattr`). Because the handshake is strict, 2.28.0 and
+2.29.0 peers are incompatible. Note: Linux refuses to associate xattrs with a
+symlink at all, so the symlink-xattr block is a no-op on Linux and is carried
+for correctness on platforms/filesystems that do support it; the config-frame
+layout is unchanged (golden length still 886).
+
+### Changed
+
+- **rsync-exact traversal order.** The sequential scanner now walks each
+  directory's entries in rsync 3.4.1's flist order (non-directories ascending,
+  then directories ascending, depth-first), so `--info=name`, the
+  `--delete-during`/`--delete-delay`/`-n` would-delete order and the partial
+  `--max-delete` survivor set match rsync byte-for-byte. `--threads` has no
+  rsync analogue and stays unordered.
+- **Delete timing.** The complete `--delete-during`/`--delete-delay`
+  per-directory plan set is transmitted before the first data frame, so a
+  mid-transfer abort has already removed every planned extra like rsync's
+  generator; `-d/--dirs` uses per-directory plans (shielded untraversed
+  subdirectories) instead of the end-of-transfer commit. `-n`, `--delete`,
+  `--del`/`--delete-during` and `--delete-delay` are now ✅ Parity.
+- **Basis directories.** A relative `--compare-dest`/`--copy-dest`/`--link-dest`
+  DIR resolves against the destination directory with the transfer-relative
+  name appended, exactly like rsync 3.4.1.
+- **`-y`/`--fuzzy`.** The candidate search no longer inherits the ordinary delta
+  engine's 16 KiB minimum or 10× size-ratio bound, so an oversized or
+  sub-16-KiB sibling is reused exactly as rsync reuses it.
+- `--info=mount` prints rsync's mount-point skip line (repeated `-xx` drops the
+  mount-point directory); `--info=stats` enables the `--stats` block; `-x` is
+  repeatable. `--stats` counts traversed directories for the `Number of files`
+  breakdown under a plain `-r` scan. `--debug` emits real output for
+  `flist`/`del`/`hash`/`deltasum`/`recv`/`filter`/`send`.
+
+### Known residuals
+
+- `--progress` and `--info` still need a receiver→sender event channel for the
+  root `./` line, ancestor-directory suppression, receiver-side `skip`/`backup`
+  wording, and symlink/empty-directory quick-checks.
+- `--delete-before`'s phase-0 late-file divergence remains (rsync's pre-scan
+  fixes the file list before the data pass).
+- A single file larger than 256 MiB cannot be streamed in the default path
+  (a general whole-file limit, not basis-specific).
+- `--stats` byte totals and `--msgs2stderr` stay documented divergences.
+
+### Security
+
+- **`--temp-dir` symlink escape fixed.** The receiver's scratch directory was
+  opened with a bare `open()`, so a symlink planted under the receive root could
+  redirect receiver scratch files outside the authorized root. The opened
+  directory is now judged by the real path of its fd (`/proc/self/fd` via
+  `realpath`) and an escaping target is refused (`EACCES`, logged); an in-root
+  link to another filesystem (the `EXDEV` fallback case) still works.
+- **Client-controlled special bits masked when super-user activities are not
+  permitted.** Setuid/setgid/sticky bits (`--perms`, `--chmod`, the symlink and
+  special-node paths, and deferred directory modes) are now stripped when the
+  connection forbids super activities (`--no-super`, a non-opted daemon module,
+  a privileged listener without `--allow-super`); exact rsync semantics are
+  preserved wherever super activities are permitted.
+- **Daemon umask no longer forced to `0`.** `daemonize()` now sets the
+  conventional `022`, so implied parent directories created without `-p` are no
+  longer world-writable `0777`.
+- **Daemon modules are read-only by default.** A `--daemon` module is now
+  served read-only unless it sets `read only = no` (or rsync's `write only =
+  yes`), matching rsync: a real `rsyncd.conf` that omits `read only` is no
+  longer silently writable. A global `read only` still sets the default for
+  later modules, and an explicit module value wins. This is a behavior change
+  for existing FastSync-native configs that relied on the old writable default;
+  add `read only = no` to keep them writable. An rsync `write only = yes` is
+  mapped to writability (FastSync is push-only, so a module can never be read
+  from the network).
+- **Accepted-but-unenforced rsync security keys now warn at startup.** The
+  rsync keys FastSync recognizes but does not implement — `secrets file`,
+  `refuse options`, `exclude`/`include`/`filter`, `max size`/`min size`,
+  `pre-xfer exec`/`post-xfer exec`, `incoming chmod`/`outgoing chmod`,
+  `name converter`, `use chroot`, `uid`/`gid`, and the rest of the
+  access-control set — load for migration compatibility but now emit a
+  `WARN` naming the key (and module) so an operator does not believe the
+  restriction is enforced. `auth users`/`secrets file` stay fail-closed: a
+  module declaring `auth users` still requires a FastSync credential store.
+- **Credentials and signal handling hardened.** Secret files are opened with
+  `O_NOFOLLOW|O_NONBLOCK` (while allowing fd-backed store paths and bound-waiting
+  a FIFO read for ~3 s so a slow process substitution works but a connected-but-
+  silent FIFO cannot hang), and signal handlers use `sigaction` with
+  async-signal-safe bodies.
+
+### Fixed
+
+- **`-z` on 100–256 MiB files.** The decompressor's internal ceiling was 100 MiB
+  while the receiver advertises and the sender compresses whole files up to
+  `MAX_RECEIVE_WHOLE_FILE_SIZE` (256 MiB), so `-z` on a 100–256 MiB regular file
+  failed with `Declared decompressed size exceeds 104857600 bytes`. The ceiling
+  is now defined in terms of the protocol whole-file bound (still an
+  allocation-clamped bomb guard).
+- **`--bwlimit` now paces `--sendfile`.** The plaintext-TCP `--sendfile` fast
+  path bypassed the protocol's token bucket, so the limit was ignored there. It
+  now throttles through the same per-session leaky bucket as the TLS path.
+- **`--partial-dir` implies `--partial`.** Matching rsync 3.4.1 (which sets
+  `keep_partial` after option parsing), `--partial-dir=DIR` alone retains an
+  interrupted transfer's partial and wins over an explicit `--no-partial`;
+  `--inplace` still bypasses the partial machinery, and combining `--inplace`
+  with `--partial-dir` is now rejected up front with rsync's message
+  (`--inplace cannot be used with --partial-dir`).
+- **Filter modifiers handled.** The `x` xattr-name modifier is rejected with a
+  clear error everywhere. The merge-only `e`/`n`/`w` and `-` modifiers are now
+  accepted and consumed on `merge`/`dir-merge` rules (so they no longer leak
+  into the merge filename) while still being rejected on non-merge rules,
+  matching rsync; their semantics remain unimplemented (accepted-but-ignored).
+  Glued patterns (`-newfile`, `-e2e`) and mixed tokens (`H,!secret`) keep their
+  historical parsing.
+- **Credential-file reads hardened.** Secret files (`--password-file`/
+  `--early-input`/`--hash-credentials` input) are opened with `O_NOFOLLOW`, so a
+  symlinked credential path now fails closed (`ELOOP`) instead of being followed
+  before the owner/mode gate; literal fd-backed paths (`/dev/fd/<digits>`,
+  `/proc/self/fd/<digits>`) are exempt so process substitution still works. A
+  FIFO/process-substitution read now waits under a bounded ~3 s deadline for its
+  writer, so a slow producer works while a connected-but-silent FIFO fails
+  instead of hanging.
+- **Miscellaneous correctness fixes:** `--filter` rule count is checked
+  client-side against `MAX_FILTER_RULES` before any network I/O (the receiver
+  still re-checks the expanded count); unknown wire `Status` values are rejected
+  as protocol errors; a mutex leak on an init-failure path, an `errno` read
+  after `free()` in deferred delete application, `log_perror` misuse for
+  non-`errno` conditions, and a `NULL` `server_host`/`ssh_destination`
+  allocation path were fixed (the `config_create` failure now releases through
+  `config_delete`); the decompression-limit log now prints the effective bound
+  rather than the compile-time ceiling; the daemon umask and root test fixtures
+  were hardened; `SSL_read` length is clamped and `sendfile` `poll()` retries on
+  `EINTR`.
+
+### Refactored / Docs
+
+- Dropped dead `filter_rules_apply` and dead `--old-args` plumbing, unified
+  `set_error`, deduplicated `path_is_within` and shared constants, and added
+  printf format attributes (fixing format mismatches). `RSYNC_COMPAT.md`,
+  `CHANGELOG.md` and `HANDOFF.md` were updated for the audit cycle; the
+  `RSYNC_COMPAT.md` summary tally was corrected to match the rows.
+
+### Triage fixes
+
+- **`--dirs` directory xattrs applied inline.** A `-d/--dirs` transfer now
+  applies captured directory `-X`/`-A` xattrs fd-relative on the directory entry
+  instead of dropping them, so directory xattrs survive the non-recursive path
+  (`src/shared/file_save.c`, `tests/test_xattr.c`).
+- **Directory/root itemize and `--out-format` lines.** `-i`/`--itemize-changes`
+  and `--out-format` now emit the transfer-root `./` line and per-directory
+  `cd...`/`.d..t...` lines, rendered by the shared itemize code. This matches
+  rsync's fresh-transfer output; because the root line is unconditional and an
+  incremental re-run may itemize directories/symlinks that rsync's quick-check
+  leaves silent, `-i` is now a ⚠️ Caveat row.
+- **FROM name globs for identity maps.** `--usermap`/`--groupmap` `FROM` tokens
+  now accept `*`/`?`/`[...]` globs, expanded sender-side against the passwd/group
+  database and collapsed into bounded numeric ranges (`MAX_IDENTITY_MAP`),
+  matching rsync.
+- **Transport fallback unit tests.** Added unit coverage for the TCP/TLS
+  transport fallback paths (`tests/test_transport_tcp.c`,
+  `tests/test_transport_tls.c`).
+- **Docs corrections.** `RSYNC_COMPAT.md`/`README.md` corrected stale parity
+  claims for issues #286–#297: the `-F` and `-i` reclassifications, the
+  `--munge-links` direction, the accepted checksum/compression name sets,
+  `--bwlimit` parsing, `--stop-at` grammar, `--trust-sender`, symlink xattrs, and
+  the native/non-interoperable batch and credential notes. The summary tally is
+  now **117 ✅ / 13 ⚠️ / 27 ❌** of 157 rows.
+
 ## [2.28.0] - 2026-09-20

 The rsync-parity cycle. `PROTOCOL_VERSION` moves `2.26.0 → 2.27.0 → 2.28.0`;
@@ -1,6 +1,6 @@
 cmake_minimum_required(VERSION 3.22)

-project(FastFileTransfer VERSION 2.28.0)
+project(FastFileTransfer VERSION 2.29.0)

 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 set(CMAKE_C_STANDARD 11)
@@ -26,9 +26,9 @@ elseif(NOT SANITIZER STREQUAL "none")
 endif()

 # --- Strict warnings option ---
-option(STRICT_WARNINGS "Enable strict warnings (Wextra, Wpedantic, Werror)" OFF)
+option(STRICT_WARNINGS "Enable strict warnings (Wextra, Wpedantic, Wformat-signedness, Werror)" OFF)
 if(STRICT_WARNINGS)
-	add_compile_options(-Wextra -Wpedantic -Werror)
+	add_compile_options(-Wextra -Wpedantic -Wformat-signedness -Werror)
 endif()

 # --- Coverage option ---
@@ -99,17 +99,21 @@ set(SHARED_SRCS
 	src/shared/daemon_limits.c
 	src/shared/data.c
 	src/shared/delay_updates.c
+	src/shared/delete.c
+	src/shared/delete_commit.c
 	src/shared/delete_plan.c
 	src/shared/delta.c
 	src/shared/file.c
 	src/shared/file_list.c
 	src/shared/file_receive.c
+	src/shared/file_save.c
 	src/shared/file_send.c
 	src/shared/file_store.c
 	src/shared/filter.c
 	src/shared/format.c
 	src/shared/hardlink.c
 	src/shared/identity.c
+	src/shared/incremental_check.c
 	src/shared/log.c
 	src/shared/metadata.c
 	src/shared/motd.c
@@ -136,9 +140,14 @@ set(SERVER_MAIN_SRCS src/server/server.c)
 # Client implementation (no main): everything except the CLI entry point.
 set(CLIENT_CORE_SRCS
 	src/client/change_list.c
+	src/client/client_manifest.c
+	src/client/client_report.c
+	src/client/client_scan.c
 	src/client/client_send.c
 	src/client/client_validation.c
 	src/client/scanner.c
+	src/client/scanner_filter.c
+	src/client/scanner_parallel.c
 	src/client/usage.c
 )
 set(CLIENT_MAIN_SRCS src/client/client_cli.c)
@@ -226,6 +235,7 @@ set(TEST_SRCS
 	tests/test_file.c
 	tests/test_file_list.c
 	tests/test_file_sendfile.c
+	tests/test_filter.c
 	tests/test_format.c
 	tests/test_fuzz_smoke.c
 	tests/test_glob.c
@@ -1,18 +1,30 @@
-# FastSync — Session Handoff (2026-09-19)
+# FastSync — Session Handoff (2026-09-21)

 ## Current status
- **rsync-parity tracks 1-6 landed on `dev`** via **PR #303** (`10159dc`,
-  "feat(parity): rsync parity tracks 1-6 (protocol 2.28.0)"). Dev push CI run
-  **581** fully green: lint, build-and-test, parity-full, ASan, UBSan,
-  fuzz-build, coverage, valgrind.
+- **Release `v2.28.0`** is tagged and merged to `main`: tag `v2.28.0` points at
+  `ee6523a`, and the PR #304 merge commit `b4d54504` is on `main`.
+- **`dev` is at `0fbb9de`** — the merge of parity cycle 2.29 (PR #305). The old
+  `558782d` (incremental-check flake fix) is an ancestor.
 - **`PROTOCOL_VERSION` = `"2.28.0"`** (`src/shared/config.h`); CMake
-  `project(FastFileTransfer VERSION 2.28.0)`. The cycle batched all wire
-  changes (stats counters, filter-rule block, `--verify-basis`) under the one
-  bump.
- **`main` = `ef76c90`** (tag `v2.26.0`); the 2.27.0/2.28.0 work is on `dev`
-  and not yet released. A `dev -> main` v2.28.0 release PR is the next step.
- Parity matrix: **116 ✅ / 14 ⚠️ / 27 ❌ = 157** (was 111/13/33 at cycle start).
- Working tree clean; feature branch deleted; no scratch trees or worktrees.
+  `project(FastFileTransfer VERSION 2.28.0)`.
+- **Parity cycle 2.29 is merged to `dev`** (PR #305), no wire change. It closed
+  the scanner-order, delete-timing, relative-basis and fuzzy-eligibility
+  residuals and improved the `--info`/`--stats`/`--debug` partials. Parity
+  matrix: **120 ✅ / 10 ⚠️ / 27 ❌ = 157**. Remaining ⚠️ rows: `--info`,
+  `--debug`, `--msgs2stderr`, `--stats`, `--progress`, `--delete-before`, the
+  three basis-dir options, and `-y`/`--fuzzy`.
+- **Audit cycle complete on branch `fix/audit-cycle`** (branched from `dev` @
+  `0fbb9de`), integration PR to `dev` pending. No wire change
+  (`PROTOCOL_VERSION` stays 2.28.0). It lands the receiver/client security and
+  correctness fixes — `--temp-dir` symlink-escape confinement, special-bit
+  masking under a super-off policy, daemon `umask(022)`, the `-z` decompression
+  ceiling raised to the 256 MiB whole-file bound, `--bwlimit` pacing the
+  plaintext `--sendfile` path, `--partial-dir` implying `--partial`, rejection
+  of unsupported filter modifiers (`x`/`e`/`n`/`w`), client-side
+  `MAX_FILTER_RULES` enforcement, unknown wire `Status` rejection, and the
+  accompanying refactors/docs. The parity matrix is unchanged at
+  **120 ✅ / 10 ⚠️ / 27 ❌ = 157**; this docs pass (worktree `fix/audit-docs2`)
+  corrects the `RSYNC_COMPAT.md` summary tally to match the rows.


 ## What landed this session
@@ -98,7 +110,8 @@
    uptodate` plus the leading `./` root name line for `--info=name` (only the
    root-line trigger condition and receiver-side `skip` wording remain). Matrix
    now **111 ✅ / 14 ⚠️ / 32 ❌ = 157**; differential + unit tests added in
-    `test_features.py`, `test_option_parity.py`, `test_delete_plan.c`,
+    `test_features.py`, `test_option_parity.py`, the unit test
+    `tests/test_delete_plan.c`,
    `test_delete_delay_budget_parity.py`, `test_delete_timing_parity.py`.
 12. **No-wire parity track 2b** on `feat/parity-2.28` (no protocol change):
    `--progress`/`-P`/`--info=progress` (when not `--quiet`) now run an opt-in
@@ -195,17 +208,43 @@
    **116 ✅ / 14 ⚠️ / 27 ❌ = 157** (the `--delete`/`--delete-during` rows stay
    ⚠️ for the abort boundary; `--delete-after` stays ✅).

+17. **Audit cycle** on `fix/audit-cycle` (from `dev` @ `0fbb9de`;
+    `PROTOCOL_VERSION` stays `2.28.0`): a security/correctness pass over the
+    parity-2.29 baseline. It raises the decompression ceiling to the 256 MiB
+    protocol whole-file bound (`-z` on 100–256 MiB files now works), paces the
+    plaintext-TCP `--sendfile` path with `--bwlimit`, confines the `--temp-dir`
+    scratch dir by the fd's real path (symlink escape refused), masks
+    client-controlled setuid/setgid/sticky bits when super activities are not
+    permitted, sets the daemon umask to `022`, makes `--partial-dir` imply
+    `--partial`, rejects the unsupported filter modifiers (`x`/`e`/`n`/`w`),
+    enforces `MAX_FILTER_RULES` client-side, rejects unknown wire `Status`
+    values, and hardens credentials/signal handling (with the accompanying
+    refactors and docs). No row changes classification, so the matrix stays
+    **120 ✅ / 10 ⚠️ / 27 ❌ = 157**. This docs pass is on `fix/audit-docs2`.
+
 ## Next steps
-1. **Merge PR #284** (`dev` -> `main`) once reviewed (protected branch).
-2. **Deferred security items** (documented, not implemented):
-   - Pre-auth config/daemon-auth handshake has no aggregate wall-clock deadline
-     (per-message timeout only) — slowloris holds connection slots.
-   - Per-source registry fails open when the shared table is full (per-module/global
-     caps and host ACLs still apply); consider fail-closed or larger/evicting table.
-   - SCRAM-like daemon auth has no TLS channel binding (and is not RFC 5802).
-   - `cleanup()` signal handler calls non-async-signal-safe teardown; daemon `umask(0)`.
-   - Wire protocol assumes homogeneous word size/endianness (lengths are native
-     `size_t`) — document or move to fixed-width framing.
+1. **Open and merge the audit-cycle PR** (`fix/audit-cycle`, including this
+   `fix/audit-docs2` docs pass) into `dev` once reviewed. `dev` is the default
+   branch; all PRs target `dev`, never `main` directly.
+2. **Remaining deferred items:**
+   - **Large structural refactors:** delete-engine consolidation
+     (`delete_extras_fd`/`manifest_delete_extras`/the delete-plan path),
+     god-function splits, and translation-unit splits.
+   - **`--progress`/`--info` receiver→sender event channel:** the root `./`
+     line, ancestor-directory suppression, receiver-side `skip`/`backup` echo,
+     and symlink/empty-dir quick-check feedback.
+   - **`--delete-before` phase-0 keep-set** (rsync fixes the file list before
+     the data pass; FastSync keeps its pre-scan snapshot race).
+   - **>256 MiB single-file streaming** (B4, the general whole-file limit).
+   - **Wire native-size framing:** lengths are native `size_t` and the protocol
+     assumes homogeneous word size/endianness — document or move to fixed-width
+     framing.
+   - **SCRAM-like daemon auth channel binding:** no TLS channel binding today
+     (and it is not RFC 5802).
+   - Still-open security nits: the pre-auth config/daemon-auth handshake has no
+     aggregate wall-clock deadline (per-message timeout only — slowloris holds
+     connection slots); the per-source registry fails open when the shared table
+     is full (per-module/global caps and host ACLs still apply).
 3. **Out of scope / intentional:** pull (remote source) mode is **not** planned —
   FastSync is push-only; see `RSYNC_COMPAT.md#direction`.

@@ -75,8 +75,9 @@ matrix is classified as parity, caveat, or divergent in
  owner, group, devices, and special files — and does not imply compression or
  multithreading (see [Client](#client)). Ownership application is still
  privilege-gated: a receiver that cannot `chown` logs a warning and skips it.
-  Under `-p` the source mode is copied exactly, including setuid/setgid/sticky
-  and group/other-write bits (strict rsync parity; see
+  Under `-p` the source mode is copied exactly, including group/other-write
+  bits; setuid/setgid/sticky bits are copied only when super-user activities are
+  permitted, and are masked under `SUPER_MODE_OFF`/`--no-super` (see
  [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md)).
 - Symlink transfer stores targets **verbatim** (`-l`/`--links`), including
  absolute and `..`-bearing targets, matching rsync. The receiver does not
@@ -172,7 +173,7 @@ This produces `./build/client` and `./build/server`. `compile_commands.json` is
 | `--preserve` | Preserve mode and mtime (`-p` + `-t`; add `-o`/`-g` for owner/group or `-U`/`--atimes` for atime; `-N`/`--crtimes` captures birth time but cannot apply it) |
 | `-U, --atimes` | Preserve access times. Captured with the metadata payload; does not enable ownership. |
 | `-N, --crtimes` | Capture birth time; cannot be applied (documented divergence) |
-| `-p, --perms` | Preserve permission bits. Strict rsync parity: the source mode is copied exactly, including setuid/setgid/sticky and group/other-write bits |
+| `-p, --perms` | Preserve permission bits. The source mode is copied exactly, including group/other-write bits; setuid/setgid/sticky are copied only when super-user activities are permitted (`SUPER_MODE_OFF`/`--no-super` masks them) |
 | `-t, --times` | Preserve modification times |
 | `-o, --owner` | Preserve the source owner (privilege-gated; mapped by name on the receiver with a numeric fallback) |
 | `-g, --group` | Preserve the source group (privilege-gated; mapped by name on the receiver with a numeric fallback) |
@@ -186,7 +187,7 @@ This produces `./build/client` and `./build/server`. `compile_commands.json` is
 | `--groupmap=MAP` | Map group names when applying ownership |
 | `--numeric-ids` | Apply source numeric uid/gid directly instead of mapping by name |
 | `--copy-as=USER[:GROUP]` | Force every written entry to USER[:GROUP] (requires a privileged receiver) |
-| `--fake-super` | Record the resolved owner plus mode/time in a reserved `user.fastsync.stat` xattr and replay mode/time; never performs a real chown |
+| `--fake-super` | Record the resolved owner plus full mode/rdev in rsync's reserved `user.rsync.%stat` xattr (rsync 3.4.1 grammar) and replay the permission bits; never performs a real chown |
 | `--super` | Permit the receiver to attempt confined super-user activities (device nodes) |
 | `-D` | Preserve device and special files (implies `--devices --specials`) |
 | `--devices` | Recreate device nodes on the destination (privileged; skipped without `CAP_MKNOD`) |
@@ -204,9 +205,10 @@ This produces `./build/client` and `./build/server`. `compile_commands.json` is
 | `-u, --update` | Skip files newer than the source on the receiver |
 | `--incremental` | Skip files unchanged since last transfer (size + mtime). Auto-enables `--preserve`. Incompatible with `--chunk-serialization`. |
 | `--existing` | Skip files not already present at the destination; update existing files normally. |
-| `--compare-dest <dir>` | Extra comparison basis: unchanged files are not transferred (requires/implies `--incremental`) |
-| `--copy-dest <dir>` | Like `--compare-dest`, but copies the unchanged file from DIR into the destination |
-| `--link-dest <dir>` | Like `--copy-dest`, but hard-links the unchanged file from DIR (repeatable; earlier DIRs win) |
+| `--ignore-existing` | Skip files that already exist on the receiver; like rsync it does not apply to directories or symlinks. |
+| `--compare-dest <dir>` | Extra comparison basis: unchanged files are not transferred (requires/implies `--incremental`; a basis MISS above the 256 MiB whole-file payload bound is refused — see [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md)) |
+| `--copy-dest <dir>` | Like `--compare-dest`, but copies the unchanged file from DIR into the destination (same basis-size caveat; see [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md)) |
+| `--link-dest <dir>` | Like `--copy-dest`, but hard-links the unchanged file from DIR (repeatable; earlier DIRs win; same basis-size caveat; see [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md)) |
 | `--verify-basis` | FastSync-only: require a basis hit (`--compare-dest`/`--copy-dest`/`--link-dest`) to match the source by whole-file digest instead of trusting the size+mtime quick-check (default matches rsync) |
 | `--delete` | Delete files on receiver not present in source (default timing: delete-during, matching rsync, so destination space is freed progressively). Scoped to the synchronized directories, so `--files-from` subsets are safe |
 | `--delete-before` | Delete extras before the transfer starts (implies `--delete`) |
@@ -216,24 +218,24 @@ This produces `./build/client` and `./build/server`. `compile_commands.json` is
 | `--delete-commit` | FastSync-only: keep the pre-2.28 atomic timing — delete only after the whole transfer succeeded (identical timing to `--delete-after`) |
 | `--delete-excluded` | Also delete filter-excluded destination mirrors (size-pruned mirrors stay protected) |
 | `--max-delete <n>` | Delete at most n destination entries; the rest are skipped and the run exits 25 (partial), matching rsync |
-| `--delay-updates` | Put updated files into place only at the end of the transfer (`--force` is honored at publication) |
-| `-T, --temp-dir <dir>` | Scratch directory for temp files before the atomic install; confined to the receive root (relative only), with an `EXDEV` non-atomic copy fallback |
+| `--delay-updates` | Put updated files into place only at the end of the transfer (`--force` is honored at publication; the fixed `.fastsync-stage` staging name diverges from rsync — see [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md)) |
+| `-T, --temp-dir <dir>` | Scratch directory for temp files before the atomic install; confined to the receive root (a relative path resolves below it; an absolute path is accepted only when it canonicalizes inside it), with an `EXDEV` non-atomic copy fallback |
 | `-n, --dry-run` | Report what would be transferred without mutating the destination. Since protocol 2.21.0 a server-routed target contacts the receiver and reports would-transfer based on receiver state; a plain local destination keeps the client-side scan. Never mutates or deletes. |
 | `-v, --verbose` | Enable debug logging |
 | `-q, --quiet` | Suppress non-error output |
-| `--progress` | Show rsync-style per-file progress blocks from the receiver's wire counters (FastSync does not print rsync's leading `./` line) |
+| `--progress` | Show rsync-style per-file progress blocks from the receiver's wire counters; the root `./` line is printed whenever progress is active (rsync prints it only when the transfer root is created) |
 | `-P` | Enables partial-transfer mode + progress output; interrupted writes retain the already-written temp for resumption |
-| `--stats` | Print transfer statistics at end (bytes, files, timing), including the receiver-only counters reported over the wire; rsync's per-type `Number of files` breakdown is not reproduced |
+| `--stats` | Print transfer statistics at end (bytes, files, timing), including the receiver-only counters reported over the wire; `Number of files` and `Number of created files` carry rsync's per-type breakdown (deleted files are reported as a single total) |
 | `-i, --itemize-changes` | Print an rsync-style per-file change line |
-| `--out-format=FORMAT` | Output format for changed files (`%f %n %l %b %M %%`) |
+| `--out-format=FORMAT` | Output format for changed files (`%f %n %l %b %c %C %i %M %%`) |
 | `--list-only` | List source files instead of transferring |
 | `--fsync` | Fsync every written file before publication |
 | `-h, --human-readable` | Format transfer byte/rate counts with rsync's decimal (base-1000) units |
 | `--max-depth <n>` | Maximum directory depth to recurse (0 = unlimited, default: 0) |
 | `--log-file <path>` | Write log messages to file instead of stderr |
-| `--write-batch=FILE` | Run the normal live transfer and also emit a self-contained batch file of the source tree |
-| `--only-write-batch=FILE` | Emit the batch file only (no destination, no server) |
-| `--read-batch=FILE` | Apply a batch file to the destination (no source, no server) |
+| `--write-batch=FILE` | Run the normal live transfer and also emit a self-contained batch file of the source tree (FastSync-native format, not rsync-interoperable) |
+| `--only-write-batch=FILE` | Emit the batch file only (no destination, no server); FastSync-native format, not rsync-interoperable |
+| `--read-batch=FILE` | Apply a batch file to the destination (no source, no server); FastSync-native format, not rsync-interoperable |
 | `--source-dir <path>` | Source directory (overrides `FASTSYNC_SOURCE_DIR`) |
 | `--dest-dir <path>` | Server destination directory (overrides `FASTSYNC_DEST_DIR`) |
 | `--save-to-disk` | Write received files to disk |
@@ -246,12 +248,12 @@ This produces `./build/client` and `./build/server`. `compile_commands.json` is
 | `-4, --ipv4` | Force IPv4 for destination resolution |
 | `-6, --ipv6` | Force IPv6 for destination resolution |
 | `--sockopts=OPTS` | Comma-separated OPT=VAL socket options applied before connect (`TCP_NODELAY`, `SO_KEEPALIVE`, `SO_RCVBUF`, `SO_SNDBUF`, `SO_REUSEADDR`) |
-| `--bwlimit <KB/s>` | Bandwidth limit in kilobytes per second |
+| `--bwlimit <RATE>` | Bandwidth limit, using rsync's exact `parse_size_arg` grammar: a bare value is KiB/s; `K`/`M`/`G`/`T`/`P` are binary suffixes; `KB`/`MB` are decimal and `KiB`/`MiB` binary; decimals are accepted and quantized to whole KiB; `0` (or empty) means no limit. Also paces `--sendfile` transfers |
 | `--chunk-size <n>` | Chunk size in bytes (default: 10485760) |
 | `--timeout <sec>` | I/O timeout in seconds, applied to both the socket (`SO_RCVTIMEO`/`SO_SNDTIMEO`) and the per-message protocol poll deadline. Default `0` = disabled (matching rsync); `0` disables it. `--no-timeout` is the negation. The value is not sent on the wire; the server side keeps its own safe floor. |
 | `--contimeout <sec>` | Connection timeout in seconds (default: 60, matching rsync); `0` disables it (`--no-contimeout` is the negation) |
 | `--stop-after=MINS` | Stop the transfer after MINS minutes (a positive integer); whatever was already transferred is kept |
-| `--stop-at=TIME` | Stop at an absolute time (`HH:MM`, `HH:MM:SS`, or `now+N[smhd]`); an early stop skips the late `--delete` keep-set |
+| `--stop-at=TIME` | Stop at an absolute time. Accepts rsync's `parse_time` forms (`Y-M-DTh:m`, `Y/M/DTh:m`, `Y-M-D`, `M-D`, `D`, `h:m`, `:m`, `T h:m`; omitted fields resolve to the next matching point in the local timezone), plus `now+N[smhd]` and FastSync's `HH:MM`/`HH:MM:SS` clock-time spelling. An early stop skips the late `--delete` keep-set |
 | `-b, --backup` | Backup existing destination files before overwriting |
 | `--backup-dir <dir>` | Target directory for backups (requires `--backup`) |
 | `--tls` | Enable TLS encryption |
@@ -314,17 +316,22 @@ transfer is never aborted.
   `timeout`, `contimeout`, `quiet`, `stats`, `max_depth`, and `log_file` are
   client-only.
 5. **Queue** — thread-safe bounded queue with condition variables.
-6. **DirectoryScanner** — recursive BFS traversal with exclude and include
-   pattern support, max-depth enforcement.
+6. **DirectoryScanner** — recursive traversal that buffers and sorts each
+   directory (non-directories ascending, then directories ascending) and walks
+   depth-first in rsync flist order, with exclude and include pattern support and
+   max-depth enforcement.

 ### Key Algorithms

-1. **File scanning** — BFS directory traversal; entries matched against exclude
-   and include patterns, with max-depth enforced.
+1. **File scanning** — sorted depth-first traversal in rsync flist order (each
+   directory's non-directories ascending, then its directories ascending);
+   entries matched against exclude and include patterns, with max-depth
+   enforced. The `--threads` parallel scanner remains unordered.
 2. **Chunking** — files accumulated until the `chunk_size` threshold (default
   10 MiB) is reached, then flushed.
 3. **Compression** — streaming zstd via `ZSTD_compressStream2()` /
-   `ZSTD_decompressStream()`.
+   `ZSTD_decompressStream()`, with lz4 and zlib/zlibx codecs also supported
+   (selectable with `--compress-choice`).
 4. **Network protocol** — status-code-driven exchange with metadata packing,
   keep-alive, and abort support.
 5. **Incremental check** — the client sends `STATUS_CHECK` + path + size +
@@ -379,6 +386,8 @@ Received files are written to a temporary path (suffixed with `.tmp`) and then a
 - C11 compiler
 - CMake >= 3.22
 - zstd library
+- zlib library
+- lz4 library
 - OpenSSL (development headers and libraries)
 - pthreads
 - SSH client (for SSH transport mode only)
@@ -387,12 +396,12 @@ Received files are written to a temporary path (suffixed with `.tmp`) and then a

 **Ubuntu/Debian:**
 ```bash
-sudo apt install cmake build-essential libzstd-dev libssl-dev openssh-client
+sudo apt install cmake build-essential libzstd-dev zlib1g-dev liblz4-dev libssl-dev openssh-client
 ```

 **Nix:**
 ```bash
-nix-shell  # provides zstd, openssl, cmake, gcc
+nix-shell  # provides zstd, zlib, lz4, openssl, cmake, gcc
 ```

 ## Building
@@ -526,9 +535,9 @@ features without changing the meaning of ordinary compatibility options.
 | `--server-host <host>` | Select the TCP server host. |
 | `--server-port <port>` | Select the TCP server port (`--port <port>` and `--port=<port>` are rsync-friendly aliases). |
 | `--tls` | Enable TLS for TCP transport. |
-| `--bwlimit <KB/s>` | Apply token-bucket bandwidth limiting. |
-| `--progress` | Show rsync-style per-file progress blocks from the receiver's wire counters (FastSync omits rsync's leading `./` line). |
-| `--stats` | Print transfer statistics, including the receiver-only counters reported over the wire; rsync's per-type `Number of files` breakdown is not reproduced. |
+| `--bwlimit <RATE>` | Apply token-bucket bandwidth limiting with rsync's exact `parse_size_arg` grammar (bare = KiB/s, `K`/`M`/`G`/`T`/`P` binary, `KB`/`MB` decimal, `KiB`/`MiB` binary, decimals quantized to whole KiB, `0`/empty = no limit; also paces `--sendfile` transfers). |
+| `--progress` | Show rsync-style per-file progress blocks from the receiver's wire counters; the root `./` line is printed whenever progress is active (rsync prints it only when the transfer root is created). |
+| `--stats` | Print transfer statistics, including the receiver-only counters reported over the wire; `Number of files`/`Number of created files` carry rsync's per-type breakdown (deleted files are a single total). |
 | `--timeout <seconds>` | Set the socket **and** per-message protocol I/O timeout. Default `0` = disabled (matching rsync); `0` disables it. |
 | `--contimeout <seconds>` | Connection timeout (default 60, matching rsync); `0` disables it. |

@@ -562,23 +571,26 @@ remote SSH argv is already built injection-safe.
 | `--size-only` | Skip incremental files matching in size, ignoring mtime. |
 | `-I, --ignore-times` | Transfer files even when size and mtime match. |
 | `-u, --update` | Skip files newer than the source on the receiver. |
+| `--ignore-existing` | Skip files that already exist on the receiver; like rsync it does not apply to directories or symlinks. |
+| `-@, --modify-window <sec>` | Modification-time tolerance (seconds) for the incremental/basis quick-check; `0` requires an exact mtime match. |
 | `-W, --whole-file` | Transfer changed files without delta processing (`--no-whole-file` clears it). |
 | `-B <n>, --block-size <n>` | Delta block size in bytes (alias `--delta-block`). |
 | `-d, --dirs` | Transfer the named directory entries without recursing into their contents (aliases `--old-dirs`/`--old-d`). |
 | `-R, --relative` | Use rsync's relative path semantics (including the `/./` cut); with `--files-from`, preserve each listed entry's relative path below the destination root. |
 | `--files-from <file>` | Read the source file list from FILE (paths relative to the source root). |
-| `--delay-updates` | Put updated files into place only at the end of the transfer. |
-| `--compare-dest <dir>` | Extra comparison basis: unchanged files are not transferred (requires/implies `--incremental`). |
-| `--copy-dest <dir>` | Like `--compare-dest`, but copies the unchanged file from DIR into the destination. |
-| `--link-dest <dir>` | Like `--copy-dest`, but hard-links the unchanged file from DIR (repeatable; earlier DIRs win). |
+| `-0, --from0` | Treat entries in `--files-from` files as NUL-delimited instead of newline-delimited. |
+| `--delay-updates` | Put updated files into place only at the end of the transfer (the fixed `.fastsync-stage` staging name diverges from rsync; see [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md)). |
+| `--compare-dest <dir>` | Extra comparison basis: unchanged files are not transferred (requires/implies `--incremental`; a basis MISS above the 256 MiB whole-file payload bound is refused — see [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md)). |
+| `--copy-dest <dir>` | Like `--compare-dest`, but copies the unchanged file from DIR into the destination (same basis-size caveat; see [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md)). |
+| `--link-dest <dir>` | Like `--copy-dest`, but hard-links the unchanged file from DIR (repeatable; earlier DIRs win; same basis-size caveat; see [`RSYNC_COMPAT.md`](RSYNC_COMPAT.md)). |
 | `--verify-basis` | FastSync-only: require a basis hit to match the source by whole-file digest instead of trusting the size+mtime quick-check (default matches rsync). |
 | `--preallocate` | Allocate destination file space up front (fail-fast on a full disk). |
 | `--append` | Resume a shorter destination by appending only its tail (prefix not verified; requires `--incremental`). |
 | `--append-verify` | Like `--append`, but verifies the retained prefix checksum first (falls back to a full transfer on mismatch). |
-| `--delete` | Request removal of destination entries absent from the source. The server must allow deletion. Default timing is delete-after: extras are removed only after the whole transfer succeeded. Scoped to the synchronized directories, so `--files-from` subsets are safe. |
+| `--delete` | Request removal of destination entries absent from the source. The server must allow deletion. Default timing is delete-during (matching rsync's `--del`): extras are removed per directory as the transfer proceeds, so destination space is freed progressively. Scoped to the synchronized directories, so `--files-from` subsets are safe. |
 | `--delete-before` | Delete extras before the transfer starts (implies `--delete`). |
-| `--delete-during`, `--del` | Delete extras once the keep-set manifest is known, before data is applied (implies `--delete`; early mode, same engine behaviour as `--delete-before`). |
-| `--delete-delay` | Delete extras only after a successful transfer (implies `--delete`; commit mode, same behaviour as `--delete-after`). |
+| `--delete-during`, `--del` | Delete each directory's extras as that directory is processed (implies `--delete`). Since protocol 2.24.0 the sender streams a per-directory `STATUS_DELETE_PLAN` frame as it reaches each source directory; this is also the default timing of a plain `--delete`. |
+| `--delete-delay` | Record extras per directory during the scan but remove them only after a successful transfer (implies `--delete`). Uses the same per-directory `STATUS_DELETE_PLAN` frames as `--delete-during`, applied late. |
 | `--delete-commit` | FastSync-only: atomic delete-after timing (only after the whole transfer succeeded). |
 | `--delete-after` | Explicit delete-after timing: delete only after the transfer succeeded (implies `--delete`). |
 | `--delete-excluded` | Also delete filter-excluded destination mirrors (size-pruned mirrors stay protected). |
@@ -594,18 +606,18 @@ remote SSH argv is already built injection-safe.
 | `--max-alloc <SIZE>` | Maximum single allocation (binary units; default 1G; `0` = no local limit). |
 | `--max-depth <n>` | Limit recursive scanning depth; zero means unlimited. |
 | `-b, --backup` | Back up overwritten files. |
-| `-T, --temp-dir <dir>` | Scratch directory for temp files before the atomic install (confined to the receive root; `EXDEV` falls back to a non-atomic copy). |
+| `-T, --temp-dir <dir>` | Scratch directory for temp files before the atomic install (confined to the receive root: relative resolves below it, absolute must canonicalize inside it; `EXDEV` falls back to a non-atomic copy). |
 | `--backup-dir <dir>` | Store backups under a separate directory (requires `--backup`). |
 | `--suffix <suffix>` | Set the backup filename suffix (default: `~`). |
 | `--partial` | Select partial-transfer handling. On failed/interrupted writes the already-written temp file is retained (best-effort) for resumption. With `--partial --partial-dir <dir>`, completed files are written under the partial directory and installed atomically. |
-| `--partial-dir <dir>` | Set a relative partial-transfer directory below the server destination root. Use with `--partial`. |
-| `--inplace` | Write directly to the destination instead of using a temporary file. |
+| `--partial-dir <dir>` | Set a relative partial-transfer directory below the server destination root. Implies `--partial`. Rejected together with `--inplace` (`--inplace cannot be used with --partial-dir`, matching rsync), because the inplace path bypasses partial/temp staging. |
+| `--inplace` | Write directly to the destination instead of using a temporary file. Cannot be combined with `--partial-dir`. |
 | `--fsync` | Fsync every written file before publication. |
-| `--write-batch=FILE` | Run the normal live transfer and also emit a self-contained batch file of the source tree. |
-| `--only-write-batch=FILE` | Emit the batch file only (no destination, no server). |
-| `--read-batch=FILE` | Apply a batch file to the destination (no source, no server). |
+| `--write-batch=FILE` | Run the normal live transfer and also emit a self-contained batch file of the source tree (FastSync-native format, not rsync-interoperable). |
+| `--only-write-batch=FILE` | Emit the batch file only (no destination, no server); FastSync-native format, not rsync-interoperable. |
+| `--read-batch=FILE` | Apply a batch file to the destination (no source, no server); FastSync-native format, not rsync-interoperable. |
 | `--stop-after=MINS` | Stop the transfer after MINS minutes; whatever was already transferred is kept. |
-| `--stop-at=TIME` | Stop at an absolute time (`HH:MM`, `HH:MM:SS`, or `now+N[smhd]`). An early stop skips the late `--delete` keep-set. |
+| `--stop-at=TIME` | Stop at an absolute time. Accepts rsync's `parse_time` forms (`Y-M-DTh:m`, `Y/M/DTh:m`, `Y-M-D`, `M-D`, `D`, `h:m`, `:m`, `T h:m`; omitted fields resolve to the next matching point in the local timezone), plus `now+N[smhd]` and FastSync's `HH:MM`/`HH:MM:SS` clock-time spelling. An early stop skips the late `--delete` keep-set. |

 ### Metadata and links

@@ -614,8 +626,11 @@ remote SSH argv is already built injection-safe.
 | `--preserve` | Preserve mode and mtime (long form only; equivalent to `-p` + `-t`). Add `-o`/`-g` for owner/group, `-U`/`--atimes` for atime, or an identity flag (`--chown`/`--usermap`/`--groupmap`/`--numeric-ids`/`--copy-as`) for mapped ownership. |
 | `-U`, `--atimes` | Preserve access times. Captured with the metadata payload; does not enable ownership. |
 | `-N`, `--crtimes` | Capture birth time and transmit it; it cannot be applied because no portable filesystem call can set a birth time (documented divergence). |
-| `-p`, `--perms` | Preserve permission bits. One of the four per-attribute preserve flags (with `-t`/`-o`/`-g`); under `-p` the source mode is copied exactly (setuid/setgid/sticky and group/other-write included), matching rsync. |
+| `-p`, `--perms` | Preserve permission bits. One of the four per-attribute preserve flags (with `-t`/`-o`/`-g`); under `-p` the source mode is copied exactly (group/other-write included; setuid/setgid/sticky included only when super-user activities are permitted, masked under `SUPER_MODE_OFF`/`--no-super`), matching rsync otherwise. |
 | `-t`, `--times` | Preserve modification times. Independent of the other attributes; `-O`/`--omit-dir-times` suppresses directories only. |
+| `-O`, `--omit-dir-times` | Do not apply modification times to directories. |
+| `-J`, `--omit-link-times` | Do not apply times to symlinks. |
+| `--open-noatime` | Open source files with `O_NOATIME` so reading for a transfer does not update their access time (client-only). |
 | `-o`, `--owner` | Preserve the source owner (uid). Mapped by name on the receiver with a raw-numeric fallback (only numeric ids cross the wire); application is privilege-gated. |
 | `-g`, `--group` | Preserve the source group (gid). Same name-mapping/numeric-fallback and privilege gating as `-o`. |
 | `--no-perms`, `--no-times`, `--no-owner`, `--no-group` | Negate each per-attribute flag (also `--no-p`/`--no-t`/`--no-o`/`--no-g`); `--no-preserve` clears all four. |
@@ -628,7 +643,7 @@ remote SSH argv is already built injection-safe.
 | `--groupmap=MAP` | Map group names when applying ownership (same syntax as `--usermap`). |
 | `--numeric-ids` | Mapping modifier: apply the source numeric uid/gid directly instead of mapping by name (combine with `-o`/`-g`, `-a`, or a map). |
 | `--copy-as=USER[:GROUP]` | Force every written entry to USER[:GROUP]; requires a privileged receiver. |
-| `--fake-super` | Record the resolved owner plus mode/time in a reserved `user.fastsync.stat` xattr and replay mode/time; never performs a real chown. |
+| `--fake-super` | Record the resolved owner plus full mode/rdev in rsync's reserved `user.rsync.%stat` xattr (rsync 3.4.1 grammar) and replay the permission bits; never performs a real chown. |
 | `--super` | Permit the receiver to attempt confined super-user activities (device nodes). |
 | `--no-super` | Forbid those super-user activities even when the receiver is root. |
 | `-l`, `--links` | Copy symlinks as symlinks; the target is stored verbatim (absolute and `..`-bearing targets included), matching rsync. |
@@ -642,6 +657,7 @@ remote SSH argv is already built injection-safe.
 | `-D` | Preserve device and special files (implies `--devices --specials`). |
 | `--devices` | Recreate device nodes on the destination (privileged; skipped without `CAP_MKNOD`). |
 | `--specials` | Recreate special files: FIFOs and unix sockets. |
+| `--copy-devices` | Copy a source device's content as an ordinary regular file on the destination (rsync's non-privileged safe mode) instead of recreating the device node. |
 | `-S`, `--sparse` | Sparse-file handling: receiver preserves holes (zero runs are written as holes; no wire change). |

 ### Output and logging
@@ -650,12 +666,17 @@ remote SSH argv is already built injection-safe.
 |---|---|
 | `-v`, `--verbose` | Enable debug logging. |
 | `-q`, `--quiet` | Suppress non-error output. |
-| `--progress` | Show rsync-style per-file progress blocks (not rsync's leading `./` line). |
-| `--stats` | Print transfer statistics, including the receiver-only counters reported over the wire. |
-| `-i`, `--itemize-changes` | Print an rsync-style per-file change line. |
-| `--out-format=FORMAT` | Output format for changed files (`%f %n %l %b %M %%`). |
+| `--progress` | Show rsync-style per-file progress blocks; the root `./` line is printed whenever progress is active (rsync prints it only when the transfer root is created). |
+| `--stats` | Print transfer statistics, including the receiver-only counters reported over the wire; `Number of files`/`Number of created files` carry rsync's per-type breakdown (deleted files are a single total). |
+| `-i, --itemize-changes` | Print an rsync-style per-file change line. |
+| `--out-format=FORMAT` | Output format for changed files (`%f %n %l %b %c %C %i %M %%`). |
 | `--list-only` | List source files instead of transferring. |
+| `--outbuf=MODE` | stdout/stderr buffering: `N` (none/unbuffered), `L` (line-buffered), or `B` (block-buffered, default). |
 | `--log-file <path>` | Write log output to a file. |
+| `--log-file-format=FORMAT` | Per-file log-line format (requires `--log-file`). |
+| `--stderr=MODE` | Route logging to stderr: `errors` or `all`. |
+| `--msgs2stderr` | Route all messages to stderr (deprecated spelling of `--stderr=all`). |
+| `--no-msgs2stderr` | Select errors-only stderr (deprecated spelling; the default). |
 | `-V`, `--version` | Print the FastSync protocol version. |
 | `--help` | Print command usage. |

@@ -668,7 +689,7 @@ remote SSH argv is already built injection-safe.
 | `--fastsync-server-path <path>` | Remote FastSync server path for SSH mode (client-only; never crosses the wire). |
 | `--rsync-path <path>` | Alias for `--fastsync-server-path`. |
 | `-M`, `--remote-option=OPT` | Append OPT to the remote server invocation over SSH (repeatable; rejected for daemon/TCP destinations). |
-| `--trust-sender` | Receiver-local: trust the remote sender's file list and skip path re-validation (does not affect symlink targets). |
+| `--trust-sender` | Receiver-local: trust the remote sender's file list and skip path re-validation (does not affect symlink targets). **On the client this flag alone is inert** — it is never sent on the wire; the server must be started with its own `--trust-sender`, or the client must forward it with `-M--trust-sender` (SSH only). |
 | `--timeout <sec>` | Socket + per-message I/O timeout; default `0` = disabled. |
 | `--contimeout <sec>` | Connection timeout; default 60; `0` disables. |
 | `--source-dir <path>` | Set the source directory explicitly. |
@@ -680,6 +701,11 @@ remote SSH argv is already built injection-safe.
 | `-4`, `--ipv4` | Force IPv4 for destination resolution. |
 | `-6`, `--ipv6` | Force IPv6 for destination resolution. |
 | `--sockopts=OPTS` | Comma-separated OPT=VAL socket options applied before connect. |
+| `--blocking-io` | SSH transport only: leave the socket without read/write timeouts so it blocks naturally (no effect on TCP). |
+| `--protocol=NUM` | Force the wire protocol version; must equal the current `PROTOCOL_VERSION` (FastSync cannot speak older/virtual wire formats). |
+| `--old-args` | Accepted for rsync CLI compatibility; no effect (the remote server path is always safely quoted). |
+| `--iconv=LOCAL[,REMOTE]` | Convert file-name charsets at the wire boundary (`LOCAL` is our names' charset, `REMOTE` the peer's, defaulting to `LOCAL`). |
+| `--no-iconv` | Disable `--iconv` charset conversion (same as `--iconv=-`). |
 | `--tls` | Enable TLS. Requires `--cert`, `--key`, and `--ca`. |
 | `--cert <path>` | TLS certificate file. |
 | `--key <path>` | TLS private key file. |
@@ -706,14 +732,14 @@ remote SSH argv is already built injection-safe.
 | `-6`, `--ipv6` | Bind an IPv6 socket. |
 | `--allow-delete` | Permit client delete manifests. Deletion is refused by default. This also gates `--force` (which can recursively replace/remove a destination directory tree). |
 | `--allow-super` | Standalone TCP listener only: keep super-user activities enabled for a **root** receiver. Without it a root standalone server forces `SUPER_MODE_OFF`, so client `--devices`/`--write-devices`/`--super` and client-chosen ownership requests are skipped/refused. Rejected with `--stdio` (the SSH remote argv is client-composed; use a forced command if the default must hold). No effect when not root. Daemon modules opt in per module with `client owner = yes`. |
-| `--trust-sender` | Trust the remote sender's file list: skip the receiver's up-front path-traversal re-validation (fewer checks, faster, potentially unsafe; off by default). It does not affect symlink targets, which are stored verbatim either way. |
+| `--trust-sender` | Trust the remote sender's file list: skip the receiver's up-front path-traversal re-validation (fewer checks, faster, potentially unsafe; off by default). It does not affect symlink targets, which are stored verbatim either way. A client `--trust-sender` is never sent over the wire — the server must set this flag itself, or the client must forward it via `-M--trust-sender`. |
 | `--no-super` | Operator veto: never attempt super-user activities (ownership, device nodes) even as root, and refuse any client `--copy-as`/`--super` request. |
 | `--allow-unauthenticated` | Permit plaintext/anonymous network clients; an auth-required module still accepts only opted-in loopback plaintext. |
 | `--iconv=LOCAL[,REMOTE]` | Declare this server's LOCAL charset for file-name conversion. |
-| `--password-file=FILE` | Credential store for modules that declare `auth users`. Requires `--daemon`. |
-| `--early-input=FILE` | Second credential store layered over `--password-file`. Requires `--daemon`. |
-| `--hash-credentials <file>` | Read `<file>`'s `user:password` lines and print PBKDF2 credential-store lines to stdout, then exit. Cannot be combined with `--daemon` or `--stdio`. |
-| `--iterations N` | PBKDF2 iteration count for `--hash-credentials` (default 600000, range 100000–10000000). Requires `--hash-credentials`. |
+| `--password-file=FILE` | Credential store for modules that declare `auth users`. Requires `--daemon`. FastSync-native SCRAM/PBKDF2 format, not rsync-interoperable. |
+| `--early-input=FILE` | Second credential store layered over `--password-file`. Requires `--daemon`. FastSync-native format, not rsync-interoperable. |
+| `--hash-credentials <file>` | Read `<file>`'s `user:password` lines and print PBKDF2 credential-store lines to stdout, then exit. Cannot be combined with `--daemon` or `--stdio`. FastSync-native, not rsync-interoperable. |
+| `--iterations N` | PBKDF2 iteration count for `--hash-credentials` (default 600000, range 100000–10000000). Requires `--hash-credentials`. FastSync-native, not rsync-interoperable. |
 | `-v`, `--verbose` | Enable debug logging. |
 | `--help` | Print server usage. |

@@ -742,9 +768,17 @@ and `address`, the global section accepts:
 - `hosts allow` / `hosts deny` — comma- and/or whitespace-separated host access
  patterns.

-A `[module]` requires `path`, and may also set `read only`, `client owner`,
-`auth users`, `max connections` (0 = unlimited; enforced per module across all
-connection children), and its own `hosts allow`/`hosts deny`.
+A `[module]` requires `path`, and may also set `read only`, `write only`,
+`client owner`, `auth users`, `max connections` (0 = unlimited; enforced per
+module across all connection children), and its own `hosts allow`/`hosts deny`.
+
+Like rsync, a module is **read-only by default**: a bare `[module]` with only a
+`path` refuses a write transfer. Opt a module into writability explicitly with
+`read only = no` or `write only = yes`; a global `read only` value in the
+section before the first `[module]` sets the default for later modules, and a
+module's own `read only`/`write only = yes` always wins over it. An
+rsync-style `write only = yes` is mapped to writability because FastSync is
+push-only (a module can never be read from the network).

 The per-host cap and the shared auth lockout identify a source by its numeric
 peer IP. **Loopback peers (127.0.0.0/8, IPv6 `::1`) are exempt**: every local
@@ -798,7 +832,7 @@ before the module list, before authentication, and the connecting peer address

 ## Protocol and Security

-FastSync protocol version `2.28.0` is shared by the client and server. The
+FastSync protocol version `2.29.0` is shared by the client and server. The
 current protocol is sender-driven and includes configuration negotiation,
 including the maximum allocation limit, incremental checks, checksums,
 manifests, keep-alives, abort handling, per-file remove-source results, and
@@ -871,8 +905,10 @@ The project will reach the drop-in replacement goal in stages:
   completion wave's scope; the tests live in `tests/integration/` and skip
   cleanly when rsync is unavailable.
 3. `-a` implements full rsync `-rlptgoD`; under `-p` the source mode is copied
-   exactly (no masking). Ownership application stays privilege-gated, as in
-   rsync.
+   exactly, including group/other-write bits, with setuid/setgid/sticky copied
+   only when super-user activities are permitted (masked under
+   `SUPER_MODE_OFF`/`--no-super`). Ownership application stays privilege-gated,
+   as in rsync.
 4. Symlink (verbatim storage), sparse-file, metadata, delete-policy (including
   `--max-delete` partial + exit 25, per-directory `--delete-during`/
   `--delete-delay`), codecs, and resumable-write semantics are implemented;
@@ -141,6 +141,10 @@ static void itemize_code(const Config* config, const ChangeEvent* event, char co
    update = 'h';
  else if (created)
    update = (event->is_directory || event->is_symlink || event->is_special) ? 'c' : '>';
+  else if (event->is_directory)
+    /* rsync: an existing directory that only has attribute changes carries no
+       transfer, so the update column is `.` rather than `>`. */
+    update = '.';
  else
    update = '>';
  code[0] = update;
@@ -168,12 +172,15 @@ static void itemize_code(const Config* config, const ChangeEvent* event, char co
  code[11] = '\0';
 }

-/* rsync %n: the transfer-relative name, with a trailing slash for directories. */
+/* rsync %n: the transfer-relative name, with a trailing slash for directories.
+ * The transfer root is `.` (so `%n` renders `./`), matching rsync's root entry. */
 static bool append_name(StrBuf* buf, const ChangeEvent* event) {
-  if (!strbuf_append(buf, event->name != NULL ? event->name : ""))
+  const char* name = event->name != NULL ? event->name : "";
+  if (event->is_directory && name[0] == '\0')
+    return strbuf_append(buf, "./");
+  if (!strbuf_append(buf, name))
    return false;
-  if (event->is_directory && (event->name == NULL || event->name[0] == '\0' ||
-                              event->name[strlen(event->name) - 1] != '/'))
+  if (event->is_directory && name[strlen(name) - 1] != '/')
    return strbuf_append_char(buf, '/');
  return true;
 }
@@ -245,7 +252,7 @@ static char* change_render_name_uptodate(const ChangeEvent* event) {
 * resolves to xxh128, so an explicit selection and the default both render the
 * selected algorithm's digest. */
 static ChecksumAlgo out_format_checksum_algo(const Config* config) {
-  return (ChecksumAlgo)config->checksum_transfer_algo;
+  return (ChecksumAlgo)config->cli.checksum_transfer_algo;
 }

 /* Render a digest as rsync's sum_as_hex: xxh128 prints the HIGH 64-bit half
@@ -54,13 +54,26 @@ bool client_abort_pending(void) {
 }

 #ifndef FASTSYNC_TEST_BUILD
+/* SIG_DFL disposition used by the handler's "not armed" fallback.  It is built
+ * once at load time so the handler can restore the default action with
+ * sigaction(2) -- which is async-signal-safe -- instead of signal(3), which is
+ * not.  The zero-initialized sa_mask is the empty set. */
+static const struct sigaction client_default_action = {
+    .sa_handler = SIG_DFL,
+    .sa_flags = 0,
+};
+
 /* Signal handler: perform NO work beyond storing the flag.  Logging, protocol
 * I/O and the STATUS_ABORT frame are all done later on the normal send path,
- * which is not async-signal-safe.  When no transfer is armed, fall back to the
- * default action so local-only modes remain interruptible. */
+ * which is not async-signal-safe.  When no transfer is armed, restore the
+ * default disposition (async-signal-safe sigaction) and re-raise so local-only
+ * modes remain interruptible.  The handler deliberately stays installed while a
+ * transfer is armed -- rather than using SA_RESETHAND -- so a second Ctrl-C
+ * during the graceful abort keeps setting the flag instead of hard-killing the
+ * process mid-cleanup. */
 static void client_signal_handler(int signo) {
  if (!client_abort_armed) {
-    signal(signo, SIG_DFL);
+    sigaction(signo, &client_default_action, NULL);
    raise(signo);
    return;
  }
@@ -157,7 +170,7 @@ static int set_positive_int_option(int* dest, const char* value, const char* opt
 * name is a hard error with rsync's exit code 4, never a silent no-op. */
 static int set_compression_choice(Config* config, const char* value) {
  if (!value) {
-    config->cli_exit_code = 4;
+    config->cli.cli_exit_code = 4;
    return -1;
  }
  int algo;
@@ -165,7 +178,7 @@ static int set_compression_choice(Config* config, const char* value) {
    algo = compression_choice_resolve();
    if (algo < 0) {
      log_message(LOG_LEVEL_ERROR, "RSYNC_COMPRESS_LIST names no supported compression algorithm");
-      config->cli_exit_code = 4;
+      config->cli.cli_exit_code = 4;
      return -1;
    }
  } else {
@@ -176,7 +189,7 @@ static int set_compression_choice(Config* config, const char* value) {
                "--compress-choice '%s' is not a supported algorithm; FastSync supports zstd, "
                "lz4, zlib, zlibx, none or auto",
                value);
-    config->cli_exit_code = 4;
+    config->cli.cli_exit_code = 4;
    return -1;
  }
  const char* canonical = compression_algo_name((CompressionAlgo)algo);
@@ -213,7 +226,7 @@ static int resolve_checksum_name(const char* name, size_t len, int* out) {
 * resolves to FastSync's negotiated default (xxh128). */
 static int set_checksum_choice(Config* config, const char* value) {
  if (!value) {
-    config->cli_exit_code = 4;
+    config->cli.cli_exit_code = 4;
    return -1;
  }
  const char* comma = strchr(value, ',');
@@ -231,7 +244,7 @@ static int set_checksum_choice(Config* config, const char* value) {
                "--checksum-choice '%s' is invalid; FastSync supports xxh64 (or xxhash), xxh128, "
                "xxh3, md5, md4, sha1, none or auto, optionally as 'transfer,pre-transfer'",
                value);
-    config->cli_exit_code = 4;
+    config->cli.cli_exit_code = 4;
    return -1;
  }
  int negotiated = -1;
@@ -239,7 +252,7 @@ static int set_checksum_choice(Config* config, const char* value) {
    negotiated = checksum_choice_resolve();
    if (negotiated < 0) {
      log_message(LOG_LEVEL_ERROR, "RSYNC_CHECKSUM_LIST names no supported checksum algorithm");
-      config->cli_exit_code = 4;
+      config->cli.cli_exit_code = 4;
      return -1;
    }
  }
@@ -251,8 +264,8 @@ static int set_checksum_choice(Config* config, const char* value) {
    pre = negotiated;

  config->checksum_algo = pre;
-  config->checksum_transfer_algo = transfer;
-  config->checksum_choice_set = true;
+  config->cli.checksum_transfer_algo = transfer;
+  config->cli.checksum_choice_set = true;
  /* rsync: "none" for the transfer checksum forces --whole-file. */
  if (transfer == (int)CHECKSUM_ALGO_NONE)
    config->whole_file = true;
@@ -504,9 +517,8 @@ static bool split_flag_level(const char* token, char* name, size_t name_size, in
 * of rsync's `symsafe`, `hlink`, and `own`. */
 static bool is_accepted_debug_category(const char* name) {
  static const char* const categories[] = {
-      "acl",   "backup", "bind",   "chdir", "cmd",   "connect", "del",  "deltasum",
-      "dup",   "exit",   "filter", "flist", "fuzzy", "genr",    "hash", "hl",
-      "hlink", "iconv",  "nstr",   "own",   "owner", "recv",    "send", "time",
+      "acl",  "backup", "bind",  "chdir", "cmd",  "connect", "dup",   "exit", "fuzzy",
+      "genr", "hl",     "hlink", "iconv", "nstr", "own",     "owner", "time",
  };
  for (size_t i = 0; i < sizeof(categories) / sizeof(categories[0]); i++) {
    if (strcmp(name, categories[i]) == 0)
@@ -518,7 +530,6 @@ static bool is_accepted_debug_category(const char* name) {
 static bool is_accepted_info_category(const char* name) {
  static const char* const categories[] = {
      "backup",
-      "mount",
      "syms",
      "symsafe",
  };
@@ -571,6 +582,18 @@ static int parse_debug_flags(const char* value, Config* config) {
      flag = LOG_DEBUG_PACK;
    } else if (strcmp(name, "util") == 0) {
      flag = LOG_DEBUG_UTIL;
+    } else if (strcmp(name, "flist") == 0) {
+      flag = LOG_DEBUG_FLIST;
+    } else if (strcmp(name, "del") == 0) {
+      flag = LOG_DEBUG_DEL;
+    } else if (strcmp(name, "hash") == 0 || strcmp(name, "deltasum") == 0) {
+      flag = LOG_DEBUG_HASH;
+    } else if (strcmp(name, "recv") == 0) {
+      flag = LOG_DEBUG_RECV;
+    } else if (strcmp(name, "filter") == 0) {
+      flag = LOG_DEBUG_FILTER;
+    } else if (strcmp(name, "send") == 0) {
+      flag = LOG_DEBUG_SEND;
    } else if (is_accepted_debug_category(name)) {
      continue;
    } else {
@@ -645,9 +668,12 @@ static int parse_info_flags(const char* value, Config* config) {
      flag = LOG_INFO_MISC;
    else if (strcmp(name, "skip") == 0)
      flag = LOG_INFO_SKIP;
-    else if (strcmp(name, "stats") == 0)
+    else if (strcmp(name, "stats") == 0) {
      flag = LOG_INFO_STATS;
-    else if (strcmp(name, "del") == 0)
+      /* `--info=stats` requests the same transfer-statistics block as
+         `--stats`; `--info=stats0` turns it back off. */
+      config->stats = level > 0;
+    } else if (strcmp(name, "del") == 0)
      flag = LOG_INFO_DEL;
    else if (strcmp(name, "remove") == 0)
      flag = LOG_INFO_REMOVE;
@@ -655,6 +681,8 @@ static int parse_info_flags(const char* value, Config* config) {
      flag = LOG_INFO_FLIST;
    else if (strcmp(name, "nonreg") == 0)
      flag = LOG_INFO_NONREG;
+    else if (strcmp(name, "mount") == 0)
+      flag = LOG_INFO_MOUNT;
    else if (strcmp(name, "progress") == 0)
      flag = LOG_INFO_PROGRESS;
    else if (is_accepted_info_category(name))
@@ -934,8 +962,18 @@ static const OptionEntry OPTION_TABLE[] = {
    /* rsync -r/--recursive: FastSync is always recursive, so this is a
     * faithful no-op (accepted silently, never consumes an argument). */
    {"--recursive", "-r", OPT_NOOP, 0},
+    /* rsync's incremental-recursion scan-mode switch.  FastSync always performs
+     * a single full recursive scan, so both spellings are accepted as no-ops:
+     * the destination is identical whichever mode the caller requests.
+     * --no-inc-recursive is handled before the generic --no-* negation branch
+     * (see cli_handle_pre_negation) but is registered here for discoverability. */
+    {"--inc-recursive", NULL, OPT_NOOP, 0},
+    {"--no-inc-recursive", NULL, OPT_NOOP, 0},
    {"--update", "-u", OPT_FLAG, offsetof(Config, update)},
-    {"--old-args", NULL, OPT_FLAG, offsetof(Config, old_args)},
+    /* rsync's --old-args: accepted for CLI compatibility as a documented no-op
+     * (the remote server path is always safely quoted; see usage.c).  It is
+     * recognized but stores no Config field. */
+    {"--old-args", NULL, OPT_NOOP, 0},
    {"--rsh", "-e", OPT_STRING, offsetof(Config, rsh_command)},
    {"--blocking-io", NULL, OPT_FLAG, offsetof(Config, blocking_io)},
    {"--links", "-l", OPT_FLAG, offsetof(Config, follow_symlinks)},
@@ -1168,12 +1206,12 @@ static int apply_negation(Config* config, const char* arg) {
    config->preserve_times = false;
    config->preserve_owner = false;
    config->preserve_group = false;
-    config->metadata_explicitly_disabled = true;
+    config->cli.metadata_explicitly_disabled = true;
    /* --no-preserve is an explicit opt-out of the whole bundle: record it so
     * the --incremental/--delta auto-preserve in cli_finalize_config does not
     * silently re-enable perms/times. */
-    config->preserve_perms_explicit_off = true;
-    config->preserve_times_explicit_off = true;
+    config->cli.preserve_perms_explicit_off = true;
+    config->cli.preserve_times_explicit_off = true;
    return 0;
  }
  *(bool*)((char*)config + entry->offset) = false;
@@ -1181,9 +1219,9 @@ static int apply_negation(Config* config, const char* arg) {
   * auto-preserve the OTHER attribute without undoing this one.  A later
   * -p/-t sets the attribute directly; this flag only gates the implication. */
  if (entry->offset == offsetof(Config, preserve_perms))
-    config->preserve_perms_explicit_off = true;
+    config->cli.preserve_perms_explicit_off = true;
  else if (entry->offset == offsetof(Config, preserve_times))
-    config->preserve_times_explicit_off = true;
+    config->cli.preserve_times_explicit_off = true;
  return 0;
 }

@@ -1213,7 +1251,13 @@ static int apply_table_option(Config* config, const OptionEntry* entry, const ch
  void* field = (char*)config + entry->offset;
  switch (entry->kind) {
  case OPT_FLAG:
-    *(bool*)field = true;
+    /* -x/--one-file-system is repeatable in rsync: `-xx` increments the level so
+       the scanner drops mount-point directories instead of recreating them
+       empty.  Everything else is a plain boolean. */
+    if (entry->offset == offsetof(Config, one_file_system))
+      (*(int*)field)++;
+    else
+      *(bool*)field = true;
    return 0;
  case OPT_NOOP:
    return 0;
@@ -1350,6 +1394,12 @@ static bool cli_handle_pre_negation(CliParseCtx* ctx) {
      ctx->no_delta = true;
    else if (strcmp(arg, "--no-incremental") == 0)
      ctx->no_incremental = true;
+    /* Real rsync option names that merely start with "--no-" and are inert
+     * no-ops (e.g. --no-inc-recursive) are registered as OPT_NOOP entries;
+     * accept them before the generic negation table would reject the name. */
+    const OptionEntry* noop = find_table_option(arg);
+    if (noop && noop->kind == OPT_NOOP)
+      return true;
    if (apply_negation(config, arg) != 0) {
      ctx->exit_code = -1;
      return true;
@@ -1406,7 +1456,7 @@ static bool cli_handle_range_time_options(CliParseCtx* ctx) {
      ctx->exit_code = -1;
      return true;
    }
-    config->stop_at_set = true;
+    config->cli.stop_at_set = true;
    return true;
  }
  if (strcmp(arg, "--stop-at") == 0) {
@@ -1421,7 +1471,7 @@ static bool cli_handle_range_time_options(CliParseCtx* ctx) {
      ctx->exit_code = -1;
      return true;
    }
-    config->stop_at_set = true;
+    config->cli.stop_at_set = true;
    return true;
  }
  const char* threads_prefix = "--compress-threads=";
@@ -1492,7 +1542,7 @@ static bool cli_handle_table_option(CliParseCtx* ctx) {
        return true;
      }
      if (entry->offset == offsetof(Config, compression_level))
-        config->compression_level_set = true;
+        config->cli.compression_level_set = true;
      if (entry->offset == offsetof(Config, chmod_spec)) {
        mode_t ignored;
        if (!chmod_apply(0, config->chmod_spec, &ignored)) {
@@ -1505,7 +1555,7 @@ static bool cli_handle_table_option(CliParseCtx* ctx) {
         defaults to 127.0.0.1, so a value check cannot distinguish it).  Used
         by --dry-run to route an explicit remote target to the server. */
      if (entry->offset == offsetof(Config, server_host))
-        config->server_host_set = true;
+        config->cli.server_host_set = true;
    }
  } else if (apply_table_option(config, entry, NULL) != 0) {
    ctx->exit_code = -1;
@@ -1779,7 +1829,7 @@ static bool cli_handle_transfer_flags(CliParseCtx* ctx) {
          return true;
        }
        config->compression_level = (int)level;
-        config->compression_level_set = true;
+        config->cli.compression_level_set = true;
        log_info_message(LOG_INFO_MISC, "Set Compression level to %ld", level);
        ctx->i++;
      }
@@ -1843,7 +1893,7 @@ static int set_server_port_option(Config* config, const char* value, const char*
    return -1;
  }
  config->server_port = port;
-  config->server_port_set = true;
+  config->cli.server_port_set = true;
  return 0;
 }

@@ -2574,7 +2624,11 @@ static bool cli_handle_outbuf_option(CliParseCtx* ctx) {
 * load --files-from once every argument has been seen.  Returns 0 on success,
 * -1 on error. */
 static int cli_finalize_config(Config* config, bool verbose, bool no_delta, bool no_incremental) {
-  set_log_level(config->quiet ? LOG_LEVEL_ERROR : (verbose ? LOG_LEVEL_DEBUG : LOG_LEVEL_WARNING));
+  /* An explicit --debug=FLAGS enables the debug log level by itself (rsync
+     behaviour); -v enables every other INFO-level message. */
+  bool debug_enabled = verbose || config->debug_level != 0;
+  set_log_level(config->quiet ? LOG_LEVEL_ERROR
+                              : (debug_enabled ? LOG_LEVEL_DEBUG : LOG_LEVEL_WARNING));
  /* rsync's plain --delete defaults to delete-during (--del): each directory's
     extras are removed as that directory is processed, so space is freed
     progressively and a tight destination never has to hold the whole old+new
@@ -2587,6 +2641,15 @@ static int cli_finalize_config(Config* config, bool verbose, bool no_delta, bool
  if (config->use_delete && !config->delete_before && !config->delete_during &&
      !config->delete_delay && !config->delete_after)
    config->delete_during = true;
+  /* rsync parity: --partial-dir=DIR chooses where an interrupted transfer's
+     partial file is kept, so it implies --partial.  rsync applies the
+     implication after option parsing, so it wins over an explicit --no-partial
+     regardless of the order the two options appear in (verified on rsync
+     3.4.1).  --inplace is the exception: the destination file is written in
+     place with no partial/temp staging, so the partial machinery is bypassed
+     and the implication is skipped to leave --inplace behavior untouched. */
+  if (config->partial_dir && !config->inplace)
+    config->partial = true;
  if (config->compress_choice) {
    int algo = compression_algo_from_name(config->compress_choice);
    if (algo >= 0) {
@@ -2601,7 +2664,7 @@ static int cli_finalize_config(Config* config, bool verbose, bool no_delta, bool
    int resolved = compression_choice_resolve();
    if (resolved < 0) {
      log_message(LOG_LEVEL_ERROR, "RSYNC_COMPRESS_LIST names no supported compression algorithm");
-      config->cli_exit_code = 4;
+      config->cli.cli_exit_code = 4;
      return -1;
    }
    config->compression_algo = resolved;
@@ -2612,7 +2675,7 @@ static int cli_finalize_config(Config* config, bool verbose, bool no_delta, bool
   * clamped to the codec's range, otherwise the codec's own default is used. */
  if (config->use_compression) {
    CompressionAlgo algo = (CompressionAlgo)config->compression_algo;
-    config->compression_level = config->compression_level_set
+    config->compression_level = config->cli.compression_level_set
                                    ? compression_clamp_level(algo, config->compression_level)
                                    : compression_default_level(algo);
    log_debug_message(LOG_DEBUG_UTIL, "Client compression: %s (level %d)",
@@ -2621,22 +2684,22 @@ static int cli_finalize_config(Config* config, bool verbose, bool no_delta, bool
  /* The negotiated checksum is always resolved (rsync negotiates one for the
   * delta strong sum even without --checksum): RSYNC_CHECKSUM_LIST first, then
   * the compiled-in order.  An explicit --checksum-choice already set it. */
-  if (!config->checksum_choice_set) {
+  if (!config->cli.checksum_choice_set) {
    int resolved = checksum_choice_resolve();
    if (resolved < 0) {
      log_message(LOG_LEVEL_ERROR, "RSYNC_CHECKSUM_LIST names no supported checksum algorithm");
-      config->cli_exit_code = 4;
+      config->cli.cli_exit_code = 4;
      return -1;
    }
    config->checksum_algo = resolved;
-    config->checksum_transfer_algo = resolved;
+    config->cli.checksum_transfer_algo = resolved;
  }
  /* rsync parity: "none" as the pre-transfer checksum cannot be combined with
   * --checksum (exit 4).  The check runs here because --checksum may appear on
   * either side of --checksum-choice. */
  if (config->checksum && config->checksum_algo == (int)CHECKSUM_ALGO_NONE) {
    log_message(LOG_LEVEL_ERROR, "Invalid checksum-choice for --checksum: none");
-    config->cli_exit_code = 4;
+    config->cli.cli_exit_code = 4;
    return -1;
  }

@@ -2715,11 +2778,11 @@ static int cli_finalize_config(Config* config, bool verbose, bool no_delta, bool
   * explicitly negated them (--no-perms/--no-times/--no-preserve).  This runs
   * BEFORE the derived use_metadata bit so the transport frame is still sent
   * for the incremental/delta handshake even when both attributes were negated
-   * via --no-preserve (metadata_explicitly_disabled handles that opt-out). */
-  if (preserve_implied && !config->metadata_explicitly_disabled) {
-    if (!config->preserve_perms_explicit_off)
+   * via --no-preserve (cli.metadata_explicitly_disabled handles that opt-out). */
+  if (preserve_implied && !config->cli.metadata_explicitly_disabled) {
+    if (!config->cli.preserve_perms_explicit_off)
      config->preserve_perms = true;
-    if (!config->preserve_times_explicit_off)
+    if (!config->cli.preserve_times_explicit_off)
      config->preserve_times = true;
  }

@@ -2764,10 +2827,12 @@ static int cli_finalize_config(Config* config, bool verbose, bool no_delta, bool
  }
  /* --info=del on a real --delete run asks the receiver to report the paths it
     actually removed; the report rides the STATUS_STATS path list, so the wire
-     stats frame must be negotiated too. */
-  config->report_deletes = config->use_delete && !config->dry_run &&
-                           ((config->info_level & LOG_INFO_DEL) != 0 || config->itemize_changes ||
-                            config->out_format != NULL);
+     stats frame must be negotiated too.  --debug=del needs the same paths, so
+     it opts into the existing report (no new wire field). */
+  config->report_deletes =
+      config->use_delete && !config->dry_run &&
+      ((config->info_level & LOG_INFO_DEL) != 0 || config->itemize_changes ||
+       config->out_format != NULL || (config->debug_level & LOG_DEBUG_DEL) != 0);
  config->report_stats = config->stats || config->show_progress ||
                         (config->info_level & LOG_INFO_PROGRESS) || format_needs_wire ||
                         config->report_deletes || (config->dry_run && config->use_delete);
@@ -3104,7 +3169,7 @@ int main(int argc, char* argv[]) {
  int parse_ret = parse_args(config, argc, argv, positional_args, &positional_count);
  if (parse_ret != 0) {
    if (parse_ret < 0)
-      exit_code = config->cli_exit_code ? config->cli_exit_code : 1;
+      exit_code = config->cli.cli_exit_code ? config->cli.cli_exit_code : 1;
    goto cleanup;
  }

@@ -3247,7 +3312,7 @@ int main(int argc, char* argv[]) {
      exit_code = 1;
    }
  } else if (config->use_multithreading) {
-    exit_code = send_files_multithreaded(&config);
+    exit_code = send_files_multithreaded(config);
  } else {
    exit_code = send_files(config);
  }
@@ -0,0 +1,682 @@
+#include "client_send_internal.h"
+#include "array_list.h"
+#include "change_list.h"
+#include "charset.h"
+#include "config.h"
+#include "data.h"
+#include "delta.h"
+#include "file.h"
+#include "format.h"
+#include "log.h"
+#include "protocol.h"
+#include "scanner.h"
+#include "transport_tls.h"
+#include "utils.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <time.h>
+
+/* True when --dry-run should contact a receiver rather than running the
+ * client-side local manifest.  Any target a real run would reach over the wire
+ * selects the server-contacting path: a remote (SSH host:path), a daemon
+ * (host::module/path), an explicit --server-host, --server-port/--port, TLS, or
+ * a source-bind --address.  A plain local destination (none of these) keeps the
+ * original client-side behavior, which never dials the default 127.0.0.1:8080. */
+bool dry_run_targets_server(const Config* config) {
+  if (!config)
+    return false;
+  if (config->transport == TRANSPORT_SSH)
+    return true;
+  if (config->module && config->module[0] != '\0')
+    return true;
+  if (config->cli.server_host_set || config->cli.server_port_set)
+    return true;
+  if (config->use_tls)
+    return true;
+  if (config->address != NULL)
+    return true;
+  return false;
+}
+
+bool add_chunk_to_manifest(ArrayList* manifest, const Chunk* chunk) {
+  if (!manifest)
+    return true;
+  for (int i = 0; i < chunk->element_count; i++) {
+    const char* path = file_wire_path(chunk->items[i]);
+    if (*path == '/')
+      path++;
+    char* entry = str_dup(path);
+    if (!entry) {
+      log_message(LOG_LEVEL_ERROR, "Failed to allocate manifest entry");
+      return false;
+    }
+    if (!array_list_add(manifest, entry)) {
+      free(entry);
+      return false;
+    }
+  }
+  return true;
+}
+
+/* Print dry-run manifest showing files that would be transferred. Returns 0 on success. */
+int send_dry_run_manifest(const Config* config) {
+  int skipped = 0;
+  ArrayList* missing_dest = NULL;
+  if (config->delete_missing_args) {
+    missing_dest = array_list_create(free);
+    if (!missing_dest)
+      return -1;
+  }
+  if (!files_from_list_check(config, missing_dest, &skipped)) {
+    if (missing_dest)
+      array_list_delete(missing_dest);
+    return -1;
+  }
+  PreparedScanner prepared;
+  if (!prepare_scanner(config, 0, &prepared)) {
+    if (missing_dest)
+      array_list_delete(missing_dest);
+    return -1;
+  }
+  DirectoryScanner* scanner =
+      directory_scanner_create_with_options(config->send_directory, &prepared.options);
+  if (!scanner) {
+    prepared_scanner_destroy(&prepared);
+    if (missing_dest)
+      array_list_delete(missing_dest);
+    return -1;
+  }
+  Chunk* chunk;
+  int file_count = 0;
+  unsigned long long total_bytes = 0;
+  char size_buffer[32];
+  if (!config->quiet)
+    printf("Dry run: files to be transferred\n");
+  while ((chunk = directory_scanner_next(scanner)) != NULL) {
+    for (int i = 0; i < chunk->element_count; i++) {
+      if (!config->quiet) {
+        char* escaped_path =
+            output_escape(file_wire_path(chunk->items[i]), config->eight_bit_output);
+        if (!escaped_path) {
+          chunk_destroy(chunk);
+          directory_scanner_destroy(scanner);
+          prepared_scanner_destroy(&prepared);
+          if (missing_dest)
+            array_list_delete(missing_dest);
+          return -1;
+        }
+        if (config->human_readable)
+          printf(
+              "  %s (%s)\n", escaped_path,
+              display_bytes(chunk->items[i]->data->size, true, size_buffer, sizeof(size_buffer)));
+        else
+          printf("  %s (%zu bytes)\n", escaped_path, chunk->items[i]->data->size);
+        free(escaped_path);
+      }
+      total_bytes += chunk->items[i]->data->size;
+      file_count++;
+    }
+    chunk_destroy(chunk);
+  }
+  directory_scanner_destroy(scanner);
+  prepared_scanner_destroy(&prepared);
+  /* --delete-missing-args: the missing entries' destination mirrors render as
+     would-be deletions (rsync's dry-run also lists its *deleting lines). */
+  if (missing_dest && !config->quiet) {
+    for (int i = 0; i < missing_dest->size; i++) {
+      char* escaped = output_escape((char*)missing_dest->items[i], config->eight_bit_output);
+      printf("  %s (missing; would be deleted)\n", escaped ? escaped : "<allocation failed>");
+      free(escaped);
+    }
+  }
+  if (missing_dest)
+    array_list_delete(missing_dest);
+  if (!config->quiet) {
+    if (config->human_readable)
+      printf("Total: %d files, %s\n", file_count,
+             display_bytes(total_bytes, true, size_buffer, sizeof(size_buffer)));
+    else
+      printf("Total: %d files, %.1f MB\n", file_count, (double)total_bytes / (double)BYTES_PER_MIB);
+  }
+  return 0;
+}
+
+typedef struct {
+  char* name; /* transfer-relative name ("" == the source root) */
+  mode_t mode;
+  unsigned long long size;
+  time_t mtime;
+  long mtime_nsec;
+  bool is_dir;
+  bool is_symlink;
+  char* link_target;
+} ListEntry;
+
+static void list_entries_destroy(ListEntry* entries, size_t count) {
+  if (entries == NULL)
+    return;
+  for (size_t i = 0; i < count; i++) {
+    free(entries[i].name);
+    free(entries[i].link_target);
+  }
+  free(entries);
+}
+
+static int compare_list_entries(const void* left, const void* right) {
+  const ListEntry* a = (const ListEntry*)left;
+  const ListEntry* b = (const ListEntry*)right;
+  return strcmp(a->name, b->name);
+}
+
+/* Relative path of an entry below `root` ("" for the root itself).  Mirrors
+ * change_list's relative_name for list-only rendering. */
+static char* list_relative_name(const char* root, const char* full) {
+  if (root == NULL || full == NULL)
+    return str_dup(full != NULL ? full : "");
+  size_t root_len = strlen(root);
+  while (root_len > 1 && root[root_len - 1] == '/')
+    root_len--;
+  if (strncmp(root, full, root_len) == 0) {
+    if (full[root_len] == '\0')
+      return str_dup("");
+    if (full[root_len] == '/')
+      return str_dup(full + root_len + 1);
+  }
+  return str_dup(full);
+}
+
+/* --list-only: print an ls-style listing of the entries that WOULD be
+ * transferred and exit without contacting the server or writing anything.
+ * Names are transfer-relative (rsync prints `a.txt`, `sub/b.txt`, `.`) and
+ * directory entries are included.  Returns 0 on success, 1 on error. */
+int send_list_only(const Config* config) {
+  int skipped = 0;
+  if (!files_from_list_check(config, NULL, &skipped))
+    return 1;
+  PreparedScanner prepared;
+  if (!prepare_scanner(config, 0, &prepared))
+    return 1;
+  prepared.options.use_metadata = true; /* capture mode + mtime for the listing */
+  prepared.options.list_dirs = true;
+  DirectoryScanner* scanner =
+      directory_scanner_create_with_options(config->send_directory, &prepared.options);
+  if (!scanner) {
+    prepared_scanner_destroy(&prepared);
+    return 1;
+  }
+  ListEntry* entries = NULL;
+  size_t count = 0;
+  size_t capacity = 0;
+  bool oom = false;
+
+  /* rsync lists the source root itself (as ".").  Only when the source is a
+   * directory and no --files-from subset is in effect. */
+  if (config->files_from_set == NULL && config->send_directory != NULL) {
+    struct stat st;
+    if (stat(config->send_directory, &st) == 0 && S_ISDIR(st.st_mode)) {
+      capacity = 64;
+      entries = calloc(capacity, sizeof(ListEntry));
+      if (entries == NULL) {
+        oom = true;
+      } else if ((entries[0].name = str_dup("")) == NULL) {
+        /* A NULL name would be dereferenced by qsort/render: fail the listing. */
+        oom = true;
+      } else {
+        entries[0].mode = st.st_mode;
+        entries[0].mtime = st.st_mtime;
+        entries[0].mtime_nsec = st.st_mtim.tv_nsec;
+        entries[0].size = (unsigned long long)st.st_size;
+        entries[0].is_dir = true;
+        count = 1;
+      }
+    }
+  }
+
+  Chunk* chunk;
+  while (!oom && (chunk = directory_scanner_next(scanner)) != NULL) {
+    for (int i = 0; i < chunk->element_count; i++) {
+      File* f = chunk->items[i];
+      if (f == NULL)
+        continue;
+      if (count == capacity) {
+        size_t new_capacity = capacity > 0 ? capacity * 2 : 64;
+        if (new_capacity <= capacity) {
+          oom = true;
+          break;
+        }
+        ListEntry* grown = realloc(entries, new_capacity * sizeof(ListEntry));
+        if (!grown) {
+          oom = true;
+          break;
+        }
+        entries = grown;
+        memset(entries + capacity, 0, (new_capacity - capacity) * sizeof(ListEntry));
+        capacity = new_capacity;
+      }
+      char* name = list_relative_name(config->send_directory, file_wire_path(f));
+      if (!name) {
+        oom = true;
+        break;
+      }
+      mode_t mode = 0;
+      time_t mtime = 0;
+      long mtime_nsec = 0;
+      if (f->metadata != NULL) {
+        mode = f->metadata->mode;
+        mtime = f->metadata->mtime_sec;
+        mtime_nsec = f->metadata->mtime_nsec;
+      } else {
+        struct stat st;
+        if (lstat(f->path, &st) == 0) {
+          mode = st.st_mode;
+          mtime = st.st_mtime;
+          mtime_nsec = st.st_mtim.tv_nsec;
+        }
+      }
+      entries[count].name = name;
+      entries[count].mode = mode;
+      entries[count].mtime = mtime;
+      entries[count].mtime_nsec = mtime_nsec;
+      if (f->is_symlink)
+        entries[count].size = f->symlink_target != NULL ? strlen(f->symlink_target) : 0;
+      else if (f->is_dir) {
+        struct stat dir_st;
+        entries[count].size = stat(f->path, &dir_st) == 0 ? (unsigned long long)dir_st.st_size : 0;
+      } else
+        entries[count].size = f->data != NULL ? f->data->size : 0;
+      entries[count].is_dir = f->is_dir;
+      entries[count].is_symlink = f->is_symlink;
+      entries[count].link_target =
+          f->is_symlink && f->symlink_target ? str_dup(f->symlink_target) : NULL;
+      count++;
+    }
+    chunk_destroy(chunk);
+  }
+  bool failed = oom || directory_scanner_failed(scanner) || directory_scanner_had_io_error(scanner);
+  directory_scanner_destroy(scanner);
+  prepared_scanner_destroy(&prepared);
+  if (failed) {
+    list_entries_destroy(entries, count);
+    if (oom)
+      log_message(LOG_LEVEL_ERROR, "memory allocation failed while listing");
+    return 1;
+  }
+  if (count > 1)
+    qsort(entries, count, sizeof(ListEntry), compare_list_entries);
+  for (size_t i = 0; i < count; i++) {
+    ChangeEvent event;
+    memset(&event, 0, sizeof(event));
+    event.name = entries[i].name;
+    event.path = entries[i].name;
+    event.mode = entries[i].mode;
+    event.size = entries[i].size;
+    event.mtime_sec = entries[i].mtime;
+    event.mtime_nsec = entries[i].mtime_nsec;
+    event.is_directory = entries[i].is_dir;
+    event.is_symlink = entries[i].is_symlink;
+    event.symlink_target = entries[i].link_target;
+    char* line = change_render_list_line(config, &event);
+    if (line != NULL) {
+      char* escaped = output_escape(line, config->eight_bit_output);
+      printf("%s\n", escaped != NULL ? escaped : line);
+      free(escaped);
+      free(line);
+    }
+  }
+  list_entries_destroy(entries, count);
+  return 0;
+}
+
+/* Send the delete manifest to the server.  Returns 0 on success, -1 on
+   failure.  It carries FOUR sections: the keep-set paths, the protected
+   excluded prefixes, the --delete-missing-args exact-delete paths, and the
+   destination-relative directories the sender synchronized this run.
+   When --delete-excluded is given `protected` is empty: excluded destination
+   mirrors are then ordinary extras and are removed.  When
+   --delete-missing-args is active `missing_args` holds the destination mirrors
+   of missing --files-from entries: each is an explicit receiver-side deletion
+   request, independent of the extras walk.  `synced_dirs` confines the extras
+   walk to entries directly inside a synchronized directory.  A NULL
+   keep-set / protected / missing / dirs list transmits an empty section.  All
+   four sections are unbounded on the sender; the receiver enforces
+   MAX_MANIFEST_ENTRIES per section and a single MAX_MANIFEST_BYTES budget
+   shared across the sections, rejecting (with STATUS_ERROR) an over-budget
+   frame.  A heavily filtered source whose exclusion list is large therefore
+   fails the run cleanly on the receiver rather than being truncated. */
+int send_delete_manifest(int fd, ArrayList* manifest, ArrayList* protected_prefixes,
+                         ArrayList* size_skipped, ArrayList* missing_args, ArrayList* synced_dirs) {
+  if (!send_status(fd, STATUS_MANIFEST))
+    return -1;
+  int keep_count = manifest ? manifest->size : 0;
+  if (!send_int(fd, keep_count))
+    return -1;
+  for (int i = 0; i < keep_count; i++) {
+    if (!send_wire_str(fd, (char*)manifest->items[i]))
+      return -1;
+  }
+  /* The receiver has ONE protected-prefix section; filter-excluded prefixes
+     (dropped under --delete-excluded) and size-pruned prefixes (always
+     protected) are concatenated into it. */
+  int protected_count =
+      (protected_prefixes ? protected_prefixes->size : 0) + (size_skipped ? size_skipped->size : 0);
+  if (!send_int(fd, protected_count))
+    return -1;
+  if (protected_prefixes) {
+    for (int i = 0; i < protected_prefixes->size; i++) {
+      if (!send_wire_str(fd, (char*)protected_prefixes->items[i]))
+        return -1;
+    }
+  }
+  if (size_skipped) {
+    for (int i = 0; i < size_skipped->size; i++) {
+      if (!send_wire_str(fd, (char*)size_skipped->items[i]))
+        return -1;
+    }
+  }
+  int missing_count = missing_args ? missing_args->size : 0;
+  if (!send_int(fd, missing_count))
+    return -1;
+  for (int i = 0; i < missing_count; i++) {
+    if (!send_wire_str(fd, (char*)missing_args->items[i]))
+      return -1;
+  }
+  int dirs_count = synced_dirs ? synced_dirs->size : 0;
+  if (!send_int(fd, dirs_count))
+    return -1;
+  for (int i = 0; i < dirs_count; i++) {
+    if (!send_wire_str(fd, (char*)synced_dirs->items[i]))
+      return -1;
+  }
+  return 0;
+}
+
+/* Transmit the keep-set manifest and wait for the receiver's verdict.  Used by
+   --delete-before/--delete-during, where the extras are removed on the receiver
+   BEFORE the first byte of file data is sent: the receiver acknowledges with
+   STATUS_OK once the bounded delete committed, or STATUS_ERROR if it could not
+   (in which case the sender aborts without streaming any data).  The ACK may
+   take much longer than an ordinary per-message round trip because the receiver
+   performs the whole bounded deletion walk (up to MAX_SERVER_DELETE_COUNT
+   unlinks) before replying, so the wait uses a generous explicit deadline
+   instead of the default 60 s receive window. */
+#define DELETE_ACK_TIMEOUT_SEC 3600
+/* While waiting for the (potentially slow) receiver-side deletion, send a
+ * STATUS_KEEPALIVE at most this often so the connection is demonstrably alive
+ * and neither side's per-message timeout trips. */
+#define DELETE_ACK_KEEPALIVE_SEC 10
+
+bool send_delete_manifest_early(Client* client, ArrayList* manifest, ArrayList* protected_prefixes,
+                                ArrayList* size_skipped, ArrayList* missing_args,
+                                ArrayList* synced_dirs) {
+  if (!client || !manifest)
+    return false;
+  if (send_delete_manifest(client->file_descriptor, manifest, protected_prefixes, size_skipped,
+                           missing_args, synced_dirs) != 0)
+    return false;
+  Status ack;
+  /* The wait is long (up to an hour) and runs inline on this thread: a helper
+   * thread would race the non-thread-safe protocol send path, so keepalives are
+   * emitted from this wait loop itself.  A Ctrl-C/SIGTERM abort flag also ends
+   * the wait; the caller then best-effort sends STATUS_ABORT. */
+  if (!receive_status_keepalive(client->file_descriptor, &ack, DELETE_ACK_TIMEOUT_SEC,
+                                DELETE_ACK_KEEPALIVE_SEC, client_abort_pending)) {
+    /* A Ctrl-C/SIGTERM abort ends the wait above; tell the receiver before the
+       caller tears the connection down (best-effort). */
+    if (client_abort_pending()) {
+      log_info_message(LOG_INFO_MISC,
+                       "Abort requested while awaiting delete ack; sending STATUS_ABORT");
+      send_status(client->file_descriptor, STATUS_ABORT);
+    }
+    return false;
+  }
+  if (ack != STATUS_OK) {
+    log_server_rejection("Server failed to delete files before the transfer");
+    return false;
+  }
+  return true;
+}
+
+/* Server-contacting --dry-run.  Connects to the configured remote/daemon and
+ * runs the normal per-file incremental decision WITHOUT transmitting any file
+ * data: the receiver (which also sees dry_run=true on the wire) answers
+ * STATUS_OK for an up-to-date file and STATUS_DRY_RUN_TRANSFER for a file it
+ * would otherwise write, mutating nothing on either side.  The would-transfer
+ * set and the same trailer as the local dry-run are printed.  A
+ * --compare-dest exact basis hit with no destination copy is reported as a
+ * skip by the receiver.
+ *
+ * Only regular files take the receiver-consulted check; directory / symlink /
+ * special / hard-link-sibling entries have no per-file content check, so they
+ * are reported conservatively as would-transfer and their frames are never
+ * sent (which is what keeps the receiver mutation-free).  --delete* is
+ * deliberately NOT transmitted in dry-run, so no deletion can occur; the
+ * would-delete manifest report is a documented follow-up.
+ *
+ * Returns 0 on success, 1 on error. */
+int send_dry_run_remote(Config* config) {
+  int from_skipped = 0;
+  ArrayList* missing_args = NULL;
+  if (config->delete_missing_args) {
+    missing_args = array_list_create(free);
+    if (!missing_args)
+      return 1;
+  }
+  if (!files_from_list_check(config, missing_args, &from_skipped)) {
+    if (missing_args)
+      array_list_delete(missing_args);
+    return 1;
+  }
+  if (missing_args)
+    array_list_delete(missing_args);
+  /* A live session may follow, so arm graceful abort handling. */
+  client_set_abort_armed(true);
+  Client* client = connect_transfer_client(config);
+  if (!client) {
+    if (config->transport == TRANSPORT_TCP)
+      log_message(LOG_LEVEL_ERROR, "could not connect to server%s",
+                  config->use_tls ? " via TLS" : "");
+    client_set_abort_armed(false);
+    return 1;
+  }
+  ProtocolSession session;
+  protocol_session_init(&session, client->file_descriptor, client->file_descriptor);
+  protocol_session_set_io_timeout(&session, config->timeout);
+  protocol_session_set_ssl(&session, (SSL*)client->ssl);
+  protocol_session_bind(&session);
+
+  int ret = 1;
+  time_t dry_start = time(NULL);
+  ReceiverStats dry_stats;
+  memset(&dry_stats, 0, sizeof(dry_stats));
+  PreparedScanner prepared;
+  memset(&prepared, 0, sizeof(prepared));
+  DirectoryScanner* scanner = NULL;
+  ArrayList* dry_manifest = NULL;
+  ArrayList* dry_dirs = NULL;
+  ArrayList* dry_excluded = NULL;
+  ArrayList* dry_size_skipped = NULL;
+  if (!config_send(client->file_descriptor, config))
+    goto dry_fail;
+  receive_daemon_motd(client, config);
+  if (!prepare_scanner(config, 0, &prepared))
+    goto dry_fail;
+  /* -n --delete: build the same keep-set manifest, protected prefixes, and
+     synchronized-directory scope a real run would send, so the receiver's
+     read-only extras walk enumerates exactly the deletions a real run makes. */
+  if (config->use_delete) {
+    dry_manifest = array_list_create(free);
+    dry_dirs = array_list_create(free);
+    dry_size_skipped = array_list_create(free);
+    if (!dry_manifest || !dry_dirs || !dry_size_skipped)
+      goto dry_fail;
+    if (!config->delete_excluded) {
+      dry_excluded = array_list_create(free);
+      if (!dry_excluded)
+        goto dry_fail;
+      prepared.options.excluded_paths = dry_excluded;
+    }
+    prepared.options.size_skipped_paths = dry_size_skipped;
+    /* A --files-from subset confines the extras walk to the directories the
+       scan synchronized; a full recursive transfer marks the root itself. */
+    if (config->files_from_set == NULL) {
+      char* root_marker = delete_scope_root_marker(config);
+      if (!root_marker || !array_list_add(dry_dirs, root_marker)) {
+        free(root_marker);
+        goto dry_fail;
+      }
+    } else {
+      prepared.options.synced_dirs = dry_dirs;
+    }
+  }
+  scanner = directory_scanner_create_with_options(config->send_directory, &prepared.options);
+  if (!scanner)
+    goto dry_fail;
+
+  int file_count = 0;
+  unsigned long long total_bytes = 0;
+  char size_buffer[32];
+  if (!config->quiet)
+    printf("Dry run: files to be transferred\n");
+  Chunk* chunk;
+  while ((chunk = directory_scanner_next(scanner)) != NULL) {
+    if (dry_manifest && !add_chunk_to_manifest(dry_manifest, chunk)) {
+      chunk_destroy(chunk);
+      goto dry_fail;
+    }
+    for (int i = 0; i < chunk->element_count; i++) {
+      File* f = chunk->items[i];
+      if (!f)
+        continue;
+      unsigned long long fsize = f->data ? f->data->size : 0;
+      bool would;
+      if (f->is_dir || f->is_symlink || f->is_special ||
+          (f->link_group != 0 && !f->link_first && f->hardlink_target != NULL)) {
+        /* No receiver-side content check exists for these frame types; a real
+           run would (re)create them, so report would-transfer and send no
+           frame (the receiver must stay mutation-free). */
+        would = true;
+      } else if (fsize > MAX_RECEIVE_WHOLE_FILE_SIZE && !config->use_incremental &&
+                 !config_has_basis(config)) {
+        /* A non-incremental run streams a >whole-file-limit source without the
+           STATUS_CHECK handshake, so no read-only receiver decision is possible
+           (and none is needed: a real run would transfer it). */
+        would = true;
+      } else {
+        DeltaSignature* sig = NULL;
+        unsigned long long resume_offset = 0;
+        int rc = incremental_check(client, f, config, &sig, &resume_offset);
+        delta_signature_destroy(sig);
+        if (rc < 0) {
+          chunk_destroy(chunk);
+          goto dry_fail;
+        }
+        if (rc == 1)
+          continue; /* up to date; nothing to report */
+        if (rc != 4) {
+          log_message(LOG_LEVEL_ERROR, "Unexpected receiver reply during dry-run");
+          chunk_destroy(chunk);
+          goto dry_fail;
+        }
+        would = true;
+      }
+      if (would) {
+        if (!config->quiet) {
+          char* escaped_path = output_escape(file_wire_path(f), config->eight_bit_output);
+          if (!escaped_path) {
+            chunk_destroy(chunk);
+            goto dry_fail;
+          }
+          if (config->human_readable)
+            printf("  %s (%s)\n", escaped_path,
+                   display_bytes(fsize, true, size_buffer, sizeof(size_buffer)));
+          else
+            printf("  %s (%llu bytes)\n", escaped_path, fsize);
+          free(escaped_path);
+        }
+        total_bytes += fsize;
+        file_count++;
+      }
+    }
+    chunk_destroy(chunk);
+  }
+  bool io_error = directory_scanner_had_io_error(scanner);
+  if (directory_scanner_failed(scanner))
+    goto dry_fail;
+  if (io_error)
+    log_message(LOG_LEVEL_WARNING, "source scan hit an unreadable directory");
+  /* Send the keep-set manifest (no data frames) so the receiver can enumerate
+     the destination extras; an early-timing delete ACKs before it will accept
+     the terminal FINISHED. */
+  bool early_delete = config->use_delete && config_delete_timing_early(config);
+  if (dry_manifest) {
+    if (send_delete_manifest(client->file_descriptor, dry_manifest, dry_excluded, dry_size_skipped,
+                             NULL, dry_dirs) != 0)
+      goto dry_fail;
+    if (early_delete) {
+      Status ack;
+      if (!receive_status_keepalive(client->file_descriptor, &ack, DELETE_ACK_TIMEOUT_SEC,
+                                    DELETE_ACK_KEEPALIVE_SEC, client_abort_pending) ||
+          ack != STATUS_OK)
+        goto dry_fail;
+    }
+  }
+  /* Terminate the stream so the receiver emits its success frame; no data frame
+     is ever sent in dry-run. */
+  if (!send_status(client->file_descriptor, STATUS_FINISHED))
+    goto dry_fail;
+  Status status;
+  if (!receive_status(client->file_descriptor, &status))
+    goto dry_fail;
+  if (status == STATUS_STATS) {
+    ArrayList* would_delete = array_list_create(free);
+    if (!would_delete)
+      goto dry_fail;
+    if (!receive_stats_record(client->file_descriptor, &dry_stats, would_delete)) {
+      array_list_delete(would_delete);
+      goto dry_fail;
+    }
+    print_delete_reports(config, would_delete);
+    array_list_delete(would_delete);
+    if (!receive_status(client->file_descriptor, &status))
+      goto dry_fail;
+  }
+  if (status != STATUS_OK)
+    goto dry_fail;
+  if (!config->quiet) {
+    if (config->human_readable)
+      printf("Total: %d files, %s\n", file_count,
+             display_bytes(total_bytes, true, size_buffer, sizeof(size_buffer)));
+    else
+      printf("Total: %d files, %.1f MB\n", file_count, (double)total_bytes / (double)BYTES_PER_MIB);
+  }
+  {
+    TransferStats dry_transfer;
+    memset(&dry_transfer, 0, sizeof(dry_transfer));
+    dry_transfer.flist_reg = (unsigned long long)file_count;
+    dry_transfer.total_file_size = total_bytes;
+    dry_transfer.transferred_regular = (unsigned long long)file_count;
+    dry_transfer.transferred_file_size = total_bytes;
+    dry_transfer.literal_data = total_bytes;
+    report_transfer_stats(config, &dry_transfer, dry_start, &dry_stats);
+  }
+  ret = io_error ? 1 : 0;
+
+dry_fail:
+  if (dry_manifest)
+    array_list_delete(dry_manifest);
+  if (dry_dirs)
+    array_list_delete(dry_dirs);
+  if (dry_excluded)
+    array_list_delete(dry_excluded);
+  if (dry_size_skipped)
+    array_list_delete(dry_size_skipped);
+  if (scanner)
+    directory_scanner_destroy(scanner);
+  prepared_scanner_destroy(&prepared);
+  disconnect_transfer_client(client);
+  protocol_session_unbind();
+  client_set_abort_armed(false);
+  return ret;
+}
@@ -0,0 +1,470 @@
+#include "client_send_internal.h"
+#include "array_list.h"
+#include "charset.h"
+#include "config.h"
+#include "delete_plan.h"
+#include "file.h"
+#include "file_list.h"
+#include "filter.h"
+#include "hardlink.h"
+#include "log.h"
+#include "scanner.h"
+#include "utils.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+
+/* Build the scanner options for one scan. Returns false and logs on failure. */
+bool prepare_scanner(const Config* config, int num_threads, PreparedScanner* out) {
+  if (!out)
+    return false;
+  out->base_filters = NULL;
+  out->hardlinks = NULL;
+  out->relative_prefix = NULL;
+  memset(&out->options, 0, sizeof(out->options));
+
+  int rule_count = config->filters ? config->filters->size : 0;
+  const char** texts = NULL;
+  if (rule_count > 0) {
+    texts = malloc((size_t)rule_count * sizeof(char*));
+    if (!texts) {
+      log_message(LOG_LEVEL_ERROR, "memory allocation failed for filter rules");
+      return false;
+    }
+    for (int i = 0; i < rule_count; i++)
+      texts[i] = (const char*)config->filters->items[i];
+  }
+  if (rule_count > 0 || config->cvs_exclude) {
+    char err[160];
+    out->base_filters = filter_base_build(texts, rule_count, config->cvs_exclude,
+                                          config->delete_excluded, err, sizeof(err));
+    free(texts);
+    if (!out->base_filters) {
+      log_message(LOG_LEVEL_ERROR, "invalid filter rule: %s", err);
+      return false;
+    }
+  } else {
+    free(texts);
+  }
+
+  ScannerOptions* options = &out->options;
+  options->use_metadata = config->use_metadata;
+  options->preserve_atimes = config->preserve_atimes;
+  options->preserve_crtimes = config->preserve_crtimes;
+  options->preserve_xattrs = config->preserve_xattrs;
+  options->preserve_acls = config->preserve_acls;
+  options->chunk_size = config->chunk_size;
+  /* --exclude/--include are compiled, in command-line order, into the SAME
+   * ordered filter rule list as --filter/-f (see config_add_selection_rule), so
+   * the legacy per-kind arrays are deliberately NOT passed to the scanner:
+   * doing so would re-apply them with the old "excludes first, then includes as
+   * a mandatory whitelist" precedence and defeat rsync's first-match-wins
+   * ordering.  The arrays remain populated purely for the Config API surface. */
+  options->exclude_patterns = NULL;
+  options->exclude_count = 0;
+  options->include_patterns = NULL;
+  options->include_count = 0;
+  options->max_size = config->max_size;
+  options->min_size = config->min_size;
+  options->max_depth = config->max_depth;
+  options->num_threads = num_threads;
+  options->follow_symlinks = config->follow_symlinks;
+  options->copy_links = config->copy_links;
+  options->safe_links = config->safe_links;
+  options->copy_unsafe_links = config->copy_unsafe_links;
+  options->copy_dirlinks = config->copy_dirlinks;
+  options->munge_links = config->munge_links;
+  options->checksum = config->checksum;
+  options->one_file_system = config->one_file_system;
+  options->preserve_devices = config->preserve_devices;
+  options->preserve_specials = config->preserve_specials;
+  options->copy_devices = config->copy_devices;
+  options->file_list = (const FileListSet*)config->files_from_set;
+  options->base_filters = out->base_filters;
+  options->per_dir_filters = config->per_dir_filter;
+  options->delete_excluded = config->delete_excluded;
+  options->exclude_per_dir_filter_files = config->per_dir_filter_count >= 2;
+  options->dirs = config->dirs;
+  options->relative = config->relative;
+  /* A real recursive transfer recreates empty source directories (rsync
+     parity); low-level scanner users leave this off. */
+  options->emit_empty_dirs = true;
+  /* --no-implied-dirs only has meaning with -R (rsync): without it the option
+     is a documented no-op, so the scanner must not suppress directory
+     metadata. */
+  options->no_implied_dirs = config->no_implied_dirs && config->relative;
+  /* -R/--relative outside --files-from reconstructs every destination path from
+   * the source spec (rsync's '/./' cut point).  With --files-from the listed
+   * entry already supplies the bare relative path, so no prefix is built. */
+  if (config->relative && config->files_from_set == NULL && config->send_directory) {
+    out->relative_prefix = scanner_relative_prefix(config->send_directory);
+    if (!out->relative_prefix) {
+      log_message(LOG_LEVEL_ERROR, "memory allocation failed building --relative path prefix");
+      filter_rule_list_free(out->base_filters);
+      out->base_filters = NULL;
+      return false;
+    }
+    options->relative_prefix = out->relative_prefix;
+  }
+  options->prune_empty_dirs = config->prune_empty_dirs;
+  options->ignore_io_errors = config->ignore_errors;
+  options->ignore_missing_args = config->ignore_missing_args || config->delete_missing_args;
+  options->note_nonreg = (config->info_level & LOG_INFO_NONREG) != 0 && !config->quiet;
+  options->note_mount = (config->info_level & LOG_INFO_MOUNT) != 0 && !config->quiet;
+  options->send_directory = config->send_directory;
+  options->eight_bit_output = config->eight_bit_output;
+  options->excluded_paths = NULL;
+  options->excluded_mutex = NULL;
+  options->size_skipped_paths = NULL;
+  options->synced_dirs = NULL;
+  options->hardlinks = NULL;
+  /* Set by the real send paths; NULL for the metadata-only scans (progress
+     pre-count, batch) that must not perturb the sender's --stats counter. */
+  options->dir_count = NULL;
+  /* P7 Wave D: capture source directory metadata when a directory attribute is
+     requested (-p for modes, -t for times unless -O omits them).  Whether they
+     are APPLIED is decided receiver-side. */
+  options->capture_dir_times = dir_metadata_should_capture(config);
+  options->dir_entries = NULL;
+  options->dir_entries_mutex = NULL;
+  if (config->preserve_hard_links) {
+    out->hardlinks = hardlink_table_create();
+    if (!out->hardlinks) {
+      filter_rule_list_free(out->base_filters);
+      out->base_filters = NULL;
+      return false;
+    }
+    options->hardlinks = out->hardlinks;
+  }
+  return true;
+}
+
+void prepared_scanner_destroy(PreparedScanner* prepared) {
+  if (!prepared)
+    return;
+  filter_rule_list_free(prepared->base_filters);
+  prepared->base_filters = NULL;
+  hardlink_table_destroy(prepared->hardlinks);
+  prepared->hardlinks = NULL;
+  free(prepared->relative_prefix);
+  prepared->relative_prefix = NULL;
+}
+
+/* -R/--relative implied directories: rsync transmits the metadata of the
+ * parent directories implied by the source path (every prefix component above
+ * the source root) so the receiver applies their attributes to the created
+ * parents.  FastSync's scan only covers the source root and below, so append
+ * one metadata-only directory entry per implied ancestor.  --no-implied-dirs
+ * suppresses this exactly like rsync.  A missing ancestor is never fatal. */
+bool append_implied_dir_times(const Config* config, ArrayList* dir_entries) {
+  if (!dir_entries || !config->relative || config->files_from_set != NULL ||
+      config->no_implied_dirs || !config->send_directory)
+    return true;
+  char* prefix = scanner_relative_prefix(config->send_directory);
+  if (!prefix)
+    return true;
+  int ncomp = 0;
+  for (const char* s = prefix; *s;) {
+    while (*s == '/')
+      s++;
+    if (!*s)
+      break;
+    while (*s && *s != '/')
+      s++;
+    ncomp++;
+  }
+  if (ncomp <= 1) {
+    free(prefix);
+    return true;
+  }
+  char* fs = str_dup(config->send_directory);
+  if (!fs) {
+    free(prefix);
+    return true;
+  }
+  size_t flen = strlen(fs);
+  while (flen > 1 && fs[flen - 1] == '/')
+    fs[--flen] = '\0';
+  bool ok = true;
+  /* Walk the source path upwards one component at a time (fs is truncated in
+     place, so each step targets the next implied ancestor). */
+  for (int depth = ncomp - 2; depth >= 0 && ok; depth--) {
+    char* slash = strrchr(fs, '/');
+    if (!slash || slash == fs)
+      break;
+    *slash = '\0';
+    char* p = prefix;
+    int c = 0;
+    while (c <= depth) {
+      while (*p == '/')
+        p++;
+      while (*p && *p != '/')
+        p++;
+      c++;
+    }
+    char saved = *p;
+    *p = '\0';
+    struct stat st;
+    if (stat(fs, &st) == 0 && S_ISDIR(st.st_mode)) {
+      File* file = file_create(fs);
+      if (!file) {
+        ok = false;
+      } else {
+        file->is_dir = true;
+        file->metadata =
+            file_metadata_create(fs, &st, config->preserve_atimes, config->preserve_crtimes);
+        file->send_path = str_dup(prefix);
+        if (!file->metadata || !file->send_path || !array_list_add(dir_entries, file)) {
+          file_destroy(file);
+          ok = false;
+        }
+      }
+    }
+    *p = saved;
+  }
+  free(fs);
+  free(prefix);
+  return ok;
+}
+
+/* The delete-walk root scope for a full (non---files-from) transfer: rsync
+ * confines --delete to the directories it actually transferred.  A plain
+ * recursive run mirrors the source under the receive root, so "." (the whole
+ * tree) is correct; an -R run transfers only the reconstructed prefix subtree,
+ * so the walk is scoped to that prefix instead.  Returns a malloc'd wire path
+ * (or "."), or NULL on allocation failure. */
+char* delete_scope_root_marker(const Config* config) {
+  if (config->relative && config->files_from_set == NULL && config->send_directory) {
+    char* prefix = scanner_relative_prefix(config->send_directory);
+    if (!prefix)
+      return NULL;
+    if (prefix[0] != '\0')
+      return prefix;
+    free(prefix);
+  }
+  return str_dup(".");
+}
+
+/* The -R destination prefix that confines a per-directory delete walk, or NULL
+ * when the whole receive root is in scope.  The marker was installed into
+ * `synced_dirs` by delete_scope_root_marker(); for a plain recursive transfer
+ * it is "." (whole root) and for --files-from the list is not a single prefix. */
+const char* delete_plan_walk_root(const Config* config, const ArrayList* synced_dirs) {
+  if (!config || config->files_from_set != NULL || !config->relative || !config->send_directory)
+    return NULL;
+  if (!synced_dirs || synced_dirs->size != 1)
+    return NULL;
+  const char* marker = (const char*)synced_dirs->items[0];
+  if (marker[0] == '\0' || strcmp(marker, ".") == 0)
+    return NULL;
+  return marker;
+}
+
+/* The destination-relative mirror path for a missing --files-from entry: where
+   a PRESENT entry with the same name would have been written.  With -R that is
+   the entry's bare relative path (the bare wire path the receiver uses);
+   otherwise it is the full source mirror below the destination root
+   (`send_directory` joined to the entry, leading '/' stripped), exactly the
+   path the manifest records for a present sibling.  Returns an owned string, or
+   NULL on allocation failure. */
+static char* files_from_missing_dest_path(const Config* config, const char* entry) {
+  if (config->relative)
+    return str_dup(entry);
+  char* joined = path_cat(config->send_directory, entry);
+  if (!joined)
+    return NULL;
+  const char* rel = *joined == '/' ? joined + 1 : joined;
+  char* dup = str_dup(rel);
+  free(joined);
+  return dup;
+}
+
+/* --files-from semantics: every listed entry must resolve under the source
+ * root, otherwise rsync reports a hard error instead of silently transferring
+ * nothing. An entry of "." (the whole tree) and listed-but-empty directories
+ * are valid.  An empty list is valid too: rsync transfers nothing and exits 0.
+ * With --ignore-missing-args
+ * (implied by --delete-missing-args) a listed-but-missing entry is instead
+ * skipped: nothing is transferred for it, it never enters the keep-set and the
+ * run succeeds for the rest (an all-missing non-empty list succeeds
+ * transferring nothing, matching rsync).  With --delete-missing-args
+ * `missing_dest` (when non-NULL) collects the entry's destination-relative
+ * mirror for the receiver's exact-deletion request.  Runs before any
+ * transfer so the failure/skip is surfaced uniformly in the single-threaded,
+ * -m, dry-run and --list-only paths. */
+bool files_from_list_check(const Config* config, ArrayList* missing_dest, int* skipped_out) {
+  *skipped_out = 0;
+  const FileListSet* set = (const FileListSet*)config->files_from_set;
+  if (!set)
+    return true;
+  if (!config->send_directory) {
+    log_message(LOG_LEVEL_ERROR, "--files-from requires a source directory");
+    return false;
+  }
+  if (set->count == 0) {
+    /* rsync treats an empty --files-from list as "nothing to transfer" and
+       exits 0 (the source directory is still a valid source arg), so this is
+       not an error.  Nothing passes the (empty) allow-set, so no file is sent
+       and no keep-set entry is produced. */
+    return true;
+  }
+  bool ignore = config->ignore_missing_args || config->delete_missing_args;
+  for (int i = 0; i < set->count; i++) {
+    const char* entry = set->entries[i];
+    if (entry[0] == '\0')
+      continue; /* "." == list the whole tree */
+    char* full = path_cat(config->send_directory, entry);
+    if (!full) {
+      log_message(LOG_LEVEL_ERROR, "memory allocation failed while validating --files-from");
+      return false;
+    }
+    struct stat st;
+    if (lstat(full, &st) != 0) {
+      free(full);
+      if (ignore) {
+        (*skipped_out)++;
+        char* escaped_entry = output_escape(entry, log_get_8_bit_output());
+        log_info_message(LOG_INFO_MISC, "skipping missing --files-from entry '%s'",
+                         escaped_entry ? escaped_entry : "<allocation failed>");
+        free(escaped_entry);
+        if (config->delete_missing_args && missing_dest) {
+          char* mirror = files_from_missing_dest_path(config, entry);
+          if (!mirror || !array_list_add(missing_dest, mirror)) {
+            free(mirror);
+            log_message(LOG_LEVEL_ERROR, "memory allocation failed while validating --files-from");
+            return false;
+          }
+        }
+        continue;
+      }
+      char* escaped_entry = output_escape(entry, log_get_8_bit_output());
+      char* escaped_src = output_escape(config->send_directory, log_get_8_bit_output());
+      log_message(LOG_LEVEL_ERROR, "--files-from entry '%s' not found in source '%s'",
+                  escaped_entry ? escaped_entry : "<allocation failed>",
+                  escaped_src ? escaped_src : "<allocation failed>");
+      free(escaped_entry);
+      free(escaped_src);
+      return false;
+    }
+    free(full);
+  }
+  if (*skipped_out > 0) {
+    if (config->delete_missing_args) {
+      /* --list-only never deletes and a --dry-run only shows intent, so the
+         summary must not claim a real deletion happened in those modes. */
+      if (config->list_only)
+        log_message(LOG_LEVEL_WARNING,
+                    "--delete-missing-args: %d missing --files-from entr%s skipped (--list-only "
+                    "never deletes)",
+                    *skipped_out, *skipped_out == 1 ? "y" : "ies");
+      else if (config->dry_run)
+        log_message(LOG_LEVEL_WARNING,
+                    "--delete-missing-args: %d missing --files-from entr%s would be deleted from "
+                    "the destination (dry run)",
+                    *skipped_out, *skipped_out == 1 ? "y" : "ies");
+      else
+        log_message(
+            LOG_LEVEL_WARNING,
+            "--delete-missing-args: %d missing --files-from entr%s will be deleted from the "
+            "destination",
+            *skipped_out, *skipped_out == 1 ? "y" : "ies");
+    } else if (config->ignore_missing_args)
+      log_message(LOG_LEVEL_WARNING,
+                  "--ignore-missing-args: ignored %d missing --files-from entr%s", *skipped_out,
+                  *skipped_out == 1 ? "y" : "ies");
+  }
+  return true;
+}
+
+/* Walk the whole source tree once collecting only destination-relative wire
+   paths, loading and sending nothing.  --delete-before/--delete-during need the
+   complete keep-set manifest before the first data byte, so it is built by a
+   dedicated pre-scan pass and transmitted early; the data pass then re-scans
+   with a fresh scanner.  --delete-before additionally replays this very scan as
+   its data pass (rsync's single file list), so `chunks_out` (optional) retains
+   the scanned Chunk objects for the caller to send instead of destroying them;
+   the caller owns the list and must give it a chunk_destroy destructor.  A
+   source I/O error is fatal unless the options carry --ignore-errors, in which
+   case the scan continues past the unreadable directory and *io_error_out
+   reports it (the caller still performs the deletion but reports the run as
+   errored). */
+bool scan_paths_only(const Config* config, const ScannerOptions* options, ArrayList* manifest,
+                     DeletePlanSender* plans, bool* io_error_out,
+                     unsigned long long* non_dir_count_out, ArrayList* chunks_out,
+                     bool emit_nonreg) {
+  if (io_error_out)
+    *io_error_out = false;
+  if (non_dir_count_out)
+    *non_dir_count_out = 0;
+  ScannerOptions local = *options;
+  /* The pre-scan is normally a paths-only pass with no client output: it must
+     not emit --info=nonreg lines because the data pass re-scans and emits them
+     once.  When the caller replays this scan as the data pass (--delete-before)
+     there is no later scan, so it opts in and the lines are emitted here. */
+  local.note_nonreg = emit_nonreg && options->note_nonreg;
+  DirectoryScanner* scanner = directory_scanner_create_with_options(config->send_directory, &local);
+  if (!scanner)
+    return false;
+  bool ok = true;
+  Chunk* chunk;
+  while ((chunk = directory_scanner_next(scanner)) != NULL) {
+    if (non_dir_count_out) {
+      for (int i = 0; i < chunk->element_count; i++) {
+        const File* f = chunk->items[i];
+        if (f && !f->is_dir)
+          (*non_dir_count_out)++;
+      }
+    }
+    if (manifest && !add_chunk_to_manifest(manifest, chunk)) {
+      ok = false;
+      chunk_destroy(chunk);
+      break;
+    }
+    if (plans) {
+      for (int i = 0; i < chunk->element_count; i++) {
+        File* f = chunk->items[i];
+        if (!f)
+          continue;
+        const char* path = file_wire_path(f);
+        if (!delete_plan_sender_add(plans, path, f->is_dir)) {
+          ok = false;
+          break;
+        }
+      }
+      if (!ok) {
+        chunk_destroy(chunk);
+        break;
+      }
+    }
+    if (chunks_out) {
+      /* Retain the chunk for the caller's data pass; ownership moves with it. */
+      if (!array_list_add(chunks_out, chunk)) {
+        ok = false;
+        chunk_destroy(chunk);
+        break;
+      }
+    } else {
+      chunk_destroy(chunk);
+    }
+  }
+  if (ok) {
+    /* Keep every traversed source directory, including empty ones, so a plan
+       no longer removes the destination directory itself.  Their own plans are
+       emitted after the data stream (no file frame triggers them). */
+    if (plans && options->plan_dirs) {
+      for (int i = 0; i < options->plan_dirs->size; i++) {
+        if (!delete_plan_sender_add(plans, (const char*)options->plan_dirs->items[i], true)) {
+          ok = false;
+          break;
+        }
+      }
+    }
+  }
+  if (ok && directory_scanner_failed(scanner))
+    ok = false;
+  if (io_error_out)
+    *io_error_out = directory_scanner_had_io_error(scanner);
+  directory_scanner_destroy(scanner);
+  return ok;
+}
@@ -22,7 +22,7 @@ void client_set_abort_armed(bool armed);
 * never free it, and the caller retains ownership (freeing it with
 * config_delete() once the call returns). */
 int send_files(Config* config);
-int send_files_multithreaded(Config** config);
+int send_files_multithreaded(Config* config);
 /* rsync's --ignore-errors deletion gate: with no I/O error during the scan the
 * deletion phase always proceeds; with one it is suppressed unless
 * `--ignore-errors` was given.  Exposed so the decision can be unit-tested
@@ -0,0 +1,95 @@
+#ifndef CLIENT_SEND_INTERNAL_H
+#define CLIENT_SEND_INTERNAL_H
+
+/* Declarations shared between the client_send.c transfer orchestration and the
+ * reporting (client_report.c), scanner-preparation (client_scan.c) and
+ * manifest/list/dry-run (client_manifest.c) translation units that were split
+ * out of it.  Nothing here is part of the public client_send.h facade. */
+
+#include "array_list.h"
+#include "client_send.h"
+#include "config.h"
+#include "delete_plan.h"
+#include "delta.h"
+#include "format.h"
+#include "log.h"
+#include "scanner.h"
+#include <stdatomic.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <time.h>
+
+/* One mebibyte in bytes; the unit used by the --stats/--progress lines.
+   Always cast to double when dividing so the output stays fractional. */
+#define BYTES_PER_MIB (1024ULL * 1024ULL)
+
+/* Compiled scanner inputs that are shared read-only across scanner instances
+ * and, in -m mode, across worker threads. `base_filters` owns the compiled
+ * command-line + -C rules; the FileListSet allow-set lives in the Config.
+ * `hardlinks` owns the --hard-links/-H link-group detection table (NULL when
+ * off) and is shared (mutex-guarded) across every scanner/worker of one scan. */
+typedef struct {
+  ScannerOptions options;
+  FilterRuleList* base_filters; /* owned; may be NULL */
+  HardLinkTable* hardlinks;     /* owned; may be NULL */
+  char* relative_prefix;        /* owned -R prefix; may be NULL */
+} PreparedScanner;
+
+/* client_scan.c */
+bool prepare_scanner(const Config* config, int num_threads, PreparedScanner* out);
+void prepared_scanner_destroy(PreparedScanner* prepared);
+bool append_implied_dir_times(const Config* config, ArrayList* dir_entries);
+char* delete_scope_root_marker(const Config* config);
+const char* delete_plan_walk_root(const Config* config, const ArrayList* synced_dirs);
+bool files_from_list_check(const Config* config, ArrayList* missing_dest, int* skipped_out);
+bool scan_paths_only(const Config* config, const ScannerOptions* options, ArrayList* manifest,
+                     DeletePlanSender* plans, bool* io_error_out,
+                     unsigned long long* non_dir_count_out, ArrayList* chunks_out,
+                     bool emit_nonreg);
+
+/* client_report.c */
+void log_server_rejection(const char* context);
+const char* display_bytes(unsigned long long bytes, bool human_readable, char* buffer,
+                          size_t buffer_size);
+unsigned long long dir_count_for_stats(const Config* config, const ArrayList* dir_entries,
+                                       atomic_ullong* counter);
+void report_transfer_stats(const Config* config, const TransferStats* stats, time_t start,
+                           const ReceiverStats* recv);
+void transfer_stats_note_entry(TransferStats* stats, const File* file);
+void transfer_stats_note_transferred(TransferStats* stats, const File* file);
+bool info_flag_enabled(const Config* config, LogInfoFlag flag);
+void print_delete_reports(const Config* config, const ArrayList* paths);
+const char* delete_display_path(const Config* config, const char* path);
+bool progress_requested(const Config* config);
+void client_progress_cleanup(void);
+void client_progress_begin(const Config* config);
+void client_progress_file(const Config* config, const File* file);
+void client_progress_name(const Config* config, const File* file);
+/* Emit a transferred entry's ancestor directories (as -i/--out-format change
+ * lines or --progress name lines) before the entry's own line. */
+void client_change_emit_ancestors(const Config* config, const File* file);
+void client_progress_uptodate(const Config* config, const File* file);
+void client_progress_prepare(const Config* config, const ArrayList* plan_dirs,
+                             unsigned long long plan_non_dir_count);
+bool receive_stats_record(int fd, ReceiverStats* stats, ArrayList* would_delete);
+
+/* client_send.c */
+void receive_daemon_motd(Client* client, const Config* config);
+Client* connect_transfer_client(const Config* config);
+void disconnect_transfer_client(Client* client);
+int incremental_check(Client* client, File* file, const Config* config, DeltaSignature** out_sig,
+                      unsigned long long* resume_offset);
+
+/* client_manifest.c */
+bool dry_run_targets_server(const Config* config);
+bool add_chunk_to_manifest(ArrayList* manifest, const Chunk* chunk);
+int send_dry_run_manifest(const Config* config);
+int send_list_only(const Config* config);
+int send_dry_run_remote(Config* config);
+int send_delete_manifest(int fd, ArrayList* manifest, ArrayList* protected_prefixes,
+                         ArrayList* size_skipped, ArrayList* missing_args, ArrayList* synced_dirs);
+bool send_delete_manifest_early(Client* client, ArrayList* manifest, ArrayList* protected_prefixes,
+                                ArrayList* size_skipped, ArrayList* missing_args,
+                                ArrayList* synced_dirs);
+
+#endif
@@ -53,7 +53,7 @@ bool validate_config(const Config* config) {
    return false;
  }
  if (config->compression_threads > 0 && !config->use_compression) {
-    log_message(LOG_LEVEL_ERROR, "--compress-threads requires compression (-c or -z)");
+    log_message(LOG_LEVEL_ERROR, "--compress-threads requires compression (-z/--compress)");
    return false;
  }
  if (config->transport == TRANSPORT_SSH && config->use_sendfile) {
@@ -75,6 +75,13 @@ bool validate_config(const Config* config) {
    log_message(LOG_LEVEL_ERROR, "-4/--ipv4 and -6/--ipv6 are mutually exclusive");
    return false;
  }
+  /* rsync 3.4.1 rejects --inplace together with --partial-dir (exit 1): the
+     inplace write path bypasses partial staging, so a partial-dir name would be
+     silently ignored.  Match rsync's message and refuse before any I/O. */
+  if (config->inplace && config->partial_dir) {
+    log_message(LOG_LEVEL_ERROR, "--inplace cannot be used with --partial-dir");
+    return false;
+  }
  if (config->log_file_format && !config->log_file) {
    log_message(LOG_LEVEL_ERROR, "--log-file-format requires --log-file");
    return false;
@@ -102,6 +109,16 @@ bool validate_config(const Config* config) {
    log_message(LOG_LEVEL_ERROR, "%s", invariants_error);
    return false;
  }
+  /* The receiver rejects a protect-rule block with more than MAX_FILTER_RULES
+     entries as an opaque protocol error; reject an over-limit --filter set here,
+     before any network I/O, with an actionable message.  send_protect_entries()
+     re-checks the final built count because cvs-exclude / merge rules can
+     expand it beyond config->filters->size. */
+  if (config->filters && config->filters->size > MAX_FILTER_RULES) {
+    log_message(LOG_LEVEL_ERROR, "too many filter rules: %d (maximum %d)", config->filters->size,
+                MAX_FILTER_RULES);
+    return false;
+  }
  /* --protocol: FastSync has exactly one wire format, so the forced version
     must equal the current PROTOCOL_VERSION exactly.  Rejected here, before any
     network I/O, rather than letting the server hit its own mismatch check. */
@@ -10,6 +10,7 @@
 #include "stop_condition.h"
 #include <dirent.h>
 #include <stdbool.h>
+#include <stddef.h>
 #include <stdatomic.h>
 #include <sys/types.h>
 #include <threads.h>
@@ -50,7 +51,7 @@ typedef struct {
  bool copy_dirlinks;
  bool munge_links;
  bool checksum;
-  bool one_file_system;
+  int one_file_system;
  /* Phase 4 special/devices: whether device nodes (--devices) and special files
   * (--specials) are preserved via recreation, and whether --copy-devices
   * copies a device's content as an ordinary regular file. */
@@ -129,6 +130,17 @@ typedef struct {
  /* --info=nonreg: print rsync's `skipping non-regular file "NAME"` line for a
   * non-regular entry that is not being preserved.  Client-only. */
  bool note_nonreg;
+  /* --info=mount: print rsync's `[sender] skipping mount-point dir NAME` when
+   * -xx drops a mount-point directory.  Client-only. */
+  bool note_mount;
+  /* --stats directory accounting for a `-r` run (no -t/-p): a shared counter of
+   * traversed directories that are NOT otherwise represented by an inline
+   * directory entry (rsync still counts every directory in `Number of files`).
+   * Incremented when a directory is opened and decremented when an empty
+   * directory is emitted inline (so it is counted exactly once).  Atomic
+   * because the parallel scanner's workers share it; NULL disables the
+   * accounting.  Client-only. */
+  atomic_ullong* dir_count;
  /* Source root and 8-bit-output policy used to render a `--info=nonreg` name
   * relative to the transfer root.  Borrowed read-only. */
  const char* send_directory;
@@ -188,6 +200,17 @@ typedef struct {
  int current_depth;
  dev_t root_dev;
  bool failed;
+  /* rsync-order traversal: each opened directory's entries are inspected once
+     and buffered (an internal SortedEntry[] owned here) sorted as rsync's flist
+     orders them -- non-directories ascending, then directories ascending.  The
+     entries are walked in order and child directories are collected in
+     `pending_dirs` (an ArrayList of DirEntry*, owned here) and pushed onto the
+     LIFO `directories` stack in reverse at directory exhaustion, so the emitted
+     stream is depth-first like rsync.  `sorted_*` are reset per directory. */
+  void* sorted_entries;
+  size_t sorted_count;
+  size_t sorted_index;
+  void* pending_dirs;
  /* Recursive scan: whether the open directory yielded any transferred or
     descended entry.  When it did not, closing it emits a directory entry so
     the empty source directory is recreated at the destination (rsync
@@ -254,7 +277,7 @@ void directory_scanner_destroy(DirectoryScanner* scanner);
 /* --one-file-system (-x) decision: a directory entry may be descended into
 * only when the option is disabled or the entry lives on the same device as
 * the transfer root. Exposed so tests can exercise the rule directly. */
-bool scanner_same_filesystem(bool one_file_system, dev_t root_device, dev_t entry_device);
+bool scanner_same_filesystem(int one_file_system, dev_t root_device, dev_t entry_device);

 /* Relative path of an on-disk path below `root` ("" == the root itself, NULL
 * when `fs_path` is not under `root`). Handles trailing slashes and a root of
@@ -0,0 +1,675 @@
+#include "log.h"
+#include "scanner.h"
+#include "scanner_internal.h"
+#include "array_list.h"
+#include "chunk.h"
+#include "file.h"
+#include "queue.h"
+#include "utils.h"
+#include <dirent.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/sysmacros.h>
+#include <threads.h>
+#include <unistd.h>
+#include <limits.h>
+
+#include "xattr.h"
+
+/* A chain node: `own` holds the .rsync-filter rules of one directory, `parent`
+ * the context that directory inherited (nearest ancestor with a filter file).
+ * The chain for a directory's contents runs from that directory's own node up
+ * to the root; the command-line base rules are evaluated after the whole
+ * chain. */
+struct FilterNode {
+  FilterNode* parent;
+  FilterRuleList* own;
+};
+
+void filter_node_destroy(void* item) {
+  if (item) {
+    FilterNode* node = (FilterNode*)item;
+    if (node->own)
+      filter_rule_list_free(node->own);
+    free(node);
+  }
+}
+
+FilterNode* filter_node_alloc(FilterNode* parent, FilterRuleList* own) {
+  FilterNode* node = malloc(sizeof(FilterNode));
+  if (!node)
+    return NULL;
+  node->parent = parent;
+  node->own = own;
+  return node;
+}
+
+/* Evaluate a rule chain for one entry.  rsync precedence, highest first: the
+ * innermost (current) directory's .rsync-filter rules, then each ancestor's,
+ * then the root's, and finally the command-line base rules (--filter/-C).  The
+ * sender-side verdict decides whether the entry is hidden from the transfer;
+ * the receiver-side verdict decides whether its destination mirror is protected
+ * from --delete.  Each side takes the FIRST matching rule independently. */
+typedef struct {
+  bool hide;    /* sender-side exclude matched */
+  bool protect; /* receiver-side exclude matched */
+} FilterOutcome;
+
+static void chain_rules_outcome(const FilterRuleList* base, const FilterNode* node, const char* rel,
+                                const char* leaf, bool is_dir, FilterOutcome* out) {
+  memset(out, 0, sizeof(*out));
+  bool sender_decided = false;
+  bool receiver_decided = false;
+  const FilterNode* n = node;
+  while (!sender_decided || !receiver_decided) {
+    const FilterRuleList* list = n ? n->own : base;
+    if (list) {
+      if (!sender_decided) {
+        FilterAction action = filter_rules_apply_side(list, rel, leaf, is_dir, FILTER_SIDE_SENDER);
+        if (action != FILTER_ACTION_NONE) {
+          out->hide = action == FILTER_ACTION_EXCLUDE;
+          sender_decided = true;
+        }
+      }
+      if (!receiver_decided) {
+        FilterAction action =
+            filter_rules_apply_side(list, rel, leaf, is_dir, FILTER_SIDE_RECEIVER);
+        if (action != FILTER_ACTION_NONE) {
+          out->protect = action == FILTER_ACTION_PROTECT;
+          receiver_decided = true;
+        }
+      }
+    }
+    if (!n)
+      break;
+    n = n->parent;
+  }
+}
+
+static bool entry_allowed(const FilterRuleList* base, const FilterNode* node, const char* rel,
+                          const char* leaf, bool is_dir, bool exclude_filter_files,
+                          bool* protect_out) {
+  /* -FF: per-directory .rsync-filter files are never transferred (single -F
+     transfers them, matching rsync). */
+  if (exclude_filter_files && !is_dir && strcmp(leaf, ".rsync-filter") == 0) {
+    if (protect_out)
+      *protect_out = false;
+    return false;
+  }
+  FilterOutcome outcome;
+  chain_rules_outcome(base, node, rel, leaf, is_dir, &outcome);
+  if (protect_out)
+    *protect_out = outcome.protect;
+  return !outcome.hide;
+}
+
+void dir_entry_destroy(void* item) {
+  if (item) {
+    DirEntry* de = (DirEntry*)item;
+    free(de->path);
+    free(de);
+  }
+}
+
+DirEntry* dir_entry_create(const char* path, int depth, FilterNode* context) {
+  DirEntry* de = malloc(sizeof(DirEntry));
+  if (!de)
+    return NULL;
+  de->path = str_dup(path);
+  if (!de->path) {
+    free(de);
+    return NULL;
+  }
+  de->depth = depth;
+  de->context = context;
+  return de;
+}
+
+/* Apply rsync's symlink-resolution precedence to one S_ISLNK entry:
+ *   --copy-links  dereferences every symlink;
+ *   --copy-unsafe-links  dereferences only targets unsafe_symlink() flags;
+ *   -k/--copy-dirlinks  dereferences only a symlink whose referent is a dir;
+ *   --safe-links  (receiver-side in rsync; modelled here) ignores an unsafe
+ *                 target that would otherwise be carried; with --munge-links
+ *                 every stored target becomes absolute, so --safe-links then
+ *                 ignores every symlink, exactly as rsync documents;
+ *   -l/--links  carries the link.
+ * `link_rel` is the symlink's transfer-relative path (incl. name) and is used
+ * only for the lexical unsafe test.  `target` receives the raw link value. */
+LinkAction scanner_link_action(const ScannerOptions* options, const char* path,
+                               const char* link_rel, char* target, size_t target_size) {
+  if (!options->follow_symlinks && !options->copy_links && !options->safe_links &&
+      !options->copy_unsafe_links && !options->copy_dirlinks)
+    return LINK_ACTION_SKIP;
+  ssize_t length = readlink(path, target, target_size - 1);
+  if (length < 0)
+    return LINK_ACTION_SKIP;
+  target[length] = '\0';
+
+  bool unsafe = file_symlink_unsafe(target, link_rel);
+  if (options->copy_links || (options->copy_unsafe_links && unsafe))
+    return LINK_ACTION_DEREF;
+  if (options->copy_dirlinks) {
+    struct stat ref;
+    if (stat(path, &ref) == 0 && S_ISDIR(ref.st_mode))
+      return LINK_ACTION_DEREF;
+  }
+  if (options->safe_links && (unsafe || options->munge_links))
+    return LINK_ACTION_SKIP_PROTECTED;
+  if (!options->follow_symlinks || target[0] == '\0')
+    return LINK_ACTION_SKIP;
+  return LINK_ACTION_CARRY;
+}
+
+/* --one-file-system (-x) decision. Only directories can carry a different
+ * device than their parent (mount points), so this is checked when a child
+ * directory is about to be descended into. */
+bool scanner_same_filesystem(int one_file_system, dev_t root_device, dev_t entry_device) {
+  return one_file_system <= 0 || entry_device == root_device;
+}
+
+/* Build a payload-less directory File carrying the captured metadata (when
+ * requested).  Used by -x mount-point emission and --list-only directory
+ * entries.  Returns NULL on allocation failure. */
+File* scanner_build_dir_file(const char* path, const struct stat* stats,
+                             const ScannerOptions* options) {
+  File* dir = file_create(path);
+  if (dir == NULL)
+    return NULL;
+  dir->is_dir = true;
+  if (options->use_metadata) {
+    dir->metadata =
+        file_metadata_create(dir->path, stats, options->preserve_atimes, options->preserve_crtimes);
+    if (!dir->metadata) {
+      file_destroy(dir);
+      return NULL;
+    }
+  }
+  return dir;
+}
+
+/* Relative path of an on-disk path below `root`. The transfer root may be
+ * given with a trailing slash; the returned rel path never has one and is ""
+ * for the root itself. A root of "/" is handled (its children start at "/").
+ * Exposed so tests can exercise the mapping directly. */
+char* scanner_path_relative(const char* root, const char* fs_path) {
+  size_t root_len = strlen(root);
+  while (root_len > 1 && root[root_len - 1] == '/')
+    root_len--;
+  if (strncmp(root, fs_path, root_len) != 0)
+    return NULL;
+  if (root_len == 1 && root[0] == '/') {
+    if (fs_path[1] == '\0')
+      return str_dup("");
+    return str_dup(fs_path + 1);
+  }
+  if (fs_path[root_len] == '\0')
+    return str_dup("");
+  if (fs_path[root_len] != '/')
+    return NULL;
+  return str_dup(fs_path + root_len + 1);
+}
+
+/* -R/--relative destination-relative prefix reconstructed from a source spec:
+ * everything after the first '.' path component (rsync's '/./' cut point),
+ * with leading/trailing slashes removed; or the whole spec (normalized) when
+ * there is no cut.  Returns "" for the receive root.  Exposed for tests. */
+char* scanner_relative_prefix(const char* spec) {
+  if (!spec || spec[0] == '\0')
+    return NULL;
+  const char* after = spec;
+  if (spec[0] == '.' && spec[1] == '/') {
+    after = spec + 2;
+  } else {
+    const char* cut = strstr(spec, "/./");
+    if (cut)
+      after = cut + 3;
+  }
+  size_t cap = strlen(spec) + 1;
+  char* out = malloc(cap);
+  if (!out)
+    return NULL;
+  size_t len = 0;
+  for (const char* s = after; *s;) {
+    while (*s == '/')
+      s++;
+    const char* comp = s;
+    while (*s && *s != '/')
+      s++;
+    size_t clen = (size_t)(s - comp);
+    if (clen == 0 || (clen == 1 && comp[0] == '.'))
+      continue;
+    if (len)
+      out[len++] = '/';
+    memcpy(out + len, comp, clen);
+    len += clen;
+  }
+  out[len] = '\0';
+  return out;
+}
+
+/* Relative path of a child entry below the current directory. */
+char* child_rel_path(const char* parent_rel, const char* name) {
+  if (!parent_rel || parent_rel[0] == '\0')
+    return str_dup(name);
+  return path_cat(parent_rel, name);
+}
+
+/* Destination-relative wire path for an entry under an -R prefix. */
+char* scanner_prefix_send_path(const char* prefix, const char* rel) {
+  if (prefix[0] == '\0')
+    return str_dup(rel);
+  if (rel[0] == '\0')
+    return str_dup(prefix);
+  return path_cat(prefix, rel);
+}
+
+/* Apply the --files-from allow-set and the filter layer to one entry.  On
+ * return `*protect_out` is true when a receiver-side rule protects the entry's
+ * destination mirror from deletion. */
+bool entry_passes_selection(const FileListSet* file_list, const FilterRuleList* base,
+                            const FilterNode* node, const char* rel, const char* leaf, bool is_dir,
+                            bool per_dir_filters, bool exclude_filter_files, bool* protect_out) {
+  if (protect_out)
+    *protect_out = false;
+  if (file_list && !file_list_affects(file_list, rel))
+    return false;
+  if (base || per_dir_filters)
+    return entry_allowed(base, node, rel, leaf, is_dir, exclude_filter_files, protect_out);
+  return true;
+}
+
+/* Best-effort capture of the file's whitelisted xattrs (-X/-A).  A failure to
+ * read xattrs is non-fatal: the file is transferred without them.  A symlink
+ * entry reads the LINK's own xattrs (never the referent's) with the no-follow
+ * variant; on Linux the VFS refuses xattrs on symlinks, so that yields NULL. */
+void scanner_capture_xattrs(const DirectoryScanner* scanner, File* file) {
+  if (!scanner || !file || !(scanner->options.preserve_xattrs || scanner->options.preserve_acls))
+    return;
+  file->xattrs = file->is_symlink
+                     ? xattr_capture_path_nofollow(file->path, scanner->options.preserve_acls)
+                     : xattr_capture_path(file->path, scanner->options.preserve_acls);
+}
+
+/* Apply --hard-links (-H) detection to one regular File.  On a sibling (a
+ * later member of an already-seen source inode) the File keeps the group id
+ * and the first member's wire path but carries NO data payload (size 0); the
+ * first member is left untouched (data present, link_first).  Allocation
+ * failure is fatal: the scanner is marked failed. */
+void scanner_assign_hardlink(DirectoryScanner* scanner, HardLinkTable* table, File* file,
+                             const struct stat* stats) {
+  if (!table || !file || !stats)
+    return;
+  int gid;
+  bool is_first;
+  char* first_path = NULL;
+  if (!hardlink_table_assign(table, file_wire_path(file), stats->st_dev, stats->st_ino, &gid,
+                             &is_first, &first_path)) {
+    if (scanner)
+      scanner->failed = true;
+    return;
+  }
+  file->link_group = gid;
+  file->link_first = is_first;
+  if (!is_first) {
+    file->hardlink_target = first_path;
+    file->data->size = 0;
+  } else {
+    free(first_path);
+  }
+}
+
+/* Phase 4 special/devices decision for one non-regular entry, matching rsync:
+   - a char/block device is RECREATED as a node under -D/--devices, unless
+     --copy-devices asks for its content to be copied into a regular file;
+   - a FIFO/socket is RECREATED under --specials;
+   - when the matching flag is absent the entry is SKIPPED ("skipping
+     non-regular file"), exactly like rsync's default, instead of being
+     silently copied as a zero-length regular file;
+   - anything else (regular/directory) is left to the normal data path. */
+ScannerSpecial scanner_prepare_special(bool preserve_devices, bool preserve_specials,
+                                       bool copy_devices, File* file, const struct stat* stats) {
+  if (!file || !stats)
+    return SCANNER_SPECIAL_REGULAR;
+  bool is_device = S_ISCHR(stats->st_mode) || S_ISBLK(stats->st_mode);
+  bool is_fifo = S_ISFIFO(stats->st_mode);
+  bool is_socket = S_ISSOCK(stats->st_mode);
+  if (!is_device && !is_fifo && !is_socket)
+    return SCANNER_SPECIAL_REGULAR;
+  if (is_device && copy_devices)
+    return SCANNER_SPECIAL_REGULAR; /* copy device content as a regular file */
+  bool preserve = is_device ? preserve_devices : preserve_specials;
+  if (!preserve)
+    return SCANNER_SPECIAL_SKIP;
+  file->is_special = true;
+  file->data->size = 0;
+  file->data->data = NULL;
+  if (is_device) {
+    file->rdev_major = (int32_t)major(stats->st_rdev);
+    file->rdev_minor = (int32_t)minor(stats->st_rdev);
+  }
+  return SCANNER_SPECIAL_RECREATE;
+}
+
+/* Append `rel` to the caller's exclusion sink, taking `mtx` when shared across
+   parallel worker threads.  Returns false on allocation failure (list left
+   unchanged). */
+bool excluded_sink_append(ArrayList* list, mtx_t* mtx, const char* rel) {
+  if (!list)
+    return true;
+  char* dup = str_dup(rel);
+  if (!dup)
+    return false;
+  if (mtx)
+    mtx_lock(mtx);
+  bool ok = array_list_add(list, dup);
+  if (mtx)
+    mtx_unlock(mtx);
+  if (!ok)
+    free(dup);
+  return ok;
+}
+
+/* Record one pruned filesystem path in a delete-protection sink.  The stored
+   form is the entry's wire/destination-relative path (a single leading '/'
+   removed, exactly how manifest keep entries are stored), so the receiver's
+   walker prefixes match the destination layout.  An allocation failure is a
+   fatal scan error. */
+static void scanner_record_protected(DirectoryScanner* scanner, const char* fs_path,
+                                     ArrayList* sink) {
+  if (!sink || !fs_path)
+    return;
+  const char* rel = *fs_path == '/' ? fs_path + 1 : fs_path;
+  if (!excluded_sink_append(sink, scanner->options.excluded_mutex, rel))
+    scanner->failed = true;
+}
+
+/* rsync's `--info=nonreg` line for a non-regular entry that is not being
+ * preserved: `skipping non-regular file "NAME"`.  The name is the path relative
+ * to the transfer root, so it matches rsync's displayed name. */
+void scanner_note_nonreg(const ScannerOptions* options, const char* fs_path) {
+  if (!options || !options->note_nonreg || !fs_path)
+    return;
+  const char* rel = utils_strip_transfer_root(fs_path, options->send_directory);
+  char* escaped = output_escape(rel, options->eight_bit_output);
+  printf("skipping non-regular file \"%s\"\n", escaped ? escaped : rel);
+  free(escaped);
+  fflush(stdout);
+}
+
+/* rsync 3.4.1's `--info=mount` line, emitted when `-xx` drops a mount-point
+ * directory: `[sender] skipping mount-point dir NAME` (the client is the
+ * sender).  Plain `-x` keeps the empty directory and prints nothing, matching
+ * rsync. */
+void scanner_note_mount(const ScannerOptions* options, const char* fs_path) {
+  if (!options || !options->note_mount || !fs_path)
+    return;
+  const char* rel = utils_strip_transfer_root(fs_path, options->send_directory);
+  char* escaped = output_escape(rel, options->eight_bit_output);
+  printf("[sender] skipping mount-point dir %s\n", escaped ? escaped : rel);
+  free(escaped);
+  fflush(stdout);
+}
+
+/* --debug=filter: a selection/filter decision dropped an entry. */
+void scanner_note_filter(const ScannerOptions* options, const char* name) {
+  if (!options || !log_debug_enabled(LOG_DEBUG_FILTER) || !name)
+    return;
+  log_debug_message(LOG_DEBUG_FILTER, "filter: excluded %s", name);
+}
+
+/* Account for a directory that will not be represented by an inline directory
+ * entry.  Paired with scanner_dir_count_uncount for empty directories that are
+ * emitted inline, so every traversed directory is counted exactly once. */
+void scanner_dir_count_count(const ScannerOptions* options) {
+  if (options && options->dir_count)
+    atomic_fetch_add(options->dir_count, 1);
+}
+
+void scanner_dir_count_uncount(const ScannerOptions* options) {
+  if (options && options->dir_count)
+    atomic_fetch_sub(options->dir_count, 1);
+}
+
+/* A user-selection exclusion (--filter/-C/per-dir or --exclude/--include). */
+void scanner_record_excluded(DirectoryScanner* scanner, const char* fs_path) {
+  scanner_record_protected(scanner, fs_path, scanner->options.excluded_paths);
+}
+
+/* A --max-size/--min-size prune (always protected, even under --delete-excluded). */
+void scanner_record_size_skipped(DirectoryScanner* scanner, const char* fs_path) {
+  scanner_record_protected(scanner, fs_path, scanner->options.size_skipped_paths);
+}
+
+/* Record a directory the scan synchronized.  `fs_path` is its absolute path and
+   `rel` its path relative to the transfer root ("" for the root); the stored
+   form matches the wire layout (the bare relative path in -R+--files-from, else
+   the source path with a leading '/' removed, with "." for the receive root).
+   Returns false on allocation failure. */
+bool scanner_record_synced_dir(const ScannerOptions* options, const char* fs_path, const char* rel,
+                               bool relative_mode) {
+  if (!options->synced_dirs && !options->plan_dirs)
+    return true;
+  if (!file_list_dir_in_scope(options->file_list, rel))
+    return true;
+  char* prefixed = NULL;
+  const char* dest;
+  if (relative_mode) {
+    dest = rel;
+  } else if (options->relative_prefix) {
+    prefixed = scanner_prefix_send_path(options->relative_prefix, rel);
+    if (!prefixed)
+      return false;
+    dest = prefixed;
+  } else {
+    dest = fs_path;
+  }
+  if (dest[0] == '/')
+    dest++;
+  if (dest[0] == '\0')
+    dest = ".";
+  bool ok = true;
+  if (options->synced_dirs)
+    ok = excluded_sink_append(options->synced_dirs, options->excluded_mutex, dest);
+  /* The delete-plan keep set needs an entry for every traversed source
+     directory, including empty ones, so its destination mirror is kept rather
+     than deleted as an extra; the receive root (".") is implicit. */
+  if (ok && options->plan_dirs && strcmp(dest, ".") != 0)
+    ok = excluded_sink_append(options->plan_dirs, options->excluded_mutex, dest);
+  free(prefixed);
+  return ok;
+}
+
+/* Read every per-directory filter file that applies to `dir_path` (its
+ * .rsync-filter when -F is active, plus each registered "dir-merge NAME") into a
+ * fresh list.  Returns NULL on allocation/parse failure (message in `err`);
+ * returns an empty list (and *any_exists=false) when no file exists. */
+FilterRuleList* read_dir_filters(const ScannerOptions* options, const char* dir_path,
+                                 const char* rel, bool* any_exists, char* err, size_t err_size) {
+  if (err && err_size > 0)
+    err[0] = '\0';
+  const FilterRuleList* base = options->base_filters;
+  bool have_names = options->per_dir_filters || (base && base->dir_merge_count > 0);
+  if (any_exists)
+    *any_exists = false;
+  if (!have_names)
+    return NULL;
+  FilterRuleList* own = filter_rule_list_create();
+  if (!own) {
+    snprintf(err, err_size, "memory allocation failed");
+    return NULL;
+  }
+  FilterParseOptions opts = {.delete_excluded = options->delete_excluded, .cvs_exclude = false};
+  bool exists = false;
+  if (options->per_dir_filters) {
+    if (!filter_file_append(own, dir_path, ".rsync-filter", rel, &opts, &exists, err, err_size))
+      goto fail;
+    if (exists && any_exists)
+      *any_exists = true;
+  }
+  if (base) {
+    for (int i = 0; i < base->dir_merge_count; i++) {
+      if (!filter_file_append(own, dir_path, base->dir_merge_names[i], rel, &opts, &exists, err,
+                              err_size))
+        goto fail;
+      if (exists && any_exists)
+        *any_exists = true;
+    }
+  }
+  return own;
+fail:
+  filter_rule_list_free(own);
+  return NULL;
+}
+
+/* Merge the open directory's own per-directory filter files (the default
+ * .rsync-filter when -F is active, plus every "dir-merge NAME" registered on the
+ * base rule list) into the inherited context, returning the context used for
+ * this directory's entries. On a parse error the scanner is marked failed.
+ * Returns 0 on success, -1 on failure. */
+int open_directory_filter_context(DirectoryScanner* scanner, const FilterNode* inherited) {
+  char err[256];
+  bool any_exists = false;
+  FilterRuleList* own = read_dir_filters(&scanner->options, scanner->current_path,
+                                         scanner->current_rel ? scanner->current_rel : "",
+                                         &any_exists, err, sizeof(err));
+  if (!own) {
+    /* read_dir_filters() leaves `err` set on a parse/allocation failure even
+       when an earlier merge file in the same directory existed (any_exists true);
+       key off the error text rather than any_exists so an invalid per-directory
+       filter file can never be silently ignored. */
+    if (err[0] == '\0') {
+      scanner->current_node = (FilterNode*)inherited;
+      return 0;
+    }
+    char* escaped_path = output_escape(scanner->current_path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_ERROR, "invalid per-directory filter in %s: %s",
+                escaped_path ? escaped_path : "<allocation failed>", err);
+    free(escaped_path);
+    scanner->failed = true;
+    return -1;
+  }
+  if (any_exists && (own->count > 0 || own->dir_merge_count > 0)) {
+    FilterNode* node = filter_node_alloc((FilterNode*)inherited, own);
+    if (!node || !array_list_add(scanner->filter_nodes, node)) {
+      filter_node_destroy(node);
+      scanner->failed = true;
+      return -1;
+    }
+    scanner->current_node = node;
+  } else {
+    filter_rule_list_free(own);
+    scanner->current_node = (FilterNode*)inherited;
+  }
+  return 0;
+}
+
+/* Inspect symlinks, resolve the entry type, and apply file filters once for both scanners.
+ * `link_rel` is the entry's path relative to the transfer root (including its
+ * name), used for the lexical rsync unsafe-symlink test. */
+int scanner_inspect_entry(const ScannerOptions* options, const char* containing_dir,
+                          const char* link_rel, const char* name, ScannerEntry* entry) {
+  entry->excluded = false;
+  entry->size_excluded = false;
+  entry->referent_error = false;
+  entry->is_symlink = false;
+  entry->link_target = NULL;
+  entry->path = path_cat(containing_dir, name);
+  if (!entry->path)
+    return -1;
+
+  struct stat link_stats;
+  if (lstat(entry->path, &link_stats) != 0) {
+    free(entry->path);
+    return 0;
+  }
+  if (!S_ISLNK(link_stats.st_mode))
+    goto regular;
+
+  char link_target[4096];
+  switch (scanner_link_action(options, entry->path, link_rel, link_target, sizeof(link_target))) {
+  case LINK_ACTION_SKIP:
+    goto skip;
+  case LINK_ACTION_SKIP_PROTECTED:
+    /* --safe-links ignored the link, but rsync still counts it as present in
+       the transfer, so its destination mirror survives --delete.  Record it as
+       an excluded path (the same delete-protection channel as a filter prune). */
+    entry->excluded = true;
+    goto skip;
+  case LINK_ACTION_DEREF:
+    if (stat(entry->path, &entry->stats) != 0) {
+      /* rsync reports "symlink has no referent" and continues with a partial
+         transfer (exit 23); record the error so the run exits 23 too. */
+      char* escaped = output_escape(entry->path, log_get_8_bit_output());
+      log_message(LOG_LEVEL_WARNING, "symlink has no referent: %s",
+                  escaped ? escaped : "<allocation failed>");
+      free(escaped);
+      entry->referent_error = true;
+      goto skip;
+    }
+    entry->is_directory = S_ISDIR(entry->stats.st_mode);
+    if (entry->is_directory)
+      return 1;
+    goto apply_filters;
+  case LINK_ACTION_CARRY:
+    break;
+  }
+
+  /* Carry the link as a symlink.  --munge-links is applied by the RECEIVER (it
+     prefixes every stored target with /rsyncd-munged/); when the SOURCE already
+     holds a munged value the sender strips it so the receiver re-munges a clean
+     target, round-tripping a munged tree exactly like rsync. */
+  entry->is_symlink = true;
+  entry->stats = link_stats;
+  entry->is_directory = false;
+  entry->link_target = str_dup(link_target);
+  if (!entry->link_target)
+    goto skip;
+  if (options->munge_links)
+    file_symlink_unmunge(entry->link_target);
+  goto apply_filters;
+
+regular:
+  /* Not a symlink: the lstat() above already described this entry, and lstat
+     and stat are identical for every non-symlink, so reuse that result instead
+     of issuing a redundant stat() on the scanner hot path.  stat() is still
+     used on the dereference paths above/below for actual symlinks (copy-links,
+     safe/copy-unsafe links, and -k symlinks-to-directories). */
+  entry->stats = link_stats;
+  entry->is_directory = S_ISDIR(link_stats.st_mode);
+  if (entry->is_directory)
+    return 1;
+
+apply_filters:
+  for (int i = 0; i < options->exclude_count; i++)
+    if (glob_match(options->exclude_patterns[i], name)) {
+      entry->excluded = true;
+      goto skip;
+    }
+  if (options->include_count > 0) {
+    bool included = false;
+    for (int i = 0; i < options->include_count; i++)
+      if (glob_match(options->include_patterns[i], name))
+        included = true;
+    if (!included) {
+      entry->excluded = true;
+      goto skip;
+    }
+  }
+  if ((options->max_size > 0 && (unsigned long long)entry->stats.st_size > options->max_size) ||
+      (options->min_size > 0 && (unsigned long long)entry->stats.st_size < options->min_size)) {
+    entry->excluded = true;
+    entry->size_excluded = true;
+    goto skip;
+  }
+  return 1;
+
+skip:
+  free(entry->path);
+  entry->path = NULL;
+  free(entry->link_target);
+  entry->link_target = NULL;
+  return 0;
+}
@@ -0,0 +1,107 @@
+#ifndef SCANNER_INTERNAL_H
+#define SCANNER_INTERNAL_H
+
+/* Internal declarations shared between the scanner translation units
+ * (scanner_filter.c, scanner.c, scanner_parallel.c).  Nothing here is part of
+ * the public scanner façade (scanner.h); every symbol stays internal to the
+ * client module. */
+
+#include "array_list.h"
+#include "file.h"
+#include "scanner.h"
+#include <stdbool.h>
+#include <stddef.h>
+#include <sys/stat.h>
+
+typedef struct {
+  char* path;
+  int depth;
+  FilterNode* context; /* inherited per-directory filter context */
+} DirEntry;
+
+/* How rsync's readlink_stat()/generator resolves one source symlink. */
+typedef enum {
+  LINK_ACTION_SKIP,           /* not transferred (no link option) */
+  LINK_ACTION_SKIP_PROTECTED, /* ignored as unsafe by --safe-links; rsync keeps
+                                 it in the transfer, so its destination mirror
+                                 must be protected from --delete */
+  LINK_ACTION_DEREF,          /* follow the referent (--copy-links, an unsafe
+                                 target under --copy-unsafe-links, or -k dir) */
+  LINK_ACTION_CARRY,          /* transmit the link itself (-l) */
+} LinkAction;
+
+typedef struct {
+  char* path;
+  struct stat stats;
+  bool is_directory;
+  /* True when the entry should be carried through as a SYMLINK (is_symlink)
+     rather than a dereferenced file/directory.  When true, `link_target` holds
+     the owned target string to transmit (sender-munged under --munge-links);
+     ownership transfers to the File built from this entry. */
+  bool is_symlink;
+  char* link_target;
+  /* True when the entry was pruned by a user selection rule (--filter/-C/per-dir
+     rules or the --exclude/--include layer) rather than skipped for another
+     reason (unreadable, symlink policy, not applicable). */
+  bool excluded;
+  /* True when the entry was skipped specifically by --max-size/--min-size.
+     Size pruning protects the destination mirror even under --delete-excluded,
+     so it is recorded into a separate sink from `excluded`. */
+  bool size_excluded;
+  /* True when a symlink selected for dereferencing (-L/--copy-links or an
+     unsafe target under --copy-unsafe-links) had no usable referent (a broken
+     link or a stat() failure).  rsync still reports this as a partial transfer
+     (exit 23) even though the entry is skipped, so the scanner records it as a
+     non-fatal I/O error. */
+  bool referent_error;
+} ScannerEntry;
+
+typedef enum {
+  SCANNER_SPECIAL_REGULAR,  /* ordinary file: transfer content */
+  SCANNER_SPECIAL_RECREATE, /* is_special node to recreate on the receiver */
+  SCANNER_SPECIAL_SKIP,     /* non-regular entry not requested: skip */
+} ScannerSpecial;
+
+/* scanner_filter.c */
+void filter_node_destroy(void* item);
+FilterNode* filter_node_alloc(FilterNode* parent, FilterRuleList* own);
+void dir_entry_destroy(void* item);
+DirEntry* dir_entry_create(const char* path, int depth, FilterNode* context);
+LinkAction scanner_link_action(const ScannerOptions* options, const char* path,
+                               const char* link_rel, char* target, size_t target_size);
+File* scanner_build_dir_file(const char* path, const struct stat* stats,
+                             const ScannerOptions* options);
+char* child_rel_path(const char* parent_rel, const char* name);
+char* scanner_prefix_send_path(const char* prefix, const char* rel);
+bool entry_passes_selection(const FileListSet* file_list, const FilterRuleList* base,
+                            const FilterNode* node, const char* rel, const char* leaf, bool is_dir,
+                            bool per_dir_filters, bool exclude_filter_files, bool* protect_out);
+void scanner_capture_xattrs(const DirectoryScanner* scanner, File* file);
+void scanner_assign_hardlink(DirectoryScanner* scanner, HardLinkTable* table, File* file,
+                             const struct stat* stats);
+ScannerSpecial scanner_prepare_special(bool preserve_devices, bool preserve_specials,
+                                       bool copy_devices, File* file, const struct stat* stats);
+bool excluded_sink_append(ArrayList* list, mtx_t* mtx, const char* rel);
+void scanner_note_nonreg(const ScannerOptions* options, const char* fs_path);
+void scanner_note_mount(const ScannerOptions* options, const char* fs_path);
+void scanner_note_filter(const ScannerOptions* options, const char* name);
+void scanner_dir_count_count(const ScannerOptions* options);
+void scanner_dir_count_uncount(const ScannerOptions* options);
+void scanner_record_excluded(DirectoryScanner* scanner, const char* fs_path);
+void scanner_record_size_skipped(DirectoryScanner* scanner, const char* fs_path);
+bool scanner_record_synced_dir(const ScannerOptions* options, const char* fs_path, const char* rel,
+                               bool relative_mode);
+FilterRuleList* read_dir_filters(const ScannerOptions* options, const char* dir_path,
+                                 const char* rel, bool* any_exists, char* err, size_t err_size);
+int open_directory_filter_context(DirectoryScanner* scanner, const FilterNode* inherited);
+int scanner_inspect_entry(const ScannerOptions* options, const char* containing_dir,
+                          const char* link_rel, const char* name, ScannerEntry* entry);
+
+/* scanner.c */
+bool scanner_capture_dir_time(ArrayList* dir_entries, mtx_t* mutex, const char* root_path,
+                              const char* fs_path, bool relative_mode, const char* relative_prefix,
+                              bool preserve_atimes, bool preserve_crtimes, bool preserve_xattrs,
+                              bool preserve_acls, bool no_implied_dirs,
+                              const FileListSet* file_list);
+
+#endif
@@ -0,0 +1,705 @@
+#include "log.h"
+#include "scanner.h"
+#include "scanner_internal.h"
+#include "array_list.h"
+#include "chunk.h"
+#include "file.h"
+#include "queue.h"
+#include "utils.h"
+#include <dirent.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/sysmacros.h>
+#include <threads.h>
+#include <unistd.h>
+#include <limits.h>
+
+#include "xattr.h"
+
+typedef struct {
+  ParallelScanner* ps;
+  char** dirs;
+  int dir_count;
+  char* root_dir; /* the transfer root, for relative-path computation */
+  ScannerOptions options;
+  ProtocolSession* allocation_session;
+} ParallelWorkerArg;
+
+static int parallel_worker_thread(void* arg) {
+  ParallelWorkerArg* wa = (ParallelWorkerArg*)arg;
+  ProtocolSession* allocation_session = wa->allocation_session;
+  if (allocation_session)
+    protocol_session_bind(allocation_session);
+  for (int i = 0; i < wa->dir_count; i++) {
+    DirectoryScanner* ds = directory_scanner_create_with_options(wa->dirs[i], &wa->options);
+    if (!ds) {
+      mtx_lock(&wa->ps->result_mutex);
+      wa->ps->failed = true;
+      atomic_store(&wa->ps->cancelled, true);
+      cnd_broadcast(&wa->ps->result_not_empty);
+      cnd_broadcast(&wa->ps->result_not_full);
+      mtx_unlock(&wa->ps->result_mutex);
+      for (int j = i; j < wa->dir_count; j++)
+        free(wa->dirs[j]);
+      break;
+    }
+    /* Root .rsync-filter rules (parsed by the parallel scanner) apply to the
+     * contents of every assigned subdirectory. Relative paths (used by the
+     * allow-set and per-directory rules) are computed against the transfer
+     * root, not the subdirectory the worker is seeded with.  Exclusion
+     * recording shares one caller-owned list across the workers. */
+    free(ds->root_path);
+    ds->root_path = str_dup(wa->root_dir);
+    ds->seed_node = wa->ps->root_filter_node;
+    ds->options.excluded_mutex = &wa->ps->result_mutex;
+    Chunk* chunk;
+    while ((chunk = directory_scanner_next(ds)) != NULL) {
+      if (!queue_enqueue_multithreaded_cancel(wa->ps->result_queue, chunk, &wa->ps->result_mutex,
+                                              &wa->ps->result_not_empty, &wa->ps->result_not_full,
+                                              &wa->ps->cancelled)) {
+        chunk_destroy(chunk);
+        break;
+      }
+    }
+    if (directory_scanner_failed(ds)) {
+      mtx_lock(&wa->ps->result_mutex);
+      wa->ps->failed = true;
+      atomic_store(&wa->ps->cancelled, true);
+      cnd_broadcast(&wa->ps->result_not_empty);
+      cnd_broadcast(&wa->ps->result_not_full);
+      mtx_unlock(&wa->ps->result_mutex);
+    } else if (directory_scanner_had_io_error(ds)) {
+      /* --ignore-errors path: an unreadable directory was skipped, not fatal. */
+      mtx_lock(&wa->ps->result_mutex);
+      wa->ps->io_error = true;
+      mtx_unlock(&wa->ps->result_mutex);
+    }
+    directory_scanner_destroy(ds);
+    free(wa->dirs[i]);
+  }
+  ParallelScanner* ps = wa->ps;
+  free(wa->root_dir);
+  free(wa->dirs);
+  free(wa);
+  mtx_lock(&ps->result_mutex);
+  ps->completed++;
+  if (ps->completed >= ps->expected_threads) {
+    ps->done = true;
+    cnd_signal(&ps->result_not_empty);
+  }
+  mtx_unlock(&ps->result_mutex);
+  if (allocation_session)
+    protocol_session_unbind();
+  return thrd_success;
+}
+
+static void parallel_scanner_creation_failed(ParallelScanner* ps) {
+  mtx_lock(&ps->result_mutex);
+  ps->failed = true;
+  atomic_store(&ps->cancelled, true);
+  ps->expected_threads = ps->created_threads;
+  if (ps->completed >= ps->expected_threads)
+    ps->done = true;
+  cnd_broadcast(&ps->result_not_empty);
+  cnd_broadcast(&ps->result_not_full);
+  mtx_unlock(&ps->result_mutex);
+}
+
+/* Initialize result queue and synchronization primitives. Returns true on success. */
+static bool parallel_scanner_init(ParallelScanner* ps) {
+  ps->result_queue = queue_create(100, chunk_destroy);
+  if (!ps->result_queue)
+    return false;
+  atomic_init(&ps->cancelled, false);
+  int init = 0;
+  bool ok = true;
+  if (mtx_init(&ps->result_mutex, mtx_plain) != thrd_success)
+    ok = false;
+  if (ok) {
+    init++;
+    if (cnd_init(&ps->result_not_empty) != thrd_success)
+      ok = false;
+  }
+  if (ok) {
+    // cppcheck-suppress unreadVariable
+    init++;
+    if (cnd_init(&ps->result_not_full) != thrd_success)
+      ok = false;
+  }
+  if (!ok) {
+    if (init >= 3)
+      cnd_destroy(&ps->result_not_full);
+    if (init >= 2)
+      cnd_destroy(&ps->result_not_empty);
+    if (init >= 1)
+      mtx_destroy(&ps->result_mutex);
+    queue_destroy(ps->result_queue);
+    ps->result_queue = NULL;
+    return false;
+  }
+  return true;
+}
+
+/* Split files into chunks of roughly chunk_size bytes. Returns the first chunk (also stored
+ * chunks beyond the first are enqueued on `queue`). Nulls out consumed entries in `files`.
+ * Sets *failed on allocation/enqueue errors. */
+static Chunk* batch_files(ArrayList* files, unsigned long long chunk_size, Queue* queue,
+                          bool* failed) {
+  Chunk* first = NULL;
+  if (files->size <= 0)
+    return NULL;
+  ArrayList* batch = array_list_create(NULL);
+  if (!batch) {
+    *failed = true;
+    return NULL;
+  }
+  unsigned long long batch_size = 0;
+  for (int i = 0; i < files->size; i++) {
+    File* f = (File*)files->items[i];
+    if (!array_list_add(batch, f)) {
+      *failed = true;
+      break;
+    }
+    batch_size += f->data->size;
+    if (batch_size >= chunk_size || i == files->size - 1) {
+      void** items = array_list_to_array(batch);
+      if (!items) {
+        *failed = true;
+        array_list_delete(batch);
+        batch = NULL;
+        break;
+      }
+      Chunk* c = chunk_create((File**)items, batch->size);
+      free(items);
+      if (!c) {
+        *failed = true;
+        array_list_delete(batch);
+        batch = NULL;
+        break;
+      }
+      int batch_start = i - batch->size + 1;
+      for (int j = batch_start; j <= i; j++)
+        files->items[j] = NULL;
+      batch->item_destroyer = NULL;
+      array_list_delete(batch);
+      batch = NULL;
+      if (!first) {
+        first = c;
+      } else {
+        if (!queue_enqueue(queue, c)) {
+          chunk_destroy(c);
+          *failed = true;
+        }
+      }
+      if (i < files->size - 1) {
+        batch = array_list_create(NULL);
+        if (!batch) {
+          *failed = true;
+          break;
+        }
+        batch_size = 0;
+      }
+    }
+  }
+  if (batch) {
+    batch->item_destroyer = NULL;
+    array_list_delete(batch);
+  }
+  return first;
+}
+
+/* Scan one root-directory entry into either the subdirs or files list. */
+static void scan_root_entry(const ScannerOptions* options, const FilterNode* root_node,
+                            const char* root_directory, const struct dirent* entry,
+                            ArrayList* root_files, ArrayList* subdirs, dev_t root_dev,
+                            ParallelScanner* ps) {
+  ScannerEntry inspected;
+  int inspection =
+      scanner_inspect_entry(options, root_directory, entry->d_name, entry->d_name, &inspected);
+  if (inspection < 0) {
+    ps->failed = true;
+    return;
+  }
+  if (inspection == 0) {
+    if (inspected.referent_error)
+      ps->io_error = true;
+    ArrayList* sink = NULL;
+    if (inspected.excluded)
+      sink = inspected.size_excluded ? options->size_skipped_paths : options->excluded_paths;
+    if (sink) {
+      /* A root-level prune protects the destination mirror of the entry's wire
+         path: under -R + --files-from that is the bare relative name, otherwise
+         it is the full source path with a leading '/' removed (matching the
+         send_path/file_wire_path the scanner hands the sender). */
+      if (options->relative && options->file_list != NULL) {
+        if (!excluded_sink_append(sink, options->excluded_mutex, entry->d_name))
+          ps->failed = true;
+      } else if (options->relative_prefix) {
+        char* wrel = scanner_prefix_send_path(options->relative_prefix, entry->d_name);
+        if (!wrel) {
+          ps->failed = true;
+        } else {
+          if (!excluded_sink_append(sink, options->excluded_mutex, wrel))
+            ps->failed = true;
+          free(wrel);
+        }
+      } else {
+        char* abs_path = path_cat(root_directory, entry->d_name);
+        if (!abs_path) {
+          ps->failed = true;
+        } else {
+          const char* rel = *abs_path == '/' ? abs_path + 1 : abs_path;
+          if (!excluded_sink_append(sink, options->excluded_mutex, rel))
+            ps->failed = true;
+          free(abs_path);
+        }
+      }
+    }
+    return;
+  }
+  char* cur_path = inspected.path;
+  struct stat st = inspected.stats;
+  bool is_dir = inspected.is_directory;
+  char* rel = str_dup(entry->d_name);
+  if (!rel) {
+    free(cur_path);
+    ps->failed = true;
+    return;
+  }
+  bool protect = false;
+  bool passes = entry_passes_selection(options->file_list, options->base_filters, root_node, rel,
+                                       entry->d_name, is_dir, options->per_dir_filters,
+                                       options->exclude_per_dir_filter_files, &protect);
+  /* -R + --files-from: root-level files keep their bare relative send path. */
+  bool use_rel = options->relative && options->file_list != NULL;
+  if (!passes || protect) {
+    /* --files-from subset pruning is not a filter exclusion; -R bare-wire-path
+       exclusions are never recorded (see ScannerOptions.excluded_paths). */
+    bool files_from_prune = options->file_list && !file_list_affects(options->file_list, rel);
+    if ((!files_from_prune && !use_rel) || protect) {
+      const char* rel_path;
+      char* prefixed = NULL;
+      if (use_rel) {
+        /* -R + --files-from: the destination/wire path is the bare relative
+           name, not the source path. */
+        rel_path = rel;
+      } else if (options->relative_prefix) {
+        prefixed = scanner_prefix_send_path(options->relative_prefix, entry->d_name);
+        if (!prefixed) {
+          free(rel);
+          free(cur_path);
+          ps->failed = true;
+          return;
+        }
+        rel_path = prefixed;
+      } else {
+        rel_path = *cur_path == '/' ? cur_path + 1 : cur_path;
+      }
+      if (options->excluded_paths &&
+          !excluded_sink_append(options->excluded_paths, options->excluded_mutex, rel_path))
+        ps->failed = true;
+      free(prefixed);
+    }
+    if (!passes) {
+      scanner_note_filter(options, entry->d_name);
+      free(rel);
+      free(cur_path);
+      return;
+    }
+  }
+  if (is_dir) {
+    if (!scanner_same_filesystem(options->one_file_system, root_dev, st.st_dev)) {
+      if (options->one_file_system > 1) {
+        /* -xx: drop the mount-point directory entirely (rsync) and print the
+           --info=mount line when enabled. */
+        scanner_note_mount(options, cur_path);
+        free(rel);
+        free(cur_path);
+        return;
+      }
+      /* -x/--one-file-system: emit the mount-point directory entry (empty) but
+         do not descend into it (see the sequential scanner for the same rule). */
+      File* mount = file_create(cur_path);
+      free(cur_path);
+      if (mount == NULL) {
+        free(rel);
+        ps->failed = true;
+        return;
+      }
+      mount->is_dir = true;
+      if (options->use_metadata) {
+        mount->metadata = file_metadata_create(mount->path, &st, options->preserve_atimes,
+                                               options->preserve_crtimes);
+        if (!mount->metadata) {
+          free(rel);
+          file_destroy(mount);
+          ps->failed = true;
+          return;
+        }
+      }
+      if (options->relative_prefix) {
+        mount->send_path = scanner_prefix_send_path(options->relative_prefix, rel);
+        if (!mount->send_path) {
+          free(rel);
+          file_destroy(mount);
+          ps->failed = true;
+          return;
+        }
+      }
+      free(rel);
+      if (!array_list_add(root_files, mount)) {
+        file_destroy(mount);
+        ps->failed = true;
+      }
+      return;
+    }
+    free(rel);
+    if (!array_list_add(subdirs, cur_path)) {
+      free(cur_path);
+      ps->failed = true;
+    }
+    return;
+  }
+  File* file = file_create(cur_path);
+  free(cur_path);
+  if (!file) {
+    free(rel);
+    free(inspected.link_target);
+    inspected.link_target = NULL;
+    ps->failed = true;
+    return;
+  }
+  if (inspected.is_symlink) {
+    file->is_symlink = true;
+    file->symlink_target = inspected.link_target;
+    inspected.link_target = NULL;
+  } else {
+    file->data->size = st.st_size;
+  }
+  if (use_rel) {
+    file->send_path = rel;
+    rel = NULL;
+  } else if (options->relative_prefix) {
+    file->send_path = scanner_prefix_send_path(options->relative_prefix, rel);
+    free(rel);
+    rel = NULL;
+    if (!file->send_path) {
+      file_destroy(file);
+      ps->failed = true;
+      return;
+    }
+  }
+  ScannerSpecial special = scanner_prepare_special(
+      options->preserve_devices, options->preserve_specials, options->copy_devices, file, &st);
+  if (special == SCANNER_SPECIAL_SKIP) {
+    scanner_note_nonreg(ps->options, file->path);
+    free(rel);
+    file_destroy(file);
+    return;
+  }
+  if (options->hardlinks && S_ISREG(st.st_mode)) {
+    int gid;
+    bool is_first;
+    char* first_path = NULL;
+    if (!hardlink_table_assign((HardLinkTable*)options->hardlinks, file_wire_path(file), st.st_dev,
+                               st.st_ino, &gid, &is_first, &first_path)) {
+      ps->failed = true;
+    } else {
+      file->link_group = gid;
+      file->link_first = is_first;
+      if (!is_first) {
+        file->hardlink_target = first_path;
+        file->data->size = 0;
+      } else {
+        free(first_path);
+      }
+    }
+  }
+  if (options->use_metadata)
+    file->metadata =
+        file_metadata_create(file->path, &st, options->preserve_atimes, options->preserve_crtimes);
+  if (options->use_metadata && !file->metadata) {
+    free(rel);
+    file_destroy(file);
+    ps->failed = true;
+    return;
+  }
+  if ((options->preserve_xattrs || options->preserve_acls) &&
+      !(file->link_group != 0 && !file->link_first))
+    file->xattrs = file->is_symlink
+                       ? xattr_capture_path_nofollow(file->path, options->preserve_acls)
+                       : xattr_capture_path(file->path, options->preserve_acls);
+  if (!array_list_add(root_files, file)) {
+    free(rel);
+    file_destroy(file);
+    ps->failed = true;
+    return;
+  }
+  free(rel);
+}
+
+/* Scan the root directory itself, collecting root files and subdirectories.
+ * Returns false if the root directory could not be opened. */
+static bool scan_root_directory(ParallelScanner* ps, const char* root_directory,
+                                const ScannerOptions* options, const FilterNode* root_node,
+                                dev_t root_dev, ArrayList* root_files, ArrayList* subdirs) {
+  DIR* dir = opendir(root_directory);
+  if (!dir) {
+    log_perror("Could not open root directory for parallel scan");
+    return false;
+  }
+  /* The parallel scanner opens the transfer root directly (not through
+     open_next_directory), so record it as synchronized here. */
+  if (!scanner_record_synced_dir(options, root_directory, "",
+                                 options->relative && options->file_list != NULL)) {
+    closedir(dir);
+    ps->failed = true;
+    return false;
+  }
+  log_debug_message(LOG_DEBUG_FLIST, "flist: scanning %s", root_directory);
+  const struct dirent* entry;
+  while ((entry = readdir(dir)) != NULL) {
+    if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
+      continue;
+    scan_root_entry(options, root_node, root_directory, entry, root_files, subdirs, root_dev, ps);
+  }
+  closedir(dir);
+  return true;
+}
+
+/* Spawn worker threads, one per group of subdirectories. */
+static void spawn_parallel_workers(ParallelScanner* ps, ArrayList* subdirs,
+                                   const ScannerOptions* options, const char* root_directory,
+                                   unsigned long long cs) {
+  if (subdirs->size <= 0)
+    return;
+  int n = options->num_threads > 0 ? options->num_threads : 4;
+  if (n > subdirs->size)
+    n = subdirs->size;
+
+  ps->num_threads = n;
+  ps->expected_threads = n;
+  ps->threads = calloc(n, sizeof(thrd_t));
+  if (!ps->threads) {
+    ps->num_threads = 0;
+    ps->expected_threads = 0;
+    ps->failed = true;
+    return;
+  }
+  int dirs_per_thread = subdirs->size / n;
+  int remainder = subdirs->size % n;
+  int start = 0;
+  ps->num_threads = 0;
+  for (int t = 0; t < n; t++) {
+    int count = dirs_per_thread + (t < remainder ? 1 : 0);
+    if (count == 0)
+      break;
+    ParallelWorkerArg* wa = calloc(1, sizeof(ParallelWorkerArg));
+    if (!wa) {
+      parallel_scanner_creation_failed(ps);
+      break;
+    }
+    wa->ps = ps;
+    wa->dirs = calloc(count, sizeof(char*));
+    wa->root_dir = str_dup(root_directory);
+    if (!wa->dirs || !wa->root_dir) {
+      free(wa->root_dir);
+      free(wa->dirs);
+      free(wa);
+      parallel_scanner_creation_failed(ps);
+      break;
+    }
+    bool dup_ok = true;
+    for (int j = 0; j < count; j++) {
+      wa->dirs[j] = str_dup((char*)subdirs->items[start + j]);
+      if (!wa->dirs[j])
+        dup_ok = false;
+    }
+    if (!dup_ok) {
+      for (int j = 0; j < count; j++)
+        free(wa->dirs[j]);
+      free(wa->root_dir);
+      free(wa->dirs);
+      free(wa);
+      parallel_scanner_creation_failed(ps);
+      break;
+    }
+    wa->dir_count = count;
+    wa->options = *options;
+    wa->options.chunk_size = cs;
+    wa->allocation_session = ps->allocation_session;
+    start += count;
+    if (thrd_create(&ps->threads[t], parallel_worker_thread, wa) != thrd_success) {
+      for (int j = 0; j < count; j++)
+        free(wa->dirs[j]);
+      free(wa->root_dir);
+      free(wa->dirs);
+      free(wa);
+      parallel_scanner_creation_failed(ps);
+      break;
+    }
+    ps->num_threads++;
+    ps->created_threads++;
+  }
+}
+
+ParallelScanner* parallel_scanner_create_with_options(const char* root_directory,
+                                                      const ScannerOptions* options,
+                                                      ProtocolSession* allocation_session) {
+  if (!root_directory || !options)
+    return NULL;
+  ParallelScanner* ps = calloc(1, sizeof(ParallelScanner));
+  if (!ps)
+    return NULL;
+  if (!parallel_scanner_init(ps)) {
+    free(ps);
+    return NULL;
+  }
+  ps->allocation_session = allocation_session;
+  ps->options = options;
+
+  ArrayList* root_files = array_list_create(file_destroy);
+  ArrayList* subdirs = array_list_create(free);
+  if (!root_files || !subdirs) {
+    array_list_delete(root_files);
+    array_list_delete(subdirs);
+    parallel_scanner_destroy(ps);
+    return NULL;
+  }
+
+  dev_t root_dev = 0;
+  if (options->one_file_system) {
+    struct stat root_stats;
+    if (stat(root_directory, &root_stats) != 0) {
+      log_perror("Could not stat source directory");
+      array_list_delete(root_files);
+      array_list_delete(subdirs);
+      parallel_scanner_destroy(ps);
+      return NULL;
+    }
+    root_dev = root_stats.st_dev;
+  }
+
+  /* Build the root directory's per-directory filter context once; workers seed
+   * their scanners with it so per-dir rules behave identically to the sequential
+   * scanner. */
+  FilterNode* root_node = NULL;
+  {
+    char err[256];
+    bool any_exists = false;
+    FilterRuleList* own =
+        read_dir_filters(options, root_directory, "", &any_exists, err, sizeof(err));
+    if (!own) {
+      /* A parse/allocation failure must fail the scan even when an earlier
+         merge file in the same directory existed (see the sequential scanner). */
+      if (err[0] != '\0') {
+        log_message(LOG_LEVEL_ERROR, "invalid per-directory filter in %s: %s", root_directory, err);
+        array_list_delete(root_files);
+        array_list_delete(subdirs);
+        parallel_scanner_destroy(ps);
+        return NULL;
+      }
+      /* no files exist: leave root_node NULL */
+    } else if (any_exists && (own->count > 0 || own->dir_merge_count > 0)) {
+      root_node = filter_node_alloc(NULL, own);
+      if (!root_node) {
+        filter_rule_list_free(own);
+        array_list_delete(root_files);
+        array_list_delete(subdirs);
+        parallel_scanner_destroy(ps);
+        return NULL;
+      }
+    } else {
+      filter_rule_list_free(own);
+    }
+  }
+  ps->root_filter_node = root_node;
+
+  if (!scan_root_directory(ps, root_directory, options, root_node, root_dev, root_files, subdirs)) {
+    array_list_delete(root_files);
+    array_list_delete(subdirs);
+    parallel_scanner_destroy(ps);
+    return NULL;
+  }
+  /* The root itself is a traversed directory (rsync counts it in
+     `Number of files`); the worker DirectoryScanners account for every
+     subdirectory below it. */
+  scanner_dir_count_count(options);
+  /* P7 Wave D: the parallel scanner never runs a DirectoryScanner over the
+     transfer root itself (it hands the root's immediate subdirectories to
+     workers), so capture the root's directory time here. */
+  if (options->capture_dir_times &&
+      !scanner_capture_dir_time(
+          options->dir_entries, options->dir_entries_mutex, root_directory, root_directory,
+          options->relative && options->file_list != NULL, options->relative_prefix,
+          options->preserve_atimes, options->preserve_crtimes, options->preserve_xattrs,
+          options->preserve_acls, options->no_implied_dirs, options->file_list)) {
+    array_list_delete(root_files);
+    array_list_delete(subdirs);
+    parallel_scanner_destroy(ps);
+    return NULL;
+  }
+
+  unsigned long long cs = options->chunk_size > 0 ? options->chunk_size : DESIRED_CHUNK_SIZE;
+  ps->initial_chunk = batch_files(root_files, cs, ps->result_queue, &ps->failed);
+  array_list_delete(root_files);
+
+  spawn_parallel_workers(ps, subdirs, options, root_directory, cs);
+  array_list_delete(subdirs);
+  return ps;
+}
+
+Chunk* parallel_scanner_next(ParallelScanner* ps) {
+  if (ps->initial_chunk) {
+    Chunk* c = ps->initial_chunk;
+    ps->initial_chunk = NULL;
+    return c;
+  }
+  if (ps->num_threads == 0) {
+    mtx_lock(&ps->result_mutex);
+    if (!queue_is_empty(ps->result_queue)) {
+      Chunk* chunk = queue_dequeue(ps->result_queue);
+      mtx_unlock(&ps->result_mutex);
+      return chunk;
+    }
+    ps->done = true;
+    mtx_unlock(&ps->result_mutex);
+    return NULL;
+  }
+  Chunk* chunk = queue_dequeue_multithreaded(
+      ps->result_queue, &ps->result_mutex, &ps->result_not_empty, &ps->result_not_full, &ps->done);
+  return chunk;
+}
+
+bool parallel_scanner_failed(const ParallelScanner* ps) {
+  return ps == NULL || ps->failed;
+}
+
+bool parallel_scanner_had_io_error(const ParallelScanner* ps) {
+  return ps != NULL && ps->io_error;
+}
+
+void parallel_scanner_destroy(ParallelScanner* ps) {
+  if (!ps)
+    return;
+  mtx_lock(&ps->result_mutex);
+  ps->done = true;
+  atomic_store(&ps->cancelled, true);
+  cnd_broadcast(&ps->result_not_empty);
+  cnd_broadcast(&ps->result_not_full);
+  mtx_unlock(&ps->result_mutex);
+  for (int i = 0; i < ps->num_threads; i++)
+    thrd_join(ps->threads[i], NULL);
+  free(ps->threads);
+  if (ps->root_filter_node)
+    filter_node_destroy(ps->root_filter_node);
+  if (ps->initial_chunk)
+    chunk_destroy(ps->initial_chunk);
+  queue_destroy(ps->result_queue);
+  mtx_destroy(&ps->result_mutex);
+  cnd_destroy(&ps->result_not_empty);
+  cnd_destroy(&ps->result_not_full);
+  free(ps);
+}
@@ -19,11 +19,16 @@ void print_usage(void) {
  printf("\n");
  printf("Options:\n");
  printf("  -c, --checksum      Verify content by checksum instead of size+mtime\n");
-  printf("  -z, --compress [level]  Enable compression (level 1-22, default 5)\n");
+  printf("  -z, --compress [level]  Enable compression.  The default level is\n");
+  printf("                      per-codec: zstd 3 (range 1-22), zlib/zlibx 6, lz4\n");
+  printf("                      ignores the level\n");
  printf("  -a, --archive       rsync archive mode (-rlptgoD): links, perms, times,\n");
  printf("                      owner, group, devices and specials; not\n");
  printf("                      compression/multithreading\n");
  printf("  -r, --recursive     Recurse into directories (FastSync is always recursive)\n");
+  printf("  --inc-recursive     Accepted for rsync CLI compatibility; no effect (FastSync\n");
+  printf("                      always performs a full scan, so the destination is identical)\n");
+  printf("  --no-inc-recursive  Accepted for rsync CLI compatibility; no effect\n");
  printf("  -n, --dry-run       Show what would be transferred\n");
  printf("  --remove-source-files  Remove regular source files after successful transfer\n");
  printf("  -p, --perms         Preserve permission bits\n");
@@ -36,8 +41,8 @@ void print_usage(void) {
  printf("                      arguments, e.g. -e \"ssh -p 2222\"\n");
  printf("  --rsync-path <path>  Alias for --fastsync-server-path (path to the\n");
  printf("                      fastsync server binary on the remote side)\n");
-  printf("  --blocking-io        Leave the SSH transport socket without read/write\n");
-  printf("                      timeouts so it blocks naturally\n");
+  printf("  --blocking-io        SSH transport only: leave the socket without read/write\n");
+  printf("                      timeouts so it blocks naturally (no effect on TCP)\n");
  printf("  --outbuf=MODE        stdout/stderr buffering: N (none/unbuffered),\n");
  printf("                      L (line-buffered), or B (block-buffered, default)\n");
  printf("  --progress          Show transfer progress\n");
@@ -49,6 +54,7 @@ void print_usage(void) {
  printf("                      converted before transmission and back on receipt; a\n");
  printf("                      name that cannot be represented in the target charset\n");
  printf("                      fails that transfer cleanly (rsync-compatible)\n");
+  printf("  --no-iconv          Disable --iconv charset conversion (same as --iconv=-)\n");
  printf("  --protocol=NUM       Force the wire protocol version (must equal the current\n");
  printf("                       PROTOCOL_VERSION; FastSync cannot speak older/virtual\n");
  printf("                       wire formats)\n");
@@ -162,7 +168,7 @@ void print_usage(void) {
  printf("                    --no-delta, or --no-incremental)\n");
  printf("  --no-fuzzy          Disable --fuzzy\n");
  printf("  -B <n>, --block-size <n>, --delta-block <n>\n");
-  printf("                    Delta block size in bytes (default: %d)\n", DELTA_BLOCK_SIZE_DEFAULT);
+  printf("                    Delta block size in bytes (default: %u)\n", DELTA_BLOCK_SIZE_DEFAULT);
  printf("  --delta-max <n>     Max file size for delta transfer (default: %llu)\n",
         DELTA_MAX_FILE_SIZE);
  printf("  -j, --threads[=N]   Enable the multithreaded scanner/loader/sender\n");
@@ -192,16 +198,21 @@ void print_usage(void) {
  printf("  -U, --atimes        Preserve access times\n");
  printf("  -N, --crtimes       Capture birth time; cannot be applied (documented\n");
  printf("                      divergence)\n");
+  printf("  -O, --omit-dir-times  Do not apply modification times to directories\n");
+  printf("  -J, --omit-link-times Do not apply times to symlinks\n");
+  printf("  --open-noatime      Open source files with O_NOATIME so reading for a\n");
+  printf("                      transfer does not update their access time\n");
  printf("  -X, --xattrs        Preserve user extended attributes (user.* only;\n");
  printf("                      privileged security.*/trusted.* namespaces are\n");
  printf("                      never captured or applied)\n");
  printf("  -A, --acls          Preserve POSIX ACLs (the system.posix_acl_* xattrs;\n");
  printf("                      setting an ACL the receiver is not permitted to\n");
  printf("                      set is warned and skipped, never fatal)\n");
-  printf("  --fake-super        Store the source uid/gid/mode/mtime in a reserved\n");
-  printf("                      user.fastsync.stat xattr on each written file and\n");
-  printf("                      re-apply it (fd-relative) on a privileged run; the\n");
-  printf("                      recording format diverges from rsync's user.rsync.%%stat%%\n");
+  printf("  --fake-super        Store the source mode/rdev/uid/gid in rsync's\n");
+  printf("                      reserved user.rsync.%%stat xattr on each written\n");
+  printf("                      file (interoperable with rsync); it never performs a\n");
+  printf("                      real chown, so an unprivileged receiver records the\n");
+  printf("                      privileged stat for a later restore\n");
  printf("  --super             Permit the receiver to attempt super-user activities\n");
  printf("                      (char/block device-node creation, --write-devices)\n");
  printf("                      within the confined receive root.  Never elevates\n");
@@ -287,8 +298,12 @@ void print_usage(void) {
  printf("  -x, --one-file-system  Do not cross filesystem boundaries\n");
  printf("  --log-file <path>, --log-file=<path>  Write log messages to file\n");
  printf("  --stderr=MODE       Route logging to stderr: errors or all\n");
+  printf("  --msgs2stderr       Route all messages to stderr (deprecated spelling of\n");
+  printf("                      --stderr=all)\n");
+  printf("  --no-msgs2stderr    Select errors-only stderr (deprecated spelling; the\n");
+  printf("                      default)\n");
  printf("  --partial           Keep partial files on interrupted transfer\n");
-  printf("  --partial-dir <dir> Directory for partial files\n");
+  printf("  --partial-dir <dir> Directory for partial files (implies --partial)\n");
  printf("  -T, --temp-dir <dir>  Scratch dir for temp files before atomic install.\n");
  printf("                      Confined to the receive root: a relative dir resolves below\n");
  printf("                      it and an absolute/traversal dir is rejected.  The dir must\n");
@@ -337,7 +352,8 @@ void print_usage(void) {
  printf("  --append-verify     Like --append, but verifies the retained prefix checksum\n");
  printf("                    before appending (falls back to a full transfer on mismatch)\n");
  printf("  --fsync             Fsync every written file before publication\n");
-  printf("  --compress-level <n>    Compression level (default: 5)\n");
+  printf("  --compress-level <n>    Compression level (per-codec default: zstd 3,\n");
+  printf("                      zlib/zlibx 6, lz4 ignores it)\n");
  printf("  --zl <n>             Alias for --compress-level\n");
  printf("  --skip-compress=LIST    Skip compression for suffixes in LIST (separated by\n");
  printf("                      '/' as in rsync, or ','); a leading dot is optional.  The\n");
@@ -349,19 +365,19 @@ void print_usage(void) {
 }

 void print_debug_usage(void) {
-  printf("Emitting debug flags: IO,PROTO,PACK,UTIL,ALL,NONE\n");
+  printf("Emitting debug flags: IO,PROTO,PACK,UTIL,FLIST,DEL,HASH,DELTASUM,\n");
+  printf("RECV,FILTER,SEND,ALL,NONE\n");
  printf("Also accepted for rsync CLI parity (silent): ACL,BACKUP,BIND,CHDIR,\n");
-  printf("CONNECT,CMD,DEL,DELTASUM,DUP,EXIT,FILTER,FLIST,FUZZY,GENR,HASH,HLINK,\n");
-  printf("ICONV,NSTR,OWN,RECV,SEND,TIME.\n");
+  printf("CONNECT,CMD,DUP,EXIT,FUZZY,GENR,HLINK,ICONV,NSTR,OWN,TIME.\n");
  printf("Flags may be comma-separated, for example: --debug=io,proto\n");
  printf("An optional level suffix is accepted (e.g. --debug=io2); level 0\n");
  printf("silences that item.  Unknown names are rejected.\n");
 }

 void print_info_usage(void) {
-  printf("Emitting info flags: COPY,NAME,MISC,SKIP,STATS,ALL,NONE\n");
-  printf("Also accepted for rsync CLI parity (silent): BACKUP,DEL,FLIST,MOUNT,\n");
-  printf("NONREG,PROGRESS,REMOVE,SYMSAFE.\n");
+  printf("Emitting info flags: COPY,MISC,SKIP,STATS,DEL,REMOVE,NAME,FLIST,\n");
+  printf("NONREG,PROGRESS,MOUNT,ALL,NONE\n");
+  printf("Also accepted for rsync CLI parity (silent): BACKUP,SYMS,SYMSAFE.\n");
  printf("Flags may be comma-separated, for example: --info=name,stats\n");
  printf("An optional level suffix is accepted (e.g. --info=stats2); level 0\n");
  printf("silences that item.  Unknown names are rejected.\n");
@@ -53,7 +53,13 @@ bool receiver_send_final_success(int fd, const Config* config, const ReceiverOut
    return send_status(fd, final_status);
  size_t count = outcomes ? outcomes->count : 0;
  for (size_t i = 0; i < count; i++) {
-    Status per_file = outcomes->entries[i] == FILE_SAVE_WRITTEN ? STATUS_NEXT : STATUS_OK;
+    Status per_file;
+    if (outcomes->entries[i] == FILE_SAVE_WRITTEN)
+      per_file = STATUS_NEXT;
+    else if (outcomes->entries[i] == FILE_SAVE_FAILED)
+      per_file = STATUS_ERROR;
+    else
+      per_file = STATUS_OK;
    if (!send_status(fd, per_file))
      return false;
  }
@@ -303,6 +309,264 @@ int receiver_process(Config* config, int file_descriptor, const ReceiverSink* si
  return receiver_process_pending(config, file_descriptor, sink, NULL, NULL);
 }

+/* Per-connection state threaded through the status handlers below.  The parked
+   keep-set / per-directory session live here so one teardown helper can release
+   them on every exit path. */
+typedef struct {
+  Config* config;
+  int fd;
+  const ReceiverSink* sink;
+  DeleteManifest** pending_manifest;
+  DeletePlanSession** pending_plans;
+  /* Parked keep-set for the late/commit timing.  Every exit path frees it
+     exactly once; the only exception is the successful FINISHED handoff, which
+     transfers ownership to *pending_manifest (used by the -m receiver). */
+  DeleteManifest* deferred_manifest;
+  /* Per-directory delete session for --delete-during/--delete-delay.  During the
+     loop it applies plans inline (during) or snapshots their extras (delay); on
+     a successful FINISHED it is either committed here or handed to
+     *pending_plans so the -m caller commits after its disk writer drained. */
+  DeletePlanSession* plan_session;
+  bool early_delete;
+  bool per_dir_delete;
+  bool delete_limit_noted;
+} ReceiverPendingState;
+
+/* Outcome of one frame handler.  NEXT reads the following status frame; FAIL
+   tears the connection down without a peer STATUS_ERROR; ERROR tears it down
+   and (when the sink owns error reporting) emits STATUS_ERROR. */
+typedef enum {
+  RECEIVER_STEP_NEXT,
+  RECEIVER_STEP_FAIL,
+  RECEIVER_STEP_ERROR,
+} ReceiverStep;
+
+static ReceiverStep receiver_handle_keepalive(ReceiverPendingState* state) {
+  if (!send_status(state->fd, STATUS_KEEPALIVE))
+    return RECEIVER_STEP_FAIL;
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_abort(ReceiverPendingState* state) {
+  (void)state;
+  log_message(LOG_LEVEL_INFO, "Received abort from client, cleaning up");
+  return RECEIVER_STEP_FAIL;
+}
+
+static ReceiverStep receiver_handle_check(ReceiverPendingState* state) {
+  bool skipped = false;
+  bool would_transfer = false;
+  File* file = receive_incremental_check_ex(state->fd, state->config, &skipped, &would_transfer);
+  if (state->config->dry_run) {
+    /* Server-contacting --dry-run: the reply has already been sent
+       (STATUS_OK = up to date, STATUS_DRY_RUN_TRANSFER = would transfer) and
+       nothing may be stored.  Both flags false means a genuine protocol
+       error (STATUS_ERROR already sent or sent by receive_error below). */
+    if (!skipped && !would_transfer)
+      return RECEIVER_STEP_ERROR;
+  } else if (!skipped && (!file || !state->sink->store_file(file, state->sink->context))) {
+    return RECEIVER_STEP_ERROR;
+  }
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_chunk(ReceiverPendingState* state) {
+  Chunk* chunk = receive_chunk_data(state->fd, state->config);
+  if (!chunk || !receiver_process_chunk(chunk, state->sink))
+    return RECEIVER_STEP_ERROR;
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_check_batch(ReceiverPendingState* state) {
+  if (!receiver_process_batch(state->config, state->fd))
+    return RECEIVER_STEP_FAIL;
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_mkdir(ReceiverPendingState* state) {
+  File* dir = file_receive_directory(state->fd, state->config);
+  if (!dir || !state->sink->store_file(dir, state->sink->context))
+    return RECEIVER_STEP_ERROR;
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_dir_times(const ReceiverPendingState* state) {
+  if (!receiver_process_dir_times(state->fd, state->config, state->sink))
+    return RECEIVER_STEP_ERROR;
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_hardlink(ReceiverPendingState* state) {
+  File* file = file_receive_hardlink(state->fd);
+  if (!file || !state->sink->store_file(file, state->sink->context))
+    return RECEIVER_STEP_ERROR;
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_symlink(ReceiverPendingState* state) {
+  File* sym = file_receive_symlink(state->fd, state->config);
+  if (!sym || !state->sink->store_file(sym, state->sink->context))
+    return RECEIVER_STEP_ERROR;
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_special(ReceiverPendingState* state) {
+  File* file = file_receive_special(state->fd);
+  if (!file || !state->sink->store_file(file, state->sink->context))
+    return RECEIVER_STEP_ERROR;
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_manifest(ReceiverPendingState* state) {
+  Config* config = state->config;
+  int fd = state->fd;
+  const ReceiverSink* sink = state->sink;
+  DeleteManifest* manifest = receive_manifest_entries(fd);
+  if (!manifest)
+    return RECEIVER_STEP_FAIL; /* receive_manifest_entries already sent STATUS_ERROR */
+  if (config->dry_run) {
+    /* Server-contacting --dry-run mutates nothing, so a keep-set manifest
+       is consumed and discarded.  The early-delete mode still needs its ACK
+       so a sender blocked on the delete handshake is not left hanging.
+       When would-delete reporting is armed, enumerate (read-only) the
+       destination extras so the terminal STATUS_STATS frame can list them. */
+    if (config->use_delete && sink->would_delete) {
+      size_t count = 0;
+      if (!manifest_would_delete_list(config, manifest, sink->would_delete, &count))
+        log_message(LOG_LEVEL_WARNING, "dry-run: could not enumerate would-delete paths");
+    }
+    delete_manifest_free(manifest);
+    if (state->early_delete && !send_status(fd, STATUS_OK))
+      return RECEIVER_STEP_FAIL;
+    return RECEIVER_STEP_NEXT;
+  }
+  if (state->early_delete) {
+    /* --delete-before: the whole-tree manifest is authoritative the moment
+       it arrives, before any file data.  Delete now and acknowledge so the
+       sender only starts streaming once the deletion committed (or failed).
+       A later transfer failure does not restore these deletions.  A
+       --max-delete-capped commit still succeeds and the transfer proceeds;
+       the terminal success frame reports the cap. */
+    size_t deleted = 0;
+    DeletePathObserver observer =
+        (config->report_deletes && sink->deleted_paths) ? receiver_record_deleted_path : NULL;
+    DeleteCommitResult deletion =
+        (config->use_delete || config->delete_missing_args)
+            ? manifest_delete_all_observed(config, manifest, &deleted, observer,
+                                           (void*)sink->deleted_paths)
+            : DELETE_COMMIT_OK;
+    receiver_tally_deleted(sink, deleted);
+    delete_manifest_free(manifest);
+    if (deletion == DELETE_COMMIT_ERROR) {
+      send_status(fd, STATUS_ERROR);
+      return RECEIVER_STEP_FAIL;
+    }
+    if (deletion == DELETE_COMMIT_LIMIT_REACHED && sink->note_delete_limit)
+      sink->note_delete_limit(sink->context);
+    if (!send_status(fd, STATUS_OK))
+      return RECEIVER_STEP_FAIL;
+  } else if (config->use_delete || config->delete_missing_args) {
+    /* Plain --delete / --delete-after and the --delete-missing-args
+       exact-path deletions: hold the manifest and commit it only after
+       STATUS_FINISHED.  The per-directory modes never send this frame. */
+    if (state->deferred_manifest) {
+      log_message(LOG_LEVEL_ERROR, "Received a second delete manifest");
+      delete_manifest_free(state->deferred_manifest);
+      state->deferred_manifest = NULL;
+      delete_manifest_free(manifest);
+      send_status(fd, STATUS_ERROR);
+      return RECEIVER_STEP_FAIL;
+    }
+    state->deferred_manifest = manifest;
+  } else {
+    delete_manifest_free(manifest);
+  }
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_delete_plan(ReceiverPendingState* state) {
+  Config* config = state->config;
+  int fd = state->fd;
+  const ReceiverSink* sink = state->sink;
+  if (!state->per_dir_delete) {
+    log_message(LOG_LEVEL_ERROR, "Received a per-directory delete plan without a per-dir "
+                                 "delete timing");
+    send_status(fd, STATUS_ERROR);
+    return RECEIVER_STEP_FAIL;
+  }
+  if (!state->plan_session) {
+    state->plan_session = delete_plan_session_create(config);
+    if (state->plan_session && config->report_deletes && sink->deleted_paths)
+      delete_plan_session_set_delete_observer(state->plan_session, receiver_record_deleted_path,
+                                              (void*)sink->deleted_paths);
+  }
+  if (!state->plan_session || delete_plan_session_receive(state->plan_session, config, fd) != 0)
+    return RECEIVER_STEP_FAIL;
+  if (delete_plan_session_limit_reached(state->plan_session) && !state->delete_limit_noted &&
+      sink->note_delete_limit) {
+    sink->note_delete_limit(sink->context);
+    state->delete_limit_noted = true;
+  }
+  return RECEIVER_STEP_NEXT;
+}
+
+static ReceiverStep receiver_handle_file(ReceiverPendingState* state) {
+  File* file = file_receive(state->config, state->fd);
+  if (!file) {
+    log_message(LOG_LEVEL_ERROR, "Failed to receive file");
+    return RECEIVER_STEP_ERROR;
+  }
+  if (!state->sink->store_file(file, state->sink->context))
+    return RECEIVER_STEP_ERROR;
+  return RECEIVER_STEP_NEXT;
+}
+
+/* One dispatch per admitted frame type; STATUS_NEXT (and any other
+   data-bearing status) falls through to the regular file receiver. */
+static ReceiverStep receiver_dispatch_status(ReceiverPendingState* state, Status status) {
+  switch (status) {
+  case STATUS_KEEPALIVE:
+    return receiver_handle_keepalive(state);
+  case STATUS_ABORT:
+    return receiver_handle_abort(state);
+  case STATUS_CHECK:
+    return receiver_handle_check(state);
+  case STATUS_CHUNK:
+    return receiver_handle_chunk(state);
+  case STATUS_CHECK_BATCH:
+    return receiver_handle_check_batch(state);
+  case STATUS_MKDIR:
+    return receiver_handle_mkdir(state);
+  case STATUS_DIR_TIMES:
+    return receiver_handle_dir_times(state);
+  case STATUS_HARDLINK:
+    return receiver_handle_hardlink(state);
+  case STATUS_SYMLINK:
+    return receiver_handle_symlink(state);
+  case STATUS_SPECIAL:
+    return receiver_handle_special(state);
+  case STATUS_MANIFEST:
+    return receiver_handle_manifest(state);
+  case STATUS_DELETE_PLAN:
+    return receiver_handle_delete_plan(state);
+  default:
+    return receiver_handle_file(state);
+  }
+}
+
+/* Release the parked keep-set / per-directory session exactly once on every
+   failure exit.  Never commit a deletion for a failed stream. */
+static void receiver_drop_pending(ReceiverPendingState* state) {
+  if (state->deferred_manifest) {
+    delete_manifest_free(state->deferred_manifest);
+    state->deferred_manifest = NULL;
+  }
+  if (state->plan_session) {
+    delete_plan_session_destroy(state->plan_session);
+    state->plan_session = NULL;
+  }
+}
+
 /* Runs the whole receive loop.  The delete manifest may legitimately arrive
   either FIRST (--delete-before / --delete-during: the sender transmits the
   validated keep-set before any file data) or LAST (--delete-after /
@@ -312,9 +576,9 @@ int receiver_process(Config* config, int file_descriptor, const ReceiverSink* si
   deletion has committed (or failed); in the late modes the manifest is held
   and the deletion is committed only after the terminal STATUS_FINISHED proves
   the whole transfer succeeded.  A plain --delete defaults to the per-directory
-   delete-during plan mode (no manifest at all).  See
-   receiver_process_pending() for how the -m receiver defers that commit until
-   its disk writer has drained. */
+   delete-during plan mode (no manifest at all).  See the per-frame handlers
+   above for how the -m receiver defers that commit until its disk writer has
+   drained. */
 int receiver_process_pending(Config* config, int file_descriptor, const ReceiverSink* sink,
                             DeleteManifest** pending_manifest, DeletePlanSession** pending_plans) {
  Status status;
@@ -329,166 +593,29 @@ int receiver_process_pending(Config* config, int file_descriptor, const Receiver
  last_progress = session_start;
  if (!receiver_note_status(&session_start, &last_progress, status, file_descriptor, sink))
    return -1;
-  bool early_delete = config_delete_timing_early(config);
-  bool per_dir_delete = config_delete_timing_per_dir(config);
-  /* Parked keep-set for the late/commit timing.  Every exit path below frees it
-     exactly once; the only exception is the successful FINISHED handoff, which
-     transfers ownership to *pending_manifest (used by the -m receiver). */
-  DeleteManifest* deferred_manifest = NULL;
-  /* Per-directory delete session for --delete-during/--delete-delay.  During the
-     loop it applies plans inline (during) or snapshots their extras (delay); on
-     a successful FINISHED it is either committed here or handed to
-     *pending_plans so the -m caller commits after its disk writer drained. */
-  DeletePlanSession* plan_session = NULL;
-  bool delete_limit_noted = false;
+  ReceiverPendingState state = {
+      .config = config,
+      .fd = file_descriptor,
+      .sink = sink,
+      .pending_manifest = pending_manifest,
+      .pending_plans = pending_plans,
+      .deferred_manifest = NULL,
+      .plan_session = NULL,
+      .early_delete = config_delete_timing_early(config),
+      .per_dir_delete = config_delete_timing_per_dir(config),
+      .delete_limit_noted = false,
+  };
+  bool notify_peer = false;
  while (status == STATUS_NEXT || status == STATUS_CHUNK || status == STATUS_CHECK ||
         status == STATUS_KEEPALIVE || status == STATUS_ABORT || status == STATUS_CHECK_BATCH ||
         status == STATUS_MKDIR || status == STATUS_MANIFEST || status == STATUS_HARDLINK ||
         status == STATUS_SYMLINK || status == STATUS_SPECIAL || status == STATUS_DIR_TIMES ||
         status == STATUS_DELETE_PLAN) {
-    if (status == STATUS_KEEPALIVE) {
-      if (!send_status(file_descriptor, STATUS_KEEPALIVE))
-        goto fail;
-      goto next_status;
-    }
-    if (status == STATUS_ABORT) {
-      log_message(LOG_LEVEL_INFO, "Received abort from client, cleaning up");
+    ReceiverStep step = receiver_dispatch_status(&state, status);
+    if (step == RECEIVER_STEP_FAIL)
      goto fail;
-    }
-    if (status == STATUS_CHECK) {
-      bool skipped = false;
-      bool would_transfer = false;
-      File* file = receive_incremental_check_ex(file_descriptor, config, &skipped, &would_transfer);
-      if (config->dry_run) {
-        /* Server-contacting --dry-run: the reply has already been sent
-           (STATUS_OK = up to date, STATUS_DRY_RUN_TRANSFER = would transfer) and
-           nothing may be stored.  Both flags false means a genuine protocol
-           error (STATUS_ERROR already sent or sent by receive_error below). */
-        if (!skipped && !would_transfer)
-          goto receive_error;
-      } else if (!skipped && (!file || !sink->store_file(file, sink->context))) {
-        goto receive_error;
-      }
-    } else if (status == STATUS_CHUNK) {
-      Chunk* chunk = receive_chunk_data(file_descriptor, config);
-      if (!chunk || !receiver_process_chunk(chunk, sink))
-        goto receive_error;
-    } else if (status == STATUS_CHECK_BATCH) {
-      if (!receiver_process_batch(config, file_descriptor))
-        goto fail;
-      goto next_status;
-    } else if (status == STATUS_MKDIR) {
-      File* dir = file_receive_directory(file_descriptor, config);
-      if (!dir || !sink->store_file(dir, sink->context))
-        goto receive_error;
-    } else if (status == STATUS_DIR_TIMES) {
-      if (!receiver_process_dir_times(file_descriptor, config, sink))
-        goto receive_error;
-    } else if (status == STATUS_HARDLINK) {
-      File* file = file_receive_hardlink(file_descriptor);
-      if (!file || !sink->store_file(file, sink->context))
-        goto receive_error;
-    } else if (status == STATUS_SYMLINK) {
-      File* sym = file_receive_symlink(file_descriptor, config);
-      if (!sym || !sink->store_file(sym, sink->context))
-        goto receive_error;
-    } else if (status == STATUS_SPECIAL) {
-      File* file = file_receive_special(file_descriptor);
-      if (!file || !sink->store_file(file, sink->context))
-        goto receive_error;
-    } else if (status == STATUS_MANIFEST) {
-      DeleteManifest* manifest = receive_manifest_entries(file_descriptor);
-      if (!manifest)
-        goto fail; /* receive_manifest_entries already sent STATUS_ERROR */
-      if (config->dry_run) {
-        /* Server-contacting --dry-run mutates nothing, so a keep-set manifest
-           is consumed and discarded.  The early-delete mode still needs its ACK
-           so a sender blocked on the delete handshake is not left hanging.
-           When would-delete reporting is armed, enumerate (read-only) the
-           destination extras so the terminal STATUS_STATS frame can list them. */
-        if (config->use_delete && sink->would_delete) {
-          size_t count = 0;
-          if (!manifest_would_delete_list(config, manifest, sink->would_delete, &count))
-            log_message(LOG_LEVEL_WARNING, "dry-run: could not enumerate would-delete paths");
-        }
-        delete_manifest_free(manifest);
-        if (early_delete && !send_status(file_descriptor, STATUS_OK))
-          goto fail;
-        goto next_status;
-      }
-      if (early_delete) {
-        /* --delete-before: the whole-tree manifest is authoritative the moment
-           it arrives, before any file data.  Delete now and acknowledge so the
-           sender only starts streaming once the deletion committed (or failed).
-           A later transfer failure does not restore these deletions.  A
-           --max-delete-capped commit still succeeds and the transfer proceeds;
-           the terminal success frame reports the cap. */
-        size_t deleted = 0;
-        DeletePathObserver observer =
-            (config->report_deletes && sink->deleted_paths) ? receiver_record_deleted_path : NULL;
-        DeleteCommitResult deletion =
-            (config->use_delete || config->delete_missing_args)
-                ? manifest_delete_all_observed(config, manifest, &deleted, observer,
-                                               (void*)sink->deleted_paths)
-                : DELETE_COMMIT_OK;
-        receiver_tally_deleted(sink, deleted);
-        delete_manifest_free(manifest);
-        if (deletion == DELETE_COMMIT_ERROR) {
-          send_status(file_descriptor, STATUS_ERROR);
-          goto fail;
-        }
-        if (deletion == DELETE_COMMIT_LIMIT_REACHED && sink->note_delete_limit)
-          sink->note_delete_limit(sink->context);
-        if (!send_status(file_descriptor, STATUS_OK))
-          goto fail;
-      } else if (config->use_delete || config->delete_missing_args) {
-        /* Plain --delete / --delete-after and the --delete-missing-args
-           exact-path deletions: hold the manifest and commit it only after
-           STATUS_FINISHED.  The per-directory modes never send this frame. */
-        if (deferred_manifest) {
-          log_message(LOG_LEVEL_ERROR, "Received a second delete manifest");
-          delete_manifest_free(deferred_manifest);
-          deferred_manifest = NULL;
-          delete_manifest_free(manifest);
-          send_status(file_descriptor, STATUS_ERROR);
-          goto fail;
-        }
-        deferred_manifest = manifest;
-      } else {
-        delete_manifest_free(manifest);
-      }
-      goto next_status;
-    } else if (status == STATUS_DELETE_PLAN) {
-      if (!per_dir_delete) {
-        log_message(LOG_LEVEL_ERROR, "Received a per-directory delete plan without a per-dir "
-                                     "delete timing");
-        send_status(file_descriptor, STATUS_ERROR);
-        goto fail;
-      }
-      if (!plan_session) {
-        plan_session = delete_plan_session_create(config);
-        if (plan_session && config->report_deletes && sink->deleted_paths)
-          delete_plan_session_set_delete_observer(plan_session, receiver_record_deleted_path,
-                                                  (void*)sink->deleted_paths);
-      }
-      if (!plan_session || delete_plan_session_receive(plan_session, config, file_descriptor) != 0)
-        goto fail;
-      if (delete_plan_session_limit_reached(plan_session) && !delete_limit_noted &&
-          sink->note_delete_limit) {
-        sink->note_delete_limit(sink->context);
-        delete_limit_noted = true;
-      }
-      goto next_status;
-    } else {
-      File* file = file_receive(config, file_descriptor);
-      if (!file) {
-        log_message(LOG_LEVEL_ERROR, "Failed to receive file");
-        goto receive_error;
-      }
-      if (!sink->store_file(file, sink->context))
-        goto receive_error;
-    }
-  next_status:
+    if (step == RECEIVER_STEP_ERROR)
+      goto receive_error;
    if (!receive_status(file_descriptor, &status))
      goto receive_error;
    if (!receiver_note_status(&session_start, &last_progress, status, file_descriptor, sink))
@@ -507,19 +634,19 @@ int receiver_process_pending(Config* config, int file_descriptor, const Receiver
     disk writer may still be draining; the caller commits after the writer has
     joined so no extra file is removed unless the transfer is known to have
     succeeded. */
-  if (deferred_manifest) {
-    if (pending_manifest) {
-      *pending_manifest = deferred_manifest;
-      deferred_manifest = NULL;
+  if (state.deferred_manifest) {
+    if (state.pending_manifest) {
+      *state.pending_manifest = state.deferred_manifest;
+      state.deferred_manifest = NULL;
    } else {
      size_t deleted = 0;
      DeletePathObserver observer =
          (config->report_deletes && sink->deleted_paths) ? receiver_record_deleted_path : NULL;
      DeleteCommitResult deletion = manifest_delete_all_observed(
-          config, deferred_manifest, &deleted, observer, (void*)sink->deleted_paths);
+          config, state.deferred_manifest, &deleted, observer, (void*)sink->deleted_paths);
      receiver_tally_deleted(sink, deleted);
-      delete_manifest_free(deferred_manifest);
-      deferred_manifest = NULL;
+      delete_manifest_free(state.deferred_manifest);
+      state.deferred_manifest = NULL;
      if (deletion == DELETE_COMMIT_ERROR) {
        send_status(file_descriptor, STATUS_ERROR);
        goto fail;
@@ -533,28 +660,28 @@ int receiver_process_pending(Config* config, int file_descriptor, const Receiver
     nothing yet and applies its decompressed snapshot here.  The -m receiver
     hands the session to its caller instead, which commits after the disk
     writer drained. */
-  if (plan_session) {
+  if (state.plan_session) {
    if (config->report_deletes && sink->deleted_paths)
-      delete_plan_session_set_delete_observer(plan_session, receiver_record_deleted_path,
+      delete_plan_session_set_delete_observer(state.plan_session, receiver_record_deleted_path,
                                              (void*)sink->deleted_paths);
-    if (pending_plans) {
-      *pending_plans = plan_session;
-      plan_session = NULL;
+    if (state.pending_plans) {
+      *state.pending_plans = state.plan_session;
+      state.plan_session = NULL;
    } else if (config->dry_run) {
      /* Central dry-run no-op: never commit a deletion for a -n run. */
-      delete_plan_session_destroy(plan_session);
-      plan_session = NULL;
+      delete_plan_session_destroy(state.plan_session);
+      state.plan_session = NULL;
    } else {
-      DeleteCommitResult deletion = delete_plan_session_commit(plan_session, config);
-      bool limit = delete_plan_session_limit_reached(plan_session);
-      receiver_tally_deleted(sink, delete_plan_session_deleted(plan_session));
-      delete_plan_session_destroy(plan_session);
-      plan_session = NULL;
+      DeleteCommitResult deletion = delete_plan_session_commit(state.plan_session, config);
+      bool limit = delete_plan_session_limit_reached(state.plan_session);
+      receiver_tally_deleted(sink, delete_plan_session_deleted(state.plan_session));
+      delete_plan_session_destroy(state.plan_session);
+      state.plan_session = NULL;
      if (deletion == DELETE_COMMIT_ERROR) {
        send_status(file_descriptor, STATUS_ERROR);
        goto fail;
      }
-      if (limit && !delete_limit_noted && sink->note_delete_limit)
+      if (limit && !state.delete_limit_noted && sink->note_delete_limit)
        sink->note_delete_limit(sink->context);
    }
  }
@@ -568,26 +695,14 @@ int receiver_process_pending(Config* config, int file_descriptor, const Receiver
  }
  return 0;

+receive_error:
+  notify_peer = true;
 fail:
  /* Failure exits that must not (or already did) report a STATUS_ERROR.  The
     parked keep-set/session is dropped: never commit a deletion for a failed
     stream. */
-  if (deferred_manifest) {
-    delete_manifest_free(deferred_manifest);
-    deferred_manifest = NULL;
-  }
-  if (plan_session)
-    delete_plan_session_destroy(plan_session);
-  return -1;
-
-receive_error:
-  if (deferred_manifest) {
-    delete_manifest_free(deferred_manifest);
-    deferred_manifest = NULL;
-  }
-  if (plan_session)
-    delete_plan_session_destroy(plan_session);
-  if (sink->send_error)
+  receiver_drop_pending(&state);
+  if (notify_peer && sink->send_error)
    send_status(file_descriptor, STATUS_ERROR);
  return -1;
 }
@@ -610,6 +725,11 @@ typedef struct {
  ArrayList* would_delete;
  /* --info=del: actually-removed paths collected during the delete commit. */
  ArrayList* deleted_paths;
+  /* Per-run count of entries that failed to materialize without aborting the
+     stream (currently ONLY a --devices mknod EPERM/EACCES).  A nonzero count
+     makes the terminal frame carry a non-OK status so the client exits
+     non-zero, matching rsync's continue-and-exit-partial behavior. */
+  size_t failed_entries;
 } ReceiverSaveContext;

 static bool receiver_save_file(File* file, void* context_pointer) {
@@ -633,6 +753,11 @@ static bool receiver_save_file(File* file, void* context_pointer) {
     count as matched data in the end-of-transfer report. */
  if (result != FILE_SAVE_ERROR && file->matched_bytes > 0)
    context->stats.matched_data += file->matched_bytes;
+  /* --devices parity: a device node the receiver could not mknod (EPERM/EACCES)
+     is counted per-run but does not abort the transfer.  The terminal frame
+     turns a nonzero count into a non-OK status so the client exits non-zero. */
+  if (result == FILE_SAVE_FAILED)
+    context->failed_entries++;
  /* Protocol 2.28.0: receiver-observed literal bytes and the created-entry
     breakdown (regular/dir/link/special) for the `--stats` report. */
  if (result == FILE_SAVE_WRITTEN)
@@ -666,9 +791,25 @@ static void receiver_note_delete_limit(void* context_pointer) {
  context->delete_limit_reached = true;
 }

+/* Terminal status for a run.  A capped --delete limit wins (rsync exit 25);
+   otherwise any per-entry failure (for example an unprivileged --devices
+   mknod) makes the terminal frame non-OK so the client exits non-zero.  rsync
+   reports 23 here; mapping the client's exact exit code to 23 is a separate,
+   pre-existing concern.  A clean run keeps STATUS_OK. */
+static Status receiver_final_status(bool delete_limit_reached, size_t failed_entries) {
+  if (delete_limit_reached)
+    return STATUS_DELETE_LIMIT;
+  return failed_entries > 0 ? STATUS_ERROR : STATUS_OK;
+}
+
 static bool receiver_send_success_frame(int fd, void* context_pointer) {
  ReceiverSaveContext* context = context_pointer;
-  Status final_status = context->delete_limit_reached ? STATUS_DELETE_LIMIT : STATUS_OK;
+  if (context->failed_entries > 0)
+    log_message(LOG_LEVEL_WARNING,
+                "%zu entr%s failed to materialize; continuing (partial transfer)",
+                context->failed_entries, context->failed_entries == 1 ? "y" : "ies");
+  Status final_status =
+      receiver_final_status(context->delete_limit_reached, context->failed_entries);
  if (!receiver_send_stats_frame(fd, context->config, &context->stats, context->would_delete,
                                 context->deleted_paths))
    return false;
@@ -29,6 +29,7 @@ PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue*
  context->deferred_manifest = NULL;
  context->deferred_plans = NULL;
  context->delete_limit_reached = false;
+  context->failed_entries = 0;
  memset(&context->stats, 0, sizeof(context->stats));
  context->would_delete = NULL;
  context->deleted_paths = NULL;
@@ -264,6 +265,13 @@ int write_thread(void* pipeline_context) {
        receiver_stats_note_saved(&context->stats, file, created, created_dirs);
        mtx_unlock(&context->mutex);
      }
+      /* --devices parity: a device node that could not be mknod'ed is counted
+         per-run but does NOT abort the transfer. */
+      if (result == FILE_SAVE_FAILED) {
+        mtx_lock(&context->mutex);
+        context->failed_entries++;
+        mtx_unlock(&context->mutex);
+      }
      if (result == FILE_SAVE_ERROR) {
        file_destroy(file);
        pipeline_context_receiver_note_bytes_released(context, file_bytes);
@@ -64,6 +64,11 @@ typedef struct PipelineContextReceiver {
  /* --info=del actually-removed path list, collected by the deferred delete
     commit in server.c and reported in the STATUS_STATS frame. */
  struct ArrayList* deleted_paths;
+  /* Per-run count of entries that failed to materialize without aborting the
+     stream (currently ONLY a --devices mknod EPERM/EACCES).  write_thread
+     increments it under `mutex`; server.c turns a nonzero count into a non-OK
+     terminal status so the client exits non-zero. */
+  size_t failed_entries;
 } PipelineContextReceiver;

 PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue* queue_receiver,
@@ -226,11 +226,6 @@ static void release_authorization(void) {
    close(root_fd);
 }

-static bool path_is_within(const char* root, const char* path) {
-  size_t n = strlen(root);
-  return strncmp(root, path, n) == 0 && (path[n] == '\0' || path[n] == '/');
-}
-
 /* --mkpath contract: when the client's destination root directory does not
   exist yet on the server side, --mkpath tells the server to create it (and
   any missing leading components) below the authorized root at connection
@@ -710,69 +705,85 @@ static const char* server_module_gate(const Config* config, void* context) {
  return module_gate_install_root(config, module);
 }

-void handler(int file_descriptor) {
-  SSL* ssl = io_get_ssl();
+/* Per-connection state threaded through the handler phase helpers below.  The
+ * fields are a faithful split of the former handler() locals: the protocol
+ * session, the config-frame gate context, the accepted config, the optional
+ * multithreaded pipeline context and the teardown bookkeeping all live here so
+ * the single `done` epilogue in handler() can release them exactly as before. */
+typedef struct ServerSession {
+  int fd;
+  SSL* ssl;
  ProtocolSession session;
-  protocol_session_init(&session, file_descriptor, file_descriptor);
-  protocol_session_set_ssl(&session, ssl);
-  protocol_session_bind(&session);
  ModuleGateContext gate_ctx;
-  gate_ctx.ssl = ssl;
-  gate_ctx.fd = file_descriptor;
-  gate_ctx.super_mode_override = -1;
-  gate_ctx.has_peer_ip = false;
-  gate_ctx.peer_ip[0] = '\0';
-  gate_ctx.is_local = false;
-  /* All teardown state starts empty so the single `done` epilogue is safe to
-   * reach from any error path (including before the config frame arrives). */
-  Config* config = NULL;
-  PipelineContextReceiver* context = NULL;
-  char* joined_destination = NULL;
-  bool charset_ready = false;
-  config = config_receive_with_validate(file_descriptor, server_module_gate, &gate_ctx);
-  if (config == NULL) {
+  Config* config;
+  PipelineContextReceiver* context;
+  char* joined_destination;
+  bool charset_ready;
+} ServerSession;
+
+/* Phase 1 -- config receipt + validation.  Receives the client config frame
+ * through the module gate, applies the super-mode override the gate recorded
+ * exactly once, and installs the per-connection protocol/compression state.
+ * Returns false when the config frame was refused (the gate has already
+ * answered the client); the caller jumps to the shared `done` epilogue. */
+static bool server_accept_config(ServerSession* state) {
+  state->config = config_receive_with_validate(state->fd, server_module_gate, &state->gate_ctx);
+  if (state->config == NULL) {
    log_message(LOG_LEVEL_ERROR, "Failed to receive config");
-    goto done;
+    return false;
  }
  /* Apply the super-mode veto the gate decided on (operator --no-super, or a
   * daemon module without the `client owner = yes` opt-in) exactly once, so
   * every downstream gate (identity_apply_ownership via privilege_super_permitted,
   * device-node creation) sees SUPER_MODE_OFF.  The gate never mutated the
   * received config. */
-  if (gate_ctx.super_mode_override != -1)
-    config->super_mode = (SuperMode)gate_ctx.super_mode_override;
+  if (state->gate_ctx.super_mode_override != -1)
+    state->config->super_mode = (SuperMode)state->gate_ctx.super_mode_override;
  /* Install the codec this connection negotiated before the receiver/writer
   * threads start (the server forks per connection, so the process-global
   * codec is private to this session). */
-  compression_set_algo((CompressionAlgo)config->compression_algo);
+  compression_set_algo((CompressionAlgo)state->config->compression_algo);
  /* If the client requested ownership but the effective super mode forbids it
   * (operator --no-super, a privileged standalone receiver's secure default, or
   * a daemon module without `client owner = yes`), say so ONCE per connection so
   * a successful -a/-o/-g transfer is not mistaken for preserved ownership. */
-  if (config->super_mode == SUPER_MODE_OFF && identity_ownership_requested(config))
+  if (state->config->super_mode == SUPER_MODE_OFF && identity_ownership_requested(state->config))
    log_message(LOG_LEVEL_WARNING,
                "requested ownership will NOT be applied: super-user activities are disabled "
                "for this connection (operator veto, or module without `client owner = yes`)");
-  protocol_set_8_bit_output(config->eight_bit_output);
+  protocol_set_8_bit_output(state->config->eight_bit_output);
  /* Server-side per-message protocol deadline for every frame from here on.
   * `timeout` is not serialized, so this is the server's own config (the server
   * has no --timeout CLI and defaults it to 0).  A client's --timeout tightens
   * only that client's own protocol I/O; the server floors its own deadline at
   * SERVER_IO_TIMEOUT_SEC so a silent peer can never hold a session slot
   * forever (the socket layer gets the same floor at startup). */
-  protocol_session_set_io_timeout(&session, protocol_server_io_timeout_sec(config->timeout));
+  protocol_session_set_io_timeout(&state->session,
+                                  protocol_server_io_timeout_sec(state->config->timeout));
+  return true;
+}
+
+/* Phase 2 -- security gates.  The ORDER here is load-bearing and must not be
+ * merged or reordered: transport/authentication (plaintext refusal, TLS
+ * client-CN verification), then daemon-root confinement (absolute-destination
+ * rejection, traversal + within-authorized-root), then delete/force
+ * authorization -- exactly the sequence the former handler() used.  Returns
+ * false after logging the matching rejection; the caller jumps to the shared
+ * `done` epilogue. */
+static bool server_apply_security_gates(ServerSession* state) {
+  Config* config = state->config;
  const char* authorized_root = utils_get_authorized_root_path();
  if (!authorized_root) {
    log_message(LOG_LEVEL_ERROR, "No server-side destination root configured");
-    goto done;
+    return false;
  }
-  if (!allow_unauthenticated && ssl == NULL) {
+  if (!allow_unauthenticated && state->ssl == NULL) {
    log_message(LOG_LEVEL_ERROR, "Rejected unauthenticated plaintext connection");
-    goto done;
+    return false;
  }
-  if (ssl && required_client_cn && !tls_client_identity_allowed(ssl)) {
+  if (state->ssl && required_client_cn && !tls_client_identity_allowed(state->ssl)) {
    log_message(LOG_LEVEL_ERROR, "Rejected TLS client with unauthorized identity");
-    goto done;
+    return false;
  }
  /* Daemon mode: the module's root is the authorized root (installed by
     server_module_gate), and the client's destination is a MODULE-RELATIVE
@@ -782,27 +793,27 @@ void handler(int file_descriptor) {
  if (g_daemon_conf && config->receive_root_directory && config->receive_root_directory[0] == '/') {
    log_message(LOG_LEVEL_ERROR, "Rejected absolute daemon destination (must be relative to the "
                                 "selected module root)");
-    goto done;
+    return false;
  }
  char* destination = config->receive_root_directory;
  if (destination && destination[0] != '/')
-    joined_destination = path_cat(authorized_root, destination);
-  if (joined_destination)
-    destination = joined_destination;
+    state->joined_destination = path_cat(authorized_root, destination);
+  if (state->joined_destination)
+    destination = state->joined_destination;
  if (!destination || has_path_traversal(destination) ||
-      !path_is_within(authorized_root, destination)) {
+      !path_is_within_root(authorized_root, destination)) {
    log_message(LOG_LEVEL_ERROR, "Rejected destination outside authorized root");
-    free(joined_destination);
-    joined_destination = NULL;
-    goto done;
+    free(state->joined_destination);
+    state->joined_destination = NULL;
+    return false;
  }
-  if (joined_destination) {
+  if (state->joined_destination) {
    free(config->receive_root_directory);
-    config->receive_root_directory = joined_destination;
-    joined_destination = NULL;
+    config->receive_root_directory = state->joined_destination;
+    state->joined_destination = NULL;
  }
  if (!config->receive_root_directory) {
-    goto done;
+    return false;
  }
  config->use_delete = config->use_delete && allow_delete;
  /* --force (receiver-side) is deletion authority too: it lets an incoming
@@ -812,6 +823,18 @@ void handler(int file_descriptor) {
   * --delete-missing-args, so a client cannot use --force to bypass the delete
   * policy. */
  config->force_delete = config->force_delete && allow_delete;
+  return true;
+}
+
+/* Phase 3 -- session preparation.  Installs the negotiated conversion, applies
+ * the remaining deletion policy, materializes the destination root (--mkpath),
+ * creates the --delay-updates staging tree, snapshots the identity policy, and
+ * publishes the --keep-dirlinks/--trust-sender globals and the daemon MOTD.
+ * All of it must happen before any receiver/writer thread is spawned.  Returns
+ * false after logging the matching failure; the caller jumps to the shared
+ * `done` epilogue. */
+static bool server_prepare_session(ServerSession* state) {
+  Config* config = state->config;
  /* --iconv (protocol 2.16.0): install the receiver-side wire->local conversion
     now that the client's full CONVERT_SPEC has been received and validated,
     before any received file name is decoded.  The server's own --iconv (if
@@ -822,14 +845,14 @@ void handler(int file_descriptor) {
    if (!charset_wire_init_receiver(config->iconv_spec, server_iconv_spec)) {
      log_message(LOG_LEVEL_ERROR,
                  "--iconv: unsupported charset conversion requested (LOCAL[,REMOTE])");
-      goto done;
+      return false;
    }
-    charset_ready = true;
+    state->charset_ready = true;
  }
  /* --delete-missing-args deletes destination mirrors receiver-side, so it is
-     deletion and stays gated by the same --allow-delete server policy.  When
-     the server policy is off the flag is inert (the missing entries are still
-     skipped via its implied --ignore-missing-args, but nothing is deleted). */
+   * deletion and stays gated by the same --allow-delete server policy.  When
+   * the server policy is off the flag is inert (the missing entries are still
+   * skipped via its implied --ignore-missing-args, but nothing is deleted). */
  config->delete_missing_args = config->delete_missing_args && allow_delete;
  /* --mkpath: create the destination root (and its missing leading components)
   * before anything else; without it the root must pre-exist.  The precondition
@@ -844,7 +867,7 @@ void handler(int file_descriptor) {
    log_message(LOG_LEVEL_ERROR, "destination root is not available: %s",
                escaped_root ? escaped_root : "<allocation failed>");
    free(escaped_root);
-    goto done;
+    return false;
  }
  /* A --delay-updates transfer stages under a private 0700 directory inside
     the receive root.  Create it up front (wiping leftovers of any previously
@@ -854,7 +877,7 @@ void handler(int file_descriptor) {
    config->delay_context = delay_updates_context_create(config->receive_root_directory);
    if (!config->delay_context || !delay_updates_prepare(config->delay_context)) {
      log_message(LOG_LEVEL_ERROR, "Failed to initialize --delay-updates staging area");
-      goto done;
+      return false;
    }
  }
  /* Preserve the negotiated identity policy for the fd-relative ownership
@@ -864,7 +887,7 @@ void handler(int file_descriptor) {
     rather than silently applying the wrong ownership policy. */
  if (!identity_set_active(config)) {
    log_message(LOG_LEVEL_ERROR, "Failed to activate identity policy");
-    goto done;
+    return false;
  }
  /* Persist the negotiated --keep-dirlinks policy once, here at config-accept,
     before any multithreaded receiver/writer threads are spawned, so the
@@ -892,140 +915,201 @@ void handler(int file_descriptor) {
     Wave C note in config.h). */
  if (g_daemon_conf) {
    char* motd = motd_read_file(g_daemon_conf->global.motd_file);
-    if (!motd_send(file_descriptor, motd ? motd : "")) {
+    if (!motd_send(state->fd, motd ? motd : "")) {
      free(motd);
      log_message(LOG_LEVEL_ERROR, "Failed to send daemon MOTD");
-      goto done;
+      return false;
    }
    free(motd);
  }
-  if (config->use_multithreading) {
-    Queue* q = queue_create(100, file_destroy);
-    if (q == NULL)
-      goto done;
-    context = pipeline_context_receiver_create(config, q, file_descriptor, ssl);
-    if (context == NULL) {
-      queue_destroy(q);
-      goto done;
-    }
-    protocol_session_set_max_alloc(&context->session, config->max_alloc);
-    protocol_session_set_io_timeout(&context->session,
-                                    protocol_server_io_timeout_sec(config->timeout));
-    atomic_store(&context->session.total_allocated_bytes,
-                 atomic_load(&session.total_allocated_bytes));
-    pipeline_context_receiver_set_queue_byte_limit(context, RECEIVER_QUEUE_MAX_BYTES);
-    thrd_t receiver = {0};
-    thrd_t writer = {0};
-    bool receiver_created = thrd_create(&receiver, receive_thread, context) == thrd_success;
-    bool writer_created = false;
-    if (receiver_created)
-      writer_created = thrd_create(&writer, write_thread, context) == thrd_success;
-    if (!receiver_created || !writer_created) {
-      log_perror("Error creating Threads");
-      if (receiver_created) {
-        mtx_lock(&context->mutex);
-        atomic_store(&context->cancelled, true);
-        cnd_broadcast(&context->condition_not_full);
-        cnd_broadcast(&context->condition_not_empty);
-        mtx_unlock(&context->mutex);
-        /* Unblock a worker parked in socket I/O without closing the fd (the
-         * child owns the single close).  shutdown() only affects sockets; for
-         * the --stdio pipe the receiver's per-message poll timeout still
-         * bounds the join, so do nothing there rather than close a descriptor
-         * another thread may still be using. */
-        struct stat fd_stat;
-        if (fstat(file_descriptor, &fd_stat) == 0 && S_ISSOCK(fd_stat.st_mode))
-          shutdown(file_descriptor, SHUT_RDWR);
-        thrd_join(receiver, NULL);
-      }
-      if (writer_created)
-        thrd_join(writer, NULL);
-      goto done;
-    }
-    int receiver_result;
-    int writer_result;
-    thrd_join(receiver, &receiver_result);
-    thrd_join(writer, &writer_result);
-    bool transfer_ok = receiver_result == thrd_success && writer_result == thrd_success;
-    if (transfer_ok && !config->dry_run) {
-      /* Commit-style (late) deletion: receive_thread handed the keep-set
-         manifest here instead of deleting while write_thread might still be
-         draining, so by now every file is on disk and the whole transfer is
-         known to have succeeded.  Remove the extras before publishing a
-         --delay-updates run; the walker skips the staging directory.  A
-         server-contacting --dry-run deletes nothing (no manifest is sent). */
-      if (context->deferred_manifest) {
-        size_t deleted = 0;
-        DeletePathObserver observer = config->report_deletes ? receiver_record_deleted_path : NULL;
-        DeleteCommitResult deletion = manifest_delete_all_observed(
-            config, context->deferred_manifest, &deleted, observer, (void*)context->deleted_paths);
-        context->stats.deleted_files += deleted;
-        if (deletion == DELETE_COMMIT_ERROR) {
-          transfer_ok = false;
-        } else if (deletion == DELETE_COMMIT_LIMIT_REACHED) {
-          /* The transfer still succeeds; the terminal frame reports the capped
-             deletion so the sender exits 25 like rsync. */
-          context->delete_limit_reached = true;
-        }
-        delete_manifest_free(context->deferred_manifest);
-        context->deferred_manifest = NULL;
-      }
-      /* --delete-delay: receive_thread snapshotted each plan's extras as it
-         arrived; with the disk writer drained, commit the deferred removals.
-         --delete-during already applied its plans on the receive thread. */
-      if (context->deferred_plans) {
-        /* Defence in depth (the enclosing block already excludes dry-run): a
-           -n run never commits a deletion. */
-        if (config->report_deletes)
-          delete_plan_session_set_delete_observer(
-              context->deferred_plans, receiver_record_deleted_path, (void*)context->deleted_paths);
-        DeleteCommitResult deletion =
-            config->dry_run ? DELETE_COMMIT_OK
-                            : delete_plan_session_commit(context->deferred_plans, config);
-        context->stats.deleted_files += delete_plan_session_deleted(context->deferred_plans);
-        if (deletion == DELETE_COMMIT_ERROR) {
-          transfer_ok = false;
-        } else if (deletion == DELETE_COMMIT_LIMIT_REACHED) {
-          context->delete_limit_reached = true;
-        }
-        delete_plan_session_destroy(context->deferred_plans);
-        context->deferred_plans = NULL;
-      }
-    }
-    if (transfer_ok && !config->dry_run) {
-      /* --delay-updates: receive_thread has finished the whole protocol stream
-         (including manifest/delete handling) and write_thread has drained its
-         queue, so every staged file is complete.  Publish atomically before the
-         success/outcome frame so a --remove-source-files sender only learns of
-         files that were actually installed. */
-      if (config->delay_updates && config->delay_context &&
-          !delay_updates_publish(config->delay_context, config)) {
-        transfer_ok = false;
-      }
-      /* P7 Wave D: all writers have joined and the late deletion (and
-         --delay-updates publication) has committed above, so it is finally safe
-         to stamp directory times; a directory's mtime must not be clobbered by
-         its children or by an extra removal. */
-      if (transfer_ok)
-        dir_metadata_list_apply(&context->dir_times, config->receive_root_directory, config);
-    }
-    if (transfer_ok) {
-      Status final_status = context->delete_limit_reached ? STATUS_DELETE_LIMIT : STATUS_OK;
-      /* Emit the optional wire-stats record first (protocol 2.25.0), then the
-         success/outcome frame, exactly like the single-threaded receiver. */
-      if (!receiver_send_stats_frame(file_descriptor, config, &context->stats,
-                                     context->would_delete, context->deleted_paths) ||
-          !receiver_send_final_success(file_descriptor, config, &context->outcomes, final_status))
-        transfer_ok = false;
-    } else {
-      send_error_detail(file_descriptor, "transfer failed on receiver");
-    }
-    if (!transfer_ok)
-      log_message(LOG_LEVEL_ERROR, "Transfer failed");
-  } else {
-    if (receiver_receive_files(config, file_descriptor) != 0)
-      log_message(LOG_LEVEL_ERROR, "Transfer failed");
+  return true;
+}
+
+/* Phase 4a -- transfer via the multithreaded receiver.  Spawns the receive/write
+ * thread pair, joins them, then commits the late deletion, --delay-updates
+ * publication and directory times before emitting the terminal stats/success
+ * frame.  On any failure the helper just returns; the caller's `done` epilogue
+ * releases the pipeline context (which owns the config and queue) exactly as the
+ * former inline code did. */
+static void server_run_mt_receiver(ServerSession* state) {
+  Config* config = state->config;
+  Queue* q = queue_create(100, file_destroy);
+  if (q == NULL)
+    return;
+  state->context = pipeline_context_receiver_create(config, q, state->fd, state->ssl);
+  if (state->context == NULL) {
+    queue_destroy(q);
+    return;
  }
+  protocol_session_set_max_alloc(&state->context->session, config->max_alloc);
+  protocol_session_set_io_timeout(&state->context->session,
+                                  protocol_server_io_timeout_sec(config->timeout));
+  atomic_store(&state->context->session.total_allocated_bytes,
+               atomic_load(&state->session.total_allocated_bytes));
+  pipeline_context_receiver_set_queue_byte_limit(state->context, RECEIVER_QUEUE_MAX_BYTES);
+  thrd_t receiver = {0};
+  thrd_t writer = {0};
+  bool receiver_created = thrd_create(&receiver, receive_thread, state->context) == thrd_success;
+  bool writer_created = false;
+  if (receiver_created)
+    writer_created = thrd_create(&writer, write_thread, state->context) == thrd_success;
+  if (!receiver_created || !writer_created) {
+    log_perror("Error creating Threads");
+    if (receiver_created) {
+      mtx_lock(&state->context->mutex);
+      atomic_store(&state->context->cancelled, true);
+      cnd_broadcast(&state->context->condition_not_full);
+      cnd_broadcast(&state->context->condition_not_empty);
+      mtx_unlock(&state->context->mutex);
+      /* Unblock a worker parked in socket I/O without closing the fd (the
+       * child owns the single close).  shutdown() only affects sockets; for
+       * the --stdio pipe the receiver's per-message poll timeout still
+       * bounds the join, so do nothing there rather than close a descriptor
+       * another thread may still be using. */
+      struct stat fd_stat;
+      if (fstat(state->fd, &fd_stat) == 0 && S_ISSOCK(fd_stat.st_mode))
+        shutdown(state->fd, SHUT_RDWR);
+      thrd_join(receiver, NULL);
+    }
+    if (writer_created)
+      thrd_join(writer, NULL);
+    return;
+  }
+  int receiver_result;
+  int writer_result;
+  thrd_join(receiver, &receiver_result);
+  thrd_join(writer, &writer_result);
+  bool transfer_ok = receiver_result == thrd_success && writer_result == thrd_success;
+  PipelineContextReceiver* context = state->context;
+  if (transfer_ok && !config->dry_run) {
+    /* Commit-style (late) deletion: receive_thread handed the keep-set
+       manifest here instead of deleting while write_thread might still be
+       draining, so by now every file is on disk and the whole transfer is
+       known to have succeeded.  Remove the extras before publishing a
+       --delay-updates run; the walker skips the staging directory.  A
+       server-contacting --dry-run deletes nothing (no manifest is sent). */
+    if (context->deferred_manifest) {
+      size_t deleted = 0;
+      DeletePathObserver observer = config->report_deletes ? receiver_record_deleted_path : NULL;
+      DeleteCommitResult deletion = manifest_delete_all_observed(
+          config, context->deferred_manifest, &deleted, observer, (void*)context->deleted_paths);
+      context->stats.deleted_files += deleted;
+      if (deletion == DELETE_COMMIT_ERROR) {
+        transfer_ok = false;
+      } else if (deletion == DELETE_COMMIT_LIMIT_REACHED) {
+        /* The transfer still succeeds; the terminal frame reports the capped
+           deletion so the sender exits 25 like rsync. */
+        context->delete_limit_reached = true;
+      }
+      delete_manifest_free(context->deferred_manifest);
+      context->deferred_manifest = NULL;
+    }
+    /* --delete-delay: receive_thread snapshotted each plan's extras as it
+       arrived; with the disk writer drained, commit the deferred removals.
+       --delete-during already applied its plans on the receive thread. */
+    if (context->deferred_plans) {
+      /* Defence in depth (the enclosing block already excludes dry-run): a
+         -n run never commits a deletion. */
+      if (config->report_deletes)
+        delete_plan_session_set_delete_observer(
+            context->deferred_plans, receiver_record_deleted_path, (void*)context->deleted_paths);
+      DeleteCommitResult deletion =
+          config->dry_run ? DELETE_COMMIT_OK
+                          : delete_plan_session_commit(context->deferred_plans, config);
+      context->stats.deleted_files += delete_plan_session_deleted(context->deferred_plans);
+      if (deletion == DELETE_COMMIT_ERROR) {
+        transfer_ok = false;
+      } else if (deletion == DELETE_COMMIT_LIMIT_REACHED) {
+        context->delete_limit_reached = true;
+      }
+      delete_plan_session_destroy(context->deferred_plans);
+      context->deferred_plans = NULL;
+    }
+  }
+  if (transfer_ok && !config->dry_run) {
+    /* --delay-updates: receive_thread has finished the whole protocol stream
+       (including manifest/delete handling) and write_thread has drained its
+       queue, so every staged file is complete.  Publish atomically before the
+       success/outcome frame so a --remove-source-files sender only learns of
+       files that were actually installed. */
+    if (config->delay_updates && config->delay_context &&
+        !delay_updates_publish(config->delay_context, config)) {
+      transfer_ok = false;
+    }
+    /* P7 Wave D: all writers have joined and the late deletion (and
+       --delay-updates publication) has committed above, so it is finally safe
+       to stamp directory times; a directory's mtime must not be clobbered by
+       its children or by an extra removal. */
+    if (transfer_ok)
+      dir_metadata_list_apply(&context->dir_times, config->receive_root_directory, config);
+  }
+  if (transfer_ok) {
+    if (context->failed_entries > 0)
+      log_message(LOG_LEVEL_WARNING,
+                  "%zu entr%s failed to materialize; continuing (partial transfer)",
+                  context->failed_entries, context->failed_entries == 1 ? "y" : "ies");
+    Status final_status = context->delete_limit_reached
+                              ? STATUS_DELETE_LIMIT
+                              : (context->failed_entries > 0 ? STATUS_ERROR : STATUS_OK);
+    /* Emit the optional wire-stats record first (protocol 2.25.0), then the
+       success/outcome frame, exactly like the single-threaded receiver. */
+    if (!receiver_send_stats_frame(state->fd, config, &context->stats, context->would_delete,
+                                   context->deleted_paths) ||
+        !receiver_send_final_success(state->fd, config, &context->outcomes, final_status))
+      transfer_ok = false;
+  } else {
+    send_error_detail(state->fd, "transfer failed on receiver");
+  }
+  if (!transfer_ok)
+    log_message(LOG_LEVEL_ERROR, "Transfer failed");
+}
+
+/* Phase 4b -- transfer via the single-threaded receiver.  Failure is logged
+ * exactly as before; the caller's `done` epilogue then releases the config. */
+static void server_run_st_receiver(ServerSession* state) {
+  if (receiver_receive_files(state->config, state->fd) != 0)
+    log_message(LOG_LEVEL_ERROR, "Transfer failed");
+}
+
+/* Phase 4 dispatch -- choose the receiver implementation the config asks for.
+ * Both helpers own their success/failure logging; the caller falls through to
+ * the shared `done` epilogue either way. */
+static void server_run_transfer(ServerSession* state) {
+  if (state->config->use_multithreading)
+    server_run_mt_receiver(state);
+  else
+    server_run_st_receiver(state);
+}
+
+void handler(int file_descriptor) {
+  /* Single per-connection state; every phase helper below advances it and
+   * returns false on a logged failure.  All teardown state starts empty so the
+   * single `done` epilogue is safe to reach from any error path (including
+   * before the config frame arrives). */
+  ServerSession state;
+  state.fd = file_descriptor;
+  state.ssl = io_get_ssl();
+  protocol_session_init(&state.session, file_descriptor, file_descriptor);
+  protocol_session_set_ssl(&state.session, state.ssl);
+  protocol_session_bind(&state.session);
+  state.gate_ctx.ssl = state.ssl;
+  state.gate_ctx.fd = file_descriptor;
+  state.gate_ctx.super_mode_override = -1;
+  state.gate_ctx.has_peer_ip = false;
+  state.gate_ctx.peer_ip[0] = '\0';
+  state.gate_ctx.is_local = false;
+  state.config = NULL;
+  state.context = NULL;
+  state.joined_destination = NULL;
+  state.charset_ready = false;
+
+  if (!server_accept_config(&state))
+    goto done;
+  if (!server_apply_security_gates(&state))
+    goto done;
+  if (!server_prepare_session(&state))
+    goto done;
+  server_run_transfer(&state);

 done:
  /* Single cleanup epilogue: every error path jumps here, so the iconv
@@ -1034,38 +1118,63 @@ done:
   * connection fd is deliberately NOT closed here -- the child functions own
   * its single close (plain_child_fn / tls_child_fn), and the --stdio call
   * site must leave stdin/stdout open. */
-  if (charset_ready)
+  if (state.charset_ready)
    charset_wire_free();
  /* The delay-updates staging tree is released by config_delete (which the
     branch below always reaches), so it is cleaned exactly once. */
  identity_clear_active();
  protocol_session_unbind();
-  if (context != NULL) {
+  if (state.context != NULL) {
    /* context owns both the config and the queue it was created with. */
-    pipeline_context_receiver_destroy(context);
-    context = NULL;
-    config = NULL;
+    pipeline_context_receiver_destroy(state.context);
+    state.context = NULL;
+    state.config = NULL;
  } else {
-    config_delete(config);
-    config = NULL;
+    config_delete(state.config);
+    state.config = NULL;
  }
-  free(joined_destination);
+  free(state.joined_destination);
 }

 #ifndef FASTSYNC_SERVER_AS_LIB
 static Server* g_server = NULL;

+/* Signal handler for the foreground daemon/standalone listener.
+ *
+ * Async-signal-safety: _exit(2) is on the POSIX async-signal-safe list and is
+ * the ONLY thing done here.  The previous body called server_delete()
+ * (close/free/SSL_CTX_free), daemon_conf_free() and credentials_free(); none of
+ * those (free/malloc, and much of OpenSSL teardown) are async-signal-safe, so a
+ * signal delivered while the main thread was inside malloc/free could deadlock
+ * or corrupt the heap.
+ *
+ * Residual (documented, not hidden): the in-memory teardown is skipped on the
+ * signal path.  That is safe because the parent daemon owns no persistent
+ * resource that survives process exit -- the listening socket is closed by the
+ * kernel, the connection registry is an anonymous MAP_SHARED mapping with no
+ * named backing object, and the daemon config/credential stores are plain heap
+ * allocations.  Connection children are separate processes and handle their own
+ * temp files/locks.  The normal (non-signal) shutdown path in main() still runs
+ * the full teardown, so no cleanup is dropped on the common path.  Wiring the
+ * accept loop (transport_tcp.c, outside this change's scope) to a flag-based
+ * self-pipe shutdown would let the frees run context-safely; it is deliberately
+ * deferred rather than risk restructuring the daemon loop. */
 static void cleanup(int sig) {
  (void)sig;
-  if (g_server)
-    server_delete(&g_server);
-  daemon_conf_free(g_daemon_conf);
-  g_daemon_conf = NULL;
-  credentials_free(g_credentials);
-  g_credentials = NULL;
  _exit(0);
 }

+/* Install a signal handler with sigaction(2) (the required async-signal-safe
+ * install primitive; signal(3) is not specified to be async-signal-safe). */
+static void install_cleanup_handler(int signo) {
+  struct sigaction action;
+  memset(&action, 0, sizeof(action));
+  action.sa_handler = cleanup;
+  sigemptyset(&action.sa_mask);
+  action.sa_flags = 0;
+  sigaction(signo, &action, NULL);
+}
+
 static void print_server_usage(void) {
  printf("FastSync Server\n");
  printf("Usage: fastsync-server [options]\n\n");
@@ -1178,13 +1287,19 @@ static bool daemonize(void) {
      close(devnull);
  }
  /* Do not pin the launch CWD (module-relative 'path' entries would resolve
-   * against an unstable working directory) and drop the restrictive host umask
-   * so modules can create files/dirs with the modes the config requests. */
+   * against an unstable working directory).  Set a conservative daemon umask
+   * of 022 (the conventional service default): rsync never forces umask 0 --
+   * it reads and restores the inherited umask and creates new entries as
+   * 0777 & ~umask / source & ~umask without -p.  Forcing 0 here made every
+   * implied parent directory world-writable (0777) whenever -p metadata was not
+   * applied.  022 gives 0755 directories and source&~022 files, matching rsync
+   * under a normal daemon umask; -p/-a still restore the exact source mode via
+   * fchmod, which is unaffected by the umask. */
  if (chdir("/") != 0)
    log_message(LOG_LEVEL_WARNING, "daemon: chdir to / failed: %s", strerror(errno));
-  umask(0);
+  umask(022);
  /* Refresh the cached umask: main() captured the launch umask before this
-   * (single-threaded) umask(0), and file_mode_base() must see the daemon's
+   * (single-threaded) umask(022), and file_mode_base() must see the daemon's
   * actual umask. */
  file_umask_capture();
  return true;
@@ -1253,8 +1368,8 @@ int main(int argc, char* argv[]) {
   * this process-global policy cannot be re-enabled by a future caller. */
  server_allow_super = opts.allow_super && !opts.stdio_mode;
  server_iconv_spec = opts.iconv_spec;
-  signal(SIGINT, cleanup);
-  signal(SIGTERM, cleanup);
+  install_cleanup_handler(SIGINT);
+  install_cleanup_handler(SIGTERM);
  /* Server-owned socket deadline floor: the client default --timeout=0 would
   * otherwise leave accepted sockets without SO_RCVTIMEO/SO_SNDTIMEO and let a
   * silent peer hold a connection (and its process slot) forever. */
@@ -3,20 +3,12 @@
 #include "credentials.h"
 #include "utils.h"
 #include <limits.h>
-#include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/socket.h>

-static void set_error(char* err, size_t err_size, const char* fmt, ...) {
-  if (!err || err_size == 0)
-    return;
-  va_list args;
-  va_start(args, fmt);
-  vsnprintf(err, err_size, fmt, args);
-  va_end(args);
-}
+#define set_error utils_set_error

 void server_cli_options_default(ServerCliOptions* opts) {
  if (!opts)
@@ -9,7 +9,7 @@
 ArrayList* array_list_create(void (*item_destroyer)(void* item)) {
  ArrayList* list = (ArrayList*)protocol_alloc(sizeof(ArrayList));
  if (list == NULL) {
-    log_perror("ERROR: Could not allocate memory for array list struct");
+    log_message(LOG_LEVEL_ERROR, "%s", "ERROR: Could not allocate memory for array list struct");
    return NULL;
  }

@@ -47,7 +47,7 @@ static bool array_list_extend(ArrayList* array_list) {
    new_capacity = INITIAL_ARRAY_SIZE;
  void* new_items = protocol_realloc(array_list->items, new_capacity * sizeof(void*));
  if (new_items == NULL) {
-    log_perror("ERROR: Could not reallocate memory for array list items");
+    log_message(LOG_LEVEL_ERROR, "%s", "ERROR: Could not reallocate memory for array list items");
    return false;
  }
  array_list->items = new_items;
@@ -73,7 +73,7 @@ void** array_list_to_array(const ArrayList* array_list) {
  }
  void** array = protocol_alloc(array_list->size * sizeof(void*));
  if (array == NULL) {
-    log_perror("Could not malloc space for array from array list!");
+    log_message(LOG_LEVEL_ERROR, "%s", "Could not malloc space for array from array list!");
    return NULL;
  }
  memcpy(array, array_list->items, array_list->size * sizeof(void*));
@@ -17,8 +17,9 @@
 #include "protocol.h"
 #include "utils.h"

-/* Maximum individual file data size within a chunk (64 MB) */
-#define MAX_FILE_DATA_SIZE (64ULL * 1024 * 1024)
+/* Maximum individual file data size within a chunk (64 MB).  Distinct from the
+ * receiver's whole-file MAX_FILE_DATA_SIZE (256 MB) in file_receive.c. */
+#define MAX_CHUNK_FILE_DATA_SIZE (64ULL * 1024 * 1024)
 #define MAX_FILES_PER_CHUNK 65536U

 /* Reserve `charge` against `session`'s connection budget.  This mirrors the
@@ -382,9 +383,9 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
    }

    // Reject individual file data larger than the maximum allowed size.
-    if (file_data_size > MAX_FILE_DATA_SIZE) {
+    if (file_data_size > MAX_CHUNK_FILE_DATA_SIZE) {
      log_message(LOG_LEVEL_ERROR, "File data size %zu exceeds maximum %llu", file_data_size,
-                  (unsigned long long)MAX_FILE_DATA_SIZE);
+                  (unsigned long long)MAX_CHUNK_FILE_DATA_SIZE);
      goto error;
    }

@@ -16,7 +16,14 @@
 #include <zstd.h>

 #define INITIAL_DECOMPRESS_BUF_SIZE (1024 * 1024)
-#define MAX_DECOMPRESSED_SIZE (100ULL * 1024 * 1024) /* 100 MB hard ceiling */
+
+/* Hard ceiling for a single decompression.  The sender compresses whole files
+ * up to the protocol's whole-file receive bound, so the decompressor must
+ * accept payloads that large; referencing the protocol constant keeps the two
+ * bounds from drifting apart (they previously did: a 100 MB ceiling rejected
+ * 100-256 MB files).  This remains a real bomb guard -- every allocation in the
+ * paths below is clamped to it -- so it must not exceed the protocol bound. */
+#define MAX_DECOMPRESSED_SIZE MAX_RECEIVE_WHOLE_FILE_SIZE

 /* rsync 3.4.1's built-in skip-compress suffix list (the `--skip-compress`
 * defaults, in the man page's order).  rsync stores it as space-separated
@@ -637,8 +644,7 @@ static Data* zstd_decompress(Data* compressed_data, size_t maximum_size) {
    }
    if (ret > 0 && output.pos == output.size) {
      if (buf_size >= hard_limit || buf_size > SIZE_MAX / 2) {
-        log_message(LOG_LEVEL_ERROR, "Decompressed data exceeds %llu bytes",
-                    (unsigned long long)MAX_DECOMPRESSED_SIZE);
+        log_message(LOG_LEVEL_ERROR, "Decompressed data exceeds %llu bytes", hard_limit);
        data_destroy(uncompressed_data);
        uncompressed_data = NULL;
        goto cleanup;
@@ -20,9 +20,9 @@

 static void config_set_defaults(Config* config) {
  config->scanner_threads = 0;
-  config->metadata_explicitly_disabled = false;
-  config->preserve_perms_explicit_off = false;
-  config->preserve_times_explicit_off = false;
+  config->cli.preserve_perms_explicit_off = false;
+  config->cli.preserve_times_explicit_off = false;
+  config->cli.metadata_explicitly_disabled = false;
  config->show_progress = false;
  config->compression_threads = 0;
  config->ssh_port = 22;
@@ -44,8 +44,8 @@ static void config_set_defaults(Config* config) {
  config->tls_ca = NULL;
  config->server_host = str_dup("127.0.0.1");
  config->server_port = 8080;
-  config->server_port_set = false;
-  config->server_host_set = false;
+  config->cli.server_port_set = false;
+  config->cli.server_host_set = false;
  /* rsync defaults: --timeout=0 (I/O timeouts disabled) and --contimeout=60.
   * A value of 0 disables the client's own deadline on both the socket layer
   * (tcp_set_timeouts) and the protocol layer
@@ -68,10 +68,10 @@ static void config_set_defaults(Config* config) {
  config->human_readable = false;
  config->ignore_errors = false;
  config->ignore_missing_args = false;
-  config->checksum_transfer_algo = CHECKSUM_ALGO_DEFAULT;
-  config->cli_exit_code = 0;
-  config->compression_level_set = false;
-  config->checksum_choice_set = false;
+  config->cli.checksum_transfer_algo = CHECKSUM_ALGO_DEFAULT;
+  config->cli.cli_exit_code = 0;
+  config->cli.compression_level_set = false;
+  config->cli.checksum_choice_set = false;
  config->filters = NULL;
  config->files_from = NULL;
  config->files_from_set = NULL;
@@ -79,13 +79,12 @@ static void config_set_defaults(Config* config) {
  config->cvs_exclude = false;
  config->per_dir_filter = false;
  config->per_dir_filter_count = 0;
-  config->one_file_system = false;
+  config->one_file_system = 0;
  config->no_implied_dirs = false;
  config->dirs = false;
  config->rsh_command = NULL;
  config->blocking_io = false;
  config->outbuf = OUTBUF_BLOCK;
-  config->old_args = false;
  config->remote_options = NULL;
  config->remote_option_count = 0;
  config->address = NULL;
@@ -101,7 +100,7 @@ static void config_set_defaults(Config* config) {
  config->trust_sender = false;
  config->stop_after_mins = 0;
  config->stop_at = 0;
-  config->stop_at_set = false;
+  config->cli.stop_at_set = false;
  config->write_batch = NULL;
  config->only_write_batch = NULL;
  config->read_batch = NULL;
@@ -230,6 +229,13 @@ Config* config_create(void) {
  if (!config)
    return NULL;
  config_set_defaults(config);
+  /* config_set_defaults() dups the default server host; a failure there leaves
+   * server_host NULL and would crash later consumers, so fail the whole create
+   * (every caller already handles a NULL return). */
+  if (!config->server_host) {
+    config_delete(config);
+    return NULL;
+  }
  return config;
 }

@@ -335,7 +341,8 @@ bool config_derived_use_metadata(const Config* config) {
      config->chown_uid_set || config->chown_gid_set || config->usermap_count > 0 ||
      config->groupmap_count > 0 || config->update)
    return true;
-  return (config->use_incremental || config->use_delta) && !config->metadata_explicitly_disabled;
+  return (config->use_incremental || config->use_delta) &&
+         !config->cli.metadata_explicitly_disabled;
 }

 bool config_has_basis(const Config* config) {
@@ -686,9 +693,15 @@ int config_parse_ssh_dest(Config* config) {
    return daemon_dest_parse_error("invalid remote destination user@host (must not be empty or "
                                   "start with '-')",
                                   dest);
-  config->transport = TRANSPORT_SSH;
-  config->ssh_destination = str_dup(dest);
+  char* ssh_destination = str_dup(dest);
  char* path = str_dup(colon + 1);
+  if (!ssh_destination || !path) {
+    free(ssh_destination);
+    free(path);
+    return daemon_dest_parse_error("out of memory parsing remote destination", dest);
+  }
+  config->transport = TRANSPORT_SSH;
+  config->ssh_destination = ssh_destination;
  free(config->receive_root_directory);
  config->receive_root_directory = path;
  return 0;
@@ -1052,6 +1065,16 @@ static bool send_protect_entries(int fd, const Config* c) {
    log_message(LOG_LEVEL_ERROR, "invalid filter rule: %s", err);
    return false;
  }
+  /* The receiver rejects any block with more than MAX_FILTER_RULES entries as a
+   * protocol error; refuse to emit such a frame at all.  filter_base_build()
+   * can expand the client rule set (cvs-exclude, merge files), so this is the
+   * authoritative bound, not config->filters->size. */
+  if (rules->count < 0 || rules->count > MAX_FILTER_RULES) {
+    log_message(LOG_LEVEL_ERROR, "too many filter rules: %d (maximum %d)", rules->count,
+                MAX_FILTER_RULES);
+    filter_rule_list_free(rules);
+    return false;
+  }
  bool ok = send_int(fd, rules->count);
  for (int i = 0; ok && i < rules->count; i++) {
    const FilterRule* r = rules->items[i];
@@ -83,7 +83,7 @@ typedef struct {
 typedef enum SuperMode { SUPER_MODE_AUTO = 0, SUPER_MODE_ON = 1, SUPER_MODE_OFF = 2 } SuperMode;

 /* ===========================================================================
- * Config wire-field table (single source of truth for protocol 2.28.0).
+ * Config wire-field table (single source of truth for protocol 2.29.0).
 *
 * Every field below crosses the wire.  The table is the ONLY place a
 * serialized field is named: config.h expands CONFIG_WIRE_FIELDS() to declare
@@ -342,22 +342,60 @@ typedef enum SuperMode { SUPER_MODE_AUTO = 0, SUPER_MODE_ON = 1, SUPER_MODE_OFF
  CONFIG_WIRE_CODEC_FIELDS(X)                                                                      \
  CONFIG_WIRE_PROTECT_FIELDS(X)

+/* Client-only, CLI-parse bookkeeping (never serialized).  These members exist
+ * only so the client command-line parser can record HOW an option was
+ * specified (explicitly set, explicitly negated, or a parser-requested exit
+ * code); no other module and no wire peer ever needs them.  Grouping them in
+ * one nested member keeps the public Config free of client-CLI-only state. */
+typedef struct {
+  /* Set when the user explicitly turned an attribute off with --no-perms /
+   * --no-times (long or short form).  --incremental/--delta historically
+   * auto-enabled mode and mtime preservation; these flags let
+   * cli_finalize_config restore that behavior while still honoring the
+   * explicit per-attribute negation.  A later -p/-t re-enables the attribute
+   * directly, so the flag only prevents the incremental/delta implication,
+   * never a POSITIVE request. */
+  bool preserve_perms_explicit_off;
+  bool preserve_times_explicit_off;
+  /* Set by --no-preserve, the explicit opt-out of the whole preservation
+   * bundle, so the --incremental/--delta auto-preserve implication stays off. */
+  bool metadata_explicitly_disabled;
+  /* True when --server-port/--port was explicitly given.  --dry-run uses it to
+   * decide whether a real server handshake was requested, so a plain local
+   * destination (no explicit port) keeps the existing client-side dry-run
+   * behavior instead of dialing the default 127.0.0.1:8080. */
+  bool server_port_set;
+  /* True when --server-host was explicitly given, and distinct from the
+   * "127.0.0.1" default: --dry-run uses it to route an explicit remote target
+   * to the server so it reports receiver state exactly like a real run,
+   * instead of silently running the client-side manifest. */
+  bool server_host_set;
+  /* Codec-negotiation CLI state.  The effective pre-transfer checksum is
+   * Config->checksum_algo (serialized); checksum_transfer_algo is the rsync
+   * "transfer" half of a two-name --checksum-choice form (validated and used
+   * only to mirror rsync's whole-file forcing, since FastSync's per-block
+   * strong hash is fixed).  cli_exit_code carries a parser-requested process
+   * exit status (rsync uses 4 for an unsupported checksum/compress algorithm)
+   * so main() can mirror it. */
+  int checksum_transfer_algo;
+  int cli_exit_code;
+  /* "The user explicitly chose" bits.  They let the per-codec default level /
+   * checksum list be applied only when the corresponding rsync option was
+   * omitted (an explicit --compress-level / --checksum-choice always wins). */
+  bool compression_level_set;
+  bool checksum_choice_set;
+  /* True when --stop-at was given. */
+  bool stop_at_set;
+} ConfigCliParse;
+
 typedef struct Config {
  /* -j/--threads=N: number of parallel scanner worker threads for the -m
   * pipeline.  0 (the default, also set by bare -j/--threads) means "use the
   * scanner's built-in default" (4).  CLIENT-ONLY: it is a local scheduling
   * concern and is NEVER serialized into the wire config frame. */
  int scanner_threads;
-  bool metadata_explicitly_disabled;
-  /* CLIENT-ONLY (never serialized; not in CONFIG_WIRE_FIELDS).  Set when the
-   * user explicitly turned an attribute off with --no-perms / --no-times (long
-   * or short form).  --incremental/--delta historically auto-enabled mode and
-   * mtime preservation; these flags let cli_finalize_config restore that
-   * behavior while still honoring the explicit per-attribute negation.  A
-   * later -p/-t re-enables the attribute directly, so the flag only prevents
-   * the incremental/delta implication, never a POSITIVE request. */
-  bool preserve_perms_explicit_off;
-  bool preserve_times_explicit_off;
+  /* Client-only CLI-parse bookkeeping (never serialized).  See ConfigCliParse. */
+  ConfigCliParse cli;
  bool show_progress;
  int compression_threads;
  int ssh_port;
@@ -378,18 +416,6 @@ typedef struct Config {
  bool use_tls;
  char* server_host;
  int server_port;
-  /* True when --server-port/--port was explicitly given.  CLIENT-ONLY (never
-   * serialized): --dry-run uses it to decide whether a real server handshake
-   * was requested, so a plain local destination (no explicit port) keeps the
-   * existing client-side dry-run behavior instead of dialing the default
-   * 127.0.0.1:8080. */
-  bool server_port_set;
-  /* True when --server-host was explicitly given.  CLIENT-ONLY (never
-   * serialized), and distinct from the "127.0.0.1" default: --dry-run uses it
-   * to route an explicit remote target to the server so it reports receiver
-   * state exactly like a real run, instead of silently running the client-side
-   * manifest. */
-  bool server_host_set;
  char* tls_cert;
  char* tls_key;
  char* tls_ca;
@@ -435,22 +461,6 @@ typedef struct Config {
   * enters the keep-set.  Implied by --delete-missing-args. */
  bool ignore_missing_args;

-  /* Codec-negotiation CLI state (all client-only, never serialized).  The
-   * effective pre-transfer checksum is Config->checksum_algo (serialized);
-   * checksum_transfer_algo is the rsync "transfer" half of a two-name
-   * --checksum-choice form (validated and used only to mirror rsync's
-   * whole-file forcing, since FastSync's per-block strong hash is fixed).
-   * cli_exit_code carries a parser-requested process exit status (rsync uses 4
-   * for an unsupported checksum/compress algorithm) so main() can mirror it. */
-  int checksum_transfer_algo;
-  int cli_exit_code;
-  /* Client-only "the user explicitly chose" bits.  They let the per-codec
-   * default level / checksum list be applied only when the corresponding
-   * rsync option was omitted (an explicit --compress-level / --checksum-choice
-   * always wins).  Never serialized. */
-  bool compression_level_set;
-  bool checksum_choice_set;
-
  // Issue #129: Advanced file selection. These fields are CLIENT-ONLY: they are
  // never serialized to the wire (the receiver must not learn them).
  ArrayList* filters;   /* --filter=RULE rule strings, in order */
@@ -463,7 +473,9 @@ typedef struct Config {
   * /.rsync-filter' (the .rsync-filter files themselves are transferred); a
   * repeated -F adds --filter='- .rsync-filter' so they are excluded too. */
  int per_dir_filter_count;
-  bool one_file_system; /* -x/--one-file-system: do not cross filesystem boundaries */
+  int one_file_system; /* -x/--one-file-system: do not cross filesystem boundaries.
+                          Repeated -x (rsync's -xx) drops the mount-point
+                          directory entirely instead of recreating it empty. */
  /* --no-implied-dirs: client-only.  With -R, do not transfer the source
   * metadata of the parent directories implied by a listed path; an unlisted
   * implied parent is still created (with default attributes) so the listed
@@ -484,7 +496,6 @@ typedef struct Config {
  /* --outbuf mode (OutbufMode): stdout/stderr buffering.  Client-only launch
   * concern: NEVER crosses the wire. */
  int outbuf;
-  bool old_args;
  /* --remote-option=OPT (Phase 5, long form only): one or more extra command-line
   * options to append to the REMOTE server invocation over SSH.  CLIENT-ONLY:
   * they are composed into the remote command line by ssh_build_remote_command()
@@ -554,7 +565,6 @@ typedef struct Config {
   * process and are NEVER serialized into the config frame. */
  int stop_after_mins; /* --stop-after=MINS minutes; 0 when unset */
  time_t stop_at;      /* --stop-at=... absolute wall-clock deadline */
-  bool stop_at_set;    /* true when --stop-at was given */

  /* Client-only residual-batch paths.  A residual batch is a self-contained
   * single-file record of the whole source tree (full file images using the
@@ -725,11 +735,13 @@ typedef struct Config {
   * --copy-as) imply it. */
  /* fake_super */
  /* --fake-super: receiver-only.  When set, each written file additionally gets
-   * a reserved user.fastsync.stat xattr recording the RESOLVED uid/gid (the
+   * rsync's reserved user.rsync.%stat xattr recording the RESOLVED uid/gid (the
   * source's own when no ownership request is active, else the --chown/--usermap
-   * result) plus mode/mtime so a later privileged restore could re-apply them.
-   * It NEVER real-chowns: the point is to record the source ownership on an
-   * unprivileged receiver.  Crosses the wire. */
+   * result) plus the full mode and rdev, in rsync 3.4.1's grammar, so the tree is
+   * interoperable and a later privileged restore could re-apply them.  mtime is
+   * carried by the file's own timestamp, exactly as rsync does it.  It NEVER
+   * real-chowns: the point is to record the source ownership on an unprivileged
+   * receiver.  Crosses the wire. */
  /* module */
  /* Daemon module selection (Wave A, protocol 2.15.0).  Client-composed from a
   * host::module/path destination; NULL or "" means "no module" (the ordinary
@@ -1059,7 +1071,20 @@ typedef struct Config {
 * filter rules so the receiver can protect DESTINATION-ONLY entries from
 * --delete with `protect`/`risk` rules (rsync parity).  The block appends after
 * compression_algo; see CONFIG_WIRE_PROTECT_FIELDS. */
-#define PROTOCOL_VERSION "2.28.0"
+/* (10) Symlink xattrs/ACLs (protocol 2.29.0): the config-frame LAYOUT is
+ * unchanged (the derived use_xattrs bit already crosses the wire), but the
+ * STATUS_SYMLINK frame BODY grows a trailing bounded xattr block when -X/-A is
+ * negotiated -- exactly the block STATUS_MKDIR, STATUS_DIR_TIMES and regular
+ * files already carry.  The sender captures the symlink's OWN xattrs with
+ * llistxattr/lgetxattr (so it can never attach the REFERENT's attributes to the
+ * link) and the receiver re-applies them to the link itself with lsetxattr on a
+ * confined /proc/self/fd/<parent>/<leaf> path (there is no *at xattr syscall and
+ * fsetxattr cannot target a symlink).  A 2.28 peer that does not consume the new
+ * trailing block would desynchronize after every symlink, so the protocol
+ * version must bump; the strict same-version handshake (config_receive rejects a
+ * mismatched version before parsing anything else) keeps a 2.29 client and a
+ * 2.28 server from ever reaching that state. */
+#define PROTOCOL_VERSION "2.29.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 /* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */
 #define MAX_BASIS_DIRS 64
@@ -8,12 +8,13 @@
 #include <openssl/evp.h>
 #include <openssl/params.h>
 #include <openssl/rand.h>
-#include <stdarg.h>
+#include <poll.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
+#include <time.h>
 #include <unistd.h>

 /* One store entry: a username and its salted PBKDF2 verifier.  The plaintext
@@ -58,19 +59,37 @@ struct CredentialStore {
 static const uint8_t k_dummy_stored_key[CREDENTIAL_KEY_LEN] = {0};
 static const uint8_t k_dummy_server_key[CREDENTIAL_KEY_LEN] = {0};

-static void set_error(char* err, size_t err_size, const char* fmt, ...) {
-  if (!err || err_size == 0)
-    return;
-  va_list args;
-  va_start(args, fmt);
-  vsnprintf(err, err_size, fmt, args);
-  va_end(args);
-}
+#define set_error utils_set_error

 static bool is_comment_char(char c) {
  return c == '#' || c == ';';
 }

+/* True for a literal fd-backed store path: exactly "/dev/fd/<digits>" or
+ * "/proc/self/fd/<digits>", with no trailing component and no "..".  These name
+ * the calling process's own open descriptors (e.g. a bash process substitution
+ * `<(...)`, which passes /dev/fd/N), and both prefixes are symlinks by
+ * construction. */
+static bool is_fd_backed_path(const char* path) {
+  static const char* const prefixes[] = {"/dev/fd/", "/proc/self/fd/"};
+  if (!path)
+    return false;
+  for (size_t i = 0; i < sizeof(prefixes) / sizeof(prefixes[0]); i++) {
+    const char* prefix = prefixes[i];
+    size_t prefix_len = strlen(prefix);
+    if (strncmp(path, prefix, prefix_len) != 0)
+      continue;
+    const char* digits = path + prefix_len;
+    if (*digits < '0' || *digits > '9')
+      return false;
+    const char* p = digits;
+    while (*p >= '0' && *p <= '9')
+      p++;
+    return *p == '\0';
+  }
+  return false;
+}
+
 /* Open a --password-file / --early-input after verifying the EXACT inode we
 * will read: it must be owned by the effective user and grant no group/other
 * permission bit (so 0600 and stricter modes such as 0400 are accepted),
@@ -80,12 +99,31 @@ static bool is_comment_char(char c) {
 * path and then fstat the resulting fd (rather than stat()ing the path first
 * and reopening it), so the permission decision is made on the same inode that
 * is read and cannot be raced by swapping the path between check and open.
- * The path may be a process-substitution pipe (`<(...)` -> /dev/fd/N), so
- * regular files and FIFOs are accepted when the ownership/mode checks pass.
+ * O_NOFOLLOW refuses a symlinked path outright (ELOOP fails closed) instead of
+ * following it before the owner/mode gate can run.  The one exception is a
+ * literal fd-backed path (/dev/fd/N or /proc/self/fd/N, see
+ * is_fd_backed_path): those entries are symlinks to the CALLING process's own
+ * descriptors, so following them is not the untrusted-symlink hazard
+ * O_NOFOLLOW guards against, and requiring O_NOFOLLOW would break the
+ * documented process-substitution/FIFO usage.  For them only, O_NOFOLLOW is
+ * omitted; the same fstat owner/mode gate still applies to the resolved inode.
+ * O_NONBLOCK keeps the OPEN itself from
+ * blocking forever on a writer-less FIFO (a blocking O_RDONLY open would wait
+ * for a writer).  The fd is left nonblocking for FIFOs so a read never blocks
+ * either; the read loop (secret_read_line) absorbs the resulting EAGAIN by
+ * waiting, under a bounded deadline, for the writer -- this is what makes a
+ * slow process substitution (`--password-file <(sleep 1; ...)`) work while a
+ * writer-less FIFO still fails after the deadline instead of hanging.  Only
+ * regular files and FIFOs pass the ownership/mode checks; O_NONBLOCK is
+ * cleared for regular files, where it is a no-op anyway and no EAGAIN can
+ * occur, so their stdio read path is byte-for-byte unchanged.
 *
 * Returns a FILE* the caller must fclose, or NULL with `err` filled. */
 static FILE* secret_file_open(const char* path, char* err, size_t err_size) {
-  int fd = open(path, O_RDONLY | O_CLOEXEC);
+  int flags = O_RDONLY | O_NONBLOCK | O_CLOEXEC;
+  if (!is_fd_backed_path(path))
+    flags |= O_NOFOLLOW;
+  int fd = open(path, flags);
  if (fd < 0) {
    set_error(err, err_size, "cannot open secret file '%s': %s", path, strerror(errno));
    return NULL;
@@ -105,6 +143,15 @@ static FILE* secret_file_open(const char* path, char* err, size_t err_size) {
    close(fd);
    return NULL;
  }
+  /* O_NONBLOCK is only meaningful for the FIFO allowance.  Restore blocking
+   * mode on a regular file so its read path is exactly as before; a no-op on
+   * most systems, but explicit.  Failures here are ignored: O_NONBLOCK on a
+   * regular file does not affect reads either way. */
+  if (S_ISREG(st.st_mode)) {
+    int status_flags = fcntl(fd, F_GETFL);
+    if (status_flags >= 0)
+      (void)fcntl(fd, F_SETFL, status_flags & ~O_NONBLOCK);
+  }
  FILE* fp = fdopen(fd, "r");
  if (!fp) {
    set_error(err, err_size, "cannot read secret file '%s': %s", path, strerror(errno));
@@ -114,6 +161,123 @@ static FILE* secret_file_open(const char* path, char* err, size_t err_size) {
  return fp;
 }

+/* Overall bound on how long the reader waits for a process-substitution/FIFO
+ * writer to produce data before giving up.  It must comfortably exceed a
+ * producer's startup delay (e.g. `--password-file <(sleep 1; ...)`) while still
+ * bounding a writer-less FIFO, so a stray or hostile FIFO cannot stall the
+ * daemon or client indefinitely. */
+#define CREDENTIAL_FIFO_READ_TIMEOUT_MS 3000
+
+/* Monotonic milliseconds, used only for the read deadline (wall-clock changes
+ * must not extend or shorten the wait). */
+static int64_t credential_monotonic_ms(void) {
+  struct timespec ts;
+  if (clock_gettime(CLOCK_MONOTONIC, &ts) != 0)
+    return 0;
+  return (int64_t)ts.tv_sec * 1000 + (int64_t)(ts.tv_nsec / 1000000);
+}
+
+/* Wait until `fd` is readable or the deadline passes.  Returns true when it is
+ * readable, false on timeout or a poll error (err filled).  EINTR is retried
+ * against the same deadline, so signals cannot extend the wait. */
+static bool credential_wait_readable(int fd, int64_t deadline, const char* label, const char* path,
+                                     char* err, size_t err_size) {
+  for (;;) {
+    int64_t remaining = deadline - credential_monotonic_ms();
+    if (remaining <= 0)
+      break;
+    if (remaining > INT_MAX)
+      remaining = INT_MAX;
+    struct pollfd pfd = {.fd = fd, .events = POLLIN, .revents = 0};
+    int rc = poll(&pfd, 1, (int)remaining);
+    if (rc > 0)
+      return true;
+    if (rc == 0)
+      break;
+    if (errno != EINTR) {
+      set_error(err, err_size, "error waiting for %s '%s': %s", label, path, strerror(errno));
+      return false;
+    }
+  }
+  set_error(err, err_size, "timed out after %d ms waiting for %s '%s'",
+            CREDENTIAL_FIFO_READ_TIMEOUT_MS, label, path);
+  return false;
+}
+
+typedef enum {
+  SECRET_READ_LINE,
+  SECRET_READ_EOF,
+  SECRET_READ_ERROR,
+} SecretReadResult;
+
+/* Read one complete line from `fp` into `line` (capacity `cap`), including the
+ * trailing newline when present and always NUL-terminating.  `*out_len`
+ * receives strlen(line).
+ *
+ * A regular file is read exactly as before: secret_file_open leaves it
+ * blocking, so fgets never sees EAGAIN.  A FIFO stays nonblocking, so fgets
+ * returns NULL (or a partial line) with EAGAIN while the writer is still
+ * starting up; instead of treating that as a fatal error the loop clearerr()s
+ * and polls for readability against one overall deadline.  The `used`
+ * accumulator reassembles a line that arrived in several write()s into a single
+ * line, so a split write is not misparsed as two entries.
+ *
+ * Returns SECRET_READ_LINE, SECRET_READ_EOF, or SECRET_READ_ERROR (err filled)
+ * on timeout or a genuine read error. */
+static SecretReadResult secret_read_line(char* line, size_t cap, FILE* fp, const char* label,
+                                         const char* path, size_t* out_len, char* err,
+                                         size_t err_size) {
+  int fd = fileno(fp);
+  int64_t deadline = credential_monotonic_ms() + CREDENTIAL_FIFO_READ_TIMEOUT_MS;
+  size_t used = 0;
+  line[0] = '\0';
+  for (;;) {
+    errno = 0;
+    if (fgets(line + used, (int)(cap - used), fp)) {
+      used += strlen(line + used);
+      if (used > 0 && line[used - 1] == '\n') {
+        *out_len = used;
+        return SECRET_READ_LINE;
+      }
+      if (feof(fp)) {
+        *out_len = used; /* final unterminated line */
+        return SECRET_READ_LINE;
+      }
+      /* No newline and not EOF.  A full buffer is the caller's over-long-line
+       * case; otherwise the line is only partially available (a nonblocking
+       * FIFO under a slow writer), so any genuine read error fails and anything
+       * else waits for the rest. */
+      if (used >= cap - 1) {
+        *out_len = used;
+        return SECRET_READ_LINE;
+      }
+      int e = ferror(fp) ? errno : 0;
+      if (e != 0 && e != EAGAIN && e != EWOULDBLOCK) {
+        set_error(err, err_size, "error reading %s '%s': %s", label, path, strerror(e));
+        return SECRET_READ_ERROR;
+      }
+      clearerr(fp);
+      if (!credential_wait_readable(fd, deadline, label, path, err, err_size))
+        return SECRET_READ_ERROR;
+      continue;
+    }
+    /* fgets returned NULL: EOF, a not-yet-readable FIFO, or a real error. */
+    if (feof(fp)) {
+      *out_len = used;
+      return used > 0 ? SECRET_READ_LINE : SECRET_READ_EOF;
+    }
+    if (errno == EAGAIN || errno == EWOULDBLOCK) {
+      clearerr(fp);
+      if (!credential_wait_readable(fd, deadline, label, path, err, err_size))
+        return SECRET_READ_ERROR;
+      continue;
+    }
+    set_error(err, err_size, "error reading %s '%s': %s", label, path,
+              errno != 0 ? strerror(errno) : "read failed");
+    return SECRET_READ_ERROR;
+  }
+}
+
 /* Trim leading/trailing ASCII space and tab in place; returns the new start. */
 static char* trim_space(char* s) {
  while (*s == ' ' || *s == '\t')
@@ -509,9 +673,17 @@ static CredentialStore* load_store_file(const char* path, char* err, size_t err_
  char line[CREDENTIAL_MAX_LINE + 2];
  bool ok = true;

-  while (fgets(line, sizeof(line), fp)) {
+  for (;;) {
+    size_t len = 0;
+    SecretReadResult rr =
+        secret_read_line(line, sizeof(line), fp, "credential file", path, &len, err, err_size);
+    if (rr == SECRET_READ_EOF)
+      break;
+    if (rr == SECRET_READ_ERROR) {
+      ok = false;
+      break;
+    }
    line_no++;
-    size_t len = strlen(line);
    if (len == CREDENTIAL_MAX_LINE + 1 && line[len - 1] != '\n' && !feof(fp)) {
      set_error(err, err_size, "credential file '%s' line %d exceeds the %d-byte limit", path,
                line_no, CREDENTIAL_MAX_LINE);
@@ -1148,9 +1320,17 @@ int credentials_hash_file(const char* path, uint32_t iters, FILE* out, char* err
  int line_no = 0;
  int result = 0;
  char line[CREDENTIAL_MAX_LINE + 2];
-  while (fgets(line, sizeof(line), fp)) {
+  for (;;) {
+    size_t len = 0;
+    SecretReadResult rr =
+        secret_read_line(line, sizeof(line), fp, "plaintext file", path, &len, err, err_size);
+    if (rr == SECRET_READ_EOF)
+      break;
+    if (rr == SECRET_READ_ERROR) {
+      result = -1;
+      break;
+    }
    line_no++;
-    size_t len = strlen(line);
    if (len == CREDENTIAL_MAX_LINE + 1 && line[len - 1] != '\n' && !feof(fp)) {
      set_error(err, err_size, "plaintext file '%s' line %d exceeds the %d-byte limit", path,
                line_no, CREDENTIAL_MAX_LINE);
@@ -1228,9 +1408,15 @@ int credentials_read_secret_file(const char* path, char** user_out, char** passw
  char line[CREDENTIAL_MAX_LINE + 2];
  int result = -1;

-  while (fgets(line, sizeof(line), fp)) {
+  for (;;) {
+    size_t len = 0;
+    SecretReadResult rr =
+        secret_read_line(line, sizeof(line), fp, "password file", path, &len, err, err_size);
+    if (rr == SECRET_READ_EOF)
+      break;
+    if (rr == SECRET_READ_ERROR)
+      goto done;
    line_no++;
-    size_t len = strlen(line);
    if (len == CREDENTIAL_MAX_LINE + 1 && line[len - 1] != '\n' && !feof(fp)) {
      set_error(err, err_size, "password file '%s' line %d exceeds the %d-byte limit", path,
                line_no, CREDENTIAL_MAX_LINE);
@@ -1,12 +1,12 @@
 #include "daemon_conf.h"
 #include "credentials.h"
+#include "log.h"
 #include "utils.h"
 #include <arpa/inet.h>
 #include <ctype.h>
 #include <errno.h>
 #include <limits.h>
 #include <netinet/in.h>
-#include <stdarg.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -17,14 +17,7 @@
 /* helpers                                                             */
 /* ------------------------------------------------------------------ */

-static void set_error(char* err, size_t err_size, const char* fmt, ...) {
-  if (!err || err_size == 0)
-    return;
-  va_list args;
-  va_start(args, fmt);
-  vsnprintf(err, err_size, fmt, args);
-  va_end(args);
-}
+#define set_error utils_set_error

 /* Trim leading and trailing ASCII space/tab in place; returns the new start. */
 static char* trim_ws(char* s) {
@@ -41,6 +34,158 @@ static bool key_equals(const char* key, const char* canonical) {
  return strcasecmp(key, canonical) == 0;
 }

+/* True when `key` matches one of the NUL-terminated names in `list`. */
+static bool key_in_list(const char* key, const char* const* list, size_t count) {
+  for (size_t i = 0; i < count; i++) {
+    if (strcasecmp(key, list[i]) == 0)
+      return true;
+  }
+  return false;
+}
+
+/* rsync 3.4.1 rsyncd.conf GLOBAL keys accepted in the pre-module section that
+ * have no FastSync equivalent.  They are recognized and documented as inert:
+ * accepting a real rsync config must not fail on a logging/process key, but a
+ * silently-reinterpreted key is never invented.  `pidfile`/`logfile` are the
+ * compact --dparam spellings rsync documents.  The same list is used by the
+ * `--dparam` dispatch (apply_global_key), so there is a single impl. */
+static const char* const kRsyncInertGlobalKeys[] = {
+    "pid file",
+    "pidfile",
+    "log file",
+    "logfile",
+    "socket options",
+    "sockopts",
+    "listen backlog",
+    "syslog facility",
+    "syslog tag",
+    "log format",
+    "use chroot",
+    "uid",
+    "gid",
+    "timeout",
+    "max verbosity",
+    "min verbosity",
+    "lock file",
+    "transfer logging",
+    "strict modes",
+    "reverse lookup",
+    "forward lookup",
+    "ignore errors",
+    "ignore nonreadable",
+    "dont compress",
+};
+
+/* rsync 3.4.1 rsyncd.conf MODULE keys accepted in a [module] section that have
+ * no FastSync equivalent (accepted-and-documented inert).  Keys with a FastSync
+ * meaning (`path`, `read only`, `write only`, `auth users`, `max connections`,
+ * `hosts allow`/`hosts deny`, `client owner`) are handled by apply_module_key
+ * before this list is consulted.  Security-relevant keys (`exclude`, `filter`,
+ * `secrets file`, `refuse options`, ...) are inert, so a daemon-side filter or
+ * rsync secrets file is NOT enforced: each is loudly warned about at load time
+ * (see kRsyncUnenforcedModuleSecurityKeys) and documented as a residual in
+ * RSYNC_COMPAT.md. */
+static const char* const kRsyncInertModuleKeys[] = {
+    "comment",
+    "use chroot",
+    "daemon chroot",
+    "uid",
+    "gid",
+    "daemon uid",
+    "daemon gid",
+    "exclude",
+    "include",
+    "exclude from",
+    "include from",
+    "filter",
+    "max verbosity",
+    "min verbosity",
+    "lock file",
+    "transfer logging",
+    "log file",
+    "log format",
+    "syslog facility",
+    "syslog tag",
+    "timeout",
+    "secrets file",
+    "auth digest",
+    "strict modes",
+    "numeric ids",
+    "fake super",
+    "munge symlinks",
+    "list",
+    "dont compress",
+    "charset",
+    "refuse options",
+    "incoming chmod",
+    "outgoing chmod",
+    "open noatime",
+    "max size",
+    "min size",
+    "temp dir",
+    "pre-xfer exec",
+    "post-xfer exec",
+    "name converter",
+    "proxy protocol",
+    "proxy protocol hosts",
+    "reverse lookup",
+    "forward lookup",
+    "ignore errors",
+    "ignore nonreadable",
+};
+
+/* Subset of the inert rsync keys whose intent is access control (data
+ * visibility, credential source, transfer hooks, daemon privilege), plus the
+ * global keys that shape the daemon's privilege/identity.  These load for
+ * rsync-config compatibility, but because FastSync ignores them an operator
+ * migrating a hardened rsyncd.conf must not believe the restriction applies.
+ * The loader emits one LOG_LEVEL_WARNING per occurrence naming the key (and the
+ * module, for a module key).  `write only` is deliberately absent: it is mapped
+ * onto writability instead (FastSync is push-only, so a write-only module is
+ * simply writable). */
+static const char* const kRsyncUnenforcedModuleSecurityKeys[] = {
+    "secrets file",
+    "auth digest",
+    "refuse options",
+    "exclude",
+    "include",
+    "exclude from",
+    "include from",
+    "filter",
+    "max size",
+    "min size",
+    "pre-xfer exec",
+    "post-xfer exec",
+    "incoming chmod",
+    "outgoing chmod",
+    "name converter",
+    "use chroot",
+    "daemon chroot",
+    "uid",
+    "gid",
+    "daemon uid",
+    "daemon gid",
+    "munge symlinks",
+    "fake super",
+    "strict modes",
+    "proxy protocol",
+    "proxy protocol hosts",
+};
+
+static const char* const kRsyncUnenforcedGlobalSecurityKeys[] = {
+    "use chroot",
+    "uid",
+    "gid",
+    "strict modes",
+};
+
+#define kRsyncInertGlobalCount (sizeof(kRsyncInertGlobalKeys) / sizeof(kRsyncInertGlobalKeys[0]))
+#define kRsyncInertModuleCount (sizeof(kRsyncInertModuleKeys) / sizeof(kRsyncInertModuleKeys[0]))
+#define kRsyncUnenforcedModuleSecurityCount                                                        \
+  (sizeof(kRsyncUnenforcedModuleSecurityKeys) / sizeof(kRsyncUnenforcedModuleSecurityKeys[0]))
+#define kRsyncUnenforcedGlobalSecurityCount                                                        \
+  (sizeof(kRsyncUnenforcedGlobalSecurityKeys) / sizeof(kRsyncUnenforcedGlobalSecurityKeys[0]))
+
 static bool parse_bool_value(const char* value, bool* out) {
  if (strcasecmp(value, "yes") == 0 || strcasecmp(value, "true") == 0 || strcmp(value, "1") == 0) {
    *out = true;
@@ -258,6 +403,10 @@ DaemonConf* daemon_conf_create(void) {
  if (!conf)
    return NULL;
  conf->global.port = DAEMON_CONF_DEFAULT_PORT;
+  /* rsync modules are READ-ONLY unless `read only = no` (or `write only = yes`)
+   * is set, so FastSync must default the same way: a migrated rsyncd.conf that
+   * omits `read only` is served read-only, never writable. */
+  conf->global.read_only_default = true;
  conf->global.max_connections = DAEMON_CONF_DEFAULT_MAX_CONNECTIONS;
  conf->global.auth_failure_delay_ms = DAEMON_CONF_DEFAULT_AUTH_FAILURE_DELAY_MS;
  conf->global.max_connections_per_host = DAEMON_CONF_DEFAULT_MAX_CONNECTIONS_PER_HOST;
@@ -332,7 +481,7 @@ static bool apply_global_key(DaemonConf* conf, char* key, const char* value, boo
                             char* err, size_t err_size) {
  if (key_equals(key, "port"))
    return store_port(&conf->global.port, value, err, err_size);
-  if (key_equals(key, "motd file")) {
+  if (key_equals(key, "motd file") || key_equals(key, "motdfile")) {
    if (!store_string(&conf->global.motd_file, value)) {
      set_error(err, err_size, "out of memory parsing 'motd file'");
      return false;
@@ -346,6 +495,25 @@ static bool apply_global_key(DaemonConf* conf, char* key, const char* value, boo
    }
    return true;
  }
+  /* rsync allows the `read only` module key in the global section as the
+   * default for modules defined after it.  Map it to that default (a later
+   * --dparam re-applies it to modules that did not set their own value) so a
+   * global `read only = yes` cannot be silently dropped into a writable
+   * default. */
+  if (key_equals(key, "read only")) {
+    bool parsed;
+    if (!parse_bool_value(value, &parsed)) {
+      set_error(err, err_size, "global 'read only' must be yes/no (or true/false/1/0), got '%s'",
+                value);
+      return false;
+    }
+    conf->global.read_only_default = parsed;
+    for (int i = 0; i < conf->module_count; i++) {
+      if (!conf->modules[i].read_only_explicit)
+        conf->modules[i].read_only = parsed;
+    }
+    return true;
+  }
  if (key_equals(key, "max connections"))
    return store_max_connections(&conf->global.max_connections, value, NULL, err, err_size);
  if (key_equals(key, "max connections per host"))
@@ -368,6 +536,15 @@ static bool apply_global_key(DaemonConf* conf, char* key, const char* value, boo
  if (key_equals(key, "hosts deny"))
    return store_host_list(&conf->global.hosts_deny, &conf->global.hosts_deny_count, value,
                           "hosts deny", NULL, replace_hosts, err, err_size);
+  /* A recognized rsync global key with no FastSync equivalent loads inert. */
+  if (key_in_list(key, kRsyncInertGlobalKeys, kRsyncInertGlobalCount)) {
+    if (key_in_list(key, kRsyncUnenforcedGlobalSecurityKeys, kRsyncUnenforcedGlobalSecurityCount))
+      log_message(LOG_LEVEL_WARNING,
+                  "daemon config: global key '%s' is accepted for rsync compatibility but is NOT "
+                  "enforced by FastSync; the restriction it expresses will not be applied",
+                  key);
+    return true;
+  }
  set_error(err, err_size, "unknown global key '%s'", key);
  return false;
 }
@@ -396,6 +573,26 @@ static bool apply_module_key(DaemonModule* module, char* key, char* value, char*
      return false;
    }
    module->read_only = parsed;
+    module->read_only_explicit = true;
+    return true;
+  }
+  /* rsync's `write only = yes` makes the module client-writable.  FastSync has
+   * no read/pull path, so mapping it to writability is the exact
+   * security-relevant effect; set `read_only_explicit` so a global default
+   * cannot override the module's explicit choice.  `write only = no` is the
+   * rsync default and leaves the module's read-only state untouched. */
+  if (key_equals(key, "write only")) {
+    bool parsed;
+    if (!parse_bool_value(value, &parsed)) {
+      set_error(err, err_size,
+                "module '%s': 'write only' must be yes/no (or true/false/1/0), got '%s'",
+                module->name, value);
+      return false;
+    }
+    if (parsed) {
+      module->read_only = false;
+      module->read_only_explicit = true;
+    }
    return true;
  }
  if (key_equals(key, "client owner")) {
@@ -465,6 +662,15 @@ static bool apply_module_key(DaemonModule* module, char* key, char* value, char*
  if (key_equals(key, "hosts deny"))
    return store_host_list(&module->hosts_deny, &module->hosts_deny_count, value, "hosts deny",
                           module->name, false, err, err_size);
+  /* A recognized rsync module key with no FastSync equivalent loads inert. */
+  if (key_in_list(key, kRsyncInertModuleKeys, kRsyncInertModuleCount)) {
+    if (key_in_list(key, kRsyncUnenforcedModuleSecurityKeys, kRsyncUnenforcedModuleSecurityCount))
+      log_message(LOG_LEVEL_WARNING,
+                  "daemon config: module '%s' key '%s' is accepted for rsync compatibility but is "
+                  "NOT enforced by FastSync; the restriction it expresses will not be applied",
+                  module->name, key);
+    return true;
+  }
  set_error(err, err_size, "unknown key '%s' in module '%s'", key, module->name);
  return false;
 }
@@ -515,6 +721,7 @@ static int open_module(DaemonConf* conf, int* current_module, const char* name,
  }
  conf->modules = grown;
  memset(&conf->modules[conf->module_count], 0, sizeof(DaemonModule));
+  conf->modules[conf->module_count].read_only = conf->global.read_only_default;
  conf->modules[conf->module_count].name = str_dup(name);
  if (!conf->modules[conf->module_count].name) {
    set_error(err, err_size, "out of memory adding module '%s'", name);
@@ -17,7 +17,20 @@
 * DAEMON_CONF_MAX_LINE all fail the whole load with a clear, line-numbered
 * error instead of being silently ignored.  This keeps a typo from silently
 * changing what a module serves.
- */
+ *
+ * rsync compatibility: to reduce the divergence from rsync 3.4.1's rsyncd.conf
+ * grammar, the parser also ACCEPTS the common rsync GLOBAL and MODULE keys.
+ * Keys with a FastSync equivalent are mapped onto it (the native spellings are
+ * unchanged; `read only` defaults to yes like rsync, and `write only = yes`
+ * opts a module into writability).  Keys with no FastSync equivalent are
+ * accepted and documented as inert (they load successfully but have no effect)
+ * rather than failing the whole config; the accepted inert set is listed in
+ * kRsyncInertGlobalKeys / kRsyncInertModuleKeys in daemon_conf.c and in
+ * RSYNC_COMPAT.md.  Every inert key whose intent is access control is loudly
+ * warned about at load time (kRsyncUnenforced*SecurityKeys) so an operator
+ * migrating a hardened rsyncd.conf is never misled into believing the
+ * restriction is enforced.  A key outside both the FastSync-native grammar and
+ * the recognized rsync subset is still rejected as unknown. */

 /* A daemon module's configured root is used exactly like the standalone
 * server's --destination-root: the daemon confines every connection that
@@ -42,15 +55,21 @@
 * store refuses (fail closed) rather than falling open; see server.c.  Auth is
 * never bypassed by ignoring the list. */
 typedef struct DaemonModule {
-  char* name;        /* module name, as the client requests it */
-  char* path;        /* module root (daemon-side authorized root) */
-  bool read_only;    /* `read only = yes/no`; default no */
-  bool client_owner; /* `client owner = yes/no`; default no.  Per-module opt-in
-                        that lets this module's clients choose ownership
-                        (--numeric-ids/--chown/--usermap/--groupmap/--fake-super/
-                        --copy-as) and request explicit --super super-user
-                        activities.  Without it the daemon refuses all of them. */
-  char** auth_users; /* `auth users = a,b`; Wave B credential list */
+  char* name;              /* module name, as the client requests it */
+  char* path;              /* module root (daemon-side authorized root) */
+  bool read_only;          /* `read only = yes/no`; defaults to the global `read only`
+                              default (rsync allows it in the global section), which is
+                              itself default YES (rsync modules are read-only unless
+                              `read only = no` / `write only = yes` opts in) */
+  bool read_only_explicit; /* set when this module set its own `read only` or
+                              `write only = yes`, so a later global default (from a
+                              `--dparam read only=`) does not override it */
+  bool client_owner;       /* `client owner = yes/no`; default no.  Per-module opt-in
+                              that lets this module's clients choose ownership
+                              (--numeric-ids/--chown/--usermap/--groupmap/--fake-super/
+                              --copy-as) and request explicit --super super-user
+                              activities.  Without it the daemon refuses all of them. */
+  char** auth_users;       /* `auth users = a,b`; Wave B credential list */
  int auth_user_count;
  /* `max connections = N` (optional per-module cap).  0 means unlimited.  The
   * per-connection child records the selected module in the shared registry
@@ -69,6 +88,10 @@ typedef struct DaemonConfGlobals {
  int port;                      /* `port`, default DAEMON_CONF_DEFAULT_PORT (873) */
  char* motd_file;               /* `motd file`, may be NULL */
  char* address;                 /* `address` (optional bind address), may be NULL */
+  bool read_only_default;        /* global `read only` default for modules defined
+                                    after it (rsync allows the module key in the
+                                    global section); default YES to match rsync's
+                                    read-only modules */
  int max_connections;           /* `max connections`, default
                                    DAEMON_CONF_DEFAULT_MAX_CONNECTIONS (100) */
  int auth_failure_delay_ms;     /* `auth failure delay`, milliseconds; default
@@ -152,10 +175,13 @@ const DaemonModule* daemon_conf_find_module(const DaemonConf* conf, const char*
 bool daemon_module_name_valid(const char* name);

 /* Parse one --dparam=KEY=VALUE (or "--dparam KEY=VALUE") override string and
- * apply it to the global keys only.  Keys are case-insensitive and limited to
- * the global keys defined by the grammar (port, motd file, address,
+ * apply it to the global keys only.  Keys are case-insensitive and cover the
+ * global keys defined by the grammar (port, motd file, address, read only,
 * max connections, max connections per host, auth failure delay,
- * auth lockout threshold, auth lockout duration, hosts allow, hosts deny).
+ * auth lockout threshold, auth lockout duration, hosts allow, hosts deny) plus
+ * the recognized inert rsync global keys and the compact rsync spellings
+ * (`motdfile`, `pidfile`, `logfile`).  Applying `read only` sets the global
+ * default and re-applies it to every module that did not set its own value.
 * Returns 0 on success, -1 on error (err filled). */
 int daemon_conf_apply_dparam(DaemonConf* conf, const char* assignment, char* err, size_t err_size);

@@ -0,0 +1,656 @@
+#include "delete.h"
+
+#include "delay_updates.h"
+#include "filter.h"
+#include "log.h"
+#include "utils.h"
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+/* Build the keep-set index from the exact manifest entries only.  A lookup of
+   `rel` succeeds iff `rel` is a kept entry, a kept directory, or an ancestor
+   directory of kept content (the old is_dir_in_manifest predicate); the sorted
+   view answers "is an ancestor of kept content" without materializing any
+   per-component prefix copy, so the index is O(manifest size) memory. */
+static bool build_keep_index(const ArrayList* manifest, PathIndex* index) {
+  if (!manifest || manifest->size <= 0)
+    return path_index_build(index, NULL, 0);
+  return path_index_build(index, (const char* const*)manifest->items, (size_t)manifest->size);
+}
+
+static bool keep_is_dir(const PathIndex* index, const char* rel_path) {
+  return path_index_contains(index, rel_path) || path_index_has_descendant(index, rel_path);
+}
+
+static bool keep_is_file(const PathIndex* index, const char* rel_path) {
+  return path_index_contains(index, rel_path);
+}
+
+/* True when child_rel is, or lies below, a protected entry.  A prefix "a"
+   therefore protects "a" and "a/b/c" but not "ab".  Entries with top_level_only
+   set only protect DIRECT children of the receive root (at_root); nested
+   directories that share such a name stay ordinary destination content. */
+bool path_under_skip_prefix(const char* child_rel, bool at_root, const DeleteSkipEntry* skips,
+                            int skip_count) {
+  for (int i = 0; i < skip_count; i++) {
+    if (skips[i].top_level_only && !at_root)
+      continue;
+    size_t prefix_len = strlen(skips[i].prefix);
+    if (strncmp(child_rel, skips[i].prefix, prefix_len) == 0 &&
+        (child_rel[prefix_len] == '\0' || child_rel[prefix_len] == '/'))
+      return true;
+  }
+  return false;
+}
+
+/* Per-run deletion budget and tallies.  `max_delete` is the cap on the number
+   of entries the walker may remove (SIZE_MAX = unlimited); once it is reached
+   the remaining extras are counted in `skipped` and left in place, matching
+   rsync's partial --max-delete behavior. */
+typedef struct {
+  size_t max_delete;
+  size_t deleted;
+  size_t skipped;
+  bool limit_hit;
+} DeleteBudget;
+
+/* True when direct children of the directory named by `rel` may be removed.
+   With no synchronization info (dirs == NULL) the whole tree is deletable; when
+   a dirs index is supplied only its exact entries are (the receive root is the
+   "." sentinel). */
+static bool is_synced_dir(const PathIndex* dirs, const char* rel) {
+  if (!dirs)
+    return true;
+  return path_index_contains(dirs, rel[0] == '\0' ? "." : rel);
+}
+
+/* Unsigned byte-wise string compare, matching rsync's u_strcmp (a signed
+   strcmp would order bytes >= 0x80 differently). */
+static int delete_name_cmp(const char* a, const char* b) {
+  const unsigned char* pa = (const unsigned char*)a;
+  const unsigned char* pb = (const unsigned char*)b;
+  while (*pa != '\0' && *pa == *pb) {
+    pa++;
+    pb++;
+  }
+  return (int)*pa - (int)*pb;
+}
+
+bool delete_dir_entries_collect(int dirfd, DeleteDirEntry** out, size_t* count,
+                                bool* operation_ok) {
+  *out = NULL;
+  *count = 0;
+  if (operation_ok)
+    *operation_ok = true;
+  int scanfd = openat(dirfd, ".", O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+  if (scanfd < 0)
+    return false;
+  DIR* dir = fdopendir(scanfd);
+  if (!dir) {
+    close(scanfd);
+    return false;
+  }
+  DeleteDirEntry* entries = NULL;
+  size_t used = 0;
+  size_t capacity = 0;
+  bool ok = true;
+  const struct dirent* entry;
+  while ((entry = readdir(dir)) != NULL) {
+    if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
+      continue;
+    struct stat st;
+    if (fstatat(dirfd, entry->d_name, &st, AT_SYMLINK_NOFOLLOW) != 0) {
+      if (errno != ENOENT && operation_ok)
+        *operation_ok = false;
+      continue;
+    }
+    if (used == capacity) {
+      size_t next = capacity == 0 ? 16 : capacity * 2;
+      DeleteDirEntry* grown = realloc(entries, next * sizeof(*grown));
+      if (!grown) {
+        ok = false;
+        break;
+      }
+      entries = grown;
+      capacity = next;
+    }
+    entries[used].name = str_dup(entry->d_name);
+    if (!entries[used].name) {
+      ok = false;
+      break;
+    }
+    entries[used].is_dir = S_ISDIR(st.st_mode);
+    used++;
+  }
+  closedir(dir);
+  if (!ok) {
+    delete_dir_entries_free(entries, used);
+    return false;
+  }
+  *out = entries;
+  *count = used;
+  return true;
+}
+
+void delete_dir_entries_free(DeleteDirEntry* entries, size_t count) {
+  if (!entries)
+    return;
+  for (size_t i = 0; i < count; i++)
+    free(entries[i].name);
+  free(entries);
+}
+
+/* rsync's extraneous-entry order: subdirectories before files, each group in
+   descending name order. */
+int delete_dir_entry_cmp_desc(const void* a, const void* b) {
+  const DeleteDirEntry* ea = a;
+  const DeleteDirEntry* eb = b;
+  if (ea->is_dir != eb->is_dir)
+    return ea->is_dir ? -1 : 1;
+  return -delete_name_cmp(ea->name, eb->name);
+}
+
+/* rsync's kept-subdirectory order: plain ascending name. */
+int delete_dir_entry_cmp_asc(const void* a, const void* b) {
+  const DeleteDirEntry* ea = a;
+  const DeleteDirEntry* eb = b;
+  return delete_name_cmp(ea->name, eb->name);
+}
+
+/* How the shared classification/descent walk disposes of an extra it has
+   identified.  LIST records the destination-relative path without touching disk
+   (the -n/--dry-run would-delete enumeration); DELETE unlinks/rmdirs it, charges
+   the shared --max-delete budget and notifies the observer.  Both modes classify
+   and traverse identically, so the dry-run enumeration and the real deletion
+   cannot drift. */
+typedef enum { DELETE_WALK_MODE_DELETE, DELETE_WALK_MODE_LIST } DeleteWalkMode;
+
+typedef struct {
+  DeleteWalkMode mode;
+  DeleteBudget* budget;        /* DELETE mode */
+  ArrayList* out;              /* LIST mode: receives strdup'd relative paths */
+  size_t* recorded;            /* LIST mode */
+  DeletePathObserver observer; /* DELETE mode */
+  void* observer_context;      /* DELETE mode */
+} DeleteWalkState;
+
+/* Remove the extras directly inside the directory open on `dirfd` (DELETE mode)
+   or record the paths that WOULD be removed (LIST mode), recursing into every
+   child directory so kept content below a synchronized prefix is reached.
+   `all_removed` reports whether every child entry was removed (so the caller may
+   rmdir this directory).  A child directory is never removed when it is itself a
+   synchronized directory or holds kept content; with a dirs index supplied,
+   direct children of a non-synchronized directory are never extras at all (they
+   are left in place but still descended into).  Symlinks are unlinked like any
+   other non-directory extra (never followed).
+
+   Entries are processed in rsync's order (extraneous subdirectories in
+   descending name order, then extraneous files, then kept subdirectories in
+   ascending order) rather than readdir() order, so `--max-delete` leaves the
+   same survivors and the `--info=del`/dry-run line order matches rsync. */
+static bool delete_walk_fd(int dirfd, const char* rel_path, const PathIndex* keep,
+                           const PathIndex* dirs, DeleteWalkState* state,
+                           const DeleteSkipEntry* skips, int skip_count,
+                           const FilterRuleList* protect_rules, bool parent_deletable,
+                           bool* all_removed) {
+  DeleteDirEntry* entries = NULL;
+  size_t count = 0;
+  bool collect_ok = true;
+  if (!delete_dir_entries_collect(dirfd, &entries, &count, &collect_ok))
+    return false;
+  bool operation_ok = collect_ok;
+  bool local_survives = false;
+  bool* shielded = calloc(count ? count : 1, sizeof(bool));
+  bool* is_extra = calloc(count ? count : 1, sizeof(bool));
+  if (!shielded || !is_extra) {
+    free(shielded);
+    free(is_extra);
+    delete_dir_entries_free(entries, count);
+    return false;
+  }
+  /* A directory is deletable when it or ANY ancestor is synchronized; the
+     `parent_deletable` flag carries that down the recursion so dest-only
+     directories below a synchronized root are removed wholesale. */
+  bool deletable = parent_deletable || is_synced_dir(dirs, rel_path);
+  bool at_root = rel_path[0] == '\0';
+
+  /* Reproduce rsync's traversal order: extraneous subdirectories in descending
+     name order, then extraneous files in descending name order, and kept
+     subdirectories only afterwards (ascending).  Sorting up front also fixes the
+     identity of the survivors under a partial --max-delete. */
+  if (count > 1)
+    qsort(entries, count, sizeof(*entries), delete_dir_entry_cmp_desc);
+  size_t dir_count = 0;
+  while (dir_count < count && entries[dir_count].is_dir)
+    dir_count++;
+
+  /* Classify every entry up front (the verdict does not depend on processing
+     order) so the ordered passes below can act on it. */
+  for (size_t i = 0; i < count; i++) {
+    char* child_rel = path_cat((char*)rel_path, entries[i].name);
+    if (!child_rel) {
+      operation_ok = false;
+      continue;
+    }
+    /* A --delay-updates run keeps its staging directory as a direct child of
+       the receive root, and basis-dir snapshots live below it too.  Their
+       contents are not manifest entries, so descending into them would delete
+       every staged / basis file as an "extra".  Only the staging name (a
+       top-level-only prefix) and the basis prefixes are protected: a nested
+       destination directory that happens to be called .fastsync-stage is
+       ordinary content. */
+    if (path_under_skip_prefix(child_rel, at_root, skips, skip_count)) {
+      shielded[i] = true;
+      local_survives = true;
+    } else if (protect_rules &&
+               filter_rules_apply_side(protect_rules, child_rel, entries[i].name, entries[i].is_dir,
+                                       FILTER_SIDE_RECEIVER) == FILTER_ACTION_PROTECT) {
+      /* A first-match protect rule shields the extra; for a directory the whole
+         subtree is shielded (rsync prunes an excluded directory), so do not
+         descend. */
+      shielded[i] = true;
+      local_survives = true;
+    } else if (entries[i].is_dir) {
+      bool child_synced = dirs && path_index_contains(dirs, child_rel);
+      is_extra[i] = deletable && !child_synced && !keep_is_dir(keep, child_rel);
+      if (!is_extra[i])
+        local_survives = true;
+    } else {
+      is_extra[i] = deletable && !keep_is_file(keep, child_rel);
+      if (!is_extra[i])
+        local_survives = true;
+    }
+    free(child_rel);
+  }
+
+  /* Pass 1: extraneous subdirectories, descending. */
+  for (size_t i = 0; i < dir_count; i++) {
+    if (!is_extra[i])
+      continue;
+    char* child_rel = path_cat((char*)rel_path, entries[i].name);
+    if (!child_rel) {
+      operation_ok = false;
+      continue;
+    }
+    int childfd = openat(dirfd, entries[i].name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+    bool child_all_removed = false;
+    if (childfd >= 0) {
+      if (!delete_walk_fd(childfd, child_rel, keep, dirs, state, skips, skip_count, protect_rules,
+                          deletable, &child_all_removed))
+        operation_ok = false;
+      close(childfd);
+    } else if (errno != ENOENT) {
+      operation_ok = false;
+    }
+    if (child_all_removed && deletable) {
+      if (state->mode == DELETE_WALK_MODE_LIST) {
+        /* Record the directory with rsync's trailing slash. */
+        size_t len = strlen(child_rel);
+        char* copy = malloc(len + 2);
+        if (!copy) {
+          operation_ok = false;
+        } else {
+          memcpy(copy, child_rel, len);
+          copy[len] = '/';
+          copy[len + 1] = '\0';
+          if (!array_list_add(state->out, copy)) {
+            free(copy);
+            operation_ok = false;
+          } else {
+            (*state->recorded)++;
+          }
+        }
+      } else if (state->budget->deleted >= state->budget->max_delete) {
+        state->budget->limit_hit = true;
+        state->budget->skipped++;
+        local_survives = true;
+      } else if (unlinkat(dirfd, entries[i].name, AT_REMOVEDIR) != 0) {
+        /* ENOENT: already gone (fine).  ENOTEMPTY/EEXIST: the directory still
+           holds entries the walker leaves in place (a protected excluded
+           prefix, a kept file the manifest protects, a symlink); rsync leaves
+           such a directory behind, so this is not an error.  Only genuine I/O
+           failures abort the deletion. */
+        if (errno != ENOENT && errno != ENOTEMPTY && errno != EEXIST)
+          operation_ok = false;
+        local_survives = true;
+      } else {
+        state->budget->deleted++;
+        /* rsync reports a removed directory with a trailing slash. */
+        if (state->observer) {
+          size_t len = strlen(child_rel);
+          char* with_slash = malloc(len + 2);
+          if (with_slash) {
+            memcpy(with_slash, child_rel, len);
+            with_slash[len] = '/';
+            with_slash[len + 1] = '\0';
+            state->observer(state->observer_context, with_slash);
+            free(with_slash);
+          } else {
+            state->observer(state->observer_context, child_rel);
+          }
+        }
+      }
+    } else {
+      local_survives = true;
+    }
+    free(child_rel);
+  }
+
+  /* Pass 2: extraneous files, descending. */
+  for (size_t i = dir_count; i < count; i++) {
+    if (!is_extra[i])
+      continue;
+    if (state->mode == DELETE_WALK_MODE_LIST) {
+      char* child_rel = path_cat((char*)rel_path, entries[i].name);
+      if (!child_rel) {
+        operation_ok = false;
+        continue;
+      }
+      char* copy = str_dup(child_rel);
+      if (!copy || !array_list_add(state->out, copy)) {
+        free(copy);
+        operation_ok = false;
+      } else {
+        (*state->recorded)++;
+      }
+      free(child_rel);
+    } else if (state->budget->deleted >= state->budget->max_delete) {
+      state->budget->limit_hit = true;
+      state->budget->skipped++;
+      local_survives = true;
+    } else if (unlinkat(dirfd, entries[i].name, 0) != 0) {
+      if (errno != ENOENT)
+        operation_ok = false;
+      local_survives = true;
+    } else {
+      state->budget->deleted++;
+      char* child_rel = path_cat((char*)rel_path, entries[i].name);
+      if (child_rel) {
+        if (state->observer)
+          state->observer(state->observer_context, child_rel);
+        char* escaped_path = output_escape(child_rel, log_get_8_bit_output());
+        fprintf(stderr, "  Deleted: %s\n", escaped_path ? escaped_path : "<allocation failed>");
+        free(escaped_path);
+      }
+      free(child_rel);
+    }
+  }
+
+  /* Pass 3: kept subdirectories, ascending (rsync descends into these only
+     after the parent's own extras have been handled). */
+  for (size_t i = dir_count; i-- > 0;) {
+    if (is_extra[i] || shielded[i])
+      continue;
+    char* child_rel = path_cat((char*)rel_path, entries[i].name);
+    if (!child_rel) {
+      operation_ok = false;
+      continue;
+    }
+    int childfd = openat(dirfd, entries[i].name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+    bool child_all_removed = false;
+    if (childfd >= 0) {
+      if (!delete_walk_fd(childfd, child_rel, keep, dirs, state, skips, skip_count, protect_rules,
+                          deletable, &child_all_removed))
+        operation_ok = false;
+      close(childfd);
+    } else if (errno != ENOENT) {
+      operation_ok = false;
+    }
+    /* A kept/synchronized directory is never removed. */
+    local_survives = true;
+    free(child_rel);
+  }
+
+  free(shielded);
+  free(is_extra);
+  delete_dir_entries_free(entries, count);
+  *all_removed = !local_survives;
+  return operation_ok;
+}
+
+/* Open the receive root following the same authorized-root confinement the
+   walker uses, or dest_root directly when no authorized root is installed. */
+static int open_destination_root(const char* dest_root) {
+  int root_fd = utils_get_authorized_root_fd();
+  if (root_fd >= 0) {
+    if (utils_get_authorized_root_path())
+      return utils_open_authorized_destination(dest_root);
+    if (dest_root == NULL)
+      return dup(root_fd);
+    return -1;
+  }
+  return open(dest_root, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+}
+
+bool delete_extras_list(const char* dest_root, const ArrayList* manifest,
+                        const ArrayList* synced_dirs, const DeleteSkipEntry* skips, int skip_count,
+                        const FilterRuleList* protect_rules, ArrayList* out, size_t* count_out) {
+  if (count_out)
+    *count_out = 0;
+  if (!manifest || !out)
+    return false;
+  PathIndex keep;
+  if (!build_keep_index(manifest, &keep))
+    return false;
+  PathIndex dirs;
+  bool have_dirs = synced_dirs != NULL;
+  if (have_dirs &&
+      !path_index_build(&dirs, (const char* const*)synced_dirs->items, (size_t)synced_dirs->size)) {
+    path_index_free(&keep);
+    return false;
+  }
+  int rootfd = open_destination_root(dest_root);
+  if (rootfd < 0) {
+    path_index_free(&keep);
+    if (have_dirs)
+      path_index_free(&dirs);
+    return false;
+  }
+  bool all_removed = false;
+  size_t recorded = 0;
+  DeleteWalkState state = {.mode = DELETE_WALK_MODE_LIST,
+                           .budget = NULL,
+                           .out = out,
+                           .recorded = &recorded,
+                           .observer = NULL,
+                           .observer_context = NULL};
+  bool ok = delete_walk_fd(rootfd, "", &keep, have_dirs ? &dirs : NULL, &state, skips, skip_count,
+                           protect_rules, false, &all_removed);
+  if (close(rootfd) != 0)
+    ok = false;
+  path_index_free(&keep);
+  if (have_dirs)
+    path_index_free(&dirs);
+  if (count_out)
+    *count_out = recorded;
+  return ok;
+}
+
+DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const ArrayList* manifest,
+                                                const ArrayList* synced_dirs, size_t max_delete,
+                                                const DeleteSkipEntry* skips, int skip_count,
+                                                const FilterRuleList* protect_rules,
+                                                size_t* deleted_out, size_t* skipped_out,
+                                                DeletePathObserver observer,
+                                                void* observer_context) {
+  if (deleted_out)
+    *deleted_out = 0;
+  if (skipped_out)
+    *skipped_out = 0;
+  if (!manifest)
+    return DELETE_WALK_ERROR;
+  /* Index the keep-set (and the synchronized-dir set, when supplied) once so
+     membership is answered in O(path length) instead of scanning every entry
+     for every destination entry. */
+  PathIndex keep;
+  if (!build_keep_index(manifest, &keep))
+    return DELETE_WALK_ERROR;
+  PathIndex dirs;
+  bool have_dirs = synced_dirs != NULL;
+  if (have_dirs &&
+      !path_index_build(&dirs, (const char* const*)synced_dirs->items, (size_t)synced_dirs->size)) {
+    path_index_free(&keep);
+    return DELETE_WALK_ERROR;
+  }
+  int rootfd = open_destination_root(dest_root);
+  if (rootfd < 0) {
+    path_index_free(&keep);
+    if (have_dirs)
+      path_index_free(&dirs);
+    return DELETE_WALK_ERROR;
+  }
+  DeleteBudget budget = {.max_delete = max_delete, .deleted = 0, .skipped = 0, .limit_hit = false};
+  bool all_removed = false;
+  DeleteWalkState state = {.mode = DELETE_WALK_MODE_DELETE,
+                           .budget = &budget,
+                           .out = NULL,
+                           .recorded = NULL,
+                           .observer = observer,
+                           .observer_context = observer_context};
+  bool ok = delete_walk_fd(rootfd, "", &keep, have_dirs ? &dirs : NULL, &state, skips, skip_count,
+                           protect_rules, false, &all_removed);
+  if (close(rootfd) != 0)
+    ok = false;
+  path_index_free(&keep);
+  if (have_dirs)
+    path_index_free(&dirs);
+  if (deleted_out)
+    *deleted_out = budget.deleted;
+  if (skipped_out)
+    *skipped_out = budget.skipped;
+  if (!ok)
+    return DELETE_WALK_ERROR;
+  return budget.limit_hit ? DELETE_WALK_LIMIT_REACHED : DELETE_WALK_OK;
+}
+
+DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
+                                       const ArrayList* synced_dirs, size_t max_delete,
+                                       const DeleteSkipEntry* skips, int skip_count,
+                                       const FilterRuleList* protect_rules, size_t* deleted_out,
+                                       size_t* skipped_out) {
+  return delete_extras_limited_observed(dest_root, manifest, synced_dirs, max_delete, skips,
+                                        skip_count, protect_rules, deleted_out, skipped_out, NULL,
+                                        NULL);
+}
+
+bool delete_extras(const char* dest_root, const ArrayList* manifest) {
+  return delete_extras_limited(dest_root, manifest, NULL, SIZE_MAX, NULL, 0, NULL, NULL, NULL) ==
+         DELETE_WALK_OK;
+}
+
+/* Build the delete-walk protection prefix for one basis directory.  The walker
+   compares paths relative to the receive root, so a relative entry is already
+   in the right form; an absolute entry that lies below the root is converted to
+   its root-relative form, and one outside the root returns NULL (the walk
+   cannot reach it, and it is not protected data beneath the root).  Exposed so
+   tests can exercise the root-of-"/" child mapping directly. */
+char* delete_basis_relative(const Config* config, const char* path) {
+  if (!path)
+    return NULL;
+  if (path[0] != '/')
+    return str_dup(path);
+  const char* root = config->receive_root_directory;
+  if (!root || root[0] != '/')
+    return NULL;
+  size_t root_len = strlen(root);
+  while (root_len > 1 && root[root_len - 1] == '/')
+    root_len--;
+  if (strncmp(path, root, root_len) != 0)
+    return NULL;
+  if (root_len == 1) {
+    /* `root` is "/" (the only single-character absolute root): every absolute
+       path is below it, and the child relative form is everything after the
+       leading '/'. */
+    if (path[1] == '\0')
+      return NULL; /* identical to the root, not a child */
+    return str_dup(path + 1);
+  }
+  if (path[root_len] != '/')
+    return NULL; /* identical or a sibling sharing a name prefix */
+  return str_dup(path + root_len + 1);
+}
+
+bool delete_skips_build(const Config* config, const ArrayList* protected_paths,
+                        const ArrayList* size_skipped, bool basis_root_relative,
+                        DeleteSkipSet* out) {
+  if (!out)
+    return false;
+  out->entries = NULL;
+  out->owned_prefixes = NULL;
+  out->count = 0;
+  out->owned_count = 0;
+  if (!config)
+    return false;
+  int protected_count = protected_paths ? protected_paths->size : 0;
+  int size_skipped_count = size_skipped ? size_skipped->size : 0;
+  int count =
+      (config->delay_updates ? 1 : 0) + config->basis_count + protected_count + size_skipped_count;
+  if (count == 0)
+    return true;
+  out->entries = calloc((size_t)count, sizeof(DeleteSkipEntry));
+  if (!out->entries)
+    return false;
+  if (basis_root_relative && config->basis_count > 0) {
+    out->owned_prefixes = calloc((size_t)config->basis_count, sizeof(char*));
+    if (!out->owned_prefixes) {
+      free(out->entries);
+      out->entries = NULL;
+      return false;
+    }
+    out->owned_count = config->basis_count;
+  }
+  int idx = 0;
+  if (config->delay_updates) {
+    out->entries[idx].prefix = DELAY_UPDATES_STAGING_DIR;
+    out->entries[idx].top_level_only = true;
+    idx++;
+  }
+  for (int i = 0; i < config->basis_count; i++) {
+    const char* prefix = config->basis_dirs[i].path;
+    if (basis_root_relative) {
+      /* An absolute basis outside the receive root is unreachable by this walk,
+         so it contributes no protection prefix (and no slot). */
+      char* relative = delete_basis_relative(config, config->basis_dirs[i].path);
+      if (!relative)
+        continue;
+      out->owned_prefixes[i] = relative;
+      prefix = relative;
+    }
+    out->entries[idx].prefix = prefix;
+    out->entries[idx].top_level_only = false;
+    idx++;
+  }
+  for (int i = 0; i < protected_count; i++) {
+    out->entries[idx].prefix = (const char*)protected_paths->items[i];
+    out->entries[idx].top_level_only = false;
+    idx++;
+  }
+  for (int i = 0; i < size_skipped_count; i++) {
+    out->entries[idx].prefix = (const char*)size_skipped->items[i];
+    out->entries[idx].top_level_only = false;
+    idx++;
+  }
+  out->count = idx;
+  return true;
+}
+
+void delete_skips_free(DeleteSkipSet* set) {
+  if (!set)
+    return;
+  if (set->owned_prefixes) {
+    for (int i = 0; i < set->owned_count; i++)
+      free(set->owned_prefixes[i]);
+  }
+  free(set->owned_prefixes);
+  free(set->entries);
+  set->entries = NULL;
+  set->owned_prefixes = NULL;
+  set->count = 0;
+  set->owned_count = 0;
+}
@@ -0,0 +1,151 @@
+#ifndef DELETE_H
+#define DELETE_H
+
+#include "array_list.h"
+#include "config.h"
+#include <stdbool.h>
+#include <stddef.h>
+
+/* Delete engine.
+ *
+ * This module owns destination-relative delete traversal: the ordered directory
+ * walker that reproduces rsync's extraneous-entry order, the skip-prefix
+ * protection set shared by every delete pass, and the read-only enumeration
+ * that mirrors the walker for -n/--dry-run.  The budgeted manifest commit
+ * (delete_commit.c) and the per-directory delete plans (delete_plan.c) are
+ * built on the primitives exported here. */
+
+/* Result of a bounded extra-file deletion run. */
+typedef enum {
+  /* Every extra entry was removed (or there were none). */
+  DELETE_WALK_OK = 0,
+  /* The numeric cap for this run was reached before every extra was removed.
+     The walker removed exactly the entries the cap allowed and skipped (without
+     removing) the rest, matching rsync's partial --max-delete behavior. */
+  DELETE_WALK_LIMIT_REACHED,
+  /* A traversal or unlink failure aborted the deletion (partial removal is
+     possible, mirroring the delete pass). */
+  DELETE_WALK_ERROR
+} DeleteWalkResult;
+
+/* One protected entry for the delete walker.  When top_level_only is true the
+   prefix is skipped only as a DIRECT child of dest_root (the --delay-updates
+   staging directory, which must not hide genuine extras inside a nested
+   destination directory that happens to share the staging name); otherwise the
+   prefix is skipped at any depth (the --compare-dest/--copy-dest/--link-dest
+   basis trees, and the sender-side protected filter-excluded prefixes, which
+   are never destination content). */
+typedef struct {
+  const char* prefix;
+  bool top_level_only;
+} DeleteSkipEntry;
+
+/* A built skip-prefix set.  `entries`/`count` are what path_under_skip_prefix()
+   consumes.  `owned_prefixes` holds any prefix strings the builder had to
+   allocate (root-relative basis-dir conversions); it is NULL when every prefix
+   is borrowed from the config or the caller's lists.  Release with
+   delete_skips_free(). */
+typedef struct {
+  DeleteSkipEntry* entries;
+  char** owned_prefixes;
+  int count;
+  int owned_count;
+} DeleteSkipSet;
+
+/* True when child_rel is, or lies below, one of the protected entries (a prefix
+   "a" protects "a" and "a/b/c" but not "ab"; top_level_only entries protect
+   only DIRECT children of the destination root, i.e. child_rel has no '/'). */
+bool path_under_skip_prefix(const char* child_rel, bool at_root, const DeleteSkipEntry* skips,
+                            int skip_count);
+
+/* One destination-directory entry collected up front so the delete walkers can
+   reproduce rsync's traversal order instead of readdir() order.  rsync processes
+   a directory's extraneous subdirectories first (descending name, depth-first),
+   then its extraneous files (descending name), and only afterwards descends into
+   its kept subdirectories (ascending name). */
+typedef struct {
+  char* name;
+  bool is_dir;
+} DeleteDirEntry;
+/* Collect the entries of the directory open on `dirfd` (excluding "." and ".."),
+   stat'ing each with AT_SYMLINK_NOFOLLOW.  On success *out is a malloc'd array of
+   *count entries whose names the caller frees with delete_dir_entries_free().
+   Returns false on an allocation/readdir failure; a vanished entry (ENOENT) is
+   skipped, any other stat failure is reported through *operation_ok while the
+   walk continues. */
+bool delete_dir_entries_collect(int dirfd, DeleteDirEntry** out, size_t* count, bool* operation_ok);
+void delete_dir_entries_free(DeleteDirEntry* entries, size_t count);
+/* Sort comparators: `_desc` orders subdirectories before files and each group by
+   descending name (rsync's extraneous-entry order); `_asc` orders plain ascending
+   name (rsync's kept-subdirectory order). */
+int delete_dir_entry_cmp_desc(const void* a, const void* b);
+int delete_dir_entry_cmp_asc(const void* a, const void* b);
+
+/* Remove files/dirs/symlinks under dest_root that are not listed in manifest
+   without ever descending into a protected prefix (see DeleteSkipEntry).  When
+   `synced_dirs` is non-NULL, extras are only removed directly inside a directory
+   whose destination-relative path is an exact entry in that list (the receive
+   root is the "." sentinel); directories outside the synchronized set are still
+   descended into so kept content below a listed directory is preserved, but
+   nothing in them is removed.  A NULL `synced_dirs` keeps the legacy behavior of
+   treating the whole destination tree as deletable.  `max_delete` caps the
+   number of removed entries (SIZE_MAX = unlimited): the walker removes up to the
+   cap and returns DELETE_WALK_LIMIT_REACHED when more extras remained.
+   `deleted_out`/`skipped_out` optionally receive the number of entries removed
+   and the number skipped because of the cap. */
+DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
+                                       const ArrayList* synced_dirs, size_t max_delete,
+                                       const DeleteSkipEntry* skips, int skip_count,
+                                       const FilterRuleList* protect_rules, size_t* deleted_out,
+                                       size_t* skipped_out);
+
+/* Optional per-deletion observer: called for each destination-relative path
+   actually removed (a file, symlink, or directory), in removal order, so the
+   receiver can stream rsync's `--info=del`/`--info=remove` lines. */
+typedef void (*DeletePathObserver)(void* context, const char* rel_path);
+
+/* `delete_extras_limited_observed` is delete_extras_limited with an optional
+ * observer; the observer is invoked only for entries truly removed.  When
+ * `protect_rules` is non-NULL its receiver-side verdict is evaluated for every
+ * candidate extra: a first-match PROTECT leaves the entry (and, for a
+ * directory, its whole subtree) in place, while RISK/NONE fall through to the
+ * ordinary skip-prefix/keep-set logic. */
+DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const ArrayList* manifest,
+                                                const ArrayList* synced_dirs, size_t max_delete,
+                                                const DeleteSkipEntry* skips, int skip_count,
+                                                const FilterRuleList* protect_rules,
+                                                size_t* deleted_out, size_t* skipped_out,
+                                                DeletePathObserver observer,
+                                                void* observer_context);
+/* Read-only companion to delete_extras_limited: walk the destination exactly as
+   the delete pass would and APPEND (strdup'd) destination-relative paths that
+   WOULD be removed, without touching disk.  Used for -n/--dry-run --delete
+   would-delete reporting.  Returns true on a clean walk; the caller owns the
+   strings appended to `out` and receives their count in *count_out. */
+bool delete_extras_list(const char* dest_root, const ArrayList* manifest,
+                        const ArrayList* synced_dirs, const DeleteSkipEntry* skips, int skip_count,
+                        const FilterRuleList* protect_rules, ArrayList* out, size_t* count_out);
+bool delete_extras(const char* dest_root, const ArrayList* manifest);
+
+/* Build the delete walk's skip-prefix set from the config's --delay-updates
+   staging directory, its --compare-dest/--copy-dest/--link-dest basis dirs, and
+   the caller-supplied protection lists, in that order.  `protected_paths` and
+   `size_skipped` are borrowed (may be NULL); every entry in them is protected at
+   any depth.  The staging directory is protected only as a DIRECT child of the
+   receive root.  `basis_root_relative` selects how a basis path becomes a
+   prefix: true converts an absolute path under the receive root to its
+   root-relative form (the whole-tree commit walk; an unreachable path
+   contributes no slot), false keeps the configured path verbatim (the
+   per-directory plan walk).  On success the caller releases `*out` with
+   delete_skips_free(); returns false on allocation failure. */
+bool delete_skips_build(const Config* config, const ArrayList* protected_paths,
+                        const ArrayList* size_skipped, bool basis_root_relative,
+                        DeleteSkipSet* out);
+void delete_skips_free(DeleteSkipSet* set);
+
+/* Convert one basis-directory path to the receive-root-relative protection
+   prefix the delete walker uses (NULL when it lies outside the root).  Exposed
+   for unit tests of the root-of-"/" and normalization edge cases. */
+char* delete_basis_relative(const Config* config, const char* path);
+
+#endif
@@ -0,0 +1,488 @@
+#include <errno.h>
+#include <ctype.h>
+#include <dirent.h>
+#include <fcntl.h>
+#include <libgen.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/sysmacros.h>
+#include <unistd.h>
+
+#include "array_list.h"
+#include "charset.h"
+#include "chmod.h"
+#include "chunk.h"
+#include "compression.h"
+#include "config.h"
+#include "data.h"
+#include "delay_updates.h"
+#include "delete_commit.h"
+#include "delta.h"
+#include "file.h"
+#include "format.h"
+#include "identity.h"
+#include "log.h"
+#include "metadata.h"
+#include "protocol.h"
+#include "utils.h"
+#include "xattr.h"
+
+#define MAX_SERVER_DELETE_COUNT 100000U
+/* Retained cost of one delete-manifest entry beyond its path bytes: the
+   ArrayList pointer slot plus an approximate malloc header/rounding for the
+   heap copy.  Charged against MAX_MANIFEST_BYTES so a frame full of tiny paths
+   cannot retain far more than the byte budget (B5). */
+#define MANIFEST_ENTRY_OVERHEAD (sizeof(char*) + 16)
+
+/* Read a delete-manifest frame (the STATUS_MANIFEST leading code has already
+   been consumed): a keep-set entry count followed by that many
+   destination-relative paths, then a protected-prefix count followed by that
+   many destination-relative prefixes, then a missing-args count followed by that
+   many destination-relative delete paths, then (protocol 2.23.0) a
+   synchronized-directory count followed by that many destination-relative
+   directory paths (the receive root is the "." sentinel).  The frame is
+   self-delimiting (the counts are authoritative), so the caller decides what to
+   do next and continues reading the following STATUS_* frame.  Every section is
+   validated identically: an entry must be non-empty, relative and traversal-free
+   and the aggregate length across ALL sections is capped by MAX_MANIFEST_BYTES
+   (so the missing-args deletion requests are confined like the rest of the
+   manifest).  Returns an owned DeleteManifest, or NULL after sending STATUS_ERROR
+   when the frame is malformed (bad count, empty/absolute path, path traversal,
+   or an aggregate size beyond MAX_MANIFEST_BYTES). */
+static bool receive_manifest_section(int fd, ArrayList* list, size_t* manifest_bytes,
+                                     size_t* manifest_entries) {
+  int count;
+  if (!receive_int(fd, &count)) {
+    send_status(fd, STATUS_ERROR);
+    return false;
+  }
+  if (count < 0 || count > MAX_MANIFEST_ENTRIES ||
+      (size_t)count > MAX_MANIFEST_ENTRIES - *manifest_entries) {
+    send_status(fd, STATUS_ERROR);
+    return false;
+  }
+  for (int i = 0; i < count; i++) {
+    char* s = receive_wire_str(fd);
+    size_t entry_size = s ? strlen(s) + MANIFEST_ENTRY_OVERHEAD : 0;
+    if (!s || s[0] == '\0' || s[0] == '/' || has_path_traversal(s) ||
+        entry_size > MAX_MANIFEST_BYTES - *manifest_bytes ||
+        (*manifest_bytes += entry_size) > MAX_MANIFEST_BYTES || !array_list_add(list, s)) {
+      free(s);
+      send_status(fd, STATUS_ERROR);
+      return false;
+    }
+  }
+  *manifest_entries += (size_t)count;
+  return true;
+}
+
+DeleteManifest* receive_manifest_entries(int fd) {
+  DeleteManifest* manifest = calloc(1, sizeof(DeleteManifest));
+  if (!manifest) {
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+  manifest->keeps = array_list_create(free);
+  manifest->protected = array_list_create(free);
+  manifest->missing = array_list_create(free);
+  manifest->dirs = array_list_create(free);
+  if (!manifest->keeps || !manifest->protected || !manifest->missing || !manifest->dirs) {
+    delete_manifest_free(manifest);
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+  size_t manifest_bytes = 0;
+  size_t manifest_entries = 0;
+  if (!receive_manifest_section(fd, manifest->keeps, &manifest_bytes, &manifest_entries) ||
+      !receive_manifest_section(fd, manifest->protected, &manifest_bytes, &manifest_entries) ||
+      !receive_manifest_section(fd, manifest->missing, &manifest_bytes, &manifest_entries) ||
+      !receive_manifest_section(fd, manifest->dirs, &manifest_bytes, &manifest_entries)) {
+    delete_manifest_free(manifest);
+    return NULL;
+  }
+  return manifest;
+}
+
+void delete_manifest_free(DeleteManifest* manifest) {
+  if (!manifest)
+    return;
+  array_list_delete(manifest->keeps);
+  array_list_delete(manifest->protected);
+  array_list_delete(manifest->missing);
+  array_list_delete(manifest->dirs);
+  free(manifest);
+}
+
+/* Shared --max-delete budget for one receiver-side deletion commit.  Both the
+   --delete-missing-args exact-path removals and the ordinary extras walk draw
+   from the same tally, matching rsync (whose --max-delete counts every deleted
+   file or directory).  `max_delete` is SIZE_MAX for an unlimited budget. */
+typedef struct {
+  size_t max_delete;
+  size_t deleted;
+  size_t skipped;
+  bool limit_hit;
+} DeleteBudgetState;
+
+/* Remove every destination entry under the receive root that is not in the
+   keep-set, bounded by the shared budget (a smaller client --max-delete=NUM
+   replaces the server hard bound; rsync deletes up to the bound and skips the
+   rest).  With --delay-updates the not-yet-published staging directory is a
+   direct child of the receive root and must not be treated as a set of extras;
+   the manifest's protected prefixes (paths excluded on the source), the
+   size-pruned prefixes (--max-size/--min-size, always protected) and the
+   alternate basis directories are never destination content and are skipped at
+   any depth.  Returns true unless a traversal/unlink error aborted the walk;
+   the budget's limit_hit/skipped fields report a cap-stopped run. */
+static bool delete_extras_budgeted_observed(const Config* config, const DeleteManifest* manifest,
+                                            DeleteBudgetState* budget, DeletePathObserver observer,
+                                            void* observer_context) {
+  if (!config || !manifest || !manifest->keeps)
+    return false;
+  fprintf(stderr, "Deleting files not in manifest...\n");
+  /* Protected entries: the --delay-updates staging name (only as a DIRECT child
+     of the receive root), the alternate basis directories and the sender-side
+     protected prefixes (filter-excluded and size-pruned source mirrors), all at
+     any depth.  See delete_skips_build(). */
+  DeleteSkipSet skips;
+  if (!delete_skips_build(config, manifest->protected, NULL, true, &skips))
+    return false;
+  /* Clamp rather than subtract: an accounting bug where deleted already exceeds
+     max_delete must never underflow into an effectively unlimited budget. */
+  size_t remaining;
+  if (budget->max_delete == SIZE_MAX)
+    remaining = SIZE_MAX;
+  else if (budget->deleted >= budget->max_delete)
+    remaining = 0;
+  else
+    remaining = budget->max_delete - budget->deleted;
+  size_t deleted = 0;
+  size_t skipped = 0;
+  DeleteWalkResult result = delete_extras_limited_observed(
+      config->receive_root_directory, manifest->keeps, manifest->dirs, remaining, skips.entries,
+      skips.count, config->protect_rules, &deleted, &skipped, observer, observer_context);
+  delete_skips_free(&skips);
+  budget->deleted += deleted;
+  budget->skipped += skipped;
+  if (result == DELETE_WALK_LIMIT_REACHED) {
+    budget->limit_hit = true;
+    return true;
+  }
+  if (result != DELETE_WALK_OK) {
+    log_message(LOG_LEVEL_ERROR, "deletion failed while removing extraneous files");
+    return false;
+  }
+  return true;
+}
+
+static bool delete_extras_budgeted(const Config* config, const DeleteManifest* manifest,
+                                   DeleteBudgetState* budget) {
+  return delete_extras_budgeted_observed(config, manifest, budget, NULL, NULL);
+}
+
+/* Prefixes every observed path with a fixed subtree root, so a nested walk
+   (a recursively removed missing-arg directory) reports receive-root-relative
+   names like the rest of the delete output. */
+typedef struct {
+  DeletePathObserver inner;
+  void* inner_context;
+  const char* prefix;
+} PrefixedDeleteObserver;
+
+static void prefixed_delete_observer(void* context, const char* rel) {
+  PrefixedDeleteObserver* prefixed = context;
+  if (!prefixed->inner || !rel)
+    return;
+  char* joined = path_cat((char*)prefixed->prefix, rel);
+  if (joined) {
+    prefixed->inner(prefixed->inner_context, joined);
+    free(joined);
+  }
+}
+
+/* --delete-missing-args exact-path deletions: each destination mirror in
+   manifest->missing is an explicit user request, so it is removed even when the
+   ordinary extras walk (with its protected prefixes) would leave it alone.  The
+   --delay-updates staging directory and basis snapshots are receiver artifacts
+   and stay protected exactly as in the extras walker.  A regular file or
+   symlink is unlinked, an empty directory removed, and a NON-empty directory is
+   removed recursively only when --delete or --force is in effect (rsync parity:
+   the man page says a non-empty directory mirror is only deleted with --force
+   or --delete); otherwise it is left with a warning and the run continues.  A
+   mirror that does not exist is a no-op.  Each removal draws from the shared
+   --max-delete budget: once it is exhausted the remaining requests are skipped
+   and counted.  Returns false only on a genuine error (a confinement failure on
+   a validated path or an I/O error), which fails the run. */
+static bool delete_missing_args_budgeted_observed(const Config* config,
+                                                  const DeleteManifest* manifest,
+                                                  DeleteBudgetState* budget,
+                                                  DeletePathObserver observer,
+                                                  void* observer_context) {
+  if (!config || !manifest)
+    return false;
+  if (!manifest->missing || manifest->missing->size == 0)
+    return true;
+  fprintf(stderr, "Deleting destination mirrors of missing source arguments...\n");
+  /* The staging directory and basis snapshots stay protected exactly as in the
+     extras walker (the missing-args path overrides the ordinary protected
+     prefixes, so those are not passed here). */
+  DeleteSkipSet skips;
+  if (!delete_skips_build(config, NULL, NULL, true, &skips))
+    return false;
+  bool ok = true;
+  for (int i = 0; i < manifest->missing->size; i++) {
+    const char* rel = (const char*)manifest->missing->items[i];
+    if (!rel || *rel == '\0' || *rel == '/' || has_path_traversal(rel)) {
+      /* Defensive only: receive_manifest_entries already validated every
+         section identically, so a controlled peer never reaches this branch. */
+      log_message(LOG_LEVEL_ERROR, "invalid missing-args delete path");
+      ok = false;
+      continue;
+    }
+    bool at_root = strchr(rel, '/') == NULL;
+    if (path_under_skip_prefix(rel, at_root, skips.entries, skips.count)) {
+      char* escaped = output_escape(rel, log_get_8_bit_output());
+      log_message(LOG_LEVEL_WARNING,
+                  "missing-args path '%s' is protected (staging directory or basis snapshot); "
+                  "not deleting",
+                  escaped ? escaped : "<allocation failed>");
+      free(escaped);
+      continue;
+    }
+    char* full = path_cat(config->receive_root_directory, rel);
+    if (!full) {
+      ok = false;
+      continue;
+    }
+    char* leaf = NULL;
+    int parent_fd = file_open_secure_parent(full, &leaf, false);
+    if (parent_fd < 0) {
+      /* The mirror's parent directory may itself not exist on the destination
+         (a deeper missing entry whose leading directories were never created).
+         That is a no-op -- there is nothing to delete -- matching
+         file_remove_tree_secure's absent-path handling; only a genuine I/O
+         error (EACCES, a symlink loop, ...) fails the run. */
+      bool absent = errno == ENOENT || errno == ENOTDIR;
+      free(full);
+      free(leaf);
+      if (!absent)
+        ok = false;
+      continue;
+    }
+    struct stat st;
+    if (fstatat(parent_fd, leaf, &st, AT_SYMLINK_NOFOLLOW) != 0) {
+      /* Already absent: nothing to delete (a no-op, not a deletion). */
+      if (errno != ENOENT)
+        ok = false;
+      close(parent_fd);
+      free(leaf);
+      free(full);
+      continue;
+    }
+    /* An entry that exists is one deletion: skip it (and count it) when the
+       shared --max-delete budget is already exhausted. */
+    if (budget->deleted >= budget->max_delete) {
+      budget->limit_hit = true;
+      budget->skipped++;
+      close(parent_fd);
+      free(leaf);
+      free(full);
+      continue;
+    }
+    bool removed = false;
+    if (S_ISDIR(st.st_mode)) {
+      if (unlinkat(parent_fd, leaf, AT_REMOVEDIR) == 0) {
+        removed = true;
+      } else if (errno == ENOTEMPTY || errno == EEXIST) {
+        close(parent_fd);
+        parent_fd = -1;
+        free(leaf);
+        leaf = NULL;
+        if (config->use_delete || config->force_delete) {
+          /* Remove the contents entry-by-entry through the budgeted extras
+             walker so every deleted file/dir counts toward --max-delete (rsync
+             parity); the now-empty directory itself costs one more.  A run that
+             hits the cap leaves the remaining entries in place. */
+          ArrayList* no_keeps = array_list_create(free);
+          /* Never let an accounting slip (deleted > max_delete) underflow the
+             remaining budget into SIZE_MAX, which would grant unlimited
+             deletions. */
+          size_t remaining =
+              budget->deleted >= budget->max_delete ? 0 : budget->max_delete - budget->deleted;
+          size_t contents_deleted = 0;
+          size_t contents_skipped = 0;
+          PrefixedDeleteObserver nested = {observer, observer_context, rel};
+          DeleteWalkResult walk =
+              no_keeps ? delete_extras_limited_observed(full, no_keeps, NULL, remaining, NULL, 0,
+                                                        NULL, &contents_deleted, &contents_skipped,
+                                                        observer ? prefixed_delete_observer : NULL,
+                                                        observer ? &nested : NULL)
+                       : DELETE_WALK_ERROR;
+          if (no_keeps)
+            array_list_delete(no_keeps);
+          budget->deleted += contents_deleted;
+          budget->skipped += contents_skipped;
+          if (walk == DELETE_WALK_LIMIT_REACHED) {
+            budget->limit_hit = true;
+          } else if (walk != DELETE_WALK_OK) {
+            ok = false;
+          } else if (budget->deleted >= budget->max_delete) {
+            budget->limit_hit = true;
+            budget->skipped++;
+          } else if (file_remove_tree_secure(full)) {
+            /* The shared `if (removed)` tail charges this directory exactly
+               once; counting it here too would consume two budget units. */
+            removed = true;
+          } else {
+            ok = false;
+          }
+        } else {
+          char* escaped = output_escape(rel, log_get_8_bit_output());
+          log_message(LOG_LEVEL_WARNING,
+                      "missing-args destination '%s' is a non-empty directory; use --force or "
+                      "--delete to remove it",
+                      escaped ? escaped : "<allocation failed>");
+          free(escaped);
+        }
+      } else if (errno != ENOENT) {
+        ok = false;
+      }
+    } else {
+      if (unlinkat(parent_fd, leaf, 0) == 0) {
+        removed = true;
+      } else if (errno != ENOENT) {
+        ok = false;
+      }
+    }
+    if (removed) {
+      budget->deleted++;
+      if (observer)
+        observer(observer_context, rel);
+      char* escaped = output_escape(rel, log_get_8_bit_output());
+      fprintf(stderr, "  Deleted: %s\n", escaped ? escaped : "<allocation failed>");
+      free(escaped);
+    }
+    if (parent_fd >= 0)
+      close(parent_fd);
+    free(leaf);
+    free(full);
+    if (!ok)
+      break;
+  }
+  delete_skips_free(&skips);
+  return ok;
+}
+
+/* Public wrappers used outside the commit path (and by unit tests): no
+   --max-delete budget. */
+bool manifest_would_delete_list(const Config* config, const DeleteManifest* manifest,
+                                ArrayList* out, size_t* count_out) {
+  if (count_out)
+    *count_out = 0;
+  if (!config || !manifest || !manifest->keeps || !out)
+    return false;
+  DeleteSkipSet skips;
+  if (!delete_skips_build(config, manifest->protected, NULL, true, &skips))
+    return false;
+  bool ok = delete_extras_list(config->receive_root_directory, manifest->keeps, manifest->dirs,
+                               skips.entries, skips.count, config->protect_rules, out, count_out);
+  delete_skips_free(&skips);
+  return ok;
+}
+
+bool manifest_delete_extras(const Config* config, const DeleteManifest* manifest) {
+  DeleteBudgetState budget = {
+      .max_delete = SIZE_MAX, .deleted = 0, .skipped = 0, .limit_hit = false};
+  return delete_extras_budgeted(config, manifest, &budget);
+}
+
+bool manifest_delete_missing_args(const Config* config, const DeleteManifest* manifest) {
+  DeleteBudgetState budget = {
+      .max_delete = SIZE_MAX, .deleted = 0, .skipped = 0, .limit_hit = false};
+  return delete_missing_args_budgeted_observed(config, manifest, &budget, NULL, NULL);
+}
+
+bool manifest_delete_missing_args_limited(const Config* config, const DeleteManifest* manifest,
+                                          size_t max_delete, size_t* deleted, size_t* skipped,
+                                          bool* limit_hit) {
+  return manifest_delete_missing_args_limited_observed(config, manifest, max_delete, deleted,
+                                                       skipped, limit_hit, NULL, NULL);
+}
+
+bool manifest_delete_missing_args_limited_observed(
+    const Config* config, const DeleteManifest* manifest, size_t max_delete, size_t* deleted,
+    size_t* skipped, bool* limit_hit, DeletePathObserver observer, void* observer_context) {
+  DeleteBudgetState budget = {
+      .max_delete = max_delete, .deleted = 0, .skipped = 0, .limit_hit = false};
+  bool ok =
+      delete_missing_args_budgeted_observed(config, manifest, &budget, observer, observer_context);
+  if (deleted)
+    *deleted = budget.deleted;
+  if (skipped)
+    *skipped = budget.skipped;
+  if (limit_hit)
+    *limit_hit = budget.limit_hit;
+  return ok;
+}
+
+/* Commit every deletion family the manifest carries.  The --delete-missing-args
+   exact-path deletions run FIRST: they are explicit user requests and must not
+   be blocked by the extras walker's filter-exclusion protection (a protected
+   leftover inside a missing-argument directory must not make that user-requested
+   removal fail).  The ordinary extras walk then runs when --delete is active.
+   Both draw from one --max-delete budget; the result reports a cap-stopped
+   (partial) commit distinctly so the client can exit 25 like rsync. */
+DeleteCommitResult manifest_delete_all(const Config* config, const DeleteManifest* manifest) {
+  return manifest_delete_all_counted(config, manifest, NULL);
+}
+
+DeleteCommitResult manifest_delete_all_counted(const Config* config, const DeleteManifest* manifest,
+                                               size_t* deleted) {
+  return manifest_delete_all_observed(config, manifest, deleted, NULL, NULL);
+}
+
+DeleteCommitResult manifest_delete_all_observed(const Config* config,
+                                                const DeleteManifest* manifest, size_t* deleted,
+                                                DeletePathObserver observer,
+                                                void* observer_context) {
+  if (deleted)
+    *deleted = 0;
+  if (!config || !manifest)
+    return DELETE_COMMIT_ERROR;
+  /* Central no-mutation guard: a dry-run never deletes.  No manifest is sent on
+     the dry-run path, but a hostile/buggy peer could; treat it as a no-op so
+     the receiver can never remove anything. */
+  if (config->dry_run)
+    return DELETE_COMMIT_OK;
+  /* A client --max-delete=NUM smaller than the server's hard bound replaces it
+     for this run; both still bound the commit. */
+  bool user_limited =
+      config->max_delete >= 0 && (size_t)config->max_delete < MAX_SERVER_DELETE_COUNT;
+  DeleteBudgetState budget = {.max_delete = user_limited ? (size_t)config->max_delete
+                                                         : MAX_SERVER_DELETE_COUNT,
+                              .deleted = 0,
+                              .skipped = 0,
+                              .limit_hit = false};
+  if (config->delete_missing_args &&
+      !delete_missing_args_budgeted_observed(config, manifest, &budget, observer, observer_context))
+    return DELETE_COMMIT_ERROR;
+  if (config->use_delete &&
+      !delete_extras_budgeted_observed(config, manifest, &budget, observer, observer_context))
+    return DELETE_COMMIT_ERROR;
+  if (deleted)
+    *deleted = budget.deleted;
+  if (budget.limit_hit) {
+    if (user_limited) {
+      log_message(LOG_LEVEL_ERROR, "Deletions stopped due to --max-delete limit (%zu skipped)",
+                  budget.skipped);
+    } else {
+      log_message(LOG_LEVEL_ERROR,
+                  "Deletions stopped due to the server deletion limit of %u (%zu skipped)",
+                  (unsigned)MAX_SERVER_DELETE_COUNT, budget.skipped);
+    }
+    return DELETE_COMMIT_LIMIT_REACHED;
+  }
+  return DELETE_COMMIT_OK;
+}
@@ -0,0 +1,105 @@
+#ifndef DELETE_COMMIT_H
+#define DELETE_COMMIT_H
+
+#include "array_list.h"
+#include "config.h"
+#include "delete.h"
+#include <stdbool.h>
+
+/* Delete-commit module: delete-manifest receive plus the budgeted extras and
+ * --delete-missing-args walkers.  These declarations are re-exported by the
+ * file_receive.h facade. */
+
+/* A received delete-manifest frame: the keep-set (`keeps`, destination-relative
+   paths the sender transferred/keeps) plus `protected`, destination-relative
+   prefixes the sender asks the receiver never to delete (paths excluded on the
+   source, protected at any depth).  When --delete-excluded is given the sender
+   transmits an empty protected list so excluded destination mirrors are treated
+   as ordinary extras.  With --delete-missing-args a third section (`missing`)
+   carries the destination mirrors of explicitly-listed source entries that do
+   not exist: each is an exact deletion request, independent of the ordinary
+   extras walk (never blocked by the protected prefixes) and processed when the
+   manifest is committed. */
+typedef struct DeleteManifest {
+  ArrayList* keeps;
+  ArrayList* protected;
+  ArrayList* missing;
+  /* Destination-relative paths of the directories the sender synchronized for
+     this run.  The extras walker only removes entries directly inside one of
+     these (the receive root is the "." sentinel); `--files-from` runs therefore
+     leave untransmitted directories and the unlisted parts of listed ones
+     alone, matching rsync's "delete only in synchronized directories". */
+  ArrayList* dirs;
+} DeleteManifest;
+
+void delete_manifest_free(DeleteManifest* manifest);
+/* Read a delete-manifest frame (protocol 2.23.0): keep count + keeps, then
+   protected count + protected prefixes, then missing count + missing paths,
+   then synchronized-directory count + directory paths (self-delimiting; the
+   leading STATUS_MANIFEST code has been consumed).  Returns an owned
+   DeleteManifest, or NULL after signalling STATUS_ERROR on a malformed frame. */
+DeleteManifest* receive_manifest_entries(int fd);
+/* Remove destination entries under config->receive_root_directory that are not
+   in `manifest` (bounded, all-or-nothing walk; staging-dir, basis-dir and
+   protected-prefix skips).  `--max-delete` and `--force` are honored here.  The
+   caller decides WHEN to run it based on the negotiated delete timing.  Returns
+   false (and the transfer fails) when the deletion cannot be committed. */
+bool manifest_delete_extras(const Config* config, const DeleteManifest* manifest);
+/* --delete-missing-args exact-path deletions: remove each destination mirror
+   in `manifest->missing` (never blocked by the protected prefixes, staging dir
+   and basis dirs excluded).  A regular file/symlink is unlinked; an empty
+   directory is removed; a NON-empty directory is removed recursively only when
+   --delete or --force is in effect, otherwise it is left with a warning (rsync
+   parity).  A missing path is a no-op.  Returns false only on a genuine
+   confinement or I/O error (the run then fails); tolerated per-path cases are
+   reported and skipped. */
+bool manifest_delete_missing_args(const Config* config, const DeleteManifest* manifest);
+/* Budgeted form of manifest_delete_missing_args for the per-directory delete
+   session: each removed mirror draws from `max_delete` (SIZE_MAX = unlimited)
+   and the tallies are accumulated into `*deleted`/`*skipped`.  `*limit_hit` is set
+   when the budget stopped the pass with entries left over.  Returns false only
+   on a genuine deletion error. */
+bool manifest_delete_missing_args_limited(const Config* config, const DeleteManifest* manifest,
+                                          size_t max_delete, size_t* deleted, size_t* skipped,
+                                          bool* limit_hit);
+/* Observer-aware form of manifest_delete_missing_args_limited: `observer` (may
+   be NULL) is invoked for every destination-relative path truly removed. */
+bool manifest_delete_missing_args_limited_observed(
+    const Config* config, const DeleteManifest* manifest, size_t max_delete, size_t* deleted,
+    size_t* skipped, bool* limit_hit, DeletePathObserver observer, void* observer_context);
+/* Outcome of committing a delete manifest.  LIMIT_REACHED reports rsync's
+   partial --max-delete result: the budget allowed some deletions and the rest
+   were skipped (the run still stores all file data but the client exits 25). */
+typedef enum {
+  DELETE_COMMIT_OK = 0,
+  DELETE_COMMIT_LIMIT_REACHED,
+  DELETE_COMMIT_ERROR
+} DeleteCommitResult;
+
+/* Run every deletion family the manifest carries: the --delete-missing-args
+   exact-path deletions first (user requests are not blocked by exclusion
+   protection), then the ordinary extras walk when --delete is active.  Both
+   share one --max-delete budget.  Returns DELETE_COMMIT_OK when nothing was to
+   do or everything committed, DELETE_COMMIT_LIMIT_REACHED when the budget
+   stopped part of the work, or DELETE_COMMIT_ERROR on a genuine failure. */
+DeleteCommitResult manifest_delete_all(const Config* config, const DeleteManifest* manifest);
+/* Like manifest_delete_all, but reports how many destination entries the commit
+   removed (for the end-of-transfer wire stats).  `deleted` may be NULL. */
+DeleteCommitResult manifest_delete_all_counted(const Config* config, const DeleteManifest* manifest,
+                                               size_t* deleted);
+/* Observer-aware form of manifest_delete_all_counted: `observer` (may be NULL)
+   is invoked for every destination-relative path truly removed. */
+DeleteCommitResult manifest_delete_all_observed(const Config* config,
+                                                const DeleteManifest* manifest, size_t* deleted,
+                                                DeletePathObserver observer,
+                                                void* observer_context);
+
+/* -n/--dry-run --delete would-delete reporting: walk the destination exactly as
+   the delete pass would and append (strdup'd) destination-relative paths that
+   WOULD be removed to `out`, without touching disk.  Uses the same staging-dir,
+   basis-dir and protected-prefix skips as the real commit.  Returns true on a
+   clean walk; `*count_out` receives the number of paths appended. */
+bool manifest_would_delete_list(const Config* config, const DeleteManifest* manifest,
+                                ArrayList* out, size_t* count_out);
+
+#endif
@@ -2,6 +2,7 @@

 #include "charset.h"
 #include "delay_updates.h"
+#include "delete.h"
 #include "file.h"
 #include "log.h"
 #include "utils.h"
@@ -432,6 +433,17 @@ int delete_plan_send_remaining(int fd, DeletePlanSender* sender, const ArrayList
  return 0;
 }

+int delete_plan_send_all(int fd, DeletePlanSender* sender, const ArrayList* dirs) {
+  if (!sender)
+    return -1;
+  /* Root first: this also transmits the one-shot per-run config block on its
+     own carrier frame (see send_config_only), so it reaches the receiver even
+     when the scope permits no directory plan at all. */
+  if (delete_plan_send_root(fd, sender) != 0)
+    return -1;
+  return delete_plan_send_remaining(fd, sender, dirs);
+}
+
 /* ------------------------------------------------------------------ */
 /* Receiver: delete session                                           */
 /* ------------------------------------------------------------------ */
@@ -471,6 +483,24 @@ static void notify_deleted(DeletePlanSession* session, const char* rel) {
    session->observer(session->observer_context, rel);
 }

+/* A removed directory is reported with rsync's trailing slash (`deleting dir/`)
+   while files keep their bare path. */
+static void notify_deleted_dir(DeletePlanSession* session, const char* rel) {
+  if (!session || !session->observer || !rel)
+    return;
+  size_t len = strlen(rel);
+  char* with_slash = malloc(len + 2);
+  if (!with_slash) {
+    session->observer(session->observer_context, rel);
+    return;
+  }
+  memcpy(with_slash, rel, len);
+  with_slash[len] = '/';
+  with_slash[len + 1] = '\0';
+  session->observer(session->observer_context, with_slash);
+  free(with_slash);
+}
+
 DeletePlanSession* delete_plan_session_create(const Config* config) {
  if (!config)
    return NULL;
@@ -572,9 +602,8 @@ static int open_plan_dir(const Config* config, const char* dir) {
  return fd;
 }

-typedef struct PlanSkips {
-  DeleteSkipEntry* entries;
-  int count;
+typedef struct {
+  DeleteSkipSet set;
  /* Receiver-side delete-protection rules received on the config frame (NULL
     when the sender sent none).  Evaluated per extra so a protect/risk rule is
     honored under --delete-during/--delete-delay exactly like the whole-tree
@@ -584,39 +613,12 @@ typedef struct PlanSkips {

 static bool build_plan_skips(const Config* config, const DeletePlanSession* session,
                             PlanSkips* out) {
-  out->entries = NULL;
-  out->count = 0;
  out->protect_rules = config->protect_rules;
-  int count = (config->delay_updates ? 1 : 0) + config->basis_count +
-              session->protected_prefixes->size + session->size_skipped->size;
-  if (count == 0)
-    return true;
-  out->entries = calloc((size_t)count, sizeof(DeleteSkipEntry));
-  if (!out->entries)
-    return false;
-  int idx = 0;
-  if (config->delay_updates) {
-    out->entries[idx].prefix = DELAY_UPDATES_STAGING_DIR;
-    out->entries[idx].top_level_only = true;
-    idx++;
-  }
-  for (int i = 0; i < config->basis_count; i++) {
-    out->entries[idx].prefix = config->basis_dirs[i].path;
-    out->entries[idx].top_level_only = false;
-    idx++;
-  }
-  for (int i = 0; i < session->protected_prefixes->size; i++) {
-    out->entries[idx].prefix = (const char*)session->protected_prefixes->items[i];
-    out->entries[idx].top_level_only = false;
-    idx++;
-  }
-  for (int i = 0; i < session->size_skipped->size; i++) {
-    out->entries[idx].prefix = (const char*)session->size_skipped->items[i];
-    out->entries[idx].top_level_only = false;
-    idx++;
-  }
-  out->count = idx;
-  return true;
+  /* The per-directory plan walk keeps each basis path verbatim (it does not
+     convert an absolute under-root path to its root-relative form, unlike the
+     whole-tree commit walk). */
+  return delete_skips_build(config, session->protected_prefixes, session->size_skipped, false,
+                            &out->set);
 }

 static bool budget_available(const DeletePlanSession* session) {
@@ -696,7 +698,7 @@ static bool process_extra_dir(int dirfd, const char* name, const char* child_rel
    session->deleted++;
    session->planned++;
    log_deleted(child_rel);
-    notify_deleted(session, child_rel);
+    notify_deleted_dir(session, child_rel);
    *removed = true;
    return true;
  }
@@ -733,81 +735,108 @@ static bool process_children(int dirfd, const char* dir_rel, const ArrayList* ke
                             const ArrayList* keep_files, bool at_root, bool force_now,
                             const PlanSkips* skips, DeletePlanSession* session, bool* survives) {
  *survives = false;
-  int scanfd = openat(dirfd, ".", O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-  if (scanfd < 0)
+  DeleteDirEntry* entries = NULL;
+  size_t count = 0;
+  bool collect_ok = true;
+  if (!delete_dir_entries_collect(dirfd, &entries, &count, &collect_ok))
    return false;
-  DIR* dir = fdopendir(scanfd);
-  if (!dir) {
-    close(scanfd);
+  bool operation_ok = collect_ok;
+  bool local_survives = false;
+  bool* shielded = calloc(count ? count : 1, sizeof(bool));
+  bool* is_extra = calloc(count ? count : 1, sizeof(bool));
+  bool* force = calloc(count ? count : 1, sizeof(bool));
+  if (!shielded || !is_extra || !force) {
+    free(shielded);
+    free(is_extra);
+    free(force);
+    delete_dir_entries_free(entries, count);
    return false;
  }
-  bool operation_ok = true;
-  bool local_survives = false;
-  const struct dirent* entry;
-  while ((entry = readdir(dir)) != NULL) {
-    if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
-      continue;
+
+  /* rsync's order: extraneous subdirectories in descending name order, then
+     extraneous files in descending name order (kept entries survive and are not
+     touched here — a kept subdirectory gets its own per-directory plan). */
+  if (count > 1)
+    qsort(entries, count, sizeof(*entries), delete_dir_entry_cmp_desc);
+  size_t dir_count = 0;
+  while (dir_count < count && entries[dir_count].is_dir)
+    dir_count++;
+
+  for (size_t i = 0; i < count; i++) {
    char* child_rel =
-        (strcmp(dir_rel, ".") == 0) ? str_dup(entry->d_name) : path_cat(dir_rel, entry->d_name);
+        (strcmp(dir_rel, ".") == 0) ? str_dup(entries[i].name) : path_cat(dir_rel, entries[i].name);
    if (!child_rel) {
      operation_ok = false;
      continue;
    }
-    if (path_under_skip_prefix(child_rel, at_root, skips->entries, skips->count)) {
+    if (path_under_skip_prefix(child_rel, at_root, skips->set.entries, skips->set.count)) {
+      shielded[i] = true;
      local_survives = true;
      free(child_rel);
      continue;
    }
-    struct stat st;
-    if (fstatat(dirfd, entry->d_name, &st, AT_SYMLINK_NOFOLLOW) != 0) {
-      if (errno != ENOENT)
-        operation_ok = false;
-      free(child_rel);
-      continue;
-    }
-    bool is_dir = S_ISDIR(st.st_mode);
-    bool in_keep_dirs = is_dir && list_contains_str(keep_dirs, entry->d_name);
-    bool in_keep_files = !is_dir && list_contains_str(keep_files, entry->d_name);
+    bool is_dir = entries[i].is_dir;
+    bool in_keep_dirs = is_dir && list_contains_str(keep_dirs, entries[i].name);
+    bool in_keep_files = !is_dir && list_contains_str(keep_files, entries[i].name);
    bool rule_protected =
        skips->protect_rules &&
-        filter_rules_apply_side(skips->protect_rules, child_rel, entry->d_name, is_dir,
+        filter_rules_apply_side(skips->protect_rules, child_rel, entries[i].name, is_dir,
                                FILTER_SIDE_RECEIVER) == FILTER_ACTION_PROTECT;
-    if (in_keep_dirs) {
+    if (in_keep_dirs || in_keep_files || rule_protected) {
+      shielded[i] = true;
      local_survives = true;
-    } else if (keep_dirs && !is_dir && list_contains_str(keep_dirs, entry->d_name)) {
-      /* Destination file blocks a source directory: clear it now, whatever the
-         delete timing, so the directory can be created. */
-      if (!process_extra_file(dirfd, entry->d_name, child_rel, true, session))
-        operation_ok = false;
-    } else if (in_keep_files) {
-      local_survives = true;
-    } else if (keep_files && is_dir && list_contains_str(keep_files, entry->d_name)) {
-      /* Destination directory blocks a source file: remove it now. */
-      bool removed = false;
-      if (!process_extra_dir(dirfd, entry->d_name, child_rel, true, skips, session, &removed))
-        operation_ok = false;
-      else if (!removed)
-        local_survives = true;
    } else if (is_dir) {
-      if (rule_protected) {
-        local_survives = true;
-      } else {
-        bool removed = false;
-        if (!process_extra_dir(dirfd, entry->d_name, child_rel, force_now, skips, session,
-                               &removed))
-          operation_ok = false;
-        else if (!removed)
-          local_survives = true;
-      }
-    } else if (rule_protected) {
-      local_survives = true;
+      /* A destination directory blocks a source file of the same name: remove
+         it now, whatever the delete timing, so the file can be created. */
+      is_extra[i] = true;
+      force[i] = keep_files && list_contains_str(keep_files, entries[i].name);
    } else {
-      if (!process_extra_file(dirfd, entry->d_name, child_rel, force_now, session))
-        operation_ok = false;
+      /* A destination file blocks a source directory of the same name: clear it
+         now so the directory can be created. */
+      is_extra[i] = true;
+      force[i] = keep_dirs && list_contains_str(keep_dirs, entries[i].name);
    }
    free(child_rel);
  }
-  closedir(dir);
+
+  /* Pass 1: extraneous subdirectories, descending. */
+  for (size_t i = 0; i < dir_count; i++) {
+    if (!is_extra[i])
+      continue;
+    char* child_rel =
+        (strcmp(dir_rel, ".") == 0) ? str_dup(entries[i].name) : path_cat(dir_rel, entries[i].name);
+    if (!child_rel) {
+      operation_ok = false;
+      continue;
+    }
+    bool removed = false;
+    if (!process_extra_dir(dirfd, entries[i].name, child_rel, force[i] || force_now, skips, session,
+                           &removed))
+      operation_ok = false;
+    else if (!removed)
+      local_survives = true;
+    free(child_rel);
+  }
+
+  /* Pass 2: extraneous files, descending. */
+  for (size_t i = dir_count; i < count; i++) {
+    if (!is_extra[i])
+      continue;
+    char* child_rel =
+        (strcmp(dir_rel, ".") == 0) ? str_dup(entries[i].name) : path_cat(dir_rel, entries[i].name);
+    if (!child_rel) {
+      operation_ok = false;
+      continue;
+    }
+    if (!process_extra_file(dirfd, entries[i].name, child_rel, force[i] || force_now, session))
+      operation_ok = false;
+    free(child_rel);
+  }
+
+  free(shielded);
+  free(is_extra);
+  free(force);
+  delete_dir_entries_free(entries, count);
  *survives = local_survives;
  return operation_ok;
 }
@@ -827,7 +856,7 @@ static bool apply_plan_dir(DeletePlanSession* session, const Config* config, con
  bool survives = false;
  bool ok = process_children(dirfd, dir, dirs, files, strcmp(dir, ".") == 0, false, &skips, session,
                             &survives);
-  free(skips.entries);
+  delete_skips_free(&skips.set);
  close(dirfd);
  if (!ok)
    log_message(LOG_LEVEL_ERROR, "deletion failed while removing extraneous files");
@@ -932,10 +961,11 @@ static bool apply_deferred_path(DeletePlanSession* session, const Config* config
    return false;
  char* leaf = NULL;
  int parent_fd = file_open_secure_parent(full, &leaf, false);
+  int open_errno = errno;
  free(full);
  if (parent_fd < 0) {
    free(leaf);
-    return errno == ENOENT || errno == ENOTDIR;
+    return open_errno == ENOENT || open_errno == ENOTDIR;
  }
  struct stat st;
  if (fstatat(parent_fd, leaf, &st, AT_SYMLINK_NOFOLLOW) != 0) {
@@ -967,7 +997,7 @@ static bool apply_deferred_path(DeletePlanSession* session, const Config* config
    }
    bool survives = false;
    bool ok = process_children(dirfd, rel, NULL, NULL, false, true, &skips, session, &survives);
-    free(skips.entries);
+    delete_skips_free(&skips.set);
    close(dirfd);
    if (!ok) {
      close(parent_fd);
@@ -981,7 +1011,7 @@ static bool apply_deferred_path(DeletePlanSession* session, const Config* config
        session->deleted++;
        session->planned++;
        log_deleted(rel);
-        notify_deleted(session, rel);
+        notify_deleted_dir(session, rel);
      } else if (errno != ENOENT && errno != ENOTEMPTY && errno != EEXIST) {
        close(parent_fd);
        free(leaf);
@@ -3,6 +3,7 @@

 #include "array_list.h"
 #include "config.h"
+#include "delete.h"
 #include "file_receive.h"
 #include "protocol.h"
 #include "utils.h"
@@ -61,9 +62,19 @@ int delete_plan_send_root(int fd, DeletePlanSender* sender);
 * for `path` itself; already-sent plans are skipped. */
 int delete_plan_send_for_path(int fd, DeletePlanSender* sender, const char* path, bool is_dir);
 /* Send the plan for every directory in `dirs` that has not been transmitted
- * yet.  Called after the data stream so an empty source directory's plan still
- * clears its destination extras even though no file frame triggered it. */
+ * yet. */
 int delete_plan_send_remaining(int fd, DeletePlanSender* sender, const ArrayList* dirs);
+/* Transmit the COMPLETE per-directory plan set in one pass, before any data
+ * frame: the root plan (with the one-shot per-run config block on its carrier
+ * frame) followed by every directory in `dirs`.  Because the whole plan set is
+ * known from the path-only pre-scan, sending it all up front means a
+ * mid-transfer abort has already applied every planned removal, matching
+ * rsync's generator (which runs ahead of its throttled sender).  A completed
+ * run is unaffected.  `dirs` is the set of directories whose direct children
+ * were enumerated (the scanner's plan_dirs sink), so a merely listed but
+ * untraversed directory never gets a plan and its mirror is left intact.
+ * Returns -1 on I/O error. */
+int delete_plan_send_all(int fd, DeletePlanSender* sender, const ArrayList* dirs);

 /* ---- Receiver: delete session ---- */

@@ -25,13 +25,6 @@
 #include "utils.h"
 #include "protocol.h"
 #include "xattr.h"
-#include <fcntl.h>
-#include <unistd.h>
-
-/* Files larger than this are not loaded whole for transfer (the sender streams
- * them); a whole-file digest is computed from the path instead.  Kept in sync
- * with the sender's streaming threshold. */
-#define STREAM_THRESHOLD (64ULL * 1024 * 1024)

 static bool write_all(int fd, const void* data, unsigned long long size) {
  const unsigned char* p = data;
@@ -1136,17 +1129,51 @@ int file_open_private_dir(const char* dir_path) {
  return fd;
 }

-/* Open a --temp-dir scratch directory exactly as rsync does: the directory must
- * already exist and is used as given (an absolute path is used verbatim, a
- * relative one was already resolved against the destination root by the
- * caller).  Unlike file_open_private_dir this neither creates it nor confines
- * it below the receive root, because rsync accepts any temp dir -- including
- * one outside the destination tree or on another filesystem.  Returns an
- * O_DIRECTORY|O_CLOEXEC fd, or -1 on error. */
+/* Open a --temp-dir scratch directory.  The directory must already exist (rsync
+ * never creates it); a relative path was already resolved against the
+ * destination root by the caller.  Unlike file_open_private_dir this neither
+ * creates it nor requires it to be a direct child of the receive root, because
+ * rsync permits a scratch dir that (via a symlink) lands on another filesystem
+ * -- but it MUST resolve inside the authorized receive root.  The directory is
+ * opened following symlinks and then judged by the REAL path of the opened fd
+ * (through /proc/self/fd), so a client-planted symlink under the receive root
+ * can never redirect receiver scratch files outside the sandbox while an
+ * in-root link to another filesystem (the EXDEV fallback case) still works.
+ * Returns an O_DIRECTORY|O_CLOEXEC fd, or -1 on error (errno set; an escaping
+ * target is reported as EACCES with a logged reason). */
 int file_open_temp_dir(const char* dir_path) {
  if (!dir_path)
    return -1;
-  return open(dir_path, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+  int fd = open(dir_path, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+  if (fd < 0)
+    return -1;
+  const char* root = utils_get_authorized_root_path();
+  if (!root) {
+    /* No authorized root (e.g. a local batch apply): nothing to confine
+       against, so preserve the historical open-as-given behavior. */
+    return fd;
+  }
+  char fd_path[64];
+  int fd_path_length = snprintf(fd_path, sizeof(fd_path), "/proc/self/fd/%d", fd);
+  char resolved[PATH_MAX];
+  if (fd_path_length < 0 || (size_t)fd_path_length >= sizeof(fd_path) ||
+      !realpath(fd_path, resolved)) {
+    int saved_errno = errno;
+    close(fd);
+    errno = saved_errno;
+    return -1;
+  }
+  if (!path_is_within_root(root, resolved)) {
+    char* escaped = output_escape(dir_path, log_get_8_bit_output());
+    log_message(LOG_LEVEL_ERROR,
+                "--temp-dir '%s' resolves outside the authorized receive root; refusing",
+                escaped ? escaped : "<allocation failed>");
+    free(escaped);
+    close(fd);
+    errno = EACCES;
+    return -1;
+  }
+  return fd;
 }

 /* After the content and mode/times are restored on the just-written file, apply
@@ -1155,21 +1182,24 @@ int file_open_temp_dir(const char* dir_path) {
 * destination file) and best-effort: a per-attribute or privilege failure is
 * logged and skipped, never fatal. */
 static void restore_extra_fd(int fd, const FileMetadata* metadata, const FileXattrList* xattrs,
-                             bool fake_super, FileAttrPolicy policy) {
+                             bool fake_super, FileAttrPolicy policy, uint32_t fake_super_rdev_major,
+                             uint32_t fake_super_rdev_minor) {
  xattr_apply_fd(fd, xattrs);
  if (fake_super && metadata) {
    /* Record the ownership that WOULD have been applied: when an explicit
       ownership request (--chown/--usermap/--groupmap/--copy-as or -o/-g) is
       active, the resolved mapping; otherwise the source's own id.  The real
       chown is suppressed (identity_apply_ownership early-returns under
-       --fake-super) so recording never defeats the flag.  Mode/mtime are still
-       replayed (policy-gated) so unprivileged --fake-super keeps working. */
+       --fake-super) so recording never defeats the flag.  The recorded stat is
+       rsync's format; the permission bits are replayed (policy-gated) so
+       unprivileged --fake-super keeps working while mtime comes from the
+       normal metadata path above. */
    uint32_t store_uid;
    uint32_t store_gid;
    identity_resolve_storage_ids((int32_t)metadata->uid, (int32_t)metadata->gid, &store_uid,
                                 &store_gid);
-    fake_super_store_fd(fd, store_uid, store_gid, (uint32_t)metadata->mode, metadata->mtime_sec,
-                        metadata->mtime_nsec);
+    fake_super_store_fd(fd, store_uid, store_gid, (uint32_t)metadata->mode, fake_super_rdev_major,
+                        fake_super_rdev_minor);
    fake_super_restore_fd(fd, policy);
  }
 }
@@ -1179,7 +1209,8 @@ file_to_disk_secure_impl(const char* path, const void* data, unsigned long long
                         bool inplace, bool sparse, bool preallocate, const FileMetadata* metadata,
                         FileAttrPolicy policy, bool update, bool no_replace, bool use_fsync,
                         const char* temp_dir, const FileXattrList* xattrs, bool fake_super,
-                         bool keep_partial, unsigned* dirs_created, const char* count_floor) {
+                         bool keep_partial, unsigned* dirs_created, const char* count_floor,
+                         uint32_t fake_super_rdev_major, uint32_t fake_super_rdev_minor) {
  char* leaf = NULL;
  int dirfd = file_open_secure_parent_counted(path, &leaf, true, dirs_created, count_floor);
  if (dirfd < 0)
@@ -1286,7 +1317,8 @@ file_to_disk_secure_impl(const char* path, const void* data, unsigned long long
            }
          }
          if (ok)
-            restore_extra_fd(fd, metadata, xattrs, fake_super, policy);
+            restore_extra_fd(fd, metadata, xattrs, fake_super, policy, fake_super_rdev_major,
+                             fake_super_rdev_minor);
          if (ok && use_fsync)
            ok = fsync(fd) == 0;
        }
@@ -1404,7 +1436,8 @@ file_to_disk_secure_impl(const char* path, const void* data, unsigned long long
          }
        }
        if (ok)
-          restore_extra_fd(fd, metadata, xattrs, fake_super, policy);
+          restore_extra_fd(fd, metadata, xattrs, fake_super, policy, fake_super_rdev_major,
+                           fake_super_rdev_minor);
        if (ok && use_fsync)
          ok = fsync(fd) == 0;
      }
@@ -1472,7 +1505,8 @@ file_to_disk_secure_impl(const char* path, const void* data, unsigned long long
                "non-atomic copy into the destination directory");
    return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                    policy, update, no_replace, use_fsync, NULL, xattrs, fake_super,
-                                    keep_partial, dirs_created, count_floor);
+                                    keep_partial, dirs_created, count_floor, fake_super_rdev_major,
+                                    fake_super_rdev_minor);
  }
  return ok;
 }
@@ -1482,7 +1516,7 @@ bool file_to_disk_secure(const char* path, const void* data, unsigned long long
                         FileAttrPolicy policy, const char* temp_dir) {
  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                  policy, false, false, false, temp_dir, NULL, false, false, NULL,
-                                  NULL);
+                                  NULL, 0, 0);
 }

 bool file_to_disk_secure_update(const char* path, const void* data, unsigned long long data_size,
@@ -1491,7 +1525,7 @@ bool file_to_disk_secure_update(const char* path, const void* data, unsigned lon
                                const char* temp_dir) {
  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                  policy, true, false, false, temp_dir, NULL, false, false, NULL,
-                                  NULL);
+                                  NULL, 0, 0);
 }

 bool file_to_disk_secure_with_fsync(const char* path, const void* data,
@@ -1500,7 +1534,7 @@ bool file_to_disk_secure_with_fsync(const char* path, const void* data,
                                    FileAttrPolicy policy, bool use_fsync, const char* temp_dir) {
  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                  policy, false, false, use_fsync, temp_dir, NULL, false, false,
-                                  NULL, NULL);
+                                  NULL, NULL, 0, 0);
 }

 bool file_to_disk_secure_no_replace(const char* path, const void* data,
@@ -1509,7 +1543,7 @@ bool file_to_disk_secure_no_replace(const char* path, const void* data,
                                    const char* temp_dir) {
  return file_to_disk_secure_impl(path, data, data_size, false, sparse, preallocate, metadata,
                                  policy, false, true, false, temp_dir, NULL, false, false, NULL,
-                                  NULL);
+                                  NULL, 0, 0);
 }

 /* Receiver write-path variant that also applies the per-file xattrs (-X/-A)
@@ -1524,19 +1558,19 @@ bool file_to_disk_secure_attrs(const char* path, const void* data, unsigned long
                               bool fake_super, bool keep_partial, const char* temp_dir) {
  return file_to_disk_secure_attrs_counted(path, data, data_size, inplace, sparse, preallocate,
                                           metadata, policy, update, no_replace, use_fsync, xattrs,
-                                           fake_super, keep_partial, temp_dir, NULL, NULL);
+                                           fake_super, keep_partial, temp_dir, NULL, NULL, 0, 0);
 }

-bool file_to_disk_secure_attrs_counted(const char* path, const void* data,
-                                       unsigned long long data_size, bool inplace, bool sparse,
-                                       bool preallocate, const FileMetadata* metadata,
-                                       FileAttrPolicy policy, bool update, bool no_replace,
-                                       bool use_fsync, const FileXattrList* xattrs, bool fake_super,
-                                       bool keep_partial, const char* temp_dir,
-                                       unsigned* dirs_created, const char* count_floor) {
+bool file_to_disk_secure_attrs_counted(
+    const char* path, const void* data, unsigned long long data_size, bool inplace, bool sparse,
+    bool preallocate, const FileMetadata* metadata, FileAttrPolicy policy, bool update,
+    bool no_replace, bool use_fsync, const FileXattrList* xattrs, bool fake_super,
+    bool keep_partial, const char* temp_dir, unsigned* dirs_created, const char* count_floor,
+    uint32_t fake_super_rdev_major, uint32_t fake_super_rdev_minor) {
  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                  policy, update, no_replace, use_fsync, temp_dir, xattrs,
-                                  fake_super, keep_partial, dirs_created, count_floor);
+                                  fake_super, keep_partial, dirs_created, count_floor,
+                                  fake_super_rdev_major, fake_super_rdev_minor);
 }

 /* Atomic --link-dest install.  The destination is replaced (via a temporary
@@ -1666,7 +1700,7 @@ static bool file_copy_basis_stream_impl(const char* path, const char* basis_path
        wrote = false;
      }
      if (wrote)
-        restore_extra_fd(fd, metadata, xattrs, fake_super, policy);
+        restore_extra_fd(fd, metadata, xattrs, fake_super, policy, 0, 0);
      if (wrote && use_fsync)
        wrote = fsync(fd) == 0;
      if (close(fd) != 0)
@@ -1815,7 +1849,7 @@ static bool file_to_disk_secure_link_impl(const char* path, const char* basis_pa
      return true;
    return file_to_disk_secure_attrs_counted(
        path, data, data_size, false, false, preallocate, metadata, policy, false, false, use_fsync,
-        xattrs, fake_super, false, temp_dir, dirs_created, count_floor);
+        xattrs, fake_super, false, temp_dir, dirs_created, count_floor, 0, 0);
  }

  if (scratch_dirfd >= 0)
@@ -1859,6 +1893,6 @@ bool file_write_to_disk(const char* path, const void* data, unsigned long long d
                        bool inplace, bool sparse) {
  if (!path || (!data && data_size != 0) || has_path_traversal(path))
    return false;
-  FileAttrPolicy policy = {false, false, false, false};
+  FileAttrPolicy policy = {0};
  return file_to_disk_secure(path, data, data_size, inplace, sparse, false, NULL, policy, NULL);
 }
@@ -103,8 +103,12 @@ bool file_remove_tree_secure(const char* path);
   the authorized root.  Used for the --delay-updates staging directory. */
 int file_open_private_dir(const char* dir_path);

-/* Open an existing --temp-dir scratch directory as-is (absolute or relative;
-   no creation, no root confinement), matching rsync's --temp-dir handling. */
+/* Open an existing --temp-dir scratch directory (relative or absolute; no
+   creation).  When an authorized receive root is configured the directory's
+   REAL path (symlinks resolved) must lie within it, so a client-planted
+   symlink cannot redirect receiver scratch files outside the sandbox; an
+   in-root symlink to another filesystem is still allowed for rsync's EXDEV
+   fallback. */
 int file_open_temp_dir(const char* dir_path);

 /* The file_to_disk_secure* variants write a temporary copy in the destination
@@ -178,13 +182,12 @@ bool file_copy_basis_stream_attrs(const char* path, const char* basis_path,
 * confined secure walk had to create that lie strictly below `count_floor` (a
 * receive-root-relative prefix, or NULL for all).  Used to reproduce rsync's
 * `Number of created files` directory count on a fresh destination. */
-bool file_to_disk_secure_attrs_counted(const char* path, const void* data,
-                                       unsigned long long data_size, bool inplace, bool sparse,
-                                       bool preallocate, const FileMetadata* metadata,
-                                       FileAttrPolicy policy, bool update, bool no_replace,
-                                       bool use_fsync, const FileXattrList* xattrs, bool fake_super,
-                                       bool keep_partial, const char* temp_dir,
-                                       unsigned* dirs_created, const char* count_floor);
+bool file_to_disk_secure_attrs_counted(
+    const char* path, const void* data, unsigned long long data_size, bool inplace, bool sparse,
+    bool preallocate, const FileMetadata* metadata, FileAttrPolicy policy, bool update,
+    bool no_replace, bool use_fsync, const FileXattrList* xattrs, bool fake_super,
+    bool keep_partial, const char* temp_dir, unsigned* dirs_created, const char* count_floor,
+    uint32_t fake_super_rdev_major, uint32_t fake_super_rdev_minor);
 bool file_to_disk_secure_link_attrs_counted(const char* path, const char* basis_path,
                                            const void* data, unsigned long long data_size,
                                            bool preallocate, const FileMetadata* metadata,
@@ -29,6 +29,12 @@ typedef struct FileAttrPolicy {
  bool times;         /* config->preserve_times: apply the source mtime */
  bool atimes;        /* config->preserve_atimes (-U): apply the source atime */
  bool executability; /* config->use_executability (-E): exec-bits-only mode */
+  /* privilege_super_mode_permitted(): when false (SUPER_MODE_OFF / --no-super,
+     or a daemon that did not grant `client owner = yes`), the setuid/setgid/
+     sticky bits are stripped from every applied mode (source mode and any
+     --chmod result) even under --perms.  When true, rsync's exact semantics are
+     preserved: -p copies the special bits and the kernel decides. */
+  bool super_permitted;
 } FileAttrPolicy;

 /* Build the per-attribute policy from a connection's Config.  A NULL config
@@ -2,11 +2,19 @@
 #define FILE_RECEIVE_H

 #include "config.h"
+#include "delete_commit.h"
+#include "file_save.h"
 #include "file_types.h"
+#include "incremental_check.h"
 #include "utils.h"
 #include <stdbool.h>

-/* Server-side file receive/save path. */
+/* Server-side file receive/save path.
+ *
+ * This header is the public facade for the file_receive module family: the
+ * wire receive dispatch (this file) plus the save-to-disk (file_save.h), the
+ * incremental check (incremental_check.h) and the delete-commit
+ * (delete_commit.h) modules. */

 /* Cumulative caps for the deferred directory-time accumulator.  The sender may
 * legitimately split a large tree across repeated STATUS_DIR_TIMES frames, so a
@@ -23,25 +31,6 @@ File* file_receive_dir_time(int file_descriptor, const Config* config);
 File* file_receive_hardlink(int file_descriptor);
 File* file_receive_symlink(int file_descriptor, const Config* config);
 File* file_receive_special(int file_descriptor);
-bool file_special_rdev_valid(int32_t major, int32_t minor, mode_t mode);
-/* Testable basis quick-check / verification policy.  file_basis_quick_match is
- * rsync's metadata quick-check for a basis candidate (equal size is required
- * separately by the caller; this adds the --size-only / mtime / --modify-window
- * leg).  file_basis_content_required reports whether a hit must ALSO be
- * confirmed by a whole-file content digest (--verify-basis; false is the
- * default rsync-parity behavior). */
-bool file_basis_quick_match(const Config* config, const struct stat* st, time_t check_mtime,
-                            long check_mtime_nsec);
-bool file_basis_content_required(const Config* config);
-
-File* receive_incremental_check(int fd, const Config* config, bool* skipped);
-/* Extended variant used by the receiver.  `would_transfer` (may be NULL) is set
- * true only on the server-contacting --dry-run path when the file is not up to
- * date: the receiver has already sent STATUS_DRY_RUN_TRANSFER and returns NULL
- * without storing anything.  On that path `*skipped` is true for an up-to-date
- * (STATUS_OK) file and both flags are false for a genuine error. */
-File* receive_incremental_check_ex(int fd, const Config* config, bool* skipped,
-                                   bool* would_transfer);

 /* P7 Wave D directory-time accumulator.  The receiver collects the metadata of
 * every directory it creates/receives (STATUS_MKDIR with metadata and/or the
@@ -85,126 +74,4 @@ bool dir_time_list_add(DirTimeList* list, const char* wire_path, const FileMetad
 void dir_metadata_list_apply(const DirTimeList* list, const char* root_directory,
                             const Config* config);

-/* A received delete-manifest frame: the keep-set (`keeps`, destination-relative
-   paths the sender transferred/keeps) plus `protected`, destination-relative
-   prefixes the sender asks the receiver never to delete (paths excluded on the
-   source, protected at any depth).  When --delete-excluded is given the sender
-   transmits an empty protected list so excluded destination mirrors are treated
-   as ordinary extras.  With --delete-missing-args a third section (`missing`)
-   carries the destination mirrors of explicitly-listed source entries that do
-   not exist: each is an exact deletion request, independent of the ordinary
-   extras walk (never blocked by the protected prefixes) and processed when the
-   manifest is committed. */
-typedef struct DeleteManifest {
-  ArrayList* keeps;
-  ArrayList* protected;
-  ArrayList* missing;
-  /* Destination-relative paths of the directories the sender synchronized for
-     this run.  The extras walker only removes entries directly inside one of
-     these (the receive root is the "." sentinel); `--files-from` runs therefore
-     leave untransmitted directories and the unlisted parts of listed ones
-     alone, matching rsync's "delete only in synchronized directories". */
-  ArrayList* dirs;
-} DeleteManifest;
-
-void delete_manifest_free(DeleteManifest* manifest);
-/* Read a delete-manifest frame (protocol 2.23.0): keep count + keeps, then
-   protected count + protected prefixes, then missing count + missing paths,
-   then synchronized-directory count + directory paths (self-delimiting; the
-   leading STATUS_MANIFEST code has been consumed).  Returns an owned
-   DeleteManifest, or NULL after signalling STATUS_ERROR on a malformed frame. */
-DeleteManifest* receive_manifest_entries(int fd);
-/* Remove destination entries under config->receive_root_directory that are not
-   in `manifest` (bounded, all-or-nothing walk; staging-dir, basis-dir and
-   protected-prefix skips).  `--max-delete` and `--force` are honored here.  The
-   caller decides WHEN to run it based on the negotiated delete timing.  Returns
-   false (and the transfer fails) when the deletion cannot be committed. */
-bool manifest_delete_extras(const Config* config, DeleteManifest* manifest);
-/* --delete-missing-args exact-path deletions: remove each destination mirror
-   in `manifest->missing` (never blocked by the protected prefixes, staging dir
-   and basis dirs excluded).  A regular file/symlink is unlinked; an empty
-   directory is removed; a NON-empty directory is removed recursively only when
-   --delete or --force is in effect, otherwise it is left with a warning (rsync
-   parity).  A missing path is a no-op.  Returns false only on a genuine
-   confinement or I/O error (the run then fails); tolerated per-path cases are
-   reported and skipped. */
-bool manifest_delete_missing_args(const Config* config, DeleteManifest* manifest);
-/* Budgeted form of manifest_delete_missing_args for the per-directory delete
-   session: each removed mirror draws from `max_delete` (SIZE_MAX = unlimited)
-   and the tallies are accumulated into `*deleted`/`*skipped`.  `*limit_hit` is set
-   when the budget stopped the pass with entries left over.  Returns false only
-   on a genuine deletion error. */
-bool manifest_delete_missing_args_limited(const Config* config, DeleteManifest* manifest,
-                                          size_t max_delete, size_t* deleted, size_t* skipped,
-                                          bool* limit_hit);
-/* Observer-aware form of manifest_delete_missing_args_limited: `observer` (may
-   be NULL) is invoked for every destination-relative path truly removed. */
-bool manifest_delete_missing_args_limited_observed(const Config* config, DeleteManifest* manifest,
-                                                   size_t max_delete, size_t* deleted,
-                                                   size_t* skipped, bool* limit_hit,
-                                                   DeletePathObserver observer,
-                                                   void* observer_context);
-/* Outcome of committing a delete manifest.  LIMIT_REACHED reports rsync's
-   partial --max-delete result: the budget allowed some deletions and the rest
-   were skipped (the run still stores all file data but the client exits 25). */
-typedef enum {
-  DELETE_COMMIT_OK = 0,
-  DELETE_COMMIT_LIMIT_REACHED,
-  DELETE_COMMIT_ERROR
-} DeleteCommitResult;
-
-/* Run every deletion family the manifest carries: the --delete-missing-args
-   exact-path deletions first (user requests are not blocked by exclusion
-   protection), then the ordinary extras walk when --delete is active.  Both
-   share one --max-delete budget.  Returns DELETE_COMMIT_OK when nothing was to
-   do or everything committed, DELETE_COMMIT_LIMIT_REACHED when the budget
-   stopped part of the work, or DELETE_COMMIT_ERROR on a genuine failure. */
-DeleteCommitResult manifest_delete_all(const Config* config, DeleteManifest* manifest);
-/* Like manifest_delete_all, but reports how many destination entries the commit
-   removed (for the end-of-transfer wire stats).  `deleted` may be NULL. */
-DeleteCommitResult manifest_delete_all_counted(const Config* config, DeleteManifest* manifest,
-                                               size_t* deleted);
-/* Observer-aware form of manifest_delete_all_counted: `observer` (may be NULL)
-   is invoked for every destination-relative path truly removed. */
-DeleteCommitResult manifest_delete_all_observed(const Config* config, DeleteManifest* manifest,
-                                                size_t* deleted, DeletePathObserver observer,
-                                                void* observer_context);
-
-/* -n/--dry-run --delete would-delete reporting: walk the destination exactly as
-   the delete pass would and append (strdup'd) destination-relative paths that
-   WOULD be removed to `out`, without touching disk.  Uses the same staging-dir,
-   basis-dir and protected-prefix skips as the real commit.  Returns true on a
-   clean walk; `*count_out` receives the number of paths appended. */
-bool manifest_would_delete_list(const Config* config, DeleteManifest* manifest, ArrayList* out,
-                                size_t* count_out);
-/* Convert one basis-directory path to the receive-root-relative protection
-   prefix the delete walker uses (NULL when it lies outside the root).  Exposed
-   for unit tests of the root-of-"/" and normalization edge cases. */
-char* file_receive_basis_delete_relative(const Config* config, const char* path);
-
-/* Outcome of a single file_save_to_disk operation.  The receiver needs to
-   distinguish "written" from "skipped" so --remove-source-files can be told
-   which sources were actually stored. */
-typedef enum { FILE_SAVE_ERROR = 0, FILE_SAVE_WRITTEN = 1, FILE_SAVE_SKIPPED = 2 } FileSaveResult;
-
-FileSaveResult file_save_to_disk_full(const char* root_directory, const File* file,
-                                      const Config* config);
-/* Protocol 2.28.0 variant: also reports through `created` (when non-NULL)
- * whether the destination entry did not exist before this save, and through
- * `created_dirs` how many parent directories the confined walk created, so the
- * receiver can build rsync's `Number of created files` breakdown.  The plain
- * file_save_to_disk_full() is this with both out-params NULL. */
-FileSaveResult file_save_to_disk_full_ex(const char* root_directory, const File* file,
-                                         const Config* config, bool* created,
-                                         unsigned* created_dirs);
-bool file_save_to_disk(const char* root_directory, const File* file, const Config* config);
-
-/* Protocol 2.28.0 receiver counter accumulator: fold one successfully saved
- * entry into `stats`, adding its receiver-observed literal bytes and, when
- * `created`, the matching created-by-type counter (regular file / symlink /
- * special) plus `created_dirs` implicitly-created parent directories.
- * Non-first hardlink siblings contribute no literal bytes. */
-void receiver_stats_note_saved(ReceiverStats* stats, const File* file, bool created,
-                               unsigned created_dirs);
-
 #endif
@@ -0,0 +1,48 @@
+#ifndef FILE_SAVE_H
+#define FILE_SAVE_H
+
+#include "config.h"
+#include "file_types.h"
+#include "format.h"
+#include <stdbool.h>
+
+/* Save-to-disk module: regular-file/symlink/hardlink/special install, xattr
+ * application, --fake-super and the --delay-updates staging path.  These
+ * declarations are re-exported by the file_receive.h facade. */
+
+/* Outcome of a single file_save_to_disk operation.  The receiver needs to
+   distinguish "written" from "skipped" so --remove-source-files can be told
+   which sources were actually stored.  FILE_SAVE_FAILED is a per-entry failure
+   (for example a device node that mknodat() refused with EPERM/EACCES): it is
+   logged and counted by the receiver but does NOT abort the transfer, matching
+   rsync's continue-and-exit-partial behavior. */
+typedef enum {
+  FILE_SAVE_ERROR = 0,
+  FILE_SAVE_WRITTEN = 1,
+  FILE_SAVE_SKIPPED = 2,
+  FILE_SAVE_FAILED = 3
+} FileSaveResult;
+
+bool file_special_rdev_valid(int32_t major, int32_t minor, mode_t mode);
+
+FileSaveResult file_save_to_disk_full(const char* root_directory, const File* file,
+                                      const Config* config);
+/* Protocol 2.28.0 variant: also reports through `created` (when non-NULL)
+ * whether the destination entry did not exist before this save, and through
+ * `created_dirs` how many parent directories the confined walk created, so the
+ * receiver can build rsync's `Number of created files` breakdown.  The plain
+ * file_save_to_disk_full() is this with both out-params NULL. */
+FileSaveResult file_save_to_disk_full_ex(const char* root_directory, const File* file,
+                                         const Config* config, bool* created,
+                                         unsigned* created_dirs);
+bool file_save_to_disk(const char* root_directory, const File* file, const Config* config);
+
+/* Protocol 2.28.0 receiver counter accumulator: fold one successfully saved
+ * entry into `stats`, adding its receiver-observed literal bytes and, when
+ * `created`, the matching created-by-type counter (regular file / symlink /
+ * special) plus `created_dirs` implicitly-created parent directories.
+ * Non-first hardlink siblings contribute no literal bytes. */
+void receiver_stats_note_saved(ReceiverStats* stats, const File* file, bool created,
+                               unsigned created_dirs);
+
+#endif
@@ -124,8 +124,12 @@ bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_meta
  }

  /* sendfile cannot encrypt TLS records.  Keep the framing identical but
-     route encrypted transfers through the deadline-aware IO layer. */
-  if (io_get_ssl() != NULL) {
+     route encrypted transfers through the deadline-aware IO layer.  Resolve
+     the transport from the bound session, not the thread-local io_ssl: a
+     worker thread running a TLS transfer has its SSL only on the session it
+     bound, so io_get_ssl() would be NULL there and the raw sendfile() path
+     would be taken on an encrypted socket. */
+  if (protocol_current_ssl() != NULL) {
    unsigned char buffer[64 * 1024];
    unsigned long long remaining = file_size;
    bool ok = true;
@@ -166,6 +170,8 @@ bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_meta
    }
    struct pollfd pfd = {.fd = file_descriptor, .events = POLLOUT};
    int polled = poll(&pfd, 1, timeout);
+    if (polled < 0 && errno == EINTR)
+      continue;
    if (polled <= 0 || (pfd.revents & (POLLERR | POLLHUP | POLLNVAL))) {
      close(fd);
      return false;
@@ -183,6 +189,7 @@ bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_meta
      return false;
    }
    protocol_note_bytes_written((unsigned long long)sent);
+    protocol_throttle_bytes(file_descriptor, (size_t)sent);
  }

  close(fd);
@@ -4,22 +4,12 @@
 #include <ctype.h>
 #include <errno.h>
 #include <limits.h>
-#include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>

-/* Write a diagnostic message into the caller's optional buffer.  A NULL `err`
- * (or a zero size) is a no-op, so a caller that only needs the boolean status
- * may pass NULL without the snprintf-on-NULL undefined behaviour. */
-static void filter_set_error(char* err, size_t err_size, const char* fmt, ...) {
-  if (!err || err_size == 0)
-    return;
-  va_list ap;
-  va_start(ap, fmt);
-  vsnprintf(err, err_size, fmt, ap);
-  va_end(ap);
-}
+/* Write a diagnostic message into the caller's optional buffer. */
+#define filter_set_error utils_set_error

 /* ---- Ordered rule lists ---- */

@@ -172,14 +162,74 @@ static bool is_modifier_char(char c) {
  return c == 's' || c == 'r' || c == 'p' || c == 'x' || c == '/' || c == '!' || c == 'C';
 }

+/* merge/dir-merge rules are the only rules rsync accepts the merge-file
+ * modifiers on. */
+static bool is_merge_rule(RuleKind kind) {
+  return kind == RULE_KIND_MERGE || kind == RULE_KIND_DIR_MERGE;
+}
+
+/* Merge-file modifiers rsync defines but FastSync does not implement:
+ * 'e' exclude the merge file itself, 'n' do not inherit the merge file, 'w'
+ * word-split the merge file.  They are recognized as part of a modifier run on
+ * every rule (so a pure e/n/w token is rejected rather than folded into the
+ * pattern), but are accepted (and ignored) only on merge/dir-merge rules. */
+static bool is_unsupported_modifier_char(char c) {
+  return c == 'e' || c == 'n' || c == 'w';
+}
+
+/* Merge-file modifiers rsync accepts on merge/dir-merge rules: 'e', 'n', 'w'
+ * and '-' (do not transfer the merge file). */
+static bool is_merge_modifier_char(char c) {
+  return c == 'e' || c == 'n' || c == 'w' || c == '-';
+}
+
+/* Characters that count as part of a modifier run for `kind` when deciding
+ * whether a token is a pure modifier run.  e/n/w count on every rule so that a
+ * pure e/n/w token is rejected on non-merge rules; '-' only on merge rules. */
+static bool is_modifier_scan_char(char c, RuleKind kind) {
+  return is_modifier_char(c) || is_unsupported_modifier_char(c) ||
+         (is_merge_rule(kind) && is_merge_modifier_char(c));
+}
+
+/* Characters actually consumed as modifiers for `kind`.  The merge-file
+ * modifiers are consumed only on merge/dir-merge rules; elsewhere e/n/w fall
+ * through to the pattern (so mixed tokens such as "H,!secret" keep their
+ * historical "ecret" pattern). */
+static bool is_consumed_modifier_char(char c, RuleKind kind) {
+  return is_modifier_char(c) || (is_merge_rule(kind) && is_merge_modifier_char(c));
+}
+
+/* Inspect the token that follows a rule name (up to the first space/underscore
+ * or the end).  If the token is composed *solely* of modifier characters and
+ * includes one that is invalid for `kind`, it is unambiguously a modifier run:
+ * return that character so the caller can reject it.  A token that contains any
+ * non-modifier character is a pattern (e.g. "-newfile") and returns '\0', which
+ * keeps the historical parsing of mixed tokens such as "H,!secret" intact. */
+static char unsupported_modifier_in_token(const char* tok, RuleKind kind) {
+  if (*tok == '\0' || *tok == ' ' || *tok == '_')
+    return '\0';
+  char bad = '\0';
+  for (const char* q = tok; *q != '\0' && *q != ' ' && *q != '_'; q++) {
+    if (!is_modifier_scan_char(*q, kind))
+      return '\0';
+    if (!is_merge_rule(kind) && is_unsupported_modifier_char(*q))
+      bad = *q;
+  }
+  return bad;
+}
+
 /* Parse "RULE[,MODIFIERS] [PATTERN]".  On success `kind`, `sides`,
 * `sides_explicit`, `negate`, `anchored_mod`, `perishable`, `xattr`,
 * `cvs_inject` and the pattern span (`pat_start`/`pat_len`, possibly 0 for
- * merge/clear) are filled.  Returns true on success. */
+ * merge/clear) are filled.  Returns true on success.
+ *
+ * On failure `*bad_mod` is set to the offending modifier character when the
+ * rule carried a modifier FastSync does not implement, and left '\0' for a
+ * generic syntax error so callers can emit a precise diagnostic. */
 static bool parse_rule_syntax(const char* text, RuleKind* kind, unsigned* sides,
                              bool* sides_explicit, bool* negate, bool* anchored_mod,
                              bool* perishable, bool* xattr, bool* cvs_inject,
-                              const char** pat_start, size_t* pat_len) {
+                              const char** pat_start, size_t* pat_len, char* bad_mod) {
  const char* p = text;
  *sides = FILTER_SIDE_SENDER | FILTER_SIDE_RECEIVER;
  *sides_explicit = false;
@@ -190,6 +240,7 @@ static bool parse_rule_syntax(const char* text, RuleKind* kind, unsigned* sides,
  *cvs_inject = false;
  *pat_start = NULL;
  *pat_len = 0;
+  *bad_mod = '\0';

  bool is_short = false;
  if (short_rule_char(*p, kind)) {
@@ -210,17 +261,25 @@ static bool parse_rule_syntax(const char* text, RuleKind* kind, unsigned* sides,
  /* Modifiers: long names require a comma; short names may attach directly.
     Only commit a modifier run that terminates at a separator or the end, so a
     pattern such as "*.tmp" written as "-*.tmp" is not mistaken for modifiers. */
+  if (*p == ',') {
+    *bad_mod = unsupported_modifier_in_token(p + 1, *kind);
+  } else if (is_short) {
+    *bad_mod = unsupported_modifier_in_token(p, *kind);
+  }
+  if (*bad_mod != '\0')
+    return false;
+
  const char* mod_start = p;
  const char* mod_end = p;
  if (*p == ',') {
    p++;
    mod_start = p;
-    while (is_modifier_char(*p))
+    while (is_consumed_modifier_char(*p, *kind))
      p++;
    mod_end = p;
  } else if (is_short) {
    const char* scan = p;
-    while (is_modifier_char(*scan))
+    while (is_consumed_modifier_char(*scan, *kind))
      scan++;
    if (*scan == '\0' || *scan == ' ' || *scan == '_') {
      mod_start = p;
@@ -290,9 +349,13 @@ FilterRule* filter_rule_parse(const char* line, const FilterParseOptions* opts,
  bool sides_explicit, negate, anchored_mod, perishable, xattr, cvs_inject;
  const char* pat;
  size_t pat_len;
+  char bad_mod;
  if (!parse_rule_syntax(p, &kind, &sides, &sides_explicit, &negate, &anchored_mod, &perishable,
-                         &xattr, &cvs_inject, &pat, &pat_len)) {
-    filter_set_error(err, err_size, "unrecognized filter rule syntax");
+                         &xattr, &cvs_inject, &pat, &pat_len, &bad_mod)) {
+    if (bad_mod != '\0')
+      filter_set_error(err, err_size, "unsupported filter modifier '%c'", bad_mod);
+    else
+      filter_set_error(err, err_size, "unrecognized filter rule syntax");
    return NULL;
  }
  if (cvs_inject) {
@@ -401,7 +464,6 @@ FilterRule* filter_rule_parse(const char* line, const FilterParseOptions* opts,
  rule->dir_only = dir_only;
  rule->negate = negate;
  rule->perishable = perishable;
-  (void)xattr; /* xattr-name rules never match file/dir names; accepted/ignored */
  return rule;
 }

@@ -530,16 +592,27 @@ static bool filter_list_parse_append_depth(FilterRuleList* list, const char* lin
  bool sides_explicit, negate, anchored_mod, perishable, xattr, cvs_inject;
  const char* pat;
  size_t pat_len;
+  char bad_mod;
  if (!parse_rule_syntax(p, &kind, &sides, &sides_explicit, &negate, &anchored_mod, &perishable,
-                         &xattr, &cvs_inject, &pat, &pat_len)) {
-    filter_set_error(err, err_size, "unrecognized filter rule syntax: %s", p);
+                         &xattr, &cvs_inject, &pat, &pat_len, &bad_mod)) {
+    if (bad_mod != '\0')
+      filter_set_error(err, err_size, "unsupported filter modifier '%c': %s", bad_mod, p);
+    else
+      filter_set_error(err, err_size, "unrecognized filter rule syntax: %s", p);
    return false;
  }
  (void)sides_explicit;
  (void)negate;
  (void)anchored_mod;
  (void)perishable;
-  (void)xattr;
+
+  /* xattr-name rules are not implemented; reject them everywhere (including on
+   * merge/dir-merge, where the flag would otherwise be silently dropped) with
+   * the same diagnostic the standalone parser gives. */
+  if (xattr) {
+    filter_set_error(err, err_size, "xattr-name filter rules (the x modifier) are not supported");
+    return false;
+  }

  if (cvs_inject) {
    /* "C" injects the CVS defaults in place; no pattern is expected. */
@@ -811,8 +884,3 @@ FilterAction filter_rules_apply_side(const FilterRuleList* list, const char* rel
  }
  return FILTER_ACTION_NONE;
 }
-
-FilterAction filter_rules_apply(const FilterRuleList* list, const char* rel_path, const char* leaf,
-                                bool is_dir) {
-  return filter_rules_apply_side(list, rel_path, leaf, is_dir, FILTER_SIDE_SENDER);
-}
@@ -23,7 +23,13 @@
 *   dir-merge/: per-directory merge file (registered for the scanner)
 *   clear/!     clear the current rule list (takes no argument)
 * Modifiers: '/' absolute anchor, '!' negate match, 'C' inject CVS defaults,
- * 's' sender side, 'r' receiver side, 'p' perishable, 'x' xattr name rule.
+ * 's' sender side, 'r' receiver side, 'p' perishable.  The rsync 'x'
+ * (xattr-name) modifier is not implemented and is rejected explicitly
+ * everywhere.  The merge-file modifiers 'e' (exclude the merge file itself),
+ * 'n' (do not inherit the merge file), 'w' (word-split the merge file) and '-'
+ * (do not transfer the merge file) are accepted and consumed only on merge/
+ * dir-merge rules (rejected on every other rule, matching rsync); their
+ * semantics are not implemented and they are otherwise ignored.
 * A trailing '/' makes a pattern match directories only.  A leading '/' anchors
 * the pattern to its owner directory.
 */
@@ -129,9 +135,4 @@ FilterRuleList* filter_file_read(const char* dir_path, const char* owner_rel, bo
 FilterAction filter_rules_apply_side(const FilterRuleList* list, const char* rel_path,
                                     const char* leaf, bool is_dir, unsigned side);

-/* Sender-side convenience wrapper (kept for callers/tests that only need the
- * transfer decision). */
-FilterAction filter_rules_apply(const FilterRuleList* list, const char* rel_path, const char* leaf,
-                                bool is_dir);
-
 #endif
@@ -3,6 +3,7 @@
 #include "utils.h"
 #include <errno.h>
 #include <fcntl.h>
+#include <fnmatch.h>
 #include <grp.h>
 #include <limits.h>
 #include <pwd.h>
@@ -12,6 +13,8 @@
 #include <sys/stat.h>
 #include <unistd.h>

+static bool identity_id_fits_int32(unsigned long id);
+
 /* The active identity snapshot lives in a per-process global.  The TCP server
 * forks one child process per connection, so a connection never shares this
 * with another; within a connection the multithreaded receiver reads it without
@@ -419,17 +422,10 @@ static int identity_parse_from(const char* token, bool is_group, int32_t* out_fr
    /* Not a numeric LOW-HIGH range: fall through and treat as a name (a
     * hyphenated account name like "wayne-smith" must still resolve). */
  }
-  /* A sender-side name.  A wildcard other than the bare '*' is matched by rsync
-   * against the sender's names; because FastSync transmits numeric ids only, the
-   * receiver cannot evaluate it, so reject rather than silently mis-match. */
-  if (identity_token_has_glob(token)) {
-    log_message(LOG_LEVEL_ERROR,
-                "%smap FROM '%s': name wildcards other than '*' are not supported "
-                "(FastSync transmits numeric ids, so sender names are unavailable on the "
-                "receiver)",
-                is_group ? "--group" : "--user", token);
-    return -1;
-  }
+  /* A sender-side name.  A FROM name wildcard other than the bare '*' is handled
+   * by identity_expand_from_glob() in the caller (it expands against the
+   * sender's account database at CLI-parse time), so this function only sees the
+   * bare '*' or a literal name here. */
  int32_t id;
  if (identity_resolve_token(token, is_group, &id) != 0)
    return -1;
@@ -486,6 +482,138 @@ static int identity_append_rule(IdentityMap** map, int* count, const IdentityMap
  return 0;
 }

+/* True when `lo` and `hi` are adjacent ids (no overflow at INT32_MAX). */
+static bool identity_ids_adjacent(int32_t lo, int32_t hi) {
+  return lo < INT32_MAX && hi == lo + 1;
+}
+
+static int identity_id_cmp(const void* a, const void* b) {
+  int32_t x = *(const int32_t*)a;
+  int32_t y = *(const int32_t*)b;
+  return (x > y) - (x < y);
+}
+
+static bool identity_ids_push(int32_t** ids, size_t* count, size_t* cap, int32_t id) {
+  if (*count == *cap) {
+    size_t grown_cap = *cap ? *cap * 2 : 16;
+    int32_t* grown = realloc(*ids, grown_cap * sizeof(int32_t));
+    if (!grown)
+      return false;
+    *ids = grown;
+    *cap = grown_cap;
+  }
+  (*ids)[(*count)++] = id;
+  return true;
+}
+
+/* Expand a FROM name wildcard (rsync's match against sender-side account names)
+ * into one rule per contiguous run of matching numeric ids, all sharing the same
+ * TO side.  FastSync transmits numeric ids only, so the wildcard must be
+ * resolved here -- at CLI-parse time -- against the SENDER's passwd/group
+ * database; the receiver has no sender names to match.  Contiguous matched ids
+ * are collapsed into a single LOW-HIGH range (a range of adjacent ids contains
+ * exactly the ids it spans, so this is semantically exact).  Returns 0 on
+ * success, -1 on an allocation failure, a wildcard that matches no sender
+ * account, or an expansion that would push the map past MAX_IDENTITY_MAP. */
+static int identity_expand_from_glob(Config* config, const char* glob, bool is_group,
+                                     const IdentityMap* to_rule) {
+  const char* optname = is_group ? "--groupmap" : "--usermap";
+  size_t cap = 0;
+  size_t n = 0;
+  int32_t* ids = NULL;
+  bool alloc_failed = false;
+
+  if (is_group) {
+    setgrent();
+    struct group* gr;
+    while ((gr = getgrent()) != NULL) {
+      if (fnmatch(glob, gr->gr_name, 0) != 0)
+        continue;
+      if (!identity_id_fits_int32((unsigned long)gr->gr_gid))
+        continue;
+      if (!identity_ids_push(&ids, &n, &cap, (int32_t)gr->gr_gid)) {
+        alloc_failed = true;
+        break;
+      }
+    }
+    endgrent();
+  } else {
+    setpwent();
+    struct passwd* pw;
+    while ((pw = getpwent()) != NULL) {
+      if (fnmatch(glob, pw->pw_name, 0) != 0)
+        continue;
+      if (!identity_id_fits_int32((unsigned long)pw->pw_uid))
+        continue;
+      if (!identity_ids_push(&ids, &n, &cap, (int32_t)pw->pw_uid)) {
+        alloc_failed = true;
+        break;
+      }
+    }
+    endpwent();
+  }
+
+  if (alloc_failed) {
+    free(ids);
+    log_message(LOG_LEVEL_ERROR, "%s: memory allocation failed expanding FROM '%s'", optname, glob);
+    return -1;
+  }
+  if (n == 0) {
+    free(ids);
+    log_message(LOG_LEVEL_ERROR, "%s FROM '%s': no source account name matches the wildcard",
+                optname, glob);
+    return -1;
+  }
+
+  qsort(ids, n, sizeof(int32_t), identity_id_cmp);
+  size_t unique = 0;
+  for (size_t i = 0; i < n; i++) {
+    if (unique == 0 || ids[unique - 1] != ids[i])
+      ids[unique++] = ids[i];
+  }
+  n = unique;
+
+  int runs = 0;
+  for (size_t i = 0; i < n; i++) {
+    if (i == 0 || !identity_ids_adjacent(ids[i - 1], ids[i]))
+      runs++;
+  }
+
+  IdentityMap** map = is_group ? &config->groupmap : &config->usermap;
+  int* count = is_group ? &config->groupmap_count : &config->usermap_count;
+  if (*count > MAX_IDENTITY_MAP - runs) {
+    log_message(LOG_LEVEL_ERROR,
+                "%s FROM '%s': the name wildcard expands to %d rule(s), which would exceed "
+                "the maximum of %d map rules",
+                optname, glob, runs, MAX_IDENTITY_MAP);
+    free(ids);
+    return -1;
+  }
+
+  for (size_t i = 0; i < n;) {
+    size_t j = i;
+    while (j + 1 < n && identity_ids_adjacent(ids[j], ids[j + 1]))
+      j++;
+    IdentityMap rule;
+    rule.from = ids[i];
+    rule.from_hi = ids[j];
+    rule.to = to_rule->to;
+    rule.to_name = to_rule->to_name ? str_dup(to_rule->to_name) : NULL;
+    if (to_rule->to_name && !rule.to_name) {
+      free(ids);
+      return -1;
+    }
+    if (identity_append_rule(map, count, &rule) != 0) {
+      free(rule.to_name);
+      free(ids);
+      return -1;
+    }
+    i = j + 1;
+  }
+  free(ids);
+  return 0;
+}
+
 int identity_parse_map(Config* config, const char* value, bool is_group) {
  if (!config || !value || *value == '\0') {
    log_message(LOG_LEVEL_ERROR, "%smap requires a value", is_group ? "--group" : "--user");
@@ -509,6 +637,30 @@ int identity_parse_map(Config* config, const char* value, bool is_group) {
    char* to_token = colon + 1;
    IdentityMap parsed;
    memset(&parsed, 0, sizeof(parsed));
+    /* A FROM name wildcard (anything with a glob metacharacter other than the
+     * bare '*') is expanded against the sender's account database here, while
+     * the sender's passwd/group DB is still available; the resulting numeric
+     * rules travel on the wire like an explicit list.  The TO side is parsed
+     * first so every expanded rule shares it. */
+    if (strcmp(from_token, "*") != 0 && identity_token_has_glob(from_token)) {
+      if (identity_parse_to(to_token, is_group, &parsed.to, &parsed.to_name) != 0) {
+        log_message(LOG_LEVEL_ERROR, "%s could not parse TO '%s' in '%s'", optname, to_token,
+                    value);
+        free(list);
+        return -1;
+      }
+      if (identity_expand_from_glob(config, from_token, is_group, &parsed) != 0) {
+        free(parsed.to_name);
+        free(list);
+        return -1;
+      }
+      /* Every rule emitted by the expansion took its own str_dup of the name,
+       * so the parse-time copy is unreachable on success: release it here (the
+       * failure path above already does).  `parsed.to_name` is NULL for a
+       * numeric TO. */
+      free(parsed.to_name);
+      continue;
+    }
    if (identity_parse_from(from_token, is_group, &parsed.from, &parsed.from_hi) != 0) {
      log_message(LOG_LEVEL_ERROR,
                  "%s could not resolve FROM '%s' in '%s' (a name must exist on the "
@@ -25,8 +25,14 @@

 /* Parse one --usermap= / --groupmap= value (comma-separated FROM:TO rules,
 * first match wins) into config->usermap / config->groupmap.  is_group selects
- * the group tables and name databases.  Returns 0 on success, -1 on a
- * malformed spec or an unresolvable name (never a silent no-op). */
+ * the group tables and name databases.  A FROM name wildcard (containing `*`,
+ * `?` or `[...]`, but not the bare `*`) is expanded against the SENDER's
+ * account database at parse time into one or more numeric id/range rules
+ * (contiguous ids collapse to a range) sharing the same TO, because only
+ * numeric ids cross the wire; the expansion is capped at MAX_IDENTITY_MAP and a
+ * wildcard matching no account is an error.  Returns 0 on success, -1 on a
+ * malformed spec, an unresolvable name, an unmatched wildcard, or a map that
+ * would exceed MAX_IDENTITY_MAP (never a silent no-op). */
 int identity_parse_map(Config* config, const char* value, bool is_group);

 /* Parse --chown=USER:GROUP.  Supports USER:GROUP, USER (owner only), :GROUP
@@ -0,0 +1,41 @@
+#ifndef INCREMENTAL_CHECK_H
+#define INCREMENTAL_CHECK_H
+
+#include "config.h"
+#include "file_types.h"
+#include "protocol.h"
+#include <stdbool.h>
+
+/* Incremental-check module: the per-file STATUS_CHECK state machine, the
+ * incremental delta / alternate-basis / fuzzy matching helpers and the shared
+ * xattr receive helper.  These declarations are re-exported by the
+ * file_receive.h facade. */
+
+/* Whole-file payload bound shared by the plain receive path and the
+ * incremental check paths. */
+#define MAX_FILE_DATA_SIZE MAX_RECEIVE_WHOLE_FILE_SIZE
+
+/* Receive a file's xattr block (when the config enables xattr transport) and
+ * attach it to `file`.  Returns false on a malformed/oversized frame. */
+bool receive_file_xattrs(File* file, int fd, const Config* config);
+
+File* receive_incremental_check(int fd, const Config* config, bool* skipped);
+/* Extended variant used by the receiver.  `would_transfer` (may be NULL) is set
+ * true only on the server-contacting --dry-run path when the file is not up to
+ * date: the receiver has already sent STATUS_DRY_RUN_TRANSFER and returns NULL
+ * without storing anything.  On that path `*skipped` is true for an up-to-date
+ * (STATUS_OK) file and both flags are false for a genuine error. */
+File* receive_incremental_check_ex(int fd, const Config* config, bool* skipped,
+                                   bool* would_transfer);
+
+/* Testable basis quick-check / verification policy.  file_basis_quick_match is
+ * rsync's metadata quick-check for a basis candidate (equal size is required
+ * separately by the caller; this adds the --size-only / mtime / --modify-window
+ * leg).  file_basis_content_required reports whether a hit must ALSO be
+ * confirmed by a whole-file content digest (--verify-basis; false is the
+ * default rsync-parity behavior). */
+bool file_basis_quick_match(const Config* config, const struct stat* st, time_t check_mtime,
+                            long check_mtime_nsec);
+bool file_basis_content_required(const Config* config);
+
+#endif
@@ -5,6 +5,15 @@
 #include <stdbool.h>
 #include <stdint.h>

+/* Ask the compiler to type-check the printf-style arguments of the variadic
+ * logging helpers.  Only enabled for GNU-compatible compilers (gcc/clang). */
+#if defined(__GNUC__)
+#define LOG_PRINTF_ATTR(fmt_idx, first_vararg_idx)                                                 \
+  __attribute__((format(printf, fmt_idx, first_vararg_idx)))
+#else
+#define LOG_PRINTF_ATTR(fmt_idx, first_vararg_idx)
+#endif
+
 typedef enum { LOG_LEVEL_DEBUG, LOG_LEVEL_INFO, LOG_LEVEL_WARNING, LOG_LEVEL_ERROR } LogLevel;
 typedef enum { LOG_STDERR_ERRORS, LOG_STDERR_ALL } LogStderrMode;

@@ -13,7 +22,19 @@ typedef enum {
  LOG_DEBUG_PROTO = 1u << 1,
  LOG_DEBUG_PACK = 1u << 2,
  LOG_DEBUG_UTIL = 1u << 3,
-  LOG_DEBUG_ALL = (1u << 4) - 1,
+  /* rsync --debug categories that now map to a natural FastSync event:
+   * flist (file-list scan progress), del (deletions), hash/deltasum
+   * (whole-file hashing and delta-sum generation), recv (receiver
+   * responses/signatures), filter (selection/exclusion decisions) and send
+   * (files handed to the sender).  Only emitted when the category is
+   * explicitly enabled; a normal run stays silent. */
+  LOG_DEBUG_FLIST = 1u << 4,
+  LOG_DEBUG_DEL = 1u << 5,
+  LOG_DEBUG_HASH = 1u << 6,
+  LOG_DEBUG_RECV = 1u << 7,
+  LOG_DEBUG_FILTER = 1u << 8,
+  LOG_DEBUG_SEND = 1u << 9,
+  LOG_DEBUG_ALL = (1u << 10) - 1,
 } LogDebugFlag;

 typedef enum {
@@ -38,12 +59,16 @@ typedef enum {
     the info_level bitset (there is no separate Config field) and is never set
     by --info=all (which selects level 1). */
  LOG_INFO_NAME_UPTODATE = 1u << 10,
+  /* --info=mount: print rsync's `[sender] skipping mount-point dir NAME` when
+   * -xx/--one-file-system drops a mount-point directory (FastSync's client is
+   * the sender). */
+  LOG_INFO_MOUNT = 1u << 11,
  LOG_INFO_ALL = LOG_INFO_COPY | LOG_INFO_MISC | LOG_INFO_SKIP | LOG_INFO_STATS | LOG_INFO_DEL |
                 LOG_INFO_REMOVE | LOG_INFO_NAME | LOG_INFO_FLIST | LOG_INFO_NONREG |
-                 LOG_INFO_PROGRESS,
+                 LOG_INFO_PROGRESS | LOG_INFO_MOUNT,
 } LogInfoFlag;

-void log_message(LogLevel log_level, const char* message, ...);
+void log_message(LogLevel log_level, const char* message, ...) LOG_PRINTF_ATTR(2, 3);
 void log_perror(const char* context);
 void set_log_level(LogLevel level);
 void set_log_debug_flags(uint32_t flags);
@@ -52,10 +77,10 @@ uint32_t get_log_debug_flags(void);
 * the debug log level is enabled AND the flag is selected.  Hot paths use this
 * to skip expensive message formatting/escaping when the line is filtered. */
 bool log_debug_enabled(LogDebugFlag flag);
-void log_debug_message(LogDebugFlag flag, const char* message, ...);
+void log_debug_message(LogDebugFlag flag, const char* message, ...) LOG_PRINTF_ATTR(2, 3);
 void set_log_info_flags(uint32_t flags);
 uint32_t get_log_info_flags(void);
-void log_info_message(LogInfoFlag flag, const char* message, ...);
+void log_info_message(LogInfoFlag flag, const char* message, ...) LOG_PRINTF_ATTR(2, 3);
 void log_set_file(FILE* fp);
 void log_set_8_bit_output(bool enabled);
 bool log_get_8_bit_output(void);
@@ -211,13 +211,22 @@ FileMetadata* metadata_receive(int file_descriptor, int* ok) {

 bool metadata_mode_for_policy(mode_t source_mode, mode_t current_mode, FileAttrPolicy policy,
                              mode_t* out_mode) {
+  const mode_t special_bits = (mode_t)(S_ISUID | S_ISGID | S_ISVTX);
  const mode_t execute_bits = S_IXUSR | S_IXGRP | S_IXOTH;
  if (policy.perms) {
    /* rsync --perms copies the source's permission and special bits exactly,
     * including group/other write and setuid/setgid/sticky.  The kernel may
     * still clear setgid when the receiver is not in the file's group; the
-     * caller logs a failed chmod rather than silently masking the bits here. */
-    *out_mode = source_mode & (mode_t)(S_ISUID | S_ISGID | S_ISVTX | 0777);
+     * caller logs a failed chmod rather than silently masking the bits here.
+     * Setuid/setgid/sticky are super-user activities: when the connection did
+     * not permit them (SUPER_MODE_OFF / --no-super) they are stripped, so a
+     * client can never install a privileged bit on a receiver that forbade
+     * super-user activities.  This also covers bits introduced by --chmod,
+     * whose result is fed in as source_mode. */
+    mode_t bits = source_mode & (mode_t)(special_bits | 0777);
+    if (!policy.super_permitted)
+      bits &= ~special_bits;
+    *out_mode = bits;
    return true;
  }
  if (policy.executability) {
@@ -227,8 +236,11 @@ bool metadata_mode_for_policy(mode_t source_mode, mode_t current_mode, FileAttrP
     * execute); otherwise clear every execute bit.  This runs on the
     * destination-derived base (pre-existing dest mode, or source&~umask for a
     * new file), and leaves the special bits untouched.  --perms wins when both
-     * are set (handled above). */
-    mode_t base = current_mode & (mode_t)(S_ISUID | S_ISGID | S_ISVTX | 0777);
+     * are set (handled above).  The destination's own special bits survive
+     * unless super-user activities are forbidden. */
+    mode_t base = current_mode & (mode_t)(special_bits | 0777);
+    if (!policy.super_permitted)
+      base &= ~special_bits;
    if (source_mode & 0111)
      *out_mode = base | ((base & 0444) >> 2);
    else
@@ -240,12 +252,13 @@ bool metadata_mode_for_policy(mode_t source_mode, mode_t current_mode, FileAttrP
 }

 FileAttrPolicy file_attr_policy_from_config(const Config* config) {
-  FileAttrPolicy policy = {false, false, false, false};
+  FileAttrPolicy policy = {0};
  if (config) {
    policy.perms = config->preserve_perms;
    policy.times = config->preserve_times;
    policy.atimes = config->preserve_atimes;
    policy.executability = config->use_executability;
+    policy.super_permitted = privilege_super_mode_permitted(config->super_mode);
  }
  return policy;
 }
@@ -314,6 +327,8 @@ bool file_restore_symlink_metadata(const char* path, const FileMetadata* metadat
     transfer never fails over it. */
  if (policy.perms) {
    mode_t link_mode = metadata->mode & (mode_t)(S_ISUID | S_ISGID | S_ISVTX | 0777);
+    if (!policy.super_permitted)
+      link_mode &= ~(mode_t)(S_ISUID | S_ISGID | S_ISVTX);
    if (fchmodat(parent_fd, leaf, link_mode, AT_SYMLINK_NOFOLLOW) != 0 && errno != EOPNOTSUPP &&
        errno != ENOTSUP && errno != ENOSYS) {
      log_message(LOG_LEVEL_DEBUG, "Could not set symlink mode on %s: %s", path, strerror(errno));
@@ -37,6 +37,7 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
  context->scan_had_io_error = false;
  context->remove_source_files = NULL;
  context->early_delete = false;
+  context->prescan_chunks = NULL;
  context->delete_plans = NULL;
  context->delete_suppressed = false;
  context->scan_stopped_early = false;
@@ -50,6 +51,7 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
  protocol_session_set_max_alloc(&context->allocation_session, config->max_alloc);
  context->dir_entries = NULL;
  context->dir_entries_mutex_init = false;
+  atomic_init(&context->dir_count, 0);
  context->delete_limit = false;
  int init = 0;
  if (config->use_metadata) {
@@ -85,11 +87,13 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
  return context;

 fail:
-  log_perror("Error initializing synchronization objects");
+  log_message(LOG_LEVEL_ERROR, "%s", "Error initializing synchronization objects");
  if (context->dir_entries_mutex_init)
    mtx_destroy(&context->dir_entries_mutex);
  if (context->dir_entries)
    array_list_delete(context->dir_entries);
+  if (init >= 7)
+    mtx_destroy(&context->mutex_progress);
  if (init >= 6)
    cnd_destroy(&context->condition_not_empty_loader);
  if (init >= 5)
@@ -191,6 +195,8 @@ void pipeline_context_sender_destroy(PipelineContextSender* context) {
  if (context->manifest) {
    array_list_delete(context->manifest);
  }
+  if (context->prescan_chunks)
+    array_list_delete(context->prescan_chunks);
  if (context->delete_plans)
    delete_plan_sender_destroy(context->delete_plans);
  if (context->excluded_paths)
@@ -78,6 +78,13 @@ typedef struct {
     path-only pre-scan on the calling thread and the pipeline scanner must not
     append to it.  Set once before the worker threads start. */
  bool early_delete;
+  /* --delete-before: the path-only pre-scan that built the early keep-set,
+     retained as the pipeline's file list (owning Chunk*; consumed and NULLed by
+     the scanner thread) so the data pass replays rsync's single file list
+     instead of re-reading the source.  NULL in every other mode, where the
+     scanner thread scans normally.  Set once before the worker threads start
+     and freed with the context. */
+  ArrayList* prescan_chunks;
  /* Non-NULL for --delete-during/--delete-delay: the per-directory plan set
     prebuilt by the path-only pre-scan on the calling thread.  The sender
     thread transmits the root plan before any data and the remaining plans
@@ -119,6 +126,10 @@ typedef struct {
  ArrayList* dir_entries;
  mtx_t dir_entries_mutex;
  bool dir_entries_mutex_init;
+  /* --stats directory accounting for a `-r` scan (no directory metadata):
+     shared by the parallel scanner workers, read by the sender thread once the
+     scanner is done.  See ScannerOptions.dir_count. */
+  atomic_ullong dir_count;
  /* Set by the sender thread when the receiver reported a --max-delete-capped
     deletion (STATUS_DELETE_LIMIT): the transfer succeeded and the process must
     exit 25 like rsync.  Read by the caller after the sender thread is joined. */
@@ -38,6 +38,129 @@ static atomic_ullong io_bytes_read = 0;

 static unsigned long long global_bwlimit(void);

+/* ------------------------------------------------------------------------- *
+ * Transport vtable implementations.
+ *
+ * Each op performs exactly one transfer attempt.  WANT_READ/WANT_WRITE and an
+ * EINTR-interrupted syscall are reported as PROTOCOL_IO_RETRY (with
+ * *wait_events set to the poll event the caller must wait on); a clean peer
+ * close is PROTOCOL_IO_CLOSED and anything else is PROTOCOL_IO_ERROR.  This
+ * keeps every WANT_READ/WANT_WRITE and EINTR retry exactly where it was before
+ * the vtable was introduced, just moved behind the function pointer.
+ * ------------------------------------------------------------------------- */
+
+static ssize_t plain_io_send(ProtocolSession* session, const void* data, size_t size,
+                             short* wait_events) {
+  ssize_t written = write(session->write_fd, data, size);
+  if (written < 0) {
+    if (errno == EINTR)
+      return PROTOCOL_IO_RETRY;
+    return PROTOCOL_IO_ERROR;
+  }
+  if (written == 0)
+    return PROTOCOL_IO_ERROR;
+  *wait_events = POLLOUT;
+  return written;
+}
+
+static ssize_t plain_io_recv(ProtocolSession* session, void* data, size_t size,
+                             short* wait_events) {
+  ssize_t received = read(session->read_fd, data, size);
+  if (received < 0) {
+    if (errno == EINTR)
+      return PROTOCOL_IO_RETRY;
+    return PROTOCOL_IO_ERROR;
+  }
+  if (received == 0)
+    return PROTOCOL_IO_CLOSED;
+  *wait_events = POLLIN;
+  return received;
+}
+
+static bool plain_io_has_pending(const ProtocolSession* session) {
+  (void)session;
+  return false;
+}
+
+static ssize_t tls_io_send(ProtocolSession* session, const void* data, size_t size,
+                           short* wait_events) {
+  /* SSL_write takes an int length; clamp a >INT_MAX request into chunks so the
+   * size_t downcast can never truncate into a negative/partial write. */
+  size_t chunk = size > (size_t)INT_MAX ? (size_t)INT_MAX : size;
+  ssize_t written = SSL_write(session->ssl, data, (int)chunk);
+  if (written <= 0) {
+    int ssl_err = SSL_get_error(session->ssl, (int)written);
+    if (ssl_err == SSL_ERROR_WANT_WRITE) {
+      *wait_events = POLLOUT;
+      return PROTOCOL_IO_RETRY;
+    }
+    if (ssl_err == SSL_ERROR_WANT_READ) {
+      *wait_events = POLLIN;
+      return PROTOCOL_IO_RETRY;
+    }
+    /* A signal (e.g. Ctrl-C) interrupts the blocking TLS write: retry so the
+     * send loop can observe the abort flag at the next checkpoint.  Only an
+     * actual negative return is an interrupted syscall; a 0-byte SSL_write is
+     * not a valid EINTR retry. */
+    if (written < 0 && ssl_err == SSL_ERROR_SYSCALL && errno == EINTR)
+      return PROTOCOL_IO_RETRY;
+    return PROTOCOL_IO_ERROR;
+  }
+  *wait_events = POLLOUT;
+  return written;
+}
+
+static ssize_t tls_io_recv(ProtocolSession* session, void* data, size_t size, short* wait_events) {
+  /* SSL_read takes an int length; clamp a >INT_MAX request into chunks
+   * (mirrors the send path) so the size_t downcast can never truncate into a
+   * negative/partial read. */
+  size_t chunk = size > (size_t)INT_MAX ? (size_t)INT_MAX : size;
+  ssize_t received = SSL_read(session->ssl, data, (int)chunk);
+  if (received <= 0) {
+    int ssl_err = SSL_get_error(session->ssl, (int)received);
+    if (ssl_err == SSL_ERROR_WANT_WRITE) {
+      *wait_events = POLLOUT;
+      return PROTOCOL_IO_RETRY;
+    }
+    if (ssl_err == SSL_ERROR_WANT_READ) {
+      *wait_events = POLLIN;
+      return PROTOCOL_IO_RETRY;
+    }
+    /* A signal interrupts the blocking TLS read: retry (mirrors the send path)
+     * so the loop reaches its next abort/deadline checkpoint.  Only an actual
+     * negative return is an interrupted syscall: a 0-byte SSL_read is an
+     * unexpected EOF (the peer closed without close_notify), which OpenSSL also
+     * reports as SSL_ERROR_SYSCALL with errno possibly still EINTR from an
+     * earlier interrupted poll/read.  Retrying that would busy-spin the
+     * status-read loop until its deadline, so classify it as closed instead. */
+    if (received < 0 && ssl_err == SSL_ERROR_SYSCALL && errno == EINTR)
+      return PROTOCOL_IO_RETRY;
+    /* A zero-length SSL_read is the peer's clean close_notify (or EOF without
+     * one); report it distinctly so the caller can log it as a close. */
+    if (received == 0)
+      return PROTOCOL_IO_CLOSED;
+    return PROTOCOL_IO_ERROR;
+  }
+  *wait_events = POLLIN;
+  return received;
+}
+
+static bool tls_io_has_pending(const ProtocolSession* session) {
+  return session->ssl != NULL && SSL_pending(session->ssl) > 0;
+}
+
+static const ProtocolIoOps plain_io_ops = {
+    .send = plain_io_send,
+    .recv = plain_io_recv,
+    .has_pending = plain_io_has_pending,
+};
+
+static const ProtocolIoOps tls_io_ops = {
+    .send = tls_io_send,
+    .recv = tls_io_recv,
+    .has_pending = tls_io_has_pending,
+};
+
 static bool protocol_reserve_memory(ProtocolSession* session, size_t charge) {
  unsigned long long allocated = atomic_load(&session->total_allocated_bytes);
  while (true) {
@@ -79,6 +202,7 @@ void io_set_fds(int read_fd, int write_fd) {
  legacy_io_session.read_fd = read_fd;
  legacy_io_session.write_fd = write_fd;
  legacy_io_session.ssl = NULL;
+  legacy_io_session.ops = &plain_io_ops;
  legacy_io_session.eight_bit_output = false;
  atomic_store(&legacy_io_session.total_allocated_bytes, 0);
  legacy_io_session.max_alloc = DEFAULT_MAX_ALLOC;
@@ -91,6 +215,7 @@ void protocol_session_init(ProtocolSession* session, int read_fd, int write_fd)
  memset(session, 0, sizeof(*session));
  session->read_fd = read_fd;
  session->write_fd = write_fd;
+  session->ops = &plain_io_ops;
  session->max_alloc = DEFAULT_MAX_ALLOC;
  session->io_timeout_sec = RECEIVE_TIMEOUT_SEC;
  atomic_init(&session->total_allocated_bytes, 0);
@@ -158,8 +283,12 @@ void protocol_session_unbind(void) {
 }

 void protocol_session_set_ssl(ProtocolSession* session, SSL* ssl) {
-  if (session)
-    session->ssl = ssl;
+  if (!session)
+    return;
+  session->ssl = ssl;
+  /* Select the transport dispatch once, here, instead of branching on the SSL
+   * pointer inside every I/O loop. */
+  session->ops = ssl ? &tls_io_ops : &plain_io_ops;
 }

 static void bw_mutex_init(void) {
@@ -270,6 +399,20 @@ SSL* io_get_ssl(void) {
  return io_ssl;
 }

+SSL* protocol_current_ssl(void) {
+  /* The bound session is the authoritative transport for a worker thread: it
+   * was explicitly handed to protocol_session_bind() and carries its own SSL,
+   * whereas io_ssl is thread-local and NULL in a thread that never performed
+   * the handshake.  Only a session whose selected dispatch is TLS may supply
+   * the SSL: a bound plaintext session has ssl == NULL and must not shadow a
+   * live thread-local io_ssl, or file_send.c would take the raw sendfile(2)
+   * path on a socket this thread is driving with TLS.  With no TLS session
+   * bound (plaintext session, or the fd-shim path), fall back to io_ssl. */
+  if (bound_session && bound_session->ops == &tls_io_ops && bound_session->ssl)
+    return bound_session->ssl;
+  return io_ssl;
+}
+
 unsigned long long protocol_bytes_written(void) {
  return atomic_load(&io_bytes_written);
 }
@@ -298,9 +441,21 @@ static ProtocolSession* legacy_session(int read_fd, int write_fd) {
    protocol_session_set_bwlimit(&legacy_io_session, global_bwlimit());
  }
  legacy_io_session.ssl = io_ssl;
+  legacy_io_session.ops = io_ssl ? &tls_io_ops : &plain_io_ops;
  return &legacy_io_session;
 }

+/* Pace an out-of-band write that bypassed protocol_send_n_data (the plaintext
+ * sendfile fast path).  The bound/legacy session is resolved exactly as the
+ * preceding send_n_data(fd, ...) resolved it, so the same token-bucket state is
+ * throttled and the TLS and plaintext transports share identical --bwlimit
+ * semantics.  Passing the wire fd (rather than -1) is essential: the sendfile
+ * send left legacy_io_session.write_fd bound to it, so resolving with -1 would
+ * mismatch, re-initialize the session and hand out a second first-call burst. */
+void protocol_throttle_bytes(int file_descriptor, size_t bytes) {
+  bw_throttle_session(legacy_session(-1, file_descriptor), bytes);
+}
+
 bool send_n_data(int file_descriptor, const void* data, size_t data_size) {
  return protocol_send_n_data(legacy_session(-1, file_descriptor), data, data_size);
 }
@@ -324,8 +479,9 @@ bool protocol_send_n_data(ProtocolSession* session, const void* data, size_t dat
  if (!data && data_size != 0)
    return false;
  log_debug_message(LOG_DEBUG_IO, "    Sending n Data: %zu", data_size);
-  if (!session)
+  if (!session || !session->ops)
    return false;
+  const ProtocolIoOps* ops = session->ops;
  /* A non-positive session timeout disables the deadline entirely (rsync's
   * --timeout=0 default); poll then blocks until the socket becomes writable. */
  int timeout_sec = session->io_timeout_sec > 0 ? session->io_timeout_sec : 0;
@@ -351,38 +507,18 @@ bool protocol_send_n_data(ProtocolSession* session, const void* data, size_t dat
      continue;
    if (pfd.revents & (POLLERR | POLLNVAL))
      return false;
-    ssize_t bytes_send;
-    if (session->ssl) {
-      /* SSL_write takes an int length; clamp a >INT_MAX request into chunks so
-       * the size_t downcast can never truncate into a negative/partial write. */
-      size_t ssl_chunk = chunk > (size_t)INT_MAX ? (size_t)INT_MAX : chunk;
-      bytes_send = SSL_write(session->ssl, (const char*)data + total_bytes_send, (int)ssl_chunk);
-    } else {
-      bytes_send = write(fd, (const char*)data + total_bytes_send, chunk);
-    }
+    ssize_t bytes_send =
+        ops->send(session, (const char*)data + total_bytes_send, chunk, &wait_events);
+    if (bytes_send == PROTOCOL_IO_RETRY)
+      continue;
    if (bytes_send <= 0) {
-      if (session->ssl) {
-        int ssl_err = SSL_get_error(session->ssl, (int)bytes_send);
-        if (ssl_err == SSL_ERROR_WANT_WRITE || ssl_err == SSL_ERROR_WANT_READ) {
-          wait_events = ssl_err == SSL_ERROR_WANT_WRITE ? POLLOUT : POLLIN;
-          continue;
-        }
-        /* A signal (e.g. Ctrl-C) interrupts the blocking TLS write: retry so
-           the send loop can observe the abort flag at the next checkpoint. */
-        if (ssl_err == SSL_ERROR_SYSCALL && errno == EINTR)
-          continue;
-      } else if (errno == EINTR) {
-        continue;
-      }
      log_message(LOG_LEVEL_ERROR, "Could not send data");
      return false;
    }
    bw_throttle_session(session, (size_t)bytes_send);
    total_bytes_send += bytes_send;
-    if (session->ssl)
-      wait_events = POLLOUT;
  }
-  log_debug_message(LOG_DEBUG_IO, "    Send n Data: %zu", total_bytes_send);
+  log_debug_message(LOG_DEBUG_IO, "    Send n Data: %zd", total_bytes_send);
  atomic_fetch_add(&io_bytes_written, (unsigned long long)total_bytes_send);
  return true;
 }
@@ -413,14 +549,15 @@ bool protocol_receive_n_data(ProtocolSession* session, void* data, size_t data_s
 static bool protocol_receive_n_data_until(ProtocolSession* session, void* data, size_t data_size,
                                          const struct timespec* deadline) {
  log_debug_message(LOG_DEBUG_IO, "    Receiving n Data: %zu", data_size);
-  if (!session)
+  if (!session || !session->ops)
    return false;
+  const ProtocolIoOps* ops = session->ops;
  int fd = session->read_fd;

  size_t total_bytes_received = 0;
  short wait_events = POLLIN;
  while (total_bytes_received < data_size) {
-    if (!session->ssl || SSL_pending(session->ssl) == 0) {
+    if (!ops->has_pending(session)) {
      struct pollfd pfd = {.fd = fd, .events = wait_events};
      /* A NULL deadline means "wait indefinitely" (timeout disabled). */
      int poll_result = poll(&pfd, 1, deadline ? deadline_remaining_ms(deadline) : -1);
@@ -438,37 +575,19 @@ static bool protocol_receive_n_data_until(ProtocolSession* session, void* data,
        return false;
    }

-    ssize_t bytes_received;
-    if (session->ssl)
-      bytes_received = SSL_read(session->ssl, (char*)data + total_bytes_received,
-                                data_size - total_bytes_received);
-    else
-      bytes_received =
-          read(fd, (char*)data + total_bytes_received, data_size - total_bytes_received);
+    ssize_t bytes_received = ops->recv(session, (char*)data + total_bytes_received,
+                                       data_size - total_bytes_received, &wait_events);
+    if (bytes_received == PROTOCOL_IO_RETRY)
+      continue;
+    if (bytes_received == PROTOCOL_IO_CLOSED) {
+      log_message(LOG_LEVEL_ERROR, "Connection closed while receiving data");
+      return false;
+    }
    if (bytes_received <= 0) {
-      if (session->ssl) {
-        int ssl_err = SSL_get_error(session->ssl, (int)bytes_received);
-        if (ssl_err == SSL_ERROR_WANT_WRITE || ssl_err == SSL_ERROR_WANT_READ) {
-          wait_events = ssl_err == SSL_ERROR_WANT_WRITE ? POLLOUT : POLLIN;
-          continue;
-        }
-        /* A signal interrupts the blocking TLS read: retry (mirrors the send
-           path and protocol_read_status_until) so the loop reaches its next
-           abort/deadline checkpoint instead of failing spuriously. */
-        if (ssl_err == SSL_ERROR_SYSCALL && errno == EINTR)
-          continue;
-      } else if (errno == EINTR) {
-        continue;
-      }
-      if (bytes_received == 0)
-        log_message(LOG_LEVEL_ERROR, "Connection closed while receiving data");
-      else
-        log_message(LOG_LEVEL_ERROR, "Could not receive bytes");
+      log_message(LOG_LEVEL_ERROR, "Could not receive bytes");
      return false;
    }
    total_bytes_received += (size_t)bytes_received;
-    if (session->ssl)
-      wait_events = POLLIN;
  }
  log_debug_message(LOG_DEBUG_IO, "    Received n Data: %zu", total_bytes_received);
  atomic_fetch_add(&io_bytes_read, (unsigned long long)total_bytes_received);
@@ -550,6 +669,15 @@ static const char* status_to_string(Status status) {
  }
 }

+/* Reject a raw wire status outside the known enum range before it is handed to
+ * callers, so an unknown/corrupt frame fails as a protocol error instead of
+ * being silently interpreted as an unexpected-but-valid verdict.  STATUS_OK is
+ * the first enumerator and STATUS_STATS the last, so the range check accepts
+ * every status the protocol defines. */
+static bool status_is_valid(Status status) {
+  return status >= STATUS_OK && status <= STATUS_STATS;
+}
+
 /* Shared string send/receive implementation.  `redact` selects whether the
 * payload body is written to the LOG_DEBUG_PROTO debug log: daemon auth material
 * (the username and the proof/signature fields) sets it so a --verbose log never
@@ -633,7 +761,7 @@ bool protocol_send_data(ProtocolSession* session, const Data* data) {
    return false;
  if (!protocol_send_n_data(session, data->data, data_size))
    return false;
-  log_debug_message(LOG_DEBUG_PROTO, "Send %lld data", data_size);
+  log_debug_message(LOG_DEBUG_PROTO, "Send %llu data", data_size);
  return true;
 }

@@ -667,7 +795,7 @@ Data* protocol_receive_data_limited(ProtocolSession* session, unsigned long long
    protocol_release_memory_for_session(session, allocation_size);
    return NULL;
  }
-  log_debug_message(LOG_DEBUG_PROTO, "Received %lld data", size);
+  log_debug_message(LOG_DEBUG_PROTO, "Received %llu data", size);
  Data* result = data_create(data, (size_t)size);
  if (!result) {
    protocol_release_memory_for_session(session, allocation_size);
@@ -777,6 +905,10 @@ bool protocol_receive_status(ProtocolSession* session, Status* status) {
  }
  if (!protocol_receive_n_data_until(session, status, sizeof(Status), deadline_ptr))
    return false;
+  if (!status_is_valid(*status)) {
+    log_message(LOG_LEVEL_ERROR, "Received unknown protocol status %d", *status);
+    return false;
+  }
  if (!protocol_capture_error_detail(session, status, deadline_ptr, NULL))
    return false;
  log_debug_message(LOG_DEBUG_PROTO, "Received Status: %s", status_to_string(*status));
@@ -798,6 +930,10 @@ bool protocol_receive_status_timed(ProtocolSession* session, Status* status, int
  deadline.tv_sec += timeout_sec;
  if (!protocol_receive_n_data_until(session, status, sizeof(Status), &deadline))
    return false;
+  if (!status_is_valid(*status)) {
+    log_message(LOG_LEVEL_ERROR, "Received unknown protocol status %d", *status);
+    return false;
+  }
  if (!protocol_capture_error_detail(session, status, &deadline, NULL))
    return false;
  log_debug_message(LOG_DEBUG_PROTO, "Received Status: %s", status_to_string(*status));
@@ -811,11 +947,14 @@ bool protocol_receive_status_timed(ProtocolSession* session, Status* status, int
 * reply across a frame boundary.  Returns false on timeout/EOF/error. */
 static bool protocol_read_status_until(ProtocolSession* session, Status* status,
                                       const struct timespec* deadline) {
+  if (!session || !session->ops)
+    return false;
+  const ProtocolIoOps* ops = session->ops;
  Status received = STATUS_ERROR;
  size_t got = 0;
  short wait_events = POLLIN;
  while (got < sizeof(Status)) {
-    if (!session->ssl || SSL_pending(session->ssl) == 0) {
+    if (!ops->has_pending(session)) {
      int remaining_ms = deadline ? deadline_remaining_ms(deadline) : -1;
      if (remaining_ms == 0) {
        log_message(LOG_LEVEL_ERROR, "Receive timeout while reading status");
@@ -835,21 +974,11 @@ static bool protocol_read_status_until(ProtocolSession* session, Status* status,
      if (pfd.revents & (POLLERR | POLLNVAL))
        return false;
    }
-    ssize_t bytes_received;
-    if (session->ssl)
-      bytes_received = SSL_read(session->ssl, (char*)&received + got, sizeof(Status) - got);
-    else
-      bytes_received = read(session->read_fd, (char*)&received + got, sizeof(Status) - got);
+    ssize_t bytes_received =
+        ops->recv(session, (char*)&received + got, sizeof(Status) - got, &wait_events);
+    if (bytes_received == PROTOCOL_IO_RETRY)
+      continue;
    if (bytes_received <= 0) {
-      if (session->ssl) {
-        int ssl_err = SSL_get_error(session->ssl, (int)bytes_received);
-        if (ssl_err == SSL_ERROR_WANT_READ || ssl_err == SSL_ERROR_WANT_WRITE) {
-          wait_events = ssl_err == SSL_ERROR_WANT_WRITE ? POLLOUT : POLLIN;
-          continue;
-        }
-      }
-      if (bytes_received < 0 && errno == EINTR)
-        continue;
      log_message(LOG_LEVEL_ERROR, "Connection closed while receiving status");
      return false;
    }
@@ -878,7 +1007,7 @@ bool protocol_receive_status_keepalive(ProtocolSession* session, Status* status,
  while (true) {
    if (abort_check && abort_check())
      return false;
-    if (!session->ssl || SSL_pending(session->ssl) == 0) {
+    if (!session->ops || !session->ops->has_pending(session)) {
      int remaining_ms = deadline_remaining_ms(&deadline);
      if (remaining_ms <= 0) {
        log_message(LOG_LEVEL_ERROR, "Receive timeout after %ds", timeout_sec);
@@ -911,6 +1040,10 @@ bool protocol_receive_status_keepalive(ProtocolSession* session, Status* status,
    Status received;
    if (!protocol_read_status_until(session, &received, &deadline))
      return false;
+    if (!status_is_valid(received)) {
+      log_message(LOG_LEVEL_ERROR, "Received unknown protocol status %d", received);
+      return false;
+    }
    if (!protocol_capture_error_detail(session, &received, &deadline, abort_check))
      return false;
    if (received == STATUS_KEEPALIVE) {
@@ -28,6 +28,10 @@

 /* Maximum chunk size (64 MB) — prevents unbounded allocation from the wire */
 #define MAX_CHUNK_SIZE (64ULL * 1024 * 1024)
+/* Files larger than this are not kept fully in memory while loading: the
+ * loader skips them so the sender streams from the path, and file_checksum
+ * hashes them from disk in bounded buffers instead of forcing a full load. */
+#define STREAM_THRESHOLD (64ULL * 1024 * 1024)
 #define MAX_MANIFEST_ENTRIES (1024 * 1024)
 /* Aggregate bytes retained by one received deletion manifest. */
 #define MAX_MANIFEST_BYTES (16ULL * 1024 * 1024)
@@ -46,16 +50,48 @@

 typedef struct ssl_st SSL;

+typedef struct ProtocolSession ProtocolSession;
+
+/*
+ * Transport vtable: the per-session set of I/O primitives the three protocol
+ * loops (send, receive, status-read) dispatch through.  The ops are selected
+ * once, when the session is initialized or its SSL is installed, so the loops
+ * never branch on the transport at runtime.  A plaintext session uses the
+ * read()/write() ops; a TLS session uses the SSL_read()/SSL_write() ops.
+ *
+ * `send`/`recv` attempt exactly one transfer and return:
+ *   > 0                    bytes transferred,
+ *   PROTOCOL_IO_RETRY      no progress; poll on *wait_events and retry,
+ *   PROTOCOL_IO_CLOSED     peer closed the stream,
+ *   PROTOCOL_IO_ERROR      fatal transport error.
+ * `has_pending` reports bytes already buffered by the transport (a TLS record
+ * residue); the receive loops skip the poll() gate when it is true.
+ */
+typedef struct ProtocolIoOps {
+  ssize_t (*send)(ProtocolSession* session, const void* data, size_t size, short* wait_events);
+  ssize_t (*recv)(ProtocolSession* session, void* data, size_t size, short* wait_events);
+  bool (*has_pending)(const ProtocolSession* session);
+} ProtocolIoOps;
+
+/* Negative sentinels returned by ProtocolIoOps.send/recv (see above). */
+enum {
+  PROTOCOL_IO_RETRY = -1,
+  PROTOCOL_IO_CLOSED = -2,
+  PROTOCOL_IO_ERROR = -3,
+};
+
 /*
 * Explicit owner of protocol I/O.  A session does not own the descriptors or
 * SSL object; it only describes the transport used by a transfer.  This makes
 * it safe to pass the transport to a worker without relying on inherited
 * thread-local state.
 */
-typedef struct ProtocolSession {
+struct ProtocolSession {
  int read_fd;
  int write_fd;
  SSL* ssl;
+  /* Transport dispatch selected by protocol_session_init()/set_ssl(). */
+  const ProtocolIoOps* ops;
  unsigned long long bwlimit;
  long long bw_tokens;
  long long bw_last_refill_sec;
@@ -71,7 +107,7 @@ typedef struct ProtocolSession {
   * SO_RCVTIMEO/SO_SNDTIMEO.  The server does not propagate a client 0 here: it
   * installs protocol_server_io_timeout_sec() so its sessions keep a floor. */
  int io_timeout_sec;
-} ProtocolSession;
+};

 typedef int Status;
 enum NET_STATUS {
@@ -212,6 +248,17 @@ void io_set_bwlimit(unsigned long long bytes_per_sec);
 unsigned long long io_get_bwlimit(void);
 void io_set_ssl(SSL* ssl);
 SSL* io_get_ssl(void);
+/* SSL object of the transport in effect on this thread: the currently bound
+ * session's SSL when a TLS session is bound, otherwise the legacy thread-local
+ * io_ssl.  NULL for a plaintext transport.  Unlike io_get_ssl(), this resolves
+ * worker threads that bound a TLS session via protocol_session_set_ssl()/
+ * protocol_session_bind() but never called io_set_ssl() themselves (C11
+ * _Thread_local state is not inherited by a new thread).  A bound session only
+ * wins when its selected dispatch is TLS; a bound plaintext session (ssl ==
+ * NULL) falls back to io_ssl so it can never mask a live encrypted transport.
+ * Callers that must choose a TLS-only code path (e.g. file_send.c's sendfile
+ * fallback) must use this instead of io_get_ssl(). */
+SSL* protocol_current_ssl(void);

 /* Process-wide wire byte counters.  protocol_send_n_data/protocol_receive_n_data
 * update them; the zero-copy sendfile path reports through
@@ -220,6 +267,15 @@ SSL* io_get_ssl(void);
 unsigned long long protocol_bytes_written(void);
 unsigned long long protocol_bytes_read(void);
 void protocol_note_bytes_written(unsigned long long bytes);
+/* Apply --bwlimit pacing to bytes written outside protocol_send_n_data (the
+ * plaintext zero-copy sendfile fast path).  `file_descriptor` is the wire fd
+ * the bytes were written to, so the legacy session is resolved exactly as the
+ * preceding send_n_data call resolved it (the bound TLS session still wins when
+ * set); resolving with the same fd avoids re-initializing the legacy session
+ * and granting a second first-call burst.  Runs the same token-bucket throttle,
+ * so the sendfile transport is paced identically to the buffered/TLS paths.  A
+ * no-op when the effective session has no bandwidth limit. */
+void protocol_throttle_bytes(int file_descriptor, size_t bytes);

 void protocol_session_init(ProtocolSession* session, int read_fd, int write_fd);
 /* Transitional bridge for helpers whose signatures still carry only an fd. */
@@ -263,6 +319,9 @@ bool protocol_send_int(ProtocolSession* session, int data);
 bool protocol_receive_int(ProtocolSession* session, int* data);
 bool protocol_send_status(ProtocolSession* session, Status status);
 bool protocol_receive_status(ProtocolSession* session, Status* status);
+/* As protocol_receive_status, but with an explicit per-message deadline
+ * (seconds) instead of the session's configured io_timeout_sec. */
+bool protocol_receive_status_timed(ProtocolSession* session, Status* status, int timeout_sec);
 bool send_n_data(int file_descriptor, const void* data, size_t data_size);
 bool receive_n_data(int file_descriptor, void* data, size_t data_size);

@@ -128,7 +128,7 @@ bool queue_enqueue_multithreaded_cancel(Queue* queue, void* item, mtx_t* mutex,

 void* queue_dequeue(Queue* queue) {
  if (queue == NULL || queue_is_empty(queue)) {
-    log_perror("ERROR: Could not dequeue from null or empty queue.");
+    log_message(LOG_LEVEL_ERROR, "%s", "ERROR: Could not dequeue from null or empty queue.");
    return NULL;
  }

@@ -139,6 +139,23 @@ void* queue_dequeue(Queue* queue) {
  return item;
 }

+bool queue_push(Queue* queue, void* item) {
+  return queue_enqueue(queue, item);
+}
+
+void* queue_pop(Queue* queue) {
+  if (queue == NULL || queue_is_empty(queue)) {
+    log_message(LOG_LEVEL_ERROR, "%s", "ERROR: Could not pop from null or empty queue.");
+    return NULL;
+  }
+
+  queue->rear = (queue->rear - 1 + queue->capacity) % queue->capacity;
+  void* item = queue->items[queue->rear];
+  queue->items[queue->rear] = NULL;
+  queue->size--;
+  return item;
+}
+
 void* queue_dequeue_multithreaded(Queue* queue, mtx_t* mutex, cnd_t* condition_not_empty,
                                  cnd_t* condition_not_full, const bool* other_thread_done) {
  mtx_lock(mutex);
@@ -28,4 +28,11 @@ void* queue_dequeue(Queue* queue);
 void* queue_dequeue_multithreaded(Queue* queue, mtx_t* mutex, cnd_t* condition_not_empty,
                                  cnd_t* condition_not_full, const bool* other_thread_done);

+/* LIFO stack operations over the same ring buffer.  queue_push() is the enqueue
+   primitive; queue_pop() removes from the rear, so a sequence of pushes is
+   returned in reverse order.  Used by the sequential scanner's depth-first
+   traversal. */
+bool queue_push(Queue* queue, void* item);
+void* queue_pop(Queue* queue);
+
 #endif
@@ -87,7 +87,7 @@ static int parse_remote_dest(const char* dest, RemoteDest* r) {
  return 0;
 }

-char* ssh_build_remote_command(const char* server_path, bool old_args, char* const* remote_options,
+char* ssh_build_remote_command(const char* server_path, char* const* remote_options,
                               int remote_option_count) {
  const char* path = server_path ? server_path : "fastsync-server";
  const char* suffix = " --stdio";
@@ -105,9 +105,7 @@ char* ssh_build_remote_command(const char* server_path, bool old_args, char* con
     shell word (remote options below reuse the same escaping), then
     " --stdio".  Quoting the path is the only injection-safe construction: an
     unquoted path would carry shell metacharacters straight into the remote
-     shell command.  --old-args is kept for CLI/ABI compatibility but no longer
-     disables that protection. */
-  (void)old_args;
+     shell command.  (rsync's --old-args no longer disables that protection.) */
  size_t quote_count = 0;
  for (const char* p = path; *p; p++)
    if (*p == '\'')
@@ -296,8 +294,8 @@ void ssh_free_client_argv(char** argv) {
 }

 Client* client_connect_ssh(const char* destination, int port, const char* server_path,
-                           bool old_args, const char* rsh_command, bool blocking_io,
-                           char* const* remote_options, int remote_option_count) {
+                           const char* rsh_command, bool blocking_io, char* const* remote_options,
+                           int remote_option_count) {
  RemoteDest r;
  if (parse_remote_dest(destination, &r) != 0) {
    char* escaped = output_escape(destination, false);
@@ -376,7 +374,7 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
      snprintf(ssh_user, ssh_user_len, "%s", r.host);

    char* remote_command =
-        ssh_build_remote_command(server_path, old_args, remote_options, remote_option_count);
+        ssh_build_remote_command(server_path, remote_options, remote_option_count);
    if (!remote_command)
      ssh_child_setup_failed(exec_pipe[1]);
    char** ssh_argv = ssh_build_client_argv(rsh_command, port, ssh_user, remote_command);
@@ -4,17 +4,17 @@
 #include "transport_tcp.h"

 Client* client_connect_ssh(const char* destination, int port, const char* server_path,
-                           bool old_args, const char* rsh_command, bool blocking_io,
-                           char* const* remote_options, int remote_option_count);
+                           const char* rsh_command, bool blocking_io, char* const* remote_options,
+                           int remote_option_count);
 /* Build the escaped remote-shell command string (the server program path always
 * quoted as one remote-shell word, followed by ` --stdio` and each
 * --remote-option value appended as an individually single-quoted shell word).
- * `old_args` is accepted for CLI/ABI compatibility but no longer disables
- * quoting: the path is always escaped so a metacharacter-bearing
- * --rsync-path can never be interpreted by the remote shell.  Every
- * --remote-option value is individually escaped with the '\'' sequence and
- * values with empty/control characters are rejected at the CLI parse layer. */
-char* ssh_build_remote_command(const char* server_path, bool old_args, char* const* remote_options,
+ * The path is always escaped so a metacharacter-bearing --rsync-path can never
+ * be interpreted by the remote shell (the --old-args no-op does not disable
+ * quoting).  Every --remote-option value is individually escaped with the '\''
+ * sequence and values with empty/control characters are rejected at the CLI
+ * parse layer. */
+char* ssh_build_remote_command(const char* server_path, char* const* remote_options,
                               int remote_option_count);
 /* Build the NULL-terminated child argv for the remote-shell client (argv[0] is
 * the exec/execvp program).  rsh_command is whitespace-split into leading argv
@@ -7,6 +7,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <netinet/in.h>
+#include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -48,6 +49,15 @@ const char* utils_get_authorized_root_path(void) {
  return authorized_root_path;
 }

+void utils_set_error(char* err, size_t err_size, const char* fmt, ...) {
+  if (!err || err_size == 0)
+    return;
+  va_list args;
+  va_start(args, fmt);
+  vsnprintf(err, err_size, fmt, args);
+  va_end(args);
+}
+
 bool path_is_within_root(const char* root, const char* path) {
  size_t root_len = strlen(root);
  return strncmp(root, path, root_len) == 0 && (path[root_len] == '\0' || path[root_len] == '/');
@@ -615,430 +625,6 @@ bool format_human_bytes(unsigned long long bytes, char* buffer, size_t buffer_si
  return written >= 0 && (size_t)written < buffer_size;
 }

-/* Build the keep-set index from the exact manifest entries only.  A lookup of
-   `rel` succeeds iff `rel` is a kept entry, a kept directory, or an ancestor
-   directory of kept content (the old is_dir_in_manifest predicate); the sorted
-   view answers "is an ancestor of kept content" without materializing any
-   per-component prefix copy, so the index is O(manifest size) memory. */
-static bool build_keep_index(const ArrayList* manifest, PathIndex* index) {
-  if (!manifest || manifest->size <= 0)
-    return path_index_build(index, NULL, 0);
-  return path_index_build(index, (const char* const*)manifest->items, (size_t)manifest->size);
-}
-
-static bool keep_is_dir(const PathIndex* index, const char* rel_path) {
-  return path_index_contains(index, rel_path) || path_index_has_descendant(index, rel_path);
-}
-
-static bool keep_is_file(const PathIndex* index, const char* rel_path) {
-  return path_index_contains(index, rel_path);
-}
-
-/* True when child_rel is, or lies below, a protected entry.  A prefix "a"
-   therefore protects "a" and "a/b/c" but not "ab".  Entries with top_level_only
-   set only protect DIRECT children of the receive root (at_root); nested
-   directories that share such a name stay ordinary destination content. */
-bool path_under_skip_prefix(const char* child_rel, bool at_root, const DeleteSkipEntry* skips,
-                            int skip_count) {
-  for (int i = 0; i < skip_count; i++) {
-    if (skips[i].top_level_only && !at_root)
-      continue;
-    size_t prefix_len = strlen(skips[i].prefix);
-    if (strncmp(child_rel, skips[i].prefix, prefix_len) == 0 &&
-        (child_rel[prefix_len] == '\0' || child_rel[prefix_len] == '/'))
-      return true;
-  }
-  return false;
-}
-
-/* Per-run deletion budget and tallies.  `max_delete` is the cap on the number
-   of entries the walker may remove (SIZE_MAX = unlimited); once it is reached
-   the remaining extras are counted in `skipped` and left in place, matching
-   rsync's partial --max-delete behavior. */
-typedef struct {
-  size_t max_delete;
-  size_t deleted;
-  size_t skipped;
-  bool limit_hit;
-} DeleteBudget;
-
-/* True when direct children of the directory named by `rel` may be removed.
-   With no synchronization info (dirs == NULL) the whole tree is deletable; when
-   a dirs index is supplied only its exact entries are (the receive root is the
-   "." sentinel). */
-static bool is_synced_dir(const PathIndex* dirs, const char* rel) {
-  if (!dirs)
-    return true;
-  return path_index_contains(dirs, rel[0] == '\0' ? "." : rel);
-}
-
-/* Remove the extras directly inside the directory open on `dirfd`, recursing
-   into every child directory so kept content below a synchronized prefix is
-   reached.  `all_removed` reports whether every child entry was removed (so the
-   caller may rmdir this directory).  A child directory is never removed when it
-   is itself a synchronized directory or holds kept content; with a dirs index
-   supplied, direct children of a non-synchronized directory are never extras at
-   all (they are left in place but still descended into).  Symlinks are unlinked
-   like any other non-directory extra (never followed). */
-static bool delete_extras_fd(int dirfd, const char* rel_path, const PathIndex* keep,
-                             const PathIndex* dirs, DeleteBudget* budget,
-                             const DeleteSkipEntry* skips, int skip_count,
-                             const FilterRuleList* protect_rules, bool parent_deletable,
-                             bool* all_removed, DeletePathObserver observer,
-                             void* observer_context) {
-  /* openat(dirfd, ".") opens an independent file description: a dup() would
-     share dirfd's file offset and a prior pass could leave the stream drained. */
-  int scanfd = openat(dirfd, ".", O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-  if (scanfd < 0)
-    return false;
-  DIR* dir = fdopendir(scanfd);
-  if (!dir) {
-    close(scanfd);
-    return false;
-  }
-  bool operation_ok = true;
-  bool local_survives = false;
-  /* A directory is deletable when it or ANY ancestor is synchronized; the
-     `parent_deletable` flag carries that down the recursion so dest-only
-     directories below a synchronized root are removed wholesale. */
-  bool deletable = parent_deletable || is_synced_dir(dirs, rel_path);
-  const struct dirent* entry;
-  while ((entry = readdir(dir)) != NULL) {
-    if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
-      continue;
-    char* child_rel = path_cat((char*)rel_path, entry->d_name);
-    if (!child_rel) {
-      operation_ok = false;
-      continue;
-    }
-    /* A --delay-updates run keeps its staging directory as a direct child of
-       the receive root, and basis-dir snapshots live below it too.  Their
-       contents are not manifest entries, so descending into them would delete
-       every staged / basis file as an "extra".  Only the staging name (a
-       top-level-only prefix) and the basis prefixes are protected: a nested
-       destination directory that happens to be called .fastsync-stage is
-       ordinary content. */
-    if (path_under_skip_prefix(child_rel, rel_path[0] == '\0', skips, skip_count)) {
-      local_survives = true;
-      free(child_rel);
-      continue;
-    }
-    struct stat st;
-    if (fstatat(dirfd, entry->d_name, &st, AT_SYMLINK_NOFOLLOW) != 0) {
-      if (errno != ENOENT)
-        operation_ok = false;
-      free(child_rel);
-      continue;
-    }
-    bool is_dir = S_ISDIR(st.st_mode);
-    if (protect_rules && filter_rules_apply_side(protect_rules, child_rel, entry->d_name, is_dir,
-                                                 FILTER_SIDE_RECEIVER) == FILTER_ACTION_PROTECT) {
-      /* A first-match protect rule shields the extra; for a directory the whole
-         subtree is shielded (rsync prunes an excluded directory), so do not
-         descend. */
-      local_survives = true;
-      free(child_rel);
-      continue;
-    }
-    if (is_dir) {
-      int childfd = openat(dirfd, entry->d_name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-      bool child_all_removed = false;
-      if (childfd >= 0) {
-        if (!delete_extras_fd(childfd, child_rel, keep, dirs, budget, skips, skip_count,
-                              protect_rules, deletable, &child_all_removed, observer,
-                              observer_context))
-          operation_ok = false;
-        close(childfd);
-      } else if (errno != ENOENT) {
-        operation_ok = false;
-      }
-      bool child_synced = dirs && path_index_contains(dirs, child_rel);
-      if (child_synced || keep_is_dir(keep, child_rel)) {
-        /* A synchronized directory and a directory holding kept content are
-           never removed. */
-        local_survives = true;
-      } else if (child_all_removed && deletable) {
-        if (budget->deleted >= budget->max_delete) {
-          budget->limit_hit = true;
-          budget->skipped++;
-          local_survives = true;
-        } else if (unlinkat(dirfd, entry->d_name, AT_REMOVEDIR) != 0) {
-          /* ENOENT: already gone (fine).  ENOTEMPTY/EEXIST: the directory
-             still holds entries the walker leaves in place (a protected
-             excluded prefix, a kept file the manifest protects, a symlink);
-             rsync leaves such a directory behind, so this is not an error.
-             Only genuine I/O failures abort the deletion. */
-          if (errno != ENOENT && errno != ENOTEMPTY && errno != EEXIST)
-            operation_ok = false;
-          local_survives = true;
-        } else {
-          budget->deleted++;
-          if (observer)
-            observer(observer_context, child_rel);
-        }
-      } else {
-        local_survives = true;
-      }
-    } else {
-      bool found = keep_is_file(keep, child_rel);
-      if (found || !deletable) {
-        /* Kept file, or a child of a directory that is not synchronized: never
-           an extra for this run. */
-        local_survives = true;
-      } else if (budget->deleted >= budget->max_delete) {
-        budget->limit_hit = true;
-        budget->skipped++;
-        local_survives = true;
-      } else if (unlinkat(dirfd, entry->d_name, 0) != 0) {
-        if (errno != ENOENT)
-          operation_ok = false;
-        local_survives = true;
-      } else {
-        budget->deleted++;
-        if (observer)
-          observer(observer_context, child_rel);
-        char* escaped_path = output_escape(child_rel, log_get_8_bit_output());
-        fprintf(stderr, "  Deleted: %s\n", escaped_path ? escaped_path : "<allocation failed>");
-        free(escaped_path);
-      }
-    }
-    free(child_rel);
-  }
-  closedir(dir);
-  *all_removed = !local_survives;
-  return operation_ok;
-}
-
-/* Read-only mirror of delete_extras_fd: records the paths that WOULD be removed
-   without unlinking anything.  A child directory is reported after its own
-   reportable children (depth-first), matching the delete pass's ordering. */
-static bool list_extras_fd(int dirfd, const char* rel_path, const PathIndex* keep,
-                           const PathIndex* dirs, ArrayList* out, size_t* recorded,
-                           const DeleteSkipEntry* skips, int skip_count,
-                           const FilterRuleList* protect_rules, bool parent_deletable,
-                           bool* all_removed) {
-  int scanfd = openat(dirfd, ".", O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-  if (scanfd < 0)
-    return false;
-  DIR* dir = fdopendir(scanfd);
-  if (!dir) {
-    close(scanfd);
-    return false;
-  }
-  bool operation_ok = true;
-  bool local_survives = false;
-  bool deletable = parent_deletable || is_synced_dir(dirs, rel_path);
-  const struct dirent* entry;
-  while ((entry = readdir(dir)) != NULL) {
-    if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
-      continue;
-    char* child_rel = path_cat((char*)rel_path, entry->d_name);
-    if (!child_rel) {
-      operation_ok = false;
-      continue;
-    }
-    if (path_under_skip_prefix(child_rel, rel_path[0] == '\0', skips, skip_count)) {
-      local_survives = true;
-      free(child_rel);
-      continue;
-    }
-    struct stat st;
-    if (fstatat(dirfd, entry->d_name, &st, AT_SYMLINK_NOFOLLOW) != 0) {
-      if (errno != ENOENT)
-        operation_ok = false;
-      free(child_rel);
-      continue;
-    }
-    bool is_dir = S_ISDIR(st.st_mode);
-    if (protect_rules && filter_rules_apply_side(protect_rules, child_rel, entry->d_name, is_dir,
-                                                 FILTER_SIDE_RECEIVER) == FILTER_ACTION_PROTECT) {
-      /* Mirror the delete walk: a protected entry is never reported as a
-         would-delete and a protected directory's subtree is not enumerated. */
-      local_survives = true;
-      free(child_rel);
-      continue;
-    }
-    if (is_dir) {
-      int childfd = openat(dirfd, entry->d_name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-      bool child_all_removed = false;
-      if (childfd >= 0) {
-        if (!list_extras_fd(childfd, child_rel, keep, dirs, out, recorded, skips, skip_count,
-                            protect_rules, deletable, &child_all_removed))
-          operation_ok = false;
-        close(childfd);
-      } else if (errno != ENOENT) {
-        operation_ok = false;
-      }
-      bool child_synced = dirs && path_index_contains(dirs, child_rel);
-      if (child_synced || keep_is_dir(keep, child_rel)) {
-        local_survives = true;
-      } else if (child_all_removed && deletable) {
-        size_t len = strlen(child_rel);
-        char* copy = malloc(len + 2);
-        if (!copy) {
-          operation_ok = false;
-        } else {
-          memcpy(copy, child_rel, len);
-          copy[len] = '/';
-          copy[len + 1] = '\0';
-          if (!array_list_add(out, copy)) {
-            free(copy);
-            operation_ok = false;
-          } else {
-            (*recorded)++;
-          }
-        }
-      } else {
-        local_survives = true;
-      }
-    } else {
-      bool found = keep_is_file(keep, child_rel);
-      if (found || !deletable) {
-        local_survives = true;
-      } else {
-        char* copy = str_dup(child_rel);
-        if (!copy || !array_list_add(out, copy)) {
-          free(copy);
-          operation_ok = false;
-        } else {
-          (*recorded)++;
-        }
-      }
-    }
-    free(child_rel);
-  }
-  closedir(dir);
-  *all_removed = !local_survives;
-  return operation_ok;
-}
-
-bool delete_extras_list(const char* dest_root, const ArrayList* manifest,
-                        const ArrayList* synced_dirs, const DeleteSkipEntry* skips, int skip_count,
-                        const FilterRuleList* protect_rules, ArrayList* out, size_t* count_out) {
-  if (count_out)
-    *count_out = 0;
-  if (!manifest || !out)
-    return false;
-  PathIndex keep;
-  if (!build_keep_index(manifest, &keep))
-    return false;
-  PathIndex dirs;
-  bool have_dirs = synced_dirs != NULL;
-  if (have_dirs &&
-      !path_index_build(&dirs, (const char* const*)synced_dirs->items, (size_t)synced_dirs->size)) {
-    path_index_free(&keep);
-    return false;
-  }
-  int rootfd;
-  int root_fd = utils_get_authorized_root_fd();
-  if (root_fd >= 0) {
-    if (utils_get_authorized_root_path())
-      rootfd = utils_open_authorized_destination(dest_root);
-    else if (dest_root == NULL)
-      rootfd = dup(root_fd);
-    else
-      rootfd = -1;
-  } else {
-    rootfd = open(dest_root, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-  }
-  if (rootfd < 0) {
-    path_index_free(&keep);
-    if (have_dirs)
-      path_index_free(&dirs);
-    return false;
-  }
-  bool all_removed = false;
-  size_t recorded = 0;
-  bool ok = list_extras_fd(rootfd, "", &keep, have_dirs ? &dirs : NULL, out, &recorded, skips,
-                           skip_count, protect_rules, false, &all_removed);
-  if (close(rootfd) != 0)
-    ok = false;
-  path_index_free(&keep);
-  if (have_dirs)
-    path_index_free(&dirs);
-  if (count_out)
-    *count_out = recorded;
-  return ok;
-}
-
-DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const ArrayList* manifest,
-                                                const ArrayList* synced_dirs, size_t max_delete,
-                                                const DeleteSkipEntry* skips, int skip_count,
-                                                const FilterRuleList* protect_rules,
-                                                size_t* deleted_out, size_t* skipped_out,
-                                                DeletePathObserver observer,
-                                                void* observer_context) {
-  if (deleted_out)
-    *deleted_out = 0;
-  if (skipped_out)
-    *skipped_out = 0;
-  if (!manifest)
-    return DELETE_WALK_ERROR;
-  /* Index the keep-set (and the synchronized-dir set, when supplied) once so
-     membership is answered in O(path length) instead of scanning every entry
-     for every destination entry. */
-  PathIndex keep;
-  if (!build_keep_index(manifest, &keep))
-    return DELETE_WALK_ERROR;
-  PathIndex dirs;
-  bool have_dirs = synced_dirs != NULL;
-  if (have_dirs &&
-      !path_index_build(&dirs, (const char* const*)synced_dirs->items, (size_t)synced_dirs->size)) {
-    path_index_free(&keep);
-    return DELETE_WALK_ERROR;
-  }
-  int rootfd;
-  int root_fd = utils_get_authorized_root_fd();
-  if (root_fd >= 0) {
-    if (utils_get_authorized_root_path())
-      rootfd = utils_open_authorized_destination(dest_root);
-    else if (dest_root == NULL)
-      rootfd = dup(root_fd);
-    else
-      rootfd = -1;
-  } else {
-    rootfd = open(dest_root, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-  }
-  if (rootfd < 0) {
-    path_index_free(&keep);
-    if (have_dirs)
-      path_index_free(&dirs);
-    return DELETE_WALK_ERROR;
-  }
-  DeleteBudget budget = {.max_delete = max_delete, .deleted = 0, .skipped = 0, .limit_hit = false};
-  bool all_removed = false;
-  bool ok =
-      delete_extras_fd(rootfd, "", &keep, have_dirs ? &dirs : NULL, &budget, skips, skip_count,
-                       protect_rules, false, &all_removed, observer, observer_context);
-  if (close(rootfd) != 0)
-    ok = false;
-  path_index_free(&keep);
-  if (have_dirs)
-    path_index_free(&dirs);
-  if (deleted_out)
-    *deleted_out = budget.deleted;
-  if (skipped_out)
-    *skipped_out = budget.skipped;
-  if (!ok)
-    return DELETE_WALK_ERROR;
-  return budget.limit_hit ? DELETE_WALK_LIMIT_REACHED : DELETE_WALK_OK;
-}
-
-DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
-                                       const ArrayList* synced_dirs, size_t max_delete,
-                                       const DeleteSkipEntry* skips, int skip_count,
-                                       const FilterRuleList* protect_rules, size_t* deleted_out,
-                                       size_t* skipped_out) {
-  return delete_extras_limited_observed(dest_root, manifest, synced_dirs, max_delete, skips,
-                                        skip_count, protect_rules, deleted_out, skipped_out, NULL,
-                                        NULL);
-}
-
-bool delete_extras(const char* dest_root, const ArrayList* manifest) {
-  return delete_extras_limited(dest_root, manifest, NULL, SIZE_MAX, NULL, 0, NULL, NULL, NULL) ==
-         DELETE_WALK_OK;
-}
-
 bool has_path_traversal(const char* path) {
  if (!path)
    return true;
@@ -106,79 +106,7 @@ int env_choice_first(const char* env_name, int (*resolve)(const char*), bool* sp
 ssize_t utils_getdelim_bounded(FILE* stream, char** line, size_t* cap, int delim, size_t max_len);
 char* path_cat(const char* path1, const char* path2);
 bool glob_match(const char* pattern, const char* str);
-/* Result of a bounded extra-file deletion run. */
-typedef enum {
-  /* Every extra entry was removed (or there were none). */
-  DELETE_WALK_OK = 0,
-  /* The numeric cap for this run was reached before every extra was removed.
-     The walker removed exactly the entries the cap allowed and skipped (without
-     removing) the rest, matching rsync's partial --max-delete behavior. */
-  DELETE_WALK_LIMIT_REACHED,
-  /* A traversal or unlink failure aborted the deletion (partial removal is
-     possible, mirroring the delete pass). */
-  DELETE_WALK_ERROR
-} DeleteWalkResult;
-/* One protected entry for the delete walker.  When top_level_only is true the
-   prefix is skipped only as a DIRECT child of dest_root (the --delay-updates
-   staging directory, which must not hide genuine extras inside a nested
-   destination directory that happens to share the staging name); otherwise the
-   prefix is skipped at any depth (the --compare-dest/--copy-dest/--link-dest
-   basis trees, and the sender-side protected filter-excluded prefixes, which
-   are never destination content). */
-typedef struct {
-  const char* prefix;
-  bool top_level_only;
-} DeleteSkipEntry;
-/* True when child_rel is, or lies below, one of the protected entries (a prefix
-   "a" protects "a" and "a/b/c" but not "ab"; top_level_only entries protect
-   only DIRECT children of the destination root, i.e. child_rel has no '/'). */
-bool path_under_skip_prefix(const char* child_rel, bool at_root, const DeleteSkipEntry* skips,
-                            int skip_count);
-/* Remove files/dirs/symlinks under dest_root that are not listed in manifest
-   without ever descending into a protected prefix (see DeleteSkipEntry).  When
-   `synced_dirs` is non-NULL, extras are only removed directly inside a directory
-   whose destination-relative path is an exact entry in that list (the receive
-   root is the "." sentinel); directories outside the synchronized set are still
-   descended into so kept content below a listed directory is preserved, but
-   nothing in them is removed.  A NULL `synced_dirs` keeps the legacy behavior of
-   treating the whole destination tree as deletable.  `max_delete` caps the
-   number of removed entries (SIZE_MAX = unlimited): the walker removes up to the
-   cap and returns DELETE_WALK_LIMIT_REACHED when more extras remained.
-   `deleted_out`/`skipped_out` optionally receive the number of entries removed
-   and the number skipped because of the cap. */
-DeleteWalkResult delete_extras_limited(const char* dest_root, const ArrayList* manifest,
-                                       const ArrayList* synced_dirs, size_t max_delete,
-                                       const DeleteSkipEntry* skips, int skip_count,
-                                       const FilterRuleList* protect_rules, size_t* deleted_out,
-                                       size_t* skipped_out);

-/* Optional per-deletion observer: called for each destination-relative path
-   actually removed (a file, symlink, or directory), in removal order, so the
-   receiver can stream rsync's `--info=del`/`--info=remove` lines. */
-typedef void (*DeletePathObserver)(void* context, const char* rel_path);
-
-/* `delete_extras_limited_observed` is delete_extras_limited with an optional
- * observer; the observer is invoked only for entries truly removed.  When
- * `protect_rules` is non-NULL its receiver-side verdict is evaluated for every
- * candidate extra: a first-match PROTECT leaves the entry (and, for a
- * directory, its whole subtree) in place, while RISK/NONE fall through to the
- * ordinary skip-prefix/keep-set logic. */
-DeleteWalkResult delete_extras_limited_observed(const char* dest_root, const ArrayList* manifest,
-                                                const ArrayList* synced_dirs, size_t max_delete,
-                                                const DeleteSkipEntry* skips, int skip_count,
-                                                const FilterRuleList* protect_rules,
-                                                size_t* deleted_out, size_t* skipped_out,
-                                                DeletePathObserver observer,
-                                                void* observer_context);
-/* Read-only companion to delete_extras_limited: walk the destination exactly as
-   the delete pass would and APPEND (strdup'd) destination-relative paths that
-   WOULD be removed, without touching disk.  Used for -n/--dry-run --delete
-   would-delete reporting.  Returns true on a clean walk; the caller owns the
-   strings appended to `out` and receives their count in *count_out. */
-bool delete_extras_list(const char* dest_root, const ArrayList* manifest,
-                        const ArrayList* synced_dirs, const DeleteSkipEntry* skips, int skip_count,
-                        const FilterRuleList* protect_rules, ArrayList* out, size_t* count_out);
-bool delete_extras(const char* dest_root, const ArrayList* manifest);
 /* Open the existing destination directory at `dest_root`, confined to the
   authorized root with an O_NOFOLLOW component walk (the same confinement the
   deletion walker uses for its root).  Returns a new fd the caller owns, or -1
@@ -203,6 +131,11 @@ void utils_set_authorized_root_fd(int fd);
 * threads spawn; see utils.c). */
 int utils_get_authorized_root_fd(void);
 const char* utils_get_authorized_root_path(void);
+/* Write a diagnostic message into a caller-supplied buffer, mirroring
+ * vsnprintf.  A NULL `err` or a zero `err_size` is a no-op, so a caller that
+ * only needs the boolean status may safely pass NULL.  Returns nothing; the
+ * buffer is always NUL-terminated by vsnprintf when err_size > 0. */
+void utils_set_error(char* err, size_t err_size, const char* fmt, ...);
 /* True when `path` is `root` itself or lies directly beneath it: a lexical
 * prefix test requiring the byte after `root` to be '\0' or '/'.  Both `root`
 * and `path` must be absolute canonical paths free of "."/".." components (the
@@ -7,6 +7,7 @@
 #include "utils.h"
 #include "file_types.h"
 #include <errno.h>
+#include <limits.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -133,16 +134,23 @@ static bool xattr_name_is_posix_acl(const char* name) {

 /* ---- SENDER: capture ---- */

-FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
+/* The two syscall families differ only in whether the FINAL component is
+ * followed (`listxattr`/`getxattr` follow; `llistxattr`/`lgetxattr` do not), so
+ * one common implementation backs both public entry points. */
+typedef ssize_t (*XattrListFn)(const char* path, char* list, size_t size);
+typedef ssize_t (*XattrGetFn)(const char* path, const char* name, void* value, size_t size);
+
+static FileXattrList* xattr_capture_common(const char* path, bool preserve_acls,
+                                           XattrListFn list_fn, XattrGetFn get_fn) {
  if (!path)
    return NULL;
-  ssize_t list_size = listxattr(path, NULL, 0);
+  ssize_t list_size = list_fn(path, NULL, 0);
  if (list_size <= 0)
    return NULL; /* no xattrs, ENOTSUP, or error: nothing appliable */
  char* names = malloc((size_t)list_size);
  if (!names)
    return NULL;
-  ssize_t got = listxattr(path, names, (size_t)list_size);
+  ssize_t got = list_fn(path, names, (size_t)list_size);
  if (got < 0) {
    free(names);
    return NULL;
@@ -165,7 +173,7 @@ FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
       negotiated.  Without it a plain -X capture never carries an ACL. */
    if (!xattr_name_appliable(name, preserve_acls))
      continue;
-    ssize_t value_size = getxattr(path, name, NULL, 0);
+    ssize_t value_size = get_fn(path, name, NULL, 0);
    if (value_size < 0)
      continue;
    if (value_size > XATTR_VALUE_MAX)
@@ -178,7 +186,7 @@ FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
      free(names);
      return NULL;
    }
-    ssize_t read_len = getxattr(path, name, buffer, (size_t)value_size);
+    ssize_t read_len = get_fn(path, name, buffer, (size_t)value_size);
    if (read_len < 0 || read_len != value_size) {
      free(buffer);
      continue;
@@ -200,6 +208,14 @@ FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
  return list;
 }

+FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
+  return xattr_capture_common(path, preserve_acls, listxattr, getxattr);
+}
+
+FileXattrList* xattr_capture_path_nofollow(const char* path, bool preserve_acls) {
+  return xattr_capture_common(path, preserve_acls, llistxattr, lgetxattr);
+}
+
 /* ---- WIRE ---- */

 bool xattr_send(int fd, const FileXattrList* list) {
@@ -363,16 +379,74 @@ bool xattr_apply_fd(int fd, const FileXattrList* list) {
  return true;
 }

-/* ---- --fake-super: park ownership/mode/mtime in a reserved xattr ---- */
+/* Symlink counterpart of xattr_apply_fd(): target the link ITSELF, never its
+ * referent.  fsetxattr cannot be used (no *at xattr syscall exists, and the
+ * kernel rejects xattr syscalls on an O_PATH descriptor), so the already-open,
+ * confinement-checked parent directory is addressed through /proc/self/fd and
+ * the final component is applied with lsetxattr, which does not follow it.
+ *
+ * The list is trusted to come from xattr_receive() (already whitelisted), but
+ * every name is re-validated here so this path-based primitive is confined on
+ * its own -- this is the only apply primitive that addresses a path, and the
+ * header promises a whitelisted apply.  The apply is best-effort: if /proc is
+ * not mounted (the anchor cannot be formed) or the kernel refuses the set, the
+ * failure is skipped and never fails the transfer.  See xattr.h for the bounded
+ * residual TOCTOU between link creation and lsetxattr. */
+bool xattr_apply_path_nofollow(int parent_fd, const char* leaf, const FileXattrList* list,
+                               bool preserve_acls) {
+  if (parent_fd < 0 || !leaf || leaf[0] == '\0' || strchr(leaf, '/') != NULL || !list)
+    return false;
+  if (list->count == 0)
+    return true;
+  char prefix[64];
+  int prefix_len = snprintf(prefix, sizeof(prefix), "/proc/self/fd/%d/", parent_fd);
+  if (prefix_len < 0 || (size_t)prefix_len >= sizeof(prefix))
+    return false;
+  size_t leaf_len = strlen(leaf);
+  char* path = malloc((size_t)prefix_len + leaf_len + 1);
+  if (!path)
+    return false;
+  memcpy(path, prefix, (size_t)prefix_len);
+  memcpy(path + prefix_len, leaf, leaf_len + 1);
+  bool warned = false;
+  int first_errno = 0;
+  for (int i = 0; i < list->count; i++) {
+    const FileXattr* xa = &list->items[i];
+    /* Defense in depth: re-validate against the receiver's full whitelist, so a
+       hand-crafted list can never apply a privileged namespace or the reserved
+       --fake-super key through this path-based primitive. */
+    if (!xattr_name_appliable(xa->name, preserve_acls))
+      continue;
+    if (lsetxattr(path, xa->name, xa->value, xa->value_len, 0) != 0) {
+      if (!warned) {
+        warned = true;
+        first_errno = errno;
+      }
+    }
+  }
+  if (warned)
+    log_message(LOG_LEVEL_WARNING,
+                "could not set one or more xattrs on the destination symlink: %s",
+                strerror(first_errno));
+  free(path);
+  return true;
+}

-void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int64_t mtime_sec,
-                         int64_t mtime_nsec) {
+/* ---- --fake-super: park ownership/mode/rdev in a reserved xattr ---- */
+
+void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, uint32_t rdev_major,
+                         uint32_t rdev_minor) {
  if (fd < 0)
    return;
-  char record[128];
-  int len =
-      snprintf(record, sizeof(record), "%lu:%lu:%03o:%lld:%ld", (unsigned long)uid,
-               (unsigned long)gid, (unsigned)mode & 0777U, (long long)mtime_sec, (long)mtime_nsec);
+  /* rsync 3.4.1's exact grammar: "<octal full st_mode> <rdev_major>,<rdev_minor>
+   * <uid>:<gid>".  The octal mode carries the S_IFMT bits (e.g. 0104711 for a
+   * setuid regular file, 020644 for a char device); the rdev pair is 0,0 for a
+   * non-device.  No mtime field: rsync leaves the file's own timestamp in
+   * charge of mtime.  This value is what rsync reads back to restore a
+   * fake-super tree, so the field order and separators must not change. */
+  char record[96];
+  int len = snprintf(record, sizeof(record), "%o %u,%u %u:%u", (unsigned)mode, (unsigned)rdev_major,
+                     (unsigned)rdev_minor, (unsigned)uid, (unsigned)gid);
  if (len <= 0 || (size_t)len >= sizeof(record))
    return;
  if (fsetxattr(fd, FAKESUPER_XATTR, record, (size_t)len, 0) != 0) {
@@ -381,11 +455,64 @@ void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int6
  }
 }

-/* --fake-super replay: read the freshly-stored record and re-apply mode/mtime
- * fd-relative.  The recorded uid/gid are retained for a later privileged
- * restore but are NEVER chowned here: --fake-super only RECORDS ownership, it
- * must not real-chown the recorded (resolved) owner.  Mode/mtime still apply so
- * unprivileged --fake-super keeps working. */
+/* Parse rsync's `user.rsync.%stat` grammar strictly:
+ *   "<octal st_mode> <rdev_major>,<rdev_minor> <uid>:<gid>"
+ * Every field is parsed with strtoul() so an out-of-range value is a clean
+ * rejection rather than the undefined behavior sscanf("%u") exhibited, each
+ * field is range-checked against the same bounds the wire validator uses, and
+ * the whole record must be consumed (only trailing whitespace is tolerated) so
+ * trailing garbage is refused.  Returns false on any malformed input. */
+static bool fake_super_parse_stat(const char* record, unsigned* mode_out, unsigned* rdev_major_out,
+                                  unsigned* rdev_minor_out, unsigned* uid_out, unsigned* gid_out) {
+  if (!record)
+    return false;
+  char* end = NULL;
+  const char* p = record;
+  errno = 0;
+  unsigned long mode = strtoul(p, &end, 8);
+  if (errno != 0 || end == p || mode > (unsigned long)UINT_MAX || *end != ' ')
+    return false;
+  p = end + 1;
+  errno = 0;
+  unsigned long rdev_major = strtoul(p, &end, 10);
+  if (errno != 0 || end == p || rdev_major > 0xffffUL || *end != ',')
+    return false;
+  p = end + 1;
+  errno = 0;
+  unsigned long rdev_minor = strtoul(p, &end, 10);
+  if (errno != 0 || end == p || rdev_minor > 0x00ffffffUL || *end != ' ')
+    return false;
+  p = end + 1;
+  errno = 0;
+  unsigned long uid = strtoul(p, &end, 10);
+  if (errno != 0 || end == p || uid > (unsigned long)UINT_MAX || *end != ':')
+    return false;
+  p = end + 1;
+  errno = 0;
+  unsigned long gid = strtoul(p, &end, 10);
+  if (errno != 0 || end == p || gid > (unsigned long)UINT_MAX)
+    return false;
+  p = end;
+  while (*p == ' ' || *p == '\t' || *p == '\n' || *p == '\r')
+    p++;
+  if (*p != '\0')
+    return false;
+  *mode_out = (unsigned)mode;
+  *rdev_major_out = (unsigned)rdev_major;
+  *rdev_minor_out = (unsigned)rdev_minor;
+  *uid_out = (unsigned)uid;
+  *gid_out = (unsigned)gid;
+  return true;
+}
+
+/* --fake-super replay: read the freshly-stored record and re-apply its
+ * permission bits fd-relative.  The recorded uid/gid are retained for a later
+ * privileged restore but are NEVER chowned here: --fake-super only RECORDS
+ * ownership, it must not real-chown the recorded (resolved) owner.  The
+ * recorded rdev is likewise parsed for grammar compatibility but is not acted
+ * on (device recreation is a separate, privilege-gated path).  mtime is not in
+ * the record: the normal metadata path applies it (policy.times), exactly as
+ * rsync relies on the file's own timestamp. */
 bool fake_super_restore_fd(int fd, FileAttrPolicy policy) {
  if (fd < 0)
    return false;
@@ -394,24 +521,25 @@ bool fake_super_restore_fd(int fd, FileAttrPolicy policy) {
  if (len < 0)
    return false; /* absent or filesystem without xattrs: silent no-op */
  record[len] = '\0';
-  unsigned long ul_uid, ul_gid, ul_mode;
-  long long mtime_sec;
-  long mtime_nsec;
-  if (sscanf(record, "%lu:%lu:%lo:%lld:%ld", &ul_uid, &ul_gid, &ul_mode, &mtime_sec, &mtime_nsec) !=
-      5)
+  unsigned ul_mode, rdev_major, rdev_minor, ul_uid, ul_gid;
+  if (!fake_super_parse_stat(record, &ul_mode, &rdev_major, &rdev_minor, &ul_uid, &ul_gid))
    return false; /* malformed record: skip, never fatal */

-  /* --fake-super NEVER performs a real chown: that would defeat the whole
-     point of the flag (record privileged ownership on an unprivileged receiver
-     for a later privileged restore).  The uid/gid parsed above are retained in
-     the record for that later restore, but no ownership change happens here. */
+  /* --fake-super NEVER performs a real chown: that would defeat the whole point
+     of the flag (record privileged ownership on an unprivileged receiver for a
+     later privileged restore).  The uid/gid parsed above are retained in the
+     record for that later restore, but no ownership change happens here.  The
+     rdev is retained for the same reason. */
+  (void)rdev_major;
+  (void)rdev_minor;
  (void)ul_uid;
  (void)ul_gid;
  /* Mode is applied only when the per-attribute policy asks for it, through the
-     SAME shared helper the normal metadata path uses (metadata_mode_for_policy):
-     under --perms the recorded source mode is copied exactly, including
-     group/other write and setuid/setgid/sticky bits (rsync parity), and the -E
-     rule derives exec bits from the destination's read bits exactly like
+     SAME shared helper the normal metadata path uses (metadata_mode_for_policy).
+     The recorded special bits are stripped first: rsync's fake-super receiver
+     stores the full mode in the xattr but never installs setuid/setgid/sticky on
+     the real file, so only the 0777 permission bits may be replayed.  The -E
+     rule then derives exec bits from the destination's read bits exactly like
     file_restore_metadata_fd. */
  if (policy.perms || policy.executability) {
    struct stat cur;
@@ -419,19 +547,12 @@ bool fake_super_restore_fd(int fd, FileAttrPolicy policy) {
    if (fstat(fd, &cur) != 0) {
      log_message(LOG_LEVEL_WARNING, "--fake-super: could not read destination mode: %s",
                  strerror(errno));
-    } else if (metadata_mode_for_policy((mode_t)ul_mode, cur.st_mode, policy, &want)) {
+    } else if (metadata_mode_for_policy((mode_t)(ul_mode & 0777U), cur.st_mode, policy, &want)) {
      if (fchmod(fd, want) != 0)
        log_message(LOG_LEVEL_WARNING,
                    "--fake-super: could not restore mode on destination file: %s",
                    strerror(errno));
    }
  }
-  if (policy.times) {
-    struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},
-                                {.tv_sec = (time_t)mtime_sec, .tv_nsec = mtime_nsec}};
-    if (futimens(fd, times) != 0)
-      log_message(LOG_LEVEL_WARNING,
-                  "--fake-super: could not restore mtime on destination file: %s", strerror(errno));
-  }
  return true;
 }
@@ -26,16 +26,22 @@
 *     and total bytes) on BOTH ends to prevent OOM/memory abuse; an oversized
 *     or malformed frame is a clean protocol rejection, never an allocation
 *     blowup.
- *   * Application is confined to the exact destination file descriptor
- *     (fsetxattr on the just-written fd), never a caller-controlled path.
+ *   * Application is confined to the exact destination entry: fsetxattr on the
+ *     just-written fd for regular files/directories, and for a symlink an
+ *     lsetxattr on "/proc/self/fd/<parent_fd>/<leaf>" reached through the
+ *     already-opened, confinement-checked parent directory -- never a
+ *     caller-controlled path, and never following the link.
 */

 /* Reserved key used by --fake-super to park the source's privileged ownership
- * / mode / mtime on the destination file as an unprivileged user.* xattr, so a
- * later privileged restore could re-apply them.  Exact documented format:
- *   uid:gid:mode:mtime_sec:mtime_nsec           (decimal, decimal, octal, dec, dec)
- * e.g. "1000:1000:644:1765238400:0". */
-#define FAKESUPER_XATTR "user.fastsync.stat"
+ * / mode / rdev on the destination file as an unprivileged user.* xattr, so the
+ * tree is interoperable with rsync 3.4.1 and a later privileged restore can
+ * re-apply them.  This is rsync's own key and value grammar exactly:
+ *   <octal st_mode with S_IFMT> <rdev_major>,<rdev_minor> <uid>:<gid>
+ * e.g. "104711 0,0 1234:5678" for a setuid regular file owned by 1234:5678,
+ * or "20644 1,3 111:222" for a char device.  mtime is deliberately NOT part of
+ * the record: exactly like rsync, the file's own timestamp carries it. */
+#define FAKESUPER_XATTR "user.rsync.%stat"

 /* --- bounds --- */
 #define XATTR_NAME_MAX 255                /* xattr names are limited to 255 bytes */
@@ -76,6 +82,17 @@ bool xattr_name_appliable(const char* name, bool preserve_acls);
 * distinct from NULL. */
 FileXattrList* xattr_capture_path(const char* path, bool preserve_acls);

+/* Sender: like xattr_capture_path() but reads the xattrs of `path` ITSELF,
+ * never following a final symlink (llistxattr/lgetxattr).  A symlink entry must
+ * use this so the scanner never captures the REFERENT's attributes onto the
+ * link (the path-following variant would).  On Linux the VFS refuses to
+ * associate xattrs with symlinks at all, so this normally returns NULL; it is
+ * still correct and portable for a filesystem/platform that supports them.
+ * The same whitelist/bounds as xattr_capture_path() apply.  Returns NULL when
+ * the link has no appliable xattrs (or the filesystem does not support them);
+ * an empty-but-valid list is never returned distinct from NULL. */
+FileXattrList* xattr_capture_path_nofollow(const char* path, bool preserve_acls);
+
 /* Wire: bounded serialization.  xattr_send returns false on write failure; an
 * empty/NULL list transmits a zero-count block.  xattr_receive returns NULL and
 * sets *ok = 0 on any malformed / oversized / non-whitelisted entry.  When
@@ -91,24 +108,57 @@ FileXattrList* xattr_receive(int fd, int* ok, bool preserve_acls);
 * true when apply was attempted (allowing callers to treat it as best-effort). */
 bool xattr_apply_fd(int fd, const FileXattrList* list);

-/* --fake-super: write the source uid/gid/mode/mtime record into the reserved
- * FAKESUPER_XATTR on `fd`.  Best-effort (logged, never fatal).  Only meaningful
- * when metadata was transmitted so the values exist. */
-void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int64_t mtime_sec,
-                         int64_t mtime_nsec);
+/* Receiver: apply every entry to the symlink named by (parent_fd, leaf) WITHOUT
+ * following it, via lsetxattr() on the confined path
+ * "/proc/self/fd/<parent_fd>/<leaf>".  Every incoming name is independently
+ * re-validated against xattr_name_appliable() with `preserve_acls`, exactly like
+ * xattr_apply_fd(): a non-whitelisted namespace (including the reserved
+ * --fake-super key) is skipped, so this primitive stays confined even if handed
+ * a hand-crafted list.  A symlink cannot be targeted by the fd-relative
+ * fsetxattr() path: there is no *at() xattr syscall and the kernel rejects
+ * xattr syscalls on an O_PATH descriptor, so the already-opened,
+ * confinement-checked parent directory is the anchor and only the final
+ * component is the (no-follow) link.  `leaf` must be a single path component.
+ *
+ * Portability: the "/proc/self/fd/<parent_fd>" anchor requires a mounted /proc.
+ * Where /proc is unavailable (or the fd cannot be addressed that way) the
+ * lsetxattr simply fails and is skipped -- the apply is best-effort exactly like
+ * xattr_apply_fd(), so no error is propagated and the transfer continues.  A
+ * per-attribute failure (on Linux every set on a symlink fails with EPERM) is
+ * logged once and skipped, never fatal.  Returns false only for an invalid
+ * anchor/list; true when an apply was attempted.
+ *
+ * Residual TOCTOU: `leaf` is a caller-supplied name resolved by path in the
+ * parent, so a local writer could replace the just-created symlink between its
+ * creation and lsetxattr().  This is bounded: it requires write access to the
+ * confinement-checked destination directory (already trusted), can only install
+ * a whitelisted user namespace or POSIX-ACL name, and never follows the link (a
+ * replacement symlink is still applied to as the final, no-follow component). */
+bool xattr_apply_path_nofollow(int parent_fd, const char* leaf, const FileXattrList* list,
+                               bool preserve_acls);
+
+/* --fake-super: write the source uid/gid/mode/rdev record into the reserved
+ * FAKESUPER_XATTR on `fd`, using rsync 3.4.1's exact grammar (see the key
+ * comment above).  `mode` is the full st_mode including its S_IFMT bits.
+ * Best-effort (logged, never fatal).  Only meaningful when metadata was
+ * transmitted so the values exist. */
+void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, uint32_t rdev_major,
+                         uint32_t rdev_minor);

 /* --fake-super replay: parse the FAKESUPER_XATTR record previously written on
- * `fd` by fake_super_store_fd and re-apply mode/mtime fd-relative.  The
- * recorded uid/gid are deliberately NOT chowned for real: --fake-super only
- * RECORDS ownership (the caller stores the resolved mapping via
- * identity_resolve_storage_ids), it never performs a real chown.  Best-effort:
- * absence of the xattr or a malformed record is a silent no-op that never fails
- * the transfer.  The MODE leg is applied only when policy.perms||policy.
- * executability and the MTIME leg only when policy.times, so the fake-super
- * replay cannot bypass the per-attribute split; the mode follows the normal
- * metadata path exactly (under --perms the source mode is copied verbatim,
- * special and group/other write bits included).
- * Returns true when the xattr was present and parsed. */
+ * `fd` by fake_super_store_fd and re-apply the recorded permission bits
+ * fd-relative.  The recorded uid/gid are deliberately NOT chowned for real:
+ * --fake-super only RECORDS ownership (the caller stores the resolved mapping
+ * via identity_resolve_storage_ids), it never performs a real chown.  The
+ * recorded rdev is retained for a later privileged restore but is not acted on
+ * here.  Best-effort: absence of the xattr or a malformed record is a silent
+ * no-op that never fails the transfer.  The MODE leg is applied only when
+ * policy.perms||policy.executability, and the recorded special bits
+ * (setuid/setgid/sticky) are NOT applied to the real file -- exactly like
+ * rsync's fake-super receiver, which stores the full mode in the xattr but
+ * strips the special bits on disk.  mtime is not part of the record; the normal
+ * metadata path carries it (policy.times) exactly as rsync sets the file's own
+ * timestamp.  Returns true when the xattr was present and parsed. */
 bool fake_super_restore_fd(int fd, FileAttrPolicy policy);

 #endif
@@ -1 +0,0 @@
-OLDDEST
@@ -1 +0,0 @@
-NEWCONTENT
@@ -1 +0,0 @@
-NEWCONTENT
@@ -20,6 +20,12 @@ CLIENT_CMD = [os.path.join(BUILD_DIR, "client")]
 _WORKER = os.environ.get("PYTEST_XDIST_WORKER")
 TEST_DATA_DIR = os.path.join(PROJECT_ROOT, f"test_data-{_WORKER}" if _WORKER else "test_data")

+# Default wall-clock budget for a short-lived client invocation.  Every client
+# is expected to finish well within this; the bound exists so a hung client
+# fails the test instead of stalling the whole CI run indefinitely.  Callers
+# that legitimately need longer can pass an explicit ``timeout``.
+CLIENT_TIMEOUT = 180
+

 class ServerManager:
    """Manages a long-lived server process. Reuses across test cases."""
@@ -137,7 +143,40 @@ class CountingProxy:
        return result


-def run_client(source_dir, dest_dir, flags=None, port=None, extra_args=None):
+def _run_client_cmd(cmd, timeout):
+    """Run one client command, returning ``(result, duration)``.
+
+    On timeout the client is killed and a result-like ``CompletedProcess`` with
+    a non-zero returncode is returned instead of raising, so callers keep the
+    established ``(result, duration)`` contract and the failure carries the
+    command plus whatever output was captured for diagnosis.
+    """
+    start = time.monotonic()
+    try:
+        result = subprocess.run(cmd, text=True, capture_output=True, timeout=timeout)
+    except subprocess.TimeoutExpired as exc:
+        duration = time.monotonic() - start
+        stdout = exc.stdout or ""
+        stderr = exc.stderr or ""
+        if isinstance(stdout, bytes):
+            stdout = stdout.decode(errors="replace")
+        if isinstance(stderr, bytes):
+            stderr = stderr.decode(errors="replace")
+        diagnostic = (
+            f"client timed out after {timeout}s\n"
+            f"command: {cmd!r}\n"
+            f"--- captured stdout ---\n{stdout}\n"
+            f"--- captured stderr ---\n{stderr}"
+        )
+        result = subprocess.CompletedProcess(cmd, returncode=-1,
+                                             stdout=stdout, stderr=diagnostic)
+        return result, duration
+    duration = time.monotonic() - start
+    return result, duration
+
+
+def run_client(source_dir, dest_dir, flags=None, port=None, extra_args=None,
+               timeout=CLIENT_TIMEOUT):
    """Run the client and return (result, duration)."""
    cmd = CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir, "--save-to-disk"]
    if port:
@@ -146,23 +185,18 @@ def run_client(source_dir, dest_dir, flags=None, port=None, extra_args=None):
        cmd += flags
    if extra_args:
        cmd += extra_args
-    start = time.monotonic()
-    result = subprocess.run(cmd, text=True, capture_output=True)
-    duration = time.monotonic() - start
-    return result, duration
+    return _run_client_cmd(cmd, timeout)


-def run_client_posix(source_dir, dest_dir, flags=None, port=None):
+def run_client_posix(source_dir, dest_dir, flags=None, port=None,
+                     timeout=CLIENT_TIMEOUT):
    """Run the client with positional args (rsync-style)."""
    cmd = CLIENT_CMD + [source_dir, dest_dir, "--save-to-disk"]
    if port:
        cmd += ["--server-port", str(port)]
    if flags:
        cmd += flags
-    start = time.monotonic()
-    result = subprocess.run(cmd, text=True, capture_output=True)
-    duration = time.monotonic() - start
-    return result, duration
+    return _run_client_cmd(cmd, timeout)


 def generate_test_files(source_dir, full=False):
@@ -238,8 +272,17 @@ def make_result(name, success, duration=None, error=""):


 def get_dest_received_dir(dest_dir, source_dir):
-    """Get the path where received files land inside dest_dir."""
-    return os.path.join(dest_dir, os.path.abspath(source_dir).lstrip(os.sep))
+    """Get the path where received files land inside dest_dir.
+
+    FastSync mirrors the absolute source path below the receive root with the
+    leading root separator removed.  Strip that separator explicitly rather
+    than with ``str.lstrip(os.sep)``: ``lstrip`` removes a *set* of characters
+    rather than a path prefix, which is not the same operation.
+    """
+    abs_source = os.path.abspath(source_dir)
+    if abs_source.startswith(os.sep):
+        abs_source = abs_source[len(os.sep):]
+    return os.path.join(dest_dir, abs_source)


 def _find_free_port():
@@ -63,6 +63,10 @@ DETACH_MODULE = os.path.join(MODULE_ROOT, "detach")
 DETACH_CONF = os.path.join(TEST_DATA_DIR, "fastsyncd_detach.conf")
 DETACH_PORT = None

+# A dedicated config for the umask test: the daemon must be launched in the real
+# (double-fork) detach path, whose daemonize() applies umask(022).
+UMASK_CONF = os.path.join(TEST_DATA_DIR, "fastsyncd_umask.conf")
+
 # Passwords are never sent as plaintext and never logged; these literals are
 # only hashed into the server credential file / client password file.
 ALICE_PASS = "alice-s3cret"
@@ -137,6 +141,7 @@ class DaemonManager:
    def __init__(self):
        self._proc = None
        self._port = None
+        self.log_path = None

    def start(self, config_path, port_override=None, extra_args=None, log_path=None):
        self.stop()
@@ -150,7 +155,11 @@ class DaemonManager:
        if extra_args:
            cmd += extra_args
        if log_path is None:
-            log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
+            # A unique log per manager: several managers run in one xdist
+            # worker, and a shared log lets one daemon's truncate/write offset
+            # corrupt the other's appended lines (a flaky log assertion).
+            log_path = os.path.join(TEST_DATA_DIR, f"fastsyncd_{id(self):x}.log")
+        self.log_path = log_path
        log = open(log_path, "w")
        self._proc = subprocess.Popen(
            cmd, stdout=log, stderr=log, stdin=subprocess.DEVNULL, start_new_session=True)
@@ -220,6 +229,7 @@ def daemon_env():
            "\n"
            "[files]\n"
            "path = %s\n"
+            "read only = no\n"
            "\n"
            "[readonly]\n"
            "path = %s\n"
@@ -227,18 +237,22 @@ def daemon_env():
            "\n"
            "[locked]\n"
            "path = %s\n"
+            "read only = no\n"
            "auth users = alice\n"
            "\n"
            "[team]\n"
            "path = %s\n"
+            "read only = no\n"
            "auth users = alice,bob\n"
            "\n"
            "[owner]\n"
            "path = %s\n"
+            "read only = no\n"
            "client owner = yes\n"
            "\n"
            "[denied]\n"
            "path = %s\n"
+            "read only = no\n"
            "hosts deny = 127.0.0.1\n"
            % (config_port, FILES_MODULE, READONLY_MODULE, AUTH_MODULE, TEAM_MODULE, OWNER_MODULE,
               DENIED_MODULE))
@@ -257,7 +271,8 @@ def daemon_env():
    global DETACH_PORT
    DETACH_PORT = _find_free_port()
    with open(DETACH_CONF, "w") as f:
-        f.write("port = %d\n\n[detach]\npath = %s\n" % (DETACH_PORT, DETACH_MODULE))
+        f.write("port = %d\n\n[detach]\npath = %s\nread only = no\n"
+                % (DETACH_PORT, DETACH_MODULE))

    yield
    _kill_by_cmdline_marker(DETACH_CONF)
@@ -332,6 +347,97 @@ class TestDaemonModuleSelection:
        assert not missing, f"missing: {missing[:5]}"
        assert not mismatches, f"mismatch: {mismatches[:5]}"

+    def test_daemon_new_dirs_not_world_writable(self):
+        """The daemon must not force umask 0: implied parent directories created
+        without -p are the source default (0755 under the daemon's 022 umask),
+        never world-writable 0777.
+
+        This drives the real double-fork detach path, where the umask(022) fix
+        lives (daemonize()); the --no-detach path never calls it.  The launcher
+        is run with umask 0, so without the fix the daemon would inherit 0 and
+        create a 0777 directory; with the fix the assertion below fails only if
+        the fix regresses."""
+        port = _find_free_port()
+        with open(UMASK_CONF, "w") as f:
+            f.write("port = %d\n\n[files]\npath = %s\nread only = no\n"
+                    % (port, FILES_MODULE))
+        sub = os.path.join(FILES_MODULE, "umask_check")
+        shutil.rmtree(sub, ignore_errors=True)
+        os.makedirs(sub, exist_ok=True)
+        log_path = os.path.join(TEST_DATA_DIR, "fastsyncd_umask.log")
+        log = open(log_path, "w")
+        cmd = SERVER_CMD + ["--daemon", "--config", UMASK_CONF, "--allow-unauthenticated"]
+        proc = subprocess.Popen(cmd, stdout=log, stderr=log, stdin=subprocess.DEVNULL,
+                                preexec_fn=lambda: os.umask(0))
+        try:
+            _wait_for_port(port, timeout=15)
+            result = _push("127.0.0.1::files/umask_check", port)
+            assert result.returncode == 0, result.stderr or result.stdout
+            received = get_dest_received_dir(sub, SOURCE_DIR)
+            nested = os.path.join(received, "nested")
+            assert os.path.isdir(nested), f"nested dir missing under {received}"
+            mode = stat.S_IMODE(os.stat(nested).st_mode)
+            assert (mode & 0o022) == 0, f"implied directory is group/other writable: {oct(mode)}"
+        finally:
+            _kill_by_cmdline_marker(UMASK_CONF)
+            log.close()
+            try:
+                proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                proc.kill()
+
+
+class TestRsyncConfigCompat:
+    """A real rsyncd.conf can be pointed at FastSync: the common rsync GLOBAL
+    and MODULE keys are accepted, the ones with a FastSync equivalent (port,
+    path, read only, max connections) take effect, and the inert ones (pid
+    file, log file, comment, use chroot, uid, gid, exclude, timeout, ...) are
+    documented no-ops.  --dparam accepts the same expanded key set."""
+
+    @pytest.mark.ci
+    def test_rsync_style_config_round_trip(self):
+        module = os.path.join(MODULE_ROOT, "rsync_style")
+        shutil.rmtree(module, ignore_errors=True)
+        os.makedirs(module, exist_ok=True)
+        port = _find_free_port()
+        conf = os.path.join(TEST_DATA_DIR, "fastsyncd_rsync_style.conf")
+        with open(conf, "w") as f:
+            f.write(
+                "# an rsync 3.4.1-style rsyncd.conf\n"
+                "pid file = /tmp/fastsyncd_rsync_style.pid\n"
+                "log file = /tmp/fastsyncd_rsync_style.log\n"
+                "socket options = TCP_NODELAY\n"
+                "use chroot = no\n"
+                "uid = nobody\n"
+                "gid = nogroup\n"
+                "timeout = 600\n"
+                "max verbosity = 2\n"
+                "transfer logging = yes\n"
+                "port = %d\n"
+                "\n"
+                "[rsync_style]\n"
+                "path = %s\n"
+                "comment = rsync-style module\n"
+                "use chroot = no\n"
+                "exclude = *.tmp\n"
+                "read only = no\n"
+                "max connections = 4\n"
+                % (port, module))
+        d = DaemonManager()
+        # --dparam borrows rsync's compact spelling; `pidfile` is inert but must
+        # not be rejected, proving dparam reuses the expanded global key set.
+        d.start(conf, extra_args=["--dparam", "pidfile=/tmp/rsync_style.pid"],
+                log_path=os.path.join(TEST_DATA_DIR, "fastsyncd_rsync_style.log"))
+        try:
+            result = _push("127.0.0.1::rsync_style", d.port)
+            assert result.returncode == 0, result.stderr or result.stdout
+            received = get_dest_received_dir(module, SOURCE_DIR)
+            mismatches, missing = verify_transfer(SOURCE_DIR, received)
+            assert not missing, f"missing: {missing[:5]}"
+            assert not mismatches, f"mismatch: {mismatches[:5]}"
+        finally:
+            d.stop()
+

 class TestDaemonRejection:
    def _tree_files(self):
@@ -435,7 +541,7 @@ class TestDaemonRejection:
        before any data lands.  `accept` lists the log phrases that count as the
        refusal (a non-root daemon refuses --copy-as earlier, at the privilege
        check, so the caller accepts that phrase too)."""
-        log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
+        log_path = daemon.log_path
        before = os.path.getsize(log_path) if os.path.exists(log_path) else 0
        before_files = self._tree_files()
        result, _ = run_client(SOURCE_DIR, f"127.0.0.1::{module}", port=daemon.port, flags=flags)
@@ -472,14 +578,13 @@ class TestDaemonRejection:
        the refusal into a silent accept."""
        port = _find_free_port()
        d = DaemonManager()
-        log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
        try:
            d.start(CONF_FILE, port_override=port,
                    extra_args=["--password-file", CRED_FILE, "--no-super"])
            result, _ = run_client(SOURCE_DIR, "127.0.0.1::files", port=d.port,
                                   flags=["--super", "--preserve"])
            assert result.returncode != 0, "the --no-super daemon must refuse --super"
-            with open(log_path, "rb") as f:
+            with open(d.log_path, "rb") as f:
                tail = f.read().decode("utf-8", "replace")
            assert "client-chosen ownership" in tail, (
                f"daemon did not log the --super refusal: {tail[-400:]!r}"
@@ -968,7 +1073,7 @@ class TestDaemonAuthentication:

    def test_auth_log_does_not_leak_password(self, daemon):
        """The daemon log must never contain the password or the store verifier."""
-        log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
+        log_path = daemon.log_path
        before = os.path.getsize(log_path) if os.path.exists(log_path) else 0
        _push_with_creds("127.0.0.1::locked", daemon.port, "alice", WRONG_PASS)
        _push_with_creds("127.0.0.1::locked", daemon.port, "alice", ALICE_PASS)
@@ -995,7 +1100,7 @@ class TestDaemonAuthentication:
            _push_with_creds("127.0.0.1::locked", port, "alice", ALICE_PASS)
            _push_with_creds("127.0.0.1::locked", port, "alice", WRONG_PASS)
            time.sleep(0.3)
-            log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
+            log_path = d.log_path
            with open(log_path, "rb") as f:
                log = f.read().decode("utf-8", "replace")
        finally:
@@ -1030,7 +1135,8 @@ class TestDaemonMotd:
        motd_line = "motd file = %s\n" % motd_path if motd_path else ""
        os.makedirs(self.MOTD_MODULE, exist_ok=True)
        with open(self.MOTD_CONF, "w") as f:
-            f.write("port = %d\n%s\n[files]\npath = %s\n" % (port, motd_line, self.MOTD_MODULE))
+            f.write("port = %d\n%s\n[files]\npath = %s\nread only = no\n"
+                    % (port, motd_line, self.MOTD_MODULE))
        d = DaemonManager()
        d.start(self.MOTD_CONF, port_override=port)
        return d, port
@@ -1214,12 +1320,12 @@ class TestDaemonTLSAuth:
        _write_client_password_file(client_creds, "alice", ALICE_PASS)
        d = DaemonManager()
        port = _find_free_port()
-        log_path = os.path.join(TEST_DATA_DIR, "fastsyncd.log")
        try:
            d.start(CONF_FILE, port_override=port, extra_args=[
                "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
                "--ca", certs["ca"], "--client-cn", "fastsync-client",
                "--password-file", CRED_FILE])
+            log_path = d.log_path
            before_files = _tree_file_count(AUTH_MODULE)
            log_before = os.path.getsize(log_path) if os.path.exists(log_path) else 0
            tls_flags = ["--tls",
@@ -1267,6 +1373,7 @@ class TestDaemonConnectionLimits:
                    "\n"
                    "[locked]\n"
                    "path = %s\n"
+                    "read only = no\n"
                    "auth users = alice\n"
                    % (port, AUTH_MODULE))
        d = DaemonManager()
@@ -1304,6 +1411,7 @@ class TestDaemonConnectionLimits:
                    "\n"
                    "[files]\n"
                    "path = %s\n"
+                    "read only = no\n"
                    "max connections = 2\n"
                    % (port, FILES_MODULE))
        d = DaemonManager()
@@ -0,0 +1,291 @@
+"""Differential coverage for the delete-timing ABORT BOUNDARY (A9/A10).
+
+rsync's generator runs ahead of its throttled sender, so on a mid-transfer abort
+it has already removed every extra it planned.  FastSync now transmits the
+COMPLETE per-directory plan set before the first data frame, so an abort has the
+same effect.  Before that change FastSync only removed the extras of the
+directories its (slower) data stream had reached, and ``-d/--dirs`` used an
+end-of-transfer commit that removed nothing on abort.
+
+These tests abort both tools mid-transfer and assert the destination extras
+removed match real ``rsync 3.4.1``.  The rsync side is driven locally with
+``--bwlimit`` and a small timing window (its generator's delete list is computed
+long before the throttled payload finishes); the FastSync side uses the
+byte-deterministic slicing proxy from ``test_delete_timing_parity``.
+"""
+import os
+import shutil
+import subprocess
+import sys
+import time
+
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import (  # noqa: E402
+    TEST_DATA_DIR,
+    ServerManager,
+    clean_dir,
+    get_dest_received_dir,
+    run_client,
+)
+from test_delete_timing_parity import _SlicingProxy  # noqa: E402
+
+RSYNC = shutil.which("rsync")
+requires_rsync = pytest.mark.skipif(RSYNC is None, reason="rsync 3.4.1 not installed")
+
+# Exceeds the 10 MiB scanner chunk, so the next directory lands in a later chunk
+# (still unreached when the proxy cuts the stream).
+BIG_BYTES = 16 * 1024 * 1024
+# Cut well past the (small) config + delete-plan frames and into the big payload,
+# so the receiver has provably processed every plan before the abort.
+MID_TRANSFER_BYTES = 256 * 1024
+PROXY_THROTTLE = 0.001
+# Throttle rsync's sender so the generator has deleted long before the payload
+# finishes, then interrupt it mid-transfer.
+RSYNC_BWLIMIT = 512  # KiB/s -> ~32 s for 16 MiB
+RSYNC_ABORT_DELAY = 1.5
+
+
+def _write(path, content):
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path, "wb") as fh:
+        fh.write(content)
+
+
+def _rsync_aborted(args, delay=RSYNC_ABORT_DELAY):
+    """Start rsync, let its generator run, then interrupt it mid-transfer."""
+    env = dict(os.environ, LC_ALL="C")
+    proc = subprocess.Popen([RSYNC] + args, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                            text=True, env=env)
+    time.sleep(delay)
+    proc.terminate()
+    try:
+        proc.wait(timeout=10)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        proc.wait(timeout=5)
+    return proc
+
+
+class TestDeleteDuringAbortBoundary:
+    """A9: on an abort, every planned removal has already been applied."""
+
+    def _seed_recursive(self, tag):
+        source = os.path.join(TEST_DATA_DIR, f"dab_{tag}_src")
+        clean_dir(source)
+        # ``a/keep.bin`` sorts first, so the client streams it (and the proxy
+        # cuts) before the data pass ever reaches ``z/deep``.
+        _write(os.path.join(source, "a", "keep.bin"), b"B" * BIG_BYTES)
+        _write(os.path.join(source, "z", "deep", "keep.txt"), b"keep\n")
+        return source
+
+    @requires_rsync
+    def test_recursive_abort_removes_all_planned_extras(self):
+        # ---- FastSync: abort mid ``a/keep.bin``; ``z/deep`` is never reached.
+        source = self._seed_recursive("rec_fs")
+        dest = os.path.join(TEST_DATA_DIR, "dab_rec_fs_dst")
+        clean_dir(dest)
+        received = get_dest_received_dir(dest, source)
+        os.makedirs(os.path.join(received, "a"), exist_ok=True)
+        _write(os.path.join(received, "a", "a_extra"), b"stale\n")
+        os.makedirs(os.path.join(received, "z", "deep"), exist_ok=True)
+        _write(os.path.join(received, "z", "deep", "old_extra"), b"stale\n")
+
+        with ServerManager() as server:
+            server.start(extra_args=["--allow-delete"])
+            proxy = _SlicingProxy(server.port, forward_limit=MID_TRANSFER_BYTES,
+                                  throttle=PROXY_THROTTLE)
+            result, _ = run_client(source, dest, flags=["--delete-during"], port=proxy.port)
+            proxy.finish()
+        assert result.returncode != 0, "truncated transfer reported success"
+        assert not os.path.exists(os.path.join(received, "a", "a_extra"))
+        assert not os.path.exists(os.path.join(received, "z", "deep", "old_extra")), (
+            "FastSync left an extra in a directory it never reached before the abort"
+        )
+
+        # ---- rsync 3.4.1: same tree, same abort, same delete outcome.
+        source = self._seed_recursive("rec_rs")
+        rsync_dst = os.path.join(TEST_DATA_DIR, "dab_rec_rs_dst")
+        clean_dir(rsync_dst)
+        os.makedirs(os.path.join(rsync_dst, "a"), exist_ok=True)
+        _write(os.path.join(rsync_dst, "a", "a_extra"), b"stale\n")
+        os.makedirs(os.path.join(rsync_dst, "z", "deep"), exist_ok=True)
+        _write(os.path.join(rsync_dst, "z", "deep", "old_extra"), b"stale\n")
+
+        proc = _rsync_aborted(["-a", "--delete-during", f"--bwlimit={RSYNC_BWLIMIT}",
+                               source + "/", rsync_dst + "/"])
+        assert proc.returncode != 0, "rsync was not actually interrupted"
+        assert not os.path.exists(os.path.join(rsync_dst, "a", "a_extra"))
+        assert not os.path.exists(os.path.join(rsync_dst, "z", "deep", "old_extra")), (
+            "rsync's generator did not delete ahead of its sender"
+        )
+
+
+class TestDirsDeleteAbortBoundary:
+    """A10: ``-d/--dirs`` uses per-directory plans like rsync.
+
+    The listed directory's direct extras are removed by the up-front plan while
+    a kept but untraversed subdirectory (and its destination content) is
+    shielded.
+    """
+
+    def _seed_dirs(self, tag):
+        source = os.path.join(TEST_DATA_DIR, f"ddb_{tag}_src")
+        clean_dir(source)
+        _write(os.path.join(source, "big.bin"), b"B" * BIG_BYTES)
+        _write(os.path.join(source, "subdir", "keep.txt"), b"inner\n")
+        return source
+
+    @pytest.mark.parametrize("fs_flag,rs_flag", [("--delete-during", "--delete-during"),
+                                                 ("--delete", "--delete")])
+    @requires_rsync
+    def test_dirs_abort_removes_direct_extras_only(self, fs_flag, rs_flag):
+        label = f"{fs_flag.lstrip('-')}_{rs_flag.lstrip('-')}"
+        # ---- FastSync: ``-d`` lists the immediate children; big.bin streams and
+        # the abort lands mid-payload.
+        source = self._seed_dirs(f"dirs_{label}_fs")
+        dest = os.path.join(TEST_DATA_DIR, f"ddb_{label}_fs_dst")
+        clean_dir(dest)
+        received = get_dest_received_dir(dest, source)
+        _write(os.path.join(received, "old_extra"), b"stale\n")
+        os.makedirs(os.path.join(received, "subdir"), exist_ok=True)
+        _write(os.path.join(received, "subdir", "stale.txt"), b"stale inner\n")
+
+        with ServerManager() as server:
+            server.start(extra_args=["--allow-delete"])
+            proxy = _SlicingProxy(server.port, forward_limit=MID_TRANSFER_BYTES,
+                                  throttle=PROXY_THROTTLE)
+            result, _ = run_client(source + "/", dest, flags=["-d", fs_flag], port=proxy.port)
+            proxy.finish()
+        assert result.returncode != 0, f"{fs_flag}: truncated transfer reported success"
+        assert not os.path.exists(os.path.join(received, "old_extra")), (
+            f"{fs_flag}: the listed directory's direct extra survived the abort"
+        )
+        assert os.path.exists(os.path.join(received, "subdir", "stale.txt")), (
+            f"{fs_flag}: descended into a kept, untraversed subdirectory"
+        )
+
+        # ---- rsync 3.4.1: same shape and same abort.
+        source = self._seed_dirs(f"dirs_{label}_rs")
+        rsync_dst = os.path.join(TEST_DATA_DIR, f"ddb_{label}_rs_dst")
+        clean_dir(rsync_dst)
+        _write(os.path.join(rsync_dst, "old_extra"), b"stale\n")
+        os.makedirs(os.path.join(rsync_dst, "subdir"), exist_ok=True)
+        _write(os.path.join(rsync_dst, "subdir", "stale.txt"), b"stale inner\n")
+
+        proc = _rsync_aborted(["-d", rs_flag, f"--bwlimit={RSYNC_BWLIMIT}",
+                               source + "/", rsync_dst + "/"])
+        assert proc.returncode != 0, "rsync was not actually interrupted"
+        assert not os.path.exists(os.path.join(rsync_dst, "old_extra")), (
+            f"rsync {rs_flag}: the listed directory's direct extra survived the abort"
+        )
+        assert os.path.exists(os.path.join(rsync_dst, "subdir", "stale.txt")), (
+            f"rsync {rs_flag}: descended into a kept, untraversed subdirectory"
+        )
+
+
+def _tree(root):
+    out = []
+    for dirpath, dirs, files in os.walk(root):
+        for name in dirs:
+            out.append(os.path.relpath(os.path.join(dirpath, name), root))
+        for name in files:
+            out.append(os.path.relpath(os.path.join(dirpath, name), root))
+    return sorted(out)
+
+
+class TestDirsDeleteFinalStateParity:
+    """A10 completed run: ``-d DIR/ --delete`` (during default) and
+    ``--delete-during`` match rsync's final tree, including a kept but
+    untraversed subdirectory whose destination content survives."""
+
+    @pytest.mark.parametrize("flag", ["--delete", "--delete-during"])
+    @requires_rsync
+    def test_dirs_final_state_matches_rsync(self, flag):
+        source = os.path.join(TEST_DATA_DIR, f"ddf_{flag.lstrip('-')}_src")
+        clean_dir(source)
+        _write(os.path.join(source, "keep.txt"), b"new keep\n")
+        _write(os.path.join(source, "subdir", "inner.txt"), b"inner\n")
+
+        def seed_dest(root):
+            clean_dir(root)
+            _write(os.path.join(root, "keep.txt"), b"old keep\n")
+            _write(os.path.join(root, "extra.txt"), b"extra\n")
+            _write(os.path.join(root, "extrasub", "ex.txt"), b"extra sub\n")
+            _write(os.path.join(root, "subdir", "stale.txt"), b"stale inner\n")
+
+        rsync_dst = os.path.join(TEST_DATA_DIR, f"ddf_{flag.lstrip('-')}_rs_dst")
+        seed_dest(rsync_dst)
+        env = dict(os.environ, LC_ALL="C")
+        rsync_result = subprocess.run(
+            [RSYNC, "-d", flag, source + "/", rsync_dst + "/"],
+            capture_output=True, text=True, env=env, timeout=120)
+        assert rsync_result.returncode == 0, rsync_result.stderr
+        rsync_tree = _tree(rsync_dst)
+
+        dest = os.path.join(TEST_DATA_DIR, f"ddf_{flag.lstrip('-')}_fs_dst")
+        clean_dir(dest)
+        received = get_dest_received_dir(dest, source)
+        seed_dest(received)
+        with ServerManager() as server:
+            server.start(extra_args=["--allow-delete"])
+            result, _ = run_client(source + "/", dest, flags=["-d", flag], port=server.port)
+        assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+        fastsync_tree = _tree(received)
+        assert fastsync_tree == rsync_tree, (
+            f"-d {flag}: fastsync tree {fastsync_tree} != rsync tree {rsync_tree}")
+
+
+class TestOneFileSystemDeleteParity:
+    """A9 side effect: the per-directory plan is now emitted only for directories
+    whose children were enumerated, so a ``-x`` mount-point directory that is
+    emitted but never traversed is shielded -- its destination content survives,
+    exactly as rsync keeps a non-descended mount point under ``--delete``."""
+
+    @requires_rsync
+    def test_mountpoint_content_survives_delete(self):
+        local = os.stat(".")
+        shm = "/dev/shm"
+        if not os.path.isdir(shm) or os.stat(shm).st_dev == local.st_dev:
+            pytest.skip("no cross-device filesystem available")
+        probe = os.path.join(shm, f"fastsync_dofs_{os.getpid()}")
+        clean_dir(probe)
+        _write(os.path.join(probe, "inside.txt"), b"cross\n")
+        try:
+            source = os.path.join(TEST_DATA_DIR, "dofs_src")
+            clean_dir(source)
+            _write(os.path.join(source, "keep.txt"), b"keep\n")
+            os.symlink(probe, os.path.join(source, "nested_link"))
+
+            def seed_dest(root):
+                clean_dir(root)
+                _write(os.path.join(root, "keep.txt"), b"old\n")
+                _write(os.path.join(root, "nested_link", "stale.txt"), b"stale\n")
+
+            rsync_dst = os.path.join(TEST_DATA_DIR, "dofs_rs_dst")
+            seed_dest(rsync_dst)
+            env = dict(os.environ, LC_ALL="C")
+            rsync_result = subprocess.run(
+                [RSYNC, "-a", "--copy-links", "-x", "--delete-during",
+                 source + "/", rsync_dst + "/"],
+                capture_output=True, text=True, env=env, timeout=120)
+            assert rsync_result.returncode == 0, rsync_result.stderr
+            assert os.path.exists(os.path.join(rsync_dst, "nested_link", "stale.txt")), (
+                "rsync unexpectedly descended into the mount point")
+
+            dest = os.path.join(TEST_DATA_DIR, "dofs_fs_dst")
+            clean_dir(dest)
+            received = get_dest_received_dir(dest, source)
+            seed_dest(received)
+            with ServerManager() as server:
+                server.start(extra_args=["--allow-delete"])
+                result, _ = run_client(source, dest,
+                                       flags=["-a", "--copy-links", "-x", "--delete-during"],
+                                       port=server.port)
+            assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+            assert os.path.exists(os.path.join(received, "nested_link", "stale.txt")), (
+                "FastSync descended into a non-traversed mount point under --delete")
+        finally:
+            clean_dir(probe)
+
@@ -111,13 +111,20 @@ class _SlicingProxy:
    """

    def __init__(self, target_port, forward_limit=None, hook=None, hook_after=0,
-                 throttle=0.0, wait_for_reply=False):
+                 throttle=0.0, wait_for_reply=False, hook_after_config_ack=False):
        self.target = ("127.0.0.1", target_port)
        self.forward_limit = forward_limit
        self.hook = hook
        self.hook_after = hook_after
        self.throttle = throttle
        self.wait_for_reply = wait_for_reply
+        # When set, the hook fires on the FIRST client->server bytes that follow
+        # the config-frame ack, BEFORE they are forwarded.  For --delete-before
+        # those bytes are the keep-set manifest, so this runs the hook after the
+        # client's source pre-scan but before the receiver's delete ack releases
+        # the client into its data pass -- a deterministic late-file window.
+        self.hook_after_config_ack = hook_after_config_ack
+        self.config_acked = False
        self.server_replied = threading.Event()
        self.hook_called = threading.Event()
        self.listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
@@ -165,6 +172,13 @@ class _SlicingProxy:
                                socks = []
                                break
                            data = data[:room]
+                        if (self.hook_after_config_ack and self.config_acked and self.hook is not None
+                                and not self.hook_called.is_set()):
+                            # The first client bytes after the config ack are the
+                            # pre-scan keep-set manifest: run the injection before
+                            # forwarding so it is causally after the source scan.
+                            self.hook()
+                            self.hook_called.set()
                        backend.sendall(data)
                        forwarded += len(data)
                        self._maybe_hook(forwarded)
@@ -177,6 +191,7 @@ class _SlicingProxy:
                        client.sendall(data)
                        # Any server reply proves the receiver consumed the
                        # frames that precede it, so the hook barrier is met.
+                        self.config_acked = True
                        self.server_replied.set()
                        self._maybe_hook(forwarded)
        except OSError:
@@ -198,8 +213,11 @@ class _SlicingProxy:
    def _maybe_hook(self, forwarded):
        """Fire the one-shot hook once its barrier is satisfied: enough client
        bytes have been forwarded and, when ``wait_for_reply`` is set, the
-        server has sent a reply proving it processed the preceding frames."""
-        if self.hook is None or self.hook_called.is_set():
+        server has sent a reply proving it processed the preceding frames.
+
+        ``hook_after_config_ack`` uses its own barrier (see ``_serve``), so the
+        byte/reply heuristic is bypassed entirely."""
+        if self.hook is None or self.hook_called.is_set() or self.hook_after_config_ack:
            return
        if forwarded < self.hook_after:
            return
@@ -537,3 +555,76 @@ class TestDeleteDelayMaxDeleteRefilledDir:
        assert os.path.isdir(later_dir), "later extra was not skipped by the budget"
        # The one actual removal is reported.
        assert _deleted_count(result.stdout) == 1, result.stdout
+
+
+class TestDeleteBeforeLateFileParity:
+    """rsync builds its file list once, so a source file created after that scan
+    is NOT transferred and its destination extra is deleted.  FastSync used to
+    re-scan the source in its data pass (single-threaded) or pipeline a fresh
+    re-scan against the pre-scan keep-set (``--threads``) and would transfer the
+    late file (a safe superset); both paths now replay the pre-scan file list
+    instead, matching rsync.
+
+    The late file is injected through the config-ack barrier: the first client
+    bytes after the config ack are the pre-scan keep-set manifest, so the hook
+    runs causally after the source scan and before the receiver's delete ack
+    releases the client into its data pass.
+
+    For ``--threads`` the pipeline scanner runs concurrently with the sender, so
+    the injection must land while that re-scan is still in flight to be observed
+    by it.  The source is therefore a tree of ``_N_DIRS`` directories: the
+    injection writes the late file into EVERY directory, so it is enough that
+    any one directory is still unscanned when the hook fires.  The tree is sized
+    so the hook (a localhost round trip) lands long before a full scan finishes;
+    a re-scanning pipeline then transfers the late files for the directories it
+    has not yet reached, which the tree comparison catches.
+    """
+
+    _N_DIRS = 2000
+
+    @requires_rsync
+    @pytest.mark.parametrize("mt", [False, True])
+    def test_late_source_file_not_transferred_and_extra_deleted(self, mt):
+        tag = f"dblate_mt{int(mt)}"
+        source = os.path.join(TEST_DATA_DIR, f"{tag}_src")
+        dest = os.path.join(TEST_DATA_DIR, f"{tag}_dst")
+        rsync_dst = os.path.join(TEST_DATA_DIR, f"{tag}_rsync_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        clean_dir(rsync_dst)
+        for i in range(self._N_DIRS):
+            _write(os.path.join(source, f"dir{i:05d}", "keep.txt"), b"kept payload\n")
+        # Both destinations carry the would-be late file as an extra.
+        for root in (dest, rsync_dst):
+            received = get_dest_received_dir(root, source)
+            for i in range(self._N_DIRS):
+                _write(os.path.join(received, f"dir{i:05d}", "late.txt"), b"stale extra\n")
+
+        # rsync reference: the same source with no late file; the extras are
+        # removed and nothing is transferred for the (never-scanned) late paths.
+        rsync_result = _rsync(["-a", "--delete-before", source + "/", rsync_dst + "/"])
+        assert rsync_result.returncode == 0, rsync_result.stderr
+        rsync_tree = _tree(rsync_dst)
+        assert "dir00000/late.txt" not in rsync_tree
+
+        received = get_dest_received_dir(dest, source)
+
+        def hook():
+            # Runs after the pre-scan and before the receiver's delete ack.
+            for i in range(self._N_DIRS):
+                _write(os.path.join(source, f"dir{i:05d}", "late.txt"),
+                       b"created after the scan\n")
+
+        with ServerManager() as server:
+            server.start(extra_args=["--allow-delete"])
+            proxy = _SlicingProxy(server.port, hook=hook, hook_after_config_ack=True)
+            flags = ["--delete-before"] + (["--threads=4"] if mt else [])
+            result, _ = run_client(source, dest, flags=flags, port=proxy.port)
+            proxy.finish()
+        assert result.returncode == 0, (result.stderr or result.stdout)[:400]
+        assert proxy.hook_called.is_set(), "late-file hook never fired"
+        assert _tree(received) == rsync_tree, (
+            f"late source {'multithreaded' if mt else 'single-threaded'} data pass re-scanned: "
+            f"{sum(1 for p in _tree(received) if p.endswith('late.txt'))} late files were "
+            "transferred"
+        )
@@ -36,7 +36,7 @@ from common import (  # noqa: E402
    verify_transfer,
 )

-PROTOCOL_VERSION = b"2.28.0"
+PROTOCOL_VERSION = b"2.29.0"
 STATUS_MANIFEST = 5
 STATUS_OK = 0

@@ -183,10 +183,11 @@ class TestDeviceSpecial:
            )

    @pytest.mark.setpriv
-    def test_devices_nonroot_receiver_skips_safely(self):
-        """A receiver without CAP_MKNOD must skip a device entry with a warning
-        and never abort.  A root runner drops the receiver (server) to nobody
-        via setpriv; on a non-root runner (or without setpriv) the test skips."""
+    def test_devices_nonroot_receiver_errors_like_rsync(self):
+        """A receiver without CAP_MKNOD must report the failed device mknod as a
+        transfer error (rsync parity, partial failure) instead of silently
+        succeeding.  A root runner drops the receiver (server) to nobody via
+        setpriv; on a non-root runner (or without setpriv) the test skips."""
        if os.geteuid() != 0 or shutil.which("setpriv") is None:
            pytest.skip("requires root + setpriv to run the receiver unprivileged")
        self._setup()
@@ -202,16 +203,16 @@ class TestDeviceSpecial:
                                   flags=["--devices"], port=port)
        finally:
            out, err = _stop_captured_server(server)
-        assert result.returncode == 0, f"Exit {result.returncode}: {result.stderr[:300]}"
-        received = get_dest_received_dir(DEVICE_DEST, DEVICE_SOURCE)
-        with open(os.path.join(received, "plain.txt")) as f:
-            assert f.read() == "regular content\n"
-        assert not os.path.lexists(os.path.join(received, "chardev")), (
-            "a receiver without CAP_MKNOD must skip the device node, not create it"
+        assert result.returncode != 0, (
+            f"a failed device mknod must be a transfer error like rsync (got exit 0): "
+            f"{(out + err)[:300]}"
        )
-        assert ("cannot create device node" in (out + err)
-                or "device-node creation is not permitted" in (out + err)), (
-            f"receiver did not log the documented device skip: out={out!r} err={err!r}"
+        received = get_dest_received_dir(DEVICE_DEST, DEVICE_SOURCE)
+        assert not os.path.lexists(os.path.join(received, "chardev")), (
+            "a receiver without CAP_MKNOD must not create the device node"
+        )
+        assert "cannot create device" in (out + err), (
+            f"receiver did not log the device creation error: out={out!r} err={err!r}"
        )

    @pytest.mark.skipif(os.geteuid() != 0, reason="requires root to create device nodes")
@@ -2275,6 +2276,36 @@ class TestPartialDir:
        partial = os.path.join(dest, ".partial", os.path.relpath(source_file, os.path.sep))
        assert not os.path.exists(partial)

+    def test_partial_dir_alone_implies_partial(self, shared_server):
+        """--partial-dir=DIR with no --partial implies --partial, like rsync.
+
+        rsync 3.4.1 retains the staged partial when --partial-dir is given by
+        itself; before the implication was added FastSync discarded it.  The
+        transfer is made to fail deterministically by placing a non-empty
+        directory at the destination path, so the final partial-dir ->
+        destination rename fails and whatever was staged under the partial dir
+        stays on disk."""
+        source = os.path.join(TEST_DATA_DIR, "partial_dir_implied_src")
+        dest = os.path.join(TEST_DATA_DIR, "partial_dir_implied_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        source_file = os.path.join(source, "f.bin")
+        with open(source_file, "wb") as f:
+            f.write(b"partial payload")
+
+        received = get_dest_received_dir(dest, source)
+        os.makedirs(os.path.join(received, "f.bin"))
+        with open(os.path.join(received, "f.bin", "keep"), "wb") as f:
+            f.write(b"keep")
+
+        result, _ = run_client(source, dest, flags=["--partial-dir=.partial"],
+                               port=shared_server.port)
+        assert result.returncode != 0, "expected the blocked install to fail"
+
+        partial = os.path.join(dest, ".partial", os.path.relpath(source_file, os.path.sep))
+        assert os.path.exists(partial), \
+            "--partial-dir alone must imply --partial and retain the partial file"
+

 class TestLargeFile:
    def test_transfer_100mb_file(self, shared_server):
@@ -2606,35 +2637,30 @@ class TestTimeoutAndAllocLimits:
        mismatches, missing = verify_transfer(source, received)
        assert not missing and not mismatches

-    def test_temp_dir_cross_filesystem_fallback(self, shared_server):
-        """A confined relative --temp-dir that resolves (via a symlink under the
-        destination root) to another filesystem must fall back to a non-atomic
-        copy instead of aborting (rsync parity).  Skipped when no second
-        filesystem is available."""
-        shm = "/dev/shm"
-        if not os.path.isdir(shm):
-            pytest.skip("/dev/shm not available")
-        if os.stat(shm).st_dev == os.stat(TEST_DATA_DIR).st_dev:
-            pytest.skip("/dev/shm is on the same filesystem as the test data")
-        scratch = os.path.join(shm, f"fastsync_tmp_{os.getpid()}")
-        shutil.rmtree(scratch, ignore_errors=True)
-        os.makedirs(scratch)
+    def test_temp_dir_symlink_escape_rejected(self, shared_server):
+        """A symlink planted inside the destination root pointing outside it
+        must not redirect receiver scratch files: --temp-dir=<that link> is
+        refused and nothing is written at the link target.  An in-root symlink
+        (e.g. to a mount point that stays inside the authorized root) is still
+        accepted, preserving the engine's EXDEV cross-filesystem fallback."""
+        source, dest = self._seed("tempdir_escape_src")
+        outside = "/tmp/fastsync_tempdir_escape_%d" % os.getpid()
+        shutil.rmtree(outside, ignore_errors=True)
+        os.makedirs(outside)
+        link = os.path.join(dest, "escape_scratch")
+        if os.path.lexists(link):
+            os.unlink(link)
+        os.symlink(outside, link)
        try:
-            source, dest = self._seed("tempdir_xdev_src")
-            # The receiver resolves a relative temp dir under the destination
-            # root; a symlink there points the scratch at the second filesystem.
-            link = os.path.join(dest, "xdev_scratch")
-            os.symlink(scratch, link)
-            result, _ = run_client(source, dest, flags=["--temp-dir", "xdev_scratch"],
+            result, _ = run_client(source, dest, flags=["--temp-dir", "escape_scratch"],
                                   port=shared_server.port)
-            assert result.returncode == 0, f"cross-fs temp-dir failed: {result.stderr[:300]}"
+            assert result.returncode != 0, "an escaping --temp-dir symlink must be refused"
            received = get_dest_received_dir(dest, source)
-            mismatches, missing = verify_transfer(source, received)
-            assert not missing, f"Missing: {missing}"
-            assert not mismatches, f"Mismatch: {mismatches}"
-            assert os.listdir(scratch) == [], "temp files left behind in the cross-fs scratch"
+            assert not os.path.exists(os.path.join(received, "f.txt")), \
+                "the receiver must not fall back to writing the file"
+            assert os.listdir(outside) == [], "receiver wrote outside the authorized root"
        finally:
-            shutil.rmtree(scratch, ignore_errors=True)
+            shutil.rmtree(outside, ignore_errors=True)


 class TestRemoteOptionTransport:
@@ -2761,7 +2787,12 @@ class TestItemizeChanges:
                               flags=["--preserve", "-i", "--incremental"],
                               port=shared_server.port)
        assert result.returncode == 0, f"incremental itemize failed: {result.stderr[:200]}"
-        itemized = [line for line in result.stdout.splitlines() if line and line[0] in ">.<c"]
+        # -i also emits the transfer-root and directory lines; only FILE entries
+        # matter here, so drop any line whose name has a trailing '/'.
+        itemized = [
+            line for line in result.stdout.splitlines()
+            if line and line[0] in ">.<c" and not line.rsplit(" ", 1)[-1].endswith("/")
+        ]
        assert itemized == [], f"unchanged files were itemized: {itemized[:5]}"

    def test_multithreaded_emits_same_itemize_lines(self, shared_server):
@@ -5782,6 +5813,35 @@ class TestStandaloneSuperDefault:
            "standalone server accepted --copy-as without --allow-super"
        )

+    @pytest.mark.skipif(
+        os.geteuid() != 0,
+        reason="root triggers the SUPER_MODE_OFF default and can create setuid sources",
+    )
+    def test_special_bits_masked_without_allow_super(self):
+        """A root standalone server without --allow-super forces SUPER_MODE_OFF,
+        so client-supplied setuid/setgid/sticky bits must be stripped even under
+        -p (they are super-user activities just like device-node creation)."""
+        source = os.path.join(TEST_DATA_DIR, "super_default_mode_src")
+        dest = os.path.join(TEST_DATA_DIR, "super_default_mode_dst")
+        clean_dir(source)
+        clean_dir(dest)
+        src_file = os.path.join(source, "priv.sh")
+        with open(src_file, "wb") as f:
+            f.write(b"#!/bin/sh\necho hi\n")
+        os.chmod(src_file, 0o4755)
+        server = ServerManager()
+        server.start()  # deliberately no --allow-super -> SUPER_MODE_OFF as root
+        try:
+            result, _ = run_client(source, dest, flags=["-p"], port=server.port)
+        finally:
+            server.stop()
+        assert result.returncode == 0, f"exit {result.returncode}: {(result.stderr or '')[:200]}"
+        received = get_dest_received_dir(dest, source)
+        mode = stat.S_IMODE(os.stat(os.path.join(received, "priv.sh")).st_mode)
+        assert (mode & (stat.S_ISUID | stat.S_ISGID | stat.S_ISVTX)) == 0, \
+            f"--no-super receiver kept a privileged bit: {oct(mode)}"
+        assert (mode & 0o777) == 0o755, f"ordinary permission bits lost: {oct(mode)}"
+
    @pytest.mark.skipif(os.geteuid() != 0, reason="root can create the source device node")
    def test_devices_skipped_without_allow_super(self):
        """Root standalone server without --allow-super must skip device-node
@@ -6540,7 +6600,7 @@ class TestExtendedAttributes:
            os.getxattr(os.path.join(received, "data.txt"), "user.foo")

    def test_reserved_fake_super_key_not_forwarded(self, shared_server):
-        """A source file that already carries the reserved user.fastsync.stat
+        """A source file that already carries the reserved user.rsync.%stat
        record must NOT have it planted on the receiver during a plain -X run
        (it is receiver-only, so it cannot be spoofed for a later privileged
        restore)."""
@@ -6550,7 +6610,7 @@ class TestExtendedAttributes:
            fh.write(b"reserved\n")
        if not _xattr_supported(f):
            pytest.skip("filesystem does not support user xattrs")
-        os.setxattr(f, "user.fastsync.stat", b"0:0:644:0:0")
+        os.setxattr(f, "user.rsync.%stat", b"100644 0,0 0:0")
        # A normal user.* attr still travels alongside.
        os.setxattr(f, "user.keep", b"yes")

@@ -6560,7 +6620,7 @@ class TestExtendedAttributes:
        received = get_dest_received_dir(dest, source)
        assert os.getxattr(os.path.join(received, "data.txt"), "user.keep") == b"yes"
        with pytest.raises(OSError):
-            os.getxattr(os.path.join(received, "data.txt"), "user.fastsync.stat")
+            os.getxattr(os.path.join(received, "data.txt"), "user.rsync.%stat")

    @pytest.mark.ci
    def test_xattrs_multithreaded(self, shared_server):
@@ -6577,6 +6637,68 @@ class TestExtendedAttributes:
        received = get_dest_received_dir(dest, source)
        assert os.getxattr(os.path.join(received, "data.txt"), "user.k") == b"v"

+    @pytest.mark.ci
+    def test_symlink_own_xattrs_never_referent(self, shared_server):
+        """Protocol 2.29.0: a symlink's STATUS_SYMLINK frame carries a trailing
+        xattr block captured with llistxattr/lgetxattr (no follow) and applied
+        with lsetxattr on the link itself.  Linux's VFS refuses to associate
+        xattrs with a symlink at all, so the portable guarantee asserted here is
+        the no-follow one: a referent that carries user.* must NOT have those
+        attributes appear on the destination symlink entry (the old
+        path-following capture would have copied the referent's attrs onto the
+        link).  On a platform/filesystem that does support symlink xattrs the
+        full round-trip of the link's own attribute is asserted too."""
+        source, dest = self._source_and_dest("symlink_xattr")
+        target = os.path.join(source, "target.txt")
+        with open(target, "wb") as fh:
+            fh.write(b"referent payload\n")
+        if not _xattr_supported(target):
+            pytest.skip("filesystem does not support user xattrs")
+        os.setxattr(target, "user.referent-only", b"referent-value")
+
+        link = os.path.join(source, "link")
+        os.symlink("target.txt", link)
+        link_xattr_supported = False
+        try:
+            os.setxattr(link, "user.link-own", b"link-value", follow_symlinks=False)
+            link_xattr_supported = os.getxattr(
+                link, "user.link-own", follow_symlinks=False
+            ) == b"link-value"
+        except (OSError, AttributeError, NotImplementedError):
+            link_xattr_supported = False
+
+        result, _ = run_client(source, dest, flags=["-aX"], port=shared_server.port)
+        assert result.returncode == 0, \
+            f"-aX symlink sync failed: {(result.stderr or result.stdout)[:300]}"
+        received = get_dest_received_dir(dest, source)
+        dst_link = os.path.join(received, "link")
+        assert os.path.islink(dst_link), "destination link entry is not a symlink"
+        assert os.readlink(dst_link) == "target.txt"
+
+        # The no-follow guarantee.  Checking only the link's own xattr list is
+        # vacuous on Linux (lsetxattr on a symlink always fails EPERM), so also
+        # prove the apply never followed the link: the destination REFERENT must
+        # keep its own user.* value untouched.
+        dst_target = os.path.join(received, "target.txt")
+        assert os.getxattr(dst_target, "user.referent-only") == b"referent-value", (
+            "the destination symlink apply followed the link and rewrote the "
+            "referent's xattr"
+        )
+        link_names = os.listxattr(dst_link, follow_symlinks=False)
+        assert "user.referent-only" not in link_names, (
+            "the destination symlink captured its REFERENT's xattr "
+            "(path-following capture bug)"
+        )
+        if sys.platform.startswith("linux"):
+            assert link_names == [], (
+                "Linux associates no xattrs with a symlink; the link entry must "
+                "carry none"
+            )
+        if link_xattr_supported:
+            assert os.getxattr(
+                dst_link, "user.link-own", follow_symlinks=False
+            ) == b"link-value", "the symlink's own xattr did not round-trip"
+
    @pytest.mark.ci
    def test_acls_via_posix_acl_xattr(self, shared_server):
        source, dest = self._source_and_dest("acl")
@@ -6649,10 +6771,17 @@ class TestExtendedAttributes:
        assert result.returncode == 0, \
            f"--fake-super sync failed: {(result.stderr or result.stdout)[:300]}"
        received = get_dest_received_dir(dest, source)
-        record = os.getxattr(os.path.join(received, "data.txt"), "user.fastsync.stat").decode()
-        fields = record.split(":")
-        assert len(fields) == 5
-        assert fields[0] == str(uid), f"reserved uid field {fields[0]} != source uid {uid}"
+        record = os.getxattr(os.path.join(received, "data.txt"), "user.rsync.%stat").decode()
+        # rsync 3.4.1 grammar: "<octal st_mode> <rdev_major>,<rdev_minor> <uid>:<gid>".
+        fields = record.split()
+        assert len(fields) == 3, f"unexpected rsync fake-super record {record!r}"
+        mode_field, rdev_field, owner_field = fields
+        assert rdev_field == "0,0", f"regular file rdev must be 0,0, got {rdev_field!r}"
+        assert int(mode_field, 8) & 0o170000 == stat.S_IFREG, (
+            f"recorded mode {mode_field!r} must carry S_IFREG"
+        )
+        assert owner_field.split(":")[0] == str(uid), \
+            f"recorded uid {owner_field!r} != source uid {uid}"

    @pytest.mark.ci
    def test_fake_super_records_resolved_chown_without_real_chown(self, shared_server):
@@ -6671,12 +6800,71 @@ class TestExtendedAttributes:
        assert result.returncode == 0, \
            f"--fake-super --chown sync failed: {(result.stderr or result.stdout)[:300]}"
        dst = os.path.join(get_dest_received_dir(dest, source), "data.txt")
-        record = os.getxattr(dst, "user.fastsync.stat").decode().split(":")
-        assert record[0] == "33333", f"recorded owner {record[0]} != resolved 33333"
-        assert record[1] == "44444", f"recorded group {record[1]} != resolved 44444"
+        record = os.getxattr(dst, "user.rsync.%stat").decode().split()
+        owner = record[2].split(":")
+        assert owner == ["33333", "44444"], (
+            f"recorded owner {record[2]!r} != resolved 33333:44444"
+        )
        st = os.stat(dst)
        assert st.st_uid != 33333, "--fake-super must not real-chown the recorded owner"

+    @pytest.mark.ci
+    def test_fake_super_rsync_interop(self, shared_server):
+        """A fake-super tree written by FastSync is readable by rsync 3.4.1:
+        rsync reads the `user.rsync.%stat` record (mode/rdev/uid:gid) and, when
+        it re-emits a fake-super tree, reproduces the same record.  This pins
+        the on-disk key and value grammar against the real tool."""
+        rsync = shutil.which("rsync")
+        if rsync is None:
+            pytest.skip("rsync not installed")
+        source, dest = self._source_and_dest("fakesuper_interop")
+        f = os.path.join(source, "data.txt")
+        with open(f, "wb") as fh:
+            fh.write(b"interop\n")
+        if not _xattr_supported(f):
+            pytest.skip("filesystem does not support user xattrs")
+        # rsync's fake-super receiver only writes a %stat% record when it has
+        # something to fake; a root-owned file with a matching root stat is
+        # a no-op.  When privileged, record a non-root owner so the round-trip
+        # actually exercises the parser (non-root CI already has a non-zero uid).
+        if os.geteuid() == 0:
+            try:
+                os.chown(f, 12345, 12346)
+            except OSError:
+                pass
+        # A setuid bit exercises the full st_mode encoding; set it AFTER any
+        # chown (chown clears setuid/setgid), and note that neither tool installs
+        # it on the real destination file.
+        os.chmod(f, 0o4711)
+
+        result, _ = run_client(source, dest, flags=["--fake-super"],
+                               port=shared_server.port)
+        assert result.returncode == 0, \
+            f"--fake-super sync failed: {(result.stderr or result.stdout)[:300]}"
+        received = get_dest_received_dir(dest, source)
+        rec = os.getxattr(os.path.join(received, "data.txt"), "user.rsync.%stat").decode()
+        rec_fields = rec.split()
+        assert len(rec_fields) == 3 and rec_fields[1] == "0,0", (
+            f"FastSync did not write rsync's stat grammar: {rec!r}"
+        )
+        assert int(rec_fields[0], 8) & 0o7777 == 0o4711, (
+            f"FastSync did not record the source mode in rsync's grammar: {rec!r}"
+        )
+
+        out = os.path.join(TEST_DATA_DIR, "fakesuper_interop_rsync")
+        clean_dir(out)
+        rs = subprocess.run([rsync, "-aX", "--fake-super",
+                             received + "/", out + "/"],
+                            capture_output=True, text=True, timeout=120)
+        assert rs.returncode == 0, (
+            f"rsync could not read FastSync's fake-super tree: {rs.stderr[:300]}"
+        )
+        out_rec = os.getxattr(os.path.join(out, "data.txt"), "user.rsync.%stat").decode()
+        assert out_rec == rec, (
+            "rsync re-emitted a different fake-super record; FastSync's grammar "
+            f"is not interoperable: ours={rec!r} rsync={out_rec!r}"
+        )
+
    @pytest.mark.ci
    def test_directory_xattrs_preserved(self, shared_server):
        """#286.3: -aX must preserve user.* xattrs on DIRECTORIES, not just files."""
@@ -6696,6 +6884,31 @@ class TestExtendedAttributes:
        assert os.getxattr(received, "user.rootdir") == b"r"
        assert os.getxattr(os.path.join(received, "sub"), "user.subdir") == b"s"

+    @pytest.mark.ci
+    @pytest.mark.parametrize("mt", [False, True])
+    def test_dirs_directory_xattr_applied(self, shared_server, mt):
+        """#286.3: -d/-X must apply a transferred directory's user.* xattr at the
+        destination through the --dirs STATUS_MKDIR path (both the
+        single-threaded and -m/--threads receiver paths)."""
+        source, dest = self._source_and_dest("dirsxattr")
+        sub = os.path.join(source, "sub")
+        os.makedirs(sub)
+        if not _xattr_supported(sub):
+            pytest.skip("filesystem does not support user xattrs")
+        os.setxattr(sub, "user.dirsdir", b"dirs-value")
+        lst = os.path.join(TEST_DATA_DIR, "dirs_xattr_list.txt")
+        with open(lst, "wb") as fh:
+            fh.write(b"sub\n")
+
+        flags = ["--files-from", lst, "--dirs", "-R", "-X"] + (["--threads"] if mt else [])
+        result, _ = run_client(source, dest, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, \
+            f"--dirs -X sync failed: {(result.stderr or result.stdout)[:300]}"
+        received = os.path.join(dest, "sub")
+        assert os.path.isdir(received), "--dirs directory entry was not created"
+        assert os.getxattr(received, "user.dirsdir") == b"dirs-value", \
+            "the --dirs directory's user.* xattr was not applied at the destination"
+
    @pytest.mark.ci
    def test_directory_default_acl_preserved(self, shared_server):
        """#286.3: -aA must preserve a directory's default POSIX ACL (the
@@ -7171,9 +7384,10 @@ class TestCopyAs:
        )
        received = get_dest_received_dir(dest, source)
        dst = os.path.join(received, "mixed.txt")
-        record = os.getxattr(dst, "user.fastsync.stat").decode().split(":")
-        assert (record[0], record[1]) == ("65534", "65534"), (
-            f"fake-super must record the resolved copy-as ownership: {record[:2]}"
+        record = os.getxattr(dst, "user.rsync.%stat").decode().split()
+        owner = record[2].split(":")
+        assert owner == ["65534", "65534"], (
+            f"fake-super must record the resolved copy-as ownership: {owner}"
        )
        st = os.lstat(dst)
        assert (st.st_uid, st.st_gid) != (12345, 12346), (
@@ -26,6 +26,17 @@ def _rsync(args):
    )


+def _file_entry_line(text):
+    """The file entry line for a single-file transfer.
+
+    -i/--out-format emit the transfer-root (and directory) lines too, so the
+    file entry is not necessarily the first line; for the one-file corpora used
+    by the wire-counter tests it is the last non-empty line.
+    """
+    lines = [line for line in text.splitlines() if line.strip()]
+    return lines[-1] if lines else ""
+
+
 def _make_selection_tree(root):
    clean_dir(root)
    os.makedirs(os.path.join(root, "sub"))
@@ -184,6 +195,120 @@ class TestItemizeParity:
        )
        assert fast_lines == rsync_lines, f"rsync={rsync_lines} fastsync={fast_lines}"

+    @requires_rsync
+    @pytest.mark.ci
+    def test_itemize_directory_lines_match_rsync(self, shared_server):
+        """#292: -i/--out-format emit rsync's directory lines (including the
+        transfer root) in rsync's depth-first order."""
+        source = os.path.join(TEST_DATA_DIR, "out_itemdir_src")
+        dest = os.path.join(TEST_DATA_DIR, "out_itemdir_dst")
+        rdst = os.path.join(TEST_DATA_DIR, "out_itemdir_rdst")
+        clean_dir(source)
+        os.makedirs(os.path.join(source, "sub", "deep"))
+        os.makedirs(os.path.join(source, "emptydir"))
+        with open(os.path.join(source, "a.txt"), "wb") as fh:
+            fh.write(b"hello\n")
+        with open(os.path.join(source, "sub", "b.txt"), "wb") as fh:
+            fh.write(b"world\n")
+        with open(os.path.join(source, "sub", "deep", "d.txt"), "wb") as fh:
+            fh.write(b"deep\n")
+        clean_dir(dest)
+        clean_dir(rdst)
+
+        def dir_lines(text):
+            # Any line whose name ends with '/' is a directory entry.
+            return sorted(
+                line for line in text.splitlines()
+                if line.rsplit(" ", 1)[-1].endswith("/")
+            )
+
+        for fmt in (None, "%i %n%L"):
+            rsync_flags = ["-a", "-i"] if fmt is None else ["-a", "--out-format=" + fmt]
+            fast_flags = rsync_flags
+            clean_dir(rdst)
+            clean_dir(dest)
+            rsync_result = _rsync(rsync_flags + [source + "/", rdst + "/"])
+            assert rsync_result.returncode == 0, rsync_result.stderr
+            result, _ = run_client(source, dest, flags=fast_flags,
+                                   port=shared_server.port)
+            assert result.returncode == 0, result.stderr[:300]
+            expected = [l for l in dir_lines(rsync_result.stdout)
+                        if not l.rsplit(" ", 1)[-1] == "./"]
+            fast = dir_lines(result.stdout)
+            assert [l for l in fast if not l.rsplit(" ", 1)[-1] == "./"] == expected, (
+                f"fmt={fmt} rsync={rsync_result.stdout!r} fastsync={result.stdout!r}"
+            )
+            assert ".d..t...... ./" in fast, f"missing root line: {result.stdout!r}"
+
+    @requires_rsync
+    @pytest.mark.ci
+    def test_itemize_info_flist_header_matches_rsync(self, shared_server):
+        """`-i --info=flist` prints rsync's file-list header: the -i change
+        lines alone do not enable the flist category, but an explicit --info=flist
+        must not be suppressed when itemizing."""
+        source = os.path.join(TEST_DATA_DIR, "out_itemfl_src")
+        dest = os.path.join(TEST_DATA_DIR, "out_itemfl_dst")
+        rdst = os.path.join(TEST_DATA_DIR, "out_itemfl_rdst")
+        _make_output_tree(source)
+        clean_dir(dest)
+        clean_dir(rdst)
+        flags = ["-a", "-i", "--info=flist"]
+        rsync_result = _rsync(flags + [source + "/", rdst + "/"])
+        assert rsync_result.returncode == 0, rsync_result.stderr
+        result, _ = run_client(source, dest, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, result.stderr[:300]
+        assert "sending incremental file list" in rsync_result.stdout
+        assert "sending incremental file list" in result.stdout, result.stdout
+        # -i alone (no explicit --info=flist) must stay silent like rsync.
+        clean_dir(dest)
+        clean_dir(rdst)
+        rsync_plain = _rsync(["-a", "-i", source + "/", rdst + "/"])
+        plain, _ = run_client(source, dest, flags=["-a", "-i"],
+                              port=shared_server.port)
+        assert "sending incremental file list" not in rsync_plain.stdout
+        assert "sending incremental file list" not in plain.stdout, plain.stdout
+
+    @requires_rsync
+    @pytest.mark.ci
+    def test_itemize_files_from_dirs_root_and_ancestors(self, shared_server):
+        """The -d/--files-from dirs generator emits the transfer-root line and
+        rsync's implied ancestor directory lines.  The generator traverses no
+        directories, so those must be synthesized from the listed entries."""
+        source = os.path.join(TEST_DATA_DIR, "out_itemff_src")
+        dest = os.path.join(TEST_DATA_DIR, "out_itemff_dst")
+        rdst = os.path.join(TEST_DATA_DIR, "out_itemff_rdst")
+        clean_dir(source)
+        os.makedirs(os.path.join(source, "sub", "deep"))
+        with open(os.path.join(source, "sub", "deep", "d.txt"), "wb") as fh:
+            fh.write(b"deep\n")
+        clean_dir(dest)
+        clean_dir(rdst)
+        listing = os.path.join(TEST_DATA_DIR, "out_itemff.list")
+        with open(listing, "w") as fh:
+            fh.write("sub/deep/d.txt\n")
+
+        flags = ["-d", "-i", "--files-from=" + listing]
+        rsync_result = _rsync(flags + [source + "/", rdst + "/"])
+        assert rsync_result.returncode == 0, rsync_result.stderr
+        result, _ = run_client(source, dest, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, result.stderr[:300]
+
+        def dir_lines(text):
+            return sorted(line for line in text.splitlines()
+                          if line.rsplit(" ", 1)[-1].endswith("/"))
+
+        # rsync emits the implied parents (sub/, sub/deep/) but never the root
+        # here; FastSync emits the same set plus its unconditional root line.
+        expected = [line for line in dir_lines(rsync_result.stdout)
+                    if not line.rsplit(" ", 1)[-1] == "./"]
+        fast = dir_lines(result.stdout)
+        assert [line for line in fast if not line.rsplit(" ", 1)[-1] == "./"] == expected, (
+            f"rsync={rsync_result.stdout!r} fastsync={result.stdout!r}"
+        )
+        assert "cd+++++++++ sub/" in fast, result.stdout
+        assert "cd+++++++++ sub/deep/" in fast, result.stdout
+        assert any(line.rsplit(" ", 1)[-1] == "./" for line in fast), result.stdout
+
    @requires_rsync
    @pytest.mark.ci
    def test_itemize_modified_file_matches_rsync(self, shared_server):
@@ -262,6 +387,47 @@ class TestOutFormatParity:
            if line:
                assert pattern.match(line), f"bad %M format: {line!r}"

+    @requires_rsync
+    @pytest.mark.ci
+    def test_out_format_directory_metadata_with_delete_during(self):
+        """--delete-during/--delete-delay reuse the per-directory plan pre-scan,
+        whose list carries no metadata.  Directory %M/%B/%U/%G must still come
+        from the source, exactly as the plain recursive scan renders them."""
+        source = os.path.join(TEST_DATA_DIR, "out_fmtmeta_src")
+        dest = os.path.join(TEST_DATA_DIR, "out_fmtmeta_dst")
+        rdst = os.path.join(TEST_DATA_DIR, "out_fmtmeta_rdst")
+        clean_dir(source)
+        os.makedirs(os.path.join(source, "sub", "deep"))
+        with open(os.path.join(source, "a.txt"), "wb") as fh:
+            fh.write(b"hello\n")
+        with open(os.path.join(source, "sub", "b.txt"), "wb") as fh:
+            fh.write(b"world\n")
+        clean_dir(dest)
+        clean_dir(rdst)
+
+        def dir_lines(text):
+            # Directory names are the last whitespace-separated token.
+            return sorted(line for line in text.splitlines()
+                          if line.rsplit(" ", 1)[-1].endswith("/")
+                          and line.rsplit(" ", 1)[-1] != "./")
+
+        for timing in ("--delete-during", "--delete-delay"):
+            for fmt in ("%M %n", "%B %n", "%U %G %n"):
+                clean_dir(dest)
+                clean_dir(rdst)
+                flags = ["-a", "--out-format=" + fmt, timing]
+                rsync_result = _rsync(flags + [source + "/", rdst + "/"])
+                assert rsync_result.returncode == 0, rsync_result.stderr
+                with ServerManager() as server:
+                    server.start(extra_args=["--allow-delete"])
+                    result, _ = run_client(source, dest, flags=flags, port=server.port)
+                assert result.returncode == 0, result.stderr[:300]
+                assert dir_lines(result.stdout) == dir_lines(rsync_result.stdout), (
+                    f"{timing} {fmt}: rsync={rsync_result.stdout!r} "
+                    f"fastsync={result.stdout!r}"
+                )
+                assert "1970/" not in result.stdout, result.stdout
+

 class TestListOnlyParity:
    @requires_rsync
@@ -387,8 +553,8 @@ class TestWireStatsParity:
        result, _ = run_client(source, dest, flags=["-a", "--out-format=" + fmt],
                               port=shared_server.port)
        assert result.returncode == 0, result.stderr[:300]
-        rb, rl = (int(x) for x in rsync_result.stdout.split()[:2])
-        fb, fl = (int(x) for x in result.stdout.split()[:2])
+        rb, rl = (int(x) for x in _file_entry_line(rsync_result.stdout).split()[:2])
+        fb, fl = (int(x) for x in _file_entry_line(result.stdout).split()[:2])
        assert rl == fl == 5000, (rsync_result.stdout, result.stdout)
        assert rb > rl, f"rsync %b must include framing: {rsync_result.stdout!r}"
        assert fb > fl, f"fastsync %b must include framing: {result.stdout!r}"
@@ -421,7 +587,9 @@ class TestWireStatsParity:
        assert file_lines(result.stdout) == file_lines(rsync_result.stdout), (
            f"rsync={rsync_result.stdout!r} fastsync={result.stdout!r}"
        )
-        assert result.stdout.split()[0] == rsync_result.stdout.split()[0] == "16", (
+        fs_c = _file_entry_line(result.stdout).split()[0]
+        rs_c = _file_entry_line(rsync_result.stdout).split()[0]
+        assert fs_c == rs_c == "16", (
            f"%c must be rsync's 16-byte sum header: {result.stdout!r}"
        )

@@ -450,8 +618,8 @@ class TestWireStatsParity:
                                      "--out-format=" + fmt],
                               port=shared_server.port)
        assert result.returncode == 0, result.stderr[:300]
-        rs_c = int(rsync_result.stdout.split()[0])
-        fs_c = int(result.stdout.split()[0])
+        rs_c = int(_file_entry_line(rsync_result.stdout).split()[0])
+        fs_c = int(_file_entry_line(result.stdout).split()[0])
        # No basis exists, so rsync still reports only its sum header.
        assert rs_c == 16, rsync_result.stdout
        # FastSync reports its own handshake bytes and is not aligned.
@@ -662,6 +830,46 @@ class TestWireStatsParity:
        assert re.match(r"Number of created files: 1 \(reg: 1\)$", r_created), r_created
        assert f_created == r_created, (r_created, f_created)

+    @requires_rsync
+    @pytest.mark.ci
+    @pytest.mark.parametrize("mt", [False, True])
+    def test_stats_r_directory_breakdown_matches_rsync(self, shared_server, mt):
+        """A recursive `-r` scan (no -t/-p) exposes no directory metadata, but
+        rsync still counts every directory in `Number of files`; the sender's
+        lightweight directory counter must reproduce the `dir: N` category."""
+        source = os.path.join(TEST_DATA_DIR, "wire_stdir_src")
+        dest = os.path.join(TEST_DATA_DIR, "wire_stdir_dst")
+        rdst = os.path.join(TEST_DATA_DIR, "wire_stdir_rdst")
+        clean_dir(source)
+        clean_dir(dest)
+        clean_dir(rdst)
+        os.makedirs(os.path.join(source, "sub", "deep"))
+        os.makedirs(os.path.join(source, "empty"))
+        for rel in ("a.txt", os.path.join("sub", "b.txt"), os.path.join("sub", "deep", "c.txt")):
+            with open(os.path.join(source, rel), "wb") as fh:
+                fh.write(b"x\n")
+        os.makedirs(get_dest_received_dir(dest, source), exist_ok=True)
+
+        rsync_result = _rsync(["-r", "--stats", source + "/", rdst + "/"])
+        assert rsync_result.returncode == 0, rsync_result.stderr
+        flags = ["-r", "--stats"] + (["--threads"] if mt else [])
+        result, _ = run_client(source, dest, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, result.stderr[:300]
+
+        def stats_line(text, key):
+            for line in text.splitlines():
+                if line.startswith(key + ":"):
+                    return line
+            return None
+
+        r_files = stats_line(rsync_result.stdout, "Number of files")
+        f_files = stats_line(result.stdout, "Number of files")
+        # 3 regular files, 4 directories (root, sub, sub/deep, empty).
+        assert re.match(r"Number of files: 7 \(reg: 3, dir: 4\)$", r_files), r_files
+        assert f_files == r_files, (r_files, f_files)
+        assert (stats_line(result.stdout, "Number of regular files transferred") ==
+                stats_line(rsync_result.stdout, "Number of regular files transferred"))
+
    @requires_rsync
    @pytest.mark.ci
    @pytest.mark.parametrize("mt", [False, True])
@@ -0,0 +1,198 @@
+"""Differential rsync-parity coverage for two residuals closed on this branch.
+
+* A4 -- ``--compare-dest``/``--copy-dest``/``--link-dest`` relative-DIR
+  resolution: rsync resolves a relative DIR against the destination directory
+  and appends the file's TRANSFER-RELATIVE name.  FastSync's default transfer
+  mirrors the absolute source path below its receive root, so a naive relative
+  DIR used to probe a different tree.  These tests seed the basis at rsync's
+  spelling and assert FastSync finds it (byte-exact / hard-linked / sparse),
+  matching real rsync 3.4.1.
+
+* A5 -- ``-y``/``--fuzzy`` candidate eligibility: rsync's ``find_fuzzy`` has no
+  delta-size gate, so it reuses an oversized (>10x) or sub-16-KiB sibling;
+  FastSync used to decline both.  These tests assert FastSync now uses the same
+  sibling as rsync (observable as ``Matched data``) with a byte-exact result.
+
+Every test skips cleanly when rsync is absent.
+"""
+import os
+import shutil
+import subprocess
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import (  # noqa: E402
+    TEST_DATA_DIR,
+    clean_dir,
+    get_dest_received_dir,
+    run_client,
+)
+
+RSYNC = shutil.which("rsync")
+requires_rsync = pytest.mark.skipif(RSYNC is None, reason="rsync 3.4.1 not installed")
+
+OLD_MTIME = 1_500_000_000
+
+
+def _write(path, content, mtime=None):
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path, "wb") as fh:
+        fh.write(content)
+    if mtime is not None:
+        os.utime(path, (mtime, mtime))
+
+
+def _read(path):
+    with open(path, "rb") as fh:
+        return fh.read()
+
+
+def _rsync(args):
+    env = dict(os.environ, LC_ALL="C")
+    return subprocess.run([RSYNC] + args, capture_output=True, text=True, env=env, timeout=120)
+
+
+def _stat_bytes(text, label):
+    for line in text.splitlines():
+        if line.startswith(label + ":"):
+            return int(line.split(":", 1)[1].strip().split()[0].replace(",", ""))
+    return None
+
+
+class TestRelativeBasisDirResolution:
+    """A4: a relative basis DIR must resolve to the same tree as rsync's."""
+
+    _FILES = {
+        "root.txt": b"root-basis-content\n",
+        "sub/nested.txt": b"nested-basis-content\n",
+    }
+
+    def _seed_source(self, source):
+        clean_dir(source)
+        for rel, data in self._FILES.items():
+            _write(os.path.join(source, rel), data, OLD_MTIME)
+        return self._FILES
+
+    @requires_rsync
+    @pytest.mark.parametrize("flag", ["--compare-dest", "--link-dest"])
+    def test_relative_dir_resolves_like_rsync(self, shared_server, flag):
+        tag = flag.lstrip("-")
+        source = os.path.join(TEST_DATA_DIR, f"relbasis_{tag}_src")
+        rdst = os.path.join(TEST_DATA_DIR, f"relbasis_{tag}_rdst")
+        fdst = os.path.join(TEST_DATA_DIR, f"relbasis_{tag}_fdst")
+        self._seed_source(source)
+
+        # rsync: relative DIR -> dest/basis/<transfer-relative name>.
+        clean_dir(rdst)
+        for rel, data in self._FILES.items():
+            _write(os.path.join(rdst, "basis", rel), data, OLD_MTIME)
+        rs = _rsync(["-a", f"{flag}=basis", source + "/", rdst + "/"])
+        assert rs.returncode == 0, rs.stderr
+
+        # FastSync: the SAME relative spelling seeded at the SAME
+        # transfer-relative location under its destination root.
+        clean_dir(fdst)
+        for rel, data in self._FILES.items():
+            _write(os.path.join(fdst, "basis", rel), data, OLD_MTIME)
+        result, _ = run_client(source, fdst,
+                               flags=["-a", f"{flag}=basis", "--incremental"],
+                               port=shared_server.port)
+        assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+        received = get_dest_received_dir(fdst, source)
+
+        for rel, data in self._FILES.items():
+            rfile = os.path.join(rdst, rel)
+            ffile = os.path.join(received, rel)
+            basis = os.path.join(fdst, "basis", rel)
+            if flag == "--compare-dest":
+                # compare-dest never copies: both destinations stay sparse.
+                assert not os.path.exists(rfile), f"rsync copied {rel}"
+                assert not os.path.exists(ffile), (
+                    f"FastSync did not resolve the relative basis DIR at {basis!r} "
+                    f"(expected {rel!r} to stay sparse like rsync)")
+            else:
+                # link-dest hard-links; a basis miss would transfer a new file.
+                assert os.path.exists(ffile), f"FastSync lost {rel}"
+                assert _read(ffile) == data
+                assert os.stat(ffile).st_ino == os.stat(basis).st_ino, (
+                    f"FastSync did not hard-link {rel!r} to the relative basis at "
+                    f"{basis!r} (basis not resolved like rsync)")
+
+    @requires_rsync
+    def test_relative_dir_copy_dest_content(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "relbasis_copy_src")
+        fdst = os.path.join(TEST_DATA_DIR, "relbasis_copy_fdst")
+        self._seed_source(source)
+        clean_dir(fdst)
+        for rel, data in self._FILES.items():
+            _write(os.path.join(fdst, "basis", rel), data, OLD_MTIME)
+        result, _ = run_client(source, fdst,
+                               flags=["-a", "--copy-dest=basis", "--incremental"],
+                               port=shared_server.port)
+        assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+        received = get_dest_received_dir(fdst, source)
+        for rel, data in self._FILES.items():
+            ffile = os.path.join(received, rel)
+            assert os.path.exists(ffile), f"copy-dest did not materialize {rel}"
+            assert _read(ffile) == data
+            assert os.stat(ffile).st_ino != os.stat(os.path.join(fdst, "basis", rel)).st_ino
+
+
+class TestFuzzyEligibilityWindow:
+    """A5: --fuzzy candidate eligibility must match rsync's uncapped window."""
+
+    BASE = b"the quick brown fox jumps over the lazy dog\n" * 4000
+
+    def _run_pair(self, shared_server, tag, payload, sibling):
+        source = os.path.join(TEST_DATA_DIR, f"fzw_{tag}_src")
+        dest = os.path.join(TEST_DATA_DIR, f"fzw_{tag}_dst")
+        rdst = os.path.join(TEST_DATA_DIR, f"fzw_{tag}_rdst")
+        clean_dir(source)
+        clean_dir(dest)
+        clean_dir(rdst)
+        _write(os.path.join(source, "report_v2.txt"), payload)
+        for root in (rdst, get_dest_received_dir(dest, source)):
+            _write(os.path.join(root, "report_v1.txt"), sibling)
+
+        rs = _rsync(["-a", "--no-whole-file", "--fuzzy", "--stats",
+                     source + "/", rdst + "/"])
+        assert rs.returncode == 0, rs.stderr
+        result, _ = run_client(
+            source, dest,
+            flags=["-a", "--incremental", "--delta", "--fuzzy", "--stats"],
+            port=shared_server.port)
+        assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+
+        # The reconstructed file is byte-exact in every case.
+        assert _read(os.path.join(get_dest_received_dir(dest, source),
+                                  "report_v2.txt")) == payload
+        return rs, result
+
+    @requires_rsync
+    def test_oversized_sibling_eligible_like_rsync(self, shared_server):
+        """A sibling 20x the source is used by rsync; FastSync must too (its old
+        10x delta-size gate declined it)."""
+        n = 65536
+        payload = (self.BASE * ((n // len(self.BASE)) + 1))[:n]
+        sibling = (self.BASE * 200)[: n * 20]
+        rs, result = self._run_pair(shared_server, "big", payload, sibling)
+        assert _stat_bytes(rs.stdout, "Matched data") > 0, \
+            "rsync should use a >10x fuzzy basis"
+        assert _stat_bytes(result.stdout, "Matched data") > 0, (
+            "FastSync's fuzzy eligibility must accept a >10x sibling like rsync "
+            f"(Matched data={_stat_bytes(result.stdout, 'Matched data')})")
+
+    @requires_rsync
+    def test_small_source_sibling_eligible_like_rsync(self, shared_server):
+        """A sub-16-KiB source with an identical sibling is used by rsync;
+        FastSync's old 16 KiB delta minimum declined it."""
+        n = 8192
+        payload = (self.BASE * ((n // len(self.BASE)) + 1))[:n]
+        rs, result = self._run_pair(shared_server, "small", payload, payload)
+        assert _stat_bytes(rs.stdout, "Matched data") > 0, \
+            "rsync applies --fuzzy below 16 KiB"
+        assert _stat_bytes(result.stdout, "Matched data") > 0, (
+            "FastSync's fuzzy eligibility must accept a sub-16-KiB source like "
+            f"rsync (Matched data={_stat_bytes(result.stdout, 'Matched data')})")
@@ -0,0 +1,105 @@
+"""`--debug=FLAGS` natural-event categories (no-wire).
+
+FastSync maps the rsync `--debug` categories that correspond to a real event it
+already performs (``flist``, ``del``, ``hash``/``deltasum``, ``recv``,
+``filter`` and ``send``) onto debug output.  A normal run prints none of it.
+"""
+import os
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import TEST_DATA_DIR, run_client, clean_dir, get_dest_received_dir, ServerManager
+
+
+def _make_tree(root):
+    clean_dir(root)
+    os.makedirs(os.path.join(root, "sub"))
+    with open(os.path.join(root, "a.txt"), "wb") as fh:
+        fh.write(b"alpha\n")
+    with open(os.path.join(root, "keep.log"), "wb") as fh:
+        fh.write(b"log\n")
+    with open(os.path.join(root, "sub", "b.txt"), "wb") as fh:
+        fh.write(b"beta\n")
+
+
+@pytest.mark.ci
+def test_debug_flist_and_send_emit_output(shared_server):
+    """`--debug=flist,send` produces category-tagged debug output."""
+    source = os.path.join(TEST_DATA_DIR, "dbg_src")
+    dest = os.path.join(TEST_DATA_DIR, "dbg_dst")
+    _make_tree(source)
+    clean_dir(dest)
+    result, _ = run_client(source, dest, flags=["-a", "--debug=flist,send"],
+                           port=shared_server.port)
+    assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+    assert "flist: scanning" in result.stdout, result.stdout
+    assert "send: " in result.stdout, result.stdout
+
+
+@pytest.mark.ci
+def test_debug_filter_emits_excluded_entry(shared_server):
+    source = os.path.join(TEST_DATA_DIR, "dbg_filter_src")
+    dest = os.path.join(TEST_DATA_DIR, "dbg_filter_dst")
+    _make_tree(source)
+    clean_dir(dest)
+    result, _ = run_client(source, dest,
+                           flags=["-a", "--debug=filter", "--exclude=*.log"],
+                           port=shared_server.port)
+    assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+    assert "filter: excluded keep.log" in result.stdout, result.stdout
+
+
+@pytest.mark.ci
+def test_debug_hash_and_recv_emit_on_incremental(shared_server):
+    source = os.path.join(TEST_DATA_DIR, "dbg_hash_src")
+    dest = os.path.join(TEST_DATA_DIR, "dbg_hash_dst")
+    _make_tree(source)
+    clean_dir(dest)
+    result, _ = run_client(source, dest,
+                           flags=["-a", "--incremental", "--checksum",
+                                  "--debug=hash,recv"],
+                           port=shared_server.port)
+    assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+    assert "hash: " in result.stdout, result.stdout
+    assert "recv: " in result.stdout, result.stdout
+
+
+@pytest.mark.ci
+def test_debug_del_emits_deleted_path():
+    """`--debug=del` reports the paths the receiver actually removed.
+
+    A deletion-capable server is required (the shared fixture refuses
+    client-requested deletion)."""
+    source = os.path.join(TEST_DATA_DIR, "dbg_del_src")
+    dest = os.path.join(TEST_DATA_DIR, "dbg_del_dst")
+    _make_tree(source)
+    clean_dir(dest)
+    seeded = get_dest_received_dir(dest, source)
+    os.makedirs(seeded)
+    with open(os.path.join(seeded, "extra.tmp"), "wb") as fh:
+        fh.write(b"stale\n")
+    server = ServerManager()
+    server.start(extra_args=["--allow-super", "--allow-delete"])
+    try:
+        result, _ = run_client(source, dest, flags=["-a", "--delete", "--debug=del"],
+                               port=server.port)
+    finally:
+        server.stop()
+    assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+    assert "del: " in result.stdout and "extra.tmp" in result.stdout, result.stdout
+    assert not os.path.exists(os.path.join(seeded, "extra.tmp"))
+
+
+@pytest.mark.ci
+def test_normal_run_has_no_debug_output(shared_server):
+    source = os.path.join(TEST_DATA_DIR, "dbg_quiet_src")
+    dest = os.path.join(TEST_DATA_DIR, "dbg_quiet_dst")
+    _make_tree(source)
+    clean_dir(dest)
+    result, _ = run_client(source, dest, flags=["-a"], port=shared_server.port)
+    assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+    assert "[DEBUG]" not in result.stdout
+    assert "flist: scanning" not in result.stdout
+    assert "send: " not in result.stdout
@@ -0,0 +1,174 @@
+"""Differential parity for `--info=mount` and `--info=stats` (no-wire).
+
+Both behaviours are compared against real rsync 3.4.1:
+
+* `--info=mount` prints rsync's ``[sender] skipping mount-point dir NAME`` line
+  when ``-xx`` drops a mount-point directory.  Plain ``-x`` keeps the empty
+  directory and stays silent, exactly like rsync.
+* `--info=stats` requests the same transfer-statistics block as `--stats`
+  (rsync spells the full block ``--info=stats2``/``--stats``).
+
+The tests are skipped when rsync is unavailable.
+"""
+import os
+import re
+import shutil
+import subprocess
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import TEST_DATA_DIR, run_client, clean_dir, get_dest_received_dir
+
+RSYNC = shutil.which("rsync")
+requires_rsync = pytest.mark.skipif(RSYNC is None, reason="rsync 3.4.1 not installed")
+
+
+def _rsync(args):
+    env = dict(os.environ, LC_ALL="C")
+    return subprocess.run([RSYNC] + args, capture_output=True, text=True, env=env, timeout=120)
+
+
+def _cross_device_mount_tree(source):
+    """Build a source whose ``nested_link`` is a symlink onto a tmpfs directory.
+
+    ``--copy-links`` dereferences it so ``-x`` sees a mount-point directory on a
+    different device.  Returns the probe path to remove, or skips the test when
+    no cross-device filesystem is available.
+    """
+    local = os.stat(".")
+    shm = "/dev/shm"
+    try:
+        shm_stat = os.stat(shm)
+    except OSError:
+        pytest.skip("/dev/shm not available")
+    if shm_stat.st_dev == local.st_dev:
+        pytest.skip("no cross-device filesystem available")
+
+    clean_dir(source)
+    with open(os.path.join(source, "keep.txt"), "wb") as fh:
+        fh.write(b"keep\n")
+    probe = os.path.join(shm, f"fastsync_info_mount_{os.getpid()}")
+    shutil.rmtree(probe, ignore_errors=True)
+    os.makedirs(probe)
+    with open(os.path.join(probe, "inside.txt"), "wb") as fh:
+        fh.write(b"cross\n")
+    try:
+        os.symlink(probe, os.path.join(source, "nested_link"))
+    except OSError:
+        shutil.rmtree(probe, ignore_errors=True)
+        pytest.skip("cannot create symlink")
+    return probe
+
+
+@requires_rsync
+@pytest.mark.ci
+def test_info_mount_xx_matches_rsync(shared_server):
+    """`-xx --info=mount` drops the mount-point dir and prints rsync's line."""
+    source = os.path.join(TEST_DATA_DIR, "info_mount_src")
+    dest = os.path.join(TEST_DATA_DIR, "info_mount_dst")
+    rdst = os.path.join(TEST_DATA_DIR, "info_mount_rdst")
+    probe = _cross_device_mount_tree(source)
+    clean_dir(dest)
+    clean_dir(rdst)
+    flags = ["-a", "--copy-links", "-xx", "--info=mount"]
+    try:
+        rsync_result = _rsync(flags + [source + "/", rdst + "/"])
+        assert rsync_result.returncode == 0, rsync_result.stderr
+        result, _ = run_client(source, dest, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+
+        expected = "[sender] skipping mount-point dir nested_link"
+        assert expected in rsync_result.stdout, rsync_result.stdout
+        assert expected in result.stdout, (result.stdout, result.stderr)
+
+        received = get_dest_received_dir(dest, source)
+        assert os.path.exists(os.path.join(received, "keep.txt"))
+        # -xx omits the mount-point directory entirely.
+        assert not os.path.exists(os.path.join(received, "nested_link"))
+        assert not os.path.exists(os.path.join(rdst, "nested_link"))
+    finally:
+        shutil.rmtree(probe, ignore_errors=True)
+
+
+@requires_rsync
+@pytest.mark.ci
+def test_info_mount_single_x_is_silent(shared_server):
+    """Plain `-x` keeps the empty mount-point directory and prints no line."""
+    source = os.path.join(TEST_DATA_DIR, "info_mount1_src")
+    dest = os.path.join(TEST_DATA_DIR, "info_mount1_dst")
+    rdst = os.path.join(TEST_DATA_DIR, "info_mount1_rdst")
+    probe = _cross_device_mount_tree(source)
+    clean_dir(dest)
+    clean_dir(rdst)
+    flags = ["-a", "--copy-links", "-x", "--info=mount"]
+    try:
+        rsync_result = _rsync(flags + [source + "/", rdst + "/"])
+        assert rsync_result.returncode == 0, rsync_result.stderr
+        result, _ = run_client(source, dest, flags=flags, port=shared_server.port)
+        assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+
+        assert "skipping mount-point dir" not in rsync_result.stdout
+        assert "skipping mount-point dir" not in result.stdout
+
+        received = get_dest_received_dir(dest, source)
+        assert os.path.isdir(os.path.join(received, "nested_link"))
+        assert not os.path.exists(os.path.join(received, "nested_link", "inside.txt"))
+        assert os.path.isdir(os.path.join(rdst, "nested_link"))
+        assert not os.path.exists(os.path.join(rdst, "nested_link", "inside.txt"))
+    finally:
+        shutil.rmtree(probe, ignore_errors=True)
+
+
+def _make_stats_tree(root):
+    clean_dir(root)
+    os.makedirs(os.path.join(root, "sub"))
+    with open(os.path.join(root, "a.txt"), "wb") as fh:
+        fh.write(b"alpha\n")
+    with open(os.path.join(root, "sub", "b.txt"), "wb") as fh:
+        fh.write(b"beta\n")
+
+
+def _pick_stats(text):
+    keys = ("Number of files", "Number of regular files transferred", "Total file size",
+            "Total transferred file size", "Literal data", "Matched data")
+    out = {}
+    for line in text.splitlines():
+        for key in keys:
+            if line.startswith(key + ":"):
+                out[key] = line
+    return out
+
+
+@requires_rsync
+@pytest.mark.ci
+def test_info_stats_emits_full_stats_block(shared_server):
+    """`--info=stats` is the same full block as `--stats` and matches rsync."""
+    source = os.path.join(TEST_DATA_DIR, "info_stats_src")
+    dest = os.path.join(TEST_DATA_DIR, "info_stats_dst")
+    rdst = os.path.join(TEST_DATA_DIR, "info_stats_rdst")
+    dest2 = os.path.join(TEST_DATA_DIR, "info_stats_dst2")
+    _make_stats_tree(source)
+    for path in (dest, rdst, dest2):
+        clean_dir(path)
+        os.makedirs(get_dest_received_dir(path, source), exist_ok=True)
+
+    rsync_result = _rsync(["-a", "--stats", source + "/", rdst + "/"])
+    assert rsync_result.returncode == 0, rsync_result.stderr
+
+    info_result, _ = run_client(source, dest, flags=["-a", "--info=stats"],
+                                port=shared_server.port)
+    assert info_result.returncode == 0, (info_result.stderr or info_result.stdout)[:300]
+    stats_result, _ = run_client(source, dest2, flags=["-a", "--stats"],
+                                 port=shared_server.port)
+    assert stats_result.returncode == 0, (stats_result.stderr or stats_result.stdout)[:300]
+
+    # --info=stats must print the same block as --stats...
+    assert _pick_stats(info_result.stdout) == _pick_stats(stats_result.stdout), (
+        f"info={info_result.stdout} stats={stats_result.stdout}")
+    # ...and the protocol-independent counters must match real rsync.
+    assert _pick_stats(info_result.stdout) == _pick_stats(rsync_result.stdout), (
+        f"rsync={_pick_stats(rsync_result.stdout)} fastsync={_pick_stats(info_result.stdout)}")
+    assert re.search(r"^Number of files: \d+ \(reg: 2, dir: 2\)$", info_result.stdout,
+                     re.MULTILINE), info_result.stdout
@@ -0,0 +1,185 @@
+"""Differential rsync-parity coverage for FastSync's transfer/delete ORDER.
+
+rsync walks a source tree in its sorted flist order: within each directory the
+non-directories come first (ascending name), then the subdirectories (ascending
+name), each subdirectory immediately followed by its own subtree (depth-first).
+The sequential scanner now reproduces that order, which makes both the
+``--info=name`` stream and the ``--delete-during`` deletion sequence match real
+``rsync 3.4.1`` exactly.  ``--threads`` has no rsync analogue and is unordered.
+
+Every test skips cleanly when rsync is absent.
+"""
+import os
+import shutil
+import subprocess
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import (  # noqa: E402
+    TEST_DATA_DIR,
+    ServerManager,
+    clean_dir,
+    get_dest_received_dir,
+    run_client,
+)
+
+RSYNC = shutil.which("rsync")
+requires_rsync = pytest.mark.skipif(RSYNC is None, reason="rsync 3.4.1 not installed")
+
+MTIME = 1_500_000_000
+
+_TREE = {
+    "a.txt": b"a\n",
+    "b.txt": b"b\n",
+    "z.txt": b"z\n",
+    "a_dir/f.txt": b"f\n",
+    "a_dir/deep/g.txt": b"g\n",
+    "m_dir/h.txt": b"h\n",
+    "Z_dir/i.txt": b"i\n",
+}
+
+
+def _write(path, data):
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    with open(path, "wb") as fh:
+        fh.write(data)
+    os.utime(path, (MTIME, MTIME))
+
+
+def _rsync(args):
+    env = dict(os.environ, LC_ALL="C")
+    return subprocess.run([RSYNC] + args, capture_output=True, text=True, env=env, timeout=120)
+
+
+def _deleting(text):
+    out = []
+    for line in text.splitlines():
+        stripped = line.strip()
+        if stripped.startswith("*deleting") or stripped.startswith("deleting"):
+            out.append(stripped.split()[-1])
+    return out
+
+
+class TestTransferOrderParity:
+    @requires_rsync
+    def test_info_name_file_order_matches_rsync(self, shared_server):
+        source = os.path.join(TEST_DATA_DIR, "order_name_src")
+        clean_dir(source)
+        for rel, data in _TREE.items():
+            _write(os.path.join(source, rel), data)
+
+        rdst = os.path.join(TEST_DATA_DIR, "order_name_rdst")
+        clean_dir(rdst)
+        rs = _rsync(["-a", "--info=name", source + "/", rdst + "/"])
+        assert rs.returncode == 0, rs.stderr
+        # rsync also names the directories (trailing '/'); FastSync names the
+        # transferred entries.  Compare the file/symlink sequence, which is what
+        # the traversal order determines.
+        rsync_files = [l for l in rs.stdout.splitlines() if l.strip() and not l.endswith("/")]
+
+        fdst = os.path.join(TEST_DATA_DIR, "order_name_fdst")
+        clean_dir(fdst)
+        result, _ = run_client(source, fdst, flags=["-a", "--info=name"],
+                               port=shared_server.port)
+        assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+        fsync_files = [
+            l for l in result.stdout.splitlines()
+            if l.strip() and l.strip() != "./" and not l.startswith("sending")
+        ]
+        assert fsync_files == rsync_files, (
+            f"transfer order differs\nrsync={rsync_files}\nfastsync={fsync_files}")
+
+
+class TestDeleteOrderParity:
+    _EXTRA = {
+        "a_extra.txt": b"a\n",
+        "z_extra.txt": b"z\n",
+        "a_extra_dir/f": b"f\n",
+        "z_extra_dir/f": b"f\n",
+        "a_extra_dir/sub/g": b"g\n",
+    }
+
+    def _seed_source(self):
+        source = os.path.join(TEST_DATA_DIR, "order_del_src")
+        clean_dir(source)
+        _write(os.path.join(source, "keep.txt"), b"k\n")
+        _write(os.path.join(source, "keepdir", "x.txt"), b"x\n")
+        _write(os.path.join(source, "keep2", "y.txt"), b"y\n")
+        return source
+
+    def _assert_order(self, timing, dry_run=False):
+        source = self._seed_source()
+        rdst = os.path.join(TEST_DATA_DIR, f"order_{timing}_rdst")
+        clean_dir(rdst)
+        for rel, data in self._EXTRA.items():
+            _write(os.path.join(rdst, rel), data)
+        rs_flags = ["-a", "-n"] if dry_run else ["-a"]
+        rs = _rsync(rs_flags + [timing, "--info=del", source + "/", rdst + "/"])
+        assert rs.returncode == 0, rs.stderr
+
+        fdst = os.path.join(TEST_DATA_DIR, f"order_{timing}_fdst")
+        clean_dir(fdst)
+        received = get_dest_received_dir(fdst, source)
+        for rel, data in self._EXTRA.items():
+            _write(os.path.join(received, rel), data)
+        fs_flags = ["-a", "-n"] if dry_run else ["-a"]
+        with ServerManager() as server:
+            server.start(extra_args=["--allow-delete"])
+            result, _ = run_client(source, fdst, flags=fs_flags + [timing, "--info=del"],
+                                   port=server.port)
+        assert result.returncode == 0, (result.stderr or result.stdout)[:300]
+
+        rsync_order = _deleting(rs.stdout)
+        fsync_order = _deleting(result.stdout)
+        assert sorted(fsync_order) == sorted(rsync_order), (
+            f"{timing} deleted set differs\nrsync={rsync_order}\nfastsync={fsync_order}")
+        assert fsync_order == rsync_order, (
+            f"{timing} deletion order differs\nrsync={rsync_order}\nfastsync={fsync_order}")
+
+    @requires_rsync
+    def test_delete_during_deletion_order_matches_rsync(self):
+        self._assert_order("--delete-during")
+
+    @requires_rsync
+    def test_delete_delay_deletion_order_matches_rsync(self):
+        self._assert_order("--delete-delay")
+
+    @requires_rsync
+    def test_dry_run_delete_order_matches_rsync(self):
+        self._assert_order("--delete", dry_run=True)
+
+    @requires_rsync
+    def test_partial_max_delete_survivor_order_matches_rsync(self):
+        """With the exact removal order matching rsync, a --max-delete cap stops
+        after the same entries, so the survivor set is identical too."""
+        source = os.path.join(TEST_DATA_DIR, "order_maxdel_src")
+        clean_dir(source)
+        _write(os.path.join(source, "keep.txt"), b"k\n")
+        extra = {f"e{i}.txt": b"x\n" for i in range(6)}
+        extra["ed/f"] = b"f\n"
+        extra["ed/g"] = b"g\n"
+
+        rdst = os.path.join(TEST_DATA_DIR, "order_maxdel_rdst")
+        clean_dir(rdst)
+        for rel, data in extra.items():
+            _write(os.path.join(rdst, rel), data)
+        rs = _rsync(["-a", "--delete-during", "--max-delete=3", "--info=del",
+                     source + "/", rdst + "/"])
+        assert rs.returncode in (0, 25), (rs.returncode, rs.stderr)
+
+        fdst = os.path.join(TEST_DATA_DIR, "order_maxdel_fdst")
+        clean_dir(fdst)
+        received = get_dest_received_dir(fdst, source)
+        for rel, data in extra.items():
+            _write(os.path.join(received, rel), data)
+        with ServerManager() as server:
+            server.start(extra_args=["--allow-delete"])
+            result, _ = run_client(source, fdst,
+                                   flags=["-a", "--delete-during", "--max-delete=3", "--info=del"],
+                                   port=server.port)
+        assert result.returncode in (0, 25), (result.returncode, result.stderr[:300])
+        assert _deleting(result.stdout) == _deleting(rs.stdout), (
+            f"partial --max-delete survivor order differs\n"
+            f"rsync={_deleting(rs.stdout)}\nfastsync={_deleting(result.stdout)}")
@@ -861,11 +861,11 @@ class TestFuzzy:
    byte-exact result.  FastSync ports rsync 3.4.1's weighted-Levenshtein name
    heuristic, so where both delta engines admit the candidate the tools pick
    the same basis (the ``fuzzy_basis`` differential asserts the tree and the
-    Matched/Literal counters match with the block size pinned).  The residual is
-    candidate ELIGIBILITY: FastSync's delta size gate (both files >= 16 KiB and
-    a <= 10x size ratio) is narrower than rsync's, which empirically uses a
-    fuzzy basis well beyond 10x and below 16 KiB.  These tests pin the window
-    boundary and prove the byte-exact fallback on both sides of it."""
+    Matched/Literal counters match with the block size pinned).  Candidate
+    ELIGIBILITY is now rsync's too: the fuzzy search no longer inherits the
+    ordinary delta engine's 16 KiB minimum or 10x size-ratio bound, so an
+    oversized or sub-16-KiB sibling is reused exactly as rsync reuses it.
+    These tests pin that window on both sides."""

    _BASE = b"the quick brown fox jumps over the lazy dog\n" * 4000

@@ -900,9 +900,10 @@ class TestFuzzy:
        return rs, result

    @requires_rsync
-    def test_fuzzy_above_size_window_declines_but_tree_exact(self, shared_server):
-        """A sibling >10x the source is used by rsync but declined by FastSync's
-        delta size-ratio gate; both destinations stay byte-identical."""
+    def test_fuzzy_above_size_window_matches_rsync(self, shared_server):
+        """A sibling >10x the source is used by rsync and by FastSync: fuzzy
+        eligibility is rsync's, not the ordinary delta size-ratio gate; both
+        destinations stay byte-identical and both reuse the basis."""
        n = 65536
        payload = (self._BASE * ((n // len(self._BASE)) + 1))[:n]
        sibling = (self._BASE * 200)[: n * 20]
@@ -911,15 +912,16 @@ class TestFuzzy:
        rs, result = self._run_both(shared_server, source, dest, rdst,
                                    payload, sibling)
        assert _stat_bytes(rs.stdout, "Matched data") > 0, \
-            "rsync should still use a >10x fuzzy basis"
-        assert _stat_bytes(result.stdout, "Matched data") == 0, \
-            "FastSync's 10x delta size-ratio gate must decline the oversized basis"
-        assert _stat_bytes(result.stdout, "Literal data") == n
+            "rsync should use a >10x fuzzy basis"
+        assert _stat_bytes(result.stdout, "Matched data") > 0, \
+            "FastSync must accept a >10x fuzzy basis like rsync"
+        assert _stat_bytes(result.stdout, "Literal data") < n

    @requires_rsync
-    def test_fuzzy_below_delta_minimum_declines_but_tree_exact(self, shared_server):
-        """A sibling below the 16 KiB delta minimum is used by rsync but never
-        enters FastSync's delta/fuzzy path; both trees stay byte-identical."""
+    def test_fuzzy_below_delta_minimum_matches_rsync(self, shared_server):
+        """A sibling below the 16 KiB delta minimum is used by rsync and by
+        FastSync: fuzzy eligibility no longer inherits the delta engine's
+        minimum; both trees stay byte-identical and both reuse the basis."""
        n = 8192
        payload = (self._BASE * ((n // len(self._BASE)) + 1))[:n]
        source, dest, rdst = (self._src("small"), self._dst("small"),
@@ -928,9 +930,9 @@ class TestFuzzy:
                                    payload, payload)
        assert _stat_bytes(rs.stdout, "Matched data") > 0, \
            "rsync applies --fuzzy below 16 KiB"
-        assert _stat_bytes(result.stdout, "Matched data") == 0, \
-            "FastSync's 16 KiB delta minimum must bypass the fuzzy basis"
-        assert _stat_bytes(result.stdout, "Literal data") == n
+        assert _stat_bytes(result.stdout, "Matched data") > 0, \
+            "FastSync must apply --fuzzy below 16 KiB like rsync"
+        assert _stat_bytes(result.stdout, "Literal data") < n


 class TestIgnoreExistingShortCircuit:
@@ -1,23 +1,57 @@
 """CLI validation and preflight checks."""
+import socket
 import subprocess
 import sys
 import os
 import shutil
+import time
 import pytest

 sys.path.insert(0, os.path.dirname(__file__))
-from common import BUILD_DIR, CLIENT_CMD, SERVER_CMD, TEST_DATA_DIR, run_client, verify_transfer
+from common import (
+    BUILD_DIR,
+    CLIENT_CMD,
+    CLIENT_TIMEOUT,
+    SERVER_CMD,
+    TEST_DATA_DIR,
+    get_dest_received_dir,
+    run_client,
+    verify_transfer,
+)
+
+DEFAULT_PORT = 8080
+
+
+def _port_is_listening(host, port, timeout=0.3):
+    """True if something accepts a TCP connection on host:port right now."""
+    try:
+        with socket.create_connection((host, port), timeout=timeout):
+            return True
+    except OSError:
+        return False
+
+
+def _wait_for_listener(host, port, timeout=5.0):
+    """Poll host:port until a listener accepts, or the deadline passes."""
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        if _port_is_listening(host, port):
+            return True
+        time.sleep(0.05)
+    return False


 class TestHelp:
    def test_client_help(self):
-        r = subprocess.run(CLIENT_CMD + ["--help"], capture_output=True, text=True)
+        r = subprocess.run(CLIENT_CMD + ["--help"], capture_output=True,
+                           text=True, timeout=CLIENT_TIMEOUT)
        assert r.returncode == 0
        assert "Usage:" in r.stdout
        assert "SSH transport" in r.stdout

    def test_server_help(self):
-        r = subprocess.run(SERVER_CMD + ["--help"], capture_output=True, text=True)
+        r = subprocess.run(SERVER_CMD + ["--help"], capture_output=True,
+                           text=True, timeout=CLIENT_TIMEOUT)
        assert r.returncode == 0
        assert "Usage:" in r.stdout

@@ -67,19 +101,24 @@ class TestServerPort:

    def test_default_port(self):
        """Server should start on default port 8080."""
+        if _port_is_listening("127.0.0.1", DEFAULT_PORT):
+            pytest.skip(f"port {DEFAULT_PORT} already in use by another process")
+
        proc = subprocess.Popen(
            SERVER_CMD, stdout=subprocess.DEVNULL, stderr=None,
        )
        try:
-            import socket, time
-            time.sleep(0.5)
-            with socket.create_connection(("127.0.0.1", 8080), timeout=2):
-                pass  # Port is listening
-        except (ConnectionRefusedError, OSError):
-            pytest.fail("Server not listening on default port 8080")
+            if not _wait_for_listener("127.0.0.1", DEFAULT_PORT, timeout=5.0):
+                if proc.poll() is not None and _port_is_listening("127.0.0.1", DEFAULT_PORT):
+                    pytest.skip(f"port {DEFAULT_PORT} was taken by another process")
+                pytest.fail(f"Server not listening on default port {DEFAULT_PORT}")
        finally:
            proc.terminate()
-            proc.wait(timeout=5)
+            try:
+                proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                proc.kill()
+                proc.wait()


 def _seed_protocol_source(source):
@@ -94,18 +133,18 @@ def _seed_protocol_source(source):
 class TestProtocol:
    @pytest.mark.ci
    def test_protocol_current_version_accepted(self, shared_server):
-        """--protocol=2.28.0 (the current PROTOCOL_VERSION) is accepted and the
+        """--protocol=2.29.0 (the current PROTOCOL_VERSION) is accepted and the
        transfer completes normally."""
        source = os.path.join(TEST_DATA_DIR, "proto_ok_src")
        dest = os.path.join(TEST_DATA_DIR, "proto_ok_dst")
        shutil.rmtree(dest, ignore_errors=True)
        os.makedirs(dest)
        _seed_protocol_source(source)
-        result, _ = run_client(source, dest, flags=["--protocol=2.28.0"],
+        result, _ = run_client(source, dest, flags=["--protocol=2.29.0"],
                               port=shared_server.port)
        assert result.returncode == 0, \
            f"--protocol current run failed: {(result.stderr or result.stdout)[:400]}"
-        received = os.path.join(dest, os.path.abspath(source).lstrip(os.sep))
+        received = get_dest_received_dir(dest, source)
        mismatches, missing = verify_transfer(source, received)
        assert not mismatches and not missing, \
            f"transfer mismatch: missing={missing} mismatches={mismatches}"
@@ -118,7 +157,7 @@ class TestProtocol:
        shutil.rmtree(dest, ignore_errors=True)
        os.makedirs(dest)
        _seed_protocol_source(source)
-        for bad in ("2.27.0", "2.26.0", "2.25.0", "2.24.0", "2.23.0", "2.22.0", "2.21.0", "2.20.0",
+        for bad in ("2.28.0", "2.27.0", "2.26.0", "2.25.0", "2.24.0", "2.23.0", "2.22.0", "2.21.0", "2.20.0",
                    "2.19.0", "2.18.0", "2.17.0", "2.15.0", "2.16.0", "216", "31"):
            result, _ = run_client(source, dest, flags=[f"--protocol={bad}"],
                                   port=shared_server.port)
@@ -353,10 +353,10 @@ class TestOwnershipRoot:
        st = os.stat(dst)
        assert st.st_uid != 12345, \
            f"--fake-super -o must NOT real-chown the source owner, got uid={st.st_uid}"
-        record = os.getxattr(dst, "user.fastsync.stat").decode()
-        fields = record.split(":")
-        assert fields[0] == "12345", \
-            f"--fake-super must record the resolved owner, got {fields[0]}"
+        record = os.getxattr(dst, "user.rsync.%stat").decode()
+        owner = record.split()[2].split(":")
+        assert owner[0] == "12345", \
+            f"--fake-super must record the resolved owner, got {owner[0]}"

    def test_o_applies_directory_owner(self, shared_server):
        """#286.2: -o must apply the source owner to DIRECTORIES too (the
@@ -0,0 +1,138 @@
+"""Parity coverage for an absolute ``--temp-dir`` that lies inside the receive root.
+
+FastSync confines the ``--temp-dir`` scratch directory to the receive root.  It
+previously rejected *every* absolute path; it now canonicalizes an absolute path
+with ``realpath(3)`` and accepts it when it resolves inside the canonical receive
+root (the destination is identical, so this is a pure parity win), while an
+absolute path that escapes the root stays rejected with a clear error.
+
+Two paths exercise the same receiver-side resolution:
+
+* the local ``--read-batch`` apply (no network; the batch destination is the
+  receive root), and
+* a real TCP transfer against the shared server (the destination root is the
+  client-supplied absolute path).
+
+The out-of-root case asserts the run fails without writing a single scratch
+file, so the confinement invariant is preserved.
+"""
+import os
+import subprocess
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import CLIENT_CMD, TEST_DATA_DIR, clean_dir, get_dest_received_dir, run_client
+
+FILES = {
+    "top.txt": b"top level\n",
+    "sub/nested.txt": b"nested file\n" * 16,
+}
+
+
+def _run(args):
+    return subprocess.run(CLIENT_CMD + args, capture_output=True, text=True, timeout=180)
+
+
+def _seed_source(root):
+    clean_dir(root)
+    for rel, data in FILES.items():
+        full = os.path.join(root, rel)
+        os.makedirs(os.path.dirname(full), exist_ok=True)
+        with open(full, "wb") as fh:
+            fh.write(data)
+
+
+def _make_batch(tmp, source):
+    batch = os.path.join(tmp, "tree.batch")
+    result = _run(["--only-write-batch", batch, source])
+    assert result.returncode == 0, (result.stdout, result.stderr)
+    return batch
+
+
+def _read(path):
+    with open(path, "rb") as fh:
+        return fh.read()
+
+
+@pytest.mark.ci
+def test_read_batch_absolute_temp_dir_inside_root_accepted(tmp_path):
+    source = os.path.join(tmp_path, "src")
+    dest = os.path.join(tmp_path, "dst")
+    _seed_source(source)
+    clean_dir(dest)
+    scratch = os.path.join(dest, "scratch")
+    os.makedirs(scratch)
+    # Stamp the scratch dir with an old mtime so the test can prove the receiver
+    # really created (and then removed) its temp file there: the directory mtime
+    # changes when an entry is created/removed, so a silently-ignored --temp-dir
+    # would leave the stamp untouched.  An empty scratch dir alone does not
+    # distinguish "used and cleaned up" from "never used".
+    stale_mtime = 946684800  # 2000-01-01
+    os.utime(scratch, (stale_mtime, stale_mtime))
+
+    batch = _make_batch(str(tmp_path), source)
+    result = _run(["--read-batch", batch, dest, "--temp-dir", scratch])
+    assert result.returncode == 0, (result.stdout, result.stderr)
+
+    received = get_dest_received_dir(dest, source)
+    for rel, data in FILES.items():
+        assert _read(os.path.join(received, rel)) == data, f"content mismatch for {rel}"
+    assert os.listdir(scratch) == [], "scratch dir was not left clean"
+    assert os.stat(scratch).st_mtime != stale_mtime, (
+        "--temp-dir scratch dir was never written to (temp file not created there)"
+    )
+
+
+@pytest.mark.ci
+def test_read_batch_absolute_temp_dir_outside_root_rejected(tmp_path):
+    source = os.path.join(tmp_path, "src")
+    dest = os.path.join(tmp_path, "dst")
+    _seed_source(source)
+    clean_dir(dest)
+    outside = os.path.join(tmp_path, "outside")
+    os.makedirs(outside)
+
+    batch = _make_batch(str(tmp_path), source)
+    result = _run(["--read-batch", batch, dest, "--temp-dir", outside])
+    assert result.returncode != 0, "an absolute temp dir outside the receive root must be rejected"
+    assert os.listdir(outside) == [], "receiver wrote into an unconfined temp dir"
+    assert "temp-dir" in (result.stdout + result.stderr), (result.stdout, result.stderr)
+
+
+def test_tcp_absolute_temp_dir_inside_root_accepted(shared_server):
+    source = os.path.join(TEST_DATA_DIR, "tempdir_abs_in_src")
+    dest = os.path.join(TEST_DATA_DIR, "tempdir_abs_in_dst")
+    _seed_source(source)
+    clean_dir(dest)
+    scratch = os.path.join(dest, "scratch")
+    os.makedirs(scratch)
+    # See test_read_batch_absolute_temp_dir_inside_root_accepted: the stale
+    # mtime makes actual scratch usage observable (the temp file creation and
+    # removal bump the directory mtime).
+    stale_mtime = 946684800  # 2000-01-01
+    os.utime(scratch, (stale_mtime, stale_mtime))
+
+    result, _ = run_client(source, dest, flags=["--temp-dir", scratch], port=shared_server.port)
+    assert result.returncode == 0, (result.stdout, result.stderr)[:300]
+    received = get_dest_received_dir(dest, source)
+    for rel, data in FILES.items():
+        assert _read(os.path.join(received, rel)) == data, f"content mismatch for {rel}"
+    assert os.listdir(scratch) == [], "scratch dir was not left clean"
+    assert os.stat(scratch).st_mtime != stale_mtime, (
+        "--temp-dir scratch dir was never written to (temp file not created there)"
+    )
+
+
+def test_tcp_absolute_temp_dir_outside_root_rejected(shared_server):
+    source = os.path.join(TEST_DATA_DIR, "tempdir_abs_out_src")
+    dest = os.path.join(TEST_DATA_DIR, "tempdir_abs_out_dst")
+    _seed_source(source)
+    clean_dir(dest)
+    outside = os.path.join(TEST_DATA_DIR, "tempdir_abs_out_scratch")
+    clean_dir(outside)
+
+    result, _ = run_client(source, dest, flags=["--temp-dir", outside], port=shared_server.port)
+    assert result.returncode != 0, "an absolute temp dir outside the receive root must be rejected"
+    assert os.listdir(outside) == [], "receiver wrote into an unconfined temp dir"
@@ -0,0 +1,80 @@
+"""End-to-end coverage for the `--temp-dir` EXDEV (cross-filesystem) fallback.
+
+`file_to_disk_secure_impl` installs a completed temp file with `renameat(2)`;
+when the scratch dir lives on a different filesystem the rename fails with
+`EXDEV` and the engine retries with no scratch dir, writing the file directly in
+the destination directory (a non-atomic copy), matching rsync.
+
+The daemon receiver confines `--temp-dir` to the authorized receive root, so a
+genuine cross-fs scratch there would require an in-root mount point.  Bind/tmpfs
+mounting is not permitted in the CI container (no `CAP_SYS_ADMIN`, and
+unprivileged user namespaces are disabled), so this test reaches the exact same
+code path through the local `--read-batch` apply instead: it has no
+authorized-root confinement, so a relative `--temp-dir` that is a symlink to a
+tmpfs (`/dev/shm`) is accepted and the final install then crosses filesystems.
+"""
+import os
+import shutil
+import subprocess
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import CLIENT_CMD, get_dest_received_dir
+
+TMPFS = "/dev/shm"
+
+
+def _run(args):
+    return subprocess.run(CLIENT_CMD + args, capture_output=True, text=True, timeout=180)
+
+
+def _read(path):
+    with open(path, "rb") as fh:
+        return fh.read()
+
+
+def test_read_batch_temp_dir_cross_filesystem_fallback(tmp_path):
+    if not os.path.isdir(TMPFS):
+        pytest.skip("no /dev/shm tmpfs available to force a cross-filesystem install")
+
+    source = tmp_path / "src"
+    dest = tmp_path / "dst"
+    source.mkdir()
+    dest.mkdir()
+    files = {
+        "payload.bin": bytes(range(256)) * 64,
+        "sub/nested.txt": b"nested exdev fallback\n" * 8,
+    }
+    for rel, data in files.items():
+        full = source / rel
+        full.parent.mkdir(parents=True, exist_ok=True)
+        full.write_bytes(data)
+
+    batch = tmp_path / "tree.batch"
+    r = _run(["--only-write-batch", str(batch), str(source)])
+    assert r.returncode == 0, (r.stdout, r.stderr)
+
+    # A cross-filesystem scratch dir, reached through a relative --temp-dir
+    # symlink (the local batch apply performs no authorized-root confinement).
+    scratch = os.path.join(TMPFS, "fastsync_exdev_%d" % os.getpid())
+    shutil.rmtree(scratch, ignore_errors=True)
+    os.makedirs(scratch)
+    os.symlink(scratch, dest / "scratch")
+    try:
+        assert os.stat(scratch).st_dev != os.stat(dest).st_dev, (
+            "scratch and destination share a filesystem; EXDEV cannot be exercised"
+        )
+        r = _run(["--read-batch", str(batch), str(dest), "--temp-dir=scratch"])
+        assert r.returncode == 0, (r.stdout, r.stderr)
+        # The engine must report the non-atomic cross-fs fallback rather than
+        # silently claiming an atomic install.
+        assert "different filesystem" in (r.stdout + r.stderr), (r.stdout, r.stderr)
+        # The tree is still byte-exact and the scratch dir is left clean.
+        received = get_dest_received_dir(str(dest), str(source))
+        for rel, data in files.items():
+            assert _read(os.path.join(received, rel)) == data, f"content mismatch for {rel}"
+        assert os.listdir(scratch) == [], "cross-fs temp file was not cleaned up"
+    finally:
+        shutil.rmtree(scratch, ignore_errors=True)
@@ -146,9 +146,16 @@ class TestTLSBasic:
        assert not missing, f"Missing files: {missing}"
        assert not mismatches, f"Mismatched files: {mismatches}"

-    @pytest.mark.xfail(reason="TLS multithreading has architectural limitations with per-thread SSL context")
+    @pytest.mark.ci
    def test_tls_with_multithreading(self, certs):
-        """TLS + multithreading."""
+        """TLS + multithreading + --sendfile.
+
+        Exercises the TLS/sendfile interaction end to end: with --sendfile the
+        sender must route the file body through the buffered TLS path rather
+        than raw sendfile(2) on the encrypted socket.  The focused decision
+        guard lives in tests/test_protocol.c
+        (test_tls_sendfile_decision_uses_buffered_path).
+        """
        clean_dir(DEST_DIR)
        with ServerManager() as server:
            server.start(extra_args=[
@@ -157,7 +164,7 @@ class TestTLSBasic:
            ])
            result, dur = run_client(
                SOURCE_DIR, DEST_DIR,
-                flags=["--threads", "--tls",
+                flags=["--threads", "--sendfile", "--tls",
                       "--cert", certs["client_cert"], "--key", certs["client_key"],
                       "--ca", certs["ca"]],
                port=server.port,
@@ -16,6 +16,7 @@
 #include "test_file.h"
 #include "test_file_list.h"
 #include "test_file_sendfile.h"
+#include "test_filter.h"
 #include "test_format.h"
 #include "test_fuzz_smoke.h"
 #include "test_glob.h"
@@ -80,6 +81,7 @@ int main() {
  RUN_TEST(test_receiver_timeout);
  RUN_TEST(test_metadata);
  RUN_TEST(test_glob);
+  RUN_TEST(test_filter);
  RUN_TEST(test_iconv);
  RUN_TEST(test_file);
  RUN_TEST(test_file_list);
@@ -195,7 +195,7 @@ static void test_format_C_padding_uses_transfer_algo() {
      {CHECKSUM_ALGO_NONE, 2},
  };
  for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); i++) {
-    config->checksum_transfer_algo = cases[i].algo;
+    config->cli.checksum_transfer_algo = cases[i].algo;
    char expected[64];
    size_t n = 0;
    expected[n++] = '[';
@@ -10,6 +10,8 @@
 #include "protocol.h"
 #include "test_utils.h"
 #include "utils.h"
+#include <fnmatch.h>
+#include <grp.h>
 #include <pwd.h>
 #include <stddef.h>
 #include <stdint.h>
@@ -171,6 +173,38 @@ static void test_validate_config_unified_invariants() {
  config_delete(cfg);
 }

+/* The receiver enforces MAX_FILTER_RULES on the protect-rule block and would
+   otherwise fail the session with an opaque protocol error.  The client must
+   accept exactly the limit and reject one more up front, before any network
+   I/O, with an actionable message. */
+static void test_validate_config_filter_rule_limit() {
+  Config* cfg = valid_client_config();
+  cfg->filters = array_list_create(free);
+  EXPECT_NOT_NULL(cfg->filters);
+  for (int i = 0; i < MAX_FILTER_RULES; i++)
+    EXPECT_TRUE(array_list_add(cfg->filters, str_dup("- *.tmp")));
+  EXPECT_TRUE(validate_config(cfg)); /* exactly the limit is accepted */
+
+  FILE* log_capture = tmpfile();
+  EXPECT_NOT_NULL(log_capture);
+  log_set_file(log_capture);
+  EXPECT_TRUE(array_list_add(cfg->filters, str_dup("- *.bak")));
+  EXPECT_FALSE(validate_config(cfg)); /* one over the limit is rejected */
+  fflush(log_capture);
+  rewind(log_capture);
+  char line[512];
+  bool saw_message = false;
+  while (fgets(line, sizeof(line), log_capture) != NULL) {
+    if (strstr(line, "too many filter rules") != NULL && strstr(line, "(maximum 1024)") != NULL)
+      saw_message = true;
+  }
+  log_set_file(NULL);
+  fclose(log_capture);
+  EXPECT_TRUE(saw_message);
+
+  config_delete(cfg);
+}
+
 /* Test main() with --help flag (early return path, no server connection needed) */
 static void test_cli_help() {
  /* We can't easily call main() because it calls send_files which needs a server.
@@ -318,7 +352,7 @@ static void test_parse_args_protocol_accept_current() {
  Config* cfg = valid_client_config();
  EXPECT_NOT_NULL(cfg);
  char* argv_equals[] = {"fastsync",   "--source-dir", "/src",
-                         "--dest-dir", "/dst",         "--protocol=2.28.0"};
+                         "--dest-dir", "/dst",         "--protocol=2.29.0"};
  int positional_args[2];
  int positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 6, argv_equals, positional_args, &positional_count), 0);
@@ -328,7 +362,7 @@ static void test_parse_args_protocol_accept_current() {
  cfg = valid_client_config();
  EXPECT_NOT_NULL(cfg);
  char* argv_space[] = {"fastsync", "--source-dir", "/src",  "--dest-dir",
-                        "/dst",     "--protocol",   "2.28.0"};
+                        "/dst",     "--protocol",   "2.29.0"};
  positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 7, argv_space, positional_args, &positional_count), 0);
  EXPECT_EQ_STR(cfg->version, PROTOCOL_VERSION);
@@ -341,7 +375,7 @@ static void test_parse_args_protocol_rejects_other_versions() {
  static const char* const bad_versions[] = {"2.17",   "2.16",   "2.15.0", "2.16.0", "2.17.0",
                                             "2.18.0", "2.19.0", "2.20.0", "2.21.0", "2.22.0",
                                             "2.23.0", "2.24.0", "2.25.0", "2.26.0", "2.27.0",
-                                             "216",    "31",     "abc",    ""};
+                                             "2.28.0", "216",    "31",     "abc",    ""};
  for (size_t i = 0; i < sizeof(bad_versions) / sizeof(bad_versions[0]); i++) {
    Config* cfg = valid_client_config();
    EXPECT_NOT_NULL(cfg);
@@ -511,6 +545,66 @@ static void test_parse_args_ignore_existing() {
  config_delete(cfg);
 }

+/* --partial-dir=DIR implies --partial, matching rsync 3.4.1.  rsync resolves
+ * this after option parsing, so the implication wins over an explicit
+ * --no-partial in either order.  It is skipped under --inplace, where partial
+ * staging is bypassed and the destination is written in place. */
+static void test_parse_args_partial_dir_implies_partial() {
+  {
+    Config* cfg = config_create();
+    char* argv[] = {"fastsync", "--partial-dir=.partial", "/src", "/dst"};
+    int positional_args[2];
+    int positional_count = 0;
+    EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
+    EXPECT_TRUE(cfg->partial);
+    config_delete(cfg);
+  }
+  {
+    /* Explicit --no-partial before --partial-dir: --partial-dir still wins. */
+    Config* cfg = config_create();
+    char* argv[] = {"fastsync", "--no-partial", "--partial-dir=.partial", "/src", "/dst"};
+    int positional_args[2];
+    int positional_count = 0;
+    EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
+    EXPECT_TRUE(cfg->partial);
+    config_delete(cfg);
+  }
+  {
+    /* Reversed order must not change the precedence. */
+    Config* cfg = config_create();
+    char* argv[] = {"fastsync", "--partial-dir=.partial", "--no-partial", "/src", "/dst"};
+    int positional_args[2];
+    int positional_count = 0;
+    EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
+    EXPECT_TRUE(cfg->partial);
+    config_delete(cfg);
+  }
+  {
+    /* --inplace bypasses partial staging, so parse_args must not set the
+       implied --partial; the combination itself is invalid (rsync parity:
+       "--inplace cannot be used with --partial-dir"), so validation rejects. */
+    Config* cfg = config_create();
+    char* argv[] = {"fastsync", "--inplace", "--partial-dir=.partial", "/src", "/dst"};
+    int positional_args[2];
+    int positional_count = 0;
+    EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
+    EXPECT_FALSE(cfg->partial);
+    cfg->send_directory = str_dup("/src");
+    cfg->receive_root_directory = str_dup("/dst");
+    EXPECT_FALSE(validate_config(cfg));
+    config_delete(cfg);
+  }
+  {
+    Config* cfg = config_create();
+    char* argv[] = {"fastsync", "--no-partial", "/src", "/dst"};
+    int positional_args[2];
+    int positional_count = 0;
+    EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
+    EXPECT_FALSE(cfg->partial);
+    config_delete(cfg);
+  }
+}
+
 static void test_parse_args_executability() {
  Config* cfg = config_create();
  char* argv[] = {"fastsync", "-E", "/src", "/dst"};
@@ -638,7 +732,7 @@ static void test_parse_args_port_alias() {
  EXPECT_EQ_INT(cfg->server_port, 9000);
  /* The default port is 8080; the explicit bit is what lets --dry-run tell an
     explicit remote target from the default and route to the server. */
-  EXPECT_TRUE(cfg->server_port_set);
+  EXPECT_TRUE(cfg->cli.server_port_set);
  config_delete(cfg);

  cfg = config_create();
@@ -646,7 +740,7 @@ static void test_parse_args_port_alias() {
  positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 4, argv_inline, positional_args, &positional_count), 0);
  EXPECT_EQ_INT(cfg->server_port, 9001);
-  EXPECT_TRUE(cfg->server_port_set);
+  EXPECT_TRUE(cfg->cli.server_port_set);
  config_delete(cfg);

  cfg = config_create();
@@ -654,7 +748,7 @@ static void test_parse_args_port_alias() {
  positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 4, argv_long, positional_args, &positional_count), 0);
  EXPECT_EQ_INT(cfg->server_port, 9002);
-  EXPECT_TRUE(cfg->server_port_set);
+  EXPECT_TRUE(cfg->cli.server_port_set);
  config_delete(cfg);
 }

@@ -665,18 +759,18 @@ static void test_parse_args_server_host_sets_routing_bit() {
  Config* cfg = config_create();
  int positional_args[2];
  int positional_count = 0;
-  EXPECT_FALSE(cfg->server_host_set);
+  EXPECT_FALSE(cfg->cli.server_host_set);
  char* argv_space[] = {"fastsync", "--server-host", "example.test", "/src", "/dst"};
  EXPECT_EQ_INT(parse_args(cfg, 5, argv_space, positional_args, &positional_count), 0);
  EXPECT_EQ_STR(cfg->server_host, "example.test");
-  EXPECT_TRUE(cfg->server_host_set);
+  EXPECT_TRUE(cfg->cli.server_host_set);
  config_delete(cfg);

  cfg = config_create();
  char* argv_inline[] = {"fastsync", "--server-host=example.test", "/src", "/dst"};
  positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 4, argv_inline, positional_args, &positional_count), 0);
-  EXPECT_TRUE(cfg->server_host_set);
+  EXPECT_TRUE(cfg->cli.server_host_set);
  config_delete(cfg);
 }

@@ -762,8 +856,9 @@ static void test_parse_args_debug_flags() {
  int positional_count = 0;

  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
-  EXPECT_EQ_INT(cfg->debug_level, LOG_DEBUG_ALL);
-  EXPECT_EQ_INT(get_log_debug_flags(), LOG_DEBUG_ALL);
+  EXPECT_EQ_INT(cfg->debug_level, LOG_DEBUG_IO | LOG_DEBUG_PROTO | LOG_DEBUG_PACK | LOG_DEBUG_UTIL);
+  EXPECT_EQ_INT(get_log_debug_flags(),
+                LOG_DEBUG_IO | LOG_DEBUG_PROTO | LOG_DEBUG_PACK | LOG_DEBUG_UTIL);
  config_delete(cfg);
 }

@@ -1241,35 +1336,78 @@ static void test_parse_args_delete_timing_without_delete_rejected() {
  config_delete(cfg);
 }

-/* Parsed-but-unimplemented options must fail instead of being silently accepted. */
-static void test_parse_args_rejects_unimplemented_options() {
-  static const char* const options[] = {"--silent",
-                                        "--queue-size",
-                                        "-A",
-                                        "--acls",
-                                        "-X",
-                                        "--xattrs",
-                                        "-D",
-                                        "--devices",
-                                        "--delete-excluded",
-                                        "--max-delete",
-                                        "--prune-empty-dirs",
-                                        "--bind-address",
-                                        "--daemon",
-                                        "--config",
-                                        "--server"};
+/* Truly-unknown options (including server-only spellings) must be rejected
+ * through the unknown-option path instead of being silently accepted. */
+static void test_parse_args_rejects_unknown_options() {
+  static const char* const options[] = {"--silent", "--queue-size", "--bind-address",
+                                        "--daemon", "--config",     "--server"};

  for (size_t i = 0; i < sizeof(options) / sizeof(options[0]); i++) {
    Config* cfg = config_create();
-    char* argv[] = {"fastsync", (char*)options[i], "dummy", "/src", "/dst"};
+    char* argv[] = {"fastsync", (char*)options[i], "/src", "/dst"};
    int positional_args[2];
    int positional_count = 0;

-    EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), -1);
+    EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), -1);
    config_delete(cfg);
  }
 }

+/* Options that are genuinely implemented must parse successfully and record
+ * their effect, rather than being lumped in with the unknown-option set. */
+static void test_parse_args_accepts_implemented_metadata_options() {
+  Config* cfg = config_create();
+  char* argv_x[] = {"fastsync", "-X", "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_x, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->preserve_xattrs);
+  config_delete(cfg);
+
+  cfg = config_create();
+  positional_count = 0;
+  char* argv_acls[] = {"fastsync", "--acls", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_acls, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->preserve_acls);
+  config_delete(cfg);
+
+  cfg = config_create();
+  positional_count = 0;
+  char* argv_d[] = {"fastsync", "-D", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_d, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->preserve_devices);
+  EXPECT_TRUE(cfg->preserve_specials);
+  config_delete(cfg);
+
+  cfg = config_create();
+  positional_count = 0;
+  char* argv_devices[] = {"fastsync", "--devices", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_devices, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->preserve_devices);
+  config_delete(cfg);
+
+  cfg = config_create();
+  positional_count = 0;
+  char* argv_delete_excluded[] = {"fastsync", "--delete-excluded", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_delete_excluded, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->delete_excluded);
+  config_delete(cfg);
+
+  cfg = config_create();
+  positional_count = 0;
+  char* argv_max_delete[] = {"fastsync", "--max-delete=5", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_max_delete, positional_args, &positional_count), 0);
+  EXPECT_EQ_INT(cfg->max_delete, 5);
+  config_delete(cfg);
+
+  cfg = config_create();
+  positional_count = 0;
+  char* argv_prune[] = {"fastsync", "--prune-empty-dirs", "/src", "/dst"};
+  EXPECT_EQ_INT(parse_args(cfg, 4, argv_prune, positional_args, &positional_count), 0);
+  EXPECT_TRUE(cfg->prune_empty_dirs);
+  config_delete(cfg);
+}
+
 /* Test both rsync-compatible quiet spellings and option ordering. */
 static void test_parse_args_quiet() {
  static const char* const options[][2] = {
@@ -1421,10 +1559,9 @@ static void test_parse_args_info_name_and_help() {
  config_delete(cfg);
 }

-/* rsync 3.4.1's full --info/--debug vocabulary parses.  The info categories
- * with a FastSync event set their flag; the remaining rsync-only categories
- * (backup/mount/symsafe/syms) parse but stay silent.  Every --debug category
- * listed here is FastSync-silent, so debug_level stays 0. */
+/* rsync 3.4.1's full --info/--debug vocabulary parses.  The categories with a
+ * FastSync event set their flag; the remaining rsync-only categories
+ * (backup/symsafe/syms, acl/bind/chdir/...) parse but stay silent. */
 static void test_parse_args_rsync_flag_vocabulary_accepted() {
  Config* cfg = config_create();
  char* argv[] = {"fastsync", "--info=backup,del,flist,mount,nonreg,progress,remove,symsafe,syms",
@@ -1436,9 +1573,10 @@ static void test_parse_args_rsync_flag_vocabulary_accepted() {
  int positional_count = 0;

  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
-  EXPECT_EQ_INT(cfg->info_level, LOG_INFO_DEL | LOG_INFO_FLIST | LOG_INFO_NONREG |
+  EXPECT_EQ_INT(cfg->info_level, LOG_INFO_DEL | LOG_INFO_FLIST | LOG_INFO_MOUNT | LOG_INFO_NONREG |
                                     LOG_INFO_PROGRESS | LOG_INFO_REMOVE);
-  EXPECT_EQ_INT(cfg->debug_level, 0);
+  EXPECT_EQ_INT(cfg->debug_level, LOG_DEBUG_DEL | LOG_DEBUG_FLIST | LOG_DEBUG_HASH |
+                                      LOG_DEBUG_RECV | LOG_DEBUG_FILTER | LOG_DEBUG_SEND);
  config_delete(cfg);
 }

@@ -1590,7 +1728,7 @@ static void test_parse_args_no_preserve_blocks_implicit_metadata() {

    EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
    EXPECT_FALSE(cfg->use_metadata);
-    EXPECT_TRUE(cfg->metadata_explicitly_disabled);
+    EXPECT_TRUE(cfg->cli.metadata_explicitly_disabled);
    config_delete(cfg);
  }
 }
@@ -1641,7 +1779,7 @@ static void test_parse_args_checksum_choice_rejects_unsupported() {
    int positional_args[2];
    int positional_count = 0;
    EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), -1);
-    EXPECT_EQ_INT(cfg->cli_exit_code, 4);
+    EXPECT_EQ_INT(cfg->cli.cli_exit_code, 4);
    config_delete(cfg);
  }
 }
@@ -1681,7 +1819,7 @@ static void test_parse_args_checksum_choice_new_algos() {
    positional_count = 0;
    EXPECT_EQ_INT(parse_args(cfg, 5, argv4, positional_args, &positional_count), 0);
    EXPECT_EQ_INT(cfg->checksum_algo, single[i]);
-    EXPECT_EQ_INT(cfg->checksum_transfer_algo, single[i]);
+    EXPECT_EQ_INT(cfg->cli.checksum_transfer_algo, single[i]);
    config_delete(cfg);
  }

@@ -1691,7 +1829,7 @@ static void test_parse_args_checksum_choice_new_algos() {
  char* argv5[] = {"fastsync", "--cc=sha1,md4", "/checksum/src", "/dst"};
  positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 4, argv5, positional_args, &positional_count), 0);
-  EXPECT_EQ_INT(cfg->checksum_transfer_algo, (int)CHECKSUM_ALGO_SHA1);
+  EXPECT_EQ_INT(cfg->cli.checksum_transfer_algo, (int)CHECKSUM_ALGO_SHA1);
  EXPECT_EQ_INT(cfg->checksum_algo, (int)CHECKSUM_ALGO_MD4);
  config_delete(cfg);

@@ -1713,14 +1851,14 @@ static void test_parse_args_checksum_none_with_checksum_rejected() {
  int positional_args[2];
  int positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), -1);
-  EXPECT_EQ_INT(cfg->cli_exit_code, 4);
+  EXPECT_EQ_INT(cfg->cli.cli_exit_code, 4);
  config_delete(cfg);

  cfg = config_create();
  char* argv2[] = {"fastsync", "--checksum", "--cc=md5,none", "/checksum/src", "/dst"};
  positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 5, argv2, positional_args, &positional_count), -1);
-  EXPECT_EQ_INT(cfg->cli_exit_code, 4);
+  EXPECT_EQ_INT(cfg->cli.cli_exit_code, 4);
  config_delete(cfg);

  /* "none" as the TRANSFER checksum with a real pre-transfer checksum is
@@ -1822,7 +1960,7 @@ static void test_parse_args_compress_choice_parity() {
    int positional_args[2];
    int positional_count = 0;
    EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), -1);
-    EXPECT_EQ_INT(cfg->cli_exit_code, 4);
+    EXPECT_EQ_INT(cfg->cli.cli_exit_code, 4);
    config_delete(cfg);
  }
 }
@@ -1942,6 +2080,9 @@ static void test_parse_args_temp_dir() {
  config_delete(cfg);
 }

+/* --old-args is accepted for rsync CLI compatibility as a documented no-op (the
+ * remote server path is always safely quoted); it stores no Config field, so
+ * parsing it must simply succeed and leave the positional arguments intact. */
 static void test_parse_args_old_args() {
  Config* cfg = config_create();
  char* argv[] = {"fastsync", "--old-args", "/src", "/dst"};
@@ -1949,7 +2090,7 @@ static void test_parse_args_old_args() {
  int positional_count = 0;

  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
-  EXPECT_TRUE(cfg->old_args);
+  EXPECT_EQ_INT(positional_count, 2);
  config_delete(cfg);
 }

@@ -2583,7 +2724,7 @@ static void test_parse_args_compression_env_list() {
  cfg = config_create();
  positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), -1);
-  EXPECT_EQ_INT(cfg->cli_exit_code, 4);
+  EXPECT_EQ_INT(cfg->cli.cli_exit_code, 4);
  config_delete(cfg);
  unsetenv("RSYNC_COMPRESS_LIST");
 }
@@ -2598,7 +2739,7 @@ static void test_parse_args_checksum_env_list() {
  setenv("RSYNC_CHECKSUM_LIST", "md5", 1);
  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), 0);
  EXPECT_EQ_INT(cfg->checksum_algo, (int)CHECKSUM_ALGO_MD5);
-  EXPECT_EQ_INT(cfg->checksum_transfer_algo, (int)CHECKSUM_ALGO_MD5);
+  EXPECT_EQ_INT(cfg->cli.checksum_transfer_algo, (int)CHECKSUM_ALGO_MD5);
  config_delete(cfg);

  /* An explicit --cc wins. */
@@ -2614,7 +2755,7 @@ static void test_parse_args_checksum_env_list() {
  cfg = config_create();
  positional_count = 0;
  EXPECT_EQ_INT(parse_args(cfg, 4, argv, positional_args, &positional_count), -1);
-  EXPECT_EQ_INT(cfg->cli_exit_code, 4);
+  EXPECT_EQ_INT(cfg->cli.cli_exit_code, 4);
  config_delete(cfg);
  unsetenv("RSYNC_CHECKSUM_LIST");
 }
@@ -3398,6 +3539,243 @@ static void test_parse_args_usermap_rsync_forms() {
  config_delete(cfg);
 }

+/* Independent oracle for the FROM name-glob tests: enumerate the sender's
+ * account database and fill `ids` with the DISTINCT ids whose name matches
+ * `glob`, sorted ascending.  Returns the count, or -1 if the matching set
+ * exceeds `max` distinct ids -- production has no such bound on the number of
+ * candidates it scans, so a truncated set would under-count runs and flake on
+ * hosts with very large account databases.  Callers must skip (not fail) on
+ * -1. */
+static int cli_collect_glob_ids(const char* glob, bool is_group, int32_t* ids, int max) {
+  int n = 0;
+  bool overflow = false;
+  if (is_group) {
+    setgrent();
+    struct group* gr;
+    while ((gr = getgrent()) != NULL) {
+      if (fnmatch(glob, gr->gr_name, 0) != 0)
+        continue;
+      if ((unsigned long)gr->gr_gid > (unsigned long)INT32_MAX)
+        continue;
+      int32_t id = (int32_t)gr->gr_gid;
+      bool dup = false;
+      for (int i = 0; i < n; i++)
+        if (ids[i] == id)
+          dup = true;
+      if (dup)
+        continue;
+      if (n >= max) {
+        overflow = true;
+        break;
+      }
+      ids[n++] = id;
+    }
+    endgrent();
+  } else {
+    setpwent();
+    struct passwd* pw;
+    while ((pw = getpwent()) != NULL) {
+      if (fnmatch(glob, pw->pw_name, 0) != 0)
+        continue;
+      if ((unsigned long)pw->pw_uid > (unsigned long)INT32_MAX)
+        continue;
+      int32_t id = (int32_t)pw->pw_uid;
+      bool dup = false;
+      for (int i = 0; i < n; i++)
+        if (ids[i] == id)
+          dup = true;
+      if (dup)
+        continue;
+      if (n >= max) {
+        overflow = true;
+        break;
+      }
+      ids[n++] = id;
+    }
+    endpwent();
+  }
+  for (int i = 1; i < n; i++) {
+    int32_t key = ids[i];
+    int j = i - 1;
+    while (j >= 0 && ids[j] > key) {
+      ids[j + 1] = ids[j];
+      j--;
+    }
+    ids[j + 1] = key;
+  }
+  return overflow ? -1 : n;
+}
+
+static int cli_count_runs(const int32_t* ids, int n) {
+  int runs = 0;
+  for (int i = 0; i < n; i++) {
+    if (i == 0 || ids[i - 1] == INT32_MAX || ids[i] != ids[i - 1] + 1)
+      runs++;
+  }
+  return runs;
+}
+
+/* #294: a FROM name wildcard must expand, at CLI-parse time, against the
+ * sender's account database into numeric id/range rules.  Prefer a prefix that
+ * matches >=2 DISTINCT NON-contiguous ids (exercising multi-rule expansion); if
+ * no such prefix exists on this host, fall back to one whose ids are contiguous
+ * (exercising range collapse).  The expected rules are derived independently by
+ * enumerating the same database. */
+static void test_parse_args_identity_map_from_name_glob(bool is_group) {
+  int32_t ids[512];
+  int chosen_n = 0;
+  int chosen_runs = 0;
+  char chosen_c = 0;
+  for (char c = 'a'; c <= 'z'; c++) {
+    const char glob[3] = {c, '*', '\0'};
+    int n = cli_collect_glob_ids(glob, is_group, ids, (int)(sizeof(ids) / sizeof(ids[0])));
+    if (n < 2)
+      continue; /* no matches, or the set overflowed the oracle's buffer */
+    int runs = cli_count_runs(ids, n);
+    if (runs > MAX_IDENTITY_MAP)
+      continue; /* production would reject this expansion; try another prefix */
+    if (runs >= 2 || chosen_c == 0) {
+      chosen_c = c;
+      chosen_n = n;
+      chosen_runs = runs;
+    }
+    if (runs >= 2)
+      break;
+  }
+  if (chosen_c == 0)
+    return; /* no multi-match prefix on this host (skipped, not failed) */
+
+  const char glob[3] = {chosen_c, '*', '\0'};
+  chosen_n = cli_collect_glob_ids(glob, is_group, ids, (int)(sizeof(ids) / sizeof(ids[0])));
+  if (chosen_n < 2)
+    return; /* account DB changed under us: skip, don't flake */
+  chosen_runs = cli_count_runs(ids, chosen_n);
+  EXPECT_TRUE(chosen_n >= 2);
+
+  char map_value[16];
+  snprintf(map_value, sizeof(map_value), "%s:@0", glob);
+  Config* cfg = config_create();
+  char* argv[] = {"fastsync", is_group ? "--groupmap" : "--usermap", map_value, "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
+
+  int got = is_group ? cfg->groupmap_count : cfg->usermap_count;
+  EXPECT_EQ_INT(got, chosen_runs);
+  const IdentityMap* map = is_group ? cfg->groupmap : cfg->usermap;
+  /* Every matched id is covered by some expanded rule. */
+  for (int i = 0; i < chosen_n; i++) {
+    bool covered = false;
+    for (int r = 0; r < got; r++)
+      if (ids[i] >= map[r].from && ids[i] <= map[r].from_hi)
+        covered = true;
+    EXPECT_TRUE(covered);
+  }
+  /* Every id inside every expanded range is one the glob actually matched, so
+   * the range collapse cannot over-match a name that does not fit the glob. */
+  for (int r = 0; r < got; r++) {
+    EXPECT_EQ_INT(map[r].to, 0);
+    for (int32_t v = map[r].from; v <= map[r].from_hi; v++) {
+      bool expected = false;
+      for (int i = 0; i < chosen_n; i++)
+        if (ids[i] == v)
+          expected = true;
+      EXPECT_TRUE(expected);
+      if (v == INT32_MAX)
+        break;
+    }
+  }
+  config_delete(cfg);
+}
+
+static void test_parse_args_usermap_from_name_glob() {
+  test_parse_args_identity_map_from_name_glob(false);
+}
+
+static void test_parse_args_groupmap_from_name_glob() {
+  test_parse_args_identity_map_from_name_glob(true);
+}
+
+/* Regression for a leak in the FROM name-glob success path: the TO side is
+ * parsed into `parsed.to_name` before the glob is expanded, and every emitted
+ * rule takes its own str_dup of that name -- so the parse-time copy must be
+ * released before the branch continues.  A numeric TO has to_name == NULL and
+ * cannot expose the leak, hence this uses a NAME TO.  The name is resolved on
+ * the receiver (not here), so any well-formed non-glob name works.  Run this
+ * under ASan/valgrind to catch the leak. */
+static void test_parse_args_identity_map_from_name_glob_name_to(bool is_group) {
+  int32_t ids[512];
+  char chosen_c = 0;
+  for (char c = 'a'; c <= 'z'; c++) {
+    const char glob[3] = {c, '*', '\0'};
+    int n = cli_collect_glob_ids(glob, is_group, ids, (int)(sizeof(ids) / sizeof(ids[0])));
+    if (n < 2)
+      continue;
+    if (cli_count_runs(ids, n) > MAX_IDENTITY_MAP)
+      continue;
+    chosen_c = c;
+    break;
+  }
+  if (chosen_c == 0)
+    return; /* no multi-match prefix on this host (skipped, not failed) */
+
+  const char glob[3] = {chosen_c, '*', '\0'};
+  char map_value[32];
+  snprintf(map_value, sizeof(map_value), "%s:nobody", glob);
+  Config* cfg = config_create();
+  char* argv[] = {"fastsync", is_group ? "--groupmap" : "--usermap", map_value, "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), 0);
+
+  int got = is_group ? cfg->groupmap_count : cfg->usermap_count;
+  EXPECT_TRUE(got >= 1);
+  const IdentityMap* map = is_group ? cfg->groupmap : cfg->usermap;
+  for (int r = 0; r < got; r++) {
+    EXPECT_EQ_INT(map[r].to, 0);
+    EXPECT_NOT_NULL(map[r].to_name);
+    if (map[r].to_name)
+      EXPECT_EQ_STR(map[r].to_name, "nobody");
+  }
+  config_delete(cfg);
+}
+
+static void test_parse_args_usermap_from_name_glob_name_to() {
+  test_parse_args_identity_map_from_name_glob_name_to(false);
+}
+
+static void test_parse_args_groupmap_from_name_glob_name_to() {
+  test_parse_args_identity_map_from_name_glob_name_to(true);
+}
+
+/* #294: an expansion that would push the map past MAX_IDENTITY_MAP must fail
+ * with a clear error rather than silently truncating.  Prefill the map to the
+ * cap and then add a wildcard guaranteed to match at least the current user. */
+static void test_parse_args_identity_map_from_name_glob_over_cap() {
+  const struct passwd* self = getpwuid(geteuid());
+  if (!self || self->pw_name[0] == '\0')
+    return;
+  char glob[8];
+  snprintf(glob, sizeof(glob), "%c*", self->pw_name[0]);
+
+  size_t need = (size_t)MAX_IDENTITY_MAP * 6 + strlen(glob) + 4 + 1;
+  char* value = malloc(need);
+  if (!value)
+    return;
+  size_t off = 0;
+  for (int i = 0; i < MAX_IDENTITY_MAP; i++)
+    off += (size_t)snprintf(value + off, need - off, "@0:@0,");
+  snprintf(value + off, need - off, "%s:@0", glob);
+
+  Config* cfg = config_create();
+  char* argv[] = {"fastsync", "--usermap", value, "/src", "/dst"};
+  int positional_args[2];
+  int positional_count = 0;
+  EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), -1);
+  config_delete(cfg);
+  free(value);
+}
+
 /* #294: rsync refuses to mix --chown with --usermap/--groupmap on the same
 * side (either order).  --chown=USER conflicts with a prior --usermap;
 * --chown=:GROUP conflicts with a prior --groupmap; the opposite side is fine. */
@@ -3577,7 +3955,8 @@ static void test_parse_args_rejects_malformed_identity() {
      {"--usermap", "definitely_not_a_real_user_zzz:@1"},
      {"--usermap", "0-"},
      {"--usermap", "5-2:@1"},
-      {"--usermap", "roo*:@1"},
+      {"--usermap", "zzz_definitely_no_such_user_glob_zzz*:@1"},
+      {"--groupmap", "zzz_definitely_no_such_group_glob_zzz*:@1"},
      {"--groupmap", "@1"},
      {"--groupmap", "no_such_group_qqq:x"},
      {"--chown", "a:b:c"},
@@ -4249,7 +4628,7 @@ static void test_parse_args_preserve_long_form() {
 }

 /* --no-perms/--no-times/--no-owner/--no-group (long and short) clear only
- * their own attribute bit; they never set metadata_explicitly_disabled. */
+ * their own attribute bit; they never set cli.metadata_explicitly_disabled. */
 static void test_parse_args_preserve_negations() {
  struct {
    const char* arg;
@@ -4277,7 +4656,7 @@ static void test_parse_args_preserve_negations() {
      bool expected = all[j] != cases[i].offset;
      EXPECT_TRUE(*(bool*)((char*)cfg + all[j]) == expected);
    }
-    EXPECT_FALSE(cfg->metadata_explicitly_disabled);
+    EXPECT_FALSE(cfg->cli.metadata_explicitly_disabled);
    /* -a's devices/specials keep the metadata frame on. */
    EXPECT_TRUE(cfg->use_metadata);
    config_delete(cfg);
@@ -4320,7 +4699,7 @@ static void test_parse_args_no_preserve_disables_bundle() {
  EXPECT_FALSE(cfg->preserve_times);
  EXPECT_FALSE(cfg->preserve_owner);
  EXPECT_FALSE(cfg->preserve_group);
-  EXPECT_TRUE(cfg->metadata_explicitly_disabled);
+  EXPECT_TRUE(cfg->cli.metadata_explicitly_disabled);
  EXPECT_TRUE(cfg->use_incremental);
  EXPECT_FALSE(cfg->use_metadata);
  config_delete(cfg);
@@ -4373,7 +4752,7 @@ static void test_parse_args_incremental_implies_preserve() {
  EXPECT_EQ_INT(parse_args(cfg, 5, argv4, positional_args, &positional_count), 0);
  EXPECT_FALSE(cfg->preserve_perms);
  EXPECT_FALSE(cfg->preserve_times);
-  EXPECT_TRUE(cfg->metadata_explicitly_disabled);
+  EXPECT_TRUE(cfg->cli.metadata_explicitly_disabled);
  EXPECT_FALSE(cfg->use_metadata);
  config_delete(cfg);
 }
@@ -4661,10 +5040,12 @@ static void test_parse_args_include_exclude_order() {
  config_delete(cfg3);
 }

-/* OPT_NOOP compatibility flags (-s/--secluded-args, -r/--recursive) must never
- * swallow the next argv: `fastsync -s SRC DST` keeps both positionals. */
+/* OPT_NOOP compatibility flags (-s/--secluded-args, -r/--recursive, and the
+ * --inc-recursive/--no-inc-recursive scan-mode pair) must never swallow the
+ * next argv: `fastsync -s SRC DST` keeps both positionals. */
 static void test_parse_args_noop_does_not_consume_argv() {
-  static const char* const noops[] = {"-s", "--secluded-args", "-r", "--recursive"};
+  static const char* const noops[] = {"-s",          "--secluded-args", "-r",
+                                      "--recursive", "--inc-recursive", "--no-inc-recursive"};
  for (size_t i = 0; i < sizeof(noops) / sizeof(noops[0]); i++) {
    Config* cfg = config_create();
    int positional_args[2];
@@ -4743,6 +5124,11 @@ void test_client_cli() {
  test_parse_args_groupmap();
  test_parse_args_usermap_name_resolution();
  test_parse_args_usermap_rsync_forms();
+  test_parse_args_usermap_from_name_glob();
+  test_parse_args_groupmap_from_name_glob();
+  test_parse_args_usermap_from_name_glob_name_to();
+  test_parse_args_groupmap_from_name_glob_name_to();
+  test_parse_args_identity_map_from_name_glob_over_cap();
  test_parse_args_identity_map_chown_conflict();
  test_parse_args_chown();
  test_parse_args_copy_as();
@@ -4768,6 +5154,7 @@ void test_client_cli() {
  test_validate_config_credentials_require_tls_or_loopback();
  test_validate_config_delta_sendfile_constraints();
  test_validate_config_unified_invariants();
+  test_validate_config_filter_rule_limit();
  test_cli_help();
  test_cli_archive_flags();
  test_cli_dry_run();
@@ -4783,6 +5170,7 @@ void test_client_cli() {
  test_parse_args_valid_port();
  test_parse_args_size_only();
  test_parse_args_ignore_existing();
+  test_parse_args_partial_dir_implies_partial();
  test_parse_args_executability();
  test_parse_args_chmod();
  test_parse_args_numeric_chmod();
@@ -4818,7 +5206,8 @@ void test_client_cli() {
  test_parse_args_delete_default_timing_and_commit();
  test_parse_args_delete_timing_conflict_rejected();
  test_parse_args_delete_timing_without_delete_rejected();
-  test_parse_args_rejects_unimplemented_options();
+  test_parse_args_rejects_unknown_options();
+  test_parse_args_accepts_implemented_metadata_options();
  test_parse_args_quiet();
  test_parse_args_human_readable();
  test_parse_args_hard_links();
@@ -3,7 +3,9 @@
 #include "compression.h"
 #include "data.h"
 #include "file.h"
+#include "protocol.h"
 #include "utils.h"
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
@@ -216,6 +218,67 @@ static void test_data_decompress_unknown_size_frame() {
  data_destroy(frame);
 }

+/* The receiver advertises MAX_RECEIVE_WHOLE_FILE_SIZE (256 MiB) and the sender
+ * compresses whole files, so the decompressor's internal ceiling must match that
+ * protocol bound.  A 130 MiB payload -- above the old 100 MiB ceiling but below
+ * the protocol bound -- must round-trip through
+ * data_decompress_limited(..., MAX_RECEIVE_WHOLE_FILE_SIZE).  The payload is all
+ * zeros so it compresses to a tiny frame while still declaring its full size. */
+static void test_data_decompress_limited_whole_file_ceiling() {
+  const size_t size = 130ULL * 1024 * 1024;
+  Data* input = data_create_empty(size);
+  EXPECT_NOT_NULL(input);
+  memset(input->data, 0, size);
+  input->size = size;
+
+  /* Threaded zstd stores the content size in the frame header, as the sender
+   * does for whole files, so the decompressor sees the exact declared size. */
+  Data* compressed = data_compress_codec(input, COMPRESSION_ALGO_ZSTD, 1, 2);
+  EXPECT_NOT_NULL(compressed);
+  /* Premise: the declared size sits between the old 100 MiB cap and the
+   * protocol whole-file bound -- exactly the range that used to be rejected. */
+  unsigned long long declared =
+      ZSTD_getFrameContentSize((uint8_t*)compressed->data + 1, compressed->size - 1);
+  EXPECT_TRUE(declared > (100ULL * 1024 * 1024));
+  EXPECT_TRUE(declared <= MAX_RECEIVE_WHOLE_FILE_SIZE);
+
+  Data* out = data_decompress_limited(compressed, MAX_RECEIVE_WHOLE_FILE_SIZE);
+  EXPECT_NOT_NULL(out);
+  EXPECT_EQ_INT((int)out->size, (int)size);
+  EXPECT_EQ_INT(memcmp(out->data, input->data, size), 0);
+
+  data_destroy(out);
+  data_destroy(compressed);
+  data_destroy(input);
+}
+
+/* A frame declaring an uncompressed size above the hard ceiling is still
+ * rejected before any allocation, even when the caller passes a limit higher
+ * than the protocol bound.  The 13-byte header is a valid zstd frame header with
+ * an 8-byte content size and no blocks; rejection happens at the size check. */
+static void test_data_decompress_limited_rejects_over_ceiling() {
+  const uint64_t declared = MAX_RECEIVE_WHOLE_FILE_SIZE + 1;
+  Data* frame = data_create_empty(1 + 13);
+  EXPECT_NOT_NULL(frame);
+  uint8_t* p = (uint8_t*)frame->data;
+  p[0] = (uint8_t)COMPRESSION_ALGO_ZSTD;
+  p[1] = 0x28; /* zstd magic number, little-endian */
+  p[2] = 0xB5;
+  p[3] = 0x2F;
+  p[4] = 0xFD;
+  p[5] = 0xE0; /* Frame_Header_Descriptor: 8-byte content size, single segment */
+  for (int i = 0; i < 8; i++)
+    p[6 + i] = (uint8_t)((declared >> (8 * i)) & 0xff);
+  frame->size = 1 + 13;
+  /* Guard the premise: zstd reads back exactly the declared over-ceiling size. */
+  EXPECT_EQ_INT((int)ZSTD_getFrameContentSize(p + 1, frame->size - 1), (int)declared);
+
+  EXPECT_NULL(data_decompress_limited(frame, MAX_RECEIVE_WHOLE_FILE_SIZE * 2));
+  EXPECT_NULL(data_decompress_limited(frame, MAX_RECEIVE_WHOLE_FILE_SIZE));
+
+  data_destroy(frame);
+}
+
 typedef struct {
  int id;
  int iterations;
@@ -467,6 +530,8 @@ void test_compression() {
  test_data_compress_decompress_roundtrip();
  test_data_compress_decompress_large();
  test_data_decompress_unknown_size_frame();
+  test_data_decompress_limited_whole_file_ceiling();
+  test_data_decompress_limited_rejects_over_ceiling();
  test_data_decompress_truncated_frame_fails();
  test_skip_compress_suffix_matching();
  test_data_compress_with_threads_roundtrip();
@@ -2533,15 +2533,15 @@ static void test_config_derived_use_metadata() {
  /* Incremental/delta imply metadata unless --no-preserve disabled it. */
  c->use_incremental = true;
  EXPECT_TRUE(config_derived_use_metadata(c));
-  c->metadata_explicitly_disabled = true;
+  c->cli.metadata_explicitly_disabled = true;
  EXPECT_FALSE(config_derived_use_metadata(c));
-  c->metadata_explicitly_disabled = false;
+  c->cli.metadata_explicitly_disabled = false;
  c->use_incremental = false;
  c->use_delta = true;
  EXPECT_TRUE(config_derived_use_metadata(c));
-  c->metadata_explicitly_disabled = true;
+  c->cli.metadata_explicitly_disabled = true;
  EXPECT_FALSE(config_derived_use_metadata(c));
-  c->metadata_explicitly_disabled = false;
+  c->cli.metadata_explicitly_disabled = false;
  c->use_delta = false;

  /* Flags that must NOT imply metadata on their own. */
@@ -2924,7 +2924,7 @@ static void golden_config_populate(Config* c) {
  array_list_add(c->filters, str_dup("- /sub/dir/"));
 }

-/* The pinned golden frame (protocol 2.28.0).  The values below are the only
+/* The pinned golden frame (protocol 2.29.0).  The values below are the only
 * thing that ties the generated table to the historical wire format; update
 * them ONLY with a PROTOCOL_VERSION bump and a documented reason.  The 2.24.0
 * delete-plan wave changed only the version string; 2.25.0 appended the
@@ -2933,10 +2933,13 @@ static void golden_config_populate(Config* c) {
 * appended the receiver-side delete-protection rule block (the STATUS_STATS
 * body also grew, but that is not part of this frame).  Track 5a appends the
 * FastSync-only verify_basis bool to the basis block WITHOUT a version bump
- * (project decision), so the frame grew by one int to 886 bytes.  The
- * byte-exact values are recomputed for the merged layout. */
+ * (project decision), so the frame grew by one int to 886 bytes.  The 2.29.0
+ * symlink-xattr wave changes only the version string: the config-frame layout
+ * is unchanged (use_xattrs already crosses the wire); the STATUS_SYMLINK frame
+ * body grows instead.  The byte-exact values are recomputed for the merged
+ * layout. */
 #define GOLDEN_WIRE_LEN 886
-#define GOLDEN_WIRE_HASH 5809509022716816757ULL
+#define GOLDEN_WIRE_HASH 17827864270611927842ULL

 static unsigned long long fnv1a_64(const unsigned char* buf, size_t len) {
  unsigned long long h = 1469598103934665603ULL;
@@ -3018,7 +3021,7 @@ static unsigned long long capture_wire_hash(const Config* cfg, size_t* out_len)
  return h;
 }

-/* Byte-for-byte wire compatibility guard (protocol 2.28.0).  The expected hash
+/* Byte-for-byte wire compatibility guard (protocol 2.29.0).  The expected hash
 * pins the pre-X-macro byte stream; the refactor MUST NOT change it. */
 static void test_config_wire_golden() {
  if (is_running_under_valgrind())
@@ -3,12 +3,14 @@
 #include "test_utils.h"
 #include "utils.h"
 #include <errno.h>
+#include <fcntl.h>
 #include <glob.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <sys/types.h>
+#include <sys/wait.h>
 #include <unistd.h>

 /* Known-answer vector, independently recomputed with Python
@@ -719,6 +721,238 @@ static void test_credentials_read_secret_file_bad() {
  EXPECT_EQ_INT(credentials_read_secret_file(missing, NULL, NULL, err, sizeof(err)), -1);
 }

+/* A symlink planted at a password-file path is refused (O_NOFOLLOW) instead of
+ * being followed before the owner/mode gate, even when it resolves to a valid
+ * owner-only regular file. */
+static void test_credentials_read_secret_file_symlink_rejected() {
+  char err[512];
+  char* target = make_tmp_file("alice:correct horse battery staple\n");
+  EXPECT_NOT_NULL(target);
+
+  char link[256];
+  snprintf(link, sizeof(link), "/tmp/fs_cred_pwlink_%d_%d", (int)getpid(), g_file_counter++);
+  unlink(link);
+  EXPECT_EQ_INT(symlink(target, link), 0);
+
+  char* user = (char*)1;
+  char* password = (char*)1;
+  EXPECT_EQ_INT(credentials_read_secret_file(link, &user, &password, err, sizeof(err)), -1);
+  EXPECT_NULL(user);
+  EXPECT_NULL(password);
+  EXPECT_TRUE(err[0] != '\0');
+
+  unlink(link); /* remove the symlink itself, not its target */
+  rm_temp(target);
+  free(target);
+}
+
+/* A named FIFO with no writer must not hang in fgets (O_NONBLOCK): the read
+ * fails cleanly with "no user:password line" instead of blocking forever. */
+static void test_credentials_read_secret_file_fifo_no_hang() {
+  char err[512];
+  char fifo[256];
+  snprintf(fifo, sizeof(fifo), "/tmp/fs_cred_pwfifo_%d_%d", (int)getpid(), g_file_counter++);
+  unlink(fifo);
+  EXPECT_EQ_INT(mkfifo(fifo, 0600), 0);
+
+  char* user = (char*)1;
+  char* password = (char*)1;
+  EXPECT_EQ_INT(credentials_read_secret_file(fifo, &user, &password, err, sizeof(err)), -1);
+  EXPECT_NULL(user);
+  EXPECT_NULL(password);
+  EXPECT_TRUE(strstr(err, "no 'user:password'") != NULL || err[0] != '\0');
+
+  unlink(fifo);
+}
+
+/* Write `s` fully to `fd`, retrying EINTR. */
+static void write_all_fd(int fd, const char* s) {
+  size_t total = strlen(s);
+  size_t off = 0;
+  while (off < total) {
+    ssize_t w = write(fd, s + off, total - off);
+    if (w < 0) {
+      if (errno == EINTR)
+        continue;
+      return;
+    }
+    off += (size_t)w;
+  }
+}
+
+/* Deterministically model a slow process substitution (`--password-file
+ * <(sleep N; ...)`): attach a writer to the FIFO (so the reader sees EAGAIN --
+ * the empty/no-writer FIFO instead yields an immediate EOF), have it sleep
+ * `delay_ms`, then write `first` and, after another `delay_ms`, `second` (NULL
+ * for a single write).  Splitting across the delay exercises reassembly of a
+ * line delivered by several write()s.
+ *
+ * The parent keeps a spare read end open for the lifetime of the test so the
+ * writer always has a reader; the caller must close(*hold_out), waitpid() the
+ * returned pid and unlink the FIFO.  Returns the child pid, or -1 on setup
+ * failure. */
+static pid_t fifo_writer_sleep_then_write(const char* fifo, const char* first, unsigned delay_ms,
+                                          const char* second, int* hold_out) {
+  int sync[2];
+  if (pipe(sync) != 0)
+    return -1;
+  pid_t pid = fork();
+  if (pid < 0) {
+    close(sync[0]);
+    close(sync[1]);
+    return -1;
+  }
+  if (pid == 0) {
+    close(sync[0]);
+    int wfd = open(fifo, O_WRONLY | O_CLOEXEC);
+    char ready = wfd >= 0 ? 1 : 0;
+    if (write(sync[1], &ready, 1) != 1)
+      _exit(1);
+    close(sync[1]);
+    if (wfd >= 0) {
+      usleep(delay_ms * 1000);
+      write_all_fd(wfd, first);
+      if (second) {
+        usleep(delay_ms * 1000);
+        write_all_fd(wfd, second);
+      }
+      close(wfd);
+    }
+    _exit(0);
+  }
+  close(sync[1]);
+  int hold = open(fifo, O_RDONLY | O_NONBLOCK | O_CLOEXEC);
+  char ready = 0;
+  ssize_t got = read(sync[0], &ready, 1);
+  close(sync[0]);
+  if (got != 1 || ready != 1) {
+    if (hold >= 0)
+      close(hold);
+    return -1;
+  }
+  *hold_out = hold;
+  return pid;
+}
+
+/* A FIFO writer that produces its data after a short delay must be read
+ * successfully (the regression: O_NONBLOCK made fgets fail with EAGAIN before
+ * the writer ran). */
+static void test_credentials_read_secret_file_fifo_delayed_writer() {
+  char err[512];
+  char fifo[256];
+  snprintf(fifo, sizeof(fifo), "/tmp/fs_cred_pwfifo_slow_%d_%d", (int)getpid(), g_file_counter++);
+  unlink(fifo);
+  EXPECT_EQ_INT(mkfifo(fifo, 0600), 0);
+
+  int hold = -1;
+  pid_t writer =
+      fifo_writer_sleep_then_write(fifo, "alice:correct horse battery staple\n", 250, NULL, &hold);
+  EXPECT_TRUE(writer > 0);
+
+  char* user = NULL;
+  char* password = NULL;
+  EXPECT_EQ_INT(credentials_read_secret_file(fifo, &user, &password, err, sizeof(err)), 0);
+  EXPECT_EQ_STR(user, "alice");
+  EXPECT_EQ_STR(password, "correct horse battery staple");
+  free(user);
+  free(password);
+
+  int status = 0;
+  waitpid(writer, &status, 0);
+  if (hold >= 0)
+    close(hold);
+  unlink(fifo);
+}
+
+/* The same, but the line is written in two chunks separated by the delay: the
+ * reader must reassemble one line rather than parse the first chunk as an
+ * empty-password entry. */
+static void test_credentials_read_secret_file_fifo_split_write() {
+  char err[512];
+  char fifo[256];
+  snprintf(fifo, sizeof(fifo), "/tmp/fs_cred_pwfifo_split_%d_%d", (int)getpid(), g_file_counter++);
+  unlink(fifo);
+  EXPECT_EQ_INT(mkfifo(fifo, 0600), 0);
+
+  int hold = -1;
+  pid_t writer =
+      fifo_writer_sleep_then_write(fifo, "alice:correct horse", 200, " battery staple\n", &hold);
+  EXPECT_TRUE(writer > 0);
+
+  char* user = NULL;
+  char* password = NULL;
+  EXPECT_EQ_INT(credentials_read_secret_file(fifo, &user, &password, err, sizeof(err)), 0);
+  EXPECT_EQ_STR(user, "alice");
+  EXPECT_EQ_STR(password, "correct horse battery staple");
+  free(user);
+  free(password);
+
+  int status = 0;
+  waitpid(writer, &status, 0);
+  if (hold >= 0)
+    close(hold);
+  unlink(fifo);
+}
+
+/* The server-side store loader (--password-file / --early-input) must also
+ * accept a FIFO whose writer appears after a delay. */
+static void test_credentials_store_fifo_delayed_writer() {
+  char err[512];
+  char fifo[256];
+  snprintf(fifo, sizeof(fifo), "/tmp/fs_cred_storefifo_%d_%d", (int)getpid(), g_file_counter++);
+  unlink(fifo);
+  EXPECT_EQ_INT(mkfifo(fifo, 0600), 0);
+
+  int hold = -1;
+  pid_t writer = fifo_writer_sleep_then_write(fifo, KAT_STORE_LINE "\n", 250, NULL, &hold);
+  EXPECT_TRUE(writer > 0);
+
+  CredentialStore* store = credentials_load(fifo, NULL, err, sizeof(err));
+  EXPECT_NOT_NULL(store);
+  EXPECT_EQ_INT(credentials_store_size(store), 1);
+  credentials_free(store);
+
+  int status = 0;
+  waitpid(writer, &status, 0);
+  if (hold >= 0)
+    close(hold);
+  rm_temp(fifo);
+}
+
+/* fd-backed store paths (bash process substitution `<(...)`, i.e. /dev/fd/N and
+ * /proc/self/fd/N) are symlinks, so the ordinary O_NOFOLLOW rule would reject
+ * them with ELOOP.  They name the calling process's own descriptors, so they
+ * are exempt: opening one that points at an owner-only regular file is
+ * accepted, while a symlink at a NORMAL path is still rejected
+ * (test_credentials_read_secret_file_symlink_rejected). */
+static void test_credentials_read_secret_file_fd_backed_accepted() {
+  char err[512];
+  char* path = make_tmp_file("alice:correct horse battery staple\n");
+  EXPECT_NOT_NULL(path);
+
+  int fd = open(path, O_RDONLY | O_CLOEXEC);
+  EXPECT_TRUE(fd >= 0);
+
+  const char* prefixes[] = {"/proc/self/fd/", "/dev/fd/"};
+  for (size_t i = 0; i < sizeof(prefixes) / sizeof(prefixes[0]); i++) {
+    if (i == 1 && access("/dev/fd", F_OK) != 0)
+      continue; /* /dev/fd is not present on every system */
+    char fd_path[64];
+    snprintf(fd_path, sizeof(fd_path), "%s%d", prefixes[i], fd);
+    char* user = (char*)1;
+    char* password = (char*)1;
+    EXPECT_EQ_INT(credentials_read_secret_file(fd_path, &user, &password, err, sizeof(err)), 0);
+    EXPECT_EQ_STR(user, "alice");
+    EXPECT_EQ_STR(password, "correct horse battery staple");
+    free(user);
+    free(password);
+  }
+
+  close(fd);
+  rm_temp(path);
+  free(path);
+}
+
 static void test_credentials_hash_file() {
  char* plaintext = make_tmp_file("# comment\n\n alice :" KAT_PASSWORD "\nbob:bob-s3cret\n");
  EXPECT_NOT_NULL(plaintext);
@@ -1103,6 +1337,12 @@ void test_credentials(void) {
  test_credentials_early_input_merge();
  test_credentials_read_secret_file();
  test_credentials_read_secret_file_bad();
+  test_credentials_read_secret_file_symlink_rejected();
+  test_credentials_read_secret_file_fifo_no_hang();
+  test_credentials_read_secret_file_fifo_delayed_writer();
+  test_credentials_read_secret_file_fifo_split_write();
+  test_credentials_store_fifo_delayed_writer();
+  test_credentials_read_secret_file_fd_backed_accepted();
  test_credentials_hash_file();
  test_credentials_rejects_group_or_other_accessible();
  test_credentials_dummy_key_persisted();
@@ -1,6 +1,7 @@
 #include "test_daemon_conf.h"
 #include "credentials.h"
 #include "daemon_conf.h"
+#include "log.h"
 #include "test_utils.h"
 #include <stdio.h>
 #include <stdlib.h>
@@ -31,6 +32,9 @@ static void test_daemon_conf_create_defaults() {
  EXPECT_EQ_INT(conf->global.port, DAEMON_CONF_DEFAULT_PORT);
  EXPECT_NULL(conf->global.motd_file);
  EXPECT_NULL(conf->global.address);
+  /* rsync modules are read-only unless they opt in, so the default must be
+   * true. */
+  EXPECT_TRUE(conf->global.read_only_default);
  EXPECT_EQ_INT(conf->global.max_connections, DAEMON_CONF_DEFAULT_MAX_CONNECTIONS);
  EXPECT_EQ_INT(conf->global.auth_failure_delay_ms, DAEMON_CONF_DEFAULT_AUTH_FAILURE_DELAY_MS);
  EXPECT_EQ_INT(conf->global.max_connections_per_host,
@@ -626,6 +630,348 @@ static void test_daemon_conf_module_count_capped() {
  EXPECT_TRUE(strstr(err, "too many modules") != NULL);
 }

+/* rsync rsyncd.conf compatibility: the common GLOBAL keys FastSync does not
+ * implement (pid file, log file, use chroot, uid/gid, timeout, ...) are
+ * accepted as documented inert keys, while the keys with a FastSync equivalent
+ * keep working and the compact rsync --dparam spellings (`pidfile`, `logfile`,
+ * `motdfile`) are recognized.  A global `read only` is rsync's module default
+ * and must not be silently dropped. */
+static void test_daemon_conf_rsync_global_keys() {
+  char* path;
+  char err[256];
+  EXPECT_EQ_INT(write_conf("pid file = /run/fastsyncd.pid\n"
+                           "log file = /var/log/fastsyncd.log\n"
+                           "socket options = TCP_NODELAY\n"
+                           "listen backlog = 10\n"
+                           "syslog facility = daemon\n"
+                           "syslog tag = fastsyncd\n"
+                           "use chroot = no\n"
+                           "uid = nobody\n"
+                           "gid = nogroup\n"
+                           "timeout = 600\n"
+                           "max verbosity = 3\n"
+                           "lock file = /var/run/fastsyncd.lock\n"
+                           "transfer logging = yes\n"
+                           "strict modes = yes\n"
+                           "reverse lookup = no\n"
+                           "dont compress = *.gz\n"
+                           "read only = yes\n"
+                           "port = 8734\n"
+                           "address = 127.0.0.1\n"
+                           "pidfile = /run/other.pid\n"
+                           "logfile = /var/log/other.log\n"
+                           "motdfile = /etc/fastsync/motd.alt\n"
+                           "\n"
+                           "[pub]\n"
+                           "path = /srv/pub\n"
+                           "\n"
+                           "[explicit]\n"
+                           "path = /srv/explicit\n"
+                           "read only = no\n",
+                           &path),
+                0);
+  DaemonConf* conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NOT_NULL(conf);
+  /* Mapped globals took effect; the compact aliases too. */
+  EXPECT_EQ_INT(conf->global.port, 8734);
+  EXPECT_EQ_STR(conf->global.address, "127.0.0.1");
+  EXPECT_EQ_STR(conf->global.motd_file, "/etc/fastsync/motd.alt");
+  /* The global `read only = yes` is the default for modules defined after it. */
+  EXPECT_TRUE(conf->global.read_only_default);
+  EXPECT_EQ_INT(conf->module_count, 2);
+  EXPECT_TRUE(conf->modules[0].read_only);
+  /* An explicit per-module value wins over the global default. */
+  EXPECT_FALSE(conf->modules[1].read_only);
+  daemon_conf_free(conf);
+}
+
+/* rsync module keys with no FastSync equivalent load inert; the keys with a
+ * FastSync meaning still map onto their native fields. */
+static void test_daemon_conf_rsync_module_keys() {
+  char* path;
+  char err[256];
+  EXPECT_EQ_INT(write_conf("[data]\n"
+                           "path = /srv/data\n"
+                           "comment = Public data\n"
+                           "use chroot = yes\n"
+                           "uid = nobody\n"
+                           "gid = nogroup\n"
+                           "exclude = *.tmp\n"
+                           "include = keep.tmp\n"
+                           "exclude from = /etc/rsync.exclude\n"
+                           "max verbosity = 2\n"
+                           "lock file = /var/run/rsyncd.lock\n"
+                           "transfer logging = yes\n"
+                           "timeout = 300\n"
+                           "secrets file = /etc/rsyncd.secrets\n"
+                           "auth digest = sha256\n"
+                           "numeric ids = yes\n"
+                           "write only = no\n"
+                           "list = yes\n"
+                           "dont compress = *.gz\n"
+                           "refuse options = delete\n"
+                           "read only = yes\n"
+                           "max connections = 5\n"
+                           "hosts allow = 10.0.0.0/8\n"
+                           "auth users = alice\n",
+                           &path),
+                0);
+  DaemonConf* conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NOT_NULL(conf);
+  EXPECT_EQ_STR(conf->modules[0].path, "/srv/data");
+  EXPECT_TRUE(conf->modules[0].read_only);
+  EXPECT_EQ_INT(conf->modules[0].max_connections, 5);
+  EXPECT_EQ_INT(conf->modules[0].hosts_allow_count, 1);
+  EXPECT_EQ_STR(conf->modules[0].hosts_allow[0], "10.0.0.0/8");
+  EXPECT_EQ_INT(conf->modules[0].auth_user_count, 1);
+  EXPECT_EQ_STR(conf->modules[0].auth_users[0], "alice");
+  daemon_conf_free(conf);
+}
+
+/* A genuinely unknown key is still rejected in both contexts, so accepting the
+ * rsync subset did not turn typos into silent no-ops. */
+static void test_daemon_conf_rsync_unknown_keys_rejected() {
+  char* path;
+  char err[256];
+  EXPECT_EQ_INT(write_conf("bogus rsync key = 1\n", &path), 0);
+  const DaemonConf* conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NULL(conf);
+  EXPECT_TRUE(strstr(err, "unknown global key") != NULL);
+
+  EXPECT_EQ_INT(write_conf("[m]\npath = /x\nnot a real key = 1\n", &path), 0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NULL(conf);
+  EXPECT_TRUE(strstr(err, "unknown key 'not a real key'") != NULL);
+}
+
+/* A recognized rsync key with an invalid value is still a clear parse error. */
+static void test_daemon_conf_rsync_read_only_invalid() {
+  char* path;
+  char err[256];
+  EXPECT_EQ_INT(write_conf("read only = maybe\n[m]\npath = /x\n", &path), 0);
+  const DaemonConf* conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NULL(conf);
+  EXPECT_TRUE(strstr(err, "read only") != NULL);
+
+  EXPECT_EQ_INT(write_conf("[m]\npath = /x\nread only = maybe\n", &path), 0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NULL(conf);
+  EXPECT_TRUE(strstr(err, "read only") != NULL);
+}
+
+/* --dparam reuses the same global dispatch: it accepts the compact rsync
+ * spellings and the inert rsync global keys, and `read only` sets the default
+ * for modules that did not set their own value. */
+static void test_daemon_conf_dparam_rsync_keys() {
+  DaemonConf* conf = daemon_conf_create();
+  EXPECT_NOT_NULL(conf);
+  char err[256];
+
+  EXPECT_EQ_INT(daemon_conf_apply_dparam(conf, "pidfile=/run/x.pid", err, sizeof(err)), 0);
+  EXPECT_EQ_INT(daemon_conf_apply_dparam(conf, "pid file=/run/y.pid", err, sizeof(err)), 0);
+  EXPECT_EQ_INT(daemon_conf_apply_dparam(conf, "logfile=/tmp/x.log", err, sizeof(err)), 0);
+  EXPECT_EQ_INT(daemon_conf_apply_dparam(conf, "log file=/tmp/y.log", err, sizeof(err)), 0);
+  EXPECT_EQ_INT(daemon_conf_apply_dparam(conf, "motdfile=/tmp/alt.motd", err, sizeof(err)), 0);
+  EXPECT_EQ_STR(conf->global.motd_file, "/tmp/alt.motd");
+  EXPECT_EQ_INT(daemon_conf_apply_dparam(conf, "timeout=600", err, sizeof(err)), 0);
+  EXPECT_EQ_INT(daemon_conf_apply_dparam(conf, "use chroot=no", err, sizeof(err)), 0);
+
+  /* A module already parsed without an explicit `read only` takes the
+   * --dparam default; an explicit module value is preserved. */
+  {
+    char* path;
+    EXPECT_EQ_INT(write_conf("[plain]\npath = /p\n[explicit]\npath = /e\nread only = no\n", &path),
+                  0);
+    DaemonConf* loaded = daemon_conf_load(path, err, sizeof(err));
+    free(path);
+    EXPECT_NOT_NULL(loaded);
+    EXPECT_EQ_INT(daemon_conf_apply_dparam(loaded, "read only=yes", err, sizeof(err)), 0);
+    EXPECT_TRUE(loaded->global.read_only_default);
+    EXPECT_TRUE(loaded->modules[0].read_only);
+    EXPECT_FALSE(loaded->modules[1].read_only);
+    daemon_conf_free(loaded);
+  }
+
+  /* Invalid values and genuinely unknown keys are still rejected. */
+  EXPECT_EQ_INT(daemon_conf_apply_dparam(conf, "read only=maybe", err, sizeof(err)), -1);
+  EXPECT_EQ_INT(daemon_conf_apply_dparam(conf, "definitely not rsync=1", err, sizeof(err)), -1);
+  EXPECT_TRUE(strstr(err, "unknown global key") != NULL);
+
+  daemon_conf_free(conf);
+}
+
+/* rsync modules default to READ-ONLY; `read only = no` / `write only = yes`
+ * opt a module into writability, and an explicit module value wins over a
+ * global default. */
+static void test_daemon_conf_read_only_default_and_opt_in() {
+  char* path;
+  char err[256];
+  DaemonConf* conf;
+
+  /* A module that never mentions read only/write only is READ-ONLY, matching
+   * rsync (a migrated rsyncd.conf must not be served writable). */
+  EXPECT_EQ_INT(write_conf("[m]\npath = /x\n", &path), 0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NOT_NULL(conf);
+  EXPECT_TRUE(conf->modules[0].read_only);
+  EXPECT_FALSE(conf->modules[0].read_only_explicit);
+  daemon_conf_free(conf);
+
+  /* `read only = no` opts in to writable. */
+  EXPECT_EQ_INT(write_conf("[m]\npath = /x\nread only = no\n", &path), 0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NOT_NULL(conf);
+  EXPECT_FALSE(conf->modules[0].read_only);
+  EXPECT_TRUE(conf->modules[0].read_only_explicit);
+  daemon_conf_free(conf);
+
+  /* `write only = yes` opts in to writable (FastSync is push-only). */
+  EXPECT_EQ_INT(write_conf("[m]\npath = /x\nwrite only = yes\n", &path), 0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NOT_NULL(conf);
+  EXPECT_FALSE(conf->modules[0].read_only);
+  EXPECT_TRUE(conf->modules[0].read_only_explicit);
+  daemon_conf_free(conf);
+
+  /* `write only = no` is rsync's default and does not undo read-only. */
+  EXPECT_EQ_INT(write_conf("[m]\npath = /x\nwrite only = no\n", &path), 0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NOT_NULL(conf);
+  EXPECT_TRUE(conf->modules[0].read_only);
+  EXPECT_FALSE(conf->modules[0].read_only_explicit);
+  daemon_conf_free(conf);
+
+  /* A global `read only = no` is the default for later modules; an explicit
+   * module `read only`/`write only = yes` still wins. */
+  EXPECT_EQ_INT(write_conf("read only = no\n[a]\npath = /a\n"
+                           "[b]\npath = /b\nread only = yes\n"
+                           "[c]\npath = /c\nwrite only = yes\n",
+                           &path),
+                0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NOT_NULL(conf);
+  EXPECT_FALSE(conf->global.read_only_default);
+  EXPECT_FALSE(conf->modules[0].read_only);
+  EXPECT_TRUE(conf->modules[1].read_only);
+  EXPECT_FALSE(conf->modules[2].read_only);
+  daemon_conf_free(conf);
+
+  /* A global `read only = yes` keeps modules without an explicit value
+   * read-only. */
+  EXPECT_EQ_INT(write_conf("read only = yes\n[a]\npath = /a\n"
+                           "[b]\npath = /b\nread only = no\n"
+                           "[c]\npath = /c\nwrite only = yes\n",
+                           &path),
+                0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NOT_NULL(conf);
+  EXPECT_TRUE(conf->global.read_only_default);
+  EXPECT_TRUE(conf->modules[0].read_only);
+  EXPECT_FALSE(conf->modules[1].read_only);
+  EXPECT_FALSE(conf->modules[2].read_only);
+  daemon_conf_free(conf);
+
+  /* An invalid `write only` value is a clear parse error. */
+  EXPECT_EQ_INT(write_conf("[m]\npath = /x\nwrite only = maybe\n", &path), 0);
+  conf = daemon_conf_load(path, err, sizeof(err));
+  free(path);
+  EXPECT_NULL(conf);
+  EXPECT_TRUE(strstr(err, "write only") != NULL);
+}
+
+/* Security-relevant rsync keys are accepted for migration but have no FastSync
+ * effect, so loading must warn loudly (naming the key and module) rather than
+ * letting an operator believe the restriction is enforced. */
+static void test_daemon_conf_unenforced_security_keys_warned() {
+  char* path;
+  char err[256];
+  EXPECT_EQ_INT(write_conf("use chroot = yes\n"
+                           "uid = nobody\n"
+                           "[m]\n"
+                           "path = /x\n"
+                           "read only = no\n"
+                           "secrets file = /etc/rsyncd.secrets\n"
+                           "refuse options = delete\n"
+                           "exclude = *.tmp\n"
+                           "max size = 1M\n"
+                           "pre-xfer exec = /bin/true\n"
+                           "incoming chmod = F644\n"
+                           "name converter = sh\n",
+                           &path),
+                0);
+
+  set_log_level(LOG_LEVEL_WARNING);
+  FILE* log_capture = tmpfile();
+  EXPECT_NOT_NULL(log_capture);
+  log_set_file(log_capture);
+  DaemonConf* conf = daemon_conf_load(path, err, sizeof(err));
+  fflush(log_capture);
+  rewind(log_capture);
+  log_set_file(NULL);
+  free(path);
+
+  /* Inert security keys must never fail the load. */
+  EXPECT_NOT_NULL(conf);
+  EXPECT_FALSE(conf->modules[0].read_only);
+
+  bool saw_secrets = false;
+  bool saw_refuse = false;
+  bool saw_filter = false;
+  bool saw_size = false;
+  bool saw_hook = false;
+  bool saw_chmod = false;
+  bool saw_converter = false;
+  bool saw_global_chroot = false;
+  bool saw_global_uid = false;
+  char line[512];
+  while (fgets(line, sizeof(line), log_capture) != NULL) {
+    if (strstr(line, "NOT enforced") == NULL)
+      continue;
+    if (strstr(line, "module 'm'") && strstr(line, "secrets file"))
+      saw_secrets = true;
+    if (strstr(line, "module 'm'") && strstr(line, "refuse options"))
+      saw_refuse = true;
+    if (strstr(line, "module 'm'") && strstr(line, "exclude"))
+      saw_filter = true;
+    if (strstr(line, "module 'm'") && strstr(line, "max size"))
+      saw_size = true;
+    if (strstr(line, "module 'm'") && strstr(line, "pre-xfer exec"))
+      saw_hook = true;
+    if (strstr(line, "module 'm'") && strstr(line, "incoming chmod"))
+      saw_chmod = true;
+    if (strstr(line, "module 'm'") && strstr(line, "name converter"))
+      saw_converter = true;
+    if (strstr(line, "global key 'use chroot'"))
+      saw_global_chroot = true;
+    if (strstr(line, "global key 'uid'"))
+      saw_global_uid = true;
+  }
+  fclose(log_capture);
+
+  EXPECT_TRUE(saw_secrets);
+  EXPECT_TRUE(saw_refuse);
+  EXPECT_TRUE(saw_filter);
+  EXPECT_TRUE(saw_size);
+  EXPECT_TRUE(saw_hook);
+  EXPECT_TRUE(saw_chmod);
+  EXPECT_TRUE(saw_converter);
+  EXPECT_TRUE(saw_global_chroot);
+  EXPECT_TRUE(saw_global_uid);
+  daemon_conf_free(conf);
+}
+
 void test_daemon_conf() {
  test_daemon_conf_create_defaults();
  test_daemon_conf_full_parse();
@@ -645,4 +991,11 @@ void test_daemon_conf() {
  test_daemon_conf_module_count_capped();
  test_daemon_hosts_allowed();
  test_daemon_module_name_valid();
+  test_daemon_conf_rsync_global_keys();
+  test_daemon_conf_rsync_module_keys();
+  test_daemon_conf_rsync_unknown_keys_rejected();
+  test_daemon_conf_rsync_read_only_invalid();
+  test_daemon_conf_dparam_rsync_keys();
+  test_daemon_conf_read_only_default_and_opt_in();
+  test_daemon_conf_unenforced_security_keys_warned();
 }
@@ -9,7 +9,9 @@
 #include "charset.h"
 #include "utils.h"
 #include "protocol.h"
+#include "xattr.h"
 #include "test_utils.h"
+#include <errno.h>
 #include <fcntl.h>
 #include <limits.h>
 #include <stdlib.h>
@@ -17,7 +19,11 @@
 #include <sys/stat.h>
 #include <sys/sysmacros.h>
 #include <sys/wait.h>
+#include <sys/xattr.h>
 #include <time.h>
+#ifdef __linux__
+#include <sys/prctl.h>
+#endif
 #include <unistd.h>

 static void test_file_create() {
@@ -339,12 +345,17 @@ static void test_file_save_to_disk_temp_dir_confined() {
  const char* root = "test_temp_confine_tmp";
  const char* dest_file = "test_temp_confine_tmp/file.txt";
  char outside[PATH_MAX];
+  char inside_abs[PATH_MAX];
  snprintf(outside, sizeof(outside), "/tmp/fastsync_temp_outside_%d", (int)getpid());
  unlink(dest_file);
  rmdir("test_temp_confine_tmp/scratch");
+  rmdir("test_temp_confine_tmp/abs_scratch");
  rmdir(root);
  mkdir(root, 0755);
  mkdir("test_temp_confine_tmp/scratch", 0755);
+  mkdir("test_temp_confine_tmp/abs_scratch", 0755);
+  if (!realpath("test_temp_confine_tmp/abs_scratch", inside_abs))
+    EXPECT_FAIL("realpath(abs_scratch) failed; inside_abs would be uninitialized");
  mkdir(outside, 0755);

  File* f = file_create("file.txt");
@@ -364,6 +375,13 @@ static void test_file_save_to_disk_temp_dir_confined() {
  config->temp_dir = str_dup("../escape");
  EXPECT_EQ_INT(file_save_to_disk_full(root, f, config), FILE_SAVE_ERROR);
  EXPECT_EQ_INT(access(dest_file, F_OK), -1);
+  /* An absolute temp dir that canonicalizes INSIDE the receive root is
+     accepted and used (the parity win); destination is still written. */
+  free(config->temp_dir);
+  config->temp_dir = str_dup(inside_abs);
+  EXPECT_EQ_INT(file_save_to_disk_full(root, f, config), FILE_SAVE_WRITTEN);
+  EXPECT_EQ_INT(access(dest_file, F_OK), 0);
+  unlink(dest_file);
  free(config->temp_dir);
  config->temp_dir = str_dup("scratch");
  EXPECT_EQ_INT(file_save_to_disk_full(root, f, config), FILE_SAVE_WRITTEN);
@@ -373,10 +391,103 @@ static void test_file_save_to_disk_temp_dir_confined() {
  config_delete(config);
  unlink(dest_file);
  rmdir("test_temp_confine_tmp/scratch");
+  rmdir("test_temp_confine_tmp/abs_scratch");
  rmdir(root);
  rmdir(outside);
 }

+/* A client-planted symlink under the receive root must never redirect the
+ * --temp-dir scratch directory outside the authorized root: the REAL path of
+ * the opened dir is checked.  An in-root symlink (the EXDEV cross-filesystem
+ * case) must still be accepted. */
+static void test_file_open_temp_dir_symlink_confinement() {
+  const char* root = "test_tempdir_link_root";
+  const char* outside = "test_tempdir_link_outside";
+  char root_abs[PATH_MAX];
+  char outside_abs[PATH_MAX];
+  unlink("test_tempdir_link_root/escape");
+  unlink("test_tempdir_link_root/inside_link");
+  rmdir("test_tempdir_link_root/scratch");
+  rmdir(root);
+  rmdir(outside);
+
+  int mkdir_root_ret = mkdir(root, 0755);
+  int mkdir_outside_ret = mkdir(outside, 0755);
+  bool root_resolved = realpath(root, root_abs) != NULL;
+  bool outside_resolved = realpath(outside, outside_abs) != NULL;
+  int root_fd = root_resolved ? open(root_abs, O_RDONLY | O_DIRECTORY | O_CLOEXEC) : -1;
+
+  bool root_set = false;
+  bool scratch_ok = false;
+  int scratch_fd = -1;
+  bool escape_staged = false;
+  int escape_fd = 0;
+  bool inside_staged = false;
+  int inside_fd = -1;
+  char* scratch = NULL;
+  char* escape = NULL;
+  char* inside_link = NULL;
+
+  /* Only touch the global authorized root and the scratch fixtures once the
+     setup succeeded; the teardown below always runs regardless. */
+  if (root_fd >= 0 && outside_resolved) {
+    root_set = utils_set_authorized_root(root_fd, root_abs);
+
+    /* An existing in-root scratch dir opens normally. */
+    scratch = path_cat(root_abs, "scratch");
+    if (scratch && mkdir(scratch, 0755) == 0) {
+      scratch_ok = true;
+      scratch_fd = file_open_temp_dir(scratch);
+      if (scratch_fd >= 0)
+        close(scratch_fd);
+    }
+
+    /* A symlink whose target is outside the root is refused. */
+    escape = path_cat(root_abs, "escape");
+    if (escape && symlink(outside_abs, escape) == 0) {
+      escape_staged = true;
+      escape_fd = file_open_temp_dir(escape);
+    }
+
+    /* A symlink that stays inside the root is accepted (EXDEV fallback). */
+    inside_link = path_cat(root_abs, "inside_link");
+    if (inside_link && scratch && symlink(scratch, inside_link) == 0) {
+      inside_staged = true;
+      inside_fd = file_open_temp_dir(inside_link);
+      if (inside_fd >= 0)
+        close(inside_fd);
+    }
+  }
+
+  /* Release the global authorized root and all fixtures BEFORE asserting:
+     EXPECT_* returns early on failure, so a failed assertion must not be able
+     to leave the process state poisoned or leak root_fd. */
+  utils_set_authorized_root(-1, NULL);
+  if (root_fd >= 0)
+    close(root_fd);
+  free(inside_link);
+  free(escape);
+  free(scratch);
+  unlink("test_tempdir_link_root/escape");
+  unlink("test_tempdir_link_root/inside_link");
+  rmdir("test_tempdir_link_root/scratch");
+  rmdir(root);
+  rmdir(outside);
+
+  EXPECT_EQ_INT(mkdir_root_ret, 0);
+  EXPECT_EQ_INT(mkdir_outside_ret, 0);
+  EXPECT_TRUE(root_resolved);
+  EXPECT_TRUE(outside_resolved);
+  EXPECT_TRUE(root_fd >= 0);
+  EXPECT_TRUE(root_set);
+  EXPECT_TRUE(scratch_ok);
+  EXPECT_TRUE(scratch_fd >= 0);
+  EXPECT_TRUE(escape_staged);
+  EXPECT_EQ_INT(escape_fd, -1);
+  EXPECT_TRUE(inside_staged);
+  EXPECT_TRUE(inside_fd >= 0);
+}
+
 /* Issue #251: file_save_to_disk_full must distinguish receiver-side skips
   (--existing/--ignore-existing/--update) from real writes so the sender can
   decide whether --remove-source-files may unlink its source. */
@@ -1040,8 +1151,8 @@ static void test_atomic_no_perms_preserves_destination_mode() {

  /* No -p/-E: the pre-existing 0640 survives the atomic overwrite. */
  bool ok = file_to_disk_secure_attrs(path, "data", 4, false, false, false, &m,
-                                      (FileAttrPolicy){false, false, false, false}, false, false,
-                                      false, NULL, false, false, NULL);
+                                      (FileAttrPolicy){false, false, false, false, true}, false,
+                                      false, false, NULL, false, false, NULL);
  EXPECT_TRUE(ok);
  struct stat st;
  EXPECT_EQ_INT(stat(path, &st), 0);
@@ -1049,8 +1160,8 @@ static void test_atomic_no_perms_preserves_destination_mode() {

  /* -p: the source mode wins. */
  ok = file_to_disk_secure_attrs(path, "data2", 5, false, false, false, &m,
-                                 (FileAttrPolicy){true, true, false, false}, false, false, false,
-                                 NULL, false, false, NULL);
+                                 (FileAttrPolicy){true, true, false, false, true}, false, false,
+                                 false, NULL, false, false, NULL);
  EXPECT_TRUE(ok);
  EXPECT_EQ_INT(stat(path, &st), 0);
  EXPECT_EQ_INT((int)(st.st_mode & 0777), 0755);
@@ -1060,8 +1171,8 @@ static void test_atomic_no_perms_preserves_destination_mode() {
     source 0755 gives 0750, not 0751 and not the scratch 0711. */
  EXPECT_EQ_INT(chmod(path, 0640), 0);
  ok = file_to_disk_secure_attrs(path, "data3", 6, false, false, false, &m,
-                                 (FileAttrPolicy){false, false, false, true}, false, false, false,
-                                 NULL, false, false, NULL);
+                                 (FileAttrPolicy){false, false, false, true, true}, false, false,
+                                 false, NULL, false, false, NULL);
  EXPECT_TRUE(ok);
  EXPECT_EQ_INT(stat(path, &st), 0);
  EXPECT_EQ_INT((int)(st.st_mode & 0777), 0750);
@@ -1073,8 +1184,8 @@ static void test_atomic_no_perms_preserves_destination_mode() {
  const char* fresh = "test_attr_split_fresh.txt";
  unlink(fresh);
  ok = file_to_disk_secure_attrs(fresh, "data", 4, false, false, false, &m,
-                                 (FileAttrPolicy){false, false, false, false}, false, false, false,
-                                 NULL, false, false, NULL);
+                                 (FileAttrPolicy){false, false, false, false, true}, false, false,
+                                 false, NULL, false, false, NULL);
  EXPECT_TRUE(ok);
  EXPECT_EQ_INT(stat(fresh, &st), 0);
  EXPECT_EQ_INT((int)(st.st_mode & 0777), (int)(m.mode & 0777 & ~(mode_t)file_process_umask()));
@@ -1083,8 +1194,8 @@ static void test_atomic_no_perms_preserves_destination_mode() {
  /* Without any metadata the historical fixed 0644 default still applies. */
  unlink(fresh);
  ok = file_to_disk_secure_attrs(fresh, "data", 4, false, false, false, NULL,
-                                 (FileAttrPolicy){false, false, false, false}, false, false, false,
-                                 NULL, false, false, NULL);
+                                 (FileAttrPolicy){false, false, false, false, true}, false, false,
+                                 false, NULL, false, false, NULL);
  EXPECT_TRUE(ok);
  EXPECT_EQ_INT(stat(fresh, &st), 0);
  EXPECT_EQ_INT((int)(st.st_mode & 0777), 0644);
@@ -1104,8 +1215,8 @@ static void test_new_file_mode_honors_source_and_umask() {
  m.gid = getegid();

  bool ok = file_to_disk_secure_attrs(path, "x", 1, false, false, false, &m,
-                                      (FileAttrPolicy){false, false, false, false}, false, false,
-                                      false, NULL, false, false, NULL);
+                                      (FileAttrPolicy){false, false, false, false, true}, false,
+                                      false, false, NULL, false, false, NULL);
  EXPECT_TRUE(ok);
  struct stat st;
  EXPECT_EQ_INT(stat(path, &st), 0);
@@ -1223,6 +1334,110 @@ static void test_special_socket_recreated() {
  rmdir(root);
 }

+/* --fake-super device round-trip (rsync parity): a char/block device must be
+ * materialized as a REGULAR empty file whose user.rsync.%stat records the real
+ * rdev -- never as an mknod'ed node -- even on a privileged receiver.  This is
+ * the non-privileged unit counterpart to the setpriv integration test (which
+ * the PR gate excludes). */
+static void test_fake_super_device_writes_regular_file_with_rdev() {
+  const char* root = "test_fake_super_dev_tmp";
+  const char* node = "test_fake_super_dev_tmp/cdev";
+  unlink(node);
+  rmdir(root);
+  EXPECT_EQ_INT(mkdir(root, 0700), 0);
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->fake_super = true;
+  cfg->preserve_devices = true;
+  cfg->preserve_perms = true;
+  cfg->use_metadata = true;
+  cfg->use_xattrs = true;
+
+  FileMetadata meta;
+  memset(&meta, 0, sizeof(meta));
+  meta.mode = S_IFCHR | 0644;
+
+  File* f = file_create("cdev");
+  EXPECT_NOT_NULL(f);
+  f->is_special = true;
+  f->rdev_major = 1;
+  f->rdev_minor = 3;
+  f->metadata = &meta;
+
+  EXPECT_EQ_INT(file_save_to_disk_full(root, f, cfg), FILE_SAVE_WRITTEN);
+
+  struct stat st;
+  EXPECT_EQ_INT(lstat(node, &st), 0);
+  EXPECT_TRUE(S_ISREG(st.st_mode)); /* never a real device node */
+  EXPECT_EQ_INT((int)st.st_size, 0);
+
+  char value[128] = {0};
+  ssize_t got = getxattr(node, FAKESUPER_XATTR, value, sizeof(value) - 1);
+  EXPECT_TRUE(got > 0);
+  EXPECT_EQ_STR(value, "20644 1,3 0:0"); /* the REAL rdev, not 0,0 */
+
+  f->metadata = NULL;
+  file_destroy(f);
+  config_delete(cfg);
+  unlink(node);
+  rmdir(root);
+}
+
+/* A char/block device that mknodat() refuses (EPERM/EACCES on an unprivileged
+ * receiver) must be a PER-ENTRY failure -- FILE_SAVE_FAILED, which the receiver
+ * counts and continues past -- never the fatal FILE_SAVE_ERROR that aborts the
+ * stream.  The unit suite normally runs as root, so drop the effective uid to
+ * make the kernel refusal deterministic. */
+static void test_device_mknod_failure_is_per_entry() {
+  const char* root = "test_device_eperm_tmp";
+  const char* node = "test_device_eperm_tmp/cdev";
+  unlink(node);
+  rmdir(root);
+  EXPECT_EQ_INT(mkdir(root, 0777), 0);
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->preserve_devices = true;
+  cfg->use_metadata = true;
+
+  FileMetadata meta;
+  memset(&meta, 0, sizeof(meta));
+  meta.mode = S_IFCHR | 0644;
+
+  File* f = file_create("cdev");
+  EXPECT_NOT_NULL(f);
+  f->is_special = true;
+  f->rdev_major = 1;
+  f->rdev_minor = 3;
+  f->metadata = &meta;
+
+  uid_t saved = geteuid();
+  bool dropped = false;
+  if (saved == 0 && seteuid(65534) == 0)
+    dropped = true;
+  FileSaveResult result = file_save_to_disk_full(root, f, cfg);
+  if (dropped) {
+    EXPECT_EQ_INT(seteuid(saved), 0);
+#ifdef __linux__
+    /* A setuid transition clears the process dumpable flag, which makes
+     * LeakSanitizer's ptrace-based thread suspension fail at exit.  Restore it
+     * so the ASan/UBSan CI jobs can still run the leak check. */
+    (void)prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
+#endif
+  }
+
+  EXPECT_EQ_INT(result, FILE_SAVE_FAILED);
+  /* Nothing was created: no device node and no regular-file fallback. */
+  struct stat st;
+  EXPECT_EQ_INT(lstat(node, &st), -1);
+
+  f->metadata = NULL;
+  file_destroy(f);
+  config_delete(cfg);
+  rmdir(root);
+}
+
 static void test_inplace_overwrite_truncates_shorter_payload() {
  const char* root = "test_inplace_trunc_tmp";
  const char* path = "test_inplace_trunc_tmp/big.txt";
@@ -1663,8 +1878,8 @@ static void test_file_write_to_disk_partial_retention() {
  m.atime_valid = false;
  m.crtime_valid = false;
  bool ok = file_to_disk_secure_attrs(path, content, strlen(content), false, false, true, &m,
-                                      (FileAttrPolicy){true, true, false, false}, false, false,
-                                      false, NULL, false, true, NULL);
+                                      (FileAttrPolicy){true, true, false, false, true}, false,
+                                      false, false, NULL, false, true, NULL);
  EXPECT_FALSE(ok); /* the write itself succeeded, but metadata restore failed */
  /* Retained: the already-written temp now sits at the destination path. */
  int fd = open(path, O_RDONLY);
@@ -1683,8 +1898,8 @@ static void test_file_write_to_disk_partial_retention() {

  /* Same failure with keep_partial=false: temp is unlinked, nothing retained. */
  ok = file_to_disk_secure_attrs(path, content, strlen(content), false, false, true, &m,
-                                 (FileAttrPolicy){true, true, false, false}, false, false, false,
-                                 NULL, false, false, NULL);
+                                 (FileAttrPolicy){true, true, false, false, true}, false, false,
+                                 false, NULL, false, false, NULL);
  EXPECT_FALSE(ok);
  EXPECT_TRUE(access(path, F_OK) == -1);
 }
@@ -2163,26 +2378,26 @@ static void test_basis_delete_relative_root_slash() {
  EXPECT_NOT_NULL(cfg);
  cfg->receive_root_directory = str_dup("/");

-  char* rel = file_receive_basis_delete_relative(cfg, "/a");
+  char* rel = delete_basis_relative(cfg, "/a");
  EXPECT_NOT_NULL(rel);
  EXPECT_EQ_STR(rel, "a");
  free(rel);
-  rel = file_receive_basis_delete_relative(cfg, "/a/b");
+  rel = delete_basis_relative(cfg, "/a/b");
  EXPECT_NOT_NULL(rel);
  EXPECT_EQ_STR(rel, "a/b");
  free(rel);
  /* The root itself is not a child. */
-  EXPECT_NULL(file_receive_basis_delete_relative(cfg, "/"));
+  EXPECT_NULL(delete_basis_relative(cfg, "/"));
  /* A relative entry is already root-relative. */
-  rel = file_receive_basis_delete_relative(cfg, "x/y");
+  rel = delete_basis_relative(cfg, "x/y");
  EXPECT_NOT_NULL(rel);
  EXPECT_EQ_STR(rel, "x/y");
  free(rel);
  /* An absolute path outside a non-"/" root is unreachable. */
  free(cfg->receive_root_directory);
  cfg->receive_root_directory = str_dup("/root");
-  EXPECT_NULL(file_receive_basis_delete_relative(cfg, "/other/a"));
-  rel = file_receive_basis_delete_relative(cfg, "/root/a");
+  EXPECT_NULL(delete_basis_relative(cfg, "/other/a"));
+  rel = delete_basis_relative(cfg, "/root/a");
  EXPECT_NOT_NULL(rel);
  EXPECT_EQ_STR(rel, "a");
  free(rel);
@@ -2264,6 +2479,7 @@ void test_file() {
  test_file_save_to_disk_ignore_existing_entry_types();
  test_file_save_to_disk_partial_install();
  test_file_save_to_disk_temp_dir_confined();
+  test_file_open_temp_dir_symlink_confinement();
  test_file_save_to_disk_reports_skips();
  test_file_write_to_disk_sparse_preserves_holes();
  test_file_write_to_disk_partial_retention();
@@ -2303,6 +2519,8 @@ void test_file() {
  test_new_file_mode_honors_source_and_umask();
  test_special_fifo_mode_honors_source_and_umask();
  test_special_socket_recreated();
+  test_fake_super_device_writes_regular_file_with_rdev();
+  test_device_mknod_failure_is_per_entry();
  test_inplace_overwrite_truncates_shorter_payload();
  test_inplace_refuses_fifo_destination();
  test_inplace_refuses_device_destination();
@@ -0,0 +1,294 @@
+#include "test_filter.h"
+#include "filter.h"
+#include "test_utils.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+/* Every `-f`/`--filter` rule string is validated through the list parser, so
+ * the list parser must reject the modifiers the standalone parser rejects
+ * rather than silently folding them into a pattern. */
+
+static void test_filter_list_rejects_xattr_modifier() {
+  static const char* const rules[] = {
+      "-x user.foo",             /* short exclude + x */
+      "exclude,x user.foo",      /* long exclude + x */
+      "+x user.foo",             /* include + x */
+      "hide,x *.tmp",            /* hide + x */
+      "dir-merge,x .rules",      /* x must not be dropped on dir-merge */
+      "merge,x /tmp/nonexistent" /* x must not be dropped on merge */
+  };
+  for (size_t i = 0; i < sizeof(rules) / sizeof(rules[0]); i++) {
+    FilterRuleList* list = filter_rule_list_create();
+    EXPECT_NOT_NULL(list);
+    char err[256] = "";
+    bool ok = filter_rule_list_parse_append(list, rules[i], NULL, NULL, err, sizeof(err));
+    EXPECT_FALSE(ok);
+    EXPECT_TRUE(strstr(err, "xattr") != NULL);
+    filter_rule_list_free(list);
+  }
+
+  /* A bare "x" is not a rule at all: rejected as generic bad syntax. */
+  FilterRuleList* list = filter_rule_list_create();
+  EXPECT_NOT_NULL(list);
+  char err[256] = "";
+  EXPECT_FALSE(filter_rule_list_parse_append(list, "x user.foo", NULL, NULL, err, sizeof(err)));
+  EXPECT_TRUE(err[0] != '\0');
+  filter_rule_list_free(list);
+}
+
+static void test_filter_list_rejects_unsupported_modifiers() {
+  /* The merge-file modifiers e/n/w/- are invalid on every non-merge rule; a
+     token made up solely of modifier characters is a modifier run, so it must
+     be rejected rather than folded into the pattern. */
+  static const char* const rules[] = {
+      "-e foo", /* e: merge-only in rsync */
+      "-n foo", /* n: merge-only in rsync */
+      "-w foo", /* w: merge-only in rsync */
+      "-new",   /* pure modifier letters (n/e/w) */
+      "-press", /* pure modifier letters (p/r/e/s) */
+      "exclude,w foo", "exclude,e foo", "exclude,n foo",
+      "hide,w foo",    "protect,n foo", "risk,e foo",
+  };
+  for (size_t i = 0; i < sizeof(rules) / sizeof(rules[0]); i++) {
+    FilterRuleList* list = filter_rule_list_create();
+    EXPECT_NOT_NULL(list);
+    char err[256] = "";
+    bool ok = filter_rule_list_parse_append(list, rules[i], NULL, NULL, err, sizeof(err));
+    EXPECT_FALSE(ok);
+    EXPECT_TRUE(strstr(err, "unsupported filter modifier") != NULL);
+    filter_rule_list_free(list);
+  }
+}
+
+/* rsync accepts the merge-file modifiers e/n/w/- on merge and dir-merge rules.
+ * They must be consumed so they never leak into the merge filename. */
+static void test_filter_list_accepts_merge_modifiers() {
+  char tmpl[] = "/tmp/fastsync_filter_mmod_XXXXXX";
+  EXPECT_TRUE(mkdtemp(tmpl) != NULL);
+  char path[512];
+  snprintf(path, sizeof(path), "%s/rules", tmpl);
+  FILE* fp = fopen(path, "w");
+  EXPECT_NOT_NULL(fp);
+  fputs("- *.tmp\n", fp);
+  fclose(fp);
+
+  /* merge with e/n/w/- consumes the modifiers and reads the right file. */
+  static const char* const fmts[] = {
+      "merge,e %s", "merge,n %s", "merge,w %s", "merge,- %s", ".e %s", ".- %s",
+  };
+  for (size_t i = 0; i < sizeof(fmts) / sizeof(fmts[0]); i++) {
+    FilterRuleList* list = filter_rule_list_create();
+    EXPECT_NOT_NULL(list);
+    char rule[600];
+    char err[256] = "";
+    snprintf(rule, sizeof(rule), fmts[i], path);
+    bool ok = filter_rule_list_parse_append(list, rule, NULL, NULL, err, sizeof(err));
+    if (!ok)
+      printf("    merge rule '%s' errored: %s\n", rule, err);
+    EXPECT_TRUE(ok);
+    EXPECT_EQ_INT(list->count, 1);
+    EXPECT_EQ_STR(list->items[0]->pattern, "*.tmp");
+    filter_rule_list_free(list);
+  }
+
+  /* dir-merge with e/n/w/- registers the basename without the modifiers. */
+  static const struct {
+    const char* rule;
+    const char* want;
+  } drules[] = {
+      {"dir-merge,e .rules", ".rules"}, {"dir-merge,n .rules", ".rules"},
+      {"dir-merge,w .rules", ".rules"}, {"dir-merge,- .rules", ".rules"},
+      {":e .rules", ".rules"},          {":- .rules", ".rules"},
+  };
+  for (size_t i = 0; i < sizeof(drules) / sizeof(drules[0]); i++) {
+    FilterRuleList* list = filter_rule_list_create();
+    EXPECT_NOT_NULL(list);
+    char err[256] = "";
+    bool ok = filter_rule_list_parse_append(list, drules[i].rule, NULL, NULL, err, sizeof(err));
+    if (!ok)
+      printf("    dir-merge rule '%s' errored: %s\n", drules[i].rule, err);
+    EXPECT_TRUE(ok);
+    EXPECT_EQ_INT(list->dir_merge_count, 1);
+    EXPECT_EQ_STR(list->dir_merge_names[0], drules[i].want);
+    filter_rule_list_free(list);
+  }
+
+  unlink(path);
+  rmdir(tmpl);
+}
+
+static void test_filter_list_accepts_supported_rules_and_modifiers() {
+  static const char* const rules[] = {
+      "- *.tmp",  "+ /a.txt",         "-s foo",     "-r foo",     "-p foo",
+      "-! *.o",   "-/ foo",           "hide *.tmp", "show *.txt", "protect *.bak",
+      "risk *.o", "dir-merge .rules", "-C",
+  };
+  for (size_t i = 0; i < sizeof(rules) / sizeof(rules[0]); i++) {
+    FilterRuleList* list = filter_rule_list_create();
+    EXPECT_NOT_NULL(list);
+    char err[256] = "";
+    bool ok = filter_rule_list_parse_append(list, rules[i], NULL, NULL, err, sizeof(err));
+    if (!ok)
+      printf("    rule '%s' errored: %s\n", rules[i], err);
+    EXPECT_TRUE(ok);
+    filter_rule_list_free(list);
+  }
+
+  /* A glued word is a pattern, not a modifier run (no separator). */
+  {
+    FilterRuleList* list = filter_rule_list_create();
+    char err[128] = "";
+    EXPECT_TRUE(filter_rule_list_parse_append(list, "-newfile", NULL, NULL, err, sizeof(err)));
+    EXPECT_EQ_INT(list->count, 1);
+    EXPECT_EQ_STR(list->items[0]->pattern, "newfile");
+    filter_rule_list_free(list);
+
+    list = filter_rule_list_create();
+    EXPECT_TRUE(filter_rule_list_parse_append(list, "-e2e", NULL, NULL, err, sizeof(err)));
+    EXPECT_EQ_INT(list->count, 1);
+    EXPECT_EQ_STR(list->items[0]->pattern, "e2e");
+    filter_rule_list_free(list);
+
+    list = filter_rule_list_create();
+    EXPECT_TRUE(filter_rule_list_parse_append(list, "-*.o", NULL, NULL, err, sizeof(err)));
+    EXPECT_EQ_INT(list->count, 1);
+    EXPECT_EQ_STR(list->items[0]->pattern, "*.o");
+    filter_rule_list_free(list);
+
+    /* A comma with no modifier still treats the rest as the pattern. */
+    list = filter_rule_list_create();
+    EXPECT_TRUE(filter_rule_list_parse_append(list, "exclude,foo", NULL, NULL, err, sizeof(err)));
+    EXPECT_EQ_INT(list->count, 1);
+    EXPECT_EQ_STR(list->items[0]->pattern, "foo");
+    filter_rule_list_free(list);
+  }
+
+  /* `!` clears the list. */
+  {
+    FilterRuleList* list = filter_rule_list_create();
+    char err[128] = "";
+    EXPECT_TRUE(filter_rule_list_parse_append(list, "- *.tmp", NULL, NULL, err, sizeof(err)));
+    EXPECT_EQ_INT(list->count, 1);
+    EXPECT_TRUE(filter_rule_list_parse_append(list, "!", NULL, NULL, err, sizeof(err)));
+    EXPECT_EQ_INT(list->count, 0);
+    filter_rule_list_free(list);
+  }
+
+  /* -C injects the CVS defaults. */
+  {
+    FilterRuleList* list = filter_rule_list_create();
+    char err[128] = "";
+    EXPECT_TRUE(filter_rule_list_parse_append(list, "-C", NULL, NULL, err, sizeof(err)));
+    EXPECT_TRUE(list->count > 0);
+    filter_rule_list_free(list);
+  }
+}
+
+static void test_filter_list_merge_file_still_supported() {
+  char tmpl[] = "/tmp/fastsync_filter_XXXXXX";
+  EXPECT_TRUE(mkdtemp(tmpl) != NULL);
+  char path[512];
+  snprintf(path, sizeof(path), "%s/rules", tmpl);
+  FILE* fp = fopen(path, "w");
+  EXPECT_NOT_NULL(fp);
+  fputs("- *.tmp\n", fp);
+  fclose(fp);
+
+  FilterRuleList* list = filter_rule_list_create();
+  char err[256] = "";
+  char rule[600];
+  snprintf(rule, sizeof(rule), "merge %s", path);
+  EXPECT_TRUE(filter_rule_list_parse_append(list, rule, NULL, NULL, err, sizeof(err)));
+  EXPECT_EQ_INT(list->count, 1);
+  filter_rule_list_free(list);
+
+  /* The same merge with the x modifier is rejected, not silently read. */
+  list = filter_rule_list_create();
+  snprintf(rule, sizeof(rule), "merge,x %s", path);
+  EXPECT_FALSE(filter_rule_list_parse_append(list, rule, NULL, NULL, err, sizeof(err)));
+  EXPECT_TRUE(strstr(err, "xattr") != NULL);
+  filter_rule_list_free(list);
+
+  unlink(path);
+  rmdir(tmpl);
+}
+
+static void test_filter_rule_parse_rejects_unsupported_and_keeps_supported() {
+  char err[256] = "";
+
+  EXPECT_NULL(filter_rule_parse("-x user.foo", NULL, err, sizeof(err)));
+  EXPECT_TRUE(strstr(err, "xattr") != NULL);
+
+  EXPECT_NULL(filter_rule_parse("-e foo", NULL, err, sizeof(err)));
+  EXPECT_TRUE(strstr(err, "unsupported filter modifier") != NULL);
+
+  FilterRule* rule = filter_rule_parse("- *.tmp", NULL, err, sizeof(err));
+  EXPECT_NOT_NULL(rule);
+  EXPECT_EQ_STR(rule->pattern, "*.tmp");
+  filter_rule_free(rule);
+
+  rule = filter_rule_parse("-newfile", NULL, err, sizeof(err));
+  EXPECT_NOT_NULL(rule);
+  EXPECT_EQ_STR(rule->pattern, "newfile");
+  filter_rule_free(rule);
+}
+
+static void test_filter_rules_apply_supported_modifiers() {
+  /* exclude */
+  {
+    const char* texts[] = {"- *.tmp"};
+    FilterRuleList* list = filter_base_build(texts, 1, false, false, NULL, 0);
+    EXPECT_NOT_NULL(list);
+    EXPECT_EQ_INT(filter_rules_apply_side(list, "b.tmp", "b.tmp", false, FILTER_SIDE_SENDER),
+                  FILTER_ACTION_EXCLUDE);
+    EXPECT_EQ_INT(filter_rules_apply_side(list, "a.txt", "a.txt", false, FILTER_SIDE_SENDER),
+                  FILTER_ACTION_NONE);
+    filter_rule_list_free(list);
+  }
+  /* anchored include then exclude-all */
+  {
+    const char* texts[] = {"+ /a.txt", "- *"};
+    FilterRuleList* list = filter_base_build(texts, 2, false, false, NULL, 0);
+    EXPECT_NOT_NULL(list);
+    EXPECT_EQ_INT(filter_rules_apply_side(list, "a.txt", "a.txt", false, FILTER_SIDE_SENDER),
+                  FILTER_ACTION_INCLUDE);
+    EXPECT_EQ_INT(filter_rules_apply_side(list, "b.txt", "b.txt", false, FILTER_SIDE_SENDER),
+                  FILTER_ACTION_EXCLUDE);
+    filter_rule_list_free(list);
+  }
+  /* negate */
+  {
+    const char* texts[] = {"-! *.o"};
+    FilterRuleList* list = filter_base_build(texts, 1, false, false, NULL, 0);
+    EXPECT_NOT_NULL(list);
+    EXPECT_EQ_INT(filter_rules_apply_side(list, "foo.c", "foo.c", false, FILTER_SIDE_SENDER),
+                  FILTER_ACTION_EXCLUDE);
+    EXPECT_EQ_INT(filter_rules_apply_side(list, "foo.o", "foo.o", false, FILTER_SIDE_SENDER),
+                  FILTER_ACTION_NONE);
+    filter_rule_list_free(list);
+  }
+  /* dir-only trailing slash */
+  {
+    const char* texts[] = {"+ dir/", "- *"};
+    FilterRuleList* list = filter_base_build(texts, 2, false, false, NULL, 0);
+    EXPECT_NOT_NULL(list);
+    EXPECT_EQ_INT(filter_rules_apply_side(list, "dir", "dir", true, FILTER_SIDE_SENDER),
+                  FILTER_ACTION_INCLUDE);
+    EXPECT_EQ_INT(filter_rules_apply_side(list, "dir", "dir", false, FILTER_SIDE_SENDER),
+                  FILTER_ACTION_EXCLUDE);
+    filter_rule_list_free(list);
+  }
+}
+
+void test_filter() {
+  test_filter_list_rejects_xattr_modifier();
+  test_filter_list_rejects_unsupported_modifiers();
+  test_filter_list_accepts_merge_modifiers();
+  test_filter_list_accepts_supported_rules_and_modifiers();
+  test_filter_list_merge_file_still_supported();
+  test_filter_rule_parse_rejects_unsupported_and_keeps_supported();
+  test_filter_rules_apply_supported_modifiers();
+}
@@ -0,0 +1,6 @@
+#ifndef TEST_FILTER_H
+#define TEST_FILTER_H
+
+void test_filter(void);
+
+#endif
--- a/Show More
+++ b/Show More