fix(odm): preserve source regressions after service relocation

Port the reviewed framing, native listing validation, and old-reader
serialization fixes from 4d72989068f845f2a046a91b1afd537dcd1bfeda to the
application-owned service without restoring the removed ECStore module.

Preserve the current GCS HEAD/GET bucket proof, optional GCS feature,
ListObjects v1 local pagination, and stored-config publication behavior.
Validate Azure object absence at its operation boundary and ignore
nonexistent provider error headers for GCS. Keep frozen compatibility
fixtures within each owning crate.

Related: rustfs/backlog#2303, rustfs/backlog#2306,
rustfs/backlog#2307, rustfs/backlog#2308.
This commit is contained in:
overtrue
2026-09-06 01:50:04 +08:00
parent 8fc1c9281e
commit 53887a69f6
18 changed files with 1544 additions and 125 deletions
@@ -11,6 +11,7 @@
## Open Items
- `odm-list-bare-envelope` historical ODM continuation tokens: preserve complete bare v1/v2 envelopes and default bare issuance while framed readers deploy. Remove the legacy classifier and default-off framing issuance gate only after every supported reader accepts framing and outstanding bare listings have drained or clients explicitly restarted them; tokens have no automatic expiry. Exact full-envelope object keys remain intrinsically ambiguous during this compatibility period.
- `backlog-2263` legacy heal MRF inspection: retained per-record journals remain readable while committed-snapshot ownership and writer activation are staged. Remove legacy import only after all supported direct-upgrade and rollback readers understand committed snapshots and migration tooling confirms that no retained or restorable legacy journal requires it. This does not enable a new writer or change the automatic legacy consumer.
- `backlog-1337` legacy restore orphan recovery: releases that predate the restore worker-lock marker can leave a valid operation-id and `ongoing-request="true"` after cancellation or process failure, with no durable liveness proof. New servers allow an exact, non-nil legacy generation to be superseded only when its consistently parsed request date is at least 24 hours old. Remove the clock-based legacy fallback after the minimum supported direct-upgrade release writes the v1 worker-lock marker on every restore and operators have resolved every retained pre-v1 ongoing generation.
- `backlog-2133-tier-delete-chunk-parent` bounded tier-delete dispatch compatibility: prefixes at or below the legacy manifest limit keep the byte-compatible v1 single-manifest protocol, while larger prefixes place a chunk-parent sentinel at the original deterministic root path and use operation-scoped child manifests. Older binaries reject the sentinel and child paths, preserving the v6 sole-owner downgrade fence instead of starting a competing local delete. Remove the v1 reader and fail-closed mixed-version sentinel only after every supported rollback release validates the parent/child protocol and migration tooling confirms that no retained v1 dispatch manifest remains.