@@ -57,6 +57,10 @@ jobs:
           npm run typecheck
           npm test
 
+      - name: box-identity tests
+        working-directory: static/box-identity
+        run: python -m unittest -v test_k2go_box_identity
+
       # Fetch the real upstream maps role (the artifact the bake uses) and apply our in-flight
       # patches, so the contract test checks what will actually be baked, not a frozen fixture.
       # A patch that no longer applies (context drift) fails here, which is itself a useful signal.
 
@@ -0,0 +1,117 @@
+# Records that a box copy (Clone, Backup) does not carry (K2GO-549). One list for both.
+# Each line is a path or glob relative to the box root (installed-rootfs/iiab).
+# CopyExcludes anchors each line at the box root for rsync and for GNU tar.
+# Rules: "*" does not match "/". Never "**". Keep a dir that a service needs at start:
+# exclude its contents with "dir/*".
+# Database rows (sessions, peers, sync state) are removed on the receiver by k2go-box-identity.
+
+# Kolibri. Logs hold the superuser password, client IPs and User-Agents.
+library/kolibri/logs/*.txt
+library/kolibri/logs/archive/*
+library/kolibri/process_cache/*/cache.db*
+library/kolibri/server.pid
+library/kolibri/process_control.flag
+library/kolibri/*.sqlite3-shm
+
+# Calibre-Web
+var/log/calibre-web.log*
+usr/local/calibre-web-py3/access.log*
+usr/local/calibre-web-py3/calibre-web.log*
+library/calibre-web/xklb-metadata.db*
+var/log/xklb.log*
+library/downloads/calibre-web/*
+
+# Forgejo. Keep library/forgejo/log: pdsm appends to it.
+library/forgejo/log/*.log*
+library/forgejo/data/repositories/*/*.git/logs
+library/forgejo/backups/*.zip
+library/forgejo/data/actions_log/*
+library/forgejo/data/forgejo.db-shm
+
+# dash-node and maps. A copied job would restart the download of the other phone.
+library/dashboard/jobs.db
+library/dashboard/jobs.db-wal
+library/dashboard/jobs.db-shm
+library/dashboard/credentials.json.tmp-*
+var/log/dash-node.log*
+var/log/dash-rebuild.log*
+var/log/forgejo-seed.log*
+var/log/forgejo-refresh.log*
+var/log/code-addons-refresh.log*
+var/log/code-assets-refresh.log*
+library/downloads/maps/*
+library/www/maps/*.aria2
+library/www/maps/*.meta4
+
+# conex-core
+var/log/conex-core.log*
+library/.conex-staging/*
+
+# Web tier. Keep var/log/nginx: nginx does not start without it.
+var/log/nginx/*.log*
+var/log/php*-fpm.log*
+var/lib/php/sessions/sess_*
+var/log/uwsgi/app/*.log*
+var/lib/nginx/*/*
+library/working/*/*
+
+# System logs and mail
+var/log/apt/*
+var/log/dpkg.log*
+var/log/alternatives.log*
+var/log/fontconfig.log*
+var/log/exim4/*
+var/log/wtmp.*
+var/log/btmp.*
+var/log/journal/*
+var/log/runit/*/*
+var/mail/*
+var/spool/exim4/input/*
+var/spool/exim4/msglog/*
+var/spool/exim4/db/*
+opt/iiab/iiab/iiab-install.log
+opt/iiab/iiab/iiab-debug.log
+root/.local/state/pipx/log/*
+
+# Shell and tool history
+root/.bash_history
+root/.*_history
+root/.lesshst
+root/.viminfo
+root/.wget-hsts
+root/.local/share/nano/*
+root/.ssh/known_hosts*
+home/*/.bash_history
+home/*/.*_history
+home/*/.lesshst
+home/*/.viminfo
+home/*/.wget-hsts
+home/*/.local/share/nano/*
+home/*/.ssh/known_hosts*
+
+# Per-box state that the box makes again
+root/.cache/aria2/dht.dat
+root/.cache/aria2/dht6.dat
+var/lib/libuuid/clock.txt
+
+# Git reflogs. The clones stay.
+opt/*/.git/logs
+opt/*/.git/FETCH_HEAD
+opt/*/.git/ORIG_HEAD
+opt/iiab/*/.git/logs
+opt/iiab/*/.git/FETCH_HEAD
+opt/iiab/*/.git/ORIG_HEAD
+
+# Runtime state. A stale pid makes a service stop the wrong process or skip its start.
+run/*.pid
+run/*/*.pid
+run/k2go/*
+var/lib/sudo/lectured/*
+tmp/*
+var/tmp/*
+# Core dumps. Not a bare "core": that matches the Kolibri core package.
+core.[0-9]*
+hs_err_pid*.log
+var/lib/systemd/coredump/*
+var/lib/systemd/pstore/*
+# Mount points (sdcard) are in CopyExcludes.MOUNT_POINTS, not here.
@@ -22,6 +22,7 @@
 import java.util.ArrayList;
 import java.util.List;
 
+import org.appdevforall.k2go.boxidentity.data.DeviceIdStore;
 import org.appdevforall.k2go.network.data.FileResolvConfWriter;
 import org.appdevforall.k2go.network.data.PrefsDnsConfigRepository;
 import org.appdevforall.k2go.network.domain.ApplyDnsUseCase;
@@ -174,6 +175,15 @@ public void executeInContainer(Context context, String rootfsDir, String command
                 args.add("-b");
                 args.add(prootTmpPath + ":/tmp");
 
+                // K2GO-549: the box step k2go-box-identity reads it. Without it, the box keeps its values.
+                try {
+                    File deviceId = DeviceIdStore.ensure(context.getNoBackupFilesDir());
+                    args.add("-b");
+                    args.add(deviceId.getCanonicalPath() + ":" + DeviceIdStore.GUEST_PATH);
+                } catch (Exception idEx) {
+                    Log.w(TAG, "Device ID bind skipped: " + idEx.getMessage());
+                }
+
                 // 4. Set Working Directory
                 args.add("-w");
                 args.add("/root");
 
@@ -14,6 +14,8 @@
 import android.os.Looper;
 import android.util.Log;
 
+import org.appdevforall.k2go.boxidentity.data.CopyExcludeFiles;
+import org.appdevforall.k2go.boxidentity.domain.CopyExcludes;
 import org.appdevforall.k2go.sync.domain.RsyncConfig;
 import org.appdevforall.k2go.sync.domain.RsyncOutcome;
 import org.appdevforall.k2go.sync.domain.RsyncProgress;
@@ -77,11 +79,16 @@ public boolean startServer(Context context, ShareConfig config, String pass, Str
             secretStore = new SecretStore(cacheDir);
             File secretsFile = secretStore.writeServerSecrets(config.user, pass);
 
+            // K2GO-549: the share is the box root. A copy never carries its records. An exception
+            // here fails the start: no share without the list.
+            File excludes = CopyExcludeFiles.rsync(context);
+
             // PHASE 1 FIX: 'max connections = 3' protects the I/O bottleneck.
             // Config/argv assembly lives in the pure RsyncConfig domain (S14 step 1).
             String configContent = RsyncConfig.buildDaemonConf(
                     pidFile.getAbsolutePath(), lockFile.getAbsolutePath(), config.rsyncPort,
-                    config.moduleName, dirToShare, config.user, secretsFile.getAbsolutePath());
+                    config.moduleName, dirToShare, config.user, secretsFile.getAbsolutePath(),
+                    excludes.getAbsolutePath());
 
             writeTextToFile(configFile, configContent);
 
@@ -128,8 +135,10 @@ public void startClient(Context context, ShareConfig config, String hostIp, int
 
                 String remoteUrl = RsyncConfig.buildRemoteUrl(user, hostIp, port, config.moduleName);
 
-                ProcessBuilder pb = new ProcessBuilder(RsyncConfig.clientArgs(
-                        rsyncBin.getAbsolutePath(), passFile.getAbsolutePath(), remoteUrl, destinationDir));
+                // K2GO-549: also filter here, for a sender whose APK has no exclude list.
+                ProcessBuilder pb = new ProcessBuilder(RsyncConfig.withExcludes(RsyncConfig.clientArgs(
+                        rsyncBin.getAbsolutePath(), passFile.getAbsolutePath(), remoteUrl, destinationDir),
+                        CopyExcludeFiles.rsync(context).getAbsolutePath(), CopyExcludes.rsyncProtectRules()));
 
                 pb.redirectErrorStream(true);
                 rsyncProcess = pb.start();
@@ -232,7 +241,8 @@ else if (line.contains("@ERROR:") || line.startsWith("rsync:")
                         + (RsyncOutcome.isSuccess(exitCode) && exitCode != 0
                             ? " (non-zero treated as complete — see any [Rsync Output Error] lines above)" : ""));
                 if (isCancelled) {
-                    mainHandler.post(() -> listener.onError(context.getString(R.string.rsync_error_cancelled)));
+                    // The cancel path already reset the screen (CloneFragment.onReceiveCancel).
+                    Log.i(TAG, "Rsync client stopped by the user");
                 } else {
                     switch (RsyncOutcome.classifyTransfer(exitCode)) {
                         case COMPLETE:
@@ -251,6 +261,12 @@ else if (line.contains("@ERROR:") || line.startsWith("rsync:")
                 }
 
             } catch (Exception e) {
+                // A user Cancel closes the stream under the reader. The cancel path already reset
+                // the screen (CloneFragment.onReceiveCancel), so it is not an error.
+                if (isCancelled) {
+                    Log.i(TAG, "Rsync client stopped by the user");
+                    return;
+                }
                 Log.e(TAG, "Rsync Client Exception", e);
                 mainHandler.post(() -> listener.onError(context.getString(R.string.rsync_error_fatal, e.getMessage())));
             }
@@ -284,8 +300,9 @@ public void calculateTransferPlan(Context context, ShareConfig config, String ho
 
                 String remoteUrl = RsyncConfig.buildRemoteUrl(user, hostIp, port, config.moduleName);
 
-                ProcessBuilder pb = new ProcessBuilder(RsyncConfig.dryRunArgs(
-                        rsyncBin.getAbsolutePath(), passFile.getAbsolutePath(), remoteUrl, destinationDir));
+                ProcessBuilder pb = new ProcessBuilder(RsyncConfig.withExcludes(RsyncConfig.dryRunArgs(
+                        rsyncBin.getAbsolutePath(), passFile.getAbsolutePath(), remoteUrl, destinationDir),
+                        CopyExcludeFiles.rsync(context).getAbsolutePath(), CopyExcludes.rsyncProtectRules()));
 
                 pb.redirectErrorStream(true);
                 rsyncProcess = pb.start();
 
@@ -17,12 +17,14 @@
 import android.content.Context;
 import android.util.Log;
 
+import org.appdevforall.k2go.boxidentity.data.CopyExcludeFiles;
 import org.appdevforall.k2go.deploy.domain.ExtractProgress;
 import org.appdevforall.k2go.system.domain.TransferRate;
 import org.appdevforall.k2go.util.ProcessRunner;
 
 import java.io.BufferedReader;
 import java.io.File;
+import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.OutputStream;
@@ -87,7 +89,17 @@ public static boolean streamBackup(Context ctx, OutputStream dest, ProgressListe
         // rootfs content, and are unreadable with the box stopped ("Cannot open: Permission denied"). Skipping
         // them keeps tar's exit honest (0) instead of failing the whole backup on a file that must not be in
         // it. The old "tar | gzip" pipe hit the same read error but gzip's exit=0 silently masked tar's exit=2.
+        // K2GO-549: a backup never carries the box records. GNU tar applies --anchored and
+        // --no-wildcards-match-slash only to the --exclude-from that follows them.
+        File excludes;
+        try {
+            excludes = CopyExcludeFiles.tar(ctx, "installed-rootfs/iiab/");
+        } catch (IOException e) {
+            Log.e(TAG, "backup: exclude list not written", e);
+            return false;
+        }
         String cmd = "'" + tarBin + "' -cf - --ignore-failed-read "
+                + "--anchored --no-wildcards-match-slash --exclude-from='" + excludes.getAbsolutePath() + "' "
                 + (manifestArg != null ? manifestArg : "")
                 + "-C '" + iiabRootDir.getAbsolutePath() + "' installed-rootfs";
 
 
@@ -0,0 +1,65 @@
+/*
+ * ============================================================================
+ * Name        : CopyExcludeFiles.java
+ * Author      : AppDevForAll
+ * Copyright   : Copyright (c) 2026 AppDevForAll
+ * Description : K2GO-560. Writes the box copy exclude list for rsync and tar.
+ * ============================================================================
+ */
+package org.appdevforall.k2go.boxidentity.data;
+
+import android.content.Context;
+
+import org.appdevforall.k2go.boxidentity.domain.CopyExcludes;
+
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+
+/** Writes the {@link CopyExcludes} list to a file, in the form each copy tool reads. */
+public final class CopyExcludeFiles {
+
+    private CopyExcludeFiles() {
+    }
+
+    /** For the rsync daemon that serves the box root (Clone send). */
+    public static File rsync(Context ctx) throws IOException {
+        return write(ctx, "box-copy-exclude.rsync", CopyExcludes.forRsync(asset(ctx)));
+    }
+
+    /** For tar, where {@code memberPrefix} is the archive name of the box root (Backup). */
+    public static File tar(Context ctx, String memberPrefix) throws IOException {
+        return write(ctx, "box-copy-exclude.tar", CopyExcludes.forTar(asset(ctx), memberPrefix));
+    }
+
+    private static String asset(Context ctx) throws IOException {
+        try (InputStream in = ctx.getAssets().open(CopyExcludes.ASSET)) {
+            ByteArrayOutputStream out = new ByteArrayOutputStream();
+            byte[] buf = new byte[4096];
+            int n;
+            while ((n = in.read(buf)) > 0) out.write(buf, 0, n);
+            return new String(out.toByteArray(), StandardCharsets.UTF_8);
+        }
+    }
+
+    private static File write(Context ctx, String name, String content) throws IOException {
+        // Not the cache dir: Android can clear it while the Clone daemon still reads the file.
+        File dir = ctx.getNoBackupFilesDir();
+        File f = new File(dir, name);
+        File tmp = new File(dir, name + ".tmp");
+        try (FileOutputStream out = new FileOutputStream(tmp)) {
+            out.write(content.getBytes(StandardCharsets.UTF_8));
+            out.getFD().sync();
+        }
+        // The rsync daemon reads the file at each connection: replace it whole, never truncate it.
+        // renameTo replaces an existing file on Android (POSIX rename).
+        if (!tmp.renameTo(f)) {
+            tmp.delete();
+            throw new IOException("cannot write " + f);
+        }
+        return f;
+    }
+}