refactor(ecstore): make store-to-disk error narrowing named and fallible (#6626)

refactor(ecstore): make store-to-disk error narrowing a named fallible operation

Backlog#1845 step 4. The blanket impl From<StorageError> for DiskError let ? silently push store-only errors (locks, buckets, quotas) across the disk boundary into DiskError::other, where the rendered message fragments reduce_errs quorum buckets. Same story for the blanket From<StorageError> for rustfs_filemeta::Error and its other() catch-all.

Both impls are replaced by named, fallible methods: StorageError::narrow_to_disk() and StorageError::narrow_to_filemeta(). Variants with an identity on the far side map across unchanged - including the two documented lossy collapses (SlowDown -> TooManyOpenFiles, StorageFull -> DiskFull) that the round-trip tests pin - and everything else returns Err(self) so the call site decides what crossing the boundary means. Removing the impls let the compiler enumerate every conversion site; the census that scoped this issue had found 5, the compiler found 33.

Call sites keep their existing behavior: the io identity bridge and the generic sites fold Err into the io-backed other() exactly as the old catch-all did (identity still recoverable by downcast), listing paths use one shared to_filemeta_err helper, and the two sites that relied on the SlowDown collapse now construct DiskError::TooManyOpenFiles directly so the loss is visible where it happens. No behavior change intended anywhere; the io::Error bridge itself is untouched by design.

Ref rustfs/backlog#1845

crates/ecstore/src/error/mod.rs

@@ -327,9 +327,20 @@ impl From<DiskError> for StorageError {
     }
 }
 
-impl From<StorageError> for DiskError {
-    fn from(val: StorageError) -> Self {
-        match val {
+impl StorageError {
+    /// Narrow a store-layer error to the disk-layer vocabulary.
+    ///
+    /// This used to be a blanket `impl From<StorageError> for DiskError`, which
+    /// let `?` silently push store-only errors across the disk boundary into
+    /// `DiskError::other`, fragmenting `reduce_errs` quorum buckets
+    /// (backlog#1845). Narrowing is now a named, fallible operation: variants
+    /// with a disk-layer identity map across (including two documented lossy
+    /// collapses kept for compatibility — `SlowDown` → `TooManyOpenFiles` and
+    /// `StorageFull` → `DiskFull`, pinned by conversion_roundtrip_tests), and
+    /// everything else comes back as `Err(self)` so the caller decides what
+    /// crossing the boundary means for it.
+    pub fn narrow_to_disk(self) -> core::result::Result<DiskError, StorageError> {
+        Ok(match self {
             StorageError::Io(io_error) => io_error.into(),
             StorageError::Unexpected => DiskError::Unexpected,
             StorageError::FileNotFound => DiskError::FileNotFound,
@@ -375,8 +386,26 @@ impl From<StorageError> for DiskError {
             StorageError::VolumeAccessDenied => DiskError::VolumeAccessDenied,
             StorageError::FileAccessDenied => DiskError::FileAccessDenied,
             StorageError::RemoteClientUnavailable(detail) => DiskError::RemoteClientUnavailable(detail),
-            _ => DiskError::other(val),
-        }
+            val => return Err(val),
+        })
+    }
+
+    /// Same contract as [`StorageError::narrow_to_disk`], for the
+    /// `rustfs_filemeta::Error` vocabulary (formerly a blanket `From` impl
+    /// with an `other()` catch-all). No production path currently narrows in
+    /// this direction; the named form keeps future callers deliberate.
+    pub fn narrow_to_filemeta(self) -> core::result::Result<rustfs_filemeta::Error, StorageError> {
+        Ok(match self {
+            StorageError::Unexpected => rustfs_filemeta::Error::Unexpected,
+            StorageError::FileNotFound => rustfs_filemeta::Error::FileNotFound,
+            StorageError::FileVersionNotFound => rustfs_filemeta::Error::FileVersionNotFound,
+            StorageError::FileCorrupt => rustfs_filemeta::Error::FileCorrupt,
+            StorageError::DoneForNow => rustfs_filemeta::Error::DoneForNow,
+            StorageError::MethodNotAllowed => rustfs_filemeta::Error::MethodNotAllowed,
+            StorageError::VolumeNotFound => rustfs_filemeta::Error::VolumeNotFound,
+            StorageError::Io(io_error) => io_error.into(),
+            val => return Err(val),
+        })
     }
 }
 
@@ -433,22 +462,6 @@ impl From<rustfs_filemeta::Error> for StorageError {
     }
 }
 
-impl From<StorageError> for rustfs_filemeta::Error {
-    fn from(val: StorageError) -> Self {
-        match val {
-            StorageError::Unexpected => rustfs_filemeta::Error::Unexpected,
-            StorageError::FileNotFound => rustfs_filemeta::Error::FileNotFound,
-            StorageError::FileVersionNotFound => rustfs_filemeta::Error::FileVersionNotFound,
-            StorageError::FileCorrupt => rustfs_filemeta::Error::FileCorrupt,
-            StorageError::DoneForNow => rustfs_filemeta::Error::DoneForNow,
-            StorageError::MethodNotAllowed => rustfs_filemeta::Error::MethodNotAllowed,
-            StorageError::VolumeNotFound => rustfs_filemeta::Error::VolumeNotFound,
-            StorageError::Io(io_error) => io_error.into(),
-            _ => rustfs_filemeta::Error::other(val),
-        }
-    }
-}
-
 impl PartialEq for StorageError {
     fn eq(&self, other: &Self) -> bool {
         match (self, other) {
@@ -1438,7 +1451,9 @@ mod tests {
 
         for original in all_variants {
             let storage_error: StorageError = original.clone().into();
-            let round_tripped: DiskError = storage_error.into();
+            let round_tripped: DiskError = storage_error
+                .narrow_to_disk()
+                .expect("every disk-representable StorageError must narrow back");
 
             assert_eq!(
                 std::mem::discriminant(&original),
@@ -1452,7 +1467,7 @@ mod tests {
         // message must both survive the round trip.
         let io_original = DiskError::Io(IoError::new(ErrorKind::PermissionDenied, "denied"));
         let storage_error: StorageError = io_original.clone().into();
-        let io_round_tripped: DiskError = storage_error.into();
+        let io_round_tripped: DiskError = storage_error.narrow_to_disk().expect("Io narrows through the bridge");
         assert_eq!(io_original, io_round_tripped);
         match io_round_tripped {
             DiskError::Io(inner) => {
@@ -1700,8 +1715,13 @@ mod tests {
             assert_eq!(converted_storage_error, expected_storage_error);
 
             // Test reverse conversion
-            let converted_back: rustfs_filemeta::Error = converted_storage_error.into();
-            assert_eq!(converted_back, expected_storage_error.into());
+            let converted_back: rustfs_filemeta::Error = converted_storage_error
+                .narrow_to_filemeta()
+                .expect("matched variants must narrow to filemeta");
+            let expected_back: rustfs_filemeta::Error = expected_storage_error
+                .narrow_to_filemeta()
+                .expect("matched variants must narrow to filemeta");
+            assert_eq!(converted_back, expected_back);
         }
     }