Double check that file list diffing properly handles protected content. It should remove any protected ("-" or "*") content if the mirror isn't pulling pre-bitflip content. Easiest way would be to do that as part ofawk_extract_paths_from_file_list; split the function into restricted and unrestricted content as is done elsewhere.

Of course this needs a test as well.