refactor(runtime): hide local disk map global (#4046)

crates/ecstore/src/api/mod.rs

@@ -112,11 +112,10 @@ pub mod event {
 
 pub mod global {
     pub use crate::runtime::global::{
-        GLOBAL_LOCAL_DISK_MAP, get_global_bucket_monitor, get_global_deployment_id, get_global_endpoints_opt,
+        get_global_bucket_monitor, get_global_deployment_id, get_global_endpoints_opt, get_global_lock_client,
-        get_global_lock_client, get_global_lock_clients, get_global_region, get_global_tier_config_mgr, global_rustfs_port,
+        get_global_lock_clients, get_global_region, get_global_tier_config_mgr, global_rustfs_port, is_dist_erasure, is_erasure,
-        is_dist_erasure, is_erasure, is_erasure_sd, is_first_cluster_node_local, new_object_layer_fn,
+        is_erasure_sd, is_first_cluster_node_local, new_object_layer_fn, resolve_object_store_handle, set_global_endpoints,
-        resolve_object_store_handle, set_global_endpoints, set_global_region, set_global_rustfs_port, set_object_store_resolver,
+        set_global_region, set_global_rustfs_port, set_object_store_resolver, shutdown_background_services, update_erasure_type,
-        shutdown_background_services, update_erasure_type,
     };
 }
 

crates/heal/src/heal/manager.rs

@@ -34,7 +34,7 @@ use tokio::{
 use tokio_util::sync::CancellationToken;
 use tracing::{debug, error, info, warn};
 
-use super::{DiskError, EcstoreError, GLOBAL_LOCAL_DISK_MAP, HealDiskExt as _};
+use super::{DiskError, EcstoreError, HealDiskExt as _, local_disk_map_read};
 
 const KEEP_HEAL_TASK_STATUS_DURATION: Duration = Duration::from_secs(10 * 60);
 const LOG_COMPONENT_HEAL: &str = "heal";
@@ -2101,7 +2101,8 @@ impl HealManager {
                         // Build list of endpoints that need healing
                         let mut endpoints = Vec::new();
                         let mut seen_returning_sets = HashSet::new();
-                        for (_, disk_opt) in GLOBAL_LOCAL_DISK_MAP.read().await.iter() {
+                        let local_disk_map = local_disk_map_read().await;
+                        for (_, disk_opt) in local_disk_map.iter() {
                             if let Some(disk) = disk_opt {
                                 let endpoint = disk.endpoint();
                                 let runtime_state = disk.runtime_state();

crates/heal/src/heal/mod.rs

@@ -49,14 +49,8 @@ pub(crate) type Endpoint = EcstoreEndpoint;
 pub(crate) type StorageError = EcstoreStorageError;
 pub(crate) type LocalDiskMap = std::collections::HashMap<String, Option<DiskStore>>;
 
-pub(crate) struct GlobalLocalDiskMap;
+pub(crate) async fn local_disk_map_read() -> tokio::sync::RwLockReadGuard<'static, LocalDiskMap> {
-
+    ecstore_local_disk_map_read().await
-pub(crate) static GLOBAL_LOCAL_DISK_MAP: GlobalLocalDiskMap = GlobalLocalDiskMap;
-
-impl GlobalLocalDiskMap {
-    pub(crate) async fn read(&self) -> tokio::sync::RwLockReadGuard<'static, LocalDiskMap> {
-        ecstore_local_disk_map_read().await
-    }
 }
 
 #[cfg(test)]

docs/architecture/global-state-inventory.md

@@ -41,7 +41,7 @@ migration PR removes or replaces each item.
 | `APP_CONTEXT_SINGLETON` | `rustfs/src/app/context/global.rs` | Owner-local compatibility | Keep as the context-first facade while no-context startup and embedded callers still exist. |
 | `GLOBAL_OBJECT_API`, `GLOBAL_OBJECT_STORE_RESOLVER` | `crates/ecstore/src/runtime/global.rs` | Runtime migration target | Do not migrate first; it is tied to storage startup, IAM-after-storage AppContext publication, and data-plane resolver compatibility. |
 | `GLOBAL_Endpoints`, `GLOBAL_IsErasure`, `GLOBAL_IsDistErasure`, `GLOBAL_IsErasureSD`, `GLOBAL_RootDiskThreshold` | `crates/ecstore/src/runtime/global.rs` and `crates/ecstore/src/runtime/sources.rs` | Runtime migration target | Move only after endpoint, setup-type, and root-disk-threshold ownership can be tested without changing readiness or quorum behavior. |
-| `GLOBAL_LOCAL_DISK_MAP`, `GLOBAL_LOCAL_DISK_ID_MAP`, `GLOBAL_LOCAL_DISK_SET_DRIVES` | `crates/ecstore/src/runtime/global.rs` and `crates/ecstore/src/runtime/sources.rs` | Runtime migration target | Needs an ECStore local-disk registry handle before code movement; preserve disk lookup, remote/local classification, and test reset hooks. |
+| `GLOBAL_LOCAL_DISK_MAP`, `GLOBAL_LOCAL_DISK_ID_MAP`, `GLOBAL_LOCAL_DISK_SET_DRIVES` | `crates/ecstore/src/runtime/global.rs` and `crates/ecstore/src/runtime/sources.rs` | Runtime migration target | Local disk map reads now stay behind the ECStore runtime-source helper instead of the global facade; move disk-id and set-drive access separately while preserving disk lookup, remote/local classification, and test reset hooks. |
 | `GLOBAL_ExpiryState`, `GLOBAL_TransitionState`, `GLOBAL_LifecycleSys` | `crates/ecstore/src/bucket/lifecycle/*` and `crates/ecstore/src/runtime/sources.rs` | Runtime migration target | First code-bearing candidate is `GLOBAL_ExpiryState`, because AppContext already has an `ExpiryStateInterface`, resolver, and tests. |
 | `GLOBAL_REPLICATION_POOL`, `GLOBAL_REPLICATION_STATS`, `GLOBAL_BUCKET_MONITOR` | `crates/ecstore/src/bucket/replication/*`, `crates/ecstore/src/runtime/global.rs` | Runtime migration target | Keep behind AppContext replication and bucket-monitor resolvers until queue admission, stats, and admin reporting coverage are explicit. |
 | `GLOBAL_TierConfigMgr`, `GLOBAL_STORAGE_CLASS`, `GLOBAL_CONFIG_SYS`, `GLOBAL_SERVER_CONFIG` | `crates/ecstore/src/config`, `crates/config`, `rustfs/src/app/context/runtime_sources.rs` | Runtime migration target | Tier config manager reads and reloads now use the ECStore runtime-source helper; move remaining config state through config/runtime-source owners only, without combining storage-class behavior or persistence changes. |

scripts/check_architecture_migration_rules.sh

@@ -182,6 +182,7 @@ EXTERNAL_TEST_ECSTORE_COMPAT_BYPASS_HITS_FILE="${TMP_DIR}/external_test_ecstore_
 FUZZ_ECSTORE_COMPAT_BYPASS_HITS_FILE="${TMP_DIR}/fuzz_ecstore_compat_bypass_hits.txt"
 EXTERNAL_ECSTORE_API_BOUNDARY_HITS_FILE="${TMP_DIR}/external_ecstore_api_boundary_hits.txt"
 REPLICATION_FACADE_BYPASS_HITS_FILE="${TMP_DIR}/replication_facade_bypass_hits.txt"
+GLOBAL_LOCAL_DISK_MAP_BYPASS_HITS_FILE="${TMP_DIR}/global_local_disk_map_bypass_hits.txt"
 GLOBAL_BOOT_TIME_BYPASS_HITS_FILE="${TMP_DIR}/global_boot_time_bypass_hits.txt"
 GLOBAL_CONN_MAP_BYPASS_HITS_FILE="${TMP_DIR}/global_conn_map_bypass_hits.txt"
 GLOBAL_LOCAL_NODE_NAME_BYPASS_HITS_FILE="${TMP_DIR}/global_local_node_name_bypass_hits.txt"
@@ -2297,6 +2298,18 @@ if [[ -s "$REPLICATION_FACADE_BYPASS_HITS_FILE" ]]; then
   report_failure "replication facade imports must stay in local storage_api boundaries: $(paste -sd '; ' "$REPLICATION_FACADE_BYPASS_HITS_FILE")"
 fi
 
+(
+  cd "$ROOT_DIR"
+  rg -n --with-filename '\bGLOBAL_LOCAL_DISK_MAP\b' \
+    crates rustfs fuzz \
+    --glob '*.rs' |
+    rg -v '^crates/ecstore/src/runtime/(global|sources)\.rs:' || true
+) >"$GLOBAL_LOCAL_DISK_MAP_BYPASS_HITS_FILE"
+
+if [[ -s "$GLOBAL_LOCAL_DISK_MAP_BYPASS_HITS_FILE" ]]; then
+  report_failure "GLOBAL_LOCAL_DISK_MAP access must stay behind ECStore runtime-source helpers: $(paste -sd '; ' "$GLOBAL_LOCAL_DISK_MAP_BYPASS_HITS_FILE")"
+fi
+
 (
   cd "$ROOT_DIR"
   rg -n --with-filename '\bGLOBAL_BOOT_TIME\b' \