71859ff83c
fix(scanner): resume committed cleanup when scanning is disabled ( #7281 )
...
Run one supervised cleanup attempt for an existing operator reset, with
strict phase and revision checks under the original leader lock. Keep v3
reset authorization and responses unchanged, report deferred status, and
bound probe and shutdown waits without aborting in-flight reset ownership.
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-06 16:44:45 +08:00
cb72df269a
fix(heal): retain hints without verified repair receipts ( #7275 )
...
Stop task completion and legacy notices from discharging scanner retry hints. Preserve existing hints and their retry due time across admission observations, bound retry scheduling, and synchronize changed batches once even on cancellation.
Exercise the production MRF consumer, manager, event channel and scanner ledger. Document producer durability gaps without enabling successor activation or garbage collection.
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-06 16:44:30 +08:00
a40ec8a6f3
fix(odm): preserve progress when list-through is disabled ( #7278 )
...
* test(odm): cover disabled list-through continuation progress
* test(odm): cover literal cache tags in disabled list cursors
* fix(odm): preserve progress when list-through is disabled
2026-09-06 15:24:59 +08:00
1dddf357cd
test(scanner): add bounded cache cost microprofile ( #7261 )
2026-09-06 14:14:07 +08:00
395ba797fc
fix(admin): bound peer probe retries to one round deadline ( #7257 )
2026-09-06 14:13:47 +08:00
51893abfbf
feat(heal): pace running admin work at safe boundaries ( #7255 )
2026-09-06 14:13:35 +08:00
92c17af8e3
ci(e2e): run distributed e2e on ubuntu-latest ( #7253 )
2026-09-06 14:13:21 +08:00
1a88870809
fix(odm): preserve cursor compatibility and native source semantics ( #7238 )
2026-09-06 14:12:56 +08:00
5aef1796cc
fix(odm): reject ambiguous native source dot segments ( #7263 )
...
* fix(odm): reject ambiguous native source dot segments
* docs(odm): align native provider limitations with implementation
2026-09-06 13:11:35 +08:00
d44244f60f
fix(admin): preserve metadata during export and target repair ( #7258 )
...
* fix(admin): reject incomplete metadata backups
* fix(admin): repair remote targets from locked disk state
* test(admin): fence target repair against source changes
* fix(admin): report unreadable XML in metadata exports
* test(admin): enable loopback in target repair fixtures
* refactor(admin): remove unused metadata getter forwards
* test(admin): box direct target repair futures
* test(admin): box target repair scenarios at env boundary
2026-09-06 12:18:00 +08:00
f0d865728c
ci(e2e): use tmpfs for distributed pool isolation ( #7207 )
...
* test(e2e): add distributed 4x4 validation
* ci(e2e): use tmpfs for distributed pool isolation
sm-standard-4 is an ARC pod without usable loop devices, so
mount -o loop fails with ENOENT before any pool filesystem is
attached. Sized tmpfs still gives each pool a distinct st_dev
and independent 1G statfs capacity.
Co-authored-by: RustFS <hello@rustfs.com >
* test(e2e): prove operations overlap data movement
---------
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-09-06 10:52:12 +08:00
54c11ef28b
test(scanner): bound segment observation diagnostics ( #7240 )
...
* test(scanner): bound segment observation diagnostics
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): observe committed fixture changes during walks
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): validate segment fixture metadata and off state
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:51:30 +08:00
e99c41a9bf
test(scanner): verify restart evidence against tested builds ( #7232 )
...
* chore(deps): refresh scanner heal batch dependency baseline
Regenerate compatible lockfile selections before the next implementation
batch. Cargo upgrade leaves direct requirements unchanged.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* chore(deps): refresh profiling dependencies for the next batch
Update hotpath and its macro crate to the compatible patch release before
the next dependency-ready implementation tasks.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(deps): preserve supported hotpath focus expressions
Keep the profiler runtime before its regex-lite compatibility regression.
Track the opt-in validation required to remove this constraint in backlog.
Refs rustfs/backlog#2302 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): add bounded ABBA validation harness
Refs rustfs/backlog#2266 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): verify real restart evidence before release gates
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(test): bind scanner evidence to execution and build identity
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* docs(test): use the nextest workspace report directory
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(test): reap ABBA leaders only after process-group cleanup
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(test): preserve inclusive ABBA thresholds
Use decimal boundary comparisons for ABBA ratio checks and cover exact documented p99, throughput, and P1 limits.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:51:22 +08:00
fddecf0afe
test(scanner): diagnose raw enumeration across restarts ( #7228 )
...
* test(scanner): diagnose raw enumeration across process restarts
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): observe the canonical synthetic disk path
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): reject unobserved enumeration budget evidence
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): remove redundant disk path clone
* fix(app): keep list-through header import test-only
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:51:14 +08:00
55fd73ed48
feat(heal): add pending legacy MRF migration staging ( #7219 )
...
* chore(deps): refresh scanner heal batch dependency baseline
Regenerate compatible lockfile selections before the next implementation
batch. Cargo upgrade leaves direct requirements unchanged.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* chore(deps): refresh profiling dependencies for the next batch
Update hotpath and its macro crate to the compatible patch release before
the next dependency-ready implementation tasks.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(deps): preserve supported hotpath focus expressions
Keep the profiler runtime before its regex-lite compatibility regression.
Track the opt-in validation required to remove this constraint in backlog.
Refs rustfs/backlog#2302 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* feat(heal): add explicit committed MRF snapshot reader
Refs rustfs/backlog#2263 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* docs(heal): register legacy MRF inspection cleanup
State the compatibility removal condition on the source marker and in
the architecture cleanup register.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(heal): cover ambiguous complete legacy MRF replicas
Cover complete subset replicas, differing sets and unknown scope in both
disk orders, preserving all original journal evidence during inspection.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* feat(heal): stage conservative legacy MRF migration evidence
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): reject incomplete migration lineage before staging
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): validate migration retries against complete lineage
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): keep reused MRF migration slots retryable
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(heal): cover source-change retry on reused MRF slots
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): retain unmatched migration manifest evidence
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:51:04 +08:00
61e0edce16
test(odm): pin gcs error classes and require the backend contracts in ci ( #7250 )
...
* test(odm): pin gcs source status-to-error-class mapping
The native GCS backend classifies every failure from the HTTP status
alone, because GCS states its error code in a body this backend never
reads. Only NotFound is negative-cached and only a retryable class may be
re-sent, so cover 401/403 -> AccessDenied, 429/503 -> Throttled,
500/502 -> ServerError and 404 -> NotFound over both HEAD and GET.
* ci(odm): require the source-backend contract tests in test-and-lint
The shared contract tests already run in ci/test-and-lint, but only
because gcs is a rustfs default feature; nothing failed if that
selection went away. Pin the S3, Azure and native GCS contracts in the
core required-test manifest so a lost selection fails the lane.
2026-09-06 10:45:09 +08:00
07833379b4
test(e2e): add distributed cluster regression coverage ( #7158 )
...
* test(e2e): add distributed 4x4 validation
* test(e2e): prove operations overlap data movement
---------
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-06 10:12:06 +08:00
0a5d4cef0e
fix(tier): drain cleanup before tier removal ( #7213 )
...
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-06 10:10:48 +08:00
03fa62cc7d
fix(admin): keep exporting past unreadable configs and allow explicit target repair ( #7247 )
...
* test(ecstore): pin MinIO array-shaped targets blob as unreadable
* fix(admin): mark unreadable configs instead of aborting export
* feat(admin): opt-in replacement of unreadable bucket targets
2026-09-06 10:03:32 +08:00
081a8b61d8
test(scanner): add bounded ABBA validation harness ( #7181 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): add bounded ABBA validation harness
Refs rustfs/backlog#2266 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): harden ABBA threshold evaluation
Handle exact threshold comparisons without binary floating point boundary drift and mark unstable P1 walk controls inconclusive.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): reject invalid ABBA evidence and boundary drift
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 07:27:46 +08:00
159dc13548
fix(scanner): bind resumable scans and cache publication coverage ( #7210 )
...
* chore(deps): refresh scanner heal batch dependency baseline
Regenerate compatible lockfile selections before the next implementation
batch. Cargo upgrade leaves direct requirements unchanged.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* chore(deps): refresh profiling dependencies for the next batch
Update hotpath and its macro crate to the compatible patch release before
the next dependency-ready implementation tasks.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(deps): preserve supported hotpath focus expressions
Keep the profiler runtime before its regex-lite compatibility regression.
Track the opt-in validation required to remove this constraint in backlog.
Refs rustfs/backlog#2302 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): require complete publication coverage
Refs rustfs/backlog#2261 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): retain scoped partial coverage across dirty plans
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): keep stable snapshot rescan behavior
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): verify coverage receipts and scan strength
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): use valid modification times in checkpoint fixtures
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): keep maintenance cycles outside dirty bucket scopes
Force complete bucket scope for deep scans and scheduled maintenance while
preserving the existing planner for verified ordinary dirty work.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): refresh scope safety independently of idle backoff
Inspect maintenance on multi-disk startup and refresh changed or failed
evidence even when explicit bitrot configuration disables idle backoff.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): bind bucket cache reuse to scan work requirements
Carry stable scan mode and full-maintenance requirements in the existing
opaque bucket digest before local and remote cache admission. Different
requirements cannot replay a same-cycle Normal cache after root delivery
failure; matching requirements remain reusable for the same intent.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): fence set snapshot reuse with the scan work proof
Prevent same-cycle set publication from replacing freshly scanned maintenance
results with an older Normal aggregate. Recognize uniform completed
maintenance baselines when planning later ordinary dirty-bucket work.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): reproduce same-cycle dirty aggregate replay
Cover a Normal-to-Normal retry with a new dirty bucket generation after
bucket persistence and root delivery failure.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): fence same-cycle caches with full activity coverage
Keep structural baseline identity separate from the full activity coverage
required by bucket admission and set publication. Require complete set
coverage proofs while retaining revision CAS and epoch regression checks.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): supply explicit coverage in publication fixtures
Keep the confirmed-empty namespace fixture authoritative under the required
coverage contract and qualify the bucket cache metadata test type.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): verify joint checkpoint coverage metadata
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): satisfy cache prefix sort lint
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-06 07:27:18 +08:00
dd368f0f5b
fix(odm): fence source work against bucket recreation ( #7231 )
...
* fix(odm): fence backfill checkpoints by bucket incarnation
* fix(odm): bind source work to the bucket incarnation
* fix(odm): retain checkpoint fences through owned commit tails
* docs(odm): explain application service and incarnation boundaries
* test(odm): probe lifecycle fence after checkpoint waiter aborts
* fix(odm): defer source identity errors past local reads
* docs(metadata): clarify MinIO target recovery limits
* fix(odm): keep source-free reads independent of capture errors
* fix(odm): retain one source policy snapshot across lookup
* test(odm): name recorded metadata hook snapshots
2026-09-06 02:05:43 +08:00
8fc1c9281e
refactor(odm): move migration orchestration into application ( #7226 )
...
* refactor(odm): move migration orchestration into application
* style(odm): format relocated listing test imports
2026-09-06 01:31:58 +08:00
14cef91423
fix(admin): add isolated bucket metadata diagnostics ( #7225 )
2026-09-06 01:30:18 +08:00
c9acc33720
test(odm): verify rc5 rollback configuration recovery ( #7224 )
...
* test(odm): verify rc5 rollback configuration recovery
* ci(e2e): run the ODM rollback recovery scenario
2026-09-06 01:28:54 +08:00
955d491174
feat(build): make native GCS backends optional ( #7223 )
...
* feat(build): make native GCS backends optional
* test(odm): cover native Azure runtime credentials
2026-09-06 01:27:36 +08:00
8fb335cf19
test(e2e): pin upgrade compatibility to rc.5 and cover bucket configuration ( #7217 )
...
test(e2e): prove bucket config survives rc.5 upgrade and rollback
Add two upgrade-compatibility scenarios pinned to the on-demand-migration
series' on-disk surfaces: BucketMetadata's 44 -> 46 msgpack keys, the
fail-closed bucket-config reads of rustfs#7172, the encryption-gated PUT
path of rustfs#7183, and the default-on migration module of rustfs#7089.
The upgrade case writes versioning, SSE-S3 default encryption, a validated
replication target plus rule, lifecycle, tags, quota, a public access block,
a bucket policy and an object lock configuration with the pinned previous
release, then asserts each one reads back unchanged on the current build,
that list-remote-targets still reports the target, that writes to the
encrypted and plain buckets keep their encryption posture, that every
pre-upgrade object including a multipart one is byte-identical, and that an
unconfigured bucket reports no migration and still answers NoSuchKey.
The rollback case is the reverse: the current build writes the 46-key blob
and the previous release must decode it by skipping the two unknown keys.
2026-09-06 01:08:22 +08:00
188f380b3b
feat(ecstore): add native azure blob and gcs migration sources ( #7211 )
...
* feat(ecstore): add a native azure blob odm source backend
* feat(ecstore): add a native gcs odm source backend and one backend contract
* fix(ecstore): refuse an empty azure account key at client build
* fix(ecstore): probe gcs sources with the listing permission
* fix(app): drop a redundant match guard on the sse config lookup
* fix(ecstore): drop stale rename commit duplicates from local.rs
* test(ecstore): use the sanctioned placeholder key in the gcs fixture
2026-09-05 22:06:30 +08:00
e2a921bc16
fix(storage): harden ODM and scanner publication ( #7187 )
...
* fix(storage): harden ODM and scanner publication
* fix(app): simplify absent SSE configuration matching
* test(heal): settle PUT rename tails before disk-wipe fixtures
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ci): satisfy new clippy lints
* style(scanner): order merged test imports
* fix(scanner): invalidate bucket work after namespace completion
* fix(scanner): fence cached snapshots by scan execution
---------
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 13:47:12 +00:00
447f3c704b
feat(heal): add explicit committed MRF snapshot reader ( #7179 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* feat(heal): add explicit committed MRF snapshot reader
Refs rustfs/backlog#2263 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* docs(heal): register legacy MRF inspection cleanup
State the compatibility removal condition on the source marker and in
the architecture cleanup register.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 13:33:41 +00:00
d915f9565e
fix(ci): preserve reported functional suite failures ( #7199 )
2026-09-05 13:26:23 +00:00
af2e9df821
fix(lifecycle): correct expiration and transition evaluation ( #7169 )
2026-09-05 12:42:22 +00:00
0a92a7d98c
fix(tier): bound remote transition requests ( #7147 )
...
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-05 12:41:11 +00:00
9e2545244c
fix(odm): bound empty pagination chains with staged tokens ( #7197 )
...
* fix(odm): add staged cross-request pagination progress budgets
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(app): simplify absent SSE configuration matching
* fix(tests): satisfy new clippy lints
---------
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 11:44:49 +00:00
19a29a7027
test(s3): add Snowball tar-codec compatibility fixtures ( #7157 )
...
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-05 07:41:48 +00:00
2e4ab045b6
test(scanner): add durable checkpoint diagnostics ( #7175 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): add durable checkpoint diagnostics
Refs rustfs/backlog#2260 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 07:34:29 +00:00
cbfd5b92f4
refactor(ecstore): isolate local object rename commit ( #7166 )
...
* fix(ecstore): drain durable control-plane write tails
* fix(ecstore): retain PUT staging after incomplete rollback
* fix(ecstore): drain backfill checkpoint before confirmation
* refactor(ecstore): isolate local object rename commit
* refactor(ecstore): remove moved quota fence import
* fix(ecstore): retain per-disk rename rollback outcomes
* fix(ecstore): retain indeterminate rename recovery evidence
* test(ecstore): mark rollback fixtures as inline data
* test(ecstore): match sealed context fixture map type
* test(ecstore): match sealed context fixture map type
* fix(ecstore): preserve known preflight rename rejections
* test(ecstore): cover observed rename outer failures
* test(ecstore): count decommission faults across retry restarts
2026-09-05 07:19:29 +00:00
2477e31059
test(ecstore): require core regressions in the existing CI lane ( #7162 )
...
* test(ecstore): require core invariant tests in existing CI lane
* test(ci): require a fresh core JUnit report
* test(ecstore): match sealed context fixture map type
2026-09-05 06:22:48 +00:00
13e6424e99
docs(architecture): settle remote credential sealing threat model ( #7168 )
...
* docs(architecture): settle remote credential sealing threat model
* docs(architecture): index sealing ADR threat-model scope
2026-09-05 11:20:58 +08:00
9ed1d46090
docs(ecstore): define generation authority and recovery boundary ( #7159 )
2026-09-05 09:29:00 +08:00
6eb60f8e72
feat(tier): add durable probe intent protocol ( #7151 )
...
* feat(tier): add durable probe intent protocol
* test(tier): remove redundant intent clones
2026-09-05 09:06:05 +08:00
5f8b097172
fix(tier): bound distributed mutation latency ( #7150 )
2026-09-05 02:28:08 +08:00
445114577f
docs(ilm): approve bounded recovery disposition ( #7155 )
2026-09-05 02:28:02 +08:00
81014fd233
docs(ilm): approve legacy tier state reconciliation ( #7142 )
2026-09-04 19:53:36 +08:00
4d226998e2
fix(ilm): chunk large tier-delete dispatches ( #7123 )
...
* fix(ilm): chunk large tier-delete dispatches
* fix(ilm): bound tier-delete chunk dispatch stack use
2026-09-04 10:30:32 +00:00
a9373288f2
docs(architecture): decide how remote credentials are sealed at rest ( #7131 )
...
Replication targets, remote tiers and on-demand migration sources each store a
remote secret in clear text under .rustfs.sys today. Record one design for all
three before any of them invents its own: seal only the secret fields, into an
added field so an old reader finds the credential absent rather than a
ciphertext it would sign with, unseal at remote-client construction, and reach
KMS through an installed hook because ECStore does not depend on rustfs-kms.
Covers the envelope format and its encryption context, the mixed-version
compatibility matrix, the rollout gate, rotation ownership and the fail-closed
rules.
2026-09-04 16:30:17 +08:00
fdb28e611f
fix: bound tier free-version recovery sweeps ( #7125 )
2026-09-04 08:12:01 +00:00
9d10d69a6d
test(odm): add the scheduled provider interop lane ( #7114 )
...
* test(odm): drive the migration cases from an env-named source
The ODM e2e suite only ever migrates from the in-process fake source, so
path-style addressing, region handling, ETag shape and list pagination on
real implementations stay untested. OdmInteropEnv resolves the source from
RUSTFS_ODM_INTEROP_*, seeding into a per-run source_prefix so a shared real
bucket can host concurrent runs and every seeded key is removed afterwards.
A named provider with a missing variable is an error, never a silent
fallback to the fake source.
interop_test holds the four cases that run against either source, and the
e2e-odm-interop profile is the lane that selects them; e2e-full excludes
them, so its committed selection is unchanged. wait_until_odm_engaged
replaces the fake source's journal probe for the readiness wait, since a
real source keeps no journal.
* ci(odm): add the scheduled provider interop lane
on-demand-migration-interop.yml runs the interop cases against a pinned
MinIO container with a 5,000-object backfill - past the fake source's 4,096
version and journal caps - and the three-case minimum against AWS, R2 and
GCS when their ODM_INTEROP_* secrets exist, skipping with a summary note
when they do not. Each provider gets one JSON report merging the per-case
entries with the nextest JUnit, which stays authoritative for what ran.
Report-only and never required: it depends on third-party endpoints and on
secrets a fork does not have.
2026-09-04 10:05:40 +08:00
9863f4848d
feat(tier): report cluster tier stats and count tier requests ( #7110 )
...
`GET /v3/tier-stats` answered from whichever process received the
request, returning that node's rolling 24-hour transition counters as
if they were cluster totals, and the `TierRequestsSuccess` and
`TierRequestsFailure` metric names had no producer at all.
The body now separates the two quantities a tier carries. Stored
inventory comes from the persisted scanner usage snapshot, which is
already cluster-wide; rolling activity is summed over every member
through a new read-only `TierDailyStats` peer RPC. Rings are merged
rather than added, so an idle node's expired hours age out, and each
node counts only its own committed transitions, so a retry is counted
once. Coverage travels with the numbers: `activity.status` names the
reporting members and the ones that could not be asked, timed out, or
answered with a ring this build refuses to merge, and per-tier
inventory is absent rather than zero when the snapshot has no
accounting. The version 1 body stays reachable at `?format=legacy`.
Tier request counters are recorded at the two seams every remote
request passes through, so a new provider is counted by construction,
with a closed operation/outcome label set that can never grow a tier
name, endpoint or object key.
Closes rustfs/backlog#2207
Co-authored-by: cxymds <cxymds@gmail.com >
2026-09-04 09:40:03 +08:00
7dfc2ee5f0
feat(odm): merge the source listing into ListObjectsV2 ( #7112 )
...
* feat(odm): merge the source listing into ListObjectsV2
Adds policy.list_through: ListObjectsV2 merges the local and source
listings into one ordered page so clients see the whole namespace during
an on-demand migration. Local entries win a key both sides hold,
CommonPrefixes are unioned under a delimiter, and the continuation token
is an opaque versioned envelope carrying both cursors.
A source listing failure or an open breaker follows policy.source_error:
propagate answers 424, not_found answers from local state and marks the
response x-rustfs-on-demand-migration-list: local_only. Source listings
are capped at 10 per second per bucket.
* test(odm): refresh the e2e-full darwin selection digest
The list-through e2e module adds seven cases to the merge lane.
2026-09-04 09:08:35 +08:00
houseme