3df39ef4d7
fix(scanner): separate write retries from movement backlog ( #7249 )
2026-09-06 10:51:46 +08:00
b0c73c1224
fix(ecstore): retain namespace owners through local disk completion ( #7245 )
...
* fix(ecstore): retain namespace owners through local physical tails
(cherry picked from commit a2f242463316e87604feadbdac5e4148140e72c0)
* test(ecstore): expose stale fsync group cleanup
* fix(ecstore): capture complete fsync worker guard
(cherry picked from commit 1dc90bb836e20ea9ee45d0a629a9201e20d231c4)
* fix(ecstore): preserve successor fsync group registration
(cherry picked from commit c7dfaad90526052e56c57dafffa4813bdcde46ca)
* test(ecstore): mark physical owner fixtures as inline
* test(ecstore): wait for namespace owner release before asserting
The namespace owner tests decided that ownership had ended when the Weak probe stopped upgrading or when the mutation lease could be reacquired. Both signals fire before the owner guard's Drop decrements the pending counter: Arc releases its strong count before running Drop, and the lease drops its locks before its owner field. The rio-v2 lane hit that window in undo_fresh_version_keeps_physical_namespace_owner_after_timeout.
Extend every drain wait to also require namespace_commits_pending() to be false, so the assertions observe the completed release instead of racing it.
2026-09-06 10:51:38 +08:00
54c11ef28b
test(scanner): bound segment observation diagnostics ( #7240 )
...
* test(scanner): bound segment observation diagnostics
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): observe committed fixture changes during walks
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): validate segment fixture metadata and off state
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:51:30 +08:00
e99c41a9bf
test(scanner): verify restart evidence against tested builds ( #7232 )
...
* chore(deps): refresh scanner heal batch dependency baseline
Regenerate compatible lockfile selections before the next implementation
batch. Cargo upgrade leaves direct requirements unchanged.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* chore(deps): refresh profiling dependencies for the next batch
Update hotpath and its macro crate to the compatible patch release before
the next dependency-ready implementation tasks.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(deps): preserve supported hotpath focus expressions
Keep the profiler runtime before its regex-lite compatibility regression.
Track the opt-in validation required to remove this constraint in backlog.
Refs rustfs/backlog#2302 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): add bounded ABBA validation harness
Refs rustfs/backlog#2266 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): verify real restart evidence before release gates
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(test): bind scanner evidence to execution and build identity
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* docs(test): use the nextest workspace report directory
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(test): reap ABBA leaders only after process-group cleanup
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(test): preserve inclusive ABBA thresholds
Use decimal boundary comparisons for ABBA ratio checks and cover exact documented p99, throughput, and P1 limits.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:51:22 +08:00
fddecf0afe
test(scanner): diagnose raw enumeration across restarts ( #7228 )
...
* test(scanner): diagnose raw enumeration across process restarts
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): observe the canonical synthetic disk path
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): reject unobserved enumeration budget evidence
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): remove redundant disk path clone
* fix(app): keep list-through header import test-only
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:51:14 +08:00
55fd73ed48
feat(heal): add pending legacy MRF migration staging ( #7219 )
...
* chore(deps): refresh scanner heal batch dependency baseline
Regenerate compatible lockfile selections before the next implementation
batch. Cargo upgrade leaves direct requirements unchanged.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* chore(deps): refresh profiling dependencies for the next batch
Update hotpath and its macro crate to the compatible patch release before
the next dependency-ready implementation tasks.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(deps): preserve supported hotpath focus expressions
Keep the profiler runtime before its regex-lite compatibility regression.
Track the opt-in validation required to remove this constraint in backlog.
Refs rustfs/backlog#2302 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* feat(heal): add explicit committed MRF snapshot reader
Refs rustfs/backlog#2263 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* docs(heal): register legacy MRF inspection cleanup
State the compatibility removal condition on the source marker and in
the architecture cleanup register.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(heal): cover ambiguous complete legacy MRF replicas
Cover complete subset replicas, differing sets and unknown scope in both
disk orders, preserving all original journal evidence during inspection.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* feat(heal): stage conservative legacy MRF migration evidence
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): reject incomplete migration lineage before staging
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): validate migration retries against complete lineage
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): keep reused MRF migration slots retryable
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(heal): cover source-change retry on reused MRF slots
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): retain unmatched migration manifest evidence
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:51:04 +08:00
1ae80c41ec
feat(heal): record canonical object and task outcomes ( #7218 )
...
* chore(deps): refresh scanner heal batch dependency baseline
Regenerate compatible lockfile selections before the next implementation
batch. Cargo upgrade leaves direct requirements unchanged.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* chore(deps): refresh profiling dependencies for the next batch
Update hotpath and its macro crate to the compatible patch release before
the next dependency-ready implementation tasks.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(deps): preserve supported hotpath focus expressions
Keep the profiler runtime before its regex-lite compatibility regression.
Track the opt-in validation required to remove this constraint in backlog.
Refs rustfs/backlog#2302 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* feat(heal): record bounded canonical object and task outcomes
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): preserve cancellation and retry only failed listing pages
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): preserve compatible listing EOF outcomes
Keep truncated heal listings without continuation tokens as complete compatibility EOFs and assert the canonical task outcome.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): drop test locks before awaits
Limit synchronous mock mutex guards to pre-await scopes in canonical outcome tests.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-06 10:50:56 +08:00
9fc9b5e69c
fix(ecstore): align platform and test helper compilation ( #7214 )
...
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-06 10:50:48 +08:00
2b5c739343
fix(scanner): require complete publication coverage ( #7176 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): require complete publication coverage
Refs rustfs/backlog#2261 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ci): keep s3s footprint ratchet tight
Route bucket list-through test-only S3 wire types through the app storage facade again so the PR does not add a direct s3s-importing file.
Retighten the s3_error! footprint baseline to the current lower count.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(odm): expose store context after relocation
Expose the ECStore instance context through a narrow accessor so relocated on-demand migration backfill code no longer reaches into private storage fields.
Declare the faster-hex dependency used by the relocated native HTTP source implementation.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): stabilize usage and ODM regressions
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:43:43 +08:00
07833379b4
test(e2e): add distributed cluster regression coverage ( #7158 )
...
* test(e2e): add distributed 4x4 validation
* test(e2e): prove operations overlap data movement
---------
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-06 10:12:06 +08:00
6655272c90
fix(ilm): reject invalid retention counts and validate lifecycle filters ( #7132 )
...
* fix(ilm): reject invalid retention counts and validate lifecycle filters
`NewerNoncurrentVersions` had no lower bound at PUT, and evaluation read a
negative count through `usize::try_from(...).unwrap_or(usize::MAX)`. An
HTTP-accepted rule therefore retained (almost) everything and silently
stopped expiring versions — the one outcome a retention rule must never
produce by accident.
Reject a negative count during validation, and stop reading one as
"retain everything" anywhere it can still arrive from older persistence
or an import: evaluation takes no action for such a rule and says so in a
diagnostic, the batch limit path yields no event, and `Evaluator::eval`
reports a typed corruption error to callers that can surface one.
A count-only noncurrent expiration is a MinIO extension, not an AWS form.
It used to be rejected as an actionless rule and was never executed. It
is now accepted and honoured with the semantics MinIO gives it: the
newest N noncurrent versions are kept and every older one is due as soon
as it became noncurrent. Zero keeps the meaning the batch limit path has
always given it — no count constraint — so a zero-count rule with no age
condition still has no action.
`LifecycleRuleFilter` is an all-`Option` DTO, so the schema constraints
were not checked anywhere: validate at most one top-level predicate, an
`And` that combines at least two, no repeated tag key, tag key/value
limits, non-negative sizes, and `ObjectSizeGreaterThan <
ObjectSizeLessThan`. An empty filter stays valid — AWS documents it as
"every object in the bucket".
Schema-shape violations are reported with a distinct `ErrorKind` so the
S3 boundary answers them with `MalformedXML`; rejected values keep the
`InvalidArgument` this path has always returned.
backlog#2201
* fix(ilm): satisfy lifecycle clippy checks
* fix(ilm): fail closed on invalid lifecycle rules
* fix: initialize optional migration source fields
---------
Co-authored-by: cxymds <cxymds@gmail.com >
2026-09-06 10:11:05 +08:00
0a5d4cef0e
fix(tier): drain cleanup before tier removal ( #7213 )
...
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-06 10:10:48 +08:00
941fae61a0
fix(ilm): persist bounded transition recovery controls ( #7200 )
...
* fix(ilm): persist bounded transition recovery controls
* test(ilm): keep expiry sentinel within control range
* fix(ilm): repair recovery control CI regressions
---------
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-06 10:10:24 +08:00
03fa62cc7d
fix(admin): keep exporting past unreadable configs and allow explicit target repair ( #7247 )
...
* test(ecstore): pin MinIO array-shaped targets blob as unreadable
* fix(admin): mark unreadable configs instead of aborting export
* feat(admin): opt-in replacement of unreadable bucket targets
2026-09-06 10:03:32 +08:00
159dc13548
fix(scanner): bind resumable scans and cache publication coverage ( #7210 )
...
* chore(deps): refresh scanner heal batch dependency baseline
Regenerate compatible lockfile selections before the next implementation
batch. Cargo upgrade leaves direct requirements unchanged.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* chore(deps): refresh profiling dependencies for the next batch
Update hotpath and its macro crate to the compatible patch release before
the next dependency-ready implementation tasks.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(deps): preserve supported hotpath focus expressions
Keep the profiler runtime before its regex-lite compatibility regression.
Track the opt-in validation required to remove this constraint in backlog.
Refs rustfs/backlog#2302 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): require complete publication coverage
Refs rustfs/backlog#2261 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): retain scoped partial coverage across dirty plans
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): keep stable snapshot rescan behavior
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): verify coverage receipts and scan strength
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): use valid modification times in checkpoint fixtures
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): keep maintenance cycles outside dirty bucket scopes
Force complete bucket scope for deep scans and scheduled maintenance while
preserving the existing planner for verified ordinary dirty work.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): refresh scope safety independently of idle backoff
Inspect maintenance on multi-disk startup and refresh changed or failed
evidence even when explicit bitrot configuration disables idle backoff.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): bind bucket cache reuse to scan work requirements
Carry stable scan mode and full-maintenance requirements in the existing
opaque bucket digest before local and remote cache admission. Different
requirements cannot replay a same-cycle Normal cache after root delivery
failure; matching requirements remain reusable for the same intent.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): fence set snapshot reuse with the scan work proof
Prevent same-cycle set publication from replacing freshly scanned maintenance
results with an older Normal aggregate. Recognize uniform completed
maintenance baselines when planning later ordinary dirty-bucket work.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): reproduce same-cycle dirty aggregate replay
Cover a Normal-to-Normal retry with a new dirty bucket generation after
bucket persistence and root delivery failure.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): fence same-cycle caches with full activity coverage
Keep structural baseline identity separate from the full activity coverage
required by bucket admission and set publication. Require complete set
coverage proofs while retaining revision CAS and epoch regression checks.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): supply explicit coverage in publication fixtures
Keep the confirmed-empty namespace fixture authoritative under the required
coverage contract and qualify the bucket cache metadata test type.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): verify joint checkpoint coverage metadata
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): satisfy cache prefix sort lint
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-06 07:27:18 +08:00
e1608fbd9c
test(odm): exercise overflow and invalid cursors reliably ( #7236 )
2026-09-06 03:09:39 +08:00
dd368f0f5b
fix(odm): fence source work against bucket recreation ( #7231 )
...
* fix(odm): fence backfill checkpoints by bucket incarnation
* fix(odm): bind source work to the bucket incarnation
* fix(odm): retain checkpoint fences through owned commit tails
* docs(odm): explain application service and incarnation boundaries
* test(odm): probe lifecycle fence after checkpoint waiter aborts
* fix(odm): defer source identity errors past local reads
* docs(metadata): clarify MinIO target recovery limits
* fix(odm): keep source-free reads independent of capture errors
* fix(odm): retain one source policy snapshot across lookup
* test(odm): name recorded metadata hook snapshots
2026-09-06 02:05:43 +08:00
6d8606412e
fix(odm): compile relocated instance-bound backfill service ( #7230 )
2026-09-06 01:43:14 +08:00
8fc1c9281e
refactor(odm): move migration orchestration into application ( #7226 )
...
* refactor(odm): move migration orchestration into application
* style(odm): format relocated listing test imports
2026-09-06 01:31:58 +08:00
c9acc33720
test(odm): verify rc5 rollback configuration recovery ( #7224 )
...
* test(odm): verify rc5 rollback configuration recovery
* ci(e2e): run the ODM rollback recovery scenario
2026-09-06 01:28:54 +08:00
955d491174
feat(build): make native GCS backends optional ( #7223 )
...
* feat(build): make native GCS backends optional
* test(odm): cover native Azure runtime credentials
2026-09-06 01:27:36 +08:00
1c4e9f1b65
fix(odm): order initial installation against configuration removal ( #7222 )
...
* fix(odm): retain removal generation before initial install
* fix(odm): reserve generations only for configured buckets
2026-09-06 01:26:57 +08:00
a9f01dbbdb
fix(ecstore): restore odm source contract tests ( #7215 )
...
* fix(ecstore): restore odm source contract tests
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(ci): initialize replication evidence in chain test
Run the replication workflow's evidence initialization before the chain handoff self-test executes the suite step. This keeps the test model aligned with the workflow-provided LOG_FILE and TMPDIR values.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(odm): distinguish missing GCS buckets from object misses (#7221 )
---------
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-06 01:26:08 +08:00
8fb335cf19
test(e2e): pin upgrade compatibility to rc.5 and cover bucket configuration ( #7217 )
...
test(e2e): prove bucket config survives rc.5 upgrade and rollback
Add two upgrade-compatibility scenarios pinned to the on-demand-migration
series' on-disk surfaces: BucketMetadata's 44 -> 46 msgpack keys, the
fail-closed bucket-config reads of rustfs#7172, the encryption-gated PUT
path of rustfs#7183, and the default-on migration module of rustfs#7089.
The upgrade case writes versioning, SSE-S3 default encryption, a validated
replication target plus rule, lifecycle, tags, quota, a public access block,
a bucket policy and an object lock configuration with the pinned previous
release, then asserts each one reads back unchanged on the current build,
that list-remote-targets still reports the target, that writes to the
encrypted and plain buckets keep their encryption posture, that every
pre-upgrade object including a multipart one is byte-identical, and that an
unconfigured bucket reports no migration and still answers NoSuchKey.
The rollback case is the reverse: the current build writes the 46-key blob
and the previous release must decode it by skipping the two unknown keys.
2026-09-06 01:08:22 +08:00
188f380b3b
feat(ecstore): add native azure blob and gcs migration sources ( #7211 )
...
* feat(ecstore): add a native azure blob odm source backend
* feat(ecstore): add a native gcs odm source backend and one backend contract
* fix(ecstore): refuse an empty azure account key at client build
* fix(ecstore): probe gcs sources with the listing permission
* fix(app): drop a redundant match guard on the sse config lookup
* fix(ecstore): drop stale rename commit duplicates from local.rs
* test(ecstore): use the sanctioned placeholder key in the gcs fixture
2026-09-05 22:06:30 +08:00
e2a921bc16
fix(storage): harden ODM and scanner publication ( #7187 )
...
* fix(storage): harden ODM and scanner publication
* fix(app): simplify absent SSE configuration matching
* test(heal): settle PUT rename tails before disk-wipe fixtures
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ci): satisfy new clippy lints
* style(scanner): order merged test imports
* fix(scanner): invalidate bucket work after namespace completion
* fix(scanner): fence cached snapshots by scan execution
---------
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 13:47:12 +00:00
447f3c704b
feat(heal): add explicit committed MRF snapshot reader ( #7179 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* feat(heal): add explicit committed MRF snapshot reader
Refs rustfs/backlog#2263 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* docs(heal): register legacy MRF inspection cleanup
State the compatibility removal condition on the source marker and in
the architecture cleanup register.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 13:33:41 +00:00
55ad7508b9
fix(tier): persist coordinator intent before waking refresh ( #7171 )
2026-09-05 13:24:00 +00:00
33fd056000
fix(ecstore): release heal disk snapshot before nested reads ( #7189 )
...
* fix(ecstore): release heal disk snapshot before nested reads
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(app): simplify absent SSE configuration matching
* fix(tests): satisfy new clippy lints
---------
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 12:49:40 +00:00
af2e9df821
fix(lifecycle): correct expiration and transition evaluation ( #7169 )
2026-09-05 12:42:22 +00:00
0a92a7d98c
fix(tier): bound remote transition requests ( #7147 )
...
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-05 12:41:11 +00:00
3e5d4ebb09
fix(ecstore): release multipart disk snapshot before nested reads ( #7184 )
...
* fix(ecstore): release multipart disk snapshot before nested reads
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(app): simplify absent SSE configuration matching
* fix(tests): satisfy new clippy lints
---------
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 12:20:50 +00:00
9e2545244c
fix(odm): bound empty pagination chains with staged tokens ( #7197 )
...
* fix(odm): add staged cross-request pagination progress budgets
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(app): simplify absent SSE configuration matching
* fix(tests): satisfy new clippy lints
---------
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 11:44:49 +00:00
e8a7f4bc4a
fix(ecstore): remove duplicate local rename implementation ( #7190 )
...
* fix(ecstore): remove duplicate local rename implementation
Keep the canonical commit module after concurrent storage changes merged.
The control-write and rollback changes are already present there.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(ci): satisfy new clippy lints
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-05 10:44:01 +00:00
acfeef55ab
feat(scanner): add bounded incarnation-scoped ACK receiver ( #7182 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* feat(scanner): add bounded incarnation-scoped ACK receiver
Refs rustfs/backlog#2265 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 08:54:55 +00:00
42c32381b6
fix(scanner): make reset cleanup safely reentrant ( #7180 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(scanner): make reset cleanup safely reentrant
Refs rustfs/backlog#2264 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 08:45:53 +00:00
e6bf2a4646
fix(admin): report partial background heal coverage ( #7178 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(admin): report partial background heal coverage
Refs rustfs/backlog#2035 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 08:45:45 +00:00
cf9688898d
fix(heal): retain completed task progress ( #7177 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* fix(heal): retain completed task progress
Refs rustfs/backlog#2262 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 08:39:26 +00:00
2d159635ed
feat(scanner): plan dirty bucket cache refreshes ( #7146 )
...
* feat(scanner): plan dirty bucket cache refreshes
* fix(scanner): route peer snapshot through storage boundary
---------
Co-authored-by: Henry Guo <marshawcoco@users.noreply.github.com >
Co-authored-by: cxymds <cxymds@gmail.com >
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-05 16:32:02 +08:00
8ae8fb7eea
fix(ecstore): drain control writes and preserve uncertain rollback ( #7163 )
...
* fix(ecstore): drain durable control-plane write tails
* fix(ecstore): retain PUT staging after incomplete rollback
* fix(ecstore): drain backfill checkpoint before confirmation
* fix(ecstore): retain per-disk rename rollback outcomes
* fix(ecstore): retain indeterminate rename recovery evidence
* test(ecstore): mark rollback fixtures as inline data
* test(ecstore): match sealed context fixture map type
* fix(ecstore): preserve known preflight rename rejections
* test(ecstore): cover observed rename outer failures
* test(ecstore): count decommission faults across retry restarts
2026-09-05 08:16:53 +00:00
bbd7b9ef17
fix(site-replication): bound and order outage recovery ( #7148 )
...
* fix(site-replication): wake retry drain after peer recovery
* fix(site-replication): replay configure after bucket make
* fix(site-replication): serialize retry replay state
* fix(site-replication): persist destructive retry intents
* fix(site-replication): bound retry recovery rounds
* fix(site-replication): keep recovery replay live
* fix(site-replication): preserve retry ordering
* fix(site-replication): bound retry coordination
* fix(site-replication): serialize topology replay
* fix(site-replication): fence distributed retry state
* fix(site-replication): bound outage retry drain
* fix(site-replication): drop unsafe delete retry intents
* fix(site-replication): order bucket mutation replay
* fix(site-replication): harden outage retry replay
* fix(site-replication): fence destructive peer delivery
* fix(site-replication): avoid peer edit retry deadlock
* fix(site-replication): fence retry error classification
* fix(site-replication): classify connect timeouts
* fix(site-replication): close recovery review races
* test(site-replication): cover timeout endpoint text
* fix(site-replication): close destructive recovery gaps
* fix(site-replication): fence recovery revisions
* fix(site-replication): replay bucket metadata on recovery
* fix(site-replication): preserve s3gate boundary
---------
Co-authored-by: overtrue <anzhengchao@gmail.com >
2026-09-05 15:55:54 +08:00
882d9ca8a4
refactor(ecstore): isolate metadata quorum decisions ( #7165 )
...
* refactor(ecstore): isolate metadata quorum decisions
* test(ecstore): match sealed context fixture map type
* test(ecstore): count decommission faults across retry restarts
2026-09-05 07:46:13 +00:00
19a29a7027
test(s3): add Snowball tar-codec compatibility fixtures ( #7157 )
...
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-05 07:41:48 +00:00
2e4ab045b6
test(scanner): add durable checkpoint diagnostics ( #7175 )
...
* chore(deps): refresh SDKs and pin clock skew regression coverage
Refresh compatible dependencies for Scanner/Heal V2 batch 1 and verify
the production S3 retry/signing path with a deterministic clock.
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
* test(scanner): add durable checkpoint diagnostics
Refs rustfs/backlog#2260 and rustfs/backlog#2240 .
Co-Authored-By: heihutu <heihutu@gmail.com >
Co-Authored-By: zhi22915 <qiuzgang@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
Co-authored-by: zhi22915 <qiuzgang@gmail.com >
2026-09-05 07:34:29 +00:00
cbfd5b92f4
refactor(ecstore): isolate local object rename commit ( #7166 )
...
* fix(ecstore): drain durable control-plane write tails
* fix(ecstore): retain PUT staging after incomplete rollback
* fix(ecstore): drain backfill checkpoint before confirmation
* refactor(ecstore): isolate local object rename commit
* refactor(ecstore): remove moved quota fence import
* fix(ecstore): retain per-disk rename rollback outcomes
* fix(ecstore): retain indeterminate rename recovery evidence
* test(ecstore): mark rollback fixtures as inline data
* test(ecstore): match sealed context fixture map type
* test(ecstore): match sealed context fixture map type
* fix(ecstore): preserve known preflight rename rejections
* test(ecstore): cover observed rename outer failures
* test(ecstore): count decommission faults across retry restarts
2026-09-05 07:19:29 +00:00
971f9acdf4
fix(ecstore): reject stalled ODM pagination before merging pages ( #7164 )
...
* fix(odm): reject non-progressing listing cursors
* docs(odm): clarify folded source probe pagination
* test(odm): match SDK bucket-root listing requests
* test(ecstore): match sealed context fixture map type
* test(odm): use app facade for listing wire types
* fix(odm): resolve pagination Clippy failures
2026-09-05 07:17:25 +00:00
a6589c19e3
chore(tier): remove stage-a blanket lint allowances ( #7153 )
...
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-05 06:43:05 +00:00
a3b8183be9
test(ecstore): narrow barrier re-export cfgs ( #7152 )
...
Co-authored-by: Zhengchao An <anzhengchao@gmail.com >
2026-09-05 06:12:45 +00:00
4dbc58887a
fix(tier): probe legacy transition version state ( #7138 )
2026-09-05 06:00:14 +00:00
123967e729
fix(ecstore): fail closed on an unreadable bucket-targets blob ( #7172 )
...
* fix(ecstore): correct sealed-credential test helper parameter type
The helper took a HashMap that nothing imports, so the ecstore test target did not compile.
* fix(ecstore): fail closed on an unreadable bucket-targets blob
An undecodable bucket-targets.json was replaced by an empty BucketTargets,
so every replication target of that bucket disappeared, replication stopped,
and no caller saw an error. A missing secretKey alone triggers it, because
Credentials has no struct-level serde(default).
parse_all_configs now retains the failure instead: the raw bytes stay and the
typed field stays None, which BucketMetadata::bucket_targets_unreadable reads
as "exists but cannot be read" — the same distinction the fabricated marker
draws for bucket metadata as a whole. One corrupt sub-config still never fails
the metadata load, so an unreadable bucket cannot take down its neighbours or
the node.
BucketTargetSys records such buckets and answers every targets query with the
new BucketRemoteTargetsUnreadable, leaving any snapshot from an earlier
readable load in place so in-flight replication is not torn down. The
replication heal queue reports Missed rather than scheduling against an empty
target set, and the admin listing surfaces the fault instead of an empty list.
Refs: rustfs/backlog#2282
* fix(ecstore): report corrupt permissive bucket configs as invalid
Audit of the remaining parse_all_configs branches. Policy, versioning, object
lock and replication already fail closed at their accessors; encryption,
public access block and quota did not, and for those three "absent" is exactly
the state that grants something — plaintext storage, anonymous access,
unbounded capacity. They now report a stored-but-undecodable payload as
invalid rather than as ConfigNotFound, matching the guard the versioning and
object-lock accessors already use. The quota enforcement path already refused
such a payload; only the metadata read path was misreporting it.
The branches left degrading, and the concrete reason each is safe, are
recorded in the table on parse_all_configs.
Refs: rustfs/backlog#2282
2026-09-05 13:02:23 +08:00
cxymds