You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
Directory SyncArea: what it touches
New FeaturesKind: in v2.1.242,
New FeaturesSection of the release
What
Before taking a snapshot, sync scans the commits the cloud session has not seen yet. If any of them contain files whose names look like credentials, or that your Read permission rules deny, sync refuses to carry those commits and tells you that deleting the file in a later commit does not fix it.
Details
Staged files matching the same rules also stop the snapshot, with advice to unstage rather than commit.
The remedy given is to amend or reset the offending commits.
Paths held back are listed back to you as "Left on this machine, not synced".
Evidence
amend or reset the commits (deleting the file in a later commit is not enough)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.