fix(sse): diagnose unresolvable encrypted metadata on reads (#6784)

crates/ecstore/src/object_api/readers.rs

@@ -730,7 +730,18 @@ impl ReadPlan {
                 })
                 .await
                 .map_err(Error::other)?
-                .ok_or_else(|| Error::other("encrypted object metadata is incomplete"))?;
+                .ok_or_else(|| {
+                    // The resolver saw no encryption it recognizes, yet the
+                    // object's markers say it is encrypted. Keep failing closed,
+                    // but as a typed, non-retryable error: the condition is a
+                    // permanent property of the stored metadata, not a fault a
+                    // retry can fix.
+                    Error::other(EncryptionResolutionError::new(
+                        EncryptionResolutionErrorKind::InvalidMetadata,
+                        "object is marked encrypted, but no decryption material could be resolved from its metadata; \
+                         the encryption metadata is incomplete or in a format this server cannot read",
+                    ))
+                })?;
             let material = resolved;
             #[cfg(feature = "rio-v2")]
             let uses_legacy_encryption = matches!(material.mode, ReadEncryptionMode::Direct { .. });

crates/rio-v2/tests/README.md

@@ -52,4 +52,4 @@ It checks that:
 - KMS key ids are derived from each fixture's own `manifest.json`, so local static-KMS runs are not tied to one hard-coded key name
 - SSE-C `HEAD` responses round-trip the expected customer algorithm and customer-key MD5
 
-These tests do not yet validate full plaintext reconstruction from MinIO-written encrypted data.
+These tests do not validate full plaintext reconstruction from MinIO-written encrypted data — that lives in the reader suite at `rustfs/src/storage/minio_generated_read_test.rs`, run with `--features rio-v2` over the same fixture captures.