fix(kms): keep the immediate-deletion gate out of persisted config

The gate is per-server operator state, so it is read from server configuration at every construction site and never serialized: a stored config that claims it is not believed, and enabling it once on one node cannot leak into the cluster-wide config every other node reloads. Refs rustfs/backlog#1585
test(kms): pin the refused immediate deletion at the admin endpoint
2026-08-01 11:02:14 +00:00 · 2026-08-01 13:53:48 +08:00 · 2026-08-01 13:53:48 +08:00 · 2026-08-01 13:53:48 +08:00 · 2026-08-01 13:53:48 +08:00 · 2026-08-01 13:52:43 +08:00
609 changed files with 136388 additions and 12663 deletions
@@ -84,6 +84,9 @@ Null report example: "Rewrote the diff as an in-place edit (no smaller equivalen
 - For any secret/token/signature/password comparison in the diff, check it uses a constant-time compare (e.g. subtle/constant_time_eq), not == or early-return byte loops. Then check the failure-response paths: construct an invalid-user request and an invalid-secret request and confirm they are indistinguishable (same error, no early length short-circuit) so an attacker cannot enumerate valid users or time-side-channel the secret.
  - Where: crates/protocols/ (FTPS/WebDAV/FormPost auth), crates/credentials/, rustfs/src/auth.rs, RPC signature verification
  - Evidence: GHSA-3p3x-734c-h5vx (FTPS/WebDAV early-return string equality + distinguishable invalid-user vs invalid-password). Fix commits 3c3113619 (constant-time FTPS/WebDAV) and c41062f27 (constant-time FormPost signature). 3p3x was fixed by PR #4403.
+- If the diff parses or transports secret-bearing config (env vars, key files, connection strings), grep every error-construction and format site on that value's path (`format!` feeding `Error::other`/`configuration_error`/`panic!`/`expect`) for interpolation of the raw value or of variables named like secret material. Construct the likeliest misconfiguration: the operator supplies the bare secret without the expected `<name>:` prefix (or with a stray newline) — if the parse-failure hint echoes the input, the secret lands in startup logs. Error strings are log content; the hint may name the env var and expected format, never the value. If the diff re-implements an existing parse helper, diff the two error paths — the duplicate is where the leak hides.
+  - Where: rustfs/src/init.rs (env plumbing), crates/kms/src/config.rs, crates/credentials/, any from_env/parse on secret values; mechanical backstop in scripts/check_logging_guardrails.sh (secret-interpolation check)
+  - Evidence: PR #5222 introduced `got: {secret_str}` in build_static_kms_config's format-hint error — a bare base64 key (the secret itself) would have been echoed into startup logs; fixed by PR #5243. The parallel parse in KmsConfig::from_env already omitted the value: the leak lived only in the duplicated copy (AGENTS.md 'Reuse Before You Write').
 - If the diff touches internode/RPC auth secret handling, trace whether the RPC HMAC secret can fall back to a public default (e.g. 'rustfsadmin', 'rustfs rpc') or be derived deterministically from the S3 root credentials. Construct the case where RUSTFS_RPC_SECRET is unset and confirm the code fails closed rather than silently using a default or a root-derived key. Verify RPC signing keys are independent random secrets, not reused across S3-root/RPC-HMAC/STS-JWT roles.
  - Where: crates/credentials/, crates/ecstore/src/rpc/, internode auth setup
  - Evidence: GHSA-r5qv-rc46-hv8q (fell back to 'rustfsadmin'), GHSA-75fx/68cw (RPC secret derivable from root creds → forgeable signatures), GHSA-h956 (hard-coded 'rustfs rpc'), GHSA-m77q (STS JWT reused root secret). Fix commit 7b2055405 (fail closed when deriving RPC secret from default credentials, PR#4402).
@@ -10,10 +10,16 @@ never weaken a check to get green.

 ## `check_layer_dependencies.sh` — layer DAG in `rustfs/src`

-Enforces `interface (admin, storage/ecfs, storage/s3_api) → app → infra`; no
-upward imports. Known legacy violations live in
+Enforces `composition (server, startup/init) → interface (admin,
+storage/ecfs, storage/s3_api) → app → infra`; no upward imports. Server source
+files are composition roots, while imports of their exported HTTP contracts
+are classified as interface dependencies. Known legacy violations live in
 `scripts/layer-dependency-baseline.txt`.

+Dedicated `*_test.rs` and `tests/` modules are outside this production guard.
+Inline `#[cfg(test)]` imports remain checked under their source file's layer;
+move architecture-crossing test scaffolding into a dedicated test module.
+
 - **New violation**: restructure your change so the dependency points
  downward (move the shared type/function to the lower layer).
 - **You legitimately removed a baseline entry**: run
@@ -1,19 +1,21 @@
 ---
 name: rustfs-release-publish
-description: "End-to-end RustFS release pipeline: bump version files on main directly to the final target version, cut a preview tag on that commit, verify the CI build and release artifacts, run the downloaded binary locally and exercise the console, validate the server with the latest rc client, then publish the final tag on the SAME validated commit — never a new bump commit, never latest main. Use whenever the user wants to release/publish a RustFS version (发版/发布)."
+description: "End-to-end RustFS release pipeline: first publish any merged-but-unreleased rustfs/console changes and wait for its latest Release asset, then bump RustFS version files on main directly to the final target, publish a visible GitHub prerelease from a preview tag without updating latest channels, validate it, and publish the final tag on the SAME commit. Use whenever the user wants to release/publish a RustFS version (发版/发布)."
 ---
 # RustFS Release Publish (preview-validated pipeline)

 This skill orchestrates a full release. It wraps `rustfs-release-version-bump` (which only edits version files and opens the PR) with a mandatory preview-tag validation loop before the final tag is published.

-Core design: **version files never carry a `-preview.N` suffix**. The preview suffix exists only in tag names. This works because the binary self-reports the git tag it was built from (`build::TAG` via shadow_rs, see `rustfs/src/config/cli.rs` `SHORT_VERSION`), and `build.yml` derives artifact names and prerelease classification from the tag name — Cargo.toml's version is only a no-tag fallback. Therefore the preview tag and the final tag can (and MUST) point at the exact same commit: what you validated is byte-for-byte the source that ships.
+Core design: **version files never carry a `-preview.N` suffix**. The preview suffix exists only in tag names. A preview tag creates a visible GitHub Release marked Prerelease and uploads versioned assets, but it never becomes GitHub Latest and never updates `*-latest`, `latest.json`, R2, Docker, or Helm channels. This works because the binary self-reports the git tag it was built from (`build::TAG` via shadow_rs, see `rustfs/src/config/cli.rs` `SHORT_VERSION`), and `build.yml` derives artifact names and preview classification from the tag name — Cargo.toml's version is only a no-tag fallback. Therefore the preview tag and the final tag can (and MUST) point at the exact same commit: what you validated is byte-for-byte the source that ships.

 Pipeline shape:

 ```
-bump version files to <target> (final version, ONE commit) -> merge
+check console main against its latest Release
+  -> if ahead: publish console -> wait for Release asset + latest API
+  -> bump RustFS version files to <target> (final version, ONE commit) -> merge
  -> tag <preview-tag> at that commit -> CI green
-  -> verify release artifacts -> run binary locally + console checks
+  -> verify preview Release assets -> run binary locally + console checks
  -> validate with latest rc client
  -> tag <target> at the SAME commit (zero delta) -> re-verify CI/release
 ```
@@ -23,7 +25,7 @@ On validation failure: fix lands on main via normal PR (version files are alread
 ## Required inputs

 - Final target version, for example `1.0.0-beta.10`.
- Preview iteration `N` (default: next unused preview tag for that target; check with `git tag -l '<target>-preview.*'` — and for stable targets `git tag -l '<target>-rc.*'` — after `git fetch --tags`).
+- Preview iteration `N` (default: next unused preview tag for that target; check with `git tag -l '<target>-preview.*'` after `git fetch --tags`).

 If the target version is missing or ambiguous, stop and ask before doing anything (see the semver gate below).

@@ -45,14 +47,18 @@ Rules:

 ## Preview tag naming

- Prerelease target (contains `alpha`/`beta`/`rc`): preview tag is `<target>-preview.N`, e.g. `1.0.0-beta.10-preview.3`. It contains `beta`, so `build.yml`'s substring-based classification marks it prerelease — safe.
- **Stable** target (e.g. `1.1.0`): NEVER tag `1.1.0-preview.N` — `build.yml` marks a tag prerelease only if its name contains `alpha`, `beta`, or `rc`, so `1.1.0-preview.N` would be treated as a stable release and overwrite `latest.json` as stable. Use `1.1.0-rc.N` as the preview tag instead.
+- Use `<target>-preview.N` for every target, e.g. `1.0.0-beta.10-preview.3` or `1.1.0-preview.1`.
+- The canonical suffix is exactly `-preview.<digits>`. `build.yml` recognizes it before alpha/beta/rc classification and routes it to the preview-only path; any other tag containing `-preview` fails closed instead of being treated as a release.
+- A preview Release MUST be published with `isPrerelease=true` and `isLatest=false`. Any `*-latest` preview asset or preview-triggered `latest.json`, R2, Docker, or Helm publication is a pipeline failure.

 ## Hard rules

 - Version files (Cargo.toml, Cargo.lock, README, flake.nix, Chart.yaml, rustfs.spec) are bumped ONCE, directly to `<target>`. Never write a `-preview.N` suffix into any version file. If `rustfs-release-version-bump` is ever asked for a `-preview` version, that is a pipeline bug — stop.
+- Preview Release assets are versioned and intentionally visible on the Releases page. Do not label them Latest or use them to update any latest distribution channel.
 - Tags have no `v` prefix. Always annotated: `git tag -a <tag> -m "Release <tag>"`.
 - The final tag MUST point at exactly `PREVIEW_HASH` — the commit the validated preview tag points at. Never tag current `main` HEAD (commits merged after validation are unvalidated), and never create an extra version-bump commit between preview and final.
+- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
+- Generated Release notes carry a workflow-management marker so retries can repair them. Before manually curating a generated body, remove that marker; unmarked non-placeholder notes are preserved by later workflow runs.
 - Phases run in order; a failure in any phase blocks everything after it. After the fix lands on main, restart from Phase 2 with the next preview iteration against the new `origin/main` hash — do not resume mid-pipeline against a stale hash.
 - If the release is abandoned after Phase 1 merged, main's version files claim a version that was never tagged. Either revert the bump PR or leave it to be overwritten by the next release — but tell the user explicitly and record the decision.
 - User-facing status updates in Chinese; commits, PR titles/bodies, and tag messages in English. No hard-wrapping in commit messages, PR bodies, or documentation prose — one logical line per sentence/paragraph, let soft wrap handle display.
@@ -63,6 +69,61 @@ Rules:
 - `gh auth status` works; confirm you can view `gh release list -L 3`.
 - Confirm the exact final target version with the user if not explicit.

+### Console release gate
+
+Complete this gate before changing any RustFS version file or creating any RustFS tag. RustFS `build.yml` downloads the asset returned by `repos/rustfs/console/releases/latest`, so a successful Console build alone is insufficient.
+
+1. Read the latest published Console tag and compare it with Console `main`:
+
+```bash
+CONSOLE_REPO="rustfs/console"
+CONSOLE_LATEST=$(gh api "repos/${CONSOLE_REPO}/releases/latest" --jq .tag_name)
+gh api "repos/${CONSOLE_REPO}/compare/${CONSOLE_LATEST}...main" \
+  --jq '{status, ahead_by, behind_by, commits: [.commits[] | {sha, message: .commit.message}]}'
+```
+
+- `ahead_by == 0`: no merged Console change is waiting for release. Still verify the current latest asset using step 4, then continue to Phase 1.
+- `ahead_by > 0` and `behind_by == 0`: publish Console before continuing. Report the merged commits and select the next unused `vX.Y.Z` tag. Default to the next patch version when the changes are fixes or backward-compatible UI work; stop for confirmation if a minor/major bump is plausible.
+- Any diverged history or `behind_by > 0`: stop and resolve the Console release baseline explicitly. Do not guess a range or publish RustFS.
+
+2. Clone/fetch `rustfs/console` into a scratch directory and record its exact `main` commit. Before creating a tag, check for a `v*` tag or Release workflow already associated with that hash. If one is in progress, wait for it instead of creating another version:
+
+```bash
+CONSOLE_SCRATCH=$(mktemp -d)
+gh repo clone "$CONSOLE_REPO" "$CONSOLE_SCRATCH/console"
+git -C "$CONSOLE_SCRATCH/console" fetch origin main --tags
+CONSOLE_HASH=$(git -C "$CONSOLE_SCRATCH/console" rev-parse origin/main)
+git -C "$CONSOLE_SCRATCH/console" tag --points-at "$CONSOLE_HASH" 'v*'
+gh run list -R "$CONSOLE_REPO" --workflow release.yml --commit "$CONSOLE_HASH" --limit 5
+```
+
+If no release exists or is running for `CONSOLE_HASH`, create the selected annotated tag at that exact hash and push it:
+
+```bash
+git -C "$CONSOLE_SCRATCH/console" tag -a "<console-tag>" -m "Release <console-tag>" "$CONSOLE_HASH"
+git -C "$CONSOLE_SCRATCH/console" push origin "<console-tag>"
+```
+
+Console tags include the `v` prefix. Pushing the tag triggers `.github/workflows/release.yml` (`🚀 Release`). Remove `CONSOLE_SCRATCH` after the gate completes.
+
+3. Find the exact tag run and wait for completion:
+
+```bash
+gh run list -R "$CONSOLE_REPO" --workflow release.yml --branch "<console-tag>" --limit 1
+gh run watch -R "$CONSOLE_REPO" "<console-run-id>" --exit-status
+```
+
+4. Block until the published Release is non-draft, the latest endpoint returns the expected tag, and `rustfs-console-<console-tag>.zip` is uploaded, non-empty, and carries a `sha256:` digest:
+
+```bash
+gh release view -R "$CONSOLE_REPO" "<console-tag>" --json isDraft,isPrerelease,assets,url
+test "$(gh api "repos/${CONSOLE_REPO}/releases/latest" --jq .tag_name)" = "<console-tag>"
+test "$(gh api "repos/${CONSOLE_REPO}/releases/tags/<console-tag>" \
+  --jq '[.assets[] | select(.name == "rustfs-console-<console-tag>.zip" and .state == "uploaded" and .size > 0 and (.digest | startswith("sha256:")))] | length')" -eq 1
+```
+
+Treat a missing/mismatched asset, digest, latest tag, or failed/cancelled workflow as BLOCKED. Do not start Phase 1 until the Console gate passes. Record `CONSOLE_TAG`, `CONSOLE_HASH`, Console run URL, and Release URL for the final report.
+
 ## Phase 1 — Version bump to the final target (once)

 - If main's version files already read `<target>` (e.g. this is a restart after a failed preview), verify with `rg -n "<target>" Cargo.toml rustfs.spec helm/rustfs/Chart.yaml` and skip to Phase 2.
@@ -85,16 +146,17 @@ git push origin "<preview-tag>"

 Pushing the tag triggers `.github/workflows/build.yml` ("Build and Release"); `docker.yml` chains off it via `workflow_run`.

+The preview run builds versioned artifacts and publishes them in a GitHub prerelease. Its latest-channel, R2, Docker, and Helm jobs must be skipped. Those publication paths run only after the final tag is pushed.
+
 On a restart (N+1), refresh `PREVIEW_HASH=$(git rev-parse origin/main)` first — it must contain the fix — and re-report it.

-## Phase 3 — CI and artifact verification
+## Phase 3 — CI and preview Release verification

- Watch the tag build: `gh run list --workflow build.yml --limit 5` then `gh run watch <run-id>`. Every matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64) plus the release and latest.json jobs.
- Verify the GitHub release: `gh release view "<preview-tag>" --json isPrerelease,assets`
-  - `isPrerelease` must be `true`.
-  - Assets must include all 6 platform zips in both versioned (`rustfs-<platform>-v<tag>.zip`) and `-latest` forms, plus `SHA256SUMS`, `SHA512SUMS`, `rustfs-<tag>.sbom.cdx.json`, `rustfs-<tag>.provenance.json`.
- Verify the chained Docker run succeeded: `gh run list --workflow docker.yml --limit 3`.
- Checksum spot-check for the platform you will run locally: download the zip and `SHA256SUMS`, verify with `shasum -a 256 -c` (grep to one line).
+- Find and watch the tag build: `gh run list --workflow build.yml --branch "<preview-tag>" --limit 1` then `gh run watch <run-id>`. Every build matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64).
+- Confirm the Release publication jobs (`create-release`, `upload-release-assets`, and `publish-release`) succeed while `update-latest-version` is skipped.
+- Verify `gh release view "<preview-tag>" --json isPrerelease,assets,url`: `isPrerelease` must be `true`, and the Release must contain all 6 versioned platform zips, checksums, SBOM, and provenance with no `-latest` assets. Confirm `gh api repos/{owner}/{repo}/releases/latest --jq .tag_name` does not return `<preview-tag>`.
+- Record `PREVIOUS_DELIVERABLE`, selected from published Releases by `publishedAt` after excluding the current tag and every `-preview.N` tag. Verify `gh release view "<preview-tag>" --json body --jq .body` contains `## What's Changed` and, when `PREVIOUS_DELIVERABLE` exists, `**Full Changelog**: https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<preview-tag>`. For a repository with no previous deliverable, verify a Full Changelog link exists and record the GitHub baseline fallback.
+- Confirm preview-triggered Docker and Helm jobs are skipped. Preview validation covers the built RustFS binaries, embedded console, and rc compatibility; Docker image construction and Helm publication are deferred to the final tag because the Dockerfiles consume GitHub Release assets.

 ## Phase 4 — Run the artifact locally, verify the console

@@ -157,13 +219,15 @@ git push origin "<target>"
 ```

 - CI rebuilds from the same source; the only changed input is the tag name, so the binary now self-reports `<target>`.
- Re-run the Phase 3 verification against the final tag: all matrix jobs green; `gh release view "<target>"` shows the full asset set; for a prerelease target `isPrerelease` is `true`, for a stable target it must be `false` and `latest.json` must be updated.
+- Verify the final tag's complete publication path: all matrix and release jobs green; `gh release view "<target>"` shows the full versioned and `-latest` asset set plus checksums, SBOM, and provenance; Docker and Helm workflows succeed; `latest.json` points to `<target>`. A stable target must have `isPrerelease=false` and `isLatest=true`. An alpha/beta/rc target must have `isPrerelease=true`; GitHub does not permit prereleases to be Latest, but the project `latest.json` still advances to the final non-preview target.
+- Verify the final Release body contains `## What's Changed` and a Full Changelog link. When `PREVIOUS_DELIVERABLE` exists, the link MUST be `https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<target>` and the baseline MUST equal the preview Release baseline; for example, both `1.0.0-beta.12-preview.1` and `1.0.0-beta.12` compare from `1.0.0-beta.11`.
 - Optionally spot-check `./rustfs --version` from a final-tag artifact — it must report `<target>`.

 ## Output contract

 Always report:

+- Console gate result: previous/latest Console tags, whether merged changes required a release, `CONSOLE_HASH`, and Console run/Release URLs when a release was published.
 - Target version, preview tag(s) used, `PREVIEW_HASH` (which both tags point at).
- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: CI run URLs, release URLs, console check results, the rc command matrix.
+- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: preview and final Release URLs, preview `isPrerelease`/`isLatest` state, final latest-channel state, console check results, and the rc command matrix.
 - Any deviation from this pipeline and why the user approved it.
@@ -18,7 +18,7 @@ Validated baseline: release pattern used in PR `#2957`.

 If target version is missing or ambiguous, stop and ask before editing.

-Reject any target version containing a `-preview.` suffix: preview identifiers are tag-only (see `rustfs-release-publish`) and must never be written into version files. If asked for one, stop and point to the release pipeline instead of editing.
+Reject any target version containing `-preview`: preview identifiers are tag-only (see `rustfs-release-publish`) and must never be written into version files. If asked for one, stop and point to the release pipeline instead of editing.

 ## Read before editing

@@ -99,6 +99,8 @@ For the full pattern map, read [advisory-patterns.md](references/advisory-patter
 ### Logging and debug output
 - Logs must never include access keys beyond safe identifiers, secret keys, session tokens, JWT claims, HMAC secrets, expected signatures, license secrets, or raw response bodies containing credentials.
 - Treat `Debug` implementations, `?value` tracing, merged config dumps, and dependency-level HTTP body logging as leak surfaces.
+- Error and panic messages are log content: they propagate through `?` and get printed by `error!`/startup logging far from where they were constructed. Never interpolate a raw config or credential value into an error string.
+- A value that fails secret-format parsing is usually the secret itself (e.g. a bare base64 key missing its `<name>:` prefix), so a parse-failure hint must name the env var or file and the expected format, never echo the input. Redacting `Debug` impls does not cover this channel.
 - Add log-capture tests or targeted unit tests for redaction wrappers when changing credential structs or response bodies.

 ### RPC, parsing, and panic safety
@@ -139,6 +141,7 @@ Use these prompts while reviewing a diff:
 - Does a public/default/empty config change security behavior from fail-closed to fail-open?
 - Is any attacker-controlled value later used as a path, policy condition, credential identity, log field, URL, Origin, or response body?
 - Does this response contain stored replication, remote target, or service credentials that need redaction or stricter authorization?
+- Does any error constructor or `format!` interpolate a variable that can hold secret material, including a config parse error that echoes the raw input?
 - Does an IAM export/import path expose or trust plaintext credential secrets beyond the caller's intended authority?
 - Can this STS/OIDC path issue credentials without SigV4, trusted issuer validation, allowlisted redirects, or trusted-proxy host/scheme handling?
 - Can a service-account or STS token omit `exp`, forge `sessionPolicy`, or use a principal-controlled key as signing authority?
@@ -26,6 +26,11 @@ script-tests: ## Run shell script tests
 	@echo "Running script tests..."
 	./scripts/test_build_rustfs_options.sh
 	./scripts/test_entrypoint_credentials.sh
+	./scripts/test_internode_grpc_ab_bench.sh
+	./scripts/test_object_batch_bench_enhanced.sh
+	./scripts/test_exact_1mib_handoff_abba.sh
+	./scripts/test_pinned_paired_abba_bench.sh
+	./scripts/test_manual_transition_runbooks.sh
 	bash -n ./scripts/validate_object_data_cache_cold_stampede.sh
 	python3 ./scripts/check_object_data_cache_follower_samples.py --self-test
 	./scripts/validate_object_data_cache_cold_stampede.sh --self-test
@@ -1,17 +1,14 @@
 # nextest configuration for RustFS.
 #
-# Serialize two known load-sensitive / global-state-sharing ecstore test groups
-# so the full parallel nextest suite stops producing spurious failures
-# (backlog #937). These tests pass in isolation but flake under the loaded
-# parallel run for two distinct reasons:
+# Serialize the ecstore tests that share the process-wide disk registry or
+# exercise a multi-disk commit handoff across nextest process boundaries.
 #
 #   * store::bucket::tests::bucket_delete_* share process/global state (disk
 #     registry, lock client) and race make_bucket into InsufficientWriteQuorum
 #     when run concurrently with other ecstore tests.
 #   * bucket_lifecycle_ops::tests::concurrent_resend_same_part_commits_one_generation
-#     asserts a lock-acquire correctness property whose serialized cross-disk
-#     commits exceed the (already max'd, 60s) acquire deadline only when the
-#     suite saturates disk I/O.
+#     uses the shared multipart fixture and a deterministic uploadId-lock
+#     handoff, so it must not overlap another process mutating that fixture.
 #
 # serial_test's #[serial] attribute does NOT serialize these across runs:
 # nextest executes each test in its own process, where the in-process
@@ -39,6 +36,7 @@ ecstore-serial-flaky = { max-threads = 1 }
 # servers never run at once. ci-7's nightly picks these up via the e2e suite;
 # they are deliberately NOT in the fast PR `e2e-smoke` filter.
 e2e-reliability = { max-threads = 1 }
+e2e-inline-boundaries = { max-threads = 1 }

 # --- default profile (local): serialize the flaky groups, never retry --------
 [[profile.default.overrides]]
@@ -54,6 +52,12 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::multipart::tests::crash_consistency::/)'
 test-group = 'ecstore-serial-flaky'

+# Serialize the durable manual-transition checkpoint test across nextest's
+# process boundary; it mutates bucket lifecycle metadata and is not quarantined.
+[[profile.default.overrides]]
+filter = 'package(rustfs-ecstore) & test(manual_transition_page_checkpoint_persists_durable_job_progress)'
+test-group = 'ecstore-serial-flaky'
+
 # Serialize the 4-disk reliability / degraded-read e2e tests (see the
 # e2e-reliability test-group note above). The matching ci-profile override is at
 # the end of the file, after [profile.ci] is declared.
@@ -61,6 +65,10 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression)_test::/)'
 test-group = 'e2e-reliability'

+[[profile.default.overrides]]
+filter = 'package(e2e_test) & test(/^inline_fast_path_cluster_test::/)'
+test-group = 'e2e-inline-boundaries'
+
 # ---------------------------------------------------------------------------
 # ci profile — the strict CI gate (ci.yml `cargo nextest run --profile ci`)
 # ---------------------------------------------------------------------------
@@ -89,13 +97,6 @@ path = "junit.xml"
 # profile's own overrides list, not the default profile's).
 # ===========================================================================

-# QUARANTINE: OPEN backlog#937 — concurrent_resend lock-acquire deadline flakes
-# under saturated disk I/O in the full parallel suite.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(concurrent_resend_same_part_commits_one_generation)'
-test-group = 'ecstore-serial-flaky'
-retries = 2
-
 # QUARANTINE: OPEN backlog#937 — store::bucket::tests::bucket_delete_* race
 # make_bucket into InsufficientWriteQuorum via shared global state under load.
 [[profile.ci.overrides]]
@@ -103,6 +104,11 @@ filter = 'package(rustfs-ecstore) & test(/^store::bucket::tests::bucket_delete_(
 test-group = 'ecstore-serial-flaky'
 retries = 2

+# Keep the deterministic multipart handoff isolated across nextest processes.
+[[profile.ci.overrides]]
+filter = 'package(rustfs-ecstore) & test(concurrent_resend_same_part_commits_one_generation)'
+test-group = 'ecstore-serial-flaky'
+
 # QUARANTINE: OPEN rustfs#4690 — walk_dir stall-budget accounting test depends
 # on producer/consumer timing windows that stretch past the budget on loaded
 # CI runners (regression test for rustfs#4644; failed on a zero-Rust-diff PR).
@@ -125,6 +131,12 @@ test-group = 'e2e-reliability'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::multipart::tests::crash_consistency::/)'
 test-group = 'ecstore-serial-flaky'

+# Serialize the durable manual-transition checkpoint test under the ci profile
+# too. No retries: failures stay visible.
+[[profile.ci.overrides]]
+filter = 'package(rustfs-ecstore) & test(manual_transition_page_checkpoint_persists_durable_job_progress)'
+test-group = 'ecstore-serial-flaky'
+
 # ---------------------------------------------------------------------------
 # e2e-smoke profile — PR smoke subset of the e2e_test crate (backlog#1149 ci-4)
 # ---------------------------------------------------------------------------
@@ -156,7 +168,7 @@ test-group = 'ecstore-serial-flaky'
 # the nightly profile derives its set as "the replication module MINUS this
 # allowlist", so any new replication test lands in nightly by default (never
 # silently unrun) until it is explicitly blessed as fast here. Keep the two
-# regexes byte-identical. Count invariant: 20 here + 27 nightly = 47 total
+# regexes byte-identical. Count invariant: 20 here + 28 nightly = 48 total
 # (authority: `cargo nextest list`; docs/testing/e2e-suite-inventory.md).
 # HISTORY (2026-07-11): the 20 fast tests were briefly pulled out of this lane
 # (#4724) because they set a loopback (127.0.0.1) replication target that the
@@ -192,7 +204,7 @@ test-group = 'ecstore-serial-flaky'
 [profile.e2e-smoke]
 default-filter = """
    package(e2e_test) & (
-        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_source_invalid_date|content_encoding|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools)_test::|^fake_s3_target::/)
+        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|multipart_storage_class|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat)_test::|^fake_s3_target::/)
        | test(/^replication_extension_test::(test_replication_check_succeeds_with_remote_target|test_replication_check_rejects_target_without_object_lock|test_set_remote_target_rejects_unversioned_source_bucket|test_replication_check_rejects_unversioned_source_bucket|test_replication_check_rejects_missing_replication_config|test_replication_check_rejects_invalid_bucket|test_set_remote_target_rejects_same_bucket_on_same_deployment|test_set_remote_target_rejects_unversioned_target_bucket|test_set_remote_target_update_requires_arn|test_set_remote_target_update_rejects_missing_target|test_set_remote_target_rejects_invalid_target_url|test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify|test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem|test_list_remote_targets_rejects_empty_bucket|test_list_remote_targets_rejects_invalid_bucket|test_remove_remote_target_rejects_missing_target|test_remove_remote_target_rejects_missing_arn|test_remove_remote_target_rejects_invalid_bucket|test_remove_remote_target_rejects_target_used_by_replication|test_delete_bucket_replication_removes_remote_target)$/)
        | test(/^reliant::lifecycle::/)
        | test(/^reliant::tiering::/)
@@ -211,7 +223,7 @@ fail-fast = false
 #     and poll until source and target converge; two replicate over HTTPS, two
 #     pin active SSE failure contracts, and one guards event/history observers.
 #     The SSE-S3 contract remains ignored under backlog#1291.
-#   * 11 `_real_dual_node` site-replication tests — each spawns TWO full rustfs
+#   * 12 `_real_dual_node` site-replication tests — each spawns TWO full rustfs
 #     servers and drives the cross-process site-replication control plane.
 #   * 1 `_real_three_node` site-replication test.
 #   * 1 `_real_single_node` service-account round-trip test.
@@ -314,3 +326,7 @@ path = "junit.xml"
 [[profile.e2e-full.overrides]]
 filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression)_test::/)'
 test-group = 'e2e-reliability'
+
+[[profile.e2e-full.overrides]]
+filter = 'package(e2e_test) & test(/^inline_fast_path_cluster_test::/)'
+test-group = 'e2e-inline-boundaries'
@@ -60,6 +60,16 @@ The file `prometheus-rules/rustfs-get-optimization-alerts.yaml` contains pre-con
 | `CodecStreamingFallbackSpike` | Warning | Codec streaming fallback > 10x baseline for 10m |
 | `IoQueueSaturation` | Warning | IO queue utilization > 90% for 5m |

+The file `prometheus-rules/rustfs-kms-alerts.yml` contains alerting rules for the KMS backend operation metrics. Thresholds are conservative defaults pending staging baseline calibration; response procedures live in `docs/operations/kms-observability-runbook.md`, and the matching dashboard is `deploy/observability/grafana/rustfs-kms-observability.json`.
+
+| Alert | Severity | Condition |
+|-------|----------|-----------|
+| `KmsBackendFatalErrors` | Critical | Fatal (non-retryable) attempt failures > 0 for 5m |
+| `KmsBackendHighErrorRate` | Critical | Non-success operation ratio > 5% for 10m (with traffic guard) |
+| `KmsBackendP99LatencyHigh` | Warning | Operation p99 duration (incl. retries) > 2s for 10m |
+| `KmsBackendAttemptFailureSpike` | Warning | Attempt failure rate > 0.5/s for 10m |
+| `KmsBackendRetryBudgetExhausted` | Warning | budget_exhausted / deadline_exceeded outcomes > 0.05/s for 10m |
+
 ### Enabling Alert Rules

 Add the alert rules file to your Prometheus configuration:
@@ -60,6 +60,16 @@
 | `CodecStreamingFallbackSpike` | 警告 | Codec streaming 回退 > 10x 基线，持续 10 分钟 |
 | `IoQueueSaturation` | 警告 | IO 队列利用率 > 90%，持续 5 分钟 |

+文件 `prometheus-rules/rustfs-kms-alerts.yml` 包含 KMS 后端操作指标的告警规则。阈值为保守默认值，待 staging 基线校准；响应流程见 `docs/operations/kms-observability-runbook.md`，配套仪表盘为 `deploy/observability/grafana/rustfs-kms-observability.json`。
+
+| 告警 | 级别 | 条件 |
+|------|------|------|
+| `KmsBackendFatalErrors` | 严重 | fatal（不可重试）尝试失败 > 0，持续 5 分钟 |
+| `KmsBackendHighErrorRate` | 严重 | 非 success 操作占比 > 5%，持续 10 分钟（含流量下限保护） |
+| `KmsBackendP99LatencyHigh` | 警告 | 操作 p99 耗时（含重试）> 2s，持续 10 分钟 |
+| `KmsBackendAttemptFailureSpike` | 警告 | 尝试失败率 > 0.5/s，持续 10 分钟 |
+| `KmsBackendRetryBudgetExhausted` | 警告 | budget_exhausted / deadline_exceeded 结果 > 0.05/s，持续 10 分钟 |
+
 ### 启用告警规则

 在 Prometheus 配置中添加告警规则文件：
@@ -0,0 +1,188 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# =============================================================================
+# RustFS KMS backend — Prometheus alerting rules
+# =============================================================================
+#
+# Metric source: the KMS operation-policy choke point in
+# crates/kms/src/policy.rs. All label values are static enum strings
+# (operation, op_class, outcome, error_class); key identifiers, key material,
+# and tokens never appear in labels.
+#
+# Response procedures: docs/operations/kms-observability-runbook.md
+#
+# IMPORTANT — threshold status: every numeric threshold below is a
+# conservative default chosen without a production baseline. Calibrate against
+# a staging baseline before relying on these alerts for paging, and prefer
+# loosening over tightening until the baseline exists. Formal SLO targets are
+# deliberately not encoded here (see rustfs/backlog#1584).
+#
+# NOTE: prometheus.yml loads /etc/prometheus/rules/*.yml — keep the .yml
+# extension or the file is silently ignored by the docker-compose stack.
+#
+# Validate: promtool check rules rustfs-kms-alerts.yml
+# =============================================================================
+
+groups:
+  # ==========================================================================
+  # Critical alerts — immediate action required
+  # ==========================================================================
+  - name: rustfs-kms-critical
+    interval: 30s
+    rules:
+      # ------------------------------------------------------------------
+      # 1. KmsBackendFatalErrors
+      #    Any attempt failure classified as fatal (non-retryable): auth
+      #    or permission errors, malformed requests, missing keys. The
+      #    policy never retries these, so even a low rate means real
+      #    operations are failing right now.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendFatalErrors
+        expr: |
+          sum by (operation) (rate(rustfs_kms_backend_attempt_failures_total{error_class="fatal"}[5m])) > 0
+        for: 5m
+        labels:
+          severity: critical
+          component: kms
+        annotations:
+          summary: "KMS backend fatal errors on operation {{ $labels.operation }}"
+          description: >-
+            Attempt failures classified as fatal are occurring at
+            {{ $value | printf "%.3f" }}/s on operation
+            {{ $labels.operation }}. Fatal failures are not retried:
+            each one is a KMS backend call that failed permanently
+            (authentication, permissions, malformed request, or a
+            missing key/version).
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendfatalerrors"
+
+      # ------------------------------------------------------------------
+      # 2. KmsBackendHighErrorRate
+      #    Sustained share of operations terminating without success
+      #    (fatal, budget_exhausted, deadline_exceeded). The cancelled
+      #    outcome is excluded because shutdowns legitimately produce it.
+      #    The traffic guard keeps a single failure on a near-idle
+      #    cluster from firing the alert.
+      #    Threshold: 5% for 10m — conservative default, calibrate
+      #    against a staging baseline.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendHighErrorRate
+        expr: |
+          (
+            sum(rate(rustfs_kms_backend_operations_total{outcome!~"success|cancelled"}[5m]))
+            /
+            clamp_min(sum(rate(rustfs_kms_backend_operations_total[5m])), 1e-9)
+          ) > 0.05
+          and
+          sum(rate(rustfs_kms_backend_operations_total[5m])) > 0.02
+        for: 10m
+        labels:
+          severity: critical
+          component: kms
+        annotations:
+          summary: "KMS backend non-success ratio above 5% for 10m"
+          description: >-
+            {{ $value | humanizePercentage }} of KMS backend operations
+            are terminating in fatal, budget_exhausted, or
+            deadline_exceeded. Object encryption and decryption paths
+            depending on the KMS are degraded or failing.
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendhigherrorrate"
+
+  # ==========================================================================
+  # Warning alerts — investigation needed
+  # ==========================================================================
+  - name: rustfs-kms-warning
+    interval: 30s
+    rules:
+      # ------------------------------------------------------------------
+      # 3. KmsBackendP99LatencyHigh
+      #    p99 wall-clock duration of whole operations (attempts plus
+      #    backoff) is sustained above 2 seconds. Because the histogram
+      #    includes retries, a high p99 usually means the retry policy
+      #    is absorbing backend failures, not that every call is slow.
+      #    Threshold: 2s for 10m — conservative default, calibrate
+      #    against a staging baseline.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendP99LatencyHigh
+        expr: |
+          histogram_quantile(0.99,
+            sum by (le) (rate(rustfs_kms_backend_operation_duration_seconds_bucket[5m]))
+          ) > 2
+        for: 10m
+        labels:
+          severity: warning
+          component: kms
+        annotations:
+          summary: "KMS backend operation p99 latency above 2s for 10m"
+          description: >-
+            The 99th-percentile KMS backend operation duration is
+            {{ $value | humanizeDuration }}, including retries and
+            backoff. Encryption and decryption latency is leaking into
+            S3 request latency.
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendp99latencyhigh"
+
+      # ------------------------------------------------------------------
+      # 4. KmsBackendAttemptFailureSpike
+      #    Aggregate attempt-failure rate (all error classes) sustained
+      #    above an absolute floor. An absolute threshold is used instead
+      #    of an offset-1d baseline ratio because fresh deployments have
+      #    no baseline and an empty offset vector would keep a ratio
+      #    alert from ever firing; switch to a baseline-relative form
+      #    (see rustfs-get-optimization-alerts.yaml for the pattern)
+      #    once a stable staging baseline exists.
+      #    Threshold: 0.5/s for 10m — conservative default, calibrate
+      #    against a staging baseline.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendAttemptFailureSpike
+        expr: |
+          sum(rate(rustfs_kms_backend_attempt_failures_total[5m])) > 0.5
+        for: 10m
+        labels:
+          severity: warning
+          component: kms
+        annotations:
+          summary: "KMS backend attempt failures above 0.5/s for 10m"
+          description: >-
+            KMS backend attempts are failing at
+            {{ $value | printf "%.2f" }}/s across all error classes.
+            The retry policy may still be masking these from callers —
+            check the error-class breakdown before it stops absorbing
+            them.
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendattemptfailurespike"
+
+      # ------------------------------------------------------------------
+      # 5. KmsBackendRetryBudgetExhausted
+      #    Operations are running out of retry budget (budget_exhausted)
+      #    or operation deadline (deadline_exceeded). These surface to
+      #    callers as failed KMS operations even though every individual
+      #    failure was retryable — the backend is unhealthy for longer
+      #    than the policy can bridge.
+      #    Threshold: 0.05/s for 10m — conservative default, calibrate
+      #    against a staging baseline.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendRetryBudgetExhausted
+        expr: |
+          sum by (outcome) (rate(rustfs_kms_backend_operations_total{outcome=~"budget_exhausted|deadline_exceeded"}[5m])) > 0.05
+        for: 10m
+        labels:
+          severity: warning
+          component: kms
+        annotations:
+          summary: "KMS backend operations exhausting retry budget ({{ $labels.outcome }})"
+          description: >-
+            KMS backend operations are terminating as
+            {{ $labels.outcome }} at {{ $value | printf "%.3f" }}/s.
+            Retryable failures are outlasting the retry budget, so
+            callers are seeing hard failures.
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendretrybudgetexhausted"
@@ -25,9 +25,13 @@ inputs:
    required: false
    default: "rustfs-deps"
  cache-save-if:
-    description: "Condition for saving cache"
+    description: >-
+      Whether to save the cache. The fail-safe default is 'false': a caller that
+      wants to populate a cache must opt in explicitly, so a forgotten input
+      costs a cold cache (minutes) rather than silently consuming the
+      repository-wide 10GB Actions cache quota and evicting other lanes.
    required: false
-    default: "true"
+    default: "false"
  install-cross-tools:
    description: "Install cross-compilation tools"
    required: false
@@ -36,28 +40,43 @@ inputs:
    description: "Target architecture to add"
    required: false
    default: ""
-  github-token:
-    description: "GitHub token for API access"
+  install-build-packaging-tools:
+    description: >-
+      Install musl-tools/zip/unzip, needed for musl linking and release
+      packaging. Off for CI test lanes, which use none of them.
    required: false
-    default: ""
+    default: "true"
+  install-test-tools:
+    description: >-
+      Install cargo-nextest and the rustfmt/clippy components. Off for release
+      and audit lanes, which run no tests and no lints.
+    required: false
+    default: "true"

 runs:
  using: "composite"
  steps:
+    # protobuf-compiler is deliberately absent: the setup-protoc step below
+    # installs 34.1 into the tool cache and prepends it to PATH, so the apt
+    # build (older, and never version-matched) was shadowed on every run and
+    # simply never used.
    - name: Install system dependencies (Ubuntu)
      if: runner.os == 'Linux'
      shell: bash
      run: |
        sudo apt-get update
        sudo apt-get install -y \
-          musl-tools \
          build-essential \
          pkg-config \
          libssl-dev \
-          ripgrep \
-          unzip \
-          zip \
-          protobuf-compiler
+          ripgrep
+
+    # musl-gcc is needed by the native musl release leg, and zip/unzip by the
+    # release packaging steps. No CI test lane touches any of them.
+    - name: Install packaging and cross-linking dependencies (Ubuntu)
+      if: runner.os == 'Linux' && inputs.install-build-packaging-tools == 'true'
+      shell: bash
+      run: sudo apt-get install -y musl-tools zip unzip

    - name: Install protoc
      uses: rustfs/setup-protoc@a3705324d8f9bf5b6c3573fb6cf8ae421db55dd6 # v3.0.1
@@ -75,7 +94,7 @@ runs:
      with:
        toolchain: ${{ inputs.rust-version }}
        targets: ${{ inputs.target }}
-        components: rustfmt, clippy
+        components: ${{ inputs.install-test-tools == 'true' && 'rustfmt, clippy' || '' }}

    - name: Install Zig
      if: inputs.install-cross-tools == 'true'
@@ -86,6 +105,7 @@ runs:
      uses: taiki-e/install-action@a21ae4029b089b9ddc45704028756f51ab8abe48 # cargo-zigbuild

    - name: Install cargo-nextest
+      if: inputs.install-test-tools == 'true'
      uses: taiki-e/install-action@96c7780c1d8a2b8723e12031def873a434d39d8d # nextest

    - name: Setup Rust cache
@@ -37,6 +37,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -45,8 +46,11 @@ jobs:
    name: Architecture Migration Rules
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Install ripgrep
        run: |
@@ -23,6 +23,8 @@ on:
      - 'deny.toml'
      - '.github/actions/**'
      - '.github/workflows/**'
+      - 'scripts/release/create_or_update_release.sh'
+      - 'scripts/security/check_preview_release_workflow.sh'
      - 'scripts/security/check_workflow_pins.sh'
  pull_request:
    types: [ opened, synchronize, reopened, closed ]
@@ -33,9 +35,16 @@ on:
      - 'deny.toml'
      - '.github/actions/**'
      - '.github/workflows/**'
+      - 'scripts/release/create_or_update_release.sh'
+      - 'scripts/security/check_preview_release_workflow.sh'
      - 'scripts/security/check_workflow_pins.sh'
  schedule:
-    - cron: '0 3 * * 0' # Weekly on Sunday 03:00 UTC (staggered after the midnight ci/build crons)
+    # Daily, not weekly. This schedule exists to catch RustSec advisories
+    # published against an unchanged dependency tree; at weekly cadence a new
+    # advisory could sit unnoticed for seven days. The check list is unchanged —
+    # splitting it into a light daily advisories-only run and a weekly full run
+    # would create runs where sources/bans/licenses go unverified.
+    - cron: '0 3 * * *' # Daily 03:00 UTC (staggered after the midnight ci/build crons)
  workflow_dispatch:

 permissions:
@@ -55,6 +64,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -70,11 +80,30 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
        with:
-          cache-shared-key: rustfs-cargo-deny
+          persist-credentials: false
+
+      # cargo-deny compiles nothing, so the full setup composite (apt packages,
+      # protoc, flatc, nextest, rustfmt/clippy) was pure overhead here. It does
+      # still need a real cargo: `cargo deny check` runs `cargo metadata`, and
+      # Cargo.toml pins datafusion and s3s as git dependencies, which must be
+      # materialised into ~/.cargo/git — a cold clone is hundreds of MB, so the
+      # cache stays.
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      # Was relying on the composite's default, which used to be "true": every
+      # PR touching Cargo.toml/Cargo.lock saved a second, PR-scoped copy of this
+      # cache and pushed the main-scoped lanes out of the 10GB quota. The
+      # default is now "false", but state it explicitly — see
+      # scripts/security/check_cache_save_if.sh.
+      - name: Setup Rust cache
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          cache-all-crates: true
+          cache-on-failure: true
+          shared-key: rustfs-cargo-deny
+          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install cargo-deny
        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
@@ -92,13 +121,28 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Report unpinned GitHub Actions
        run: ./scripts/security/check_workflow_pins.sh --enforce

+      - name: Check setup cache-save-if is explicit
+        run: ./scripts/security/check_cache_save_if.sh
+
+      - name: Check every job declares a timeout
+        run: ./scripts/security/check_job_timeouts.sh
+
+      - name: Check checkouts clear their credentials
+        run: ./scripts/security/check_persist_credentials.sh
+
+      - name: Check preview release workflow policy
+        run: ./scripts/security/check_preview_release_workflow.sh
+
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    if: github.event_name == 'pull_request' && github.event.action != 'closed'
    permissions:
      contents: read
@@ -106,6 +150,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
@@ -118,3 +164,28 @@ jobs:
          # conscious re-review of the license/provenance claim (backlog#1181).
          allow-dependencies-licenses: pkg:cargo/rustfs-uring@0.1.0
          comment-summary-in-pr: always
+
+  alert-on-failure:
+    name: Alert on scheduled failure
+    # dependency-review is deliberately excluded: it only runs on pull_request,
+    # so it can never contribute a failure to a scheduled run.
+    needs: [cargo-deny, workflow-pin-report]
+    # A scheduled cargo-deny failure usually means the dependency tree just
+    # matched a newly published advisory — the single most important signal this
+    # workflow produces, and until now it was only visible to whoever happened to
+    # open the Actions tab. Same ci-8 mechanism coverage.yml and
+    # e2e-replication-nightly.yml already use.
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Open or update failure-tracking issue
+        uses: ./.github/actions/schedule-failure-issue
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -50,12 +50,18 @@ on:
      - "**/*.svg"
      - ".gitignore"
      - ".dockerignore"
+      - "flake.lock"
  schedule:
    - cron: "0 1 * * 0" # Weekly on Sunday 01:00 UTC (staggered after the ci.yml midnight cron)
  workflow_dispatch:
    inputs:
      build_docker:
-        description: "Build and push Docker images after binary build"
+        # Advisory only. docker.yml triggers on workflow_run and its job-level
+        # condition requires the triggering event to be a tag push, so a manual
+        # dispatch of this workflow never produces images regardless of this
+        # value. Kept because the summary step reports it; wiring it up would
+        # mean teaching docker.yml's version parser a second event shape.
+        description: "Build and push Docker images after binary build (ignored: dispatch runs never reach docker.yml)"
        required: false
        default: true
        type: boolean
@@ -83,6 +89,7 @@ jobs:
  build-check:
    name: Build Strategy Check
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    outputs:
      should_build: ${{ steps.check.outputs.should_build }}
      build_type: ${{ steps.check.outputs.build_type }}
@@ -92,6 +99,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Determine build strategy
        id: check
@@ -107,13 +116,21 @@ jobs:

          # Determine build type based on trigger
          if [[ "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]]; then
-            # Tag push - release or prerelease
+            # Tag push - preview, release, or prerelease
            should_build=true
            tag_name="${GITHUB_REF#refs/tags/}"
            version="${tag_name}"

-            # Check if this is a prerelease
-            if [[ "$tag_name" == *"alpha"* ]] || [[ "$tag_name" == *"beta"* ]] || [[ "$tag_name" == *"rc"* ]]; then
+            # Preview tags publish a GitHub prerelease for validation, but
+            # must not update any latest channel.
+            if [[ "$tag_name" =~ -preview\.[0-9]+$ ]]; then
+              build_type="preview"
+              is_prerelease=true
+              echo "🔍 Preview build detected: $tag_name"
+            elif [[ "$tag_name" == *"-preview"* ]]; then
+              echo "❌ Invalid preview tag: $tag_name (expected suffix: -preview.<number>)" >&2
+              exit 1
+            elif [[ "$tag_name" == *"alpha"* ]] || [[ "$tag_name" == *"beta"* ]] || [[ "$tag_name" == *"rc"* ]]; then
              build_type="prerelease"
              is_prerelease=true
              echo "🚀 Prerelease build detected: $tag_name"
@@ -156,6 +173,7 @@ jobs:
    name: Prepare Platform Matrix
    needs: build-check
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    outputs:
      matrix: ${{ steps.select.outputs.matrix }}
      selected: ${{ steps.select.outputs.selected }}
@@ -163,10 +181,14 @@ jobs:
      - name: Select target platforms
        id: select
        shell: bash
+        env:
+          # via env, not interpolation: a dispatch input is free-form text and
+          # would otherwise be pasted into the script for bash to evaluate.
+          RAW_PLATFORMS: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.platforms || 'all' }}
        run: |
          set -euo pipefail

-          selected="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.platforms || 'all' }}"
+          selected="$RAW_PLATFORMS"
          selected="$(echo "${selected}" | tr -d '[:space:]')"
          if [[ -z "${selected}" ]]; then
            selected="all"
@@ -237,6 +259,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          persist-credentials: false
          fetch-depth: 0

      - name: Setup Rust environment
@@ -245,9 +268,17 @@ jobs:
          rust-version: stable
          target: ${{ matrix.target }}
          cache-shared-key: build-${{ matrix.target }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
+          # main only. A cache saved on refs/tags/X is scoped to that tag: no
+          # other tag, no main run and no PR can restore it, so every release
+          # cycle wrote up to 12 entries of 1-2GB (preview tag plus final tag,
+          # six legs each) that nobody could read, evicting the hot lanes from
+          # the repo-wide 10GB quota. Tag builds still restore the main-scoped
+          # cache, since default-branch caches are readable from every ref.
+          # The one real cost: re-running a failed leg of the same tag no longer
+          # finds that tag's own warm cache and falls back to main's.
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
          install-cross-tools: ${{ matrix.cross }}
+          install-test-tools: 'false'

      - name: Download static console assets
        shell: bash
@@ -694,9 +725,14 @@ jobs:
    needs: [ build-check, build-rustfs ]
    if: always() && needs.build-check.outputs.should_build == 'true'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Build completion summary
        shell: bash
+        env:
+          # dispatch input via env: free-form text must not be pasted into the
+          # script for bash to evaluate.
+          INPUT_BUILD_DOCKER: ${{ github.event.inputs.build_docker }}
        run: |
          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
          VERSION="${{ needs.build-check.outputs.version }}"
@@ -714,6 +750,10 @@ jobs:
          echo ""

          case "$BUILD_TYPE" in
+            "preview")
+              echo "🔍 Preview artifacts are published in a GitHub prerelease"
+              echo "⏭️  Preview releases do not update latest channels"
+              ;;
            "development")
              echo "🛠️  Development build artifacts have been uploaded to OSS dev directory"
              echo "⚠️  This is a development build - not suitable for production use"
@@ -732,7 +772,9 @@ jobs:

          echo ""
          echo "🐳 Docker Images:"
-          if [[ "${{ github.event.inputs.build_docker }}" == "false" ]]; then
+          if [[ "$BUILD_TYPE" == "preview" ]]; then
+            echo "⏭️  Preview tags do not publish Docker images"
+          elif [[ "$INPUT_BUILD_DOCKER" == "false" ]]; then
            echo "⏭️  Docker image build was skipped (binary only build)"
          elif [[ "$BUILD_STATUS" == "success" ]]; then
            echo "🔄 Docker images will be built and pushed automatically via workflow_run event"
@@ -740,12 +782,13 @@ jobs:
            echo "❌ Docker image build will be skipped due to build failure"
          fi

-  # Create GitHub Release (only for tag pushes)
+  # Create GitHub Release for every valid release tag, including previews
  create-release:
    name: Create GitHub Release
    needs: [ build-check, build-rustfs ]
-    if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    permissions:
      contents: write
    outputs:
@@ -755,6 +798,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          persist-credentials: false
          fetch-depth: 0

      - name: Create GitHub Release
@@ -767,9 +811,12 @@ jobs:
          VERSION="${{ needs.build-check.outputs.version }}"
          IS_PRERELEASE="${{ needs.build-check.outputs.is_prerelease }}"
          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
+          TARGET_COMMITISH=$(git rev-parse --verify "refs/tags/${TAG}^{commit}")

          # Determine release type for title
-          if [[ "$BUILD_TYPE" == "prerelease" ]]; then
+          if [[ "$BUILD_TYPE" == "preview" ]]; then
+            RELEASE_TYPE="preview"
+          elif [[ "$BUILD_TYPE" == "prerelease" ]]; then
            if [[ "$TAG" == *"alpha"* ]]; then
              RELEASE_TYPE="alpha"
            elif [[ "$TAG" == *"beta"* ]]; then
@@ -783,61 +830,34 @@ jobs:
            RELEASE_TYPE="release"
          fi

-          # Check if release already exists
-          if gh release view "$TAG" >/dev/null 2>&1; then
-            echo "Release $TAG already exists"
-            RELEASE_ID=$(gh release view "$TAG" --json databaseId --jq '.databaseId')
-            RELEASE_URL=$(gh release view "$TAG" --json url --jq '.url')
+          # Create release title
+          if [[ "$IS_PRERELEASE" == "true" ]]; then
+            TITLE="RustFS $VERSION (${RELEASE_TYPE})"
          else
-            # Get release notes from tag message
-            RELEASE_NOTES=$(git tag -l --format='%(contents)' "${TAG}")
-            if [[ -z "$RELEASE_NOTES" || "$RELEASE_NOTES" =~ ^[[:space:]]*$ ]]; then
-              if [[ "$IS_PRERELEASE" == "true" ]]; then
-                RELEASE_NOTES="Pre-release ${VERSION} (${RELEASE_TYPE})"
-              else
-                RELEASE_NOTES="Release ${VERSION}"
-              fi
-            fi
-
-            # Create release title
-            if [[ "$IS_PRERELEASE" == "true" ]]; then
-              TITLE="RustFS $VERSION (${RELEASE_TYPE})"
-            else
-              TITLE="RustFS $VERSION"
-            fi
-
-            # Create the release
-            PRERELEASE_FLAG=""
-            if [[ "$IS_PRERELEASE" == "true" ]]; then
-              PRERELEASE_FLAG="--prerelease"
-            fi
-
-            gh release create "$TAG" \
-              --title "$TITLE" \
-              --notes "$RELEASE_NOTES" \
-              $PRERELEASE_FLAG \
-              --draft
-
-            RELEASE_ID=$(gh release view "$TAG" --json databaseId --jq '.databaseId')
-            RELEASE_URL=$(gh release view "$TAG" --json url --jq '.url')
+            TITLE="RustFS $VERSION"
          fi

-          echo "release_id=$RELEASE_ID" >> "$GITHUB_OUTPUT"
-          echo "release_url=$RELEASE_URL" >> "$GITHUB_OUTPUT"
-          echo "Created release: $RELEASE_URL"
+          ./scripts/release/create_or_update_release.sh \
+            "$TAG" \
+            "$TARGET_COMMITISH" \
+            "$TITLE" \
+            "$IS_PRERELEASE"

  # Prepare and upload release assets
  upload-release-assets:
    name: Upload Release Assets
    needs: [ build-check, build-rustfs, create-release ]
-    if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    permissions:
      contents: write
      actions: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download all build artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -920,9 +940,10 @@ jobs:
  # the pointed-to version is a prerelease.
  update-latest-version:
    name: Update Latest Version
-    needs: [ build-check, upload-release-assets ]
-    if: startsWith(github.ref, 'refs/tags/')
+    needs: [ build-check, publish-release ]
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    steps:
      - name: Update latest.json
        env:
@@ -980,51 +1001,34 @@ jobs:
  publish-release:
    name: Publish Release
    needs: [ build-check, create-release, upload-release-assets ]
-    if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    permissions:
      contents: write
    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Update release notes and publish
+      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          TAG="${{ needs.build-check.outputs.version }}"
-          VERSION="${{ needs.build-check.outputs.version }}"
-          IS_PRERELEASE="${{ needs.build-check.outputs.is_prerelease }}"
          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
+          RELEASE_ID="${{ needs.create-release.outputs.release_id }}"

-          # Determine release type
-          if [[ "$BUILD_TYPE" == "prerelease" ]]; then
-            if [[ "$TAG" == *"alpha"* ]]; then
-              RELEASE_TYPE="alpha"
-            elif [[ "$TAG" == *"beta"* ]]; then
-              RELEASE_TYPE="beta"
-            elif [[ "$TAG" == *"rc"* ]]; then
-              RELEASE_TYPE="rc"
-            else
-              RELEASE_TYPE="prerelease"
-            fi
+          # Publish the release and correct its channel state on retries.
+          # Only a stable final release may become GitHub Latest.
+          if [[ "$BUILD_TYPE" == "release" ]]; then
+            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
+              -F draft=false \
+              -F prerelease=false \
+              -f make_latest=true >/dev/null
          else
-            RELEASE_TYPE="release"
+            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
+              -F draft=false \
+              -F prerelease=true \
+              -f make_latest=false >/dev/null
          fi

-          # Get original release notes from tag
-          ORIGINAL_NOTES=$(git tag -l --format='%(contents)' "${TAG}")
-          if [[ -z "$ORIGINAL_NOTES" || "$ORIGINAL_NOTES" =~ ^[[:space:]]*$ ]]; then
-            if [[ "$IS_PRERELEASE" == "true" ]]; then
-              ORIGINAL_NOTES="Pre-release ${VERSION} (${RELEASE_TYPE})"
-            else
-              ORIGINAL_NOTES="Release ${VERSION}"
-            fi
-          fi
-
-          # Publish the release (remove draft status)
-          gh release edit "$TAG" --draft=false
-
          echo "🎉 Released $TAG successfully!"
          echo "📄 Release URL: ${{ needs.create-release.outputs.release_url }}"
@@ -0,0 +1,231 @@
+# Copyright 2026 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Sole writer of the Rust dependency caches that ci.yml restores.
+#
+# Why this is a separate workflow rather than steps inside ci.yml: ci.yml's
+# concurrency group cancels in-progress runs on main pushes, and merges land far
+# faster than its 70-minute pipeline. Measured over 15 consecutive main pushes:
+# 12 cancelled, 2 failed, 0 succeeded. A cancelled run never reaches
+# Swatinem/rust-cache's post step (cache-on-failure does not cover cancellation),
+# so the writer lanes were saving nothing and every PR paid a cold restore —
+# 11.8-20.9 minutes of "Setup Rust environment" against 0.7-3.4 warm.
+#
+# Splitting cache writing out of the test pipeline lets ci.yml keep cancelling
+# superseded runs (which is correct — nobody needs test results for a commit
+# that is already three merges behind) while the caches still get written.
+#
+# The group below deliberately does NOT cancel in progress. GitHub keeps at most
+# one running plus one pending run per group, so a burst of merges collapses
+# into "current run finishes, newest queued run follows" rather than a pile-up.
+# That also bounds this workflow to one self-hosted runner at a time.
+#
+# Each job below owns exactly one shared-key and is the only place that sets
+# cache-save-if to anything but 'false' for it; every lane in ci.yml reads.
+# scripts/security/check_cache_save_if.sh keeps the declarations explicit.
+#
+# The builds are supersets of what the reading lanes compile, because a reader
+# restores only what the writer saved. Feature resolution matters here: a lane
+# built with e2e-test-hooks resolves dependency features differently, which
+# changes -Cmetadata, so the plain build does not cover it. See
+# rustfs/backlog#1600.
+
+name: Cache Warm
+
+on:
+  push:
+    branches: [ main ]
+    # Mirrors ci.yml's push paths-ignore: if a commit cannot change what ci.yml
+    # compiles, it cannot change what ci.yml needs restored either.
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
+      - "deploy/**"
+      - "scripts/dev_*.sh"
+      - "scripts/probe.sh"
+      - "LICENSE*"
+      - ".gitignore"
+      - ".dockerignore"
+      - "README*"
+      - "**/*.png"
+      - "**/*.jpg"
+      - "**/*.svg"
+      - ".github/workflows/build.yml"
+      - ".github/workflows/docker.yml"
+      - ".github/workflows/audit.yml"
+  workflow_dispatch:
+    inputs:
+      emit_timings:
+        description: >-
+          Also emit cargo --timings for the ci-dev build and upload it. Used to
+          decide whether sccache is worth adopting (rustfs/backlog#1601 gate).
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cache-warm
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  # Readers: test-and-lint, test-ilm-integration-serial, build-rustfs-debug-binary,
+  # e2e-tests, e2e-full.
+  warm-ci-dev:
+    name: Warm ci-dev
+    runs-on: sm-standard-4
+    timeout-minutes: 90
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-dev
+          cache-save-if: 'true'
+          install-build-packaging-tools: 'false'
+
+      # --all-targets covers the test binaries nextest builds, including
+      # e2e_test, which test-and-lint's own run excludes. The second build adds
+      # the e2e-test-hooks feature resolution that build-rustfs-debug-binary uses
+      # and that no lint lane enables.
+      # rustfs/backlog#1601 gate. sccache can only cache compilation units whose
+      # --emit includes link, so it covers workspace rlibs and nothing else:
+      # clippy is metadata-only, and the ~100 test binaries, the rustfs bin and
+      # every build script invoke the system linker. Before spending a bucket,
+      # credentials and a supply-chain boundary on it, measure how much of the
+      # build is actually rlib codegen.
+      #
+      # Read from the report: workspace lib codegen as a share of the build, and
+      # s3select-query's own rlib as a share. The plan adopts sccache only above
+      # 50% and 25% respectively; if linking dominates instead, the answer is
+      # mold/lld plus split-debuginfo, which is exactly the part sccache cannot
+      # touch. Off by default — this doubles the ci-dev build.
+      - name: Build ci-dev superset (with --timings)
+        if: inputs.emit_timings
+        env:
+          CARGO_BUILD_JOBS: "2"
+        run: cargo build --workspace --all-targets --timings
+
+      - name: Upload cargo timings report
+        if: inputs.emit_timings
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: cargo-timings-ci-dev
+          path: target/cargo-timings/
+          retention-days: 30
+          if-no-files-found: error
+
+      - name: Build ci-dev superset
+        env:
+          # Same limit ci.yml puts on its nextest step: this builds the same
+          # ~100 workspace test binaries, and three concurrent links saturate the
+          # self-hosted runner's overlay I/O and can wedge Cargo (#5394).
+          CARGO_BUILD_JOBS: "2"
+        run: |
+          cargo build --workspace --all-targets
+          cargo build -p rustfs --bins --features e2e-test-hooks
+
+  # Readers: test-and-lint-rio-v2, build-rustfs-debug-binary-rio-v2.
+  warm-ci-feat-rio:
+    name: Warm ci-feat-rio
+    runs-on: sm-standard-4
+    timeout-minutes: 90
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-feat-rio
+          cache-save-if: 'true'
+          install-build-packaging-tools: 'false'
+
+      - name: Build ci-feat-rio superset
+        run: |
+          cargo build -p rustfs -p rustfs-ecstore --all-targets --features rio-v2
+          cargo build -p rustfs --bins --features rio-v2,e2e-test-hooks
+
+  # Readers: the swift and sftp legs of test-and-lint-protocols. Built in
+  # sequence rather than as `--features swift,sftp`, which is a combination no
+  # lane actually compiles; running both leaves the union in target/.
+  warm-ci-feat-proto:
+    name: Warm ci-feat-proto
+    runs-on: sm-standard-4
+    timeout-minutes: 90
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-feat-proto
+          cache-save-if: 'true'
+          install-build-packaging-tools: 'false'
+
+      - name: Build ci-feat-proto superset
+        run: |
+          cargo build -p rustfs -p rustfs-protocols --all-targets --features swift
+          cargo build -p rustfs -p rustfs-protocols --all-targets --features sftp
+
+  # Reader: uring-integration. Runs on ubuntu-latest to match it: rust-cache's
+  # key covers runner.os and arch but not the runner label or image, so a cache
+  # written on sm-standard-4 would be restored by the hosted runner as if it
+  # belonged to it.
+  warm-ci-uring:
+    name: Warm ci-uring
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-uring
+          cache-save-if: 'true'
+          install-build-packaging-tools: 'false'
+
+      - name: Install build dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
+      - name: Build ci-uring superset
+        run: cargo build -p rustfs-ecstore --all-targets
@@ -12,18 +12,24 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# Companion to ci.yml for the required "Test and Lint" status check.
+# Companion to ci.yml for required status checks.
 #
-# ci.yml skips docs-only pull requests via paths-ignore, but the branch
-# ruleset requires a check named "Test and Lint" — without this workflow a
-# docs-only PR would wait on that check forever. This workflow triggers on
-# exactly the paths ci.yml ignores and reports an instant success under the
-# same job name. Mixed PRs trigger both workflows and the real check still
-# gates: a required check with any failing run blocks the merge.
+# ci.yml skips docs-only pull requests via paths-ignore, but the branch ruleset
+# requires a check named "Test and Lint" — without this workflow a docs-only PR
+# would wait on it forever. This workflow triggers on exactly the paths ci.yml
+# ignores and reports success under the same job name. Mixed PRs trigger both
+# workflows and the real check still gates: a required check with any failing
+# run blocks the merge.
 # https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
 #
+# "Quick Checks" is mirrored here ahead of the ruleset change that will make it
+# required too (rustfs/backlog#1599). Until that change lands this job is
+# inert; mirroring it first is what lets the ruleset change happen without
+# stranding docs-only PRs on a check nobody reports.
+#
 # Keep the paths list below in sync with the pull_request paths-ignore list
-# in ci.yml.
+# in ci.yml, and keep the quick-checks steps below byte-identical to the
+# quick-checks job in ci.yml.

 name: Continuous Integration (docs only)

@@ -47,17 +53,82 @@ on:
      - ".github/workflows/build.yml"
      - ".github/workflows/docker.yml"
      - ".github/workflows/audit.yml"
+      - "flake.lock"

 permissions:
  contents: read

 jobs:
-  test-and-lint:
-    name: Test and Lint
+  # Deliberately NOT a bare `echo`. Once "Quick Checks" becomes a required
+  # check, ci.yml gates every expensive job behind it, so a mixed PR reports
+  # two check runs with this name: the real one (45-51s) and this companion.
+  # GitHub has no written contract for how it picks between same-named
+  # required check runs ("latest wins" vs "any failure blocks"), so instead of
+  # relying on ordering we make both runs execute the same commands against
+  # the same merge ref — their conclusions are then necessarily identical and
+  # the choice does not matter. Keep these steps byte-identical to the
+  # quick-checks job in ci.yml (a guard script that asserts this, and the paths
+  # sync below, is tracked in rustfs/backlog#1603).
+  #
+  # For a genuinely docs-only PR this adds no strictness (no code changed, so
+  # fmt and the guards always pass) and costs ~50s of ubuntu-latest.
+  quick-checks:
+    name: Quick Checks
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install ripgrep
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          components: rustfmt
+
+      - name: Check code formatting
+        run: cargo fmt --all --check
+
+      - name: Check unsafe code allowances
+        run: ./scripts/check_unsafe_code_allowances.sh
+
+      - name: Check layered dependencies
+        run: ./scripts/check_layer_dependencies.sh
+
+      - name: Check architecture migration rules
+        run: ./scripts/check_architecture_migration_rules.sh
+
+      - name: Check tokio io-uring feature guard
+        run: ./scripts/check_no_tokio_io_uring.sh
+
+      - name: Check extension schema boundaries
+        run: ./scripts/check_extension_schema_boundaries.sh
+
+      - name: Check body-cache whitelist guard
+        run: ./scripts/check_body_cache_whitelist.sh
+
+      - name: Check no planning docs committed
+        run: ./scripts/check_no_planning_docs.sh
+
+      - name: Check CI paths stay in sync
+        run: ./scripts/check_ci_paths_sync.sh
+
+      - name: Check io_uring lane --lib precondition
+        run: ./scripts/check_uring_lane_lib_only.sh
+
+  test-and-lint:
+    name: Test and Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      # Docs-only PRs skip the full code CI, but they are exactly where a
      # planning-type document could be slipped in (git add -f bypasses
@@ -33,6 +33,7 @@ on:
      - ".github/workflows/build.yml"
      - ".github/workflows/docker.yml"
      - ".github/workflows/audit.yml"
+      - "flake.lock"
  pull_request:
    types: [ opened, synchronize, reopened, closed ]
    branches: [ main ]
@@ -54,6 +55,7 @@ on:
      - ".github/workflows/build.yml"
      - ".github/workflows/docker.yml"
      - ".github/workflows/audit.yml"
+      - "flake.lock"
  merge_group:
    types: [ checks_requested ]
  schedule:
@@ -81,6 +83,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -89,13 +92,20 @@ jobs:
    name: Typos
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Typos check with custom config file
        uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # master

  # Fast, compile-free checks that fail early so contributors get feedback in
  # ~1 minute instead of waiting for the full test job.
+  #
+  # These steps are mirrored byte-for-byte in ci-docs-only.yml so that a mixed
+  # PR, which reports two check runs named "Quick Checks", cannot get one red
+  # and one green. Edit both jobs together.
  quick-checks:
    name: Quick Checks
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
@@ -104,6 +114,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Install ripgrep
        run: sudo apt-get update && sudo apt-get install -y ripgrep
@@ -137,35 +149,127 @@ jobs:
      - name: Check no planning docs committed
        run: ./scripts/check_no_planning_docs.sh

+      - name: Check CI paths stay in sync
+        run: ./scripts/check_ci_paths_sync.sh
+
+      - name: Check io_uring lane --lib precondition
+        run: ./scripts/check_uring_lane_lib_only.sh
+
  test-and-lint:
    name: Test and Lint
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
-    timeout-minutes: 60
+    timeout-minutes: 90
+    # Both lines are required. Job-level `permissions` replaces the workflow
+    # block rather than merging with it, so declaring only `actions: write`
+    # would drop `contents: read` and break this job's checkout and the
+    # repo-token the setup action hands to setup-protoc.
+    permissions:
+      contents: read
+      actions: write
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          # This job's token can cancel runs and delete Actions caches. Checkout
+          # otherwise writes it into .git/config, where a PR's own build.rs or
+          # proc-macro could read it back out.
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-test
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          # Every lane in this workflow reads its cache and none writes it.
+          # cache-warm.yml is the sole writer for all four keys: this workflow
+          # cancels superseded runs on main, and a cancelled run never reaches
+          # rust-cache's post step, so writing from here saved nothing (12 of 15
+          # consecutive main-push runs were cancelled). See rustfs/backlog#1600.
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'
+
+      - name: Prepare test evidence
+        run: |
+          mkdir -p artifacts/test-and-lint
+          {
+            echo "run_id=${GITHUB_RUN_ID}"
+            echo "job=${GITHUB_JOB}"
+            echo "runner=${RUNNER_NAME}"
+            echo "started_at=$(date --utc --iso-8601=seconds)"
+          } > artifacts/test-and-lint/run-metadata.txt

      # Clippy runs before the test pass: lint failures are the most common
      # CI-only breakage and should surface in minutes, not after 20+ minutes
      # of tests.
+      # Sampled too: clippy is the natural control arm for any CARGO_BUILD_JOBS
+      # experiment, since --all-targets is check-only for workspace members and
+      # never links the ~100 test binaries the limit exists to throttle.
      - name: Run clippy lints
-        run: cargo clippy --all-targets -- -D warnings
-
-      - name: Run tests
        run: |
-          cargo nextest run --profile ci --all --exclude e2e_test
-          cargo test --all --doc
+          ./scripts/ci/resource_sampler.sh start clippy
+          trap './scripts/ci/resource_sampler.sh stop' EXIT
+          cargo clippy --all-targets -- -D warnings
+
+      - name: Run nextest tests
+        env:
+          # Three concurrent workspace test links saturate the self-hosted
+          # runner's overlay I/O and can wedge Cargo until the 75m timeout.
+          CARGO_BUILD_JOBS: "2"
+        run: |
+          mkdir -p artifacts/test-and-lint
+          ./scripts/ci/resource_sampler.sh start nextest
+          trap './scripts/ci/resource_sampler.sh stop' EXIT
+          set +e
+          NEXTEST_HIDE_PROGRESS_BAR=1 timeout --verbose --signal=TERM --kill-after=30s 75m \
+            cargo nextest run --profile ci --all --exclude e2e_test \
+            --status-level all --final-status-level all \
+            2>&1 | tee artifacts/test-and-lint/nextest.log
+          status=${PIPESTATUS[0]}
+          {
+            echo "command=cargo nextest run --profile ci --all --exclude e2e_test"
+            echo "exit_status=${status}"
+            echo "finished_at=$(date --utc --iso-8601=seconds)"
+            echo
+            echo "Remaining test-related processes:"
+            pgrep -af 'cargo|nextest|target/.*/deps/' || true
+            echo
+            echo "Kernel OOM / kill events:"
+            dmesg -T 2>/dev/null | grep -iE 'oom|out of memory|killed process' | tail -20 || true
+          } > artifacts/test-and-lint/nextest-diagnostics.txt
+          exit "${status}"
+
+      - name: Run documentation tests
+        run: |
+          mkdir -p artifacts/test-and-lint
+          set +e
+          timeout --verbose --signal=TERM --kill-after=30s 15m \
+            cargo test --all --doc \
+            2>&1 | tee artifacts/test-and-lint/doctest.log
+          status=${PIPESTATUS[0]}
+          {
+            echo "command=cargo test --all --doc"
+            echo "exit_status=${status}"
+            echo "finished_at=$(date --utc --iso-8601=seconds)"
+            echo
+            echo "Remaining test-related processes:"
+            pgrep -af 'cargo|rustdoc|target/.*/deps/' || true
+          } > artifacts/test-and-lint/doctest-diagnostics.txt
+          exit "${status}"
+
+      - name: Upload test reports and diagnostics
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: junit-test-and-lint-${{ github.run_number }}
+          path: |
+            target/nextest/ci/junit.xml
+            artifacts/test-and-lint
+          retention-days: 3
+          if-no-files-found: error

      # rustfs/backlog#1289: fail if a seed rule's log anchor no longer exists
      # verbatim in the source tree (log message drifted without updating the
@@ -174,15 +278,6 @@ jobs:
      - name: Check log-analyzer rule anchors
        run: ./scripts/check_log_analyzer_rules.sh

-      - name: Upload test junit report
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: junit-test-and-lint-${{ github.run_number }}
-          path: target/nextest/ci/junit.xml
-          retention-days: 3
-          if-no-files-found: ignore
-
      # Explicit gate for migration-critical suites. These tests already ran in
      # the full nextest pass above; a single filtered nextest invocation keeps
      # the named gate without rebuilding or re-running them one package at a time.
@@ -199,6 +294,48 @@ jobs:
      - name: Run rebalance/decommission migration proofs
        run: ./scripts/check_migration_gate_count.sh

+      # Early stop. Once this job has failed the PR cannot merge, so the sibling
+      # lanes are burning runners on a result nobody can act on: on run
+      # 30674613104 three lanes had already failed while Test and Lint and the
+      # rio-v2 variant kept going past 70 minutes.
+      #
+      # Only this job may cancel. The lanes that are NOT required checks
+      # (protocols, ILM, e2e, s3-tests) must never hold that power: a flake in
+      # one of them would turn the required "Test and Lint" into `cancelled`,
+      # which blocks the merge. Today a maintainer can merge with sftp red, and
+      # that has to stay true.
+      #
+      # These steps run last so the `if: always()` artifact upload above still
+      # captures logs and diagnostics before the run goes away.
+      - name: Annotate early-stop reason
+        if: failure() && github.event_name == 'pull_request'
+        run: |
+          echo "## CI early-stop" >> "$GITHUB_STEP_SUMMARY"
+          echo "Job \`${GITHUB_JOB}\` (Test and Lint) failed; cancelling run ${GITHUB_RUN_ID} to free runners." >> "$GITHUB_STEP_SUMMARY"
+          echo "Sibling jobs showing **cancelled** were stopped by this job, not by their own failure." >> "$GITHUB_STEP_SUMMARY"
+
+      # curl rather than `gh`: every existing `gh` call in this repo runs on
+      # ubuntu-latest, and the sm-standard-* images are custom and trimmed (they
+      # ship no C toolchain, see the e2e job below), so `gh` is not known to
+      # exist here.
+      #
+      # Fork PRs are excluded explicitly instead of relying on the error path:
+      # their GITHUB_TOKEN is forced read-only and job-level permissions cannot
+      # raise it, so the call would always 403. Skipping keeps their logs clean.
+      - name: Cancel run on failure (same-repo PR only)
+        if: >-
+          failure() && github.event_name == 'pull_request'
+          && github.event.pull_request.head.repo.full_name == github.repository
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          curl -fsS -X POST \
+            -H "Authorization: Bearer ${GH_TOKEN}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/cancel" || true
+
  # Dedicated serial lane for the ILM / lifecycle integration tests. These tests
  # drive the object layer through process-global singletons (the GLOBAL_ENV
  # ECStore, the global tier-config manager, background-expiry workers) and bind
@@ -212,6 +349,7 @@ jobs:
  test-ilm-integration-serial:
    name: ILM Integration (serial)
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 45
    env:
@@ -219,14 +357,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-ilm-serial
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      # test_transition_and_restore_flows was re-enabled by rustfs/backlog#1303:
      # its "missing xl.meta on disk2" was a test-util bug (open_disk hardcoded
@@ -249,6 +389,7 @@ jobs:
  test-and-lint-rio-v2:
    name: Test and Lint (rio-v2)
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 60
    env:
@@ -256,14 +397,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-test-rio-v2
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-feat-rio
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      - name: Run rio-v2 clippy lints
        run: cargo clippy -p rustfs -p rustfs-ecstore --all-targets --features rio-v2 -- -D warnings
@@ -276,10 +419,17 @@ jobs:
  test-and-lint-protocols:
    name: "Test and Lint (${{ matrix.features.name }})"
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 60
    strategy:
-      fail-fast: false
+      # On a PR, one failing protocol leg is enough to know the PR is not ready,
+      # so stop the sibling leg instead of paying another ~40 minutes for it.
+      # Everywhere else (main pushes, the merge queue, the weekly schedule) keep
+      # the full signal: there we want to know whether swift AND sftp are broken,
+      # not just whichever failed first. This is the only part of the early-stop
+      # work that also covers fork PRs, since it needs no token.
+      fail-fast: ${{ github.event_name == 'pull_request' }}
      matrix:
        features:
          - name: swift
@@ -291,14 +441,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-test-${{ matrix.features.name }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-feat-proto
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      - name: Run clippy with ${{ matrix.features.name }}
        run: |
@@ -311,6 +463,7 @@ jobs:
  build-rustfs-debug-binary:
    name: Build RustFS Debug Binary
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 30
    env:
@@ -318,17 +471,19 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-rustfs-debug-binary
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      - name: Build debug binary
-        run: cargo build -p rustfs --bins
+        run: cargo build -p rustfs --bins --features e2e-test-hooks

      - name: Upload debug binary
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
@@ -341,6 +496,7 @@ jobs:
  build-rustfs-debug-binary-rio-v2:
    name: Build RustFS Debug Binary (rio-v2)
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 30
    env:
@@ -348,17 +504,19 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-rustfs-debug-binary-rio-v2
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-shared-key: ci-feat-rio
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      - name: Build debug binary with rio-v2
-        run: cargo build -p rustfs --bins --features rio-v2
+        run: cargo build -p rustfs --bins --features rio-v2,e2e-test-hooks

      - name: Upload debug binary
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
@@ -370,6 +528,14 @@ jobs:

  uring-integration:
    name: io_uring Integration (real)
+    # The pull_request trigger includes `closed` purely so the concurrency
+    # group cancels in-flight runs of a closed PR; every other job opts out of
+    # that run with this guard (or is skipped through its `needs` chain). This
+    # job had neither, so each closed/merged PR really ran the whole io_uring
+    # suite (measured 4m17s / 7m19s / 7m31s on runs 30678272341 / 30678117601 /
+    # 30662728539) and kept the cancellation run in progress for minutes.
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    # GitHub-hosted ubuntu-latest runs a recent kernel with io_uring and, unlike
    # a container, applies no seccomp filter that would block io_uring_setup — so
    # the probe succeeds and the tests exercise the real UringBackend/FdCache/
@@ -380,17 +546,24 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
+          # Keeps its own key rather than joining ci-dev. rust-cache's key is
+          # built from runner.os/arch plus rustc and lockfile fingerprints — it
+          # does NOT include the runner label or image. ubuntu-latest and
+          # sm-standard-4 are therefore indistinguishable to it, so sharing a key
+          # would let two different system images overwrite each other's
+          # artifacts, and would make a 2-core hosted runner unpack ci-dev's ~3GB
+          # instead of this lane's ~1.3GB. cache-warm.yml warms this key on
+          # ubuntu-latest for the same reason.
          cache-shared-key: ci-uring
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: Install build dependencies
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      # ext4 supports O_DIRECT; the runner's default TMPDIR may sit on tmpfs or
      # overlayfs, where open(O_DIRECT) returns EINVAL/EOPNOTSUPP and the native
@@ -417,7 +590,17 @@ jobs:
          RUSTFS_IO_URING_READ_ENABLE: "true"
          RUSTFS_URING_TESTS_MUST_RUN: "1"
          TMPDIR: /mnt/rustfs-odirect
-        run: cargo test -p rustfs-ecstore uring_ -- --test-threads=1 --nocapture
+        # --lib narrows what gets compiled, not what gets run: every selected
+        # test lives in the lib target. The 7 integration binaries under
+        # crates/ecstore/tests/ each reported "running 0 tests" here, so they
+        # were compiled and linked for nothing.
+        #
+        # The `uring_` filter must stay exactly as it is. libtest matches on
+        # substring, so it also selects names containing `during_` — 6 of the 18
+        # selected tests are such incidental matches. Narrowing the filter to
+        # `io_uring` would silently drop them, which is a coverage change.
+        # scripts/check_uring_lane_lib_only.sh guards the --lib precondition.
+        run: cargo test -p rustfs-ecstore --lib uring_ -- --test-threads=1 --nocapture

  e2e-tests:
    name: End-to-End Tests
@@ -427,6 +610,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      # Full setup with dependency caching: the smoke-suite step below
      # compiles the e2e_test crate, which pulls in most of the workspace.
@@ -435,9 +620,9 @@ jobs:
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-e2e
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      # Download after the cache restore so the freshly built binary from the
      # build job always wins over anything restored into target/debug.
@@ -511,14 +696,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-e2e
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      # Download after the cache restore so the freshly built binary from the
      # build job always wins over anything restored into target/debug.
@@ -554,6 +741,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Clean up previous test run
        run: |
@@ -608,6 +797,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download debug binary
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -668,12 +859,20 @@ jobs:
  # evaluates ILM within ~2s of the due time, well inside the poll window.
  s3-lifecycle-behavior-tests:
    name: S3 Lifecycle Behavior Tests
-    needs: [ build-rustfs-debug-binary ]
+    # Also gated on e2e-tests, matching s3-implemented-tests: when the e2e smoke
+    # suite is already red this lane cannot tell us anything new, and it holds a
+    # sm-standard-4 for up to 30 minutes doing so. Both lanes only download the
+    # prebuilt debug binary (no cargo build), and s3-implemented-tests — which
+    # already waits on e2e-tests — finishes later anyway, so a green PR's total
+    # wall clock is unchanged.
+    needs: [ build-rustfs-debug-binary, e2e-tests ]
    runs-on: sm-standard-4
    timeout-minutes: 30
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download debug binary
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -22,11 +22,18 @@ on:
  issue_comment:
    types: [created, edited]

+# Least privilege at the top, widened per job below. This workflow runs on
+# pull_request_target and issue_comment, so it holds full secrets on every fork
+# PR and on any comment anyone writes — the one place in this repository where a
+# compromised action would be handed a repo-write token. It does not check out
+# or execute PR code, so there is no pwn-request path today, but the blast
+# radius should not depend on that staying true.
+#
+# contents: write in particular was never used: the signature records are
+# written to rustfs/cla through the scoped app token created below, and nothing
+# here writes to this repository's contents.
 permissions:
-  contents: write
-  pull-requests: write
-  issues: write
-  checks: write
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
@@ -36,14 +43,26 @@ jobs:
  cancel-closed-pr-runs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request_target' && github.event.action == 'closed'
+    # Echoes one line; the run exists only so the concurrency group cancels the
+    # in-flight run of a closed PR.
+    permissions: {}
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."

  cla:
    if: ${{ (github.event_name != 'issue_comment' || github.event.issue.pull_request) && (github.event_name != 'pull_request_target' || github.event.action != 'closed') }}
+    # checks: write reports the merge-queue check run; pull-requests and issues
+    # let cla-bot comment and label. contents stays read — see the note above.
+    permissions:
+      contents: read
+      checks: write
+      issues: write
+      pull-requests: write
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    steps:
      - name: Report CLA result for merge queue
        if: github.event_name == 'merge_group'
@@ -62,14 +62,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
          cache-shared-key: ci-coverage
-          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          install-build-packaging-tools: 'false'

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
@@ -116,6 +118,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -66,7 +66,7 @@ env:
  CARGO_TERM_COLOR: always
  REGISTRY_DOCKERHUB: rustfs/rustfs
  REGISTRY_GHCR: ghcr.io/${{ github.repository }}
-  REGISTRY_QUAY: quay.io/${{ secrets.QUAY_USERNAME }}/rustfs
+  REGISTRY_QUAY: quay.io/rustfs/rustfs
  DOCKER_PLATFORMS: linux/amd64,linux/arm64

 jobs:
@@ -82,8 +82,10 @@ jobs:
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'push' &&
-       github.event.workflow_run.head_branch != 'main')
+       github.event.workflow_run.head_branch != 'main' &&
+       !contains(github.event.workflow_run.head_branch, '-preview'))
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    outputs:
      should_build: ${{ steps.check.outputs.should_build }}
      should_push: ${{ steps.check.outputs.should_push }}
@@ -96,11 +98,18 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          persist-credentials: false
          # For workflow_run events, checkout the specific commit that triggered the workflow
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}

      - name: Check build conditions
        id: check
+        env:
+          # dispatch inputs via env, not `${{ }}` interpolation: they are
+          # free-form strings and would otherwise be evaluated by bash.
+          INPUT_VERSION: ${{ github.event.inputs.version }}
+          INPUT_PUSH_IMAGES: ${{ github.event.inputs.push_images }}
+          INPUT_FORCE_REBUILD: ${{ github.event.inputs.force_rebuild }}
        run: |
          should_build=false
          should_push=false
@@ -201,9 +210,9 @@ jobs:

          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            # Manual trigger
-            input_version="${{ github.event.inputs.version }}"
+            input_version="$INPUT_VERSION"
            version="${input_version}"
-            should_push="${{ github.event.inputs.push_images }}"
+            should_push="$INPUT_PUSH_IMAGES"
            should_build=true

            # Get short SHA
@@ -211,7 +220,7 @@ jobs:

            echo "🎯 Manual Docker build triggered:"
            echo "   📋 Requested version: $input_version"
-            echo "   🔧 Force rebuild: ${{ github.event.inputs.force_rebuild }}"
+            echo "   🔧 Force rebuild: $INPUT_FORCE_REBUILD"
            echo "   🚀 Push images: $should_push"

            case "$input_version" in
@@ -220,6 +229,13 @@ jobs:
                create_latest=true
                echo "🚀 Building with latest stable release version"
                ;;
+              *-preview*)
+                build_type="preview"
+                is_prerelease=true
+                should_build=false
+                should_push=false
+                echo "⏭️  Preview tags do not publish Docker images"
+                ;;
              # Prerelease versions (must match first, more specific)
              v*alpha*|v*beta*|v*rc*|*alpha*|*beta*|*rc*)
                build_type="prerelease"
@@ -290,6 +306,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
@@ -325,32 +343,28 @@ jobs:
          CREATE_LATEST="${{ needs.build-check.outputs.create_latest }}"
          VARIANT_SUFFIX="${{ matrix.suffix }}"

-          # Convert version format for Dockerfile compatibility
+          # Convert version format for Dockerfile compatibility. The former
+          # DOCKER_CHANNEL was "release" down every branch and was passed as a
+          # build-arg no Dockerfile declares, so it is gone.
          case "$VERSION" in
            "latest")
-              # For stable latest, use RELEASE=latest + release CHANNEL
              DOCKER_RELEASE="latest"
-              DOCKER_CHANNEL="release"
              ;;
            v*)
              # For versioned releases (v1.0.0), remove 'v' prefix for Dockerfile
              DOCKER_RELEASE="${VERSION#v}"
-              DOCKER_CHANNEL="release"
              ;;
            *)
              # For other versions, pass as-is
              DOCKER_RELEASE="${VERSION}"
-              DOCKER_CHANNEL="release"
              ;;
          esac

          echo "docker_release=$DOCKER_RELEASE" >> "$GITHUB_OUTPUT"
-          echo "docker_channel=$DOCKER_CHANNEL" >> "$GITHUB_OUTPUT"

          echo "🐳 Docker build parameters:"
          echo "  - Original version: $VERSION"
          echo "  - Docker RELEASE: $DOCKER_RELEASE"
-          echo "  - Docker CHANNEL: $DOCKER_CHANNEL"

          # Generate tags based on build type
          # Only support release and prerelease builds (no development builds)
@@ -404,18 +418,24 @@ jobs:
          push: ${{ needs.build-check.outputs.should_push == 'true' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: |
-            type=gha,scope=docker-${{ matrix.variant }}
-          cache-to: |
-            type=gha,mode=max,scope=docker-${{ matrix.variant }}
+          # No layer cache. This build compiles nothing — it downloads a
+          # release zip and runs apk/apt — so the cache could only save the
+          # minute or two those take, while creating a correctness problem: with
+          # RELEASE=latest the binary URL is resolved by curl *inside* a RUN
+          # layer, and the layer key does not include what that resolved to. A
+          # rebuild at the same RELEASE value (dispatch with version=latest, or
+          # a re-run of the same version) would hit the old layer and ship the
+          # previous release's binary. mode=max also consumed the same 10GB
+          # Actions cache quota the Rust lanes are fighting over.
+          #
+          # Only RELEASE is passed: it is the sole build-arg the Dockerfiles
+          # declare besides TARGETARCH. BUILDTIME, VERSION, BUILD_TYPE, REVISION
+          # and CHANNEL were never read by any stage (and BUILDTIME's $(date ...)
+          # was a literal here, not a shell substitution). BUILD_DATE and VCS_REF
+          # are declared by the Dockerfiles but deliberately left unset —
+          # supplying them would change the published image labels.
          build-args: |
-            BUILDTIME=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
-            VERSION=${{ needs.build-check.outputs.version }}
-            BUILD_TYPE=${{ needs.build-check.outputs.build_type }}
-            REVISION=${{ github.sha }}
            RELEASE=${{ steps.meta.outputs.docker_release }}
-            CHANNEL=${{ steps.meta.outputs.docker_channel }}
-            BUILDKIT_INLINE_CACHE=1
          provenance: true
          sbom: true
          # Add retry mechanism by splitting the build process
@@ -431,6 +451,7 @@ jobs:
    needs: [ build-check, build-docker ]
    if: needs.build-check.outputs.should_build == 'true' && needs.build-check.outputs.should_push == 'true'
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
@@ -485,6 +506,7 @@ jobs:
    needs: [ build-check, build-docker ]
    if: always() && needs.build-check.outputs.should_build == 'true'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Docker build completion summary
        run: |
@@ -64,14 +64,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
          cache-shared-key: ci-e2e-repl
-          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          install-build-packaging-tools: 'false'

      # awscurl lets the STS dual-node test actually exercise its path. Without
      # it the test skips gracefully with a visible log line
@@ -124,6 +126,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -45,6 +45,13 @@
 # The PR gate (ci.yml s3-implemented-tests) is unaffected: it avoids Docker
 # via DEPLOY_MODE=binary and defers all pip setup to run.sh's self-bootstrap.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: e2e-s3tests

 on:
@@ -135,6 +142,8 @@ jobs:
      TEST_MODE: ${{ matrix.test-mode }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      # Provision Python explicitly rather than trusting the runner image to
      # ship a working pip (ci-1: a bare python3 without pip is what broke the
@@ -354,6 +363,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -12,6 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: Fuzz

 on:
@@ -59,6 +66,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -79,13 +87,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: nightly
          cache-shared-key: fuzz-${{ hashFiles('fuzz/Cargo.lock') }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'schedule' }}

      - name: Install cargo-fuzz
@@ -145,6 +154,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download prebuilt fuzz binaries
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -200,6 +211,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download prebuilt fuzz binaries
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -247,6 +260,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -32,12 +32,14 @@ permissions:
 jobs:
  build-helm-package:
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    if: |
-      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'workflow_dispatch' && !contains(github.event.inputs.version, '-preview')) ||
      (
        github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.event == 'push' &&
-        contains(github.event.workflow_run.head_branch, '.')
+        contains(github.event.workflow_run.head_branch, '.') &&
+        !contains(github.event.workflow_run.head_branch, '-preview')
      )

    outputs:
@@ -48,16 +50,26 @@ jobs:
    steps:
      - name: Checkout helm chart repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

+      # Both inputs reach the shell through env rather than `${{ }}`
+      # interpolation. A git ref name may contain `$(...)` — anything without a
+      # space is a legal tag — and interpolation pastes it into the script
+      # verbatim, where bash would run it. Reading "$RAW_INPUT" instead makes it
+      # data.
      - name: Normalize release version
        id: version
+        env:
+          RAW_INPUT: ${{ github.event.inputs.version }}
+          RAW_BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: |
          set -eux

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            RAW="${{ github.event.inputs.version }}"
+            RAW="$RAW_INPUT"
          else
-            RAW="${{ github.event.workflow_run.head_branch }}"
+            RAW="$RAW_BRANCH"
          fi

          case "$RAW" in
@@ -72,10 +84,13 @@ jobs:
          ./scripts/helm_chart_version.sh "$RAW_TAG"

      - name: Replace chart version and app version
+        env:
+          CHART_VERSION: ${{ steps.version.outputs.chart_version }}
+          APP_VERSION: ${{ steps.version.outputs.app_version }}
        run: |
          set -eux
-          sed -i -E 's/^version:.*/version: "${{ steps.version.outputs.chart_version }}"/' helm/rustfs/Chart.yaml
-          sed -i -E 's/^appVersion:.*/appVersion: "${{ steps.version.outputs.app_version }}"/' helm/rustfs/Chart.yaml
+          sed -i -E "s/^version:.*/version: \"${CHART_VERSION}\"/" helm/rustfs/Chart.yaml
+          sed -i -E "s/^appVersion:.*/appVersion: \"${APP_VERSION}\"/" helm/rustfs/Chart.yaml

      - name: Set up Helm
        uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
@@ -100,6 +115,7 @@ jobs:

  publish-helm-package:
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    needs: [ build-helm-package ]
    if: needs.build-helm-package.result == 'success'

@@ -107,6 +123,8 @@ jobs:
      - name: Checkout helm package repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          # persist-credentials-exempt: this checkout's token IS the push credential —
+          # the job git-pushes to rustfs/helm below. Clearing it breaks chart publishing.
          repository: rustfs/helm
          token: ${{ secrets.RUSTFS_HELM_PACKAGE }}

@@ -122,11 +140,19 @@ jobs:
      - name: Generate index
        run: helm repo index . --url https://charts.rustfs.com

+      # app_version is derived from the triggering tag name, and this job holds
+      # the cross-repository push token with rustfs/helm already checked out —
+      # the worst place in the repo to paste an attacker-influenced string into
+      # a shell line. Passed through env so bash treats it as data.
      - name: Push helm package and index file
+        env:
+          GIT_USERNAME: ${{ secrets.USERNAME }}
+          GIT_EMAIL: ${{ secrets.EMAIL_ADDRESS }}
+          APP_VERSION: ${{ needs.build-helm-package.outputs.app_version }}
        run: |
          set -eux
-          git config --global user.name "${{ secrets.USERNAME }}"
-          git config --global user.email "${{ secrets.EMAIL_ADDRESS }}"
+          git config --global user.name "${GIT_USERNAME}"
+          git config --global user.email "${GIT_EMAIL}"
          git add .
-          git commit -m "Update rustfs helm package with ${{ needs.build-helm-package.outputs.app_version }}." || echo "No changes to commit"
+          git commit -m "Update rustfs helm package with ${APP_VERSION}." || echo "No changes to commit"
          git push origin main
@@ -12,6 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: "issue-translator"
 on:
  issue_comment:
@@ -26,6 +33,7 @@ permissions:
 jobs:
  build:
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - uses: usthe/issues-translate-action@b41f55ddc81d7d54bd542a4f289fe28ec081898e # v2.7
        with:
@@ -23,6 +23,13 @@
 # Runner: GitHub-hosted `ubuntu-latest`. It reliably ships Docker + Python,
 # unlike the self-hosted fleet, whose pods drift in Docker/pip availability
 # (see the infra note in e2e-s3tests.yml). Nightly + manual only.
+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: minio-interop

 on:
@@ -51,13 +58,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
          cache-shared-key: ci-minio-interop
-          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Generate real MinIO fixtures via Docker
@@ -45,6 +45,13 @@
 # docker-capable self-hosted `dind-sm-standard-2` label was the alternative but
 # has fewer cores and reintroduces fleet-state risk for no reliability gain.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: mint

 on:
@@ -118,6 +125,8 @@ jobs:
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Enable buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
@@ -263,6 +272,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -19,9 +19,12 @@ on:
  schedule:
    - cron: '0 5 * * 0' # Weekly on Sunday 05:00 UTC (staggered after the midnight ci/build crons)

+# GITHUB_TOKEN only needs to read the repository here: the branch push and the
+# pull request are both created by update-flake-lock using the
+# FLAKE_UPDATE_TOKEN PAT below, not by this token. Leaving write on it hands a
+# repo-write credential to an unattended weekly job that does not use it.
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -37,6 +40,10 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        # persist-credentials-exempt: update-flake-lock pushes the branch and opens
+        # the PR. It passes FLAKE_UPDATE_TOKEN to create-pull-request itself rather
+        # than reusing .git/config, but that is unverified — exempt until a
+        # workflow_dispatch run confirms it (rustfs/backlog#1602).

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3
@@ -12,6 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: Nix CI

 on:
@@ -46,6 +53,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -63,6 +71,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@4eea0b33e3d1f02ecfe37cf16e7204c424009606 # v3.21.0
@@ -22,6 +22,13 @@
 # a deliberate correctness cost (e.g. the #4221 fsync durability fix) is
 # recorded but does not block (rustfs/backlog#935 correction 1).

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: Performance A/B

 on:
@@ -92,6 +99,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
@@ -99,7 +108,6 @@ jobs:
          rust-version: stable
          cache-shared-key: warp-ab-${{ hashFiles('**/Cargo.lock') }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build release rustfs
        run: cargo build --release --bin rustfs
@@ -142,6 +150,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          persist-credentials: false
          fetch-depth: 0 # baseline is built from origin/main

      - name: Setup Rust environment
@@ -150,7 +159,6 @@ jobs:
          rust-version: stable
          cache-shared-key: warp-ab-${{ hashFiles('**/Cargo.lock') }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install warp
        run: |
@@ -162,13 +170,15 @@ jobs:

      - name: Decide exemption
        id: exempt
+        env:
+          INPUT_ALLOW_REGRESSION: ${{ github.event.inputs.allow_regression }}
        run: |
          allow="false"
          if [[ "${{ github.event_name }}" == "pull_request" ]] \
            && ${{ contains(github.event.pull_request.labels.*.name, 'perf-deliberate-tradeoff') }}; then
            allow="true"
          fi
-          if [[ "${{ github.event.inputs.allow_regression }}" == "true" ]]; then
+          if [[ "$INPUT_ALLOW_REGRESSION" == "true" ]]; then
            allow="true"
          fi
          echo "allow_regression=$allow" >> "$GITHUB_OUTPUT"
@@ -224,6 +234,8 @@ jobs:

      - name: Run warp A/B and gate
        id: ab
+        env:
+          INPUT_DURATION: ${{ github.event.inputs.duration }}
        run: |
          set -euo pipefail
          # Budget note: with perf-3's cached baseline the nightly does no source
@@ -234,7 +246,7 @@ jobs:
          # budget, which the rig's previous 60s health poll undershot (the first
          # two nightly failures). perf-6 recalibrates these once the noise study
          # lands.
-          duration="${{ github.event.inputs.duration || '12s' }}"
+          duration="${INPUT_DURATION:-12s}"
          baseline_sha="${{ steps.commits.outputs.baseline_sha }}"
          candidate_sha="${{ steps.commits.outputs.candidate_sha }}"
          baseline_hit="${{ steps.baseline_cache.outputs.cache-hit }}"
@@ -385,6 +397,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -24,6 +24,13 @@
 # The run itself is expected to end red (the forced failure); only the
 # alert-on-failure job result matters.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: Schedule Failure Alert Drill

 on:
@@ -56,6 +63,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -12,6 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: "Mark stale issues"
 on:
  schedule:
@@ -20,6 +27,7 @@ on:
 jobs:
  stale:
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    steps:
      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
        with:
@@ -15,6 +15,7 @@ concurrency:
 jobs:
  update:
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - uses: overtrue/repo-visuals-action@72f34d24769ff5d341956da2f23952594ef2f1e2 # v1.3.0
        with:
@@ -172,7 +172,7 @@
            ],
        },
        {
-            "name": "Debug executable target/debug/rustfs with sse",
+            "name": "Debug executable target/debug/rustfs with sse kms",
            "type":  "lldb",
            "request": "launch",
            "program": "${workspaceFolder}/target/debug/rustfs",
@@ -200,7 +200,7 @@
                // 2. kms local backend test key
                // "RUSTFS_KMS_ENABLE": "true",
                // "RUSTFS_KMS_BACKEND": "local",
-                // "RUSTFS_KMS_KEY_DIR": "./target/kms-key-dir",
+                // "RUSTFS_KMS_KEY_DIR": "/tmp/kms-key-dir",
                // "RUSTFS_KMS_LOCAL_MASTER_KEY": "my-secret-key", // Some Password
                // "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",

@@ -212,13 +212,40 @@
                // "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",

                // 4. kms vault transit backend test key
+                // "RUSTFS_KMS_ENABLE": "true",
+                // "RUSTFS_KMS_BACKEND": "vault-transit",
+                // "RUSTFS_KMS_VAULT_ADDRESS": "http://127.0.0.1:8200",
+                // "RUSTFS_KMS_VAULT_TOKEN": "Dev Token",
+                // "RUSTFS_KMS_VAULT_MOUNT_PATH": "transit",
+                // "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",
+                
+                // 5、kms static backend test key
                "RUSTFS_KMS_ENABLE": "true",
-                "RUSTFS_KMS_BACKEND": "vault-transit",
-                "RUSTFS_KMS_VAULT_ADDRESS": "http://127.0.0.1:8200",
-                "RUSTFS_KMS_VAULT_TOKEN": "Dev Token",
-                "RUSTFS_KMS_VAULT_MOUNT_PATH": "transit",
-                "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",
-
+                "RUSTFS_KMS_BACKEND": "static",
+                "RUSTFS_KMS_STATIC_SECRET_KEY": "rustfs-master-key:2dfNXGHlsEflGVCxb+5DIdGEl1sIvtwX+QfmYasi5QM="
+            },
+            "sourceLanguages": [
+                "rust"
+            ],
+        },
+        {
+            "name": "Debug executable target/debug/rustfs with local sse",
+            "type": "lldb",
+            "request": "launch",
+            "program": "${workspaceFolder}/target/debug/rustfs",
+            "args": [],
+            "cwd": "${workspaceFolder}",
+            "env": {
+                "RUSTFS_ACCESS_KEY": "rustfsadmin",
+                "RUSTFS_SECRET_KEY": "rustfsadmin",
+                "RUSTFS_VOLUMES": "./target/volumes/test{1...4}",
+                "RUSTFS_ADDRESS": ":9000",
+                "RUSTFS_CONSOLE_ENABLE": "true",
+                "RUSTFS_CONSOLE_ADDRESS": "127.0.0.1:9001",
+                "RUSTFS_OBS_LOG_DIRECTORY": "./target/logs",
+                "RUSTFS_UNSAFE_BYPASS_DISK_CHECK": "true",
+                "RUSTFS_SSE_S3_MASTER_KEY": "xGb3aYSp825j2tPpg8JrUzghiXsIkfdOtmrsJ/iafiM=",
+                "RUST_LOG": "rustfs=debug,ecstore=debug,s3s=debug,iam=debug",
            },
            "sourceLanguages": [
                "rust"
@@ -21,6 +21,12 @@ If repo-level instructions conflict, follow the nearest file and keep behavior a
 - Avoid redundant file reads, repeated commands, and unnecessary exploratory work once enough context is available.
 - A good result is a minimal diff with clear assumptions, no over-engineering, and independent verification that survives Adversarial Validation (below).

+## Autonomy and Approval Boundaries
+
+- Inquiry tasks (answer, explain, review, diagnose, plan): report findings; do not change files unless a fix is explicitly requested.
+- Action tasks (change, build, fix): make in-scope local changes without asking for approval.
+- Ask for confirmation before destructive or hard-to-reverse operations (force-pushes, history rewrites, deleting data or branches), merging a PR (reviewer approval required), or any material expansion of the requested scope.
+
 ## Communication and Language

 - Respond in the same language used by the requester.
@@ -99,33 +105,78 @@ CI) fails the build if anything is committed under `docs/superpowers/`, even via

 ## Verification Before PR

-Convert changes into independently verifiable outcomes. Prefer focused tests for behavior changes and run the relevant checks before declaring completion.
-Non-exempt changes must also pass Adversarial Validation (next section) before the checks below count as completion.
+Convert changes into independently verifiable outcomes. This section controls
+agent-run local validation; preparing a commit or PR does not by itself require
+the broadest gate. Inspect only the final task-owned diff, classify it by
+behavioral impact rather than line count or path alone, and run the smallest
+set of checks that provides meaningful coverage. Do not let unrelated
+worktree changes or a generic contributor checklist expand the scope.
+Non-exempt changes must also pass Adversarial Validation (next section) before
+the checks below count as completion.

-For code changes, run and pass the following before opening a PR:
+### Validation floor

-```bash
-make pre-pr
-```
+- Every change that is not documentation-only must finish with
+  `cargo fmt --all --check` passing. An umbrella gate that runs this exact
+  check satisfies the requirement; do not run it twice. Use `cargo fmt --all`
+  only when formatting needs to be fixed. Run the configured formatter or
+  validator for other changed languages when one exists.
+- Documentation-only or instruction-only means all task-owned changes are
+  prose or documentation assets and cannot affect runtime, builds, CI,
+  dependencies, generated code, or tests. Run `git diff --check` and any
+  relevant documentation guard, but skip Cargo formatting, compilation,
+  Clippy, tests, `make pre-commit`, and `make pre-pr`.
+- Behavior changes require relevant existing or new tests. Prefer the most
+  focused test or affected package. A passing targeted test can also provide
+  sufficient compilation coverage when it builds every changed target and
+  feature involved; do not add a redundant `cargo check` in that case.
+- `cargo check` supplements compilation coverage; it never substitutes for a
+  behavioral test. If a relevant test cannot reasonably be added or run, use
+  the narrowest compilation check and report the reason and remaining risk.

-Before committing code changes, prefer focused verification for the touched
-surface and use the faster local gate when a broad smoke check is needed:
+### Validation tiers

-```bash
-make pre-commit
-```
+1. **Documentation/instruction-only:** Apply the exemption above. Run a guard
+   such as `make doc-paths-check` only when it is relevant to the edited text.
+2. **Non-behavioral source change:** For comments, formatting, or another
+   demonstrably non-executable change, run the formatting floor. Compilation,
+   Clippy, and tests may be skipped only when the edit cannot affect
+   compilation or runtime behavior; run targeted doctests if executable
+   documentation examples changed.
+3. **Localized or bounded behavior change:** Run the formatting floor and the
+   narrowest relevant tests. Add package-scoped `cargo check` or Clippy only
+   for changed targets, features, APIs, error handling, async behavior, or
+   control flow not already covered. When several crates are affected but the
+   dependency set is identifiable, validate those packages and known
+   dependents instead of the whole workspace. Use `make pre-commit` only when
+   a repository-wide fast gate adds useful confidence beyond those checks.
+4. **Broad or high-risk change:** Run `make pre-pr` only when targeted coverage
+   cannot bound the impact, including:
+   - dependency, feature, build-script, procedural-macro, code-generation,
+     toolchain, or CI changes that alter compilation or the test matrix;
+   - cross-crate public APIs, shared foundational code, or broad refactors with
+     an unbounded dependent set;
+   - locking, storage durability or formats, erasure coding, replication,
+     RPC/protocol compatibility, IAM/KMS/auth, cryptography, or other
+     security-sensitive behavior;
+   - a targeted check that reveals wider impact, an explicit user request, or
+     a release policy that requires the full gate.

-For migration batches, do not run the full `make pre-pr` gate before every
-intermediate commit. Use focused tests and `make pre-commit` during
-development, then reserve `make pre-pr` for the final PR-ready branch.
+Documentation-only and non-behavioral classifications take precedence over
+path-based triggers. A small diff can still be high-risk, while a CI comment,
+manifest comment, or release-note edit does not require full validation.

-Before pushing code changes, make sure formatting is clean:
+`make pre-pr` includes `make pre-commit` coverage. Never run both for the same
+unchanged diff, and do not repeat equivalent checks during PR preparation or
+because a local hook already ran them. Rerun only checks whose scope is affected
+by later edits. Full workspace checks do not replace a relevant integration or
+E2E test for changed behavior; run that focused test when required and
+available, or report why it was not run and the remaining risk.

- Run `cargo fmt --all`.
- Run `cargo fmt --all --check` and ensure no files are modified unexpectedly.
+If `make` is unavailable, run the equivalent checks defined under
+`.config/make/`. At handoff, list the checks actually run, checks intentionally
+skipped, and the reason for the selected tier.

-If `make` is unavailable, run the equivalent checks defined under `.config/make/`.
-Documentation-only or instruction-only changes are exempt from the verification commands above (including the `.config/make/` equivalents), though any locally installed git pre-commit hooks may still run on commit unless explicitly skipped.
 After build-based verification completes, clean generated build artifacts before wrapping up to avoid unnecessary disk usage.
 Do not open a PR with code changes when the required checks fail.
 Make a failing check pass by fixing the cause, never by weakening the gate:
@@ -68,8 +68,8 @@ resolver = "3"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
-rust-version = "1.96.0"
-version = "1.0.0-beta.11"
+rust-version = "1.97.1"
+version = "1.0.0-beta.12"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
@@ -86,58 +86,58 @@ redundant_clone = "warn"

 [workspace.dependencies]
 # RustFS Internal Crates
-rustfs = { path = "./rustfs", version = "1.0.0-beta.11" }
-rustfs-heal = { path = "crates/heal", version = "1.0.0-beta.11" }
-rustfs-audit = { path = "crates/audit", version = "1.0.0-beta.11" }
-rustfs-checksums = { path = "crates/checksums", version = "1.0.0-beta.11" }
-rustfs-common = { path = "crates/common", version = "1.0.0-beta.11" }
-rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-beta.11" }
-rustfs-config = { path = "./crates/config", version = "1.0.0-beta.11" }
-rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-beta.11" }
-rustfs-credentials = { path = "crates/credentials", version = "1.0.0-beta.11" }
-rustfs-crypto = { path = "crates/crypto", version = "1.0.0-beta.11" }
-rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-beta.11" }
-rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-beta.11" }
-rustfs-iam = { path = "crates/iam", version = "1.0.0-beta.11" }
-rustfs-keystone = { path = "crates/keystone", version = "1.0.0-beta.11" }
-rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-beta.11" }
-rustfs-kms = { path = "crates/kms", version = "1.0.0-beta.11" }
-rustfs-lock = { path = "crates/lock", version = "1.0.0-beta.11" }
-rustfs-madmin = { path = "crates/madmin", version = "1.0.0-beta.11" }
-rustfs-notify = { path = "crates/notify", version = "1.0.0-beta.11" }
-rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-beta.11" }
-rustfs-io-core = { path = "crates/io-core", version = "1.0.0-beta.11" }
-rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-beta.11" }
-rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-beta.11" }
-rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-beta.11" }
-rustfs-obs = { path = "crates/obs", version = "1.0.0-beta.11" }
-rustfs-policy = { path = "crates/policy", version = "1.0.0-beta.11" }
-rustfs-protos = { path = "crates/protos", version = "1.0.0-beta.11" }
-rustfs-protocols = { path = "crates/protocols", version = "1.0.0-beta.11" }
-rustfs-replication = { path = "crates/replication", version = "1.0.0-beta.11" }
-rustfs-rio = { path = "crates/rio", version = "1.0.0-beta.11" }
-rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-beta.11" }
-rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-beta.11" }
-rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-beta.11" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-beta.11" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-beta.11" }
-rustfs-scanner = { path = "crates/scanner", version = "1.0.0-beta.11" }
-rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-beta.11" }
-rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-beta.11" }
-rustfs-signer = { path = "crates/signer", version = "1.0.0-beta.11" }
-rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-beta.11" }
-rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-beta.11" }
-rustfs-targets = { path = "crates/targets", version = "1.0.0-beta.11" }
-rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-beta.11" }
-rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-beta.11" }
-rustfs-utils = { path = "crates/utils", version = "1.0.0-beta.11" }
-rustfs-zip = { path = "./crates/zip", version = "1.0.0-beta.11" }
+rustfs = { path = "./rustfs", version = "1.0.0-beta.12" }
+rustfs-heal = { path = "crates/heal", version = "1.0.0-beta.12" }
+rustfs-audit = { path = "crates/audit", version = "1.0.0-beta.12" }
+rustfs-checksums = { path = "crates/checksums", version = "1.0.0-beta.12" }
+rustfs-common = { path = "crates/common", version = "1.0.0-beta.12" }
+rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-beta.12" }
+rustfs-config = { path = "./crates/config", version = "1.0.0-beta.12" }
+rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-beta.12" }
+rustfs-credentials = { path = "crates/credentials", version = "1.0.0-beta.12" }
+rustfs-crypto = { path = "crates/crypto", version = "1.0.0-beta.12" }
+rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-beta.12" }
+rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-beta.12" }
+rustfs-iam = { path = "crates/iam", version = "1.0.0-beta.12" }
+rustfs-keystone = { path = "crates/keystone", version = "1.0.0-beta.12" }
+rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-beta.12" }
+rustfs-kms = { path = "crates/kms", version = "1.0.0-beta.12" }
+rustfs-lock = { path = "crates/lock", version = "1.0.0-beta.12" }
+rustfs-madmin = { path = "crates/madmin", version = "1.0.0-beta.12" }
+rustfs-notify = { path = "crates/notify", version = "1.0.0-beta.12" }
+rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-beta.12" }
+rustfs-io-core = { path = "crates/io-core", version = "1.0.0-beta.12" }
+rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-beta.12" }
+rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-beta.12" }
+rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-beta.12" }
+rustfs-obs = { path = "crates/obs", version = "1.0.0-beta.12" }
+rustfs-policy = { path = "crates/policy", version = "1.0.0-beta.12" }
+rustfs-protos = { path = "crates/protos", version = "1.0.0-beta.12" }
+rustfs-protocols = { path = "crates/protocols", version = "1.0.0-beta.12" }
+rustfs-replication = { path = "crates/replication", version = "1.0.0-beta.12" }
+rustfs-rio = { path = "crates/rio", version = "1.0.0-beta.12" }
+rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-beta.12" }
+rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-beta.12" }
+rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-beta.12" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-beta.12" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-beta.12" }
+rustfs-scanner = { path = "crates/scanner", version = "1.0.0-beta.12" }
+rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-beta.12" }
+rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-beta.12" }
+rustfs-signer = { path = "crates/signer", version = "1.0.0-beta.12" }
+rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-beta.12" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-beta.12" }
+rustfs-targets = { path = "crates/targets", version = "1.0.0-beta.12" }
+rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-beta.12" }
+rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-beta.12" }
+rustfs-utils = { path = "crates/utils", version = "1.0.0-beta.12" }
+rustfs-zip = { path = "./crates/zip", version = "1.0.0-beta.12" }

 # Async Runtime and Networking
 async-channel = "2.5.0"
 async_zip = { default-features = false, version = "0.0.18" }
 mysql_async = { default-features = false, version = "0.37" }
-async-compression = { version = "0.4.42" }
+async-compression = { version = "0.4.43" }
 async-recursion = "1.1.1"
 async-trait = "0.1.91"
 async-nats = { version = "0.50.0", default-features = false }
@@ -152,7 +152,7 @@ lapin = { default-features = false, version = "4.10.0" }
 hyper = { version = "1.11.0" }
 hyper-rustls = { default-features = false, version = "0.27.9" }
 hyper-util = { version = "0.1.20" }
-http = "1.4.2"
+http = "1.5.0"
 http-body = "1.1.0"
 http-body-util = "0.1.4"
 minlz = "1.2.3"
@@ -196,13 +196,13 @@ blake2 = "=0.11.0-rc.6"
 chacha20poly1305 = { version = "=0.11.0" }
 crc-fast = "1.10.0"
 hmac = { version = "0.13.0" }
-jsonwebtoken = { version = "10.4.0" }
+jsonwebtoken = { version = "11.0.0" }
 openidconnect = { default-features = false, version = "4.0" }
 pbkdf2 = "0.13.0"
 rsa = { version = "=0.10.0-rc.18" }
-rustls = { default-features = false, version = "0.23.42" }
+rustls = { default-features = false, version = "0.23.43" }
 rustls-native-certs = "0.8"
-rustls-pki-types = "1.15.0"
+rustls-pki-types = "1.15.1"
 sha1 = "0.11.0"
 sha2 = "0.11.0"
 subtle = "2.6"
@@ -211,7 +211,7 @@ zeroize = { version = "1.9.0" }
 # Time and Date
 chrono = { version = "0.4.45" }
 humantime = "2.4.0"
-jiff = { version = "0.2.34" }
+jiff = { version = "0.2.35" }
 time = { version = "0.3.54" }

 # Database
@@ -225,13 +225,14 @@ arc-swap = "1.9.2"
 astral-tokio-tar = "0.6.4"
 atoi = "3.1.0"
 atomic_enum = "0.3.0"
-aws-config = { version = "1.10.0" }
+aws-config = { version = "1.10.1" }
 aws-credential-types = { version = "1.3.0" }
-aws-sdk-s3 = { default-features = false, version = "1.139.0" }
+aws-sdk-s3 = { default-features = false, version = "1.140.0" }
+aws-sdk-sts = { default-features = false, version = "1.110.0" }
 aws-smithy-http-client = { default-features = false, version = "1.2.0" }
-aws-smithy-runtime-api = { version = "1.13.0" }
+aws-smithy-runtime-api = { version = "1.14.0" }
 aws-smithy-types = { version = "1.6.1" }
-base64 = "0.22.1"
+base64 = "0.23.0"
 base64-simd = "0.8.0"
 brotli = "8.0.4"
 clap = { version = "4.6.4" }
@@ -243,17 +244,19 @@ crossbeam-channel = "0.5.16"
 crossbeam-deque = "0.8.7"
 crossbeam-utils = "0.8.22"
 datafusion = { default-features = false, git = "https://github.com/apache/datafusion.git", rev = "dae03ee062b2abf986de8df12ea82fb1578a2d99" }
+#datafusion = { default-features = false, version = "54.1.0" }
 derive_builder = "0.20.2"
 enumset = "1.1.14"
 faster-hex = "0.10.0"
 flate2 = "1.1.9"
 glob = "0.3.4"
-google-cloud-storage = "1.16.0"
-google-cloud-auth = "1.14.0"
+google-cloud-storage = "1.17.0"
+google-cloud-auth = "1.15.0"
 hashbrown = { version = "0.17.1" }
 hex = "0.4.3"
 hex-simd = "0.8.0"
 highway = { version = "1.3.0" }
+hostname = "0.4.2"
 ipnetwork = { version = "0.21.1" }
 lazy_static = "1.5.0"
 libc = "0.2.189"
@@ -263,7 +266,6 @@ memmap2 = "0.9.11"
 lz4 = "1.28.1"
 matchit = "0.9.2"
 md-5 = "0.11.0"
-md5 = "0.8.1"
 mime_guess = "2.0.5"
 moka = { version = "0.12.15" }
 netif = "0.1.6"
@@ -278,16 +280,17 @@ pretty_assertions = "1.4.1"
 rand = { version = "0.10.2" }
 ratelimit = "0.10.1"
 rayon = "1.12.0"
-reed-solomon-erasure = { package = "rustfs-erasure-codec", version = "8.0.0" }
+reed-solomon-erasure = { package = "rustfs-erasure-codec", version = "8.0.2" }
 reed-solomon-simd = "3.1.0"
 regex = { version = "1.13.1" }
 rumqttc = { package = "rumqttc-next", version = "0.33.3" }
-redis = { version = "1.4.1" }
+redis = { version = "1.5.0" }
+rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.4" }
 rust-embed = { version = "8.12.0" }
 rustc-hash = { version = "2.1.3" }
-s3s = { git = "https://github.com/s3s-project/s3s.git", rev = "a5471625975f5014f7b28eee7e4d801f1b32f529" }
-serial_test = "3.5.0"
+s3s = { git = "https://github.com/cxymds/s3s.git", rev = "fe3941d91fa1c69956f209a9145995c9f0235bff" }
+serial_test = "4.0.1"
 shadow-rs = { default-features = false, version = "2.0.0" }
 siphasher = "1.0.3"
 smallvec = { version = "1.15.2" }
@@ -302,6 +305,7 @@ test-case = "3.3.1"
 thiserror = "2.0.19"
 tracing = { version = "0.1.44" }
 tracing-appender = "0.2.5"
+tracing-core = "0.1.36"
 tracing-error = "0.2.1"
 tracing-opentelemetry = { version = "0.33" }
 tracing-subscriber = { version = "0.3.23" }
@@ -312,7 +316,9 @@ uuid = { version = "1.24.0" }
 vaultrs = { version = "0.8.0" }
 tar = "0.4.46"
 walkdir = "2.5.0"
+winapi-util = "0.1.11"
 windows = { version = "0.62.2" }
+windows-sys = "0.61.2"
 xxhash-rust = { version = "0.8.18" }
 zip = "8.6.0"
 zstd = "0.13.3"
@@ -323,6 +329,7 @@ dial9-tokio-telemetry = "0.3"
 opentelemetry = { version = "0.32.0" }
 opentelemetry-appender-tracing = { version = "0.32.0" }
 opentelemetry-otlp = { version = "0.32.0" }
+opentelemetry-proto = { version = "0.32.0", default-features = false, features = ["metrics", "gen-tonic-messages"] }
 opentelemetry_sdk = { version = "0.32.1" }
 opentelemetry-semantic-conventions = { version = "0.32.1" }
 opentelemetry-stdout = { version = "0.32.0" }
@@ -333,7 +340,7 @@ libunftp = { version = "0.23.0" }
 unftp-core = "0.1.0"
 suppaftp = { version = "10.0.1" }
 rcgen = { version = "0.14.8", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
-russh = { version = "0.62.3" }
+russh = { version = "0.62.4" }
 russh-sftp = "2.3.0"

 # WebDAV
@@ -341,7 +348,7 @@ dav-server = "0.11.0"

 # Performance Analysis and Memory Profiling
 mimalloc = "0.1.52"
-hotpath = "0.21.5"
+hotpath = { version = "0.22.0", default-features = false }
 # Snapshot testing for output format regression detection
 insta = { version = "1.48" }

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-FROM rust:1.97-trixie
+FROM rust:1.97.1-trixie

 RUN set -eux; \
    export DEBIAN_FRONTEND=noninteractive; \
@@ -32,7 +32,7 @@ ARG RUSTFS_BUILD_FEATURES=""
 # -----------------------------
 # Build stage
 # -----------------------------
-FROM rust:1.97-trixie AS builder
+FROM rust:1.97.1-trixie AS builder

 # Re-declare args after FROM
 ARG TARGETPLATFORM
@@ -116,7 +116,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.11
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.12
 ```

 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command
@@ -163,6 +163,7 @@ docker run -d --name rustfs -p 9000:9000 \
  -e RUSTFS_NOTIFY_WEBHOOK_ENABLE_PRIMARY=on \
  -e RUSTFS_NOTIFY_WEBHOOK_ENDPOINT_PRIMARY=http://<host-ip>:3020/webhook \
  -e RUSTFS_NOTIFY_WEBHOOK_QUEUE_DIR_PRIMARY=/tmp/rustfs-events \
+  -e RUSTFS_OUTBOUND_ALLOW_ORIGINS=http://<host-ip>:3020 \
  rustfs/rustfs:latest
 ```

@@ -171,6 +172,11 @@ Notes:
 - For ARN `arn:rustfs:sqs::primary:webhook`, use instance-scoped env vars with `_PRIMARY`.
 - If queue dir is omitted, default is `/opt/rustfs/events`; ensure it is writable by the container runtime user.
 - `RUSTFS_NOTIFY_WEBHOOK_SKIP_TLS_VERIFY_PRIMARY` defaults to `false`; enabling it skips webhook TLS certificate verification, allows MITM attacks, and emits a startup warning. Prefer `RUSTFS_NOTIFY_WEBHOOK_CLIENT_CA_PRIMARY` for private CAs.
+- Since `1.0.0-beta.11`, webhook endpoints on private or container networks
+  (`Docker Compose service names`, `host.docker.internal`, RFC 1918 addresses) are
+  blocked unless their exact `scheme://host:port` origin is listed in
+  `RUSTFS_OUTBOUND_ALLOW_ORIGINS` (the origin only, without the path). See
+  [Outbound Connection Policy](docs/operations/outbound-connection-policy.md).

 **NOTE**: We recommend reviewing the `docker-compose.yml` file before running. It defines several services including Grafana, Prometheus, and Jaeger, which are helpful for RustFS observability. If you wish to start Redis or Nginx containers, you can specify the corresponding profiles.

@@ -262,7 +268,7 @@ rustfs --help
 2. **Create a Bucket**: Use the console to create a new bucket for your objects.
 3. **Upload Objects**: You can upload files directly through the console or use S3-compatible APIs/clients to interact with your RustFS instance.

-**NOTE**: To access the RustFS instance via `https`, please refer to the [TLS Configuration Docs](https://docs.rustfs.com/integration/tls-configured.html).
+**NOTE**: To access the RustFS instance via `https`, please refer to the [TLS Configuration Docs](https://docs.rustfs.com/integration/tls-configured).

 ### OIDC Roles Claim (Microsoft Entra ID)

@@ -113,7 +113,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.11
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.12
 ```

 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：
@@ -214,7 +214,7 @@ rustfs --help
 2. **创建存储桶**: 使用控制台为您的对象创建一个新的存储桶 (Bucket)。
 3. **上传对象**: 您可以直接通过控制台上传文件，或使用 S3 兼容的 API/客户端与您的 RustFS 实例进行交互。

-**注意**: 如果您希望通过 `https` 访问 RustFS 实例，请参考 [TLS 配置文档](https://docs.rustfs.com/integration/tls-configured.html)。
+**注意**: 如果您希望通过 `https` 访问 RustFS 实例，请参考 [TLS 配置文档](https://docs.rustfs.com/integration/tls-configured)。

 ## 文档

@@ -25,7 +25,33 @@ documentation = "https://docs.rs/rustfs-audit/latest/rustfs_audit/"
 keywords = ["audit", "target", "management", "fan-out", "RustFS"]
 categories = ["web-programming", "development-tools", "asynchronous", "api-bindings"]

+[features]
+default = []
+hotpath = [
+    "hotpath/hotpath",
+    "hotpath/tokio",
+    "hotpath/futures",
+    "rustfs-config/hotpath",
+    "rustfs-s3-types/hotpath",
+    "rustfs-targets/hotpath",
+]
+hotpath-alloc = [
+    "hotpath",
+    "hotpath/hotpath-alloc",
+    "rustfs-config/hotpath-alloc",
+    "rustfs-s3-types/hotpath-alloc",
+    "rustfs-targets/hotpath-alloc",
+]
+hotpath-cpu = [
+    "hotpath",
+    "hotpath/hotpath-cpu",
+    "rustfs-config/hotpath-cpu",
+    "rustfs-s3-types/hotpath-cpu",
+    "rustfs-targets/hotpath-cpu",
+]
+
 [dependencies]
+hotpath.workspace = true
 rustfs-targets = { workspace = true }
 rustfs-config = { workspace = true, features = ["audit", "server-config-model"] }
 rustfs-s3-types = { workspace = true }
@@ -25,7 +25,17 @@ keywords = ["checksum-calculation", "verification", "integrity", "authenticity",
 categories = ["web-programming", "development-tools", "network-programming"]
 documentation = "https://docs.rs/rustfs-checksums/latest/rustfs_checksum/"

+[lints]
+workspace = true
+
+[features]
+default = []
+hotpath = ["hotpath/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 bytes = { workspace = true, features = ["serde"] }
 crc-fast = { workspace = true }
 http = { workspace = true }
@@ -27,7 +27,14 @@ categories = ["web-programming", "development-tools", "data-structures"]
 [lints]
 workspace = true

+[features]
+default = []
+hotpath = ["hotpath/hotpath", "hotpath/tokio"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 tokio = { workspace = true, features = ["fs", "rt-multi-thread"] }
 tonic = { workspace = true, features = ["gzip", "deflate"] }
 uuid = { workspace = true, features = ["v4", "fast-rng", "macro-diagnostics"] }
@@ -768,6 +768,7 @@ pub struct Metrics {
    last_scan_cycle_replication_checks: AtomicU64,
    last_scan_cycle_usage_saves: AtomicU64,
    failed_scan_cycles: AtomicU64,
+    superseded_scan_cycles: AtomicU64,
    partial_scan_cycles_unknown: AtomicU64,
    partial_scan_cycles_runtime: AtomicU64,
    partial_scan_cycles_objects: AtomicU64,
@@ -785,6 +786,9 @@ pub struct Metrics {
    scanner_expiry_queue_missed: AtomicU64,
    scanner_expiry_queued_total: AtomicU64,
    scanner_expiry_missed_total: AtomicU64,
+    scanner_expiry_blocked_total: AtomicU64,
+    scanner_expiry_not_enqueued_total: AtomicU64,
+    scanner_expiry_delete_failed_total: AtomicU64,
    scanner_transition_queue_capacity: AtomicU64,
    scanner_transition_queued: AtomicU64,
    scanner_transition_active: AtomicU64,
@@ -833,10 +837,12 @@ const SCAN_CYCLE_RESULT_UNKNOWN: u8 = 0;
 const SCAN_CYCLE_RESULT_SUCCESS: u8 = 1;
 const SCAN_CYCLE_RESULT_ERROR: u8 = 2;
 const SCAN_CYCLE_RESULT_PARTIAL: u8 = 3;
+const SCAN_CYCLE_RESULT_SUPERSEDED: u8 = 4;
 const SCAN_CYCLE_RESULT_UNKNOWN_LABEL: &str = "unknown";
 const SCAN_CYCLE_RESULT_SUCCESS_LABEL: &str = "success";
 const SCAN_CYCLE_RESULT_ERROR_LABEL: &str = "error";
 const SCAN_CYCLE_RESULT_PARTIAL_LABEL: &str = "partial";
+const SCAN_CYCLE_RESULT_SUPERSEDED_LABEL: &str = "superseded";

 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub enum ScanCyclePartialReason {
@@ -1048,6 +1054,12 @@ pub struct ScannerLifecycleExpirySnapshot {
    pub queue_missed: u64,
    pub scanner_queued: u64,
    pub scanner_missed: u64,
+    #[serde(default)]
+    pub scanner_blocked: u64,
+    #[serde(default)]
+    pub scanner_not_enqueued: u64,
+    #[serde(default)]
+    pub delete_failed: u64,
 }

 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
@@ -1102,6 +1114,8 @@ pub struct ScannerLastMinute {
 pub struct ScannerMetricsReport {
    pub collected_at: DateTime<Utc>,
    pub current_cycle: u64,
+    #[serde(default)]
+    pub current_cycle_active: bool,
    pub current_started: DateTime<Utc>,
    pub cycles_completed_at: Vec<DateTime<Utc>>,
    pub ongoing_buckets: usize,
@@ -1208,6 +1222,8 @@ pub struct ScannerMetricsReport {
    pub last_cycle_usage_saves: u64,
    pub failed_cycles: u64,
    #[serde(default)]
+    pub superseded_cycles: u64,
+    #[serde(default)]
    pub partial_cycles_unknown: u64,
    #[serde(default)]
    pub partial_cycles_runtime: u64,
@@ -1310,6 +1326,7 @@ fn scan_cycle_result_label(result: u8) -> &'static str {
        SCAN_CYCLE_RESULT_SUCCESS => SCAN_CYCLE_RESULT_SUCCESS_LABEL,
        SCAN_CYCLE_RESULT_ERROR => SCAN_CYCLE_RESULT_ERROR_LABEL,
        SCAN_CYCLE_RESULT_PARTIAL => SCAN_CYCLE_RESULT_PARTIAL_LABEL,
+        SCAN_CYCLE_RESULT_SUPERSEDED => SCAN_CYCLE_RESULT_SUPERSEDED_LABEL,
        _ => SCAN_CYCLE_RESULT_UNKNOWN_LABEL,
    }
 }
@@ -1633,6 +1650,11 @@ pub fn emit_scan_cycle_partial_with_source(
    metrics::counter!(OTEL_SCANNER_CYCLES, "result" => SCAN_CYCLE_RESULT_PARTIAL_LABEL).increment(1);
 }

+pub fn emit_scan_cycle_superseded(duration: Duration) {
+    global_metrics().record_scan_cycle_superseded(duration);
+    metrics::counter!(OTEL_SCANNER_CYCLES, "result" => SCAN_CYCLE_RESULT_SUPERSEDED_LABEL).increment(1);
+}
+
 pub fn emit_scan_bucket_drive_complete(success: bool, bucket: &str, disk: &str, duration: Duration) {
    let result = if success { "success" } else { "error" };
    metrics::counter!(
@@ -1726,6 +1748,7 @@ impl Metrics {
            last_scan_cycle_replication_checks: AtomicU64::new(0),
            last_scan_cycle_usage_saves: AtomicU64::new(0),
            failed_scan_cycles: AtomicU64::new(0),
+            superseded_scan_cycles: AtomicU64::new(0),
            partial_scan_cycles_unknown: AtomicU64::new(0),
            partial_scan_cycles_runtime: AtomicU64::new(0),
            partial_scan_cycles_objects: AtomicU64::new(0),
@@ -1743,6 +1766,9 @@ impl Metrics {
            scanner_expiry_queue_missed: AtomicU64::new(0),
            scanner_expiry_queued_total: AtomicU64::new(0),
            scanner_expiry_missed_total: AtomicU64::new(0),
+            scanner_expiry_blocked_total: AtomicU64::new(0),
+            scanner_expiry_not_enqueued_total: AtomicU64::new(0),
+            scanner_expiry_delete_failed_total: AtomicU64::new(0),
            scanner_transition_queue_capacity: AtomicU64::new(0),
            scanner_transition_queued: AtomicU64::new(0),
            scanner_transition_active: AtomicU64::new(0),
@@ -1973,9 +1999,18 @@ impl Metrics {
            self.scanner_expiry_queued_total.fetch_add(count, Ordering::Relaxed);
        } else {
            self.scanner_expiry_missed_total.fetch_add(count, Ordering::Relaxed);
+            self.scanner_expiry_not_enqueued_total.fetch_add(count, Ordering::Relaxed);
        }
    }

+    pub fn record_scanner_expiry_blocked(&self, count: u64) {
+        self.scanner_expiry_blocked_total.fetch_add(count, Ordering::Relaxed);
+    }
+
+    pub fn record_scanner_expiry_delete_failed(&self, count: u64) {
+        self.scanner_expiry_delete_failed_total.fetch_add(count, Ordering::Relaxed);
+    }
+
    pub fn record_scanner_transition_enqueue_result(&self, count: u64, queued: bool) {
        self.record_scanner_ilm_enqueue_result(count, queued);
        if queued {
@@ -2018,7 +2053,7 @@ impl Metrics {
    pub fn record_scanner_transition_failed(&self, count: u64) {
        self.scanner_transition_failed.fetch_add(count, Ordering::Relaxed);
        self.record_scanner_source_failed(ScannerWorkSource::Lifecycle, count);
-        if !self.current_scan_cycle_work_active.load(Ordering::Relaxed) {
+        if !self.current_scan_cycle_work_active.load(Ordering::Acquire) {
            self.record_last_cycle_scanner_source_work(ScannerWorkSource::Lifecycle, ScannerSourceWorkUpdate::failed(count));
        }
    }
@@ -2303,6 +2338,21 @@ impl Metrics {
        *self.cycle_info.write().await = cycle;
    }

+    /// Publish a scanner cycle and its work-accounting baseline as one state transition.
+    pub async fn start_scan_cycle_work_with_cycle(&self, cycle: CurrentCycle) -> ScanCycleWorkSnapshot {
+        let mut current_cycle = self.cycle_info.write().await;
+        let snapshot = self.start_scan_cycle_work();
+        *current_cycle = Some(cycle);
+        snapshot
+    }
+
+    /// Publish the completed work snapshot and idle cycle state as one state transition.
+    pub async fn finish_scan_cycle_work_with_cycle(&self, start: ScanCycleWorkSnapshot, cycle: CurrentCycle) {
+        let mut current_cycle = self.cycle_info.write().await;
+        self.finish_scan_cycle_work(start);
+        *current_cycle = Some(cycle);
+    }
+
    /// Read the current cycle record.
    pub async fn get_cycle(&self) -> Option<CurrentCycle> {
        self.cycle_info.read().await.clone()
@@ -2349,6 +2399,18 @@ impl Metrics {
            .store(duration_millis_saturated(duration), Ordering::Relaxed);
    }

+    pub fn record_scan_cycle_superseded(&self, duration: Duration) {
+        self.record_scanner_cycle_end_time();
+        self.superseded_scan_cycles.fetch_add(1, Ordering::Relaxed);
+        self.last_scan_cycle_result
+            .store(SCAN_CYCLE_RESULT_SUPERSEDED, Ordering::Relaxed);
+        self.last_scan_cycle_partial_reason
+            .store(ScanCyclePartialReason::Unknown as u8, Ordering::Relaxed);
+        self.last_scan_cycle_partial_source.store(0, Ordering::Relaxed);
+        self.last_scan_cycle_duration_millis
+            .store(duration_millis_saturated(duration), Ordering::Relaxed);
+    }
+
    pub fn record_scan_cycle_partial(&self, duration: Duration, reason: ScanCyclePartialReason) {
        self.record_scan_cycle_partial_with_source(duration, reason, None);
    }
@@ -2419,7 +2481,7 @@ impl Metrics {
            &self.current_scan_cycle_replication_repair_work_start,
            &replication_repair_snapshot,
        );
-        self.current_scan_cycle_work_active.store(true, Ordering::Relaxed);
+        self.current_scan_cycle_work_active.store(true, Ordering::Release);
        snapshot
    }

@@ -2431,11 +2493,11 @@ impl Metrics {
        self.record_scan_cycle_work(work);
        self.record_scan_cycle_source_work(&source_work);
        self.record_scan_cycle_replication_repair_work(&replication_repair_work);
-        self.current_scan_cycle_work_active.store(false, Ordering::Relaxed);
+        self.current_scan_cycle_work_active.store(false, Ordering::Release);
    }

    pub fn current_scan_cycle_has_unresolved_heal_work(&self) -> bool {
-        if !self.current_scan_cycle_work_active.load(Ordering::Relaxed) {
+        if !self.current_scan_cycle_work_active.load(Ordering::Acquire) {
            return false;
        }

@@ -2701,13 +2763,41 @@ impl Metrics {
    pub async fn report(&self) -> ScannerMetricsReport {
        let mut m = ScannerMetricsReport::default();

-        let has_cycle = if let Some(cycle) = self.get_cycle().await {
-            m.current_cycle = cycle.current;
-            m.cycles_completed_at = cycle.cycle_completed;
-            m.current_started = cycle.started;
-            true
-        } else {
-            false
+        let has_cycle = {
+            let cycle = self.cycle_info.read().await;
+            let has_cycle = if let Some(cycle) = cycle.as_ref() {
+                m.current_cycle = cycle.current;
+                m.cycles_completed_at = cycle.cycle_completed.clone();
+                m.current_started = cycle.started;
+                true
+            } else {
+                false
+            };
+            m.current_cycle_active = self.current_scan_cycle_work_active.load(Ordering::Acquire);
+            if m.current_cycle_active {
+                let current_work = self.scan_cycle_work_since(self.current_scan_cycle_work_start());
+                let current_source_work = self.scanner_source_work_since(&self.current_scan_cycle_source_work_start_values());
+                let current_replication_repair_work =
+                    self.scanner_replication_repair_work_since(&self.current_scan_cycle_replication_repair_work_start_values());
+                m.current_cycle_objects_scanned = current_work.objects_scanned;
+                m.current_cycle_directories_scanned = current_work.directories_scanned;
+                m.current_cycle_bucket_drive_scans = current_work.bucket_drive_scans;
+                m.current_cycle_bucket_drive_failures = current_work.bucket_drive_failures;
+                m.current_cycle_yield_events = current_work.yield_events;
+                m.current_cycle_yield_duration_seconds = current_work.yield_duration_millis as f64 / 1000.0;
+                m.current_cycle_throttle_sleep_events = current_work.throttle_sleep_events;
+                m.current_cycle_throttle_sleep_duration_seconds = current_work.throttle_sleep_duration_millis as f64 / 1000.0;
+                m.current_cycle_ilm_actions = current_work.ilm_actions;
+                m.current_cycle_lifecycle_expiry_actions = current_work.lifecycle_expiry_actions;
+                m.current_cycle_lifecycle_transition_actions = current_work.lifecycle_transition_actions;
+                m.current_cycle_heal_objects = current_work.heal_objects;
+                m.current_cycle_replication_checks = current_work.replication_checks;
+                m.current_cycle_usage_saves = current_work.usage_saves;
+                m.current_cycle_source_work = self.scanner_source_work_snapshots(&current_source_work);
+                m.current_cycle_replication_repair =
+                    self.scanner_replication_repair_work_snapshots(&current_replication_repair_work);
+            }
+            has_cycle
        };

        if !has_cycle && let Some(init_time) = crate::get_global_init_time().await {
@@ -2748,28 +2838,6 @@ impl Metrics {
        m.current_disk_scan_concurrency_limit = disk_scan_concurrency_limit;
        m.current_disk_bucket_scans_queued = disk_bucket_scans_queued;
        m.current_disk_bucket_scans_active = disk_bucket_scans_active;
-        if self.current_scan_cycle_work_active.load(Ordering::Relaxed) {
-            let current_work = self.scan_cycle_work_since(self.current_scan_cycle_work_start());
-            let current_source_work = self.scanner_source_work_since(&self.current_scan_cycle_source_work_start_values());
-            let current_replication_repair_work =
-                self.scanner_replication_repair_work_since(&self.current_scan_cycle_replication_repair_work_start_values());
-            m.current_cycle_objects_scanned = current_work.objects_scanned;
-            m.current_cycle_directories_scanned = current_work.directories_scanned;
-            m.current_cycle_bucket_drive_scans = current_work.bucket_drive_scans;
-            m.current_cycle_bucket_drive_failures = current_work.bucket_drive_failures;
-            m.current_cycle_yield_events = current_work.yield_events;
-            m.current_cycle_yield_duration_seconds = current_work.yield_duration_millis as f64 / 1000.0;
-            m.current_cycle_throttle_sleep_events = current_work.throttle_sleep_events;
-            m.current_cycle_throttle_sleep_duration_seconds = current_work.throttle_sleep_duration_millis as f64 / 1000.0;
-            m.current_cycle_ilm_actions = current_work.ilm_actions;
-            m.current_cycle_lifecycle_expiry_actions = current_work.lifecycle_expiry_actions;
-            m.current_cycle_lifecycle_transition_actions = current_work.lifecycle_transition_actions;
-            m.current_cycle_heal_objects = current_work.heal_objects;
-            m.current_cycle_replication_checks = current_work.replication_checks;
-            m.current_cycle_usage_saves = current_work.usage_saves;
-            m.current_cycle_source_work = self.scanner_source_work_snapshots(&current_source_work);
-            m.current_cycle_replication_repair = self.scanner_replication_repair_work_snapshots(&current_replication_repair_work);
-        }
        let last_cycle_result = self.last_scan_cycle_result.load(Ordering::Relaxed);
        m.last_cycle_result = scan_cycle_result_label(last_cycle_result).to_string();
        m.last_cycle_result_code = last_cycle_result as u64;
@@ -2802,6 +2870,7 @@ impl Metrics {
        m.last_cycle_replication_repair =
            self.scanner_replication_repair_work_counter_snapshots(&self.last_scan_cycle_replication_repair_work);
        m.failed_cycles = self.failed_scan_cycles.load(Ordering::Relaxed);
+        m.superseded_cycles = self.superseded_scan_cycles.load(Ordering::Relaxed);
        m.partial_cycles_unknown = self.partial_scan_cycles_unknown.load(Ordering::Relaxed);
        m.partial_cycles_runtime = self.partial_scan_cycles_runtime.load(Ordering::Relaxed);
        m.partial_cycles_objects = self.partial_scan_cycles_objects.load(Ordering::Relaxed);
@@ -2825,6 +2894,9 @@ impl Metrics {
            queue_missed: self.scanner_expiry_queue_missed.load(Ordering::Relaxed),
            scanner_queued: self.scanner_expiry_queued_total.load(Ordering::Relaxed),
            scanner_missed: self.scanner_expiry_missed_total.load(Ordering::Relaxed),
+            scanner_blocked: self.scanner_expiry_blocked_total.load(Ordering::Relaxed),
+            scanner_not_enqueued: self.scanner_expiry_not_enqueued_total.load(Ordering::Relaxed),
+            delete_failed: self.scanner_expiry_delete_failed_total.load(Ordering::Relaxed),
        };
        m.lifecycle_transition = ScannerLifecycleTransitionSnapshot {
            current_queue_capacity: self.scanner_transition_queue_capacity.load(Ordering::Relaxed),
@@ -2950,19 +3022,15 @@ pub type CloseDiskFn = Arc<dyn Fn() -> Pin<Box<dyn Future<Output = ()> + Send>>

 /// Register a new disk in the global path tracker and return two callbacks:
 /// one to update the current path and one to deregister the disk when done.
-pub fn current_path_updater(disk: &str, initial: &str) -> (UpdateCurrentPathFn, CloseDiskFn) {
+pub async fn current_path_updater(disk: &str, initial: &str) -> (UpdateCurrentPathFn, CloseDiskFn) {
    let tracker = Arc::new(CurrentPathTracker::new(initial.to_string()));
    let disk_name = disk.to_string();

-    let tracker_clone = Arc::clone(&tracker);
-    let disk_insert = disk_name.clone();
-    tokio::spawn(async move {
-        global_metrics()
-            .current_paths
-            .write()
-            .await
-            .insert(disk_insert, tracker_clone);
-    });
+    global_metrics()
+        .current_paths
+        .write()
+        .await
+        .insert(disk_name.clone(), Arc::clone(&tracker));

    let update_fn: UpdateCurrentPathFn = {
        let tracker = Arc::clone(&tracker);
@@ -2990,23 +3058,28 @@ pub fn current_path_updater(disk: &str, initial: &str) -> (UpdateCurrentPathFn,
 // CloseDiskGuard
 // ---------------------------------------------------------------------------

-pub struct CloseDiskGuard(CloseDiskFn);
+pub struct CloseDiskGuard(Option<CloseDiskFn>);

 impl CloseDiskGuard {
    pub fn new(close_disk: CloseDiskFn) -> Self {
-        Self(close_disk)
+        Self(Some(close_disk))
    }

-    pub async fn close(&self) {
-        self.0().await;
+    pub async fn close(&mut self) {
+        let Some(close_disk) = self.0.clone() else {
+            return;
+        };
+        close_disk().await;
+        self.0 = None;
    }
 }

 impl Drop for CloseDiskGuard {
    fn drop(&mut self) {
-        if let Ok(handle) = tokio::runtime::Handle::try_current() {
-            let close_fn = self.0.clone();
-            handle.spawn(async move { close_fn().await });
+        if let Some(close_disk) = self.0.take()
+            && let Ok(handle) = tokio::runtime::Handle::try_current()
+        {
+            handle.spawn(close_disk());
        }
        // If there is no runtime we are in a test or shutdown path; skip cleanup.
    }
@@ -3016,6 +3089,61 @@ impl Drop for CloseDiskGuard {
 mod tests {
    use super::*;

+    #[tokio::test]
+    async fn close_disk_guard_runs_cleanup_when_an_early_return_drops_it() {
+        let (closed_tx, closed_rx) = tokio::sync::oneshot::channel();
+        let closed_tx = Arc::new(std::sync::Mutex::new(Some(closed_tx)));
+        let close_disk: CloseDiskFn = {
+            let closed_tx = Arc::clone(&closed_tx);
+            Arc::new(move || {
+                let closed_tx = closed_tx.lock().expect("close callback lock").take();
+                Box::pin(async move {
+                    if let Some(closed_tx) = closed_tx {
+                        let _ = closed_tx.send(());
+                    }
+                })
+            })
+        };
+
+        let guard = CloseDiskGuard::new(close_disk);
+        drop(guard);
+
+        tokio::time::timeout(std::time::Duration::from_secs(1), closed_rx)
+            .await
+            .expect("drop cleanup should run")
+            .expect("drop cleanup should signal");
+    }
+
+    #[tokio::test]
+    async fn close_disk_guard_runs_explicit_cleanup_once() {
+        let close_count = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let close_disk: CloseDiskFn = {
+            let close_count = Arc::clone(&close_count);
+            Arc::new(move || {
+                close_count.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                Box::pin(std::future::ready(()))
+            })
+        };
+
+        let mut guard = CloseDiskGuard::new(close_disk);
+        guard.close().await;
+        drop(guard);
+        tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+
+        assert_eq!(close_count.load(std::sync::atomic::Ordering::Relaxed), 1);
+    }
+
+    #[tokio::test]
+    async fn current_path_updater_registers_before_return() {
+        let disk = format!("test-disk-{}", uuid::Uuid::new_v4());
+        let (_update_path, close_disk) = current_path_updater(&disk, "bucket-a").await;
+
+        assert!(global_metrics().current_paths.read().await.contains_key(&disk));
+
+        close_disk().await;
+        assert!(!global_metrics().current_paths.read().await.contains_key(&disk));
+    }
+
    #[tokio::test]
    async fn report_counts_active_scan_paths() {
        let metrics = Metrics::new();
@@ -3304,6 +3432,8 @@ mod tests {
        });
        metrics.record_scanner_expiry_enqueue_result(6, true);
        metrics.record_scanner_expiry_enqueue_result(2, false);
+        metrics.record_scanner_expiry_blocked(4);
+        metrics.record_scanner_expiry_delete_failed(1);

        let report = metrics.report().await;

@@ -3314,6 +3444,9 @@ mod tests {
        assert_eq!(report.lifecycle_expiry.queue_missed, 3);
        assert_eq!(report.lifecycle_expiry.scanner_queued, 6);
        assert_eq!(report.lifecycle_expiry.scanner_missed, 2);
+        assert_eq!(report.lifecycle_expiry.scanner_blocked, 4);
+        assert_eq!(report.lifecycle_expiry.scanner_not_enqueued, 2);
+        assert_eq!(report.lifecycle_expiry.delete_failed, 1);
    }

    #[tokio::test]
@@ -3850,6 +3983,21 @@ mod tests {
        assert_eq!(report.failed_cycles, 1);
    }

+    #[tokio::test]
+    async fn report_tracks_superseded_cycle_without_failed_increment() {
+        let metrics = Metrics::new();
+        metrics.record_scan_cycle_superseded(Duration::from_millis(750));
+
+        let report = metrics.report().await;
+
+        assert_eq!(report.last_cycle_result, SCAN_CYCLE_RESULT_SUPERSEDED_LABEL);
+        assert_eq!(report.last_cycle_result_code, u64::from(SCAN_CYCLE_RESULT_SUPERSEDED));
+        assert_eq!(report.last_cycle_duration_seconds, 0.75);
+        assert_eq!(report.failed_cycles, 0);
+        assert_eq!(report.superseded_cycles, 1);
+        assert_eq!(report.partial_cycles, 0);
+    }
+
    #[tokio::test]
    async fn report_tracks_successful_scan_cycle_without_failed_increment() {
        let metrics = Metrics::new();
@@ -4017,6 +4165,8 @@ mod tests {

        let report = metrics.report().await;

+        assert!(report.current_cycle_active);
+        assert_eq!(report.current_cycle, 0);
        assert_eq!(report.current_cycle_objects_scanned, 7);
        assert_eq!(report.current_cycle_directories_scanned, 3);
        assert_eq!(report.current_cycle_bucket_drive_scans, 2);
@@ -4033,6 +4183,8 @@ mod tests {
        metrics.finish_scan_cycle_work(start);
        let report = metrics.report().await;

+        assert!(!report.current_cycle_active);
+        assert_eq!(report.current_cycle, 0);
        assert_eq!(report.current_cycle_objects_scanned, 0);
        assert_eq!(report.current_cycle_directories_scanned, 0);
        assert_eq!(report.current_cycle_bucket_drive_scans, 0);
@@ -4059,6 +4211,91 @@ mod tests {
        assert_eq!(report.last_cycle_usage_saves, 2);
    }

+    #[tokio::test]
+    async fn scan_cycle_activity_and_cycle_state_publish_together() {
+        let metrics = Metrics::new();
+        let cycle_started = Utc::now() - chrono::Duration::seconds(5);
+        let active_cycle = CurrentCycle {
+            current: 12,
+            next: 13,
+            started: cycle_started,
+            ..Default::default()
+        };
+
+        let cycle_state = metrics.cycle_info.read().await;
+        let mut start_transition = Box::pin(metrics.start_scan_cycle_work_with_cycle(active_cycle));
+        let waker = std::task::Waker::noop();
+        let mut context = std::task::Context::from_waker(waker);
+        assert!(start_transition.as_mut().poll(&mut context).is_pending());
+        assert!(!metrics.current_scan_cycle_work_active.load(Ordering::Acquire));
+        drop(cycle_state);
+
+        let start = start_transition.await;
+        let active = metrics.report().await;
+        assert!(active.current_cycle_active);
+        assert_eq!(active.current_cycle, 12);
+        assert_eq!(active.current_started, cycle_started);
+
+        let idle_cycle = CurrentCycle {
+            current: 0,
+            next: 13,
+            started: cycle_started,
+            ..Default::default()
+        };
+        let cycle_state = metrics.cycle_info.read().await;
+        let mut finish_transition = Box::pin(metrics.finish_scan_cycle_work_with_cycle(start, idle_cycle));
+        assert!(finish_transition.as_mut().poll(&mut context).is_pending());
+        assert!(metrics.current_scan_cycle_work_active.load(Ordering::Acquire));
+        drop(cycle_state);
+
+        finish_transition.await;
+        let idle = metrics.report().await;
+        assert!(!idle.current_cycle_active);
+        assert_eq!(idle.current_cycle, 0);
+    }
+
+    #[tokio::test]
+    async fn report_keeps_cycle_identity_and_work_in_one_snapshot() {
+        let metrics = Metrics::new();
+        let cycle_ten = CurrentCycle {
+            current: 10,
+            next: 11,
+            started: Utc::now() - chrono::Duration::seconds(10),
+            ..Default::default()
+        };
+        let cycle_ten_start = metrics.start_scan_cycle_work_with_cycle(cycle_ten.clone()).await;
+        metrics.operations[Metric::ScanObject as usize].store(1, Ordering::Relaxed);
+
+        let paths = metrics.current_paths.write().await;
+        let mut report = Box::pin(metrics.report());
+        let waker = std::task::Waker::noop();
+        let mut context = std::task::Context::from_waker(waker);
+        assert!(report.as_mut().poll(&mut context).is_pending());
+
+        metrics
+            .finish_scan_cycle_work_with_cycle(cycle_ten_start, CurrentCycle { current: 0, ..cycle_ten })
+            .await;
+        let cycle_eleven_start = metrics
+            .start_scan_cycle_work_with_cycle(CurrentCycle {
+                current: 11,
+                next: 12,
+                started: Utc::now(),
+                ..Default::default()
+            })
+            .await;
+        metrics.operations[Metric::ScanObject as usize].store(101, Ordering::Relaxed);
+
+        drop(paths);
+        let snapshot = report.await;
+
+        assert_eq!(snapshot.current_cycle, 10);
+        assert_eq!(snapshot.current_cycle_objects_scanned, 1);
+
+        metrics
+            .finish_scan_cycle_work_with_cycle(cycle_eleven_start, CurrentCycle::default())
+            .await;
+    }
+
    #[tokio::test]
    async fn scanner_cycle_ilm_actions_ignore_global_ilm_work() {
        let metrics = Metrics::new();
@@ -10,7 +10,17 @@ description = "Shared concurrency contract types for RustFS - workload admission
 keywords = ["rustfs", "concurrency", "admission", "backpressure", "workers"]
 categories = ["concurrency", "filesystem"]

+[lints]
+workspace = true
+
+[features]
+default = []
+hotpath = ["hotpath/hotpath", "hotpath/tokio", "rustfs-io-core/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc", "rustfs-io-core/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu", "rustfs-io-core/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 # Internal crates
 rustfs-io-core = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
@@ -25,6 +25,7 @@ keywords = ["configuration", "settings", "management", "rustfs", "Minio"]
 categories = ["web-programming", "development-tools", "config"]

 [dependencies]
+hotpath.workspace = true
 const-str = { workspace = true, optional = true, features = ["std", "proc"] }
 serde = { workspace = true, optional = true, features = ["derive"] }
 serde_json = { workspace = true, optional = true, features = ["raw_value"] }
@@ -34,6 +35,9 @@ workspace = true

 [features]
 default = ["constants"]
+hotpath = ["hotpath/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
 audit = ["dep:const-str", "constants"]
 constants = ["dep:const-str"]
 notify = ["dep:const-str", "constants"]
@@ -66,6 +66,10 @@ Current guidance:

 - `RUSTFS_BROWSER_REDIRECT_URL` sets the externally reachable browser origin used for OIDC callback, console success redirect, and logout fallback URLs. Configure it to the public scheme and authority without a path, for example `https://console.example.com`. In load-balancer deployments, keep OIDC authorize and callback requests on the same backend node because the in-flight OIDC `state` is local to the RustFS node.

+## Distributed endpoint locality
+
+- `RUSTFS_LOCAL_ENDPOINT_HOST` identifies this server's host in a distributed `RUSTFS_VOLUMES` topology without resolving every peer during startup. Set it to exactly one host, without a scheme, port, or path. It is accepted only for orchestrated URL topologies and must match at least one endpoint on the RustFS server port; invalid or unmatched values fail startup. Leave it unset to retain DNS-based locality discovery.
+
 ## Scanner environment aliases

 - `RUSTFS_SCANNER_SPEED` (canonical, also accepts `MINIO_SCANNER_SPEED`)
@@ -131,6 +131,10 @@ pub const ENV_RUSTFS_ADDRESS: &str = "RUSTFS_ADDRESS";
 /// Environment variable for server volumes.
 pub const ENV_RUSTFS_VOLUMES: &str = "RUSTFS_VOLUMES";

+/// Environment variable identifying this server's host in distributed endpoint
+/// lists without relying on DNS locality discovery.
+pub const ENV_LOCAL_ENDPOINT_HOST: &str = "RUSTFS_LOCAL_ENDPOINT_HOST";
+
 /// Environment variable to explicitly bypass local physical disk independence checks.
 pub const ENV_UNSAFE_BYPASS_DISK_CHECK: &str = "RUSTFS_UNSAFE_BYPASS_DISK_CHECK";

@@ -226,6 +230,19 @@ pub const ENV_RUSTFS_KMS_ENABLE: &str = "RUSTFS_KMS_ENABLE";
 /// Default value: false
 pub const DEFAULT_KMS_ENABLE: bool = false;

+/// Environment variable enabling per-key KMS authorization on the SSE-KMS data path.
+///
+/// When enabled, an SSE-KMS write additionally requires `kms:GenerateDataKey` and an
+/// SSE-KMS read additionally requires `kms:Decrypt` on the resolved key, evaluated as
+/// the requesting identity. SSE-S3 and SSE-C are unaffected.
+pub const ENV_RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY: &str = "RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY";
+
+/// Default per-key KMS authorization mode for the SSE-KMS data path.
+///
+/// Off for now so deployments whose identity policies only grant s3 actions keep
+/// working; the default flips to on in a later release.
+pub const DEFAULT_KMS_ENFORCE_SSE_KEY_POLICY: bool = false;
+
 /// Environment variable for server KMS backend.
 pub const ENV_RUSTFS_KMS_BACKEND: &str = "RUSTFS_KMS_BACKEND";

@@ -28,6 +28,15 @@ pub const MAX_ADMIN_REQUEST_BODY_SIZE: usize = 1024 * 1024; // 1 MB
 /// Rationale: ZIP archives with hundreds of IAM entities. 10MB allows ~10,000 small configs.
 pub const MAX_IAM_IMPORT_SIZE: usize = 10 * 1024 * 1024; // 10 MB

+/// Maximum total size the members of an IAM import ZIP may expand to (100 MB).
+/// Used for: bounding decompression of `ImportIam` archive members.
+/// Rationale: `MAX_IAM_IMPORT_SIZE` caps the *compressed* upload only. Deflate
+/// reaches ratios far above 100:1, so without a separate budget a 10 MB archive
+/// can expand without bound. 100 MB keeps a 10x headroom over the compressed cap
+/// — ample for legitimate IAM exports, which are small JSON documents — while
+/// keeping the worst case bounded.
+pub const MAX_IAM_IMPORT_EXPANDED_SIZE: u64 = 100 * 1024 * 1024; // 100 MB
+
 /// Maximum size for bucket metadata import operations (100 MB)
 /// Used for: Bucket metadata import containing configurations for many buckets
 /// Rationale: Large deployments may have thousands of buckets with various configs.
@@ -54,3 +63,12 @@ pub const MAX_HEAL_REQUEST_SIZE: usize = 1024 * 1024; // 1 MB
 /// 10MB provides generous headroom for legitimate responses while preventing
 /// memory exhaustion from malicious or misconfigured remote services.
 pub const MAX_S3_CLIENT_RESPONSE_SIZE: usize = 10 * 1024 * 1024; // 10 MB
+
+/// Maximum size for OIDC provider response bodies (1 MB)
+/// Used for: discovery documents, JWKS documents and token endpoint responses
+/// Rationale: a hostile or compromised identity provider must not be able to exhaust
+/// memory through an arbitrarily large or endless response body.
+/// - Discovery documents: typically < 10KB
+/// - JWKS documents: typically < 50KB
+/// - Token responses: typically < 10KB
+pub const MAX_OIDC_RESPONSE_SIZE: usize = 1024 * 1024; // 1 MB
@@ -97,19 +97,96 @@ pub const ENV_INTERNODE_RPC_MAX_MESSAGE_SIZE: &str = "RUSTFS_INTERNODE_RPC_MAX_M
 pub const ENV_INTERNODE_RPC_LARGE_PAYLOAD_WARN_BYTES: &str = "RUSTFS_INTERNODE_RPC_LARGE_PAYLOAD_WARN_BYTES";
 pub const DEFAULT_INTERNODE_RPC_LARGE_PAYLOAD_WARN_BYTES: usize = 8 * 1024 * 1024;

-/// Stop dual-writing the JSON compatibility strings on internode metadata RPCs and send only the
+/// Request stopping the JSON compatibility strings on internode metadata RPCs and sending only the
 /// msgpack `_bin` payloads (grpc-optimization P2-1).
 ///
-/// Defaults to `false` (dual-write, byte-for-byte legacy behavior). This is a rollout lever, not a
-/// wire-format change: it may only be enabled **after** the JSON-fallback counter
-/// (`rustfs_system_network_internode_msgpack_json_fallback_total`) has read zero across a release
-/// window fleet-wide, confirming every peer decodes `_bin` first. Single-env rollback. See
+/// Defaults to `false` (dual-write, byte-for-byte legacy behavior). This is only a request; RustFS
+/// keeps JSON compatibility fields unless [`ENV_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED`] is also
+/// true after the release-window convergence and rollback gates pass. See
 /// `docs/operations/internode-msgpack-json-convergence-runbook.md`.
 pub const ENV_INTERNODE_RPC_MSGPACK_ONLY: &str = "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY";
 pub const DEFAULT_INTERNODE_RPC_MSGPACK_ONLY: bool = false;

-// Compile-time invariant: dual-write by default so the base build is byte-for-byte legacy behavior.
+/// Explicit fleet-wide confirmation gate for [`ENV_INTERNODE_RPC_MSGPACK_ONLY`].
+///
+/// This separate default-off guard prevents a single legacy flag from accidentally emptying JSON
+/// fields in a mixed-version fleet where an older peer still reads the JSON field.
+pub const ENV_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED: &str = "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED";
+pub const DEFAULT_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED: bool = false;
+
+// Compile-time invariants: dual-write by default so the base build is byte-for-byte legacy behavior.
 const _: () = assert!(!DEFAULT_INTERNODE_RPC_MSGPACK_ONLY);
+const _: () = assert!(!DEFAULT_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED);
+
+/// Require target-bound v2 signatures on every internode gRPC request, rejecting the legacy
+/// constant-target fallback instead of accepting it (<https://github.com/rustfs/backlog/issues/1327>).
+///
+/// Defaults to `false` (fail-open): a request without any v2 auth headers keeps authenticating
+/// through the legacy signature, so legacy-only peers survive rolling upgrades with byte-for-byte
+/// the pre-gate acceptance behavior. This is a rollout lever, not a wire-format change: it may only
+/// be enabled **after** the v1-fallback counter
+/// (`rustfs_system_network_internode_signature_v1_fallback_total`) has read zero across a release
+/// window fleet-wide, confirming every peer already sends v2 authentication on every internode gRPC
+/// request. Single-env rollback. Requests that do carry v2 headers are unaffected by this switch:
+/// they are always verified as v2 with no downgrade, strict or not.
+pub const ENV_INTERNODE_RPC_SIGNATURE_STRICT: &str = "RUSTFS_INTERNODE_RPC_SIGNATURE_STRICT";
+pub const DEFAULT_INTERNODE_RPC_SIGNATURE_STRICT: bool = false;
+
+// Compile-time invariant: fail-open by default so legacy-only peers keep authenticating during
+// rolling upgrades until the fleet-wide v1-fallback counter reads zero.
+const _: () = assert!(!DEFAULT_INTERNODE_RPC_SIGNATURE_STRICT);
+
+/// Require a signature-bound canonical body digest on every mutating internode disk RPC
+/// (RenameData, DeleteVersion, DeleteVersions, WriteMetadata, UpdateMetadata, WriteAll, Delete,
+/// DeletePaths, RenameFile, RenamePart, DeleteVolume, MakeVolume, MakeVolumes), rejecting requests
+/// that authenticate without one (<https://github.com/rustfs/backlog/issues/1327>).
+///
+/// Defaults to `false` (fail-open): a mutating request without a body digest keeps authenticating
+/// through the method-bound v2 (or legacy) signature, so peers from releases that predate
+/// body-digest signing survive rolling upgrades unchanged. Requests that do carry a digest are
+/// always verified with no downgrade, strict or not — the digest value is part of the signed v2
+/// scope, so an on-path attacker cannot strip it without invalidating the signature. This is a
+/// rollout lever gated on the body-digest fallback counter
+/// (`rustfs_system_network_internode_body_digest_fallback_total`) reading zero across a release
+/// window fleet-wide. Single-env rollback. It is deliberately separate from
+/// [`ENV_INTERNODE_RPC_SIGNATURE_STRICT`]: the two enforcement flips converge on different
+/// counters and must not gate each other.
+pub const ENV_INTERNODE_RPC_BODY_DIGEST_STRICT: &str = "RUSTFS_INTERNODE_RPC_BODY_DIGEST_STRICT";
+pub const DEFAULT_INTERNODE_RPC_BODY_DIGEST_STRICT: bool = false;
+
+// Compile-time invariant: fail-open by default so digestless peers keep authenticating during
+// rolling upgrades until the fleet-wide body-digest fallback counter reads zero.
+const _: () = assert!(!DEFAULT_INTERNODE_RPC_BODY_DIGEST_STRICT);
+
+/// Require the replay-scoped internode RPC signature after the fleet has converged on it.
+///
+/// The default keeps v1/v2 peers available during a rolling upgrade. Operators may set this only
+/// after `rustfs_system_network_internode_replay_scope_fallback_total` remains zero for a full
+/// release window. The node still accepts a v2-authenticated `Ping` carrying an epoch challenge:
+/// that narrowly scoped bootstrap lets an upgraded client learn the receiving process epoch and
+/// immediately retry with the replay-scoped signature after a peer restart.
+pub const ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT: &str = "RUSTFS_INTERNODE_RPC_REPLAY_SCOPE_STRICT";
+pub const DEFAULT_INTERNODE_RPC_REPLAY_SCOPE_STRICT: bool = false;
+
+// Compile-time invariant: mixed-version clusters must remain available until operators make the
+// observed fallback counter an explicit strictness decision.
+const _: () = assert!(!DEFAULT_INTERNODE_RPC_REPLAY_SCOPE_STRICT);
+
+/// Capacity (distinct nonces) of the process-local internode RPC replay cache that enforces
+/// one-time consumption of authenticated RPC signatures.
+///
+/// The cache retains each nonce for the ~10-minute signature freshness envelope. Once peers use
+/// replay-scoped v3 authentication, every authenticated RPC consumes one entry, so the steady
+/// state holds roughly `authenticated RPC RPS x 601s` entries. The default sustains about 1,700
+/// authenticated RPCs per second (about 120 MiB worst case, allocated only under sustained load);
+/// operators must size it for the node's aggregate peak RPC rate before enabling strict replay
+/// scope. Overflow fails closed — legitimate signed traffic is the only thing that can fill the
+/// cache (replays are rejected before insertion, and an attacker cannot mint valid nonces without
+/// the shared secret) — and increments
+/// `rustfs_system_network_internode_replay_cache_overflow_total`, so a sustained non-zero overflow
+/// counter means this capacity is undersized for the node's peak authenticated RPC rate.
+pub const ENV_INTERNODE_RPC_REPLAY_CACHE_CAPACITY: &str = "RUSTFS_INTERNODE_RPC_REPLAY_CACHE_CAPACITY";
+pub const DEFAULT_INTERNODE_RPC_REPLAY_CACHE_CAPACITY: usize = 1_048_576;

 /// Consecutive-failure threshold after which an internode peer is marked offline (grpc-optimization
 /// P3 observability).
@@ -273,8 +350,36 @@ mod tests {

    #[test]
    fn internode_msgpack_only_env_name_is_stable() {
-        // The dual-write-by-default invariant is asserted at compile time next to the definition.
+        // The dual-write-by-default invariants are asserted at compile time next to the definitions.
        assert_eq!(ENV_INTERNODE_RPC_MSGPACK_ONLY, "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY");
+        assert_eq!(
+            ENV_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED,
+            "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED"
+        );
+    }
+
+    #[test]
+    fn internode_signature_strict_env_name_is_stable() {
+        // The fail-open default invariant is asserted at compile time next to the definition.
+        assert_eq!(ENV_INTERNODE_RPC_SIGNATURE_STRICT, "RUSTFS_INTERNODE_RPC_SIGNATURE_STRICT");
+    }
+
+    #[test]
+    fn internode_body_digest_strict_env_name_is_stable() {
+        // The fail-open default invariant is asserted at compile time next to the definition.
+        assert_eq!(ENV_INTERNODE_RPC_BODY_DIGEST_STRICT, "RUSTFS_INTERNODE_RPC_BODY_DIGEST_STRICT");
+    }
+
+    #[test]
+    fn internode_replay_scope_strict_env_name_is_stable() {
+        // The fail-open default invariant is asserted at compile time next to the definition.
+        assert_eq!(ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT, "RUSTFS_INTERNODE_RPC_REPLAY_SCOPE_STRICT");
+    }
+
+    #[test]
+    fn internode_replay_cache_capacity_defaults_and_env_name() {
+        assert_eq!(ENV_INTERNODE_RPC_REPLAY_CACHE_CAPACITY, "RUSTFS_INTERNODE_RPC_REPLAY_CACHE_CAPACITY");
+        assert_eq!(DEFAULT_INTERNODE_RPC_REPLAY_CACHE_CAPACITY, 1_048_576);
    }

    #[test]
@@ -116,6 +116,27 @@ pub const ENV_OBJECT_GET_SKIP_BITROT_VERIFY: &str = "RUSTFS_OBJECT_GET_SKIP_BITR
 /// Default: bitrot verification is enabled on GetObject reads (do not skip).
 pub const DEFAULT_OBJECT_GET_SKIP_BITROT_VERIFY: bool = false;

+/// Request writing the complete remote-tier version state into object metadata.
+///
+/// This remains ineffective until
+/// [`ENV_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED`] is also enabled.
+pub const ENV_TIER_REMOTE_VERSION_STATE_WRITE: &str = "RUSTFS_TIER_REMOTE_VERSION_STATE_WRITE";
+pub const DEFAULT_TIER_REMOTE_VERSION_STATE_WRITE: bool = false;
+
+/// Operator-attested fleet-wide confirmation for
+/// [`ENV_TIER_REMOTE_VERSION_STATE_WRITE`].
+///
+/// This flag is an operational contract, not automatic capability discovery.
+/// Operators may enable it only after every node that can write or read
+/// transitioned object metadata supports the remote version-state schema and
+/// semantics. Keeping the confirmation separate makes a single-node request or
+/// a writer whose local opt-in is removed fail closed.
+pub const ENV_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED: &str = "RUSTFS_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED";
+pub const DEFAULT_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED: bool = false;
+
+const _: () = assert!(!DEFAULT_TIER_REMOTE_VERSION_STATE_WRITE);
+const _: () = assert!(!DEFAULT_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED);
+
 // =============================================================================
 // Concurrent Request Fix - Timeout and Backpressure Configuration
 // =============================================================================
@@ -617,3 +638,15 @@ pub const ENV_OBJECT_IO_RANDOM_READAHEAD_DISABLE_CONCURRENCY: &str = "RUSTFS_OBJ

 /// Default read-ahead disable concurrency threshold: 4.
 pub const DEFAULT_OBJECT_IO_RANDOM_READAHEAD_DISABLE_CONCURRENCY: usize = 4;
+
+#[cfg(test)]
+mod remote_version_state_tests {
+    #[test]
+    fn remote_version_state_gate_uses_stable_environment_names() {
+        assert_eq!(super::ENV_TIER_REMOTE_VERSION_STATE_WRITE, "RUSTFS_TIER_REMOTE_VERSION_STATE_WRITE");
+        assert_eq!(
+            super::ENV_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED,
+            "RUSTFS_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED"
+        );
+    }
+}
@@ -14,6 +14,7 @@

 // OIDC configuration field keys (used in KVS)
 pub const OIDC_CONFIG_URL: &str = "config_url";
+pub const OIDC_ISSUER: &str = "issuer";
 pub const OIDC_CLIENT_ID: &str = "client_id";
 pub const OIDC_CLIENT_SECRET: &str = "client_secret";
 pub const OIDC_SCOPES: &str = "scopes";
@@ -33,6 +34,7 @@ pub const OIDC_HIDE_FROM_UI: &str = "hide_from_ui";
 // Environment variable names for OIDC
 pub const ENV_IDENTITY_OPENID_ENABLE: &str = "RUSTFS_IDENTITY_OPENID_ENABLE";
 pub const ENV_IDENTITY_OPENID_CONFIG_URL: &str = "RUSTFS_IDENTITY_OPENID_CONFIG_URL";
+pub const ENV_IDENTITY_OPENID_ISSUER: &str = "RUSTFS_IDENTITY_OPENID_ISSUER";
 pub const ENV_IDENTITY_OPENID_CLIENT_ID: &str = "RUSTFS_IDENTITY_OPENID_CLIENT_ID";
 pub const ENV_IDENTITY_OPENID_CLIENT_SECRET: &str = "RUSTFS_IDENTITY_OPENID_CLIENT_SECRET";
 pub const ENV_IDENTITY_OPENID_SCOPES: &str = "RUSTFS_IDENTITY_OPENID_SCOPES";
@@ -50,9 +52,10 @@ pub const ENV_IDENTITY_OPENID_USERNAME_CLAIM: &str = "RUSTFS_IDENTITY_OPENID_USE
 pub const ENV_IDENTITY_OPENID_HIDE_FROM_UI: &str = "RUSTFS_IDENTITY_OPENID_HIDE_FROM_UI";

 /// List of all environment variable keys for an OIDC provider.
-pub const ENV_IDENTITY_OPENID_KEYS: &[&str; 17] = &[
+pub const ENV_IDENTITY_OPENID_KEYS: &[&str; 18] = &[
    ENV_IDENTITY_OPENID_ENABLE,
    ENV_IDENTITY_OPENID_CONFIG_URL,
+    ENV_IDENTITY_OPENID_ISSUER,
    ENV_IDENTITY_OPENID_CLIENT_ID,
    ENV_IDENTITY_OPENID_CLIENT_SECRET,
    ENV_IDENTITY_OPENID_SCOPES,
@@ -74,6 +77,7 @@ pub const ENV_IDENTITY_OPENID_KEYS: &[&str; 17] = &[
 pub const IDENTITY_OPENID_KEYS: &[&str] = &[
    crate::ENABLE_KEY,
    OIDC_CONFIG_URL,
+    OIDC_ISSUER,
    OIDC_CLIENT_ID,
    OIDC_CLIENT_SECRET,
    OIDC_SCOPES,
@@ -57,6 +57,7 @@ pub const ENV_WEBDAV_CERTS_DIR: &str = "RUSTFS_WEBDAV_CERTS_DIR";
 pub const ENV_WEBDAV_CA_FILE: &str = "RUSTFS_WEBDAV_CA_FILE";
 pub const ENV_WEBDAV_MAX_BODY_SIZE: &str = "RUSTFS_WEBDAV_MAX_BODY_SIZE";
 pub const ENV_WEBDAV_REQUEST_TIMEOUT: &str = "RUSTFS_WEBDAV_REQUEST_TIMEOUT";
+pub const ENV_WEBDAV_MAX_CONNECTIONS: &str = "RUSTFS_WEBDAV_MAX_CONNECTIONS";

 /// Default SFTP server bind address.
 pub const DEFAULT_SFTP_ADDRESS: &str = "0.0.0.0:2222";
@@ -220,12 +220,10 @@ pub const ENV_SCANNER_YIELD_EVERY_N_OBJECTS: &str = "RUSTFS_SCANNER_YIELD_EVERY_
 pub const DEFAULT_SCANNER_IDLE_MODE: bool = true;

 /// Default set scan concurrency budget.
-/// `0` means no additional limit beyond deployment topology.
-pub const DEFAULT_SCANNER_MAX_CONCURRENT_SET_SCANS: usize = 0;
+pub const DEFAULT_SCANNER_MAX_CONCURRENT_SET_SCANS: usize = 4;

 /// Default disk scan concurrency budget.
-/// `0` means no additional limit beyond available disks in the set.
-pub const DEFAULT_SCANNER_MAX_CONCURRENT_DISK_SCANS: usize = 0;
+pub const DEFAULT_SCANNER_MAX_CONCURRENT_DISK_SCANS: usize = 4;

 /// Default object interval for cooperative scanner yields.
 pub const DEFAULT_SCANNER_YIELD_EVERY_N_OBJECTS: u64 = 128;
@@ -142,6 +142,10 @@ pub const DEFAULT_H2_KEEP_ALIVE_TIMEOUT: u64 = 10;
 /// proxy's upstream idle-keepalive, or lower the proxy's keepalive below this
 /// value. Environments that expose RustFS directly to untrusted slow clients and
 /// want tighter slowloris protection can lower it via the env var below.
+///
+/// The same budget bounds the TLS handshake on the listener, so an unauthenticated
+/// peer cannot park an accept task and its socket indefinitely by opening a
+/// connection and then stalling the handshake.
 pub const ENV_HTTP1_HEADER_READ_TIMEOUT: &str = "RUSTFS_HTTP1_HEADER_READ_TIMEOUT";
 pub const DEFAULT_HTTP1_HEADER_READ_TIMEOUT: u64 = 75;

@@ -24,7 +24,14 @@ description = "Credentials management utilities for RustFS, enabling secure hand
 keywords = ["rustfs", "Minio", "credentials", "authentication", "authorization"]
 categories = ["web-programming", "development-tools", "data-structures", "security"]

+[features]
+default = []
+hotpath = ["hotpath/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 base64-simd = { workspace = true }
 hmac = { workspace = true }
 rand = { workspace = true, features = ["serde"] }
@@ -29,6 +29,7 @@ documentation = "https://docs.rs/rustfs-crypto/latest/rustfs_crypto/"
 workspace = true

 [dependencies]
+hotpath.workspace = true
 aes-gcm = { workspace = true, optional = true, features = ["rand_core"] }
 argon2 = { workspace = true, optional = true }
 chacha20poly1305 = { workspace = true, optional = true }
@@ -49,6 +50,9 @@ time = { workspace = true, features = ["parsing", "formatting", "macros", "serde

 [features]
 default = ["crypto", "fips"]
+hotpath = ["hotpath/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
 fips = []
 crypto = [
    "dep:aes-gcm",
@@ -27,9 +27,15 @@ categories = ["data-structures", "filesystem"]
 [lints]
 workspace = true

+[features]
+default = []
+hotpath = ["hotpath/hotpath", "rustfs-filemeta/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc", "rustfs-filemeta/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu", "rustfs-filemeta/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 serde = { workspace = true, features = ["derive"] }
-path-clean = { workspace = true }
 rmp-serde = { workspace = true }
 async-trait = { workspace = true }
 rustfs-filemeta = { workspace = true }
@@ -12,12 +12,10 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-use path_clean::PathClean;
 use serde::{Deserialize, Serialize};
 use std::{
    collections::{HashMap, HashSet},
    hash::{DefaultHasher, Hash, Hasher},
-    path::Path,
    time::{Duration, SystemTime},
 };

@@ -32,6 +30,20 @@ use std::{
 /// save forever and freeze admin usage stats; callers must bypass the skip instead.
 pub const USAGE_LAST_UPDATE_FUTURE_TOLERANCE: Duration = Duration::from_secs(5 * 60);

+/// Cluster-wide usage snapshot written by coordinated scanners.
+///
+/// `usage_snapshot_complete` is an additive JSON field: older readers ignore
+/// it, while current readers treat snapshots from older writers as unknown.
+/// Keeping the existing object name preserves rolling-upgrade and rollback
+/// compatibility without allowing an ambiguous snapshot to become authoritative.
+pub const DATA_USAGE_OBJECT_NAME: &str = ".usage.v2.json";
+
+/// Usage snapshot written by scanner implementations predating distributed
+/// leadership fencing. It is read only when neither authoritative snapshot
+/// copy exists.
+// RUSTFS_COMPAT_TODO(scanner-usage-v2): keep .usage.json readable and removable during rolling upgrades from pre-v2 scanners. Remove after supported direct-upgrade sources all write .usage.v2.json.
+pub const LEGACY_DATA_USAGE_OBJECT_NAME: &str = ".usage.json";
+
 /// Returns true when `existing_last_update` is ahead of `now` by more than
 /// [`USAGE_LAST_UPDATE_FUTURE_TOLERANCE`], i.e. the persisted timestamp cannot be
 /// trusted for staleness comparisons and a fresh snapshot save must be allowed.
@@ -95,7 +107,7 @@ impl AllTierStats {
 }

 /// Bucket target usage info provides replication statistics
-#[derive(Debug, Default, Clone, Serialize, Deserialize)]
+#[derive(Debug, Default, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct BucketTargetUsageInfo {
    pub replication_pending_size: u64,
    pub replication_failed_size: u64,
@@ -107,7 +119,7 @@ pub struct BucketTargetUsageInfo {
 }

 /// Bucket usage info provides bucket-level statistics
-#[derive(Debug, Default, Clone, Serialize, Deserialize)]
+#[derive(Debug, Default, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct BucketUsageInfo {
    pub size: u64,
    // Following five fields suffixed with V1 are here for backward compatibility
@@ -133,7 +145,7 @@ pub struct BucketUsageInfo {
 }

 /// DataUsageInfo represents data usage stats of the underlying storage
-#[derive(Debug, Default, Clone, Serialize, Deserialize)]
+#[derive(Debug, Default, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct DataUsageInfo {
    /// Total capacity
    pub total_capacity: u64,
@@ -145,6 +157,22 @@ pub struct DataUsageInfo {
    /// LastUpdate is the timestamp of when the data usage info was last updated
    pub last_update: Option<SystemTime>,

+    /// Monotonic scanner cycle that produced this complete snapshot.
+    ///
+    /// Older snapshots omit this field and continue to use `last_update` for
+    /// compatibility. New scanner snapshots use the cycle to fence stale
+    /// leaders independently of wall-clock skew.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub scanner_cycle: Option<u64>,
+
+    /// Persisted scanner leadership epoch that produced this snapshot.
+    ///
+    /// The epoch is claimed through the cycle-state CAS before scanning. It
+    /// orders snapshots from different leaders even when their wall clocks or
+    /// cycle counters coincide.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub scanner_epoch: Option<u64>,
+
    /// Objects total count across all buckets
    pub objects_total_count: u64,
    /// Versions total count across all buckets
@@ -160,6 +188,12 @@ pub struct DataUsageInfo {
    pub buckets_count: u64,
    /// Buckets usage info provides following information across all buckets
    pub buckets_usage: HashMap<String, BucketUsageInfo>,
+    /// Whether this snapshot covers the complete bucket namespace.
+    ///
+    /// Legacy snapshots default to `false`. A complete snapshot contains an
+    /// explicit entry for every bucket, including confirmed-empty buckets.
+    #[serde(default)]
+    pub usage_snapshot_complete: bool,
    /// Deprecated kept here for backward compatibility reasons
    pub bucket_sizes: HashMap<String, u64>,
    /// Per-disk snapshot information when available
@@ -168,7 +202,7 @@ pub struct DataUsageInfo {
 }

 /// Metadata describing the status of a disk-level data usage snapshot.
-#[derive(Debug, Default, Clone, Serialize, Deserialize)]
+#[derive(Debug, Default, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct DiskUsageStatus {
    pub disk_id: String,
    pub pool_index: Option<usize>,
@@ -268,19 +302,37 @@ impl DataUsageHash {
 pub type DataUsageHashMap = HashSet<String>;

 /// Size histogram for object size distribution
-#[derive(Clone, Debug, Serialize, Deserialize)]
+const SIZE_HISTOGRAM_LEN: usize = 11;
+
+#[derive(Clone, Debug, Serialize)]
 pub struct SizeHistogram(Vec<u64>);

 impl Default for SizeHistogram {
    fn default() -> Self {
-        Self(vec![0; 11]) // DATA_USAGE_BUCKET_LEN = 11
+        Self(vec![0; SIZE_HISTOGRAM_LEN])
+    }
+}
+
+impl<'de> Deserialize<'de> for SizeHistogram {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let values = Vec::<u64>::deserialize(deserializer)?;
+        if values.len() != SIZE_HISTOGRAM_LEN {
+            return Err(serde::de::Error::invalid_length(
+                values.len(),
+                &"exactly 11 object-size histogram buckets",
+            ));
+        }
+        Ok(Self(values))
    }
 }

 impl SizeHistogram {
    pub fn add(&mut self, size: u64) {
        let intervals = [
-            (0, 1024),                                  // LESS_THAN_1024_B
+            (0, 1024 - 1),                              // LESS_THAN_1024_B
            (1024, 64 * 1024 - 1),                      // BETWEEN_1024_B_AND_64_KB
            (64 * 1024, 256 * 1024 - 1),                // BETWEEN_64_KB_AND_256_KB
            (256 * 1024, 512 * 1024 - 1),               // BETWEEN_256_KB_AND_512_KB
@@ -308,7 +360,7 @@ impl SizeHistogram {
        // the sub-ranges in [1 KiB, 512 KiB).
        const ONE_MIB: u64 = 1024 * 1024;
        let intervals = [
-            (0, 1024),                          // LESS_THAN_1024_B
+            (0, 1024 - 1),                      // LESS_THAN_1024_B
            (1024, 64 * 1024 - 1),              // BETWEEN_1024_B_AND_64_KB
            (64 * 1024, 256 * 1024 - 1),        // BETWEEN_64_KB_AND_256_KB
            (256 * 1024, 512 * 1024 - 1),       // BETWEEN_256_KB_AND_512_KB
@@ -343,7 +395,7 @@ impl SizeHistogram {
            .zip(names.iter())
            .filter(|((_, (start, end)), name)| name != &&"BETWEEN_1024B_AND_1_MB" && *start >= 1024 && *end < ONE_MIB)
            .map(|((count, _), _)| *count)
-            .sum();
+            .fold(0, u64::saturating_add);

        let mut res = HashMap::new();
        for (count, name) in self.0.iter().zip(names.iter()) {
@@ -364,12 +416,30 @@ impl SizeHistogram {
 }

 /// Versions histogram for version count distribution
-#[derive(Clone, Debug, Serialize, Deserialize)]
+const VERSIONS_HISTOGRAM_LEN: usize = 7;
+
+#[derive(Clone, Debug, Serialize)]
 pub struct VersionsHistogram(Vec<u64>);

 impl Default for VersionsHistogram {
    fn default() -> Self {
-        Self(vec![0; 7]) // DATA_USAGE_VERSION_LEN = 7
+        Self(vec![0; VERSIONS_HISTOGRAM_LEN])
+    }
+}
+
+impl<'de> Deserialize<'de> for VersionsHistogram {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let values = Vec::<u64>::deserialize(deserializer)?;
+        if values.len() != VERSIONS_HISTOGRAM_LEN {
+            return Err(serde::de::Error::invalid_length(
+                values.len(),
+                &"exactly 7 object-version histogram buckets",
+            ));
+        }
+        Ok(Self(values))
    }
 }

@@ -434,8 +504,35 @@ pub struct ReplicationStats {
 }

 impl ReplicationStats {
+    pub fn is_empty(&self) -> bool {
+        let Self {
+            pending_size,
+            replicated_size,
+            failed_size,
+            failed_count,
+            pending_count,
+            missed_threshold_size,
+            after_threshold_size,
+            missed_threshold_count,
+            after_threshold_count,
+            replicated_count,
+        } = self;
+
+        *pending_size == 0
+            && *replicated_size == 0
+            && *failed_size == 0
+            && *failed_count == 0
+            && *pending_count == 0
+            && *missed_threshold_size == 0
+            && *after_threshold_size == 0
+            && *missed_threshold_count == 0
+            && *after_threshold_count == 0
+            && *replicated_count == 0
+    }
+
+    #[deprecated(note = "use is_empty instead")]
    pub fn empty(&self) -> bool {
-        self.replicated_size == 0 && self.failed_size == 0 && self.failed_count == 0
+        self.is_empty()
    }
 }

@@ -448,16 +545,19 @@ pub struct ReplicationAllStats {
 }

 impl ReplicationAllStats {
+    pub fn is_empty(&self) -> bool {
+        let Self {
+            replica_size,
+            replica_count,
+            targets,
+        } = self;
+
+        *replica_size == 0 && *replica_count == 0 && targets.values().all(ReplicationStats::is_empty)
+    }
+
+    #[deprecated(note = "use is_empty instead")]
    pub fn empty(&self) -> bool {
-        if self.replica_size != 0 && self.replica_count != 0 {
-            return false;
-        }
-        for v in self.targets.values() {
-            if !v.empty() {
-                return false;
-            }
-        }
-        true
+        self.is_empty()
    }
 }

@@ -535,13 +635,74 @@ impl DataUsageEntry {
            }
        }

-        for (i, v) in other.obj_sizes.0.iter().enumerate() {
-            self.obj_sizes.0[i] += v;
-        }
+        self.obj_sizes.merge_from(&other.obj_sizes);
+        self.obj_versions.merge_from(&other.obj_versions);
+    }

-        for (i, v) in other.obj_versions.0.iter().enumerate() {
-            self.obj_versions.0[i] += v;
+    pub fn checked_merge(&mut self, other: &DataUsageEntry) -> bool {
+        let scalar_counts_fit = self.objects.checked_add(other.objects).is_some()
+            && self.versions.checked_add(other.versions).is_some()
+            && self.delete_markers.checked_add(other.delete_markers).is_some()
+            && self.size.checked_add(other.size).is_some()
+            && self.failed_objects.checked_add(other.failed_objects).is_some();
+        let histograms_fit = self.obj_sizes.0.len() == SIZE_HISTOGRAM_LEN
+            && other.obj_sizes.0.len() == SIZE_HISTOGRAM_LEN
+            && self.obj_versions.0.len() == VERSIONS_HISTOGRAM_LEN
+            && other.obj_versions.0.len() == VERSIONS_HISTOGRAM_LEN
+            && self
+                .obj_sizes
+                .0
+                .iter()
+                .zip(other.obj_sizes.0.iter())
+                .all(|(left, right)| left.checked_add(*right).is_some())
+            && self
+                .obj_versions
+                .0
+                .iter()
+                .zip(other.obj_versions.0.iter())
+                .all(|(left, right)| left.checked_add(*right).is_some());
+        let replication_fits = match (&self.replication_stats, &other.replication_stats) {
+            (_, None) | (None, Some(_)) => true,
+            (Some(left), Some(right)) => {
+                left.replica_size.checked_add(right.replica_size).is_some()
+                    && left.replica_count.checked_add(right.replica_count).is_some()
+                    && right.targets.iter().all(|(target, right_stats)| {
+                        left.targets.get(target).is_none_or(|left_stats| {
+                            left_stats.pending_size.checked_add(right_stats.pending_size).is_some()
+                                && left_stats.replicated_size.checked_add(right_stats.replicated_size).is_some()
+                                && left_stats.failed_size.checked_add(right_stats.failed_size).is_some()
+                                && left_stats.failed_count.checked_add(right_stats.failed_count).is_some()
+                                && left_stats.pending_count.checked_add(right_stats.pending_count).is_some()
+                                && left_stats
+                                    .missed_threshold_size
+                                    .checked_add(right_stats.missed_threshold_size)
+                                    .is_some()
+                                && left_stats
+                                    .after_threshold_size
+                                    .checked_add(right_stats.after_threshold_size)
+                                    .is_some()
+                                && left_stats
+                                    .missed_threshold_count
+                                    .checked_add(right_stats.missed_threshold_count)
+                                    .is_some()
+                                && left_stats
+                                    .after_threshold_count
+                                    .checked_add(right_stats.after_threshold_count)
+                                    .is_some()
+                                && left_stats
+                                    .replicated_count
+                                    .checked_add(right_stats.replicated_count)
+                                    .is_some()
+                        })
+                    })
+            }
+        };
+
+        if !scalar_counts_fit || !histograms_fit || !replication_fits {
+            return false;
        }
+        self.merge(other);
+        true
    }
 }

@@ -554,6 +715,12 @@ pub struct DataUsageCacheInfo {
    pub skip_healing: bool,
    #[serde(default)]
    pub failed_objects: HashMap<String, u64>,
+    /// Whether this per-set cache was produced by a completed scanner pass.
+    ///
+    /// Older cache writers omit this field and therefore deserialize as
+    /// incomplete instead of exposing partial set totals as confirmed zeros.
+    #[serde(default)]
+    pub snapshot_complete: bool,
 }

 /// Data usage cache
@@ -644,7 +811,7 @@ impl DataUsageCache {
                    return Some(root);
                }
                let mut flat = self.flatten(&root);
-                if flat.replication_stats.as_ref().is_some_and(|stats| stats.empty()) {
+                if flat.replication_stats.as_ref().is_some_and(ReplicationAllStats::is_empty) {
                    flat.replication_stats = None;
                }
                Some(flat)
@@ -873,6 +1040,7 @@ impl DataUsageCache {
            objects_total_size: flat.size as u64,
            buckets_count: u64::try_from(buckets.len()).unwrap_or(u64::MAX),
            buckets_usage,
+            usage_snapshot_complete: self.info.snapshot_complete,
            ..Default::default()
        }
    }
@@ -940,9 +1108,39 @@ fn mark(duc: &DataUsageCache, entry: &DataUsageEntry, found: &mut HashSet<String
    }
 }

-/// Hash a path for data usage caching
+fn clean_data_usage_path(data: &str) -> String {
+    let rooted = data.starts_with('/');
+    let mut parts = Vec::new();
+
+    for part in data.split('/') {
+        match part {
+            "" | "." => {}
+            ".." => {
+                if parts.last().is_some_and(|last| *last != "..") {
+                    parts.pop();
+                } else if !rooted {
+                    parts.push(part);
+                }
+            }
+            _ => parts.push(part),
+        }
+    }
+
+    let clean = parts.join("/");
+    match (rooted, clean.is_empty()) {
+        (true, true) => "/".to_string(),
+        (true, false) => format!("/{clean}"),
+        (false, true) => ".".to_string(),
+        (false, false) => clean,
+    }
+}
+
+/// Hash a slash-separated path for data usage caching.
+///
+/// Cache identifiers are persisted and exchanged across nodes, so their
+/// normalization must not depend on the host operating system.
 pub fn hash_path(data: &str) -> DataUsageHash {
-    DataUsageHash(Path::new(&data).clean().to_string_lossy().to_string())
+    DataUsageHash(clean_data_usage_path(data))
 }

 impl DataUsageInfo {
@@ -951,6 +1149,13 @@ impl DataUsageInfo {
        Self::default()
    }

+    /// Whether this snapshot authoritatively covers every reported bucket.
+    pub fn is_complete_bucket_usage_snapshot(&self) -> bool {
+        self.usage_snapshot_complete
+            && self.last_update.is_some()
+            && u64::try_from(self.buckets_usage.len()).ok() == Some(self.buckets_count)
+    }
+
    /// Add object metadata to data usage statistics
    pub fn add_object(&mut self, object_path: &str, meta_object: &rustfs_filemeta::MetaObject) {
        // This method is kept for backward compatibility
@@ -1315,6 +1520,52 @@ pub struct CompressionTotalInfo {
 mod tests {
    use super::*;

+    #[derive(Deserialize)]
+    struct LegacyUsageReader {
+        buckets_count: u64,
+    }
+
+    #[test]
+    fn hash_path_uses_portable_slash_semantics() {
+        for (input, expected) in [
+            ("", "."),
+            (".", "."),
+            ("/", "/"),
+            ("//bucket///prefix/", "/bucket/prefix"),
+            ("bucket/./prefix//object", "bucket/prefix/object"),
+            ("bucket/a/../b", "bucket/b"),
+            ("../bucket/..", ".."),
+            ("/../../bucket", "/bucket"),
+            ("bucket\\prefix/object", "bucket\\prefix/object"),
+        ] {
+            assert_eq!(hash_path(input).key(), expected, "unexpected portable cache key for {input:?}");
+        }
+    }
+
+    #[test]
+    fn completeness_marker_is_additive_for_legacy_named_readers() {
+        let current = DataUsageInfo {
+            last_update: Some(SystemTime::UNIX_EPOCH),
+            usage_snapshot_complete: true,
+            ..Default::default()
+        };
+        let encoded = rmp_serde::to_vec_named(&current).expect("encode current data usage snapshot");
+        let legacy: LegacyUsageReader = rmp_serde::from_slice(&encoded).expect("legacy reader should ignore additive fields");
+
+        assert_eq!(legacy.buckets_count, 0);
+        assert!(current.is_complete_bucket_usage_snapshot());
+    }
+
+    #[test]
+    fn completeness_marker_requires_a_snapshot_timestamp() {
+        let untimestamped = DataUsageInfo {
+            usage_snapshot_complete: true,
+            ..Default::default()
+        };
+
+        assert!(!untimestamped.is_complete_bucket_usage_snapshot());
+    }
+
    #[test]
    fn test_usage_last_update_future_tolerance_boundary() {
        let now = SystemTime::UNIX_EPOCH + Duration::from_secs(1_000_000);
@@ -1395,6 +1646,180 @@ mod tests {
        assert_eq!(map["BETWEEN_512_KB_AND_1_MB"], 1);
    }

+    #[test]
+    fn test_size_histogram_classifies_adjacent_boundaries_once() {
+        let cases = [
+            (1023, 0),
+            (1024, 1),
+            (64 * 1024 - 1, 1),
+            (64 * 1024, 2),
+            (256 * 1024 - 1, 2),
+            (256 * 1024, 3),
+            (512 * 1024 - 1, 3),
+            (512 * 1024, 4),
+            (1024 * 1024 - 1, 4),
+            (1024 * 1024, 6),
+            (10 * 1024 * 1024 - 1, 6),
+            (10 * 1024 * 1024, 7),
+            (64 * 1024 * 1024 - 1, 7),
+            (64 * 1024 * 1024, 8),
+            (128 * 1024 * 1024 - 1, 8),
+            (128 * 1024 * 1024, 9),
+            (512 * 1024 * 1024 - 1, 9),
+            (512 * 1024 * 1024, 10),
+        ];
+
+        for (size, expected_bucket) in cases {
+            let mut hist = SizeHistogram::default();
+            hist.add(size);
+
+            assert_eq!(hist.0.iter().sum::<u64>(), 1, "size {size} must have exactly one physical bucket");
+            assert_eq!(hist.0[expected_bucket], 1, "size {size} must select the expected bucket");
+        }
+    }
+
+    #[test]
+    fn test_size_histogram_1024_bytes_contributes_to_compat_rollup() {
+        let mut hist = SizeHistogram::default();
+        hist.add(1024);
+
+        let map = hist.to_map();
+        assert_eq!(map["LESS_THAN_1024_B"], 0);
+        assert_eq!(map["BETWEEN_1024_B_AND_64_KB"], 1);
+        assert_eq!(map["BETWEEN_1024B_AND_1_MB"], 1);
+    }
+
+    #[test]
+    fn test_size_histogram_compat_rollup_saturates_on_corrupt_counts() {
+        let mut hist = SizeHistogram::default();
+        hist.0[1] = u64::MAX;
+        hist.0[2] = 1;
+
+        let map = hist.to_map();
+
+        assert_eq!(map["BETWEEN_1024B_AND_1_MB"], u64::MAX);
+    }
+
+    #[test]
+    fn replication_stats_empty_checks_every_field() {
+        type SetField = fn(&mut ReplicationStats);
+
+        let cases: [(&str, SetField); 10] = [
+            ("pending_size", |stats| stats.pending_size = 1),
+            ("replicated_size", |stats| stats.replicated_size = 1),
+            ("failed_size", |stats| stats.failed_size = 1),
+            ("failed_count", |stats| stats.failed_count = 1),
+            ("pending_count", |stats| stats.pending_count = 1),
+            ("missed_threshold_size", |stats| stats.missed_threshold_size = 1),
+            ("after_threshold_size", |stats| stats.after_threshold_size = 1),
+            ("missed_threshold_count", |stats| stats.missed_threshold_count = 1),
+            ("after_threshold_count", |stats| stats.after_threshold_count = 1),
+            ("replicated_count", |stats| stats.replicated_count = 1),
+        ];
+
+        assert!(ReplicationStats::default().is_empty());
+        for (field, set_nonzero) in cases {
+            let mut stats = ReplicationStats::default();
+            set_nonzero(&mut stats);
+            assert!(!stats.is_empty(), "{field} must make replication stats non-empty");
+        }
+    }
+
+    #[test]
+    fn replication_all_stats_empty_checks_aggregate_fields_independently() {
+        let cases = [
+            (
+                "replica_size",
+                ReplicationAllStats {
+                    replica_size: 1,
+                    ..Default::default()
+                },
+            ),
+            (
+                "replica_count",
+                ReplicationAllStats {
+                    replica_count: 1,
+                    ..Default::default()
+                },
+            ),
+        ];
+
+        assert!(ReplicationAllStats::default().is_empty());
+        for (field, stats) in cases {
+            assert!(!stats.is_empty(), "{field} must make aggregate replication stats non-empty");
+        }
+
+        let empty_targets = ReplicationAllStats {
+            targets: HashMap::from([("arn:test:empty".to_string(), ReplicationStats::default())]),
+            ..Default::default()
+        };
+        assert!(empty_targets.is_empty(), "all-empty targets must keep aggregate stats empty");
+
+        let stats = ReplicationAllStats {
+            targets: HashMap::from([
+                ("arn:test:empty".to_string(), ReplicationStats::default()),
+                (
+                    "arn:test:non-empty".to_string(),
+                    ReplicationStats {
+                        pending_count: 1,
+                        ..Default::default()
+                    },
+                ),
+            ]),
+            ..Default::default()
+        };
+        assert!(!stats.is_empty(), "a non-empty target must make aggregate replication stats non-empty");
+    }
+
+    #[test]
+    fn size_recursive_prunes_empty_and_preserves_pending_replication_stats() {
+        let root = hash_path("bucket");
+        let child = hash_path("bucket/child");
+        let mut cache = DataUsageCache::default();
+        cache.replace_hashed(&root, &None, &DataUsageEntry::default());
+        cache.replace_hashed(
+            &child,
+            &Some(root.clone()),
+            &DataUsageEntry {
+                replication_stats: Some(ReplicationAllStats::default()),
+                ..Default::default()
+            },
+        );
+
+        assert!(
+            cache
+                .size_recursive("bucket")
+                .expect("bucket usage should flatten")
+                .replication_stats
+                .is_none()
+        );
+
+        cache.replace_hashed(
+            &child,
+            &Some(root.clone()),
+            &DataUsageEntry {
+                replication_stats: Some(ReplicationAllStats {
+                    targets: HashMap::from([(
+                        "arn:test:pending".to_string(),
+                        ReplicationStats {
+                            pending_count: 1,
+                            ..Default::default()
+                        },
+                    )]),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            },
+        );
+
+        let flattened = cache.size_recursive("bucket").expect("bucket usage should flatten");
+        let replication = flattened
+            .replication_stats
+            .expect("pending-only replication stats must survive pruning");
+
+        assert_eq!(replication.targets["arn:test:pending"].pending_count, 1);
+    }
+
    #[test]
    fn test_data_usage_cache_merge_adds_missing_child() {
        let mut base = DataUsageCache::default();
@@ -1708,4 +2133,86 @@ mod tests {
        assert!(cache.find("bucket/large/a").is_some());
        assert!(cache.find("bucket/large/b").is_some());
    }
+
+    #[test]
+    fn checked_merge_rejects_scalar_and_replication_overflow_without_mutation() {
+        let mut entry = DataUsageEntry {
+            objects: usize::MAX,
+            replication_stats: Some(ReplicationAllStats {
+                replica_size: 7,
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+        let other = DataUsageEntry {
+            objects: 1,
+            replication_stats: Some(ReplicationAllStats {
+                replica_size: u64::MAX,
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+
+        assert!(!entry.checked_merge(&other));
+        assert_eq!(entry.objects, usize::MAX);
+        assert_eq!(entry.replication_stats.as_ref().map(|stats| stats.replica_size), Some(7));
+    }
+
+    #[test]
+    fn checked_merge_accepts_valid_usage() {
+        let mut entry = DataUsageEntry {
+            objects: 2,
+            size: 20,
+            ..Default::default()
+        };
+        let other = DataUsageEntry {
+            objects: 3,
+            size: 30,
+            ..Default::default()
+        };
+
+        assert!(entry.checked_merge(&other));
+        assert_eq!(entry.objects, 5);
+        assert_eq!(entry.size, 50);
+    }
+
+    #[test]
+    fn histogram_deserialization_rejects_noncanonical_lengths() {
+        let invalid_sizes =
+            rmp_serde::to_vec(&vec![0_u64; SIZE_HISTOGRAM_LEN + 1]).expect("encode invalid object-size histogram fixture");
+        let invalid_versions =
+            rmp_serde::to_vec(&vec![0_u64; VERSIONS_HISTOGRAM_LEN - 1]).expect("encode invalid object-version histogram fixture");
+
+        assert!(rmp_serde::from_slice::<SizeHistogram>(&invalid_sizes).is_err());
+        assert!(rmp_serde::from_slice::<VersionsHistogram>(&invalid_versions).is_err());
+    }
+
+    #[test]
+    fn replication_target_deserialization_preserves_large_historical_maps() {
+        let mut stats = ReplicationAllStats::default();
+        for index in 0..=1024 {
+            stats.targets.insert(format!("target-{index}"), ReplicationStats::default());
+        }
+        let encoded = rmp_serde::to_vec_named(&stats).expect("large replication target fixture should encode");
+        let decoded = rmp_serde::from_slice::<ReplicationAllStats>(&encoded)
+            .expect("historical replication target maps must remain readable");
+
+        assert_eq!(decoded.targets.len(), stats.targets.len());
+    }
+
+    #[test]
+    fn checked_merge_rejects_noncanonical_histograms_without_mutation() {
+        let mut entry = DataUsageEntry {
+            objects: 2,
+            ..Default::default()
+        };
+        let other = DataUsageEntry {
+            objects: 3,
+            obj_sizes: SizeHistogram(vec![0; SIZE_HISTOGRAM_LEN + 1]),
+            ..Default::default()
+        };
+
+        assert!(!entry.checked_merge(&other));
+        assert_eq!(entry.objects, 2);
+    }
 }
@@ -25,11 +25,60 @@ workspace = true

 [features]
 default = []
+hotpath = [
+    "hotpath/hotpath",
+    "hotpath/tokio",
+    "hotpath/futures",
+    "hotpath/reqwest-0-13",
+    "rustfs-config/hotpath",
+    "rustfs-credentials/hotpath",
+    "rustfs-data-usage/hotpath",
+    "rustfs-ecstore/hotpath",
+    "rustfs-filemeta/hotpath",
+    "rustfs-lock/hotpath",
+    "rustfs-madmin/hotpath",
+    "rustfs-protos/hotpath",
+    "rustfs-rio/hotpath",
+    "rustfs-signer/hotpath",
+    "rustfs-utils/hotpath",
+]
+hotpath-alloc = [
+    "hotpath",
+    "hotpath/hotpath-alloc",
+    "rustfs-config/hotpath-alloc",
+    "rustfs-credentials/hotpath-alloc",
+    "rustfs-data-usage/hotpath-alloc",
+    "rustfs-ecstore/hotpath-alloc",
+    "rustfs-filemeta/hotpath-alloc",
+    "rustfs-lock/hotpath-alloc",
+    "rustfs-madmin/hotpath-alloc",
+    "rustfs-protos/hotpath-alloc",
+    "rustfs-rio/hotpath-alloc",
+    "rustfs-signer/hotpath-alloc",
+    "rustfs-utils/hotpath-alloc",
+]
+hotpath-cpu = [
+    "hotpath",
+    "hotpath/hotpath-cpu",
+    "rustfs-config/hotpath-cpu",
+    "rustfs-credentials/hotpath-cpu",
+    "rustfs-data-usage/hotpath-cpu",
+    "rustfs-ecstore/hotpath-cpu",
+    "rustfs-filemeta/hotpath-cpu",
+    "rustfs-lock/hotpath-cpu",
+    "rustfs-madmin/hotpath-cpu",
+    "rustfs-protos/hotpath-cpu",
+    "rustfs-rio/hotpath-cpu",
+    "rustfs-signer/hotpath-cpu",
+    "rustfs-utils/hotpath-cpu",
+]
 ftps = []
 sftp = []

 [dependencies]
+hotpath.workspace = true
 rustfs-config = { workspace = true, features = ["constants"] }
+rustfs-credentials.workspace = true
 rustfs-ecstore.workspace = true
 rustfs-data-usage.workspace = true
 rustfs-rio.workspace = true
@@ -49,6 +98,7 @@ rustfs-filemeta.workspace = true
 bytes = { workspace = true, features = ["serde"] }
 serial_test = { workspace = true }
 aws-sdk-s3 = { workspace = true, default-features = false, features = ["sigv4a", "default-https-client", "rt-tokio"] }
+aws-sdk-sts = { workspace = true, default-features = false, features = ["default-https-client", "rt-tokio"] }
 aws-config = { workspace = true }
 aws-smithy-http-client = { workspace = true, default-features = false, features = ["rustls-aws-lc"] }
 async-compression = { workspace = true, features = ["tokio", "bzip2", "xz"] }
@@ -68,7 +118,10 @@ walkdir.workspace = true
 base64 = { workspace = true }
 rand = { workspace = true, features = ["serde"] }
 chrono = { workspace = true, features = ["serde"] }
-md5 = { workspace = true }
+hex = { workspace = true }
+md-5 = { workspace = true }
+opentelemetry-proto = { workspace = true }
+prost.workspace = true
 sha2 = { workspace = true }
 astral-tokio-tar = { workspace = true }
 s3s = { workspace = true, features = ["minio"] }
@@ -46,6 +46,45 @@ mod tests {
    use std::time::{Duration, Instant};

    const ADMIN_INFO_PATH: &str = "/rustfs/admin/v3/info";
+    const ADMIN_MANUAL_TRANSITION_BUCKET: &str = "auth-deny-manual-transition";
+    const ADMIN_MANUAL_TRANSITION_PATH: &str =
+        "/rustfs/admin/v3/ilm/transition/run?bucket=auth-deny-manual-transition&maxObjects=1&mode=async";
+
+    fn assert_no_raw_manual_transition_markers(body: &str, context: &str) {
+        assert!(
+            !body.contains("\"marker\"") && !body.contains("\"versionMarker\"") && !body.contains("\"version_marker\""),
+            "{context} must not expose raw manual transition resume markers, body: {body}"
+        );
+    }
+
+    async fn wait_for_terminal_manual_transition_job(
+        env: &RustFSTestEnvironment,
+        status_endpoint: &str,
+    ) -> Result<String, Box<dyn Error + Send + Sync>> {
+        let deadline = Instant::now() + Duration::from_secs(30);
+        loop {
+            let (status, body) =
+                signed_request(&env.url, http::Method::GET, status_endpoint, None, &env.access_key, &env.secret_key).await?;
+            assert_eq!(
+                status,
+                reqwest::StatusCode::OK,
+                "root credential must query manual transition job status, body: {body}"
+            );
+            assert_no_raw_manual_transition_markers(&body, "manual transition status response");
+            let value: serde_json::Value = serde_json::from_str(&body)?;
+            let job_status = value
+                .get("status")
+                .and_then(serde_json::Value::as_str)
+                .ok_or("manual transition job status response must include status")?;
+            if matches!(job_status, "completed" | "partial" | "cancelled" | "failed" | "unknown") {
+                return Ok(body);
+            }
+            if Instant::now() >= deadline {
+                return Err(format!("manual transition job did not reach terminal status within 30s; last={body}").into());
+            }
+            tokio::time::sleep(Duration::from_millis(250)).await;
+        }
+    }

    /// Send a SigV4-signed request to `path` (optionally with a JSON `body`) and
    /// return `(status, body)`. Uses the `UNSIGNED_PAYLOAD` content hash so a
@@ -158,6 +197,130 @@ mod tests {
        Ok(())
    }

+    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
+    async fn non_admin_credential_denied_on_manual_transition_run() -> Result<(), Box<dyn Error + Send + Sync>> {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(vec![]).await?;
+
+        let user_ak = "ilmtransitionlimited";
+        let user_sk = "ilmtransitionlimitedsecret";
+        create_limited_user(&env, user_ak, user_sk).await?;
+        env.create_s3_client()
+            .create_bucket()
+            .bucket(ADMIN_MANUAL_TRANSITION_BUCKET)
+            .send()
+            .await?;
+
+        let (root_status, root_body) = signed_request(
+            &env.url,
+            http::Method::POST,
+            ADMIN_MANUAL_TRANSITION_PATH,
+            None,
+            &env.access_key,
+            &env.secret_key,
+        )
+        .await?;
+        assert_eq!(
+            root_status,
+            reqwest::StatusCode::ACCEPTED,
+            "root credential must reach the manual transition handler, body: {root_body}"
+        );
+        assert!(
+            root_body.contains("\"mode\":\"durable_job\""),
+            "root response should be the durable manual transition JSON contract, body: {root_body}"
+        );
+        assert_no_raw_manual_transition_markers(&root_body, "manual transition run response");
+        let root_value: serde_json::Value = serde_json::from_str(&root_body)?;
+        let job_id = root_value
+            .get("job_id")
+            .and_then(serde_json::Value::as_str)
+            .ok_or("manual transition async response must include job_id")?;
+        let status_endpoint = root_value
+            .get("status_endpoint")
+            .and_then(serde_json::Value::as_str)
+            .ok_or("manual transition async response must include status_endpoint")?;
+        let cancel_endpoint = root_value
+            .get("cancel_endpoint")
+            .and_then(serde_json::Value::as_str)
+            .ok_or("manual transition async response must include cancel_endpoint")?;
+        assert_eq!(
+            cancel_endpoint, status_endpoint,
+            "manual transition durable jobs currently use the same status/cancel endpoint"
+        );
+        assert!(
+            status_endpoint.ends_with(job_id),
+            "status endpoint must address the returned job id, job_id={job_id}, status_endpoint={status_endpoint}"
+        );
+
+        let terminal_body = wait_for_terminal_manual_transition_job(&env, status_endpoint).await?;
+        let terminal: serde_json::Value = serde_json::from_str(&terminal_body)?;
+        assert_eq!(terminal.get("job_id").and_then(serde_json::Value::as_str), Some(job_id));
+        assert_eq!(
+            terminal
+                .get("report")
+                .and_then(|report| report.get("bucket"))
+                .and_then(serde_json::Value::as_str),
+            Some(ADMIN_MANUAL_TRANSITION_BUCKET)
+        );
+
+        let (root_status, root_body) =
+            signed_request(&env.url, http::Method::DELETE, status_endpoint, None, &env.access_key, &env.secret_key).await?;
+        assert_eq!(
+            root_status,
+            reqwest::StatusCode::OK,
+            "root credential must cancel/query a terminal manual transition job idempotently, body: {root_body}"
+        );
+        assert_no_raw_manual_transition_markers(&root_body, "manual transition cancel response");
+        let root_cancel: serde_json::Value = serde_json::from_str(&root_body)?;
+        assert_eq!(root_cancel.get("job_id").and_then(serde_json::Value::as_str), Some(job_id));
+        assert!(
+            matches!(
+                root_cancel.get("status").and_then(serde_json::Value::as_str),
+                Some("completed" | "partial" | "failed" | "unknown")
+            ),
+            "terminal cancel must not rewrite the job into cancelled state, body: {root_body}"
+        );
+
+        let (status, body) =
+            signed_request(&env.url, http::Method::POST, ADMIN_MANUAL_TRANSITION_PATH, None, user_ak, user_sk).await?;
+        assert_eq!(
+            status,
+            reqwest::StatusCode::FORBIDDEN,
+            "non-admin credential must get 403 on manual transition run, body: {body}"
+        );
+        assert!(
+            body.contains("AccessDenied"),
+            "manual transition rejection must carry the AccessDenied S3 error code, body: {body}"
+        );
+        let (status, body) = signed_request(&env.url, http::Method::GET, status_endpoint, None, user_ak, user_sk).await?;
+        assert_eq!(
+            status,
+            reqwest::StatusCode::FORBIDDEN,
+            "non-admin credential must get 403 on manual transition status, body: {body}"
+        );
+        assert_no_raw_manual_transition_markers(&body, "manual transition status rejection");
+        assert!(
+            body.contains("AccessDenied"),
+            "manual transition status rejection must carry the AccessDenied S3 error code, body: {body}"
+        );
+        let (status, body) = signed_request(&env.url, http::Method::DELETE, status_endpoint, None, user_ak, user_sk).await?;
+        assert_eq!(
+            status,
+            reqwest::StatusCode::FORBIDDEN,
+            "non-admin credential must get 403 on manual transition cancel, body: {body}"
+        );
+        assert_no_raw_manual_transition_markers(&body, "manual transition cancel rejection");
+        assert!(
+            body.contains("AccessDenied"),
+            "manual transition cancel rejection must carry the AccessDenied S3 error code, body: {body}"
+        );
+
+        env.stop_server();
+        Ok(())
+    }
+
    /// Rotating the root credentials (restart with new `--access-key` /
    /// `--secret-key` on the same data directory) takes effect: the new
    /// credential is accepted and the old one is rejected, on both the S3 data
@@ -26,75 +26,16 @@
 //! Later batches tracked on backlog#1154: config get/set, info, pools status,
 //! group lifecycle, import/export IAM.

-use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
+use crate::common::{RustFSTestEnvironment, admin_ok, admin_request, init_logging};
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::{Client, Config};
-use http::header::{CONTENT_TYPE, HOST};
 use reqwest::StatusCode;
-use rustfs_signer::constants::UNSIGNED_PAYLOAD;
-use rustfs_signer::sign_v4;
-use s3s::Body;
 use serial_test::serial;
 use std::error::Error;
 use tokio::time::{Duration, sleep};

 type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
-type BoxError = Box<dyn Error + Send + Sync>;
-
-/// Signs and sends an admin HTTP request with the given credential, returning
-/// status and body. Native `/rustfs/admin/v3` requests and responses are plain
-/// JSON (the MinIO-compat encryption applies only to `/minio/admin/v3` paths).
-async fn admin_request(
-    base_url: &str,
-    method: http::Method,
-    path_and_query: &str,
-    body: Option<String>,
-    access_key: &str,
-    secret_key: &str,
-) -> Result<(StatusCode, String), BoxError> {
-    let url = format!("{base_url}{path_and_query}");
-    let uri = url.parse::<http::Uri>()?;
-    let authority = uri.authority().ok_or("admin URL missing authority")?.to_string();
-    let mut builder = http::Request::builder()
-        .method(method.clone())
-        .uri(uri)
-        .header(HOST, authority)
-        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
-    if body.is_some() {
-        builder = builder.header(CONTENT_TYPE, "application/json");
-    }
-
-    let content_len = body.as_ref().map(|b| b.len() as i64).unwrap_or_default();
-    let signed = sign_v4(builder.body(Body::empty())?, content_len, access_key, secret_key, "", "us-east-1");
-
-    let reqwest_method = reqwest::Method::from_bytes(method.as_str().as_bytes())?;
-    let mut request = local_http_client().request(reqwest_method, &url);
-    for (name, value) in signed.headers() {
-        request = request.header(name, value);
-    }
-    if let Some(body) = body {
-        request = request.body(body);
-    }
-    let response = request.send().await?;
-    let status = response.status();
-    let text = response.text().await.unwrap_or_default();
-    Ok((status, text))
-}
-
-/// Root-credential admin request that must succeed; returns the response body.
-async fn admin_ok(
-    env: &RustFSTestEnvironment,
-    method: http::Method,
-    path_and_query: &str,
-    body: Option<String>,
-) -> Result<String, BoxError> {
-    let (status, text) = admin_request(&env.url, method.clone(), path_and_query, body, &env.access_key, &env.secret_key).await?;
-    if !status.is_success() {
-        return Err(format!("{method} {path_and_query} failed: {status} {text}").into());
-    }
-    Ok(text)
-}

 fn build_s3_client(url: &str, access_key: &str, secret_key: &str) -> Client {
    let config = Config::builder()
@@ -170,3 +170,81 @@ async fn test_anonymous_access_allowed_when_restrict_public_buckets_disabled()
    info!("Test passed: anonymous access allowed with RestrictPublicBuckets=false");
    Ok(())
 }
+
+/// A policy granting anonymous `s3:ListBucket` also permits ListObjectVersions.
+/// That grant must still be subject to RestrictPublicBuckets: the versions listing
+/// reaches authorization through a fallback branch, and that branch has to apply the
+/// same public-access gate as a direct grant.
+#[tokio::test]
+#[serial]
+async fn ghsa_x298_anonymous_list_object_versions_denied_when_restrict_public_buckets_enabled()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+    info!("Starting test: anonymous ListObjectVersions denied with RestrictPublicBuckets=true...");
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket_name = "anon-test-restrict-versions";
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket_name).send().await?;
+
+    let policy_json = serde_json::json!({
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "AllowAnonymousListBucket",
+                "Effect": "Allow",
+                "Principal": "*",
+                "Action": ["s3:ListBucket"],
+                "Resource": [format!("arn:aws:s3:::{}", bucket_name)]
+            }
+        ]
+    })
+    .to_string();
+
+    admin_client
+        .put_bucket_policy()
+        .bucket(bucket_name)
+        .policy(&policy_json)
+        .send()
+        .await?;
+
+    admin_client
+        .put_object()
+        .bucket(bucket_name)
+        .key("test.txt")
+        .body(aws_sdk_s3::primitives::ByteStream::from_static(b"hello anonymous"))
+        .send()
+        .await?;
+
+    // Without the public-access block the fallback grant is expected to work.
+    let versions_url = format!("{}/{}?versions=", env.url, bucket_name);
+    let resp = local_http_client().get(&versions_url).send().await?;
+    assert_eq!(
+        resp.status().as_u16(),
+        200,
+        "Anonymous ListObjectVersions should succeed via the s3:ListBucket grant"
+    );
+
+    admin_client
+        .put_public_access_block()
+        .bucket(bucket_name)
+        .public_access_block_configuration(
+            PublicAccessBlockConfiguration::builder()
+                .restrict_public_buckets(true)
+                .build(),
+        )
+        .send()
+        .await?;
+
+    let resp = local_http_client().get(&versions_url).send().await?;
+    assert_eq!(
+        resp.status().as_u16(),
+        403,
+        "Anonymous ListObjectVersions must be denied when RestrictPublicBuckets is true"
+    );
+
+    info!("Test passed: anonymous ListObjectVersions denied with RestrictPublicBuckets=true");
+    Ok(())
+}
@@ -24,9 +24,10 @@ mod tests {
    use aws_sdk_s3::types::{ChecksumAlgorithm, ChecksumMode, CompletedMultipartUpload, CompletedPart};
    use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
    use base64::Engine;
+    use md5::{Digest as Md5Digest, Md5};
    use rustfs_rio::{Checksum, ChecksumType as RioChecksumType};
    use serial_test::serial;
-    use sha2::{Digest, Sha256};
+    use sha2::Sha256;
    use tracing::info;

    fn create_s3_client(env: &RustFSTestEnvironment) -> Client {
@@ -70,7 +71,9 @@ mod tests {
    }

    fn content_md5_base64(body: &[u8]) -> String {
-        let digest = md5::compute(body);
+        let mut hasher = Md5::new();
+        hasher.update(body);
+        let digest = hasher.finalize();
        base64::engine::general_purpose::STANDARD.encode(digest.as_slice())
    }

@@ -24,7 +24,12 @@
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::{Client, Config};
 use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
+use http::header::{CONTENT_TYPE, HOST};
 use reqwest::Client as HttpClient;
+use reqwest::StatusCode;
+use rustfs_signer::constants::UNSIGNED_PAYLOAD;
+use rustfs_signer::sign_v4;
+use s3s::Body;
 use std::ffi::OsStr;
 use std::fs as stdfs;
 use std::path::{Path, PathBuf};
@@ -75,6 +80,58 @@ pub fn local_http_client() -> HttpClient {
        .expect("failed to build local reqwest client")
 }

+/// Signs and sends an admin HTTP request with the given credentials.
+pub(crate) async fn admin_request(
+    base_url: &str,
+    method: http::Method,
+    path_and_query: &str,
+    body: Option<String>,
+    access_key: &str,
+    secret_key: &str,
+) -> Result<(StatusCode, String), Box<dyn std::error::Error + Send + Sync>> {
+    let url = format!("{base_url}{path_and_query}");
+    let uri = url.parse::<http::Uri>()?;
+    let authority = uri.authority().ok_or("admin URL missing authority")?.to_string();
+    let mut request = http::Request::builder()
+        .method(method.clone())
+        .uri(uri)
+        .header(HOST, authority)
+        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
+    if body.is_some() {
+        request = request.header(CONTENT_TYPE, "application/json");
+    }
+
+    let content_length = i64::try_from(body.as_ref().map_or(0, String::len)).map_err(|_| "admin request body is too large")?;
+    let signed = sign_v4(request.body(Body::empty())?, content_length, access_key, secret_key, "", "us-east-1");
+
+    let mut request = local_http_client().request(method, &url);
+    for (name, value) in signed.headers() {
+        request = request.header(name, value);
+    }
+    if let Some(body) = body {
+        request = request.body(body);
+    }
+    let response = request.send().await?;
+    let status = response.status();
+    let body = response.text().await?;
+    Ok((status, body))
+}
+
+/// Sends a root-credential admin request and returns its successful response body.
+pub(crate) async fn admin_ok(
+    env: &RustFSTestEnvironment,
+    method: http::Method,
+    path_and_query: &str,
+    body: Option<String>,
+) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+    let (status, response_body) =
+        admin_request(&env.url, method.clone(), path_and_query, body, &env.access_key, &env.secret_key).await?;
+    if !status.is_success() {
+        return Err(format!("{method} {path_and_query} failed: {status} {response_body}").into());
+    }
+    Ok(response_body)
+}
+
 /// Resolve the RustFS binary relative to the workspace.
 pub fn rustfs_binary_path() -> PathBuf {
    rustfs_binary_path_with_features(requested_rustfs_build_features().as_deref())
@@ -892,6 +949,7 @@ pub struct RustFSTestClusterEnvironment {
    pub access_key: String,
    pub secret_key: String,
    pub extra_env: Vec<(String, String)>,
+    pub node_extra_env: Vec<Vec<(String, String)>>,
    pub topology: ClusterTopology,
 }

@@ -990,6 +1048,7 @@ impl RustFSTestClusterEnvironment {
            access_key: "rustfs-cluster-test-access".to_string(),
            secret_key: "rustfs-cluster-test-secret".to_string(),
            extra_env,
+            node_extra_env: vec![Vec::new(); topology.node_count],
            topology,
        })
    }
@@ -1003,6 +1062,22 @@ impl RustFSTestClusterEnvironment {
        self.extra_env.push((key.into(), value.into()));
    }

+    /// Add an extra environment variable applied to a single cluster node.
+    pub fn set_node_env<K, V>(
+        &mut self,
+        node_idx: usize,
+        key: K,
+        value: V,
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>>
+    where
+        K: Into<String>,
+        V: Into<String>,
+    {
+        self.ensure_node_index(node_idx)?;
+        self.node_extra_env[node_idx].push((key.into(), value.into()));
+        Ok(())
+    }
+
    fn ensure_node_index(&self, node_idx: usize) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        if node_idx >= self.nodes.len() {
            return Err(format!("node_idx {node_idx} is invalid").into());
@@ -1089,6 +1164,9 @@ impl RustFSTestClusterEnvironment {
            for (key, value) in &self.extra_env {
                command.env(key, value);
            }
+            for (key, value) in &self.node_extra_env[i] {
+                command.env(key, value);
+            }

            let process = command.current_dir(&node.data_dir).spawn()?;

@@ -1130,6 +1208,9 @@ impl RustFSTestClusterEnvironment {
        for (key, value) in &self.extra_env {
            command.env(key, value);
        }
+        for (key, value) in &self.node_extra_env[node_idx] {
+            command.env(key, value);
+        }

        let process = command.current_dir(&node.data_dir).spawn()?;
        node.process = Some(process);
@@ -1371,6 +1452,7 @@ mod tests {
            access_key: DEFAULT_ACCESS_KEY.to_string(),
            secret_key: DEFAULT_SECRET_KEY.to_string(),
            extra_env: Vec::new(),
+            node_extra_env: vec![Vec::new(); topology.node_count],
            topology,
        }
    }
@@ -1455,4 +1537,24 @@ mod tests {
        assert!(ClusterTopology::single_pool_multidrive(4, 4).validate().is_ok());
        assert!(ClusterTopology::single_pool_multidrive(1, 1).validate().is_ok());
    }
+
+    #[test]
+    fn cluster_node_env_supports_per_node_overrides() {
+        let mut env = fake_cluster(ClusterTopology::single_pool(4));
+        env.set_node_env(2, "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY", "true").unwrap();
+        assert_eq!(
+            env.node_extra_env[2].as_slice(),
+            [("RUSTFS_INTERNODE_RPC_MSGPACK_ONLY".to_string(), "true".to_string())]
+        );
+    }
+
+    #[test]
+    fn cluster_node_env_rejects_invalid_index() {
+        let mut env = fake_cluster(ClusterTopology::single_pool(4));
+        let err = env
+            .set_node_env(4, "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY", "true")
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("invalid"), "unexpected error: {err}");
+    }
 }
@@ -80,6 +80,25 @@ mod tests {
        assert_eq!(head_resp.content_encoding(), Some("zstd"), "HEAD should return Content-Encoding: zstd");
        assert_eq!(head_resp.content_type(), Some("text/plain"), "HEAD should return correct Content-Type");

+        client
+            .delete_object()
+            .bucket(bucket)
+            .key(key)
+            .send()
+            .await
+            .expect("DELETE object failed");
+        client
+            .delete_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("DELETE bucket failed");
+        client
+            .list_buckets()
+            .send()
+            .await
+            .expect("RustFS must remain available after deleting a bucket");
+
        env.stop_server();
    }

@@ -12,18 +12,24 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-//! Regression test for Issue #4996: CopyObject must return the destination object's
-//! checksum in `CopyObjectResult` and persist it so a later checksum-mode HEAD/GET
-//! returns the same value. Covers both the requested-algorithm case (compute fresh)
-//! and the no-algorithm case (preserve the source object's existing checksum).
+//! CopyObject checksum compatibility tests. Covers all supported algorithms,
+//! source-checksum preservation, explicit override, and fail-closed handling of
+//! unsupported algorithms before destination mutation.

 #[cfg(test)]
 mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
+    use aws_sdk_s3::config::{Credentials, Region, RequestChecksumCalculation};
+    use aws_sdk_s3::error::ProvideErrorMetadata;
    use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::{BucketVersioningStatus, ChecksumAlgorithm, ChecksumMode, VersioningConfiguration};
+    use aws_sdk_s3::types::{
+        BucketVersioningStatus, ChecksumAlgorithm, ChecksumMode, ChecksumType, CompletedMultipartUpload, CompletedPart,
+        VersioningConfiguration,
+    };
+    use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
    use base64::Engine as _;
    use base64::engine::general_purpose::STANDARD as BASE64;
+    use rustfs_rio::{Checksum, ChecksumType as RioChecksumType};
    use serial_test::serial;
    use sha2::{Digest, Sha256};
    use tracing::info;
@@ -48,6 +54,401 @@ mod tests {
            .expect("Failed to enable versioning");
    }

+    fn create_s3_client_no_auto_checksum(env: &RustFSTestEnvironment) -> aws_sdk_s3::Client {
+        let credentials = Credentials::new(&env.access_key, &env.secret_key, None, None, "copy-checksum-e2e");
+        let config = aws_sdk_s3::Config::builder()
+            .credentials_provider(credentials)
+            .region(Region::new("us-east-1"))
+            .endpoint_url(format!("http://{}", env.address))
+            .force_path_style(true)
+            .behavior_version_latest()
+            .request_checksum_calculation(RequestChecksumCalculation::WhenRequired)
+            .http_client(SmithyHttpClientBuilder::new().build_http())
+            .build();
+        aws_sdk_s3::Client::from_conf(config)
+    }
+
+    fn algorithms() -> [(ChecksumAlgorithm, RioChecksumType); 10] {
+        [
+            (ChecksumAlgorithm::Crc32, RioChecksumType::CRC32),
+            (ChecksumAlgorithm::Crc32C, RioChecksumType::CRC32C),
+            (ChecksumAlgorithm::Crc64Nvme, RioChecksumType::CRC64_NVME),
+            (ChecksumAlgorithm::Sha1, RioChecksumType::SHA1),
+            (ChecksumAlgorithm::Sha256, RioChecksumType::SHA256),
+            (ChecksumAlgorithm::Md5, RioChecksumType::MD5),
+            (ChecksumAlgorithm::Sha512, RioChecksumType::SHA512),
+            (ChecksumAlgorithm::Xxhash3, RioChecksumType::XXHASH3),
+            (ChecksumAlgorithm::Xxhash64, RioChecksumType::XXHASH64),
+            (ChecksumAlgorithm::Xxhash128, RioChecksumType::XXHASH128),
+        ]
+    }
+
+    fn result_checksums(result: &aws_sdk_s3::types::CopyObjectResult) -> [Option<&str>; 10] {
+        [
+            result.checksum_crc32(),
+            result.checksum_crc32_c(),
+            result.checksum_crc64_nvme(),
+            result.checksum_sha1(),
+            result.checksum_sha256(),
+            result.checksum_md5(),
+            result.checksum_sha512(),
+            result.checksum_xxhash3(),
+            result.checksum_xxhash64(),
+            result.checksum_xxhash128(),
+        ]
+    }
+
+    fn head_checksums(output: &aws_sdk_s3::operation::head_object::HeadObjectOutput) -> [Option<&str>; 10] {
+        [
+            output.checksum_crc32(),
+            output.checksum_crc32_c(),
+            output.checksum_crc64_nvme(),
+            output.checksum_sha1(),
+            output.checksum_sha256(),
+            output.checksum_md5(),
+            output.checksum_sha512(),
+            output.checksum_xxhash3(),
+            output.checksum_xxhash64(),
+            output.checksum_xxhash128(),
+        ]
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn test_copy_supports_all_checksum_algorithms() {
+        init_logging();
+
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = create_s3_client_no_auto_checksum(&env);
+        let src_bucket = "copy-all-checksums-src";
+        let dst_bucket = "copy-all-checksums-dst";
+        let src_key = "objects/source.bin";
+        let content = b"deterministic CopyObject payload for all ten checksum algorithms";
+
+        create_versioned_bucket(&client, src_bucket).await;
+        create_versioned_bucket(&client, dst_bucket).await;
+        client
+            .put_object()
+            .bucket(src_bucket)
+            .key(src_key)
+            .body(ByteStream::from_static(content))
+            .send()
+            .await
+            .expect("PUT source failed");
+
+        for (index, (sdk_algorithm, rio_algorithm)) in algorithms().into_iter().enumerate() {
+            let expected = Checksum::new_from_data(rio_algorithm, content)
+                .expect("supported checksum must be computable")
+                .encoded;
+            let dst_key = format!("objects/destination-{index}.bin");
+            let copy = client
+                .copy_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .copy_source(format!("{src_bucket}/{src_key}"))
+                .checksum_algorithm(sdk_algorithm)
+                .send()
+                .await
+                .expect("CopyObject with supported checksum must succeed");
+            let result = copy.copy_object_result().expect("CopyObject result");
+            let checksums = result_checksums(result);
+            assert_eq!(checksums[index], Some(expected.as_str()), "{rio_algorithm}: response checksum");
+            assert_eq!(
+                checksums.iter().filter(|checksum| checksum.is_some()).count(),
+                1,
+                "{rio_algorithm}: only the requested checksum may be returned"
+            );
+
+            let head = client
+                .head_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .checksum_mode(ChecksumMode::Enabled)
+                .send()
+                .await
+                .expect("HEAD destination failed");
+            let checksums = head_checksums(&head);
+            assert_eq!(checksums[index], Some(expected.as_str()), "{rio_algorithm}: persisted checksum");
+            assert_eq!(
+                checksums.iter().filter(|checksum| checksum.is_some()).count(),
+                1,
+                "{rio_algorithm}: destination must persist only the requested checksum"
+            );
+
+            let body = client
+                .get_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .send()
+                .await
+                .expect("GET destination failed")
+                .body
+                .collect()
+                .await
+                .expect("collect destination body")
+                .into_bytes();
+            assert_eq!(body.as_ref(), content, "{rio_algorithm}: full copied body");
+        }
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn test_copy_without_algorithm_preserves_every_supported_source_checksum() {
+        init_logging();
+
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = create_s3_client_no_auto_checksum(&env);
+        let src_bucket = "copy-preserve-all-src";
+        let dst_bucket = "copy-preserve-all-dst";
+        let content = b"source checksum preservation payload for all ten algorithms";
+
+        create_versioned_bucket(&client, src_bucket).await;
+        create_versioned_bucket(&client, dst_bucket).await;
+
+        for (index, (_sdk_algorithm, rio_algorithm)) in algorithms().into_iter().enumerate() {
+            let expected = Checksum::new_from_data(rio_algorithm, content)
+                .expect("supported checksum must be computable")
+                .encoded;
+            let checksum_header = rio_algorithm.key().expect("supported checksum header");
+            let request_checksum = expected.clone();
+            let src_key = format!("objects/source-{index}.bin");
+            let dst_key = format!("objects/destination-{index}.bin");
+            client
+                .put_object()
+                .bucket(src_bucket)
+                .key(&src_key)
+                .body(ByteStream::from_static(content))
+                .customize()
+                .mutate_request(move |request| {
+                    request.headers_mut().insert(checksum_header, request_checksum.clone());
+                })
+                .send()
+                .await
+                .expect("PUT checksummed source failed");
+
+            let copy = client
+                .copy_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .copy_source(format!("{src_bucket}/{src_key}"))
+                .send()
+                .await
+                .expect("CopyObject without algorithm must succeed");
+            let result = copy.copy_object_result().expect("CopyObject result");
+            let checksums = result_checksums(result);
+            assert_eq!(checksums[index], Some(expected.as_str()), "{rio_algorithm}: preserved response checksum");
+            assert_eq!(checksums.iter().filter(|checksum| checksum.is_some()).count(), 1);
+
+            let head = client
+                .head_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .checksum_mode(ChecksumMode::Enabled)
+                .send()
+                .await
+                .expect("HEAD destination failed");
+            let checksums = head_checksums(&head);
+            assert_eq!(checksums[index], Some(expected.as_str()), "{rio_algorithm}: preserved stored checksum");
+            assert_eq!(checksums.iter().filter(|checksum| checksum.is_some()).count(), 1);
+        }
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn test_copy_without_algorithm_preserves_composite_checksum_type() {
+        init_logging();
+
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = create_s3_client_no_auto_checksum(&env);
+        let bucket = "copy-preserve-composite";
+        let source_key = "objects/multipart-source.bin";
+        let destination_key = "objects/copied-multipart.bin";
+        let content = b"multipart source checksum must remain composite";
+
+        create_versioned_bucket(&client, bucket).await;
+        let created = client
+            .create_multipart_upload()
+            .bucket(bucket)
+            .key(source_key)
+            .checksum_algorithm(ChecksumAlgorithm::Sha256)
+            .send()
+            .await
+            .expect("CreateMultipartUpload failed");
+        let upload_id = created.upload_id().expect("multipart upload ID");
+        let checksum = Checksum::new_from_data(RioChecksumType::SHA256, content)
+            .expect("SHA256 checksum")
+            .encoded;
+        let uploaded = client
+            .upload_part()
+            .bucket(bucket)
+            .key(source_key)
+            .upload_id(upload_id)
+            .part_number(1)
+            .checksum_sha256(&checksum)
+            .body(ByteStream::from_static(content))
+            .send()
+            .await
+            .expect("UploadPart failed");
+        let completed_part = CompletedPart::builder()
+            .part_number(1)
+            .e_tag(uploaded.e_tag().expect("part ETag"))
+            .checksum_sha256(uploaded.checksum_sha256().expect("part checksum"))
+            .build();
+        client
+            .complete_multipart_upload()
+            .bucket(bucket)
+            .key(source_key)
+            .upload_id(upload_id)
+            .multipart_upload(CompletedMultipartUpload::builder().parts(completed_part).build())
+            .send()
+            .await
+            .expect("CompleteMultipartUpload failed");
+
+        let source_head = client
+            .head_object()
+            .bucket(bucket)
+            .key(source_key)
+            .checksum_mode(ChecksumMode::Enabled)
+            .send()
+            .await
+            .expect("HEAD multipart source failed");
+        let source_checksum = source_head.checksum_sha256().expect("multipart source checksum");
+        assert_eq!(source_head.checksum_type(), Some(&ChecksumType::Composite));
+
+        let copied = client
+            .copy_object()
+            .bucket(bucket)
+            .key(destination_key)
+            .copy_source(format!("{bucket}/{source_key}"))
+            .send()
+            .await
+            .expect("CopyObject without algorithm failed");
+        let result = copied.copy_object_result().expect("CopyObject result");
+        assert_eq!(result.checksum_sha256(), Some(source_checksum));
+        assert_eq!(result.checksum_type(), Some(&ChecksumType::Composite));
+
+        let destination_head = client
+            .head_object()
+            .bucket(bucket)
+            .key(destination_key)
+            .checksum_mode(ChecksumMode::Enabled)
+            .send()
+            .await
+            .expect("HEAD copied multipart object failed");
+        assert_eq!(destination_head.checksum_sha256(), Some(source_checksum));
+        assert_eq!(destination_head.checksum_type(), Some(&ChecksumType::Composite));
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn test_copy_rejects_unknown_algorithm_without_destination_mutation() {
+        init_logging();
+
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-reject-unknown-checksum";
+        let src_key = "objects/source.bin";
+        let dst_key = "objects/destination.bin";
+        let source = b"source must never replace destination";
+        let destination = b"pre-existing destination must remain byte-for-byte unchanged";
+        let expected = Checksum::new_from_data(RioChecksumType::SHA256, destination)
+            .expect("SHA256 checksum")
+            .encoded;
+
+        create_versioned_bucket(&client, bucket).await;
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(src_key)
+            .body(ByteStream::from_static(source))
+            .send()
+            .await
+            .expect("PUT source failed");
+        let original = client
+            .put_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .metadata("state", "original")
+            .checksum_algorithm(ChecksumAlgorithm::Sha256)
+            .body(ByteStream::from_static(destination))
+            .send()
+            .await
+            .expect("PUT destination failed");
+        let original_version = original.version_id().expect("versioned PUT must return a version id");
+
+        let missing_source_error = client
+            .copy_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .copy_source(format!("{bucket}/objects/missing-source.bin"))
+            .checksum_algorithm(ChecksumAlgorithm::from("BLAKE3"))
+            .send()
+            .await
+            .expect_err("checksum validation must precede source lookup");
+        assert_eq!(
+            missing_source_error.as_service_error().and_then(|value| value.code()),
+            Some("InvalidArgument")
+        );
+        assert_eq!(missing_source_error.raw_response().map(|response| response.status().as_u16()), Some(400));
+
+        let error = client
+            .copy_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .copy_source(format!("{bucket}/{src_key}"))
+            .checksum_algorithm(ChecksumAlgorithm::from("BLAKE3"))
+            .send()
+            .await
+            .expect_err("unsupported checksum algorithm must fail");
+        assert_eq!(error.as_service_error().and_then(|value| value.code()), Some("InvalidArgument"));
+        assert_eq!(error.raw_response().map(|response| response.status().as_u16()), Some(400));
+
+        let head = client
+            .head_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .checksum_mode(ChecksumMode::Enabled)
+            .send()
+            .await
+            .expect("HEAD unchanged destination");
+        assert_eq!(head.version_id(), Some(original_version));
+        assert_eq!(
+            head.metadata().and_then(|metadata| metadata.get("state").map(String::as_str)),
+            Some("original")
+        );
+        assert_eq!(head.checksum_sha256(), Some(expected.as_str()));
+
+        let body = client
+            .get_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .send()
+            .await
+            .expect("GET unchanged destination")
+            .body
+            .collect()
+            .await
+            .expect("collect unchanged destination")
+            .into_bytes();
+        assert_eq!(body.as_ref(), destination);
+
+        env.stop_server();
+    }
+
    /// Requested algorithm: a CopyObject asking for SHA256 must compute it over the copied
    /// bytes, return it in `CopyObjectResult.ChecksumSHA256`, and persist it so a checksum-mode
    /// HEAD on the destination returns the identical value.
@@ -17,14 +17,17 @@
 #[cfg(test)]
 mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
-    use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::MetadataDirective;
+    use aws_sdk_s3::error::ProvideErrorMetadata;
+    use aws_sdk_s3::primitives::{ByteStream, DateTime, DateTimeFormat};
+    use aws_sdk_s3::types::{
+        BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, MetadataDirective, StorageClass, VersioningConfiguration,
+    };
    use serial_test::serial;
    use tracing::info;

    #[tokio::test]
    #[serial]
-    async fn test_self_copy_replace_metadata_preserves_readable_object() {
+    async fn copy_object_standard_metadata_copy_replace_and_clear() {
        init_logging();
        info!("Issue #2789: self-copy metadata replacement must preserve object data");

@@ -35,6 +38,14 @@ mod tests {
        let bucket = "self-copy-metadata-replace-test";
        let key = "assets/chunk-2F3R7JUG.js";
        let content = b"console.log('metadata replacement should keep object data readable');";
+        let source_expires = DateTime::from_secs(1_893_456_000);
+        let source_expires_http_date = source_expires
+            .fmt(DateTimeFormat::HttpDate)
+            .expect("Test timestamp should format as an HTTP date");
+        let replacement_expires = DateTime::from_secs(1_924_992_000);
+        let replacement_expires_http_date = replacement_expires
+            .fmt(DateTimeFormat::HttpDate)
+            .expect("Test timestamp should format as an HTTP date");

        client
            .create_bucket()
@@ -47,7 +58,14 @@ mod tests {
            .put_object()
            .bucket(bucket)
            .key(key)
+            .cache_control("max-age=60")
+            .content_disposition("inline; filename=source.js")
+            .content_encoding("br")
+            .content_language("en-US")
            .content_type("text/javascript; charset=utf-8")
+            .expires(source_expires)
+            .website_redirect_location("/source.html")
+            .storage_class(StorageClass::ReducedRedundancy)
            .metadata("mtime", "1777992333")
            .metadata("stale", "must-be-removed")
            .body(ByteStream::from_static(content))
@@ -55,13 +73,137 @@ mod tests {
            .await
            .expect("PUT failed");

+        let copied_key = "assets/default-copy.js";
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key(copied_key)
+            .copy_source(format!("{bucket}/{key}"))
+            .send()
+            .await
+            .expect("default CopyObject failed");
+
+        let copied_head = client
+            .head_object()
+            .bucket(bucket)
+            .key(copied_key)
+            .send()
+            .await
+            .expect("HEAD failed after default copy");
+        assert_eq!(copied_head.cache_control(), Some("max-age=60"));
+        assert_eq!(copied_head.content_disposition(), Some("inline; filename=source.js"));
+        assert_eq!(copied_head.content_encoding(), Some("br"));
+        assert_eq!(copied_head.content_language(), Some("en-US"));
+        assert_eq!(copied_head.content_type(), Some("text/javascript; charset=utf-8"));
+        assert_eq!(copied_head.expires_string(), Some(source_expires_http_date.as_str()));
+        assert_eq!(
+            copied_head.storage_class(),
+            None,
+            "CopyObject without a storage class should write STANDARD"
+        );
+        assert_eq!(
+            copied_head.website_redirect_location(),
+            Some("/source.html"),
+            "default CopyObject should preserve source metadata"
+        );
+        assert_eq!(
+            copied_head.metadata().and_then(|metadata| metadata.get("stale")),
+            Some(&"must-be-removed".to_string())
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("assets/explicit-copy.js")
+            .copy_source(format!("{bucket}/{key}"))
+            .metadata_directive(MetadataDirective::Copy)
+            .customize()
+            .mutate_request(|request| {
+                request.headers_mut().insert("content-type", "application/octet-stream");
+                request.headers_mut().insert("x-amz-meta-request-only", "ignored");
+            })
+            .send()
+            .await
+            .expect("explicit COPY directive with request metadata failed");
+        let explicit_copy_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("assets/explicit-copy.js")
+            .send()
+            .await
+            .expect("HEAD failed after explicit COPY");
+        assert_eq!(explicit_copy_head.cache_control(), Some("max-age=60"));
+        assert_eq!(explicit_copy_head.content_type(), Some("text/javascript; charset=utf-8"));
+        assert_eq!(
+            explicit_copy_head.metadata().and_then(|metadata| metadata.get("mtime")),
+            Some(&"1777992333".to_string())
+        );
+        assert_eq!(
+            explicit_copy_head
+                .metadata()
+                .and_then(|metadata| metadata.get("request-only")),
+            None,
+            "COPY must ignore request metadata"
+        );
+        assert_eq!(
+            explicit_copy_head.website_redirect_location(),
+            None,
+            "explicit COPY does not inherit website redirect metadata"
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("assets/explicit-copy-redirect.js")
+            .copy_source(format!("{bucket}/{key}"))
+            .metadata_directive(MetadataDirective::Copy)
+            .website_redirect_location("/explicit-copy.html")
+            .send()
+            .await
+            .expect("explicit COPY with redirect failed");
+        let explicit_redirect_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("assets/explicit-copy-redirect.js")
+            .send()
+            .await
+            .expect("HEAD failed after explicit COPY with redirect");
+        assert_eq!(explicit_redirect_head.website_redirect_location(), Some("/explicit-copy.html"));
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("assets/explicit-storage-class.js")
+            .copy_source(format!("{bucket}/{key}"))
+            .storage_class(StorageClass::ReducedRedundancy)
+            .send()
+            .await
+            .expect("CopyObject with an explicit storage class failed");
+        let explicit_storage_class_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("assets/explicit-storage-class.js")
+            .send()
+            .await
+            .expect("HEAD failed after explicit storage class copy");
+        assert_eq!(
+            explicit_storage_class_head.storage_class().map(StorageClass::as_str),
+            Some("REDUCED_REDUNDANCY")
+        );
+
        client
            .copy_object()
            .bucket(bucket)
            .key(key)
            .copy_source(format!("{bucket}/{key}"))
            .metadata_directive(MetadataDirective::Replace)
-            .content_type("text/javascript; charset=utf-8")
+            .cache_control("no-cache")
+            .content_disposition("attachment; filename=replaced.js")
+            .content_encoding("gzip")
+            .content_language("fr-FR")
+            .content_type("application/javascript")
+            .expires(replacement_expires)
+            .website_redirect_location("/replaced.html")
            .metadata("mtime", "1777992348")
            .send()
            .await
@@ -85,6 +227,14 @@ mod tests {
            None,
            "HEAD should not return metadata omitted by REPLACE"
        );
+        assert_eq!(head_resp.cache_control(), Some("no-cache"));
+        assert_eq!(head_resp.content_disposition(), Some("attachment; filename=replaced.js"));
+        assert_eq!(head_resp.content_encoding(), Some("gzip"));
+        assert_eq!(head_resp.content_language(), Some("fr-FR"));
+        assert_eq!(head_resp.content_type(), Some("application/javascript"));
+        assert_eq!(head_resp.expires_string(), Some(replacement_expires_http_date.as_str()));
+        assert_eq!(head_resp.website_redirect_location(), Some("/replaced.html"));
+        assert_eq!(head_resp.storage_class(), None, "REPLACE without a storage class should write STANDARD");

        let get_resp = client
            .get_object()
@@ -123,6 +273,13 @@ mod tests {
            None,
            "HEAD should not return metadata omitted by empty REPLACE"
        );
+        assert_eq!(empty_head_resp.cache_control(), None);
+        assert_eq!(empty_head_resp.content_disposition(), None);
+        assert_eq!(empty_head_resp.content_encoding(), None);
+        assert_eq!(empty_head_resp.content_language(), None);
+        assert_eq!(empty_head_resp.content_type(), None);
+        assert_eq!(empty_head_resp.expires_string(), None);
+        assert_eq!(empty_head_resp.website_redirect_location(), None);

        let empty_get_resp = client
            .get_object()
@@ -141,4 +298,319 @@ mod tests {

        env.stop_server();
    }
+
+    #[tokio::test]
+    #[serial]
+    async fn copy_object_replace_accepts_each_standard_field_independently() {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-object-metadata-fields";
+        let source = "source.txt";
+        client
+            .create_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("Failed to create bucket");
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(source)
+            .cache_control("source-cache")
+            .content_disposition("inline")
+            .content_encoding("br")
+            .content_language("en")
+            .content_type("text/source")
+            .expires(DateTime::from_secs(1_893_456_000))
+            .body(ByteStream::from_static(b"field-by-field"))
+            .send()
+            .await
+            .expect("PUT failed");
+        let replacement_expires = DateTime::from_secs(1_924_992_000);
+        let replacement_expires_http_date = replacement_expires
+            .fmt(DateTimeFormat::HttpDate)
+            .expect("Test timestamp should format as an HTTP date");
+
+        for field in [
+            "cache-control",
+            "content-disposition",
+            "content-encoding",
+            "content-language",
+            "content-type",
+            "expires",
+            "website-redirect",
+        ] {
+            let destination = format!("{field}.txt");
+            let request = client
+                .copy_object()
+                .bucket(bucket)
+                .key(&destination)
+                .copy_source(format!("{bucket}/{source}"))
+                .metadata_directive(MetadataDirective::Replace);
+            let request = match field {
+                "cache-control" => request.cache_control("field-cache"),
+                "content-disposition" => request.content_disposition("attachment"),
+                "content-encoding" => request.content_encoding("gzip"),
+                "content-language" => request.content_language("de"),
+                "content-type" => request.content_type("text/field"),
+                "expires" => request.expires(replacement_expires),
+                "website-redirect" => request.website_redirect_location("/field.html"),
+                _ => unreachable!("field table contains only supported entries"),
+            };
+            request.send().await.expect("field-specific CopyObject failed");
+
+            let head = client
+                .head_object()
+                .bucket(bucket)
+                .key(&destination)
+                .send()
+                .await
+                .expect("HEAD failed");
+            assert_eq!(head.cache_control(), (field == "cache-control").then_some("field-cache"));
+            assert_eq!(head.content_disposition(), (field == "content-disposition").then_some("attachment"));
+            assert_eq!(head.content_encoding(), (field == "content-encoding").then_some("gzip"));
+            assert_eq!(head.content_language(), (field == "content-language").then_some("de"));
+            assert_eq!(head.content_type(), (field == "content-type").then_some("text/field"));
+            assert_eq!(
+                head.expires_string(),
+                (field == "expires").then_some(replacement_expires_http_date.as_str())
+            );
+            assert_eq!(head.website_redirect_location(), (field == "website-redirect").then_some("/field.html"));
+        }
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("user-metadata-collision.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .metadata("content-type", "user-content-type")
+            .metadata("content-encoding", "user-content-encoding")
+            .send()
+            .await
+            .expect("CopyObject should preserve user metadata namespaces");
+        let collision_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("user-metadata-collision.txt")
+            .send()
+            .await
+            .expect("HEAD failed for metadata collision case");
+        assert_eq!(collision_head.content_type(), None);
+        assert_eq!(collision_head.content_encoding(), None);
+        assert_eq!(
+            collision_head.metadata().and_then(|metadata| metadata.get("content-type")),
+            Some(&"user-content-type".to_string())
+        );
+        assert_eq!(
+            collision_head
+                .metadata()
+                .and_then(|metadata| metadata.get("content-encoding")),
+            Some(&"user-content-encoding".to_string())
+        );
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn copy_object_replace_handles_versioned_multipart_source() {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-object-metadata-multipart";
+        let source = "source.bin";
+        let multipart_body = b"multipart historical source";
+        client
+            .create_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("Failed to create bucket");
+        client
+            .put_bucket_versioning()
+            .bucket(bucket)
+            .versioning_configuration(
+                VersioningConfiguration::builder()
+                    .status(BucketVersioningStatus::Enabled)
+                    .build(),
+            )
+            .send()
+            .await
+            .expect("Failed to enable versioning");
+
+        let upload = client
+            .create_multipart_upload()
+            .bucket(bucket)
+            .key(source)
+            .content_type("application/source")
+            .send()
+            .await
+            .expect("Failed to create multipart upload");
+        let upload_id = upload.upload_id().expect("Multipart upload should return an ID");
+        let part = client
+            .upload_part()
+            .bucket(bucket)
+            .key(source)
+            .upload_id(upload_id)
+            .part_number(1)
+            .body(ByteStream::from_static(multipart_body))
+            .send()
+            .await
+            .expect("Failed to upload multipart part");
+        let completed = client
+            .complete_multipart_upload()
+            .bucket(bucket)
+            .key(source)
+            .upload_id(upload_id)
+            .multipart_upload(
+                CompletedMultipartUpload::builder()
+                    .parts(
+                        CompletedPart::builder()
+                            .part_number(1)
+                            .e_tag(part.e_tag().expect("Uploaded part should return an ETag"))
+                            .build(),
+                    )
+                    .build(),
+            )
+            .send()
+            .await
+            .expect("Failed to complete multipart upload");
+        let historical_version = completed
+            .version_id()
+            .expect("Versioned multipart upload should return a version ID")
+            .to_string();
+
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(source)
+            .body(ByteStream::from_static(b"new current version"))
+            .send()
+            .await
+            .expect("Failed to write current version");
+
+        let copy = client
+            .copy_object()
+            .bucket(bucket)
+            .key("restored.bin")
+            .copy_source(format!("{bucket}/{source}?versionId={historical_version}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .content_type("application/replaced")
+            .send()
+            .await
+            .expect("Failed to copy historical multipart version");
+        assert_eq!(copy.copy_source_version_id(), Some(historical_version.as_str()));
+
+        let restored = client
+            .get_object()
+            .bucket(bucket)
+            .key("restored.bin")
+            .send()
+            .await
+            .expect("Failed to read copied multipart source");
+        assert_eq!(restored.content_type(), Some("application/replaced"));
+        assert_eq!(
+            restored
+                .body
+                .collect()
+                .await
+                .expect("Failed to collect restored body")
+                .into_bytes()
+                .as_ref(),
+            multipart_body
+        );
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn invalid_replacement_metadata_does_not_mutate_destination() {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_REJECT_ARCHIVE_CONTENT_ENCODING", "true")])
+            .await
+            .expect("Failed to start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-object-invalid-metadata";
+        let key = "destination.zip";
+        client
+            .create_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("Failed to create bucket");
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(key)
+            .content_type("application/zip")
+            .metadata("state", "original")
+            .body(ByteStream::from_static(b"original destination"))
+            .send()
+            .await
+            .expect("Failed to write destination");
+
+        let error = client
+            .copy_object()
+            .bucket(bucket)
+            .key(key)
+            .copy_source(format!("{bucket}/{key}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .content_type("application/zip")
+            .content_encoding("gzip")
+            .send()
+            .await
+            .expect_err("Invalid replacement metadata should be rejected");
+        assert_eq!(error.as_service_error().and_then(|err| err.code()), Some("InvalidArgument"));
+
+        let invalid_directive = client
+            .copy_object()
+            .bucket(bucket)
+            .key(key)
+            .copy_source(format!("{bucket}/{key}"))
+            .customize()
+            .mutate_request(|request| {
+                request.headers_mut().insert("x-amz-metadata-directive", "UNKNOWN");
+            })
+            .send()
+            .await
+            .expect_err("Unknown metadata directives should be rejected");
+        assert_eq!(
+            invalid_directive.as_service_error().and_then(|error| error.code()),
+            Some("InvalidArgument")
+        );
+
+        let unchanged = client
+            .get_object()
+            .bucket(bucket)
+            .key(key)
+            .send()
+            .await
+            .expect("Destination should remain readable");
+        assert_eq!(unchanged.content_type(), Some("application/zip"));
+        assert_eq!(
+            unchanged.metadata().and_then(|metadata| metadata.get("state")),
+            Some(&"original".to_string())
+        );
+        assert_eq!(
+            unchanged
+                .body
+                .collect()
+                .await
+                .expect("Failed to collect destination body")
+                .into_bytes()
+                .as_ref(),
+            b"original destination"
+        );
+
+        env.stop_server();
+    }
 }
@@ -0,0 +1,468 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! CopyObject tagging directive regression tests.
+
+#[cfg(test)]
+mod tests {
+    use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
+    use aws_sdk_s3::Client;
+    use aws_sdk_s3::error::ProvideErrorMetadata;
+    use aws_sdk_s3::primitives::ByteStream;
+    use aws_sdk_s3::types::{BucketVersioningStatus, MetadataDirective, TaggingDirective, VersioningConfiguration};
+    use serial_test::serial;
+    use std::collections::BTreeMap;
+
+    async fn object_tags(client: &Client, bucket: &str, key: &str) -> BTreeMap<String, String> {
+        client
+            .get_object_tagging()
+            .bucket(bucket)
+            .key(key)
+            .send()
+            .await
+            .expect("GetObjectTagging should succeed")
+            .tag_set()
+            .iter()
+            .map(|tag| (tag.key().to_string(), tag.value().to_string()))
+            .collect()
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn copy_object_applies_copy_replace_and_empty_tagging_directives() {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new()
+            .await
+            .expect("test environment should initialize");
+        env.start_rustfs_server(vec![]).await.expect("RustFS should start");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-object-tagging-directive";
+        let source = "source.txt";
+
+        client
+            .create_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("bucket creation should succeed");
+        client
+            .put_bucket_versioning()
+            .bucket(bucket)
+            .versioning_configuration(
+                VersioningConfiguration::builder()
+                    .status(BucketVersioningStatus::Enabled)
+                    .build(),
+            )
+            .send()
+            .await
+            .expect("versioning should be enabled");
+
+        let first_version = client
+            .put_object()
+            .bucket(bucket)
+            .key(source)
+            .tagging("project=rustfs&stage=first")
+            .body(ByteStream::from_static(b"first"))
+            .send()
+            .await
+            .expect("first source version should be written")
+            .version_id()
+            .expect("versioned PUT should return a version ID")
+            .to_string();
+
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(source)
+            .tagging("project=rustfs&stage=current")
+            .body(ByteStream::from_static(b"current"))
+            .send()
+            .await
+            .expect("current source version should be written");
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("default-copy.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .send()
+            .await
+            .expect("default CopyObject should preserve current source tags");
+        assert_eq!(
+            object_tags(&client, bucket, "default-copy.txt").await,
+            BTreeMap::from([
+                ("project".to_string(), "rustfs".to_string()),
+                ("stage".to_string(), "current".to_string()),
+            ])
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("explicit-copy.txt")
+            .copy_source(format!("{bucket}/{source}?versionId={first_version}"))
+            .tagging_directive(TaggingDirective::Copy)
+            .send()
+            .await
+            .expect("COPY should preserve the selected historical version's tags");
+        assert_eq!(
+            object_tags(&client, bucket, "explicit-copy.txt").await,
+            BTreeMap::from([
+                ("project".to_string(), "rustfs".to_string()),
+                ("stage".to_string(), "first".to_string()),
+            ])
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("replace.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::Replace)
+            .tagging("project=cli&label=copy%20test")
+            .send()
+            .await
+            .expect("REPLACE should atomically apply requested tags");
+        assert_eq!(
+            object_tags(&client, bucket, "replace.txt").await,
+            BTreeMap::from([
+                ("label".to_string(), "copy test".to_string()),
+                ("project".to_string(), "cli".to_string()),
+            ])
+        );
+        let replace_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("replace.txt")
+            .send()
+            .await
+            .expect("HEAD should succeed after tag replacement");
+        assert_eq!(replace_head.tag_count(), Some(2));
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("empty-replace.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::Replace)
+            .send()
+            .await
+            .expect("REPLACE without Tagging should clear the destination tag set");
+        assert!(object_tags(&client, bucket, "empty-replace.txt").await.is_empty());
+        let empty_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("empty-replace.txt")
+            .send()
+            .await
+            .expect("HEAD should succeed after empty tag replacement");
+        assert_eq!(empty_head.tag_count(), None);
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("metadata-replace-tag-copy.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .metadata("updated", "true")
+            .send()
+            .await
+            .expect("metadata REPLACE must preserve tags under the default COPY directive");
+        assert_eq!(
+            object_tags(&client, bucket, "metadata-replace-tag-copy.txt").await,
+            BTreeMap::from([
+                ("project".to_string(), "rustfs".to_string()),
+                ("stage".to_string(), "current".to_string()),
+            ])
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("combined-replace.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .metadata("updated", "true")
+            .tagging_directive(TaggingDirective::Replace)
+            .tagging("project=combined")
+            .send()
+            .await
+            .expect("metadata and tagging REPLACE directives must be independent");
+        assert_eq!(
+            object_tags(&client, bucket, "combined-replace.txt").await,
+            BTreeMap::from([("project".to_string(), "combined".to_string())])
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key(source)
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::Replace)
+            .tagging("project=self-copy")
+            .send()
+            .await
+            .expect("self-copy with tag replacement should update tags atomically");
+        assert_eq!(
+            object_tags(&client, bucket, source).await,
+            BTreeMap::from([("project".to_string(), "self-copy".to_string())])
+        );
+        let self_copy_body = client
+            .get_object()
+            .bucket(bucket)
+            .key(source)
+            .send()
+            .await
+            .expect("self-copy destination should remain readable")
+            .body
+            .collect()
+            .await
+            .expect("self-copy body should be complete")
+            .into_bytes();
+        assert_eq!(self_copy_body.as_ref(), b"current", "tag-only self-copy must preserve the object body");
+
+        client
+            .put_object()
+            .bucket(bucket)
+            .key("malformed.txt")
+            .tagging("state=original")
+            .body(ByteStream::from_static(b"original destination"))
+            .send()
+            .await
+            .expect("preexisting malformed-test destination should be written");
+
+        let malformed = client
+            .copy_object()
+            .bucket(bucket)
+            .key("malformed.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::Replace)
+            .tagging("project=rustfs%ZZ")
+            .send()
+            .await
+            .expect_err("malformed tags must fail CopyObject");
+        assert_eq!(malformed.as_service_error().and_then(ProvideErrorMetadata::code), Some("InvalidTag"));
+        assert_eq!(
+            object_tags(&client, bucket, "malformed.txt").await,
+            BTreeMap::from([("state".to_string(), "original".to_string())])
+        );
+        let preserved_body = client
+            .get_object()
+            .bucket(bucket)
+            .key("malformed.txt")
+            .send()
+            .await
+            .expect("malformed tags must not replace an existing destination")
+            .body
+            .collect()
+            .await
+            .expect("preserved destination body should be readable")
+            .into_bytes();
+        assert_eq!(
+            preserved_body.as_ref(),
+            b"original destination",
+            "malformed tags must leave destination data unchanged"
+        );
+
+        let discarded = client
+            .copy_object()
+            .bucket(bucket)
+            .key("discarded.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging("project=must-not-be-discarded")
+            .send()
+            .await
+            .expect_err("Tagging without REPLACE must fail instead of discarding requested tags");
+        assert_eq!(discarded.as_service_error().and_then(ProvideErrorMetadata::code), Some("InvalidRequest"));
+
+        let invalid_directive = client
+            .copy_object()
+            .bucket(bucket)
+            .key("invalid-directive.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::from("UNKNOWN"))
+            .send()
+            .await
+            .expect_err("an unknown TaggingDirective must fail");
+        assert_eq!(
+            invalid_directive.as_service_error().and_then(ProvideErrorMetadata::code),
+            Some("InvalidArgument")
+        );
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn copy_object_tag_replacement_honors_request_tag_policy_denial() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
+    {
+        init_logging();
+        let source_bucket = "copy-tags-policy-source";
+        let destination_bucket = "copy-tags-policy-destination";
+
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(vec![]).await?;
+        let admin = env.create_s3_client();
+        admin.create_bucket().bucket(source_bucket).send().await?;
+        admin.create_bucket().bucket(destination_bucket).send().await?;
+        admin
+            .put_object()
+            .bucket(source_bucket)
+            .key("source.txt")
+            .tagging("source=allowed")
+            .body(ByteStream::from_static(b"source"))
+            .send()
+            .await?;
+        admin
+            .put_object()
+            .bucket(source_bucket)
+            .key("conditioned.txt")
+            .body(ByteStream::from_static(b"conditioned source"))
+            .send()
+            .await?;
+
+        let source_policy = serde_json::json!({
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Effect": "Allow",
+                    "Principal": "*",
+                    "Action": ["s3:GetObject"],
+                    "Resource": [format!("arn:aws:s3:::{source_bucket}/source.txt")]
+                },
+                {
+                    "Effect": "Allow",
+                    "Principal": "*",
+                    "Action": ["s3:GetObject"],
+                    "Resource": [format!("arn:aws:s3:::{source_bucket}/conditioned.txt")],
+                    "Condition": {
+                        "StringEquals": {
+                            "s3:RequestObjectTag/classification": "public"
+                        }
+                    }
+                }
+            ]
+        })
+        .to_string();
+        admin
+            .put_bucket_policy()
+            .bucket(source_bucket)
+            .policy(source_policy)
+            .send()
+            .await?;
+
+        let destination_policy = serde_json::json!({
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Effect": "Allow",
+                    "Principal": "*",
+                    "Action": ["s3:PutObject"],
+                    "Resource": [format!("arn:aws:s3:::{destination_bucket}/*")]
+                },
+                {
+                    "Effect": "Deny",
+                    "Principal": "*",
+                    "Action": ["s3:PutObject"],
+                    "Resource": [format!("arn:aws:s3:::{destination_bucket}/*")],
+                    "Condition": {
+                        "StringEquals": {
+                            "s3:RequestObjectTag/classification": "restricted"
+                        }
+                    }
+                }
+            ]
+        })
+        .to_string();
+        admin
+            .put_bucket_policy()
+            .bucket(destination_bucket)
+            .policy(destination_policy)
+            .send()
+            .await?;
+
+        let copy_source = format!("/{source_bucket}/source.txt");
+        let allowed = local_http_client()
+            .put(format!("{}/{destination_bucket}/allowed.txt", env.url))
+            .header("x-amz-copy-source", &copy_source)
+            .header("x-amz-tagging-directive", "REPLACE")
+            .header("x-amz-tagging", "classification=public")
+            .send()
+            .await?;
+        assert_eq!(
+            allowed.status(),
+            reqwest::StatusCode::OK,
+            "a tag set allowed by the request-tag policy should copy successfully"
+        );
+        assert_eq!(
+            object_tags(&admin, destination_bucket, "allowed.txt").await,
+            BTreeMap::from([("classification".to_string(), "public".to_string())])
+        );
+
+        let denied = local_http_client()
+            .put(format!("{}/{destination_bucket}/denied.txt", env.url))
+            .header("x-amz-copy-source", copy_source)
+            .header("x-amz-tagging-directive", "REPLACE")
+            .header("x-amz-tagging", "classification=restricted")
+            .send()
+            .await?;
+        assert_eq!(
+            denied.status(),
+            reqwest::StatusCode::FORBIDDEN,
+            "CopyObject must honor a request-tag policy Deny"
+        );
+
+        let source_condition_bypass = local_http_client()
+            .put(format!("{}/{destination_bucket}/source-condition.txt", env.url))
+            .header("x-amz-copy-source", format!("/{source_bucket}/conditioned.txt"))
+            .header("x-amz-tagging-directive", "REPLACE")
+            .header("x-amz-tagging", "classification=public")
+            .send()
+            .await?;
+        assert_eq!(
+            source_condition_bypass.status(),
+            reqwest::StatusCode::FORBIDDEN,
+            "destination request tags must not satisfy source GetObject policy conditions"
+        );
+
+        let missing_destination = admin
+            .head_object()
+            .bucket(destination_bucket)
+            .key("denied.txt")
+            .send()
+            .await
+            .expect_err("an access-denied copy must not create a destination object");
+        assert_eq!(
+            missing_destination.as_service_error().and_then(ProvideErrorMetadata::code),
+            Some("NotFound")
+        );
+        let missing_bypass_destination = admin
+            .head_object()
+            .bucket(destination_bucket)
+            .key("source-condition.txt")
+            .send()
+            .await
+            .expect_err("a source authorization denial must not create a destination object");
+        assert_eq!(
+            missing_bypass_destination
+                .as_service_error()
+                .and_then(ProvideErrorMetadata::code),
+            Some("NotFound")
+        );
+
+        env.stop_server();
+        Ok(())
+    }
+}
@@ -56,6 +56,21 @@ mod tests {
        );
    }

+    async fn assert_current_list_hides_delete_marker(client: &Client, bucket: &str, key: &str) {
+        let listed = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .prefix(key)
+            .send()
+            .await
+            .expect("list current objects after delete marker");
+
+        assert!(
+            listed.contents().iter().all(|object| object.key() != Some(key)),
+            "ListObjectsV2 must hide an object whose latest version is a delete marker"
+        );
+    }
+
    #[tokio::test]
    #[serial]
    async fn test_versioning_only_delete_marker_has_minio_compatible_visibility_for_migration_proof() {
@@ -94,6 +109,7 @@ mod tests {
        assert_eq!(markers[0].version_id(), Some(delete_marker_version_id));
        assert_eq!(markers[0].is_latest(), Some(true));
        assert_current_get_is_delete_marker_not_found(&client, bucket, key).await;
+        assert_current_list_hides_delete_marker(&client, bucket, key).await;
    }

    #[tokio::test]
@@ -118,6 +134,17 @@ mod tests {
            .await
            .expect("put historical version");
        let data_version_id = put.version_id().expect("put should return data version id");
+        let listed_before_delete = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .prefix(key)
+            .send()
+            .await
+            .expect("list current object before creating delete marker");
+        assert!(
+            listed_before_delete.contents().iter().any(|object| object.key() == Some(key)),
+            "ListObjectsV2 must include the current object before it is deleted"
+        );

        let delete_marker = client
            .delete_object()
@@ -145,6 +172,7 @@ mod tests {
        assert_eq!(markers[0].version_id(), Some(delete_marker_version_id));
        assert_eq!(markers[0].is_latest(), Some(true));
        assert_current_get_is_delete_marker_not_found(&client, bucket, key).await;
+        assert_current_list_hides_delete_marker(&client, bucket, key).await;

        let historical = client
            .get_object()
@@ -25,6 +25,7 @@ use hyper::body::Incoming;
 use hyper::server::conn::http1;
 use hyper::service::service_fn;
 use hyper_util::rt::{TokioIo, TokioTimer};
+use md5::{Digest as Md5Digest, Md5};
 use s3s::access::{S3Access, S3AccessContext};
 use s3s::auth::SimpleAuth;
 use s3s::dto::{
@@ -827,13 +828,25 @@ fn ensure_body_growth(current: usize, added: usize) -> S3Result {

 async fn md5_digest(body: Bytes, permit: OwnedSemaphorePermit) -> S3Result<([u8; 16], OwnedSemaphorePermit)> {
    if body.len() < 1024 * 1024 {
-        return Ok((md5::compute(body).0, permit));
+        return Ok((md5_bytes(body), permit));
    }
-    tokio::task::spawn_blocking(move || (md5::compute(body).0, permit))
+    tokio::task::spawn_blocking(move || (md5_bytes(body), permit))
        .await
        .map_err(|error| s3s::s3_error!(InternalError, "MD5 worker failed: {error}"))
 }

+fn md5_bytes(input: impl AsRef<[u8]>) -> [u8; 16] {
+    let mut hasher = Md5::new();
+    hasher.update(input.as_ref());
+    hasher.finalize().into()
+}
+
+fn md5_hex(input: impl AsRef<[u8]>) -> String {
+    let mut hasher = Md5::new();
+    hasher.update(input.as_ref());
+    hex::encode(hasher.finalize())
+}
+
 fn ensure_store_budget(state: &StoreState, removed_bytes: usize, added_bytes: usize, adds_version: bool) -> S3Result {
    let total_bytes = state
        .total_bytes
@@ -1005,7 +1018,7 @@ impl S3 for FakeBackend {
            Some(value) => value,
            None => {
                let (digest, _body_permit) = md5_digest(body.clone(), _body_permit).await?;
-                format!("{:x}", md5::Digest(digest))
+                hex::encode(digest)
            }
        };
        let version = ObjectVersion {
@@ -1208,7 +1221,7 @@ impl S3 for FakeBackend {
        }
        let body = collect_stream(input.body, input.content_length, fault.as_ref(), &self.control).await?;
        let (digest, _body_permit) = md5_digest(body.clone(), _body_permit).await?;
-        let e_tag = format!("{:x}", md5::Digest(digest));
+        let e_tag = hex::encode(digest);
        let mut state = lock(&self.store);
        let existing_bytes = state
            .uploads
@@ -1336,7 +1349,7 @@ impl S3 for FakeBackend {
            .collect();
        let (body, digests, _body_permits) = assemble_multipart(assembly_parts, total_len, _body_permits).await?;
        let part_count = requested.len();
-        let e_tag = source_etag(&headers)?.unwrap_or_else(|| format!("{:x}-{part_count}", md5::compute(digests)));
+        let e_tag = source_etag(&headers)?.unwrap_or_else(|| format!("{}-{part_count}", md5_hex(digests)));
        let version = ObjectVersion {
            version_id: upload.version_id.clone(),
            body,
@@ -45,10 +45,10 @@
 //!   * Parity reconstruction: one data disk is taken offline
 //!     (`take_disk_offline`) and the SAME object matrix is GET both ways while
 //!     the EC 2+2 set rebuilds each large object from the surviving shards. The
-//!     codec-streaming reader gate never inspects drive health, so the codec
-//!     fast path is exercised end-to-end through reconstruction; the test
-//!     asserts byte- and header-equality vs the legacy path AND that the codec
-//!     phase never fell back to a duplex pipe while reconstructing.
+//!     eager first/single-part setup may keep its conservative whole-request
+//!     fallback when shard placement makes codec streaming unsafe, so this phase
+//!     asserts byte- and header-equality vs the legacy path rather than requiring
+//!     zero duplex fallbacks under degraded drive health.
 //!   * Missing object: a GET for an absent key is compared across both phases
 //!     to prove the error semantics (HTTP status + S3 error code) are identical
 //!     — the codec env must not perturb the NoSuchKey negative path.
@@ -475,15 +475,14 @@ mod tests {
            "ranged GET length diverged with codec streaming enabled"
        );

-        // ---- Phase B degraded: the same reconstruction, now on the codec path ----
-        // Re-run the reconstruction A/B with the codec-streaming gates still
-        // open. The reader gate decision is independent of drive health (it
-        // never inspects disk state), so the codec fast path is exercised
-        // end-to-end while the EC set rebuilds each large object from the
-        // surviving shards — this is a real codec-vs-legacy reconstruction test,
-        // not legacy-vs-legacy. Snapshot the duplex count first (the range GET
-        // above already used the duplex path) so we can measure only the markers
-        // these degraded codec GETs add.
+        // ---- Phase B degraded: the same reconstruction, with codec gates open ----
+        // Re-run the reconstruction A/B with codec-streaming enabled. If eager
+        // first/single-part setup cannot prove the codec path is safe for the
+        // surviving shards, the implementation intentionally preserves the
+        // whole-request legacy fallback; later multipart parts can degrade in
+        // place. This phase verifies parity-reconstructed bytes and headers,
+        // while the healthy phase above remains the strict zero-duplex path
+        // confirmation.
        let dup_codec_before_degraded = count_marker(&codec_log, DUPLEX_MARKER);
        harness.take_disk_offline(0)?;
        let mut codec_degraded: BTreeMap<String, GetView> = BTreeMap::new();
@@ -511,16 +510,11 @@ mod tests {
            );
        }

-        // Path confirmation under reconstruction: the codec fast path must have
-        // served the reconstructed large objects without ever falling back to
-        // the legacy duplex pipe. Without this, the equivalence above could be
-        // legacy-vs-legacy and prove nothing about codec reconstruction.
+        // Keep degraded duplex markers as diagnostic evidence only: eager setup
+        // may fall back before streaming when shard safety cannot be proven.
        sleep(Duration::from_millis(300)).await;
        let dup_codec_degraded = count_marker(&codec_log, DUPLEX_MARKER).saturating_sub(dup_codec_before_degraded);
-        assert_eq!(
-            dup_codec_degraded, 0,
-            "codec phase created {dup_codec_degraded} duplex pipe(s) while reconstructing large objects with disk0 offline; the codec fast path was not exercised under degraded reads (see {codec_log})"
-        );
+        info!(dup_codec_degraded, "codec phase degraded-read legacy duplex marker count");

        info!(
            objects = baseline.len(),
@@ -0,0 +1,776 @@
+#![cfg(test)]
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Cross-process replay / tamper acceptance for internode NodeService RPC
+//! signatures (<https://github.com/rustfs/backlog/issues/1327>,
+//! <https://github.com/rustfs/backlog/issues/1542>).
+//!
+//! # Why this exists on top of the in-process tests
+//!
+//! `http_auth.rs` unit-tests the signature algebra by calling the verifier
+//! directly. That proves the crypto, but it cannot prove that a *deployed*
+//! server actually reaches it: the request has to survive the hybrid HTTP/gRPC
+//! router, `check_auth`, tonic's own metadata handling, and finally the
+//! per-handler body-digest gate. A handler that forgets its
+//! `verify_disk_mutation_digest` call, or a router change that bypasses
+//! `check_auth`, is invisible in-process and wide open in production. These
+//! tests drive a real `rustfs` child process over a real TCP socket, so every
+//! one of those layers is in the path.
+//!
+//! # Attacker model
+//!
+//! The adversary is on-path: it observed one legitimately signed request and
+//! can resend, retarget, or edit those bytes — including individual headers.
+//! It does **not** hold the RPC secret. The test process does hold the secret,
+//! but uses it for exactly one purpose: minting the request that stands in for
+//! the captured one. Every attack then only *reuses or edits* an already-minted
+//! header set; no attack step ever re-signs. If any of these tests could pass
+//! by re-signing, it would be testing nothing.
+//!
+//! # Isolating one variable at a time
+//!
+//! Each rejection is paired with an acceptance that differs in exactly one
+//! respect, because a misconfigured harness (wrong audience, dead server,
+//! ambient strict env) would otherwise make every "rejected" assertion pass
+//! vacuously. Two pairings carry most of the weight:
+//!
+//! - Editing the body alone is caught by the *handler* (`PermissionDenied`);
+//!   editing the body **and** repairing the digest header to match is caught by
+//!   the *signature* (`Unauthenticated`). The second only fails closed if the
+//!   digest is genuinely inside the signed scope, so the pair pins both layers.
+//! - Replaying a captured nonce is caught by the replay cache; swapping in a
+//!   fresh nonce is caught by the signature. Again, only the pair proves the
+//!   nonce is signed rather than merely cached.
+//!
+//! # Why `MakeVolume` against a non-existent disk
+//!
+//! Every covered handler checks the digest before touching storage, and
+//! `MakeVolume` resolves its disk *after* that check. Aiming at a disk that
+//! cannot exist gives three cleanly separable outcomes with zero side effects
+//! on the server's real data:
+//!
+//! - `Err(Unauthenticated)` — rejected by `check_auth` (signature layer).
+//! - `Err(PermissionDenied)` — rejected by the handler's body-digest gate.
+//! - `Ok(success: false)` — **authentication passed**; the request reached
+//!   handler logic and only then failed on the bogus disk.
+//!
+//! # Coverage of the issue's acceptance matrix
+//!
+//! | Acceptance item | Test |
+//! |---|---|
+//! | replay a signature onto another method → reject | [`cross_method_signature_transplant_is_rejected`] |
+//! | replay same method + body after nonce consumed → reject | [`nonce_replay_of_a_captured_mutation_is_rejected`] |
+//! | nonce is signed, not just cached → reject a swapped nonce | [`swapping_in_a_fresh_nonce_is_rejected`] |
+//! | tamper one byte of the body → reject | [`tampered_mutation_body_is_rejected`] |
+//! | body digest is inside the signed scope → reject a repaired digest | [`rewriting_the_digest_to_match_a_tampered_body_is_rejected`] |
+//! | wrong destination node identity → reject | [`signature_minted_for_another_node_is_rejected`] |
+//! | mixed version: legacy-only still served, not blocked | [`legacy_only_signature_is_accepted_in_default_posture`] |
+//! | strict flip closes the signature downgrade | [`signature_strict_rejects_legacy_only_downgrade`] |
+//! | strict flip closes the body-digest downgrade, incl. v1 | [`body_digest_strict_rejects_digestless_mutation`] |
+//! | replay scope binds every RPC and rejects restart replay | [`replay_scope_rejects_replay_path_transplant_and_stale_epoch_e2e`] |
+//! | strict replay scope allows only Ping bootstrap before v3 | [`replay_scope_strict_requires_v3_after_ping_bootstrap_e2e`] |
+//!
+//! Two acceptance items are deliberately left to the in-process tests. A stale
+//! timestamp cannot be forged from outside — it is inside the HMAC — so
+//! observing it would mean idling out the full freshness window. And the
+//! `signature_v1_fallback_total` / `body_digest_fallback_total` counter deltas
+//! that gate the strict flips are asserted directly in `http_auth.rs`; the
+//! legacy test below proves only the *accepted* half of that behaviour.
+
+use crate::common::{RustFSTestEnvironment, init_logging};
+use crate::storage_api::internode_rpc_signature::{
+    TONIC_RPC_PREFIX, gen_signature_headers, gen_tonic_replay_scope_headers, gen_tonic_signature_headers,
+    node_service_time_out_client_no_auth, verify_tonic_boot_epoch_response,
+};
+use http::{HeaderMap, Method};
+use rustfs_config::{
+    ENV_INTERNODE_RPC_BODY_DIGEST_STRICT, ENV_INTERNODE_RPC_REPLAY_CACHE_CAPACITY, ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT,
+    ENV_INTERNODE_RPC_SIGNATURE_STRICT,
+};
+use rustfs_protos::canonical_make_volume_request_body;
+use rustfs_protos::proto_gen::node_service::{MakeVolumeRequest, MakeVolumeResponse, PingRequest, PingResponse};
+use serial_test::serial;
+use sha2::{Digest, Sha256};
+use std::error::Error;
+use tonic::{Code, Request, Response, Status};
+use uuid::Uuid;
+
+type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+
+/// Shared internode secret handed to both the child server and this process.
+///
+/// Must not be the default credential: `resolve_rpc_secret` fails closed on
+/// defaults (GHSA-r5qv), so a default here would break every request rather
+/// than test anything.
+const TEST_RPC_SECRET: &str = "rustfs-internode-signature-e2e-secret";
+
+/// A disk path the server cannot possibly have configured, so a request that
+/// clears authentication stops harmlessly at `find_disk`.
+const ABSENT_DISK: &str = "/nonexistent/rustfs-signature-e2e-disk";
+
+/// Wire names of the v2 and replay-scope headers these black-box tests edit. They are
+/// `pub(crate)` in ecstore, so they are repeated here rather than imported.
+/// [`overwrite_header`] asserts the header it replaces was actually present, which turns a
+/// rename into a loud failure instead of silently reducing an attack to a no-op.
+const CONTENT_SHA256_HEADER: &str = "x-rustfs-content-sha256";
+const NONCE_HEADER: &str = "x-rustfs-rpc-nonce";
+const TIMESTAMP_HEADER: &str = "x-rustfs-timestamp";
+const BOOT_EPOCH_CHALLENGE_HEADER: &str = "x-rustfs-rpc-boot-epoch-challenge";
+
+/// gRPC service name carried in the signed scope, i.e. `TONIC_RPC_PREFIX`
+/// without its leading `/`.
+fn node_service_name() -> &'static str {
+    TONIC_RPC_PREFIX.trim_start_matches('/')
+}
+
+/// Make the RPC secret of this test process match the child server's.
+///
+/// The secret lands in a process-wide `OnceLock`, so the first writer wins for
+/// the whole test binary. Every test here uses the same constant, and the
+/// assertion turns a cross-test collision into an explicit failure instead of a
+/// confusing wall of signature rejections.
+fn align_rpc_secret_with_server() {
+    let _ = rustfs_credentials::set_global_rpc_secret(TEST_RPC_SECRET.to_string());
+    let effective = rustfs_credentials::try_get_rpc_token().expect("RPC secret must resolve in the test process");
+    assert_eq!(
+        effective, TEST_RPC_SECRET,
+        "another test in this binary already fixed a different process-wide RPC secret; \
+         the signature tests cannot mint requests the child server will accept"
+    );
+}
+
+/// Start a `rustfs` child process sharing [`TEST_RPC_SECRET`], with the rollout
+/// posture pinned explicitly.
+///
+/// The child inherits the ambient environment, so the strict gates and the
+/// replay-cache capacity are set here rather than assumed: a developer or CI
+/// runner exporting `RUSTFS_INTERNODE_RPC_*` would otherwise silently flip the
+/// posture and fail these tests for a non-security reason. `extra_env` is
+/// applied last so the strict tests can still override.
+///
+/// Uses the no-cleanup spawn so a `pkill` pattern cannot reap servers belonging
+/// to other tests running in the same binary.
+fn server_env(extra_env: &[(&'static str, &'static str)]) -> Vec<(&'static str, &'static str)> {
+    let mut child_env = vec![
+        ("RUSTFS_RPC_SECRET", TEST_RPC_SECRET),
+        (ENV_INTERNODE_RPC_SIGNATURE_STRICT, "false"),
+        (ENV_INTERNODE_RPC_BODY_DIGEST_STRICT, "false"),
+        (ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT, "false"),
+        (ENV_INTERNODE_RPC_REPLAY_CACHE_CAPACITY, "1048576"),
+    ];
+    child_env.extend_from_slice(extra_env);
+    child_env
+}
+
+async fn start_server_with_env(child_env: &[(&str, &str)]) -> Result<RustFSTestEnvironment, Box<dyn Error + Send + Sync>> {
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server_without_cleanup_with_env(child_env).await?;
+    Ok(env)
+}
+
+async fn start_server(extra_env: &[(&'static str, &'static str)]) -> Result<RustFSTestEnvironment, Box<dyn Error + Send + Sync>> {
+    start_server_with_env(&server_env(extra_env)).await
+}
+
+/// Stop the child and drop the cached gRPC channel for its address.
+///
+/// `node_service_time_out_client_no_auth` memoises channels in a process-global
+/// map keyed by URL, and ports handed out by `find_available_port` can recur
+/// within one test binary. Evicting here keeps a later test from inheriting a
+/// channel aimed at this test's dead server.
+async fn stop_server(mut env: RustFSTestEnvironment, url: &str) {
+    env.stop_server();
+    rustfs_protos::evict_failed_connection(url).await;
+}
+
+/// The audience the server binds into the v2 signature: its own node authority.
+///
+/// A single-node server started with `--address 127.0.0.1:PORT` over filesystem
+/// endpoints has no URL peer set, so `init_local_peer` falls back to
+/// `host:port` — exactly the address we dialed. The positive controls below
+/// fail loudly if that ever stops holding.
+fn audience_of(env: &RustFSTestEnvironment) -> String {
+    env.address.clone()
+}
+
+fn hex_sha256(bytes: &[u8]) -> String {
+    Sha256::digest(bytes).iter().fold(String::new(), |mut acc, byte| {
+        use std::fmt::Write as _;
+        let _ = write!(acc, "{byte:02x}");
+        acc
+    })
+}
+
+fn make_volume_request(volume: &str) -> MakeVolumeRequest {
+    MakeVolumeRequest {
+        disk: ABSENT_DISK.to_string(),
+        volume: volume.to_string(),
+    }
+}
+
+fn canonical_digest(request: &MakeVolumeRequest) -> String {
+    hex_sha256(&canonical_make_volume_request_body(request).expect("canonical body must encode"))
+}
+
+/// Mint a full v2 header set for `(audience, rpc_method, content_sha256)`.
+///
+/// This is the only place a signature is produced. Tests treat the returned map
+/// as an opaque captured artifact.
+fn mint_v2_headers(audience: &str, rpc_method: &str, content_sha256: Option<&str>) -> HeaderMap {
+    gen_tonic_signature_headers(audience, node_service_name(), rpc_method, content_sha256)
+        .expect("minting a v2 signature must succeed once the RPC secret is aligned")
+}
+
+/// Mint the pre-v2 header set: a signature over the fixed
+/// `TONIC_RPC_PREFIX|GET|timestamp` constant, with no v2 headers at all. This is
+/// both what an un-upgraded peer sends and what an attacker sends to force a
+/// downgrade.
+fn mint_legacy_only_headers() -> HeaderMap {
+    gen_signature_headers(TONIC_RPC_PREFIX, &Method::GET).expect("minting a legacy signature must succeed")
+}
+
+/// Replace one header of a captured set, asserting it was there to begin with.
+fn overwrite_header(headers: &mut HeaderMap, name: &'static str, value: &str) {
+    assert!(
+        headers.contains_key(name),
+        "minted headers must carry {name}; the wire contract changed and this attack would edit nothing"
+    );
+    headers.insert(name, value.parse().expect("header value must be valid"));
+}
+
+/// Send `request` to the server's NodeService with exactly `headers` attached
+/// and nothing else — no interceptor adds or rewrites auth metadata, so the
+/// bytes on the wire are the ones the test chose.
+async fn call_make_volume(url: &str, request: MakeVolumeRequest, headers: HeaderMap) -> Result<MakeVolumeResponse, Status> {
+    call_make_volume_response(url, request, headers)
+        .await
+        .map(Response::into_inner)
+}
+
+async fn call_make_volume_response(
+    url: &str,
+    request: MakeVolumeRequest,
+    headers: HeaderMap,
+) -> Result<Response<MakeVolumeResponse>, Status> {
+    let mut client = node_service_time_out_client_no_auth(&url.to_string())
+        .await
+        .map_err(|err| Status::unavailable(format!("cannot reach the node service: {err}")))?;
+    let mut rpc_request = Request::new(request);
+    rpc_request.metadata_mut().as_mut().extend(headers);
+    client.make_volume(rpc_request).await
+}
+
+async fn call_ping_response(url: &str, headers: HeaderMap) -> Result<Response<PingResponse>, Status> {
+    let mut client = node_service_time_out_client_no_auth(&url.to_string())
+        .await
+        .map_err(|err| Status::unavailable(format!("cannot reach the node service: {err}")))?;
+    let mut rpc_request = Request::new(PingRequest {
+        version: 1,
+        body: bytes::Bytes::new(),
+    });
+    rpc_request.metadata_mut().as_mut().extend(headers);
+    client.ping(rpc_request).await
+}
+
+fn attach_boot_epoch_challenge(headers: &mut HeaderMap) -> Uuid {
+    let challenge = Uuid::new_v4();
+    headers.insert(
+        BOOT_EPOCH_CHALLENGE_HEADER,
+        challenge.to_string().parse().expect("UUID must be a valid header value"),
+    );
+    challenge
+}
+
+fn mint_replay_scope_headers(audience: &str, path: &str, content_sha256: &str, boot_epoch: Uuid) -> HeaderMap {
+    let mut headers = mint_v2_headers(audience, "MakeVolume", Some(content_sha256));
+    let timestamp = headers
+        .get(TIMESTAMP_HEADER)
+        .and_then(|value| value.to_str().ok())
+        .expect("v2 headers must carry a timestamp")
+        .to_string();
+    headers.extend(
+        gen_tonic_replay_scope_headers(audience, path, &timestamp, content_sha256, boot_epoch)
+            .expect("replay-scope headers must mint with the aligned RPC secret"),
+    );
+    headers
+}
+
+async fn learn_boot_epoch_from_make_volume(url: &str, audience: &str) -> Uuid {
+    let request = make_volume_request("signature-e2e-epoch-bootstrap");
+    let mut headers = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&request)));
+    let challenge = attach_boot_epoch_challenge(&mut headers);
+    let response = call_make_volume_response(url, request, headers)
+        .await
+        .expect("v2 request with epoch challenge must clear default authentication");
+    let boot_epoch = verify_tonic_boot_epoch_response(audience, challenge, response.metadata().as_ref())
+        .expect("server must HMAC-authenticate the advertised boot epoch");
+    assert_authenticated(
+        Ok(response.into_inner()),
+        "a v2 epoch-challenge request in the default replay-scope posture",
+    );
+    boot_epoch
+}
+
+async fn learn_boot_epoch_from_ping(url: &str, audience: &str) -> Uuid {
+    let mut headers = mint_v2_headers(audience, "Ping", None);
+    let challenge = attach_boot_epoch_challenge(&mut headers);
+    let response = call_ping_response(url, headers)
+        .await
+        .expect("v2 Ping with an epoch challenge must bootstrap strict replay scope");
+    verify_tonic_boot_epoch_response(audience, challenge, response.metadata().as_ref())
+        .expect("strict replay-scope Ping must return a valid boot epoch proof")
+}
+
+/// Assert a call cleared authentication.
+///
+/// Receiving *any* `Ok` response is the load-bearing signal: both auth layers
+/// reject with a `Status`, so an `Ok` means the request reached handler logic.
+/// The failed disk lookup underneath is what keeps it side-effect free.
+fn assert_authenticated(result: Result<MakeVolumeResponse, Status>, context: &str) {
+    match result {
+        Ok(response) => {
+            assert!(
+                !response.success,
+                "{context}: the absent disk {ABSENT_DISK} must not yield a successful volume creation"
+            );
+            assert!(
+                response.error.is_some(),
+                "{context}: expected the request to reach disk lookup and fail there, got no error"
+            );
+        }
+        Err(status) => panic!(
+            "{context}: the request must clear authentication, but was rejected with {:?}: {}",
+            status.code(),
+            status.message()
+        ),
+    }
+}
+
+/// Assert a call was rejected, optionally pinning which check spoke.
+///
+/// `PermissionDenied` responses carry the reason on the wire, so the digest
+/// tests pin it and cannot be satisfied by an unrelated digest-gate failure.
+/// `Unauthenticated` is deliberately generic on the wire; those tests pin their
+/// cause structurally instead, by differing from a passing request in exactly
+/// one respect.
+fn assert_rejected(result: Result<MakeVolumeResponse, Status>, expected: Code, expected_message: Option<&str>, context: &str) {
+    match result {
+        Ok(response) => panic!(
+            "{context}: the request must be rejected, but the server accepted it and ran the handler \
+             (success={}, error={:?})",
+            response.success, response.error
+        ),
+        Err(status) => {
+            assert_eq!(
+                status.code(),
+                expected,
+                "{context}: expected {expected:?}, got {:?}: {}",
+                status.code(),
+                status.message()
+            );
+            if let Some(needle) = expected_message {
+                assert!(
+                    status.message().contains(needle),
+                    "{context}: expected the rejection to cite {needle:?}, got {:?}",
+                    status.message()
+                );
+            }
+        }
+    }
+}
+
+/// Default posture (both strict gates off): the protections that hold without
+/// any operator flip.
+///
+/// Grouped into one server start because each case is independent and spawning
+/// a `rustfs` process per assertion would dominate the runtime.
+#[tokio::test]
+#[serial]
+async fn internode_rpc_signature_default_posture_e2e() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let env = start_server(&[]).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+
+    signed_mutations_are_accepted(&url, &audience).await;
+    unsigned_request_is_rejected(&url).await;
+    cross_method_signature_transplant_is_rejected(&url, &audience).await;
+    nonce_replay_of_a_captured_mutation_is_rejected(&url, &audience).await;
+    swapping_in_a_fresh_nonce_is_rejected(&url, &audience).await;
+    tampered_mutation_body_is_rejected(&url, &audience).await;
+    rewriting_the_digest_to_match_a_tampered_body_is_rejected(&url, &audience).await;
+    signature_minted_for_another_node_is_rejected(&url).await;
+    legacy_only_signature_is_accepted_in_default_posture(&url).await;
+
+    stop_server(env, &url).await;
+    Ok(())
+}
+
+/// A replay-scoped signature is usable exactly once against the exact gRPC path and the server
+/// process epoch that minted it. This crosses the child-process boundary twice: the HMAC-protected
+/// epoch is learned from a real response, then the same server is restarted in place to prove its
+/// replacement epoch rejects the captured request even though the nonce cache is necessarily new.
+#[tokio::test]
+#[serial]
+async fn replay_scope_rejects_replay_path_transplant_and_stale_epoch_e2e() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let child_env = server_env(&[]);
+    let mut env = start_server_with_env(&child_env).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+    let boot_epoch = learn_boot_epoch_from_make_volume(&url, &audience).await;
+
+    let request = make_volume_request("replay-scope-e2e-once");
+    let captured = mint_replay_scope_headers(
+        &audience,
+        &format!("{TONIC_RPC_PREFIX}/MakeVolume"),
+        &canonical_digest(&request),
+        boot_epoch,
+    );
+    assert_authenticated(
+        call_make_volume(&url, request.clone(), captured.clone()).await,
+        "the first replay-scoped mutation delivery",
+    );
+    assert_rejected(
+        call_make_volume(&url, request.clone(), captured).await,
+        Code::Unauthenticated,
+        None,
+        "the same replay-scoped mutation delivered twice",
+    );
+
+    let transplanted =
+        mint_replay_scope_headers(&audience, &format!("{TONIC_RPC_PREFIX}/Ping"), &canonical_digest(&request), boot_epoch);
+    assert_rejected(
+        call_make_volume(&url, request.clone(), transplanted).await,
+        Code::Unauthenticated,
+        None,
+        "a replay-scoped Ping signature transplanted onto MakeVolume",
+    );
+
+    let stale_epoch = mint_replay_scope_headers(
+        &audience,
+        &format!("{TONIC_RPC_PREFIX}/MakeVolume"),
+        &canonical_digest(&request),
+        boot_epoch,
+    );
+    env.restart_server_preserving_data(Vec::new(), &child_env).await?;
+    rustfs_protos::evict_failed_connection(&url).await;
+    assert_rejected(
+        call_make_volume(&url, request.clone(), stale_epoch).await,
+        Code::Unauthenticated,
+        None,
+        "a replay-scoped signature captured before the receiving process restart",
+    );
+
+    let restarted_epoch = learn_boot_epoch_from_make_volume(&url, &audience).await;
+    assert_ne!(boot_epoch, restarted_epoch, "a restarted child process must advertise a new boot epoch");
+    let fresh_epoch = mint_replay_scope_headers(
+        &audience,
+        &format!("{TONIC_RPC_PREFIX}/MakeVolume"),
+        &canonical_digest(&request),
+        restarted_epoch,
+    );
+    assert_authenticated(
+        call_make_volume(&url, request, fresh_epoch).await,
+        "a replay-scoped mutation signed with the replacement process epoch",
+    );
+
+    stop_server(env, &url).await;
+    Ok(())
+}
+
+/// Strict replay scope leaves one authenticated v2 bootstrap: `Ping` carrying a fresh challenge.
+/// A mutating v2 request cannot use that lane; once the epoch proof is returned, the first v3
+/// mutation succeeds. This protects a server restart without reopening a general downgrade path.
+#[tokio::test]
+#[serial]
+async fn replay_scope_strict_requires_v3_after_ping_bootstrap_e2e() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let env = start_server(&[(ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT, "true")]).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+
+    let v2_request = make_volume_request("replay-scope-e2e-strict-v2");
+    assert_rejected(
+        call_make_volume(
+            &url,
+            v2_request.clone(),
+            mint_v2_headers(&audience, "MakeVolume", Some(&canonical_digest(&v2_request))),
+        )
+        .await,
+        Code::Unauthenticated,
+        None,
+        "a v2 mutation after replay-scope strictness is enabled",
+    );
+
+    let boot_epoch = learn_boot_epoch_from_ping(&url, &audience).await;
+    let request = make_volume_request("replay-scope-e2e-strict-v3");
+    let replay_scoped = mint_replay_scope_headers(
+        &audience,
+        &format!("{TONIC_RPC_PREFIX}/MakeVolume"),
+        &canonical_digest(&request),
+        boot_epoch,
+    );
+    assert_authenticated(
+        call_make_volume(&url, request, replay_scoped).await,
+        "a replay-scoped mutation after Ping bootstrap under strict replay scope",
+    );
+
+    stop_server(env, &url).await;
+    Ok(())
+}
+
+/// Baseline: correctly signed mutations are accepted, both with and without a
+/// body digest.
+///
+/// These anchor every rejection below. The body-bound case proves the audience
+/// the server verifies against really is the address we dialed. The digestless
+/// case is the control the transplant test needs: without it, a regression that
+/// rejected every `UNSIGNED-PAYLOAD` request would make the transplant
+/// assertion pass for entirely the wrong reason. It also documents that the
+/// default posture still serves digestless mutations.
+async fn signed_mutations_are_accepted(url: &str, audience: &str) {
+    let bound = make_volume_request("signature-e2e-control-bound");
+    let bound_headers = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&bound)));
+    assert_authenticated(
+        call_make_volume(url, bound, bound_headers).await,
+        "a correctly signed body-bound mutation",
+    );
+
+    let digestless = make_volume_request("signature-e2e-control-digestless");
+    let digestless_headers = mint_v2_headers(audience, "MakeVolume", None);
+    assert_authenticated(
+        call_make_volume(url, digestless, digestless_headers).await,
+        "a correctly signed digestless mutation in the default posture",
+    );
+}
+
+/// A request with no auth metadata at all must never reach a handler.
+async fn unsigned_request_is_rejected(url: &str) {
+    let result = call_make_volume(url, make_volume_request("signature-e2e-unsigned"), HeaderMap::new()).await;
+    assert_rejected(result, Code::Unauthenticated, None, "an entirely unsigned mutation");
+}
+
+/// GHSA-c667 class: a signature captured from one gRPC method must not be
+/// replayable onto another.
+///
+/// Before method-path binding every NodeService call signed the same constant,
+/// so a captured `Ping` — the cheapest, least privileged call on the service —
+/// authenticated a `MakeVolume` just as well. The captured `Ping` signature is
+/// transplanted verbatim; the server recomputes the scope with
+/// `rpc_method = MakeVolume` and the HMAC no longer matches. It differs from the
+/// accepted digestless control above only in the method it was minted for.
+async fn cross_method_signature_transplant_is_rejected(url: &str, audience: &str) {
+    let captured_ping = mint_v2_headers(audience, "Ping", None);
+    let result = call_make_volume(url, make_volume_request("signature-e2e-transplant"), captured_ping).await;
+    assert_rejected(
+        result,
+        Code::Unauthenticated,
+        None,
+        "a Ping signature transplanted onto a MakeVolume mutation",
+    );
+}
+
+/// A body-bound mutation must be consumable exactly once.
+///
+/// The first send establishes that the captured artifact is genuinely valid —
+/// without it, the second rejection could just mean the headers were malformed
+/// all along. The replay reuses the identical `(signature, timestamp, nonce)`
+/// well inside the freshness window, so only the server's replay cache can
+/// stop it.
+async fn nonce_replay_of_a_captured_mutation_is_rejected(url: &str, audience: &str) {
+    let request = make_volume_request("signature-e2e-replay");
+    let captured = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&request)));
+
+    let first = call_make_volume(url, request.clone(), captured.clone()).await;
+    assert_authenticated(first, "the captured mutation on its first delivery");
+
+    let replayed = call_make_volume(url, request, captured).await;
+    assert_rejected(
+        replayed,
+        Code::Unauthenticated,
+        None,
+        "the same captured mutation replayed after its nonce was consumed",
+    );
+}
+
+/// The nonce must be *signed*, not merely remembered.
+///
+/// A replay cache alone would be trivially defeated: swap in a fresh UUID and
+/// the cache has never seen it. This request is byte-identical to one the server
+/// would accept apart from that one header, so it can only be stopped by the
+/// nonce being inside the signed scope.
+async fn swapping_in_a_fresh_nonce_is_rejected(url: &str, audience: &str) {
+    let request = make_volume_request("signature-e2e-nonce-swap");
+    let mut captured = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&request)));
+    overwrite_header(&mut captured, NONCE_HEADER, &Uuid::new_v4().to_string());
+
+    let result = call_make_volume(url, request, captured).await;
+    assert_rejected(
+        result,
+        Code::Unauthenticated,
+        None,
+        "a captured mutation resent under a freshly minted nonce",
+    );
+}
+
+/// Editing the body of a captured request must invalidate it, in the default
+/// posture, with no operator flip required.
+///
+/// The headers are left byte-identical — including the signed digest of the
+/// original body — so `check_auth` still passes. Only the handler, recomputing
+/// the canonical body from the fields it actually received, can catch this. It
+/// is the test that fails if a handler ever loses its digest gate.
+async fn tampered_mutation_body_is_rejected(url: &str, audience: &str) {
+    let signed = make_volume_request("signature-e2e-tamper-a");
+    let captured = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&signed)));
+
+    // Exactly one byte of the volume name differs from what the digest covers.
+    let tampered = make_volume_request("signature-e2e-tamper-b");
+    let result = call_make_volume(url, tampered, captured).await;
+    assert_rejected(
+        result,
+        Code::PermissionDenied,
+        Some("RPC content SHA-256 mismatch"),
+        "a mutation whose body was edited after signing",
+    );
+}
+
+/// The body digest must be *inside the signed scope*, not merely cross-checked
+/// by the handler.
+///
+/// This is the same tampered body as above, except the attacker also repairs the
+/// digest header so it matches what it sends — defeating the handler's
+/// comparison. The only thing left standing is the signature, which covers the
+/// digest header itself. Drop `content_sha256` from `update_signature_v2` and
+/// this is the test that goes green when it should not.
+async fn rewriting_the_digest_to_match_a_tampered_body_is_rejected(url: &str, audience: &str) {
+    let signed = make_volume_request("signature-e2e-scope-a");
+    let mut captured = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&signed)));
+
+    let tampered = make_volume_request("signature-e2e-scope-b");
+    overwrite_header(&mut captured, CONTENT_SHA256_HEADER, &canonical_digest(&tampered));
+
+    let result = call_make_volume(url, tampered, captured).await;
+    assert_rejected(
+        result,
+        Code::Unauthenticated,
+        None,
+        "a tampered mutation whose digest header was repaired to match",
+    );
+}
+
+/// A signature is bound to its destination node, so a request captured against
+/// one node cannot be aimed at another.
+///
+/// `127.0.0.1:1` stands in for a different peer; the audience is inside the
+/// HMAC, so the server's own authority no longer reproduces it.
+async fn signature_minted_for_another_node_is_rejected(url: &str) {
+    let request = make_volume_request("signature-e2e-wrong-node");
+    let headers = mint_v2_headers("127.0.0.1:1", "MakeVolume", Some(&canonical_digest(&request)));
+    let result = call_make_volume(url, request, headers).await;
+    assert_rejected(result, Code::Unauthenticated, None, "a signature minted for a different node");
+}
+
+/// Rolling-upgrade compatibility: a peer that predates v2 must still be served
+/// while the strict gates are off.
+///
+/// This is the case the issue insists must not fail closed during an upgrade.
+/// It is also, honestly, the open downgrade window: an attacker can strip the
+/// v2 headers and land here too. That window is what
+/// [`signature_strict_rejects_legacy_only_downgrade`] closes.
+async fn legacy_only_signature_is_accepted_in_default_posture(url: &str) {
+    let result = call_make_volume(url, make_volume_request("signature-e2e-legacy"), mint_legacy_only_headers()).await;
+    assert_authenticated(result, "a legacy-only signature in the default posture");
+}
+
+/// With `RUSTFS_INTERNODE_RPC_SIGNATURE_STRICT` on, the legacy downgrade lane is
+/// closed: the exact request accepted in the default posture is now refused.
+///
+/// The paired v2 positive control rules out "strict simply breaks everything".
+#[tokio::test]
+#[serial]
+async fn signature_strict_rejects_legacy_only_downgrade() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let env = start_server(&[(ENV_INTERNODE_RPC_SIGNATURE_STRICT, "true")]).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+
+    let downgraded = call_make_volume(&url, make_volume_request("signature-e2e-strict-legacy"), mint_legacy_only_headers()).await;
+    assert_rejected(
+        downgraded,
+        Code::Unauthenticated,
+        None,
+        "a legacy-only signature once signature-strict is enabled",
+    );
+
+    let request = make_volume_request("signature-e2e-strict-v2");
+    let signed = mint_v2_headers(&audience, "MakeVolume", Some(&canonical_digest(&request)));
+    assert_authenticated(
+        call_make_volume(&url, request, signed).await,
+        "a v2-signed mutation under signature-strict",
+    );
+
+    stop_server(env, &url).await;
+    Ok(())
+}
+
+/// With `RUSTFS_INTERNODE_RPC_BODY_DIGEST_STRICT` on, any mutation that arrives
+/// without a body digest is refused — including one that downgraded all the way
+/// to the legacy signature.
+///
+/// This gate converges independently of the signature gate, so it is exercised
+/// on its own server with signature-strict left off. Both rejected requests
+/// clear `check_auth` on their own terms (one is properly v2-signed, the other
+/// takes the still-open legacy lane), which is what pins the rejection to the
+/// handler's digest gate; the cited message confirms which check spoke.
+#[tokio::test]
+#[serial]
+async fn body_digest_strict_rejects_digestless_mutation() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let env = start_server(&[(ENV_INTERNODE_RPC_BODY_DIGEST_STRICT, "true")]).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+
+    let digestless = mint_v2_headers(&audience, "MakeVolume", None);
+    assert_rejected(
+        call_make_volume(&url, make_volume_request("signature-e2e-digestless"), digestless).await,
+        Code::PermissionDenied,
+        Some("RPC mutation requires a body-bound v2 signature"),
+        "a v2-signed but digestless mutation once body-digest-strict is enabled",
+    );
+
+    assert_rejected(
+        call_make_volume(&url, make_volume_request("signature-e2e-digestless-legacy"), mint_legacy_only_headers()).await,
+        Code::PermissionDenied,
+        Some("RPC mutation requires a body-bound v2 signature"),
+        "a v1-downgraded mutation once body-digest-strict is enabled",
+    );
+
+    let request = make_volume_request("signature-e2e-digest-bound");
+    let bound = mint_v2_headers(&audience, "MakeVolume", Some(&canonical_digest(&request)));
+    assert_authenticated(
+        call_make_volume(&url, request, bound).await,
+        "a body-bound mutation under body-digest-strict",
+    );
+
+    stop_server(env, &url).await;
+    Ok(())
+}
@@ -29,6 +29,11 @@ use aws_sdk_s3::Client;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::ServerSideEncryption;
 use base64::{Engine, engine::general_purpose::STANDARD as BASE64};
+use http::header::{CONTENT_TYPE, HOST};
+use md5::{Digest as Md5Digest, Md5};
+use rustfs_signer::constants::UNSIGNED_PAYLOAD;
+use rustfs_signer::sign_v4;
+use s3s::Body;
 use serde_json;
 use std::process::{Child, Command};
 use std::time::Duration;
@@ -64,7 +69,52 @@ pub fn skip_if_kms_admin_tool_unavailable(test_name: &str) -> bool {
 }

 pub fn sse_customer_key_md5_base64(key: &str) -> String {
-    BASE64.encode(md5::compute(key).0)
+    let mut hasher = Md5::new();
+    hasher.update(key.as_bytes());
+    BASE64.encode(hasher.finalize())
+}
+
+pub async fn kms_admin_request(
+    base_url: &str,
+    method: http::Method,
+    path_and_query: &str,
+    body: Option<&str>,
+    access_key: &str,
+    secret_key: &str,
+) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+    let url = format!("{base_url}{path_and_query}");
+    let uri = url.parse::<http::Uri>()?;
+    let authority = uri.authority().ok_or("KMS admin URL missing authority")?.to_string();
+    let mut builder = http::Request::builder()
+        .method(method.clone())
+        .uri(uri)
+        .header(HOST, authority)
+        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
+    if body.is_some() {
+        builder = builder.header(CONTENT_TYPE, "application/json");
+    }
+
+    let content_len = match body {
+        Some(value) => i64::try_from(value.len())?,
+        None => 0,
+    };
+    let signed = sign_v4(builder.body(Body::empty())?, content_len, access_key, secret_key, "", "us-east-1");
+
+    let mut request = local_http_client().request(method.clone(), &url);
+    for (name, value) in signed.headers() {
+        request = request.header(name, value);
+    }
+    if let Some(value) = body {
+        request = request.body(value.to_owned());
+    }
+
+    let response = request.send().await?;
+    let status = response.status();
+    let response_body = response.text().await?;
+    if !status.is_success() {
+        return Err(format!("{method} {path_and_query} failed with {status}: {response_body}").into());
+    }
+    Ok(response_body)
 }

 // KMS-specific helper functions
@@ -75,8 +125,19 @@ pub async fn configure_kms(
    access_key: &str,
    secret_key: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let url = format!("{base_url}/rustfs/admin/v3/kms/configure");
-    awscurl_post(&url, config_json, access_key, secret_key).await?;
+    let response = kms_admin_request(
+        base_url,
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/configure",
+        Some(config_json),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let response: serde_json::Value = serde_json::from_str(&response)?;
+    if response["success"] != true {
+        return Err(format!("KMS configuration failed: {}", response["message"].as_str().unwrap_or("unknown error")).into());
+    }
    info!("KMS configured successfully");
    Ok(())
 }
@@ -87,8 +148,19 @@ pub async fn start_kms(
    access_key: &str,
    secret_key: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let url = format!("{base_url}/rustfs/admin/v3/kms/start");
-    awscurl_post(&url, "{}", access_key, secret_key).await?;
+    let response = kms_admin_request(
+        base_url,
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/start",
+        Some("{}"),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let response: serde_json::Value = serde_json::from_str(&response)?;
+    if response["success"] != true {
+        return Err(format!("KMS start failed: {}", response["message"].as_str().unwrap_or("unknown error")).into());
+    }
    info!("KMS started successfully");
    Ok(())
 }
@@ -99,8 +171,8 @@ pub async fn get_kms_status(
    access_key: &str,
    secret_key: &str,
 ) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
-    let url = format!("{base_url}/rustfs/admin/v3/kms/status");
-    let status = awscurl_get(&url, access_key, secret_key).await?;
+    let status =
+        kms_admin_request(base_url, http::Method::GET, "/rustfs/admin/v3/kms/status", None, access_key, secret_key).await?;
    info!("KMS status retrieved: {}", status);
    Ok(status)
 }
@@ -508,7 +580,8 @@ impl VaultTestEnvironment {
            },
            "mount_path": VAULT_TRANSIT_PATH,
            "default_key_id": VAULT_KEY_NAME,
-            "skip_tls_verify": true
+            "skip_tls_verify": true,
+            "allow_insecure_dev_defaults": true
        })
        .to_string();

@@ -657,14 +730,19 @@ pub async fn test_multipart_upload_with_config(
        .build();

    info!("🔗 Completing multipart upload");
-    let complete_output = s3_client
+    let mut complete_request = s3_client
        .complete_multipart_upload()
        .bucket(bucket)
        .key(&config.object_key)
        .upload_id(upload_id)
-        .multipart_upload(completed_multipart_upload)
-        .send()
-        .await?;
+        .multipart_upload(completed_multipart_upload);
+    if let EncryptionType::SSEC { .. } = &config.encryption_type {
+        complete_request = complete_request
+            .sse_customer_algorithm("AES256")
+            .sse_customer_key(sse_c_key_b64.as_ref().unwrap())
+            .sse_customer_key_md5(sse_c_key_md5.as_ref().unwrap());
+    }
+    let complete_output = complete_request.send().await?;

    debug!("Multipart upload finalized with ETag {:?}", complete_output.e_tag());

@@ -796,7 +874,8 @@ impl LocalKMSTestEnvironment {
            "backend_type": "Local",
            "key_dir": self.kms_keys_dir,
            "file_permissions": 0o600,
-            "default_key_id": default_key_id
+            "default_key_id": default_key_id,
+            "allow_insecure_dev_defaults": true
        })
        .to_string();

@@ -0,0 +1,415 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Configured-backend validation for the KMS admin and SSE-KMS round-trip
+//! contract tracked by rustfs/backlog#1378.
+
+use super::common::{
+    LocalKMSTestEnvironment, VAULT_KEY_NAME, VaultTestEnvironment, configure_kms, get_kms_status, kms_admin_request, start_kms,
+};
+use aws_sdk_s3::primitives::ByteStream;
+use aws_sdk_s3::types::{BucketVersioningStatus, ServerSideEncryption, VersioningConfiguration};
+use serial_test::serial;
+use std::error::Error;
+use uuid::Uuid;
+
+type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+
+async fn assert_configured_status(
+    base_url: &str,
+    access_key: &str,
+    secret_key: &str,
+    expected_backend: &str,
+    expected_default_key: &str,
+) -> TestResult {
+    let body = get_kms_status(base_url, access_key, secret_key).await?;
+    let status: serde_json::Value = serde_json::from_str(&body)?;
+    assert_eq!(status["backend_type"], expected_backend);
+    assert_eq!(status["backend_status"], "healthy");
+    assert_eq!(status["default_key_id"], expected_default_key);
+    Ok(())
+}
+
+async fn create_and_verify_key(
+    base_url: &str,
+    access_key: &str,
+    secret_key: &str,
+) -> Result<String, Box<dyn Error + Send + Sync>> {
+    let create_body = serde_json::json!({
+        "key_usage": "EncryptDecrypt",
+        "description": "configured KMS round-trip e2e key",
+        "tags": {
+            "test": "backlog-1378"
+        }
+    })
+    .to_string();
+    let created = kms_admin_request(
+        base_url,
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys",
+        Some(&create_body),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let created: serde_json::Value = serde_json::from_str(&created)?;
+    assert_eq!(created["success"], true);
+    let key_id = created["key_id"]
+        .as_str()
+        .ok_or("create KMS key response omitted key_id")?
+        .to_string();
+
+    let described = kms_admin_request(
+        base_url,
+        http::Method::GET,
+        &format!("/rustfs/admin/v3/kms/keys/{key_id}"),
+        None,
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let described: serde_json::Value = serde_json::from_str(&described)?;
+    assert_eq!(described["success"], true);
+    assert_eq!(described["key_metadata"]["key_id"], key_id);
+    assert_eq!(described["key_metadata"]["key_state"], "Enabled");
+
+    let listed =
+        kms_admin_request(base_url, http::Method::GET, "/rustfs/admin/v3/kms/keys", None, access_key, secret_key).await?;
+    let listed: serde_json::Value = serde_json::from_str(&listed)?;
+    let keys = listed["keys"].as_array().ok_or("list KMS keys response omitted keys")?;
+    assert!(keys.iter().any(|key| key["key_id"] == key_id), "created KMS key must appear in list");
+    Ok(key_id)
+}
+
+async fn assert_key_deletion_lifecycle(base_url: &str, access_key: &str, secret_key: &str, key_id: &str) -> TestResult {
+    let scheduled = kms_admin_request(
+        base_url,
+        http::Method::DELETE,
+        "/rustfs/admin/v3/kms/keys/delete",
+        Some(
+            &serde_json::json!({
+                "key_id": key_id,
+                "pending_window_in_days": 7,
+                "force_immediate": false
+            })
+            .to_string(),
+        ),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let scheduled: serde_json::Value = serde_json::from_str(&scheduled)?;
+    assert_eq!(scheduled["success"], true);
+    assert!(scheduled["deletion_date"].is_string());
+
+    let cancelled = kms_admin_request(
+        base_url,
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys/cancel-deletion",
+        Some(&serde_json::json!({ "key_id": key_id }).to_string()),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let cancelled: serde_json::Value = serde_json::from_str(&cancelled)?;
+    assert_eq!(cancelled["success"], true);
+    assert_eq!(cancelled["key_metadata"]["key_state"], "Enabled");
+
+    // A default server refuses to skip the waiting window (rustfs/backlog#1585):
+    // immediate deletion is unrecoverable and takes every object encrypted under
+    // the key with it, so the endpoint must reject it rather than honour it.
+    let refused = kms_admin_request(
+        base_url,
+        http::Method::DELETE,
+        "/rustfs/admin/v3/kms/keys/delete",
+        Some(
+            &serde_json::json!({
+                "key_id": key_id,
+                "force_immediate": true
+            })
+            .to_string(),
+        ),
+        access_key,
+        secret_key,
+    )
+    .await
+    .err()
+    .ok_or("immediate KMS key deletion must be refused on a default server")?;
+    assert!(
+        refused.to_string().contains("400 Bad Request"),
+        "refused immediate deletion must report a client error: {refused}"
+    );
+
+    // The refused request left the key alone, so the window-bounded path still
+    // has something to schedule.
+    let described = kms_admin_request(
+        base_url,
+        http::Method::GET,
+        &format!("/rustfs/admin/v3/kms/keys/{key_id}"),
+        None,
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let described: serde_json::Value = serde_json::from_str(&described)?;
+    assert_eq!(
+        described["key_metadata"]["key_state"], "Enabled",
+        "a refused immediate deletion must leave the key usable"
+    );
+
+    let rescheduled = kms_admin_request(
+        base_url,
+        http::Method::DELETE,
+        "/rustfs/admin/v3/kms/keys/delete",
+        Some(
+            &serde_json::json!({
+                "key_id": key_id,
+                "pending_window_in_days": 7
+            })
+            .to_string(),
+        ),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let rescheduled: serde_json::Value = serde_json::from_str(&rescheduled)?;
+    assert_eq!(rescheduled["success"], true);
+    assert!(rescheduled["deletion_date"].is_string());
+
+    let listed =
+        kms_admin_request(base_url, http::Method::GET, "/rustfs/admin/v3/kms/keys", None, access_key, secret_key).await?;
+    let listed: serde_json::Value = serde_json::from_str(&listed)?;
+    assert_eq!(listed["success"], true);
+    let keys = listed["keys"]
+        .as_array()
+        .ok_or("final list KMS keys response omitted keys after deletion")?;
+    let key = keys
+        .iter()
+        .find(|key| key["key_id"] == key_id)
+        .ok_or("a key awaiting its deletion window must still be listed")?;
+    assert_eq!(key["status"], "PendingDeletion", "a scheduled key must be pending deletion");
+    Ok(())
+}
+
+async fn assert_versioned_sse_kms_roundtrip_and_cleanup(
+    env: &crate::common::RustFSTestEnvironment,
+    key_id: &str,
+    bucket_prefix: &str,
+) -> TestResult {
+    let client = env.create_s3_client();
+    let bucket = format!("{bucket_prefix}-{}", Uuid::new_v4().simple());
+    let object = format!("configured-kms-probe/{}/object", Uuid::new_v4().simple());
+    let first_body = b"configured KMS version one";
+    let second_body = b"configured KMS version two";
+
+    client.create_bucket().bucket(&bucket).send().await?;
+    client
+        .put_bucket_versioning()
+        .bucket(&bucket)
+        .versioning_configuration(
+            VersioningConfiguration::builder()
+                .status(BucketVersioningStatus::Enabled)
+                .build(),
+        )
+        .send()
+        .await?;
+
+    let first = client
+        .put_object()
+        .bucket(&bucket)
+        .key(&object)
+        .server_side_encryption(ServerSideEncryption::AwsKms)
+        .ssekms_key_id(key_id)
+        .body(ByteStream::from_static(first_body))
+        .send()
+        .await?;
+    assert_eq!(first.server_side_encryption(), Some(&ServerSideEncryption::AwsKms));
+    assert_eq!(first.ssekms_key_id(), Some(key_id));
+    let first_version = first.version_id().ok_or("first SSE-KMS PUT omitted version_id")?.to_string();
+
+    let second = client
+        .put_object()
+        .bucket(&bucket)
+        .key(&object)
+        .server_side_encryption(ServerSideEncryption::AwsKms)
+        .ssekms_key_id(key_id)
+        .body(ByteStream::from_static(second_body))
+        .send()
+        .await?;
+    assert_eq!(second.server_side_encryption(), Some(&ServerSideEncryption::AwsKms));
+    assert_eq!(second.ssekms_key_id(), Some(key_id));
+    let second_version = second
+        .version_id()
+        .ok_or("second SSE-KMS PUT omitted version_id")?
+        .to_string();
+    assert_ne!(first_version, second_version);
+    let storage_root = std::path::Path::new(&env.temp_dir);
+    super::encryption_metadata_test::assert_storage_encrypted(storage_root, &bucket, &object, first_body);
+    super::encryption_metadata_test::assert_storage_encrypted(storage_root, &bucket, &object, second_body);
+
+    for (version_id, expected) in [
+        (&first_version, first_body.as_slice()),
+        (&second_version, second_body.as_slice()),
+    ] {
+        let response = client
+            .get_object()
+            .bucket(&bucket)
+            .key(&object)
+            .version_id(version_id)
+            .send()
+            .await?;
+        assert_eq!(response.server_side_encryption(), Some(&ServerSideEncryption::AwsKms));
+        assert_eq!(response.ssekms_key_id(), Some(key_id));
+        let actual = response.body.collect().await?.into_bytes();
+        assert_eq!(actual.len(), expected.len());
+        assert_eq!(actual.as_ref(), expected);
+    }
+
+    let marker = client.delete_object().bucket(&bucket).key(&object).send().await?;
+    assert_eq!(marker.delete_marker(), Some(true));
+    assert!(marker.version_id().is_some(), "versioned delete must create a delete marker");
+
+    let before_cleanup = client.list_object_versions().bucket(&bucket).prefix(&object).send().await?;
+    assert_eq!(
+        before_cleanup
+            .versions()
+            .iter()
+            .filter(|version| version.key() == Some(object.as_str()))
+            .count(),
+        2
+    );
+    assert_eq!(
+        before_cleanup
+            .delete_markers()
+            .iter()
+            .filter(|delete_marker| delete_marker.key() == Some(object.as_str()))
+            .count(),
+        1
+    );
+
+    client
+        .delete_object()
+        .bucket(&bucket)
+        .key(&object)
+        .customize()
+        .mutate_request(|request| {
+            request.headers_mut().insert("x-rustfs-force-delete", "true");
+        })
+        .send()
+        .await?;
+
+    let after_cleanup = client.list_object_versions().bucket(&bucket).prefix(&object).send().await?;
+    assert!(
+        after_cleanup
+            .versions()
+            .iter()
+            .all(|version| version.key() != Some(object.as_str())),
+        "force cleanup must remove every encrypted object version"
+    );
+    assert!(
+        after_cleanup
+            .delete_markers()
+            .iter()
+            .all(|delete_marker| delete_marker.key() != Some(object.as_str())),
+        "force cleanup must remove the delete marker"
+    );
+    let head_error = match client.head_object().bucket(&bucket).key(&object).send().await {
+        Ok(_) => return Err("force-cleaned probe object remained readable".into()),
+        Err(error) => error,
+    };
+    let service_error = head_error
+        .as_service_error()
+        .ok_or_else(|| format!("force-cleaned HEAD failed with a non-service error: {head_error}"))?;
+    assert!(
+        service_error.is_not_found(),
+        "force-cleaned HEAD returned the wrong service error: {service_error:?}"
+    );
+
+    client.delete_bucket().bucket(&bucket).send().await?;
+    Ok(())
+}
+
+#[tokio::test]
+#[serial]
+async fn test_configured_local_kms_admin_and_versioned_cleanup() -> TestResult {
+    let mut env = LocalKMSTestEnvironment::new().await?;
+    env.base_env.start_rustfs_server(Vec::new()).await?;
+
+    let start_error = match start_kms(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await {
+        Ok(()) => return Err("unconfigured KMS start unexpectedly succeeded".into()),
+        Err(error) => error,
+    };
+    assert!(
+        start_error.to_string().contains("no configuration provided"),
+        "unconfigured KMS start returned the wrong business error: {start_error}"
+    );
+
+    let insecure_config = serde_json::json!({
+        "backend_type": "Local",
+        "key_dir": env.kms_keys_dir,
+        "file_permissions": 0o600,
+        "default_key_id": "rustfs-e2e-test-default-key"
+    })
+    .to_string();
+    let configure_error =
+        match configure_kms(&env.base_env.url, &insecure_config, &env.base_env.access_key, &env.base_env.secret_key).await {
+            Ok(()) => return Err("insecure Local KMS configuration unexpectedly succeeded".into()),
+            Err(error) => error,
+        };
+    assert!(
+        configure_error.to_string().contains("requires a master key"),
+        "invalid Local KMS configuration returned the wrong business error: {configure_error}"
+    );
+
+    let default_key_id = env.configure_local_kms().await?;
+    start_kms(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;
+    assert_configured_status(
+        &env.base_env.url,
+        &env.base_env.access_key,
+        &env.base_env.secret_key,
+        "local",
+        &default_key_id,
+    )
+    .await?;
+    let key_id = create_and_verify_key(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;
+    assert_versioned_sse_kms_roundtrip_and_cleanup(&env.base_env, &key_id, "kms-local-configured").await?;
+    assert_key_deletion_lifecycle(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key, &key_id).await?;
+    Ok(())
+}
+
+#[tokio::test]
+#[serial]
+#[ignore = "requires a Vault binary"]
+async fn test_configured_vault_kms_admin_and_versioned_cleanup() -> TestResult {
+    let mut env = VaultTestEnvironment::new().await?;
+    env.start_vault().await?;
+    env.setup_vault_transit().await?;
+    env.start_rustfs_for_vault().await?;
+    env.configure_vault_transit_kms().await?;
+    start_kms(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;
+    assert_configured_status(
+        &env.base_env.url,
+        &env.base_env.access_key,
+        &env.base_env.secret_key,
+        "vault-transit",
+        VAULT_KEY_NAME,
+    )
+    .await?;
+
+    let key_id = create_and_verify_key(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;
+    assert_ne!(key_id, VAULT_KEY_NAME, "key lifecycle test must create a distinct Vault key");
+    assert_versioned_sse_kms_roundtrip_and_cleanup(&env.base_env, &key_id, "kms-vault-configured").await?;
+    assert_key_deletion_lifecycle(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key, &key_id).await?;
+    Ok(())
+}
@@ -42,7 +42,7 @@ fn assert_managed_encryption_metadata_hidden(metadata: Option<&HashMap<String, S
    }
 }

-fn assert_storage_encrypted(storage_root: &std::path::Path, bucket: &str, key: &str, plaintext: &[u8]) {
+pub(super) fn assert_storage_encrypted(storage_root: &std::path::Path, bucket: &str, key: &str, plaintext: &[u8]) {
    let mut stack = VecDeque::from([storage_root.to_path_buf()]);
    let mut scanned = 0;
    let mut plaintext_path: Option<std::path::PathBuf> = None;
@@ -25,12 +25,18 @@ use super::common::{LocalKMSTestEnvironment, sse_customer_key_md5_base64};
 use crate::common::{TEST_BUCKET, init_logging};
 use aws_sdk_s3::types::ServerSideEncryption;
 use base64::Engine;
-use md5::compute;
+use md5::{Digest as Md5Digest, Md5};
 use serial_test::serial;
 use std::sync::Arc;
 use tokio::sync::Semaphore;
 use tracing::{info, warn};

+fn md5_hex(input: impl AsRef<[u8]>) -> String {
+    let mut hasher = Md5::new();
+    hasher.update(input.as_ref());
+    hex::encode(hasher.finalize())
+}
+
 /// Test encryption of zero-byte files (empty files)
 #[tokio::test]
 #[serial]
@@ -294,7 +300,7 @@ async fn test_kms_invalid_key_scenarios() -> Result<(), Box<dyn std::error::Erro
    info!("🔍 Testing invalid SSE-C key length");
    let invalid_short_key = "short"; // Too short
    let invalid_key_b64 = base64::engine::general_purpose::STANDARD.encode(invalid_short_key);
-    let invalid_key_md5 = format!("{:x}", compute(invalid_short_key));
+    let invalid_key_md5 = md5_hex(invalid_short_key);

    let invalid_key_result = s3_client
        .put_object()
@@ -625,6 +625,9 @@ async fn test_multipart_upload_with_sse_c(
        .bucket(bucket)
        .key(object_key)
        .upload_id(upload_id)
+        .sse_customer_algorithm("AES256")
+        .sse_customer_key(&key_b64)
+        .sse_customer_key_md5(&key_md5)
        .multipart_upload(completed_multipart_upload)
        .send()
        .await?;
@@ -449,29 +449,32 @@ async fn test_vault_kms_key_crud(

    info!("✅ Delete verification: Key state correctly changed to: {}", key_state);

-    // Force Delete - Force immediate deletion for PendingDeletion key
-    let force_delete_response = crate::common::execute_awscurl(
+    // Force Delete - a default server refuses to skip the waiting window
+    // (rustfs/backlog#1585): destroying the key material immediately would take
+    // every object encrypted under the key with it.
+    let force_delete_error = crate::common::execute_awscurl(
        &format!("{base_url}/rustfs/admin/v3/kms/keys/delete?keyId={key_id}&force_immediate=true"),
        "DELETE",
        None,
        access_key,
        secret_key,
    )
-    .await?;
+    .await
+    .err()
+    .expect("Immediate KMS key deletion must be refused on a default server");
+    info!("✅ Force Delete: correctly refused for key {}: {}", key_id, force_delete_error);

-    // Parse and validate the force delete response
-    let force_delete_result: serde_json::Value = serde_json::from_str(&force_delete_response)?;
-    assert_eq!(force_delete_result["success"], true, "Force delete operation must return success=true");
-    info!("✅ Force Delete: Successfully force deleted key: {}", key_id);
+    // The refused request must leave the key exactly as it was: still present,
+    // still pending deletion, still recoverable through cancel-deletion.
+    let describe_after_refusal =
+        crate::common::awscurl_get(&format!("{base_url}/rustfs/admin/v3/kms/keys/{key_id}"), access_key, secret_key).await?;
+    let describe_after_refusal: serde_json::Value = serde_json::from_str(&describe_after_refusal)?;
+    assert_eq!(
+        describe_after_refusal["key_metadata"]["key_state"], "PendingDeletion",
+        "A refused immediate deletion must leave the key pending deletion"
+    );

-    // Verify key no longer exists after force deletion (should return error)
-    let describe_force_deleted_result =
-        crate::common::awscurl_get(&format!("{base_url}/rustfs/admin/v3/kms/keys/{key_id}"), access_key, secret_key).await;
-
-    // After force deletion, key should not be found (GET should fail)
-    assert!(describe_force_deleted_result.is_err(), "Force deleted key should not be found");
-
-    info!("✅ Force Delete verification: Key was permanently deleted and is no longer accessible");
+    info!("✅ Force Delete verification: Key survived the refused immediate deletion");

    info!("Vault KMS key CRUD operations completed successfully");
    Ok(())
@@ -50,3 +50,6 @@ mod encryption_metadata_test;

 #[cfg(test)]
 mod copy_object_version_restore_sse_test;
+
+#[cfg(test)]
+mod configured_roundtrip_test;
@@ -566,14 +566,19 @@ async fn test_multipart_encryption_type(
        .set_parts(Some(completed_parts))
        .build();

-    let _complete_output = s3_client
+    let mut complete_request = s3_client
        .complete_multipart_upload()
        .bucket(bucket)
        .key(object_key)
        .upload_id(upload_id)
-        .multipart_upload(completed_multipart_upload)
-        .send()
-        .await?;
+        .multipart_upload(completed_multipart_upload);
+    if matches!(encryption_type, EncryptionType::SSEC) {
+        complete_request = complete_request
+            .sse_customer_algorithm("AES256")
+            .sse_customer_key(sse_c_key.as_ref().unwrap())
+            .sse_customer_key_md5(sse_c_md5.as_ref().unwrap());
+    }
+    let _complete_output = complete_request.send().await?;

    // Download and verify
    let mut get_request = s3_client.get_object().bucket(bucket).key(object_key);
@@ -79,6 +79,12 @@ mod bucket_policy_check_test;
 #[cfg(test)]
 mod security_boundary_test;

+// Cross-process replay/tamper acceptance for the internode NodeService v2 RPC
+// signature (backlog#1327): method-path transplant, nonce replay, body tampering
+// and the two strict rollout flips, all against a real spawned server.
+#[cfg(test)]
+mod internode_rpc_signature_e2e_test;
+
 // Opt-in per-client S3 API rate limiting (backlog#1191)
 #[cfg(test)]
 mod api_rate_limit_test;
@@ -95,6 +101,9 @@ mod admin_auth_test;
 #[cfg(test)]
 mod existing_object_tag_policy_test;

+#[cfg(test)]
+mod sts_query_compat_test;
+
 // Regression tests for Issue #2036: anonymous access with PublicAccessBlock
 #[cfg(test)]
 mod anonymous_access_test;
@@ -167,6 +176,10 @@ mod cluster_concurrency_test;
 #[cfg(test)]
 mod cluster_multidrive_pool_test;

+// backlog#1433: real 4-node EC boundary gate for inline storage and GET paths.
+#[cfg(test)]
+mod inline_fast_path_cluster_test;
+
 // PutObject / MultipartUpload with checksum (Content-MD5, x-amz-checksum-*)
 #[cfg(test)]
 mod checksum_upload_test;
@@ -187,12 +200,24 @@ mod heal_erasure_disk_rebuild_test;
 #[cfg(test)]
 mod copy_object_metadata_test;

+#[cfg(test)]
+mod copy_object_tagging_test;
+
 #[cfg(test)]
 mod copy_object_version_restore_test;

 #[cfg(test)]
 mod copy_object_checksum_test;

+#[cfg(test)]
+mod ssec_copy_test;
+
+#[cfg(test)]
+mod multipart_storage_class_test;
+
+#[cfg(test)]
+mod storage_class_capability_test;
+
 // S3 dummy-compat bucket API tests
 #[cfg(test)]
 mod bucket_logging_test;
@@ -26,6 +26,7 @@ use chrono::{Duration as ChronoDuration, Utc};
 use flate2::{Compression, write::GzEncoder};
 use http::HeaderValue;
 use http::header::{CONTENT_TYPE, HOST};
+use md5::{Digest as Md5Digest, Md5};
 use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use s3s::Body;
@@ -50,7 +51,15 @@ fn encode_post_policy(conditions: Vec<serde_json::Value>) -> String {
 }

 fn sse_customer_key_md5_base64(key: &str) -> String {
-    base64::engine::general_purpose::STANDARD.encode(md5::compute(key).0)
+    let mut hasher = Md5::new();
+    hasher.update(key.as_bytes());
+    base64::engine::general_purpose::STANDARD.encode(hasher.finalize())
+}
+
+fn md5_hex(input: impl AsRef<[u8]>) -> String {
+    let mut hasher = Md5::new();
+    hasher.update(input.as_ref());
+    hex::encode(hasher.finalize())
 }

 /// Env var consumed by the local SSE-S3 DEK provider when KMS is not configured.
@@ -1267,7 +1276,7 @@ async fn test_anonymous_post_object_accepts_storage_class_exact_policy_match()
    let bucket = "anon-post-storage-class";
    let object_key = "post-storage-class-object.txt";
    let expected_body = b"post-storage-class-body".to_vec();
-    let storage_class = "STANDARD_IA";
+    let storage_class = "REDUCED_REDUNDANCY";

    let admin_client = env.create_s3_client();
    admin_client.create_bucket().bucket(bucket).send().await?;
@@ -5138,7 +5147,7 @@ async fn test_signed_put_object_extract_preserves_storage_class() -> Result<(),
        .put_object()
        .bucket(bucket)
        .key(archive_key)
-        .storage_class(aws_sdk_s3::types::StorageClass::StandardIa)
+        .storage_class(aws_sdk_s3::types::StorageClass::ReducedRedundancy)
        .body(ByteStream::from(tar_bytes))
        .customize()
        .mutate_request(move |req| {
@@ -5155,7 +5164,7 @@ async fn test_signed_put_object_extract_preserves_storage_class() -> Result<(),
        .send()
        .await?;

-    assert_eq!(head.storage_class().map(|value| value.as_str()), Some("STANDARD_IA"));
+    assert_eq!(head.storage_class().map(|value| value.as_str()), Some("REDUCED_REDUNDANCY"));

    Ok(())
 }
@@ -5664,7 +5673,7 @@ async fn test_signed_put_object_extract_returns_archive_etag() -> Result<(), Box
    client.create_bucket().bucket(bucket).send().await?;

    let archive = make_tar(&[("alpha.txt", b"alpha-body")], &[]).await;
-    let expected_etag = format!("\"{:x}\"", md5::compute(&archive));
+    let expected_etag = format!("\"{}\"", md5_hex(&archive));

    let response = client
        .put_object()
@@ -0,0 +1,364 @@
+// Copyright 2026 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! CreateMultipartUpload storage-class persistence regression tests.
+
+#[cfg(test)]
+mod tests {
+    use crate::common::{RustFSTestEnvironment, init_logging};
+    use aws_sdk_s3::Client;
+    use aws_sdk_s3::error::ProvideErrorMetadata;
+    use aws_sdk_s3::primitives::ByteStream;
+    use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart, StorageClass};
+
+    const PART_SIZE: usize = 5 * 1024 * 1024;
+
+    async fn assert_completed_object(
+        client: &Client,
+        bucket: &str,
+        key: &str,
+        expected_storage_class: &str,
+        expected_body: &[u8],
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        let head = client.head_object().bucket(bucket).key(key).send().await?;
+        let expected_head_class = (expected_storage_class != "STANDARD").then_some(expected_storage_class);
+        assert_eq!(
+            head.storage_class().map(StorageClass::as_str),
+            expected_head_class,
+            "HeadObject should use S3's implicit STANDARD representation"
+        );
+
+        let listed = client.list_objects_v2().bucket(bucket).prefix(key).send().await?;
+        let object = listed
+            .contents()
+            .iter()
+            .find(|object| object.key() == Some(key))
+            .ok_or("completed multipart object missing from ListObjectsV2")?;
+        assert_eq!(
+            object.storage_class().map(|storage_class| storage_class.as_str()),
+            Some(expected_storage_class),
+            "ListObjectsV2 should report the completed object's storage class"
+        );
+
+        let body = client
+            .get_object()
+            .bucket(bucket)
+            .key(key)
+            .send()
+            .await?
+            .body
+            .collect()
+            .await?
+            .into_bytes();
+        assert_eq!(body.as_ref(), expected_body, "completed multipart body should be byte-exact");
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn multipart_upload_preserves_standard_and_rrs_across_retry_and_resume()
+    -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(Vec::new()).await?;
+        let client = env.create_s3_client();
+        let bucket = "multipart-storage-class-retry";
+        env.create_test_bucket(bucket).await?;
+
+        for storage_class in [StorageClass::Standard, StorageClass::ReducedRedundancy] {
+            let class_name = storage_class.as_str();
+            let key = format!("retry-{class_name}.bin");
+            let create = client
+                .create_multipart_upload()
+                .bucket(bucket)
+                .key(&key)
+                .storage_class(storage_class.clone())
+                .content_type("application/octet-stream")
+                .metadata("content-type", "user-content-type")
+                .metadata("x-amz-storage-class", "user-storage-class")
+                .send()
+                .await?;
+            let upload_id = create.upload_id().ok_or("CreateMultipartUpload returned no upload ID")?;
+
+            let original_part = vec![b'a'; PART_SIZE];
+            let first_attempt = client
+                .upload_part()
+                .bucket(bucket)
+                .key(&key)
+                .upload_id(upload_id)
+                .part_number(1)
+                .body(ByteStream::from(original_part))
+                .send()
+                .await?;
+
+            let resumed_client = env.create_s3_client();
+            let before_retry = resumed_client
+                .list_parts()
+                .bucket(bucket)
+                .key(&key)
+                .upload_id(upload_id)
+                .send()
+                .await?;
+            assert_eq!(before_retry.storage_class().map(StorageClass::as_str), Some(class_name));
+            assert_eq!(before_retry.parts().len(), 1, "resume should find the previously uploaded part");
+
+            let retried_part = vec![b'b'; PART_SIZE];
+            let retry = resumed_client
+                .upload_part()
+                .bucket(bucket)
+                .key(&key)
+                .upload_id(upload_id)
+                .part_number(1)
+                .body(ByteStream::from(retried_part.clone()))
+                .send()
+                .await?;
+            assert_ne!(
+                first_attempt.e_tag(),
+                retry.e_tag(),
+                "retrying the same part number with different bytes should replace the part"
+            );
+
+            let tail = format!("-tail-{class_name}").into_bytes();
+            let second = resumed_client
+                .upload_part()
+                .bucket(bucket)
+                .key(&key)
+                .upload_id(upload_id)
+                .part_number(2)
+                .body(ByteStream::from(tail.clone()))
+                .send()
+                .await?;
+            let after_retry = resumed_client
+                .list_parts()
+                .bucket(bucket)
+                .key(&key)
+                .upload_id(upload_id)
+                .send()
+                .await?;
+            assert_eq!(after_retry.storage_class().map(StorageClass::as_str), Some(class_name));
+            assert_eq!(after_retry.parts().len(), 2);
+            assert_eq!(after_retry.parts()[0].e_tag(), retry.e_tag());
+
+            resumed_client
+                .complete_multipart_upload()
+                .bucket(bucket)
+                .key(&key)
+                .upload_id(upload_id)
+                .multipart_upload(
+                    CompletedMultipartUpload::builder()
+                        .parts(
+                            CompletedPart::builder()
+                                .part_number(1)
+                                .set_e_tag(retry.e_tag().map(str::to_owned))
+                                .build(),
+                        )
+                        .parts(
+                            CompletedPart::builder()
+                                .part_number(2)
+                                .set_e_tag(second.e_tag().map(str::to_owned))
+                                .build(),
+                        )
+                        .build(),
+                )
+                .send()
+                .await?;
+
+            let mut expected_body = retried_part;
+            expected_body.extend_from_slice(&tail);
+            assert_completed_object(&resumed_client, bucket, &key, class_name, &expected_body).await?;
+            let metadata_head = resumed_client.head_object().bucket(bucket).key(&key).send().await?;
+            assert_eq!(metadata_head.content_type(), Some("application/octet-stream"));
+            assert_eq!(
+                metadata_head.metadata().and_then(|metadata| metadata.get("content-type")),
+                Some(&"user-content-type".to_string())
+            );
+            assert_eq!(
+                metadata_head
+                    .metadata()
+                    .and_then(|metadata| metadata.get("x-amz-storage-class")),
+                Some(&"user-storage-class".to_string())
+            );
+        }
+
+        env.stop_server();
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn multipart_copy_preserves_standard_and_rrs() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(Vec::new()).await?;
+        let client = env.create_s3_client();
+        let bucket = "multipart-storage-class-copy";
+        let source_key = "source.bin";
+        let source_body = vec![b'c'; 1024 * 1024];
+        env.create_test_bucket(bucket).await?;
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(source_key)
+            .body(ByteStream::from(source_body.clone()))
+            .send()
+            .await?;
+
+        for storage_class in [StorageClass::Standard, StorageClass::ReducedRedundancy] {
+            let class_name = storage_class.as_str();
+            let key = format!("copy-{class_name}.bin");
+            let create = client
+                .create_multipart_upload()
+                .bucket(bucket)
+                .key(&key)
+                .storage_class(storage_class.clone())
+                .send()
+                .await?;
+            let upload_id = create.upload_id().ok_or("CreateMultipartUpload returned no upload ID")?;
+            let copied = client
+                .upload_part_copy()
+                .bucket(bucket)
+                .key(&key)
+                .upload_id(upload_id)
+                .part_number(1)
+                .copy_source(format!("{bucket}/{source_key}"))
+                .send()
+                .await?;
+            let e_tag = copied
+                .copy_part_result()
+                .and_then(|result| result.e_tag())
+                .ok_or("UploadPartCopy returned no ETag")?;
+
+            let parts = client
+                .list_parts()
+                .bucket(bucket)
+                .key(&key)
+                .upload_id(upload_id)
+                .send()
+                .await?;
+            assert_eq!(parts.storage_class().map(StorageClass::as_str), Some(class_name));
+            assert_eq!(parts.parts().len(), 1);
+
+            client
+                .complete_multipart_upload()
+                .bucket(bucket)
+                .key(&key)
+                .upload_id(upload_id)
+                .multipart_upload(
+                    CompletedMultipartUpload::builder()
+                        .parts(CompletedPart::builder().part_number(1).e_tag(e_tag).build())
+                        .build(),
+                )
+                .send()
+                .await?;
+            assert_completed_object(&client, bucket, &key, class_name, &source_body).await?;
+        }
+
+        env.stop_server();
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn invalid_and_aborted_uploads_leave_no_session_or_object() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(Vec::new()).await?;
+        let client = env.create_s3_client();
+        let bucket = "multipart-storage-class-errors";
+        let invalid_key = "invalid.bin";
+        let aborted_key = "aborted.bin";
+        env.create_test_bucket(bucket).await?;
+
+        let invalid = client
+            .create_multipart_upload()
+            .bucket(bucket)
+            .key(invalid_key)
+            .storage_class(StorageClass::from("INVALID"))
+            .send()
+            .await
+            .expect_err("invalid storage class should be rejected");
+        assert_eq!(
+            invalid.as_service_error().and_then(ProvideErrorMetadata::code),
+            Some("InvalidStorageClass")
+        );
+        let after_invalid = client
+            .list_multipart_uploads()
+            .bucket(bucket)
+            .prefix(invalid_key)
+            .send()
+            .await?;
+        assert!(
+            after_invalid.uploads().is_empty(),
+            "validation failure must not create a multipart session"
+        );
+
+        let create = client
+            .create_multipart_upload()
+            .bucket(bucket)
+            .key(aborted_key)
+            .storage_class(StorageClass::ReducedRedundancy)
+            .send()
+            .await?;
+        let upload_id = create.upload_id().ok_or("CreateMultipartUpload returned no upload ID")?;
+        client
+            .upload_part()
+            .bucket(bucket)
+            .key(aborted_key)
+            .upload_id(upload_id)
+            .part_number(1)
+            .body(ByteStream::from_static(b"aborted multipart part"))
+            .send()
+            .await?;
+        let before_abort = client
+            .list_parts()
+            .bucket(bucket)
+            .key(aborted_key)
+            .upload_id(upload_id)
+            .send()
+            .await?;
+        assert_eq!(before_abort.storage_class().map(StorageClass::as_str), Some("REDUCED_REDUNDANCY"));
+
+        client
+            .abort_multipart_upload()
+            .bucket(bucket)
+            .key(aborted_key)
+            .upload_id(upload_id)
+            .send()
+            .await?;
+        let after_abort = client
+            .list_parts()
+            .bucket(bucket)
+            .key(aborted_key)
+            .upload_id(upload_id)
+            .send()
+            .await
+            .expect_err("aborted upload should not be resumable");
+        assert_eq!(after_abort.as_service_error().and_then(ProvideErrorMetadata::code), Some("NoSuchUpload"));
+        let remaining_uploads = client
+            .list_multipart_uploads()
+            .bucket(bucket)
+            .prefix(aborted_key)
+            .send()
+            .await?;
+        assert!(remaining_uploads.uploads().is_empty(), "abort should remove the multipart session");
+        let aborted_head = client
+            .head_object()
+            .bucket(bucket)
+            .key(aborted_key)
+            .send()
+            .await
+            .expect_err("aborted upload should not create an object");
+        assert_eq!(aborted_head.raw_response().map(|response| response.status().as_u16()), Some(404));
+
+        env.stop_server();
+        Ok(())
+    }
+}
@@ -21,18 +21,22 @@
 //! function, never as an S3 event sink.
 //!
 //! Coverage:
-//!   * PUT / multipart-complete / DELETE each deliver one event with the correct
+//!   * PUT / multipart-complete / DeleteObject / DeleteObjects each deliver one event with the correct
 //!     eventName, bucket, key, versionId and eTag.
 //!   * prefix/suffix filters drop non-matching keys (rule-engine gate).
 //!   * an event queued while the target endpoint is unreachable is redelivered
 //!     from the on-disk store once the endpoint recovers (store-and-forward).
+//!   * responseElements and the S3 response use the canonical request ID while
+//!     requestParameters preserve a conflicting client-supplied value.

 use crate::common::{RustFSTestEnvironment, init_logging};
 use aws_sdk_s3::Client;
+use aws_sdk_s3::operation::RequestId;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{
-    BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, Event, FilterRule, FilterRuleName,
-    NotificationConfiguration, NotificationConfigurationFilter, QueueConfiguration, S3KeyFilter, VersioningConfiguration,
+    BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, Delete, Event, FilterRule, FilterRuleName,
+    NotificationConfiguration, NotificationConfigurationFilter, ObjectIdentifier, QueueConfiguration, S3KeyFilter,
+    VersioningConfiguration,
 };
 use http::header::{CONTENT_TYPE, HOST};
 use local_ip_address::local_ip;
@@ -40,10 +44,12 @@ use reqwest::StatusCode;
 use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use rustfs_utils::egress::ENV_OUTBOUND_ALLOW_ORIGINS;
+use rustfs_utils::http::headers::{AMZ_REQUEST_ID, REQUEST_ID_HEADER};
 use s3s::Body;
 use serde_json::Value;
 use serial_test::serial;
 use std::error::Error;
+use std::io::Cursor;
 use std::path::Path;
 use std::sync::{
    Arc, Once,
@@ -63,6 +69,8 @@ type BoxError = Box<dyn Error + Send + Sync>;
 /// for target lookup (see `process_queue_configurations`), so the region is
 /// nominal, but it must be present for `ARN::parse` to succeed.
 const NOTIFY_REGION: &str = "us-east-1";
+const CLIENT_REQUEST_ID: &str = "client-supplied-request-id";
+const CLIENT_AMZ_REQUEST_ID: &str = "client-supplied-amz-request-id";

 /// Webhook targets are registered as `TargetID { id: <name>, name: "webhook" }`,
 /// so the ARN a notification rule references is
@@ -579,6 +587,36 @@ fn trimmed_etag(value: Option<&str>) -> Option<String> {
    value.map(|e| e.trim_matches('"').to_string())
 }

+fn assert_conflicting_request_id_correlation(record: &Value, server_request_id: &str) {
+    assert_eq!(
+        record["requestParameters"][REQUEST_ID_HEADER].as_str(),
+        Some(CLIENT_REQUEST_ID),
+        "notification request parameters should retain the actual client header: {record}"
+    );
+    assert_eq!(
+        record["requestParameters"][AMZ_REQUEST_ID].as_str(),
+        Some(CLIENT_AMZ_REQUEST_ID),
+        "notification request parameters should retain the actual client header: {record}"
+    );
+    assert_eq!(
+        record["responseElements"][AMZ_REQUEST_ID].as_str(),
+        Some(server_request_id),
+        "notification response elements should use the canonical request ID: {record}"
+    );
+}
+
+fn assert_generated_request_id_correlation(record: &Value, request_id: &str) {
+    assert!(
+        record["requestParameters"][AMZ_REQUEST_ID].is_null(),
+        "notification request parameters must not invent a client request header: {record}"
+    );
+    assert_eq!(
+        record["responseElements"][AMZ_REQUEST_ID].as_str(),
+        Some(request_id),
+        "notification response elements should match the S3 response request ID: {record}"
+    );
+}
+
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
@@ -671,8 +709,17 @@ async fn test_webhook_event_delivery_and_filtering() -> TestResult {
        .bucket(bucket)
        .key(put_key)
        .body(ByteStream::from_static(b"peri-1 put body"))
+        .customize()
+        .mutate_request(|request| {
+            request.headers_mut().insert(REQUEST_ID_HEADER, CLIENT_REQUEST_ID);
+            request.headers_mut().insert(AMZ_REQUEST_ID, CLIENT_AMZ_REQUEST_ID);
+        })
        .send()
        .await?;
+    let put_request_id = put.request_id().ok_or("PUT response missing request ID")?.to_owned();
+    assert!(uuid::Uuid::parse_str(&put_request_id).is_ok());
+    assert_ne!(put_request_id, CLIENT_REQUEST_ID);
+    assert_ne!(put_request_id, CLIENT_AMZ_REQUEST_ID);
    let put_version = put
        .version_id()
        .ok_or("PUT response missing versionId (versioning not enabled?)")?;
@@ -692,6 +739,7 @@ async fn test_webhook_event_delivery_and_filtering() -> TestResult {
        "record eventName: {record}"
    );
    assert_eq!(record["s3"]["bucket"]["name"].as_str(), Some(bucket), "bucket in event: {record}");
+    assert_conflicting_request_id_correlation(record, &put_request_id);
    assert_eq!(object["versionId"].as_str(), Some(put_version), "versionId in event: {object}");
    assert_eq!(
        trimmed_etag(object["eTag"].as_str()),
@@ -744,6 +792,35 @@ async fn test_webhook_event_delivery_and_filtering() -> TestResult {
        "multipart eTag in event: {mp_record}"
    );

+    // --- Snowball extract: direct notification path keeps response correlation
+    let snowball_key = "uploads/snowball.dat";
+    let snowball_body = b"snowball notification body";
+    let mut archive_builder = tokio_tar::Builder::new(Cursor::new(Vec::new()));
+    let mut archive_header = tokio_tar::Header::new_gnu();
+    archive_header.set_size(u64::try_from(snowball_body.len()).expect("snowball fixture length should fit in u64"));
+    archive_header.set_mode(0o644);
+    archive_header.set_cksum();
+    archive_builder
+        .append_data(&mut archive_header, snowball_key, Cursor::new(snowball_body))
+        .await?;
+    let archive = archive_builder.into_inner().await?.into_inner();
+    let snowball = client
+        .put_object()
+        .bucket(bucket)
+        .key("snowball-fixture.tar")
+        .body(ByteStream::from(archive))
+        .customize()
+        .mutate_request(|request| {
+            request.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
+        })
+        .send()
+        .await?;
+    let snowball_request_id = snowball.request_id().ok_or("Snowball response missing request ID")?;
+
+    let snowball_event = wait_for_event(&mut rx, snowball_key, "s3:ObjectCreated:", Duration::from_secs(20)).await?;
+    let snowball_record = &snowball_event["Records"][0];
+    assert_generated_request_id_correlation(snowball_record, snowball_request_id);
+
    // --- Filter: non-matching prefix and suffix must never be delivered ------
    let wrong_prefix = "logs/report.dat"; // right suffix, wrong prefix
    let wrong_suffix = "uploads/report.txt"; // right prefix, wrong suffix
@@ -772,7 +849,32 @@ async fn test_webhook_event_delivery_and_filtering() -> TestResult {
        "wrong-suffix key {wrong_suffix} bypassed the filter; saw {seen:?}"
    );

-    // --- DELETE on a versioned bucket: ObjectRemoved:* with delete-marker version
+    // --- DeleteObjects: direct notification path keeps response correlation --
+    let delete_many_key = "uploads/delete-many.dat";
+    client
+        .put_object()
+        .bucket(bucket)
+        .key(delete_many_key)
+        .body(ByteStream::from_static(b"delete objects notification body"))
+        .send()
+        .await?;
+    wait_for_event(&mut rx, delete_many_key, "s3:ObjectCreated:", Duration::from_secs(20)).await?;
+
+    let delete_many = client
+        .delete_objects()
+        .bucket(bucket)
+        .delete(
+            Delete::builder()
+                .objects(ObjectIdentifier::builder().key(delete_many_key).build()?)
+                .build()?,
+        )
+        .send()
+        .await?;
+    let delete_many_request_id = delete_many.request_id().ok_or("DeleteObjects response missing request ID")?;
+    let delete_many_event = wait_for_event(&mut rx, delete_many_key, "s3:ObjectRemoved:", Duration::from_secs(20)).await?;
+    assert_generated_request_id_correlation(&delete_many_event["Records"][0], delete_many_request_id);
+
+    // --- DeleteObject on a versioned bucket: delete-marker version ----------
    let delete = client.delete_object().bucket(bucket).key(put_key).send().await?;
    let removed = wait_for_event(&mut rx, put_key, "s3:ObjectRemoved:", Duration::from_secs(20)).await?;
    let removed_record = &removed["Records"][0];
@@ -26,6 +26,7 @@

 use super::common::*;
 use aws_sdk_s3::Client;
+use aws_sdk_s3::error::ProvideErrorMetadata;
 use aws_sdk_s3::primitives::{ByteStream, DateTimeFormat};
 use aws_sdk_s3::types::{
    CompletedMultipartUpload, CompletedPart, Delete, MetadataDirective, ObjectIdentifier, ObjectLockLegalHoldStatus,
@@ -2120,6 +2121,127 @@ async fn test_multipart_default_retention_fixed_at_create() {
 // Versioning Auto-Enable Tests
 // ============================================================================

+#[tokio::test]
+#[serial]
+async fn test_unretained_object_lock_object_delete_and_bucket_cleanup() {
+    init_logging();
+    info!("🧪 Test: Unretained Object Lock object delete and bucket cleanup (Issue #5339)");
+
+    let mut env = ObjectLockTestEnvironment::new()
+        .await
+        .expect("failed to create Object Lock test environment");
+    env.start_rustfs().await.expect("failed to start RustFS");
+
+    let bucket = "test-object-lock-delete-cleanup";
+    let key = "unretained-object";
+
+    env.create_object_lock_bucket(bucket)
+        .await
+        .expect("failed to create Object Lock bucket");
+    let client = env.s3_client();
+
+    let put_response = client
+        .put_object()
+        .bucket(bucket)
+        .key(key)
+        .body(ByteStream::from_static(b"unretained data"))
+        .send()
+        .await
+        .expect("failed to upload unretained object");
+    let object_version_id = put_response
+        .version_id()
+        .expect("Object Lock buckets must create versioned objects")
+        .to_string();
+
+    let delete_response = client
+        .delete_object()
+        .bucket(bucket)
+        .key(key)
+        .send()
+        .await
+        .expect("failed to create delete marker");
+    assert_eq!(delete_response.delete_marker(), Some(true));
+    let delete_marker_version_id = delete_response
+        .version_id()
+        .expect("Deleting without a version ID must create a delete marker")
+        .to_string();
+
+    let get_error = client
+        .get_object()
+        .bucket(bucket)
+        .key(key)
+        .send()
+        .await
+        .expect_err("GET must not return an object hidden by a delete marker");
+    assert_eq!(get_error.raw_response().map(|response| response.status().as_u16()), Some(404));
+    assert_eq!(get_error.as_service_error().and_then(|error| error.code()), Some("NoSuchKey"));
+
+    let listed_objects = client
+        .list_objects_v2()
+        .bucket(bucket)
+        .send()
+        .await
+        .expect("failed to list current objects");
+    assert!(
+        listed_objects.contents().iter().all(|object| object.key() != Some(key)),
+        "ListObjectsV2 must hide objects whose latest version is a delete marker"
+    );
+
+    let listed_versions = client
+        .list_object_versions()
+        .bucket(bucket)
+        .send()
+        .await
+        .expect("failed to list object versions");
+    assert!(
+        listed_versions
+            .versions()
+            .iter()
+            .any(|version| version.key() == Some(key) && version.version_id() == Some(object_version_id.as_str())),
+        "The data version must remain until it is explicitly deleted"
+    );
+    assert!(
+        listed_versions
+            .delete_markers()
+            .iter()
+            .any(|marker| marker.key() == Some(key) && marker.version_id() == Some(delete_marker_version_id.as_str())),
+        "ListObjectVersions must expose the delete marker"
+    );
+
+    client
+        .delete_object()
+        .bucket(bucket)
+        .key(key)
+        .version_id(object_version_id)
+        .send()
+        .await
+        .expect("failed to delete the data version");
+    client
+        .delete_object()
+        .bucket(bucket)
+        .key(key)
+        .version_id(delete_marker_version_id)
+        .send()
+        .await
+        .expect("failed to delete the delete marker");
+
+    let remaining_versions = client
+        .list_object_versions()
+        .bucket(bucket)
+        .send()
+        .await
+        .expect("failed to list versions after cleanup");
+    assert!(remaining_versions.versions().is_empty());
+    assert!(remaining_versions.delete_markers().is_empty());
+
+    client
+        .delete_bucket()
+        .bucket(bucket)
+        .send()
+        .await
+        .expect("Deleting every version must remove xl.meta so the bucket can be deleted normally");
+}
+
 #[tokio::test]
 #[serial]
 async fn test_versioning_auto_enabled_with_object_lock() {
@@ -24,7 +24,7 @@ use rustfs_protos::proto_gen::node_service::{BatchGenerallyLockRequest, Generall
 use tonic::Request;
 use tracing::{info, warn};

-use crate::storage_api::grpc_lock::{TonicInterceptor, node_service_time_out_client_no_auth};
+use crate::storage_api::grpc_lock::{AuthenticatedChannel, TonicInterceptor, node_service_time_out_client_no_auth};

 /// gRPC lock client without authentication for testing
 /// Similar to RemoteClient but uses no_auth client
@@ -42,7 +42,7 @@ impl GrpcLockClient {
        &self,
    ) -> Result<
        rustfs_protos::proto_gen::node_service::node_service_client::NodeServiceClient<
-            tonic::service::interceptor::InterceptedService<tonic::transport::Channel, TonicInterceptor>,
+            tonic::service::interceptor::InterceptedService<AuthenticatedChannel, TonicInterceptor>,
        >,
    > {
        node_service_time_out_client_no_auth(&self.addr)
@@ -23,7 +23,8 @@ use rustfs_protos::{
    proto_gen::node_service::{
        BatchGenerallyLockRequest, BatchGenerallyLockResponse, BatchReadVersionRequest, BatchReadVersionResponse,
        GenerallyLockRequest, GenerallyLockResponse, GenerallyLockResult, PingRequest, PingResponse,
-        node_service_server::NodeService,
+        SnapshotLeaseMutationResponse, SnapshotLeaseReleaseRequest, SnapshotLeaseRenewRequest, SnapshotLeaseRequest,
+        SnapshotLeaseResponse, node_service_server::NodeService,
    },
 };
 use std::pin::Pin;
@@ -104,6 +105,27 @@ impl NodeService for MinimalLockNodeService {
        Err(Status::unimplemented("MinimalLockNodeService only supports lock RPCs"))
    }

+    async fn acquire_snapshot_lease(
+        &self,
+        _request: Request<SnapshotLeaseRequest>,
+    ) -> Result<Response<SnapshotLeaseResponse>, Status> {
+        Err(Status::unimplemented("MinimalLockNodeService only supports lock RPCs"))
+    }
+
+    async fn renew_snapshot_lease(
+        &self,
+        _request: Request<SnapshotLeaseRenewRequest>,
+    ) -> Result<Response<SnapshotLeaseResponse>, Status> {
+        Err(Status::unimplemented("MinimalLockNodeService only supports lock RPCs"))
+    }
+
+    async fn release_snapshot_lease(
+        &self,
+        _request: Request<SnapshotLeaseReleaseRequest>,
+    ) -> Result<Response<SnapshotLeaseMutationResponse>, Status> {
+        Err(Status::unimplemented("MinimalLockNodeService only supports lock RPCs"))
+    }
+
    async fn lock(&self, request: Request<GenerallyLockRequest>) -> Result<Response<GenerallyLockResponse>, Status> {
        let request = request.into_inner();
        let args: LockRequest = match serde_json::from_str(&request.args) {
@@ -400,6 +422,20 @@ impl NodeService for MinimalLockNodeService {
        Err(Status::unimplemented("lock-only test server"))
    }

+    async fn prepare_part_transaction(
+        &self,
+        _request: Request<rustfs_protos::proto_gen::node_service::PreparePartTransactionRequest>,
+    ) -> Result<Response<rustfs_protos::proto_gen::node_service::PreparePartTransactionResponse>, Status> {
+        Err(Status::unimplemented("lock-only test server"))
+    }
+
+    async fn settle_part_transaction(
+        &self,
+        _request: Request<rustfs_protos::proto_gen::node_service::SettlePartTransactionRequest>,
+    ) -> Result<Response<rustfs_protos::proto_gen::node_service::SettlePartTransactionResponse>, Status> {
+        Err(Status::unimplemented("lock-only test server"))
+    }
+
    async fn rename_file(
        &self,
        _request: Request<rustfs_protos::proto_gen::node_service::RenameFileRequest>,
@@ -38,7 +38,7 @@ use aws_sdk_s3::Client;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{
    BucketLifecycleConfiguration, BucketVersioningStatus, ExpirationStatus, LifecycleExpiration, LifecycleRule,
-    LifecycleRuleFilter, VersioningConfiguration,
+    LifecycleRuleFilter, NoncurrentVersionExpiration, VersioningConfiguration,
 };
 use std::time::Duration as StdDuration;
 use time::OffsetDateTime;
@@ -98,7 +98,10 @@ async fn put_object_with_backdated_mtime(
 /// still succeeds. Any other error is surfaced.
 async fn object_is_gone(client: &Client, bucket: &str, key: &str) -> Result<bool, Box<dyn std::error::Error + Send + Sync>> {
    match client.get_object().bucket(bucket).key(key).send().await {
-        Ok(_) => Ok(false),
+        Ok(output) => {
+            output.body.collect().await?;
+            Ok(false)
+        }
        Err(e) => {
            if let Some(service_error) = e.as_service_error() {
                if service_error.is_no_such_key() {
@@ -132,6 +135,39 @@ async fn wait_for_object_expired(client: &Client, bucket: &str, key: &str, deadl
    }
 }

+async fn version_is_absent_from_listing(
+    client: &Client,
+    bucket: &str,
+    key: &str,
+    version_id: &str,
+) -> Result<bool, Box<dyn std::error::Error + Send + Sync>> {
+    let versions = client.list_object_versions().bucket(bucket).prefix(key).send().await?;
+    Ok(!versions.versions().iter().any(|v| v.version_id() == Some(version_id)))
+}
+
+async fn wait_for_version_expired(
+    client: &Client,
+    bucket: &str,
+    key: &str,
+    version_id: &str,
+    deadline: StdDuration,
+) -> TestResult {
+    let start = std::time::Instant::now();
+    loop {
+        if version_is_absent_from_listing(client, bucket, key, version_id).await? {
+            return Ok(());
+        }
+        if start.elapsed() >= deadline {
+            return Err(format!(
+                "object version {bucket}/{key}?versionId={version_id} was not expired by the lifecycle scanner within {}s",
+                deadline.as_secs()
+            )
+            .into());
+        }
+        tokio::time::sleep(StdDuration::from_millis(500)).await;
+    }
+}
+
 /// Build a prefix-scoped `Days`-based expiration rule.
 fn expiration_rule(id: &str, prefix: &str, days: i32) -> Result<LifecycleRule, Box<dyn std::error::Error + Send + Sync>> {
    let rule = LifecycleRule::builder()
@@ -143,6 +179,20 @@ fn expiration_rule(id: &str, prefix: &str, days: i32) -> Result<LifecycleRule, B
    Ok(rule)
 }

+fn noncurrent_expiration_rule(
+    id: &str,
+    prefix: &str,
+    days: i32,
+) -> Result<LifecycleRule, Box<dyn std::error::Error + Send + Sync>> {
+    let rule = LifecycleRule::builder()
+        .id(id)
+        .filter(LifecycleRuleFilter::builder().prefix(prefix).build())
+        .noncurrent_version_expiration(NoncurrentVersionExpiration::builder().noncurrent_days(days).build())
+        .status(ExpirationStatus::Enabled)
+        .build()?;
+    Ok(rule)
+}
+
 async fn put_expiration_config(client: &Client, bucket: &str, rule: LifecycleRule) -> TestResult {
    let lifecycle = BucketLifecycleConfiguration::builder().rules(rule).build()?;
    client
@@ -277,9 +327,94 @@ async fn test_lifecycle_versioned_current_version_expiry_creates_delete_marker()
    Ok(())
 }

+/// `NoncurrentVersionExpiration NoncurrentDays=1` on a versioned bucket,
+/// accelerated with `RUSTFS_ILM_DEBUG_DAY_SECS`. Proves the scanner purges the
+/// noncurrent data version from `ListObjectVersions` while preserving the
+/// latest version as the normal readable object and without creating a delete
+/// marker.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_lifecycle_noncurrent_version_expiry_removes_only_old_version() -> TestResult {
+    let mut env = RustFSTestEnvironment::new().await?;
+    let mut extra_env = fast_lifecycle_env();
+    extra_env.push(("RUSTFS_ILM_DEBUG_DAY_SECS", "2"));
+    env.start_rustfs_server_with_env(vec![], &extra_env).await?;
+
+    let client = env.create_s3_client();
+    let bucket = "ilm3-noncurrent";
+    client.create_bucket().bucket(bucket).send().await?;
+    client
+        .put_bucket_versioning()
+        .bucket(bucket)
+        .versioning_configuration(
+            VersioningConfiguration::builder()
+                .status(BucketVersioningStatus::Enabled)
+                .build(),
+        )
+        .send()
+        .await?;
+
+    let key = "versioned/noncurrent.txt";
+    let first_put = client
+        .put_object()
+        .bucket(bucket)
+        .key(key)
+        .body(ByteStream::from_static(b"old payload"))
+        .send()
+        .await?;
+    let old_version_id = first_put
+        .version_id()
+        .map(str::to_string)
+        .expect("first versioned PUT returns a version id");
+
+    let second_put = client
+        .put_object()
+        .bucket(bucket)
+        .key(key)
+        .body(ByteStream::from_static(b"latest payload"))
+        .send()
+        .await?;
+    let latest_version_id = second_put
+        .version_id()
+        .map(str::to_string)
+        .expect("second versioned PUT returns a version id");
+
+    assert!(
+        !version_is_absent_from_listing(&client, bucket, key, &old_version_id).await?,
+        "old noncurrent version must be readable before lifecycle is installed"
+    );
+
+    put_expiration_config(&client, bucket, noncurrent_expiration_rule("expire-noncurrent", "versioned/", 1)?).await?;
+
+    wait_for_version_expired(&client, bucket, key, &old_version_id, StdDuration::from_secs(90)).await?;
+
+    let latest = client.get_object().bucket(bucket).key(key).send().await?;
+    assert_eq!(latest.version_id(), Some(latest_version_id.as_str()));
+    assert_eq!(latest.body.collect().await?.into_bytes().as_ref(), b"latest payload");
+
+    let versions = client.list_object_versions().bucket(bucket).prefix(key).send().await?;
+    let data_versions = versions.versions();
+    assert!(
+        data_versions
+            .iter()
+            .any(|v| v.version_id() == Some(latest_version_id.as_str())),
+        "latest data version {latest_version_id} must remain, got: {data_versions:?}"
+    );
+    assert!(
+        !data_versions.iter().any(|v| v.version_id() == Some(old_version_id.as_str())),
+        "old noncurrent version {old_version_id} must be removed, got: {data_versions:?}"
+    );
+    assert!(
+        versions.delete_markers().is_empty(),
+        "noncurrent version expiry must not create delete markers, got: {:?}",
+        versions.delete_markers()
+    );
+
+    Ok(())
+}
+
 /// `Days=0` expiration is invalid per S3 semantics (`Days` must be a positive
 /// integer >= 1). A `PutBucketLifecycleConfiguration` carrying a zero-day rule
-/// must be rejected with `InvalidArgument` (HTTP 400) — see crates/lifecycle
+/// must be rejected with `InvalidArgument` (HTTP 400) - see crates/lifecycle
 /// `validate()` and the PutBucketLifecycleConfiguration handler. This is the
 /// self-managed counterpart of the localhost-only
 /// `test_bucket_lifecycle_rejects_zero_days` unit test.
@@ -2113,11 +2113,31 @@ async fn build_replication_pair(
 async fn test_replication_check_succeeds_with_remote_target() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

-    let (_source_env, _target_env, source_bucket) = build_replication_pair(true).await?;
-    let response = run_replication_check(&_source_env, &source_bucket).await?;
+    let (source_env, target_env, source_bucket) = build_replication_pair(true).await?;
+    let response = run_replication_check(&source_env, &source_bucket).await?;

    assert_eq!(response.status(), StatusCode::OK);
-    assert!(response.text().await?.is_empty());
+    let payload: serde_json::Value = response.json().await?;
+    assert_eq!(payload["Status"], "OK");
+    assert_eq!(payload["ActiveMutation"], true);
+    assert_eq!(payload["Targets"].as_array().map(Vec::len), Some(1));
+    assert_eq!(payload["Targets"][0]["Status"], "OK");
+    assert_eq!(payload["Targets"][0]["Phases"]["Put"]["Status"], "OK");
+    assert_eq!(payload["Targets"][0]["Phases"]["DeleteMarker"]["Status"], "OK");
+    assert_eq!(payload["Targets"][0]["Phases"]["VersionDelete"]["Status"], "OK");
+    assert_eq!(payload["Targets"][0]["Phases"]["Cleanup"]["Status"], "OK");
+
+    let target_client = target_env.create_s3_client();
+    let versions = target_client
+        .list_object_versions()
+        .bucket("replication-check-dst")
+        .prefix(".rustfs.sys/replication-check/")
+        .send()
+        .await?;
+    assert!(
+        versions.versions().is_empty() && versions.delete_markers().is_empty(),
+        "successful check must remove every probe version and delete marker"
+    );

    Ok(())
 }
@@ -2159,9 +2179,19 @@ async fn test_replication_check_rejects_target_without_object_lock() -> Result<(
    let status = response.status();
    let body = response.text().await?;

-    assert_eq!(status, StatusCode::BAD_REQUEST);
-    assert!(body.contains("InvalidRequest"), "unexpected response: {body}");
-    assert!(body.to_ascii_lowercase().contains("object lock"), "unexpected response: {body}");
+    assert_eq!(status, StatusCode::OK);
+    let payload: serde_json::Value = serde_json::from_str(&body)?;
+    assert_eq!(payload["Status"], "FAILED");
+    assert_eq!(payload["Targets"][0]["Status"], "FAILED");
+    assert_eq!(payload["Targets"][0]["Phases"]["ObjectLock"]["Status"], "FAILED");
+    assert!(
+        payload["Targets"][0]["Phases"]["ObjectLock"]["Error"]
+            .as_str()
+            .unwrap_or_default()
+            .contains("object lock"),
+        "unexpected response: {body}"
+    );
+    assert_eq!(payload["Targets"][0]["Phases"]["Put"]["Status"], "SKIPPED");

    Ok(())
 }
@@ -4773,6 +4803,153 @@ async fn test_site_replication_replicates_object_with_bucket_versioning_real_dua
    Ok(())
 }

+/// Re-applying a site's own replication config must not disable the peer's reverse direction.
+///
+/// `PutBucketReplication` broadcasts the config to every peer — the console's replication
+/// Save button, `mc replicate import`, and a bucket-metadata import all go through it. The
+/// receiver used to overwrite its rules with the sender's, whose destination ARN names the
+/// receiver itself. No bucket target can satisfy that ARN, so every object written on the
+/// receiver was dropped with only a debug line, while `replicate status` still reported
+/// "1/1 Buckets in sync" because both configs were byte-identical.
+#[tokio::test]
+#[serial]
+async fn test_site_replication_config_broadcast_keeps_reverse_direction_real_dual_node() -> TestResult {
+    init_logging();
+
+    let mut source_env = RustFSTestEnvironment::new().await?;
+    source_env
+        .start_rustfs_server_with_env(vec![], LOOPBACK_REPLICATION_TARGET_ENV)
+        .await?;
+
+    let mut target_env = RustFSTestEnvironment::new().await?;
+    target_env
+        .start_rustfs_server_without_cleanup_with_env(LOOPBACK_REPLICATION_TARGET_ENV)
+        .await?;
+
+    let source_client = source_env.create_s3_client();
+    let target_client = target_env.create_s3_client();
+    let bucket = "site-repl-config-broadcast";
+
+    let add_status = site_replication_add(
+        &source_env,
+        &[
+            PeerSite {
+                name: "broadcast-source".to_string(),
+                endpoint: source_env.url.clone(),
+                access_key: source_env.access_key.clone(),
+                secret_key: source_env.secret_key.clone(),
+                ..Default::default()
+            },
+            PeerSite {
+                name: "broadcast-target".to_string(),
+                endpoint: target_env.url.clone(),
+                access_key: target_env.access_key.clone(),
+                secret_key: target_env.secret_key.clone(),
+                ..Default::default()
+            },
+        ],
+    )
+    .await?;
+    assert!(add_status.success, "unexpected site add result: {add_status:?}");
+    wait_for_site_replication_enabled(&source_env, 2).await?;
+    wait_for_site_replication_enabled(&target_env, 2).await?;
+
+    source_client.create_bucket().bucket(bucket).send().await?;
+    wait_for_bucket_on_target(&target_client, bucket).await?;
+
+    // Both directions work before the broadcast.
+    source_client
+        .put_object()
+        .bucket(bucket)
+        .key("from-source.txt")
+        .body(ByteStream::from_static(b"written on the initiating site"))
+        .send()
+        .await?;
+    assert_eq!(
+        wait_for_object_on_target(&target_client, bucket, "from-source.txt").await?,
+        b"written on the initiating site".to_vec(),
+    );
+    target_client
+        .put_object()
+        .bucket(bucket)
+        .key("from-target.txt")
+        .body(ByteStream::from_static(b"written on the joined site"))
+        .send()
+        .await?;
+    assert_eq!(
+        wait_for_object_on_target(&source_client, bucket, "from-target.txt").await?,
+        b"written on the joined site".to_vec(),
+    );
+
+    // Round-trip the source's own config through PutBucketReplication, exactly what the
+    // console does when an operator opens the bucket's replication page and saves it.
+    let source_config = source_client
+        .get_bucket_replication()
+        .bucket(bucket)
+        .send()
+        .await?
+        .replication_configuration
+        .ok_or("source bucket has no replication configuration")?;
+    source_client
+        .put_bucket_replication()
+        .bucket(bucket)
+        .replication_configuration(source_config)
+        .send()
+        .await?;
+
+    let target_config = wait_for_site_replication_rule(&target_client, bucket).await?;
+    let target_deployment_id = site_replication_info(&target_env)
+        .await?
+        .sites
+        .iter()
+        .find(|peer| peer.endpoint == target_env.url)
+        .map(|peer| peer.deployment_id.clone())
+        .ok_or("joined site missing from its own replication info")?;
+    for rule in &target_config.rules {
+        let destination = rule
+            .destination
+            .as_ref()
+            .map(|destination| destination.bucket.as_str())
+            .unwrap_or_default();
+        assert!(
+            !destination.contains(&target_deployment_id),
+            "joined site adopted a rule pointing at itself: {destination}"
+        );
+    }
+
+    target_client
+        .put_object()
+        .bucket(bucket)
+        .key("from-target-after-broadcast.txt")
+        .body(ByteStream::from_static(b"written after the config broadcast"))
+        .send()
+        .await?;
+    assert_eq!(
+        wait_for_object_on_target(&source_client, bucket, "from-target-after-broadcast.txt").await?,
+        b"written after the config broadcast".to_vec(),
+        "config broadcast made replication one-directional"
+    );
+
+    Ok(())
+}
+
+async fn wait_for_site_replication_rule(
+    client: &aws_sdk_s3::Client,
+    bucket: &str,
+) -> Result<aws_sdk_s3::types::ReplicationConfiguration, Box<dyn Error + Send + Sync>> {
+    for _ in 0..40 {
+        if let Ok(response) = client.get_bucket_replication().bucket(bucket).send().await
+            && let Some(config) = response.replication_configuration
+            && !config.rules.is_empty()
+        {
+            return Ok(config);
+        }
+        sleep(Duration::from_millis(250)).await;
+    }
+
+    Err(format!("bucket {bucket} never reported a replication rule").into())
+}
+
 #[tokio::test]
 #[serial]
 async fn test_site_replication_active_active_converges_without_loops_real_dual_node() -> TestResult {
@@ -0,0 +1,474 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Black-box SSE-C CopyObject and multipart-copy regression coverage (backlog#1467).
+
+use crate::common::{RustFSTestEnvironment, init_logging};
+use aws_sdk_s3::config::interceptors::{BeforeDeserializationInterceptorContextRef, BeforeTransmitInterceptorContextRef};
+use aws_sdk_s3::config::{ConfigBag, Credentials, Intercept, Region, RuntimeComponents};
+use aws_sdk_s3::error::BoxError;
+use aws_sdk_s3::primitives::ByteStream;
+use aws_sdk_s3::types::{BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, VersioningConfiguration};
+use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
+use base64::Engine;
+use md5::{Digest as Md5Digest, Md5};
+use std::collections::HashMap;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+
+type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
+
+const SSE_CUSTOMER_ALGORITHM_HEADER: &str = "x-amz-server-side-encryption-customer-algorithm";
+const SSE_CUSTOMER_KEY_MD5_HEADER: &str = "x-amz-server-side-encryption-customer-key-md5";
+
+struct CustomerKey {
+    raw: String,
+    encoded: String,
+    md5: String,
+}
+
+struct InvalidSsec<'a> {
+    algorithm: Option<&'a str>,
+    key: Option<&'a str>,
+    md5: Option<&'a str>,
+}
+
+#[derive(Clone, Debug, Default)]
+struct ResponseHeaderCapture {
+    headers: Arc<Mutex<HashMap<String, String>>>,
+    abort_attempts: Arc<AtomicUsize>,
+}
+
+impl ResponseHeaderCapture {
+    fn snapshot(&self) -> Result<HashMap<String, String>, BoxError> {
+        self.headers
+            .lock()
+            .map(|headers| headers.clone())
+            .map_err(|_| std::io::Error::other("response header capture mutex was poisoned").into())
+    }
+
+    fn abort_attempts(&self) -> usize {
+        self.abort_attempts.load(Ordering::SeqCst)
+    }
+}
+
+impl Intercept for ResponseHeaderCapture {
+    fn name(&self) -> &'static str {
+        "ssec-copy-response-header-capture"
+    }
+
+    fn read_before_deserialization(
+        &self,
+        context: &BeforeDeserializationInterceptorContextRef<'_>,
+        _runtime_components: &RuntimeComponents,
+        _cfg: &mut ConfigBag,
+    ) -> Result<(), BoxError> {
+        let mut captured = self
+            .headers
+            .lock()
+            .map_err(|_| std::io::Error::other("response header capture mutex was poisoned"))?;
+        captured.clear();
+        for name in [SSE_CUSTOMER_ALGORITHM_HEADER, SSE_CUSTOMER_KEY_MD5_HEADER] {
+            if let Some(value) = context.response().headers().get(name) {
+                captured.insert(name.to_owned(), value.to_owned());
+            }
+        }
+        Ok(())
+    }
+
+    fn read_before_transmit(
+        &self,
+        context: &BeforeTransmitInterceptorContextRef<'_>,
+        _runtime_components: &RuntimeComponents,
+        _cfg: &mut ConfigBag,
+    ) -> Result<(), BoxError> {
+        let request = context.request();
+        if request.method() == "DELETE" && request.uri().contains("uploadId=") {
+            self.abort_attempts.fetch_add(1, Ordering::SeqCst);
+        }
+        Ok(())
+    }
+}
+
+fn customer_key(byte: u8) -> CustomerKey {
+    let raw = [byte; 32];
+    let mut hasher = Md5::new();
+    hasher.update(raw);
+    CustomerKey {
+        raw: String::from_utf8_lossy(&raw).into_owned(),
+        encoded: base64::engine::general_purpose::STANDARD.encode(raw),
+        md5: base64::engine::general_purpose::STANDARD.encode(hasher.finalize()),
+    }
+}
+
+fn assert_secret_absent(error: &str, keys: &[&CustomerKey]) {
+    for key in keys {
+        assert!(!error.contains(&key.raw), "error exposed a raw SSE-C key");
+        assert!(!error.contains(&key.encoded), "error exposed an encoded SSE-C key");
+        assert!(!error.contains(&key.md5), "error exposed an SSE-C key MD5");
+    }
+}
+
+fn invalid_ssec_cases<'a>(correct_key: &'a CustomerKey, wrong_key: &'a CustomerKey) -> [InvalidSsec<'a>; 5] {
+    [
+        InvalidSsec {
+            algorithm: None,
+            key: Some(&correct_key.encoded),
+            md5: Some(&correct_key.md5),
+        },
+        InvalidSsec {
+            algorithm: Some("AES256"),
+            key: None,
+            md5: Some(&correct_key.md5),
+        },
+        InvalidSsec {
+            algorithm: Some("AES256"),
+            key: Some(&correct_key.encoded),
+            md5: None,
+        },
+        InvalidSsec {
+            algorithm: Some("AES256"),
+            key: Some(&wrong_key.encoded),
+            md5: Some(&wrong_key.md5),
+        },
+        InvalidSsec {
+            algorithm: Some("AES256"),
+            key: Some(&correct_key.encoded),
+            md5: Some(&wrong_key.md5),
+        },
+    ]
+}
+
+#[tokio::test]
+async fn copy_object_rotates_ssec_key_and_drops_source_encryption_metadata() -> TestResult {
+    init_logging();
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(Vec::new()).await?;
+    let client = env.create_s3_client();
+    let bucket = "ssec-copy-object";
+    let source = "source.bin";
+    let plaintext_copy = "plaintext-copy.bin";
+    let rotated_copy = "rotated-copy.bin";
+    let source_key = customer_key(0x41);
+    let destination_key = customer_key(0x42);
+    let wrong_key = customer_key(0x43);
+    let body = b"backlog-1467 versioned SSE-C copy payload";
+
+    env.create_test_bucket(bucket).await?;
+    client
+        .put_bucket_versioning()
+        .bucket(bucket)
+        .versioning_configuration(
+            VersioningConfiguration::builder()
+                .status(BucketVersioningStatus::Enabled)
+                .build(),
+        )
+        .send()
+        .await?;
+    let put = client
+        .put_object()
+        .bucket(bucket)
+        .key(source)
+        .sse_customer_algorithm("AES256")
+        .sse_customer_key(&source_key.encoded)
+        .sse_customer_key_md5(&source_key.md5)
+        .body(ByteStream::from_static(body))
+        .send()
+        .await?;
+    let source_version = put.version_id().ok_or("versioned PUT returned no version ID")?;
+    let copy_source = format!("{bucket}/{source}?versionId={source_version}");
+
+    let plaintext = client
+        .copy_object()
+        .bucket(bucket)
+        .key(plaintext_copy)
+        .copy_source(&copy_source)
+        .copy_source_sse_customer_algorithm("AES256")
+        .copy_source_sse_customer_key(&source_key.encoded)
+        .copy_source_sse_customer_key_md5(&source_key.md5)
+        .send()
+        .await?;
+    assert_eq!(plaintext.copy_source_version_id(), Some(source_version));
+    let plaintext_body = client
+        .get_object()
+        .bucket(bucket)
+        .key(plaintext_copy)
+        .send()
+        .await?
+        .body
+        .collect()
+        .await?
+        .into_bytes();
+    assert_eq!(plaintext_body.as_ref(), body);
+
+    let rotated = client
+        .copy_object()
+        .bucket(bucket)
+        .key(rotated_copy)
+        .copy_source(&copy_source)
+        .copy_source_sse_customer_algorithm("AES256")
+        .copy_source_sse_customer_key(&source_key.encoded)
+        .copy_source_sse_customer_key_md5(&source_key.md5)
+        .sse_customer_algorithm("AES256")
+        .sse_customer_key(&destination_key.encoded)
+        .sse_customer_key_md5(&destination_key.md5)
+        .send()
+        .await?;
+    assert_eq!(rotated.sse_customer_algorithm(), Some("AES256"));
+    assert_eq!(rotated.sse_customer_key_md5(), Some(destination_key.md5.as_str()));
+
+    let wrong_key_error = client
+        .get_object()
+        .bucket(bucket)
+        .key(rotated_copy)
+        .sse_customer_algorithm("AES256")
+        .sse_customer_key(&source_key.encoded)
+        .sse_customer_key_md5(&source_key.md5)
+        .send()
+        .await
+        .expect_err("the source key must not read a copy encrypted with the destination key");
+    assert_secret_absent(&format!("{wrong_key_error:?}"), &[&source_key, &destination_key]);
+
+    let rotated_body = client
+        .get_object()
+        .bucket(bucket)
+        .key(rotated_copy)
+        .sse_customer_algorithm("AES256")
+        .sse_customer_key(&destination_key.encoded)
+        .sse_customer_key_md5(&destination_key.md5)
+        .send()
+        .await?
+        .body
+        .collect()
+        .await?
+        .into_bytes();
+    assert_eq!(rotated_body.as_ref(), body);
+
+    for (case_index, case) in invalid_ssec_cases(&source_key, &wrong_key).iter().enumerate() {
+        let failed_target = format!("failed-copy-{case_index}.bin");
+        let mut request = client
+            .copy_object()
+            .bucket(bucket)
+            .key(&failed_target)
+            .copy_source(&copy_source);
+        if let Some(algorithm) = case.algorithm {
+            request = request.copy_source_sse_customer_algorithm(algorithm);
+        }
+        if let Some(key) = case.key {
+            request = request.copy_source_sse_customer_key(key);
+        }
+        if let Some(md5) = case.md5 {
+            request = request.copy_source_sse_customer_key_md5(md5);
+        }
+        let error = request
+            .send()
+            .await
+            .expect_err("invalid source SSE-C parameters must reject CopyObject");
+        assert_secret_absent(&format!("{error:?}"), &[&source_key, &wrong_key]);
+        assert!(
+            client.head_object().bucket(bucket).key(&failed_target).send().await.is_err(),
+            "a rejected CopyObject must not create its target"
+        );
+    }
+    env.stop_server();
+    Ok(())
+}
+
+#[tokio::test]
+async fn multipart_copy_requires_keys_on_every_stage_and_abort_leaves_no_object() -> TestResult {
+    init_logging();
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(Vec::new()).await?;
+    let response_headers = ResponseHeaderCapture::default();
+    let credentials = Credentials::new(&env.access_key, &env.secret_key, None, None, "ssec-copy-e2e");
+    let config = aws_sdk_s3::Config::builder()
+        .credentials_provider(credentials)
+        .region(Region::new("us-east-1"))
+        .endpoint_url(&env.url)
+        .force_path_style(true)
+        .behavior_version_latest()
+        .http_client(SmithyHttpClientBuilder::new().build_http())
+        .interceptor(response_headers.clone())
+        .build();
+    let client = aws_sdk_s3::Client::from_conf(config);
+    let bucket = "ssec-multipart-copy";
+    let source = "source.bin";
+    let destination = "destination.bin";
+    let aborted_destination = "aborted.bin";
+    let source_key = customer_key(0x51);
+    let destination_key = customer_key(0x52);
+    let wrong_key = customer_key(0x53);
+    let part_size = 5 * 1024 * 1024;
+    let body: Vec<u8> = (0..part_size * 2).map(|index| (index % 251) as u8).collect();
+
+    env.create_test_bucket(bucket).await?;
+    client
+        .put_bucket_versioning()
+        .bucket(bucket)
+        .versioning_configuration(
+            VersioningConfiguration::builder()
+                .status(BucketVersioningStatus::Enabled)
+                .build(),
+        )
+        .send()
+        .await?;
+    let source_put = client
+        .put_object()
+        .bucket(bucket)
+        .key(source)
+        .sse_customer_algorithm("AES256")
+        .sse_customer_key(&source_key.encoded)
+        .sse_customer_key_md5(&source_key.md5)
+        .body(ByteStream::from(body.clone()))
+        .send()
+        .await?;
+    let source_version = source_put
+        .version_id()
+        .ok_or("versioned multipart-copy source returned no version ID")?;
+
+    let create = client
+        .create_multipart_upload()
+        .bucket(bucket)
+        .key(destination)
+        .sse_customer_algorithm("AES256")
+        .sse_customer_key(&destination_key.encoded)
+        .sse_customer_key_md5(&destination_key.md5)
+        .send()
+        .await?;
+    assert_eq!(create.sse_customer_algorithm(), Some("AES256"));
+    assert_eq!(create.sse_customer_key_md5(), Some(destination_key.md5.as_str()));
+    let upload_id = create.upload_id().ok_or("CreateMultipartUpload returned no upload ID")?;
+    let mut completed = Vec::new();
+    for part_number in 1..=2 {
+        let first = (part_number - 1) * part_size;
+        let last = part_number * part_size - 1;
+        let copied = client
+            .upload_part_copy()
+            .bucket(bucket)
+            .key(destination)
+            .upload_id(upload_id)
+            .part_number(part_number)
+            .copy_source(format!("{bucket}/{source}"))
+            .copy_source_range(format!("bytes={first}-{last}"))
+            .copy_source_sse_customer_algorithm("AES256")
+            .copy_source_sse_customer_key(&source_key.encoded)
+            .copy_source_sse_customer_key_md5(&source_key.md5)
+            .sse_customer_algorithm("AES256")
+            .sse_customer_key(&destination_key.encoded)
+            .sse_customer_key_md5(&destination_key.md5)
+            .send()
+            .await?;
+        assert_eq!(
+            copied.copy_source_version_id(),
+            Some(source_version),
+            "UploadPartCopy must return the actual latest source version"
+        );
+        let etag = copied
+            .copy_part_result()
+            .and_then(|result| result.e_tag())
+            .ok_or("UploadPartCopy returned no ETag")?;
+        completed.push(CompletedPart::builder().part_number(part_number).e_tag(etag).build());
+    }
+    client
+        .complete_multipart_upload()
+        .bucket(bucket)
+        .key(destination)
+        .upload_id(upload_id)
+        .sse_customer_algorithm("AES256")
+        .sse_customer_key(&destination_key.encoded)
+        .sse_customer_key_md5(&destination_key.md5)
+        .multipart_upload(CompletedMultipartUpload::builder().set_parts(Some(completed)).build())
+        .send()
+        .await?;
+    let completed_headers = response_headers.snapshot()?;
+    assert_eq!(completed_headers.get(SSE_CUSTOMER_ALGORITHM_HEADER).map(String::as_str), Some("AES256"));
+    assert_eq!(
+        completed_headers.get(SSE_CUSTOMER_KEY_MD5_HEADER).map(String::as_str),
+        Some(destination_key.md5.as_str())
+    );
+    let downloaded = client
+        .get_object()
+        .bucket(bucket)
+        .key(destination)
+        .sse_customer_algorithm("AES256")
+        .sse_customer_key(&destination_key.encoded)
+        .sse_customer_key_md5(&destination_key.md5)
+        .send()
+        .await?
+        .body
+        .collect()
+        .await?
+        .into_bytes();
+    assert_eq!(downloaded.as_ref(), body.as_slice());
+
+    for (case_index, case) in invalid_ssec_cases(&destination_key, &wrong_key).iter().enumerate() {
+        let failed_target = format!("{aborted_destination}-{case_index}");
+        let failed_create = client
+            .create_multipart_upload()
+            .bucket(bucket)
+            .key(&failed_target)
+            .sse_customer_algorithm("AES256")
+            .sse_customer_key(&destination_key.encoded)
+            .sse_customer_key_md5(&destination_key.md5)
+            .send()
+            .await?;
+        let failed_upload_id = failed_create
+            .upload_id()
+            .ok_or("CreateMultipartUpload returned no upload ID")?;
+        let mut request = client
+            .upload_part_copy()
+            .bucket(bucket)
+            .key(&failed_target)
+            .upload_id(failed_upload_id)
+            .part_number(1)
+            .copy_source(format!("{bucket}/{source}"))
+            .copy_source_sse_customer_algorithm("AES256")
+            .copy_source_sse_customer_key(&source_key.encoded)
+            .copy_source_sse_customer_key_md5(&source_key.md5);
+        if let Some(algorithm) = case.algorithm {
+            request = request.sse_customer_algorithm(algorithm);
+        }
+        if let Some(key) = case.key {
+            request = request.sse_customer_key(key);
+        }
+        if let Some(md5) = case.md5 {
+            request = request.sse_customer_key_md5(md5);
+        }
+        let error = request
+            .send()
+            .await
+            .expect_err("invalid destination SSE-C parameters must reject UploadPartCopy");
+        assert_secret_absent(&format!("{error:?}"), &[&source_key, &destination_key, &wrong_key]);
+
+        let abort_attempts_before = response_headers.abort_attempts();
+        client
+            .abort_multipart_upload()
+            .bucket(bucket)
+            .key(&failed_target)
+            .upload_id(failed_upload_id)
+            .send()
+            .await?;
+        assert_eq!(
+            response_headers.abort_attempts(),
+            abort_attempts_before + 1,
+            "each failed multipart copy must issue exactly one wire-level abort attempt"
+        );
+        assert!(
+            client.head_object().bucket(bucket).key(&failed_target).send().await.is_err(),
+            "an aborted failed multipart copy must leave no completed object"
+        );
+    }
+    env.stop_server();
+    Ok(())
+}
@@ -16,7 +16,12 @@
 pub(crate) use rustfs_ecstore::api::bucket::bucket_target_sys::BucketTargetSys;
 #[cfg(test)]
 pub(crate) use rustfs_ecstore::api::disk::{VolumeInfo, WalkDirOptions};
-pub(crate) use rustfs_ecstore::api::rpc::{TonicInterceptor, node_service_time_out_client_no_auth};
+pub(crate) use rustfs_ecstore::api::rpc::{AuthenticatedChannel, TonicInterceptor, node_service_time_out_client_no_auth};
+#[cfg(test)]
+pub(crate) use rustfs_ecstore::api::rpc::{
+    TONIC_RPC_PREFIX, gen_signature_headers, gen_tonic_replay_scope_headers, gen_tonic_signature_headers,
+    verify_tonic_boot_epoch_response,
+};
 #[cfg(test)]
 pub(crate) use rustfs_ecstore::api::rpc::{gen_tonic_signature_interceptor, node_service_time_out_client};

@@ -28,7 +33,19 @@ pub(crate) mod node_interact {
 }

 pub(crate) mod grpc_lock {
-    pub(crate) use super::{TonicInterceptor, node_service_time_out_client_no_auth};
+    pub(crate) use super::{AuthenticatedChannel, TonicInterceptor, node_service_time_out_client_no_auth};
+}
+
+/// Signing/transport surface used by the cross-process internode RPC signature
+/// acceptance tests (backlog#1327). The signing helpers are what let a test mint
+/// the one legitimately signed request an on-path attacker is assumed to have
+/// captured; every attack in that suite then only *reuses* those bytes.
+#[cfg(test)]
+pub(crate) mod internode_rpc_signature {
+    pub(crate) use super::{
+        TONIC_RPC_PREFIX, gen_signature_headers, gen_tonic_replay_scope_headers, gen_tonic_signature_headers,
+        node_service_time_out_client_no_auth, verify_tonic_boot_epoch_response,
+    };
 }

 #[cfg(test)]
@@ -0,0 +1,428 @@
+// Copyright 2026 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Truthful storage-class write and discovery contract regressions.
+
+#[cfg(test)]
+mod tests {
+    use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
+    use aws_sdk_s3::Client;
+    use aws_sdk_s3::error::ProvideErrorMetadata;
+    use aws_sdk_s3::primitives::ByteStream;
+    use aws_sdk_s3::types::{ObjectAttributes, StorageClass};
+    use http::header::HOST;
+    use reqwest::StatusCode;
+    use rustfs_signer::constants::UNSIGNED_PAYLOAD;
+    use rustfs_signer::sign_v4;
+    use s3s::Body;
+    use serde_json::Value;
+    use std::error::Error;
+    use std::path::Path;
+
+    const UNSUPPORTED_AWS_CLASSES: [&str; 9] = [
+        "DEEP_ARCHIVE",
+        "EXPRESS_ONEZONE",
+        "GLACIER",
+        "GLACIER_IR",
+        "INTELLIGENT_TIERING",
+        "ONEZONE_IA",
+        "OUTPOSTS",
+        "SNOW",
+        "STANDARD_IA",
+    ];
+
+    async fn assert_object_storage_class(
+        client: &Client,
+        bucket: &str,
+        key: &str,
+        expected: &str,
+        body: &[u8],
+    ) -> Result<(), Box<dyn Error + Send + Sync>> {
+        let head = client.head_object().bucket(bucket).key(key).send().await?;
+        let expected_head = (expected != "STANDARD").then_some(expected);
+        assert_eq!(
+            head.storage_class().map(StorageClass::as_str),
+            expected_head,
+            "HeadObject must omit implicit STANDARD and report RRS"
+        );
+
+        let listed = client.list_objects_v2().bucket(bucket).prefix(key).send().await?;
+        let object = listed
+            .contents()
+            .iter()
+            .find(|object| object.key() == Some(key))
+            .ok_or("object missing from ListObjectsV2")?;
+        assert_eq!(object.storage_class().map(|storage_class| storage_class.as_str()), Some(expected));
+
+        let get = client.get_object().bucket(bucket).key(key).send().await?;
+        assert_eq!(
+            get.storage_class().map(StorageClass::as_str),
+            expected_head,
+            "GetObject must report the same effective storage class as HeadObject"
+        );
+        let downloaded = get.body.collect().await?.into_bytes();
+        assert_eq!(downloaded.as_ref(), body, "storage-class selection must not alter object bytes");
+        Ok(())
+    }
+
+    async fn mutate_xl_meta(
+        root: &str,
+        bucket: &str,
+        key: &str,
+        mutate: impl FnOnce(&mut rustfs_filemeta::MetaObject),
+    ) -> Result<(), Box<dyn Error + Send + Sync>> {
+        let path = Path::new(root).join(bucket).join(key).join("xl.meta");
+        let bytes = tokio::fs::read(&path).await?;
+        let mut file_meta = rustfs_filemeta::FileMeta::load(&bytes)?;
+        let (index, mut version) = file_meta.find_version(None)?;
+        let object = version.object.as_mut().ok_or("fixture version is not an object")?;
+        mutate(object);
+        file_meta.versions[index] = rustfs_filemeta::FileMetaShallowVersion::try_from(version)?;
+        tokio::fs::write(path, file_meta.marshal_msg()?).await?;
+        Ok(())
+    }
+
+    async fn signed_admin_get(
+        env: &RustFSTestEnvironment,
+        path: &str,
+    ) -> Result<reqwest::Response, Box<dyn Error + Send + Sync>> {
+        let url = format!("{}{path}", env.url);
+        let uri = url.parse::<http::Uri>()?;
+        let authority = uri.authority().ok_or("admin URL missing authority")?.to_string();
+        let request = http::Request::builder()
+            .method(http::Method::GET)
+            .uri(uri)
+            .header(HOST, authority)
+            .header("x-amz-content-sha256", UNSIGNED_PAYLOAD)
+            .body(Body::empty())?;
+        let signed = sign_v4(request, 0, &env.access_key, &env.secret_key, "", "us-east-1");
+
+        let mut request = local_http_client().get(&url);
+        for (name, value) in signed.headers() {
+            request = request.header(name, value);
+        }
+        Ok(request.send().await?)
+    }
+
+    #[tokio::test]
+    async fn standard_and_rrs_are_supported_across_put_copy_and_multipart() -> Result<(), Box<dyn Error + Send + Sync>> {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(Vec::new()).await?;
+        let client = env.create_s3_client();
+        let bucket = "storage-class-supported-contract";
+        env.create_test_bucket(bucket).await?;
+
+        client
+            .put_object()
+            .bucket(bucket)
+            .key("copy-source")
+            .body(ByteStream::from_static(b"copy-source-body"))
+            .send()
+            .await?;
+
+        for storage_class in [StorageClass::Standard, StorageClass::ReducedRedundancy] {
+            let class_name = storage_class.as_str().to_string();
+            let put_key = format!("put-{class_name}");
+            let put_body = format!("put-body-{class_name}").into_bytes();
+            client
+                .put_object()
+                .bucket(bucket)
+                .key(&put_key)
+                .storage_class(storage_class.clone())
+                .body(ByteStream::from(put_body.clone()))
+                .send()
+                .await?;
+            assert_object_storage_class(&client, bucket, &put_key, &class_name, &put_body).await?;
+
+            let copy_key = format!("copy-{class_name}");
+            client
+                .copy_object()
+                .bucket(bucket)
+                .key(&copy_key)
+                .copy_source(format!("{bucket}/copy-source"))
+                .storage_class(storage_class.clone())
+                .send()
+                .await?;
+            assert_object_storage_class(&client, bucket, &copy_key, &class_name, b"copy-source-body").await?;
+
+            let multipart_key = format!("multipart-{class_name}");
+            let created = client
+                .create_multipart_upload()
+                .bucket(bucket)
+                .key(&multipart_key)
+                .storage_class(storage_class)
+                .send()
+                .await?;
+            let upload_id = created.upload_id().ok_or("CreateMultipartUpload returned no upload ID")?;
+            let parts = client
+                .list_parts()
+                .bucket(bucket)
+                .key(&multipart_key)
+                .upload_id(upload_id)
+                .send()
+                .await?;
+            assert_eq!(parts.storage_class().map(StorageClass::as_str), Some(class_name.as_str()));
+            client
+                .abort_multipart_upload()
+                .bucket(bucket)
+                .key(&multipart_key)
+                .upload_id(upload_id)
+                .send()
+                .await?;
+        }
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn label_only_aws_classes_fail_before_put_copy_or_multipart_mutation() -> Result<(), Box<dyn Error + Send + Sync>> {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(Vec::new()).await?;
+        let client = env.create_s3_client();
+        let bucket = "storage-class-unsupported-contract";
+        env.create_test_bucket(bucket).await?;
+
+        for key in ["put-guard", "copy-source", "copy-guard"] {
+            client
+                .put_object()
+                .bucket(bucket)
+                .key(key)
+                .body(ByteStream::from(format!("original-{key}").into_bytes()))
+                .send()
+                .await?;
+        }
+
+        for unsupported in UNSUPPORTED_AWS_CLASSES {
+            let put_error = client
+                .put_object()
+                .bucket(bucket)
+                .key("put-guard")
+                .storage_class(StorageClass::from(unsupported))
+                .body(ByteStream::from(format!("rejected-put-{unsupported}").into_bytes()))
+                .send()
+                .await
+                .expect_err("label-only PUT storage class must be rejected");
+            assert_eq!(
+                put_error.as_service_error().and_then(ProvideErrorMetadata::code),
+                Some("InvalidStorageClass"),
+                "PUT returned a different error for {unsupported}"
+            );
+
+            let copy_error = client
+                .copy_object()
+                .bucket(bucket)
+                .key("copy-guard")
+                .copy_source(format!("{bucket}/copy-source"))
+                .storage_class(StorageClass::from(unsupported))
+                .send()
+                .await
+                .expect_err("label-only CopyObject storage class must be rejected");
+            assert_eq!(
+                copy_error.as_service_error().and_then(ProvideErrorMetadata::code),
+                Some("InvalidStorageClass"),
+                "CopyObject returned a different error for {unsupported}"
+            );
+
+            let multipart_key = format!("multipart-{unsupported}");
+            let multipart_error = client
+                .create_multipart_upload()
+                .bucket(bucket)
+                .key(&multipart_key)
+                .storage_class(StorageClass::from(unsupported))
+                .send()
+                .await
+                .expect_err("label-only CreateMultipartUpload storage class must be rejected");
+            assert_eq!(
+                multipart_error.as_service_error().and_then(ProvideErrorMetadata::code),
+                Some("InvalidStorageClass"),
+                "CreateMultipartUpload returned a different error for {unsupported}"
+            );
+        }
+
+        let put_guard = client
+            .get_object()
+            .bucket(bucket)
+            .key("put-guard")
+            .send()
+            .await?
+            .body
+            .collect()
+            .await?
+            .into_bytes();
+        assert_eq!(put_guard.as_ref(), b"original-put-guard");
+
+        let copy_guard = client
+            .get_object()
+            .bucket(bucket)
+            .key("copy-guard")
+            .send()
+            .await?
+            .body
+            .collect()
+            .await?
+            .into_bytes();
+        assert_eq!(copy_guard.as_ref(), b"original-copy-guard");
+
+        let uploads = client.list_multipart_uploads().bucket(bucket).send().await?;
+        assert!(uploads.uploads().is_empty(), "unsupported classes must not create multipart sessions");
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn historical_label_only_metadata_is_standard_without_hiding_a_real_transition_tier()
+    -> Result<(), Box<dyn Error + Send + Sync>> {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(Vec::new()).await?;
+        let client = env.create_s3_client();
+        let bucket = "storage-class-historical-contract";
+        let legacy_key = "legacy-label-only";
+        let transitioned_key = "real-transition-tier";
+        env.create_test_bucket(bucket).await?;
+
+        for key in [legacy_key, transitioned_key] {
+            client
+                .put_object()
+                .bucket(bucket)
+                .key(key)
+                .body(ByteStream::from_static(b"fixture-body"))
+                .send()
+                .await?;
+        }
+
+        env.stop_server();
+        mutate_xl_meta(&env.temp_dir, bucket, legacy_key, |object| {
+            object
+                .meta_user
+                .insert("x-amz-storage-class".to_string(), "STANDARD_IA".to_string());
+        })
+        .await?;
+        mutate_xl_meta(&env.temp_dir, bucket, transitioned_key, |object| {
+            object.set_transition(&rustfs_filemeta::FileInfo {
+                transition_status: rustfs_filemeta::TRANSITION_COMPLETE.to_string(),
+                transition_tier: "STANDARD_IA".to_string(),
+                ..Default::default()
+            });
+        })
+        .await?;
+        env.restart_server_preserving_data(Vec::new(), &[]).await?;
+
+        assert_object_storage_class(&client, bucket, legacy_key, "STANDARD", b"fixture-body").await?;
+
+        let legacy_attributes = client
+            .get_object_attributes()
+            .bucket(bucket)
+            .key(legacy_key)
+            .object_attributes(ObjectAttributes::StorageClass)
+            .send()
+            .await?;
+        assert_eq!(legacy_attributes.storage_class().map(StorageClass::as_str), Some("STANDARD"));
+
+        let versions = client.list_object_versions().bucket(bucket).prefix(legacy_key).send().await?;
+        let legacy_version = versions
+            .versions()
+            .iter()
+            .find(|version| version.key() == Some(legacy_key))
+            .ok_or("legacy fixture missing from ListObjectVersions")?;
+        assert_eq!(legacy_version.storage_class().map(|class| class.as_str()), Some("STANDARD"));
+
+        let transitioned_head = client.head_object().bucket(bucket).key(transitioned_key).send().await?;
+        assert_eq!(transitioned_head.storage_class().map(StorageClass::as_str), Some("STANDARD_IA"));
+        let transitioned_attributes = client
+            .get_object_attributes()
+            .bucket(bucket)
+            .key(transitioned_key)
+            .object_attributes(ObjectAttributes::StorageClass)
+            .send()
+            .await?;
+        assert_eq!(transitioned_attributes.storage_class().map(StorageClass::as_str), Some("STANDARD_IA"));
+        let transitioned_list = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .prefix(transitioned_key)
+            .send()
+            .await?;
+        assert_eq!(
+            transitioned_list.contents()[0].storage_class().map(|class| class.as_str()),
+            Some("STANDARD_IA")
+        );
+        let transitioned_versions = client
+            .list_object_versions()
+            .bucket(bucket)
+            .prefix(transitioned_key)
+            .send()
+            .await?;
+        assert_eq!(
+            transitioned_versions.versions()[0]
+                .storage_class()
+                .map(|class| class.as_str()),
+            Some("STANDARD_IA")
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn authenticated_runtime_capabilities_publish_the_versioned_storage_class_contract()
+    -> Result<(), Box<dyn Error + Send + Sync>> {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(Vec::new()).await?;
+        let path = "/rustfs/admin/v4/runtime/capabilities";
+
+        let unsigned = local_http_client().get(format!("{}{path}", env.url)).send().await?;
+        assert_eq!(unsigned.status(), StatusCode::FORBIDDEN);
+        let unsigned_body = unsigned.text().await?;
+        assert!(
+            !unsigned_body.contains("supported_write_classes"),
+            "the capability contract must not bypass admin authentication"
+        );
+        assert!(
+            !unsigned_body.contains("manual_transition_jobs"),
+            "manual transition job capabilities must not bypass admin authentication"
+        );
+
+        let response = signed_admin_get(&env, path).await?;
+        assert_eq!(response.status(), StatusCode::OK);
+        let body: Value = response.json().await?;
+        assert_eq!(body["storage_classes"]["contract_version"], 1);
+        assert_eq!(
+            body["storage_classes"]["supported_write_classes"],
+            serde_json::json!(["STANDARD", "REDUCED_REDUNDANCY"])
+        );
+        assert_eq!(body["storage_classes"]["unsupported_write_error"], "InvalidStorageClass");
+        assert_eq!(body["storage_classes"]["legacy_label_behavior"], "normalized_to_effective_class");
+        assert_eq!(body["summary"]["manual_transition_jobs"]["state"], "supported");
+        assert_eq!(body["manual_transition_jobs"]["contract_version"], 1);
+        assert_eq!(body["manual_transition_jobs"]["status"]["state"], "supported");
+        assert_eq!(body["manual_transition_jobs"]["modes"], serde_json::json!(["enqueue_only", "async"]));
+        assert_eq!(body["manual_transition_jobs"]["run_route"], "/rustfs/admin/v3/ilm/transition/run");
+        assert_eq!(
+            body["manual_transition_jobs"]["status_route"],
+            "/rustfs/admin/v3/ilm/transition/jobs/{job_id}"
+        );
+        assert_eq!(
+            body["manual_transition_jobs"]["cancel_route"],
+            "/rustfs/admin/v3/ilm/transition/jobs/{job_id}"
+        );
+        assert_eq!(body["manual_transition_jobs"]["job_id_format"], "uuid");
+        assert_eq!(body["manual_transition_jobs"]["admission_scope"], "bucket");
+        assert_eq!(
+            body["manual_transition_jobs"]["mixed_version_policy"],
+            "fail_closed_when_capability_unknown_or_unsupported"
+        );
+        Ok(())
+    }
+}
@@ -0,0 +1,613 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::common::{RustFSTestEnvironment, admin_ok, init_logging};
+use aws_sdk_sts::config::retry::RetryConfig;
+use aws_sdk_sts::config::{Credentials, Region};
+use aws_sdk_sts::error::ProvideErrorMetadata;
+use aws_sdk_sts::operation::RequestId;
+use aws_sdk_sts::{Client, Config};
+use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
+use bytes::Bytes;
+use http::header::{AUTHORIZATION, CONTENT_TYPE};
+use http::{Request, Response};
+use http_body_util::{BodyExt, Full};
+use hyper::body::Incoming;
+use hyper::server::conn::http1;
+use hyper::service::service_fn;
+use hyper_util::rt::TokioIo;
+use serde_json::Value;
+use serial_test::serial;
+use std::collections::BTreeSet;
+use std::convert::Infallible;
+use std::error::Error;
+use std::sync::Arc;
+use tokio::net::TcpListener;
+use tokio::sync::{Notify, mpsc};
+use tokio::task::{JoinHandle, JoinSet};
+use tokio::time::{Duration, timeout};
+
+type BoxError = Box<dyn Error + Send + Sync>;
+type TestResult = Result<(), BoxError>;
+const OPA_AUTH_TOKEN: &str = "sts-opa-token";
+
+fn sts_client(url: &str, access_key: &str, secret_key: &str, session_token: Option<&str>) -> Client {
+    let mut config = Config::builder()
+        .credentials_provider(Credentials::new(
+            access_key,
+            secret_key,
+            session_token.map(str::to_owned),
+            None,
+            "e2e-sts-query-compat",
+        ))
+        .region(Region::new("us-east-1"))
+        .endpoint_url(url)
+        .retry_config(RetryConfig::standard().with_max_attempts(1))
+        .behavior_version_latest();
+    if url.starts_with("http://") {
+        config = config.http_client(SmithyHttpClientBuilder::new().build_http());
+    }
+    Client::from_conf(config.build())
+}
+
+async fn create_root_service_account(env: &RustFSTestEnvironment) -> Result<(String, String), BoxError> {
+    let body = admin_ok(
+        env,
+        http::Method::PUT,
+        "/rustfs/admin/v3/add-service-accounts",
+        Some(serde_json::json!({ "targetUser": env.access_key.clone() }).to_string()),
+    )
+    .await?;
+    let response: Value = serde_json::from_str(&body)?;
+    let access_key = response["credentials"]["accessKey"]
+        .as_str()
+        .ok_or("service account response should contain credentials.accessKey")?
+        .to_owned();
+    let secret_key = response["credentials"]["secretKey"]
+        .as_str()
+        .ok_or("service account response should contain credentials.secretKey")?
+        .to_owned();
+    Ok((access_key, secret_key))
+}
+
+async fn create_user_with_policy(
+    env: &RustFSTestEnvironment,
+    user: &str,
+    secret: &str,
+    policy_name: &str,
+    statements: Value,
+) -> TestResult {
+    create_user(env, user, secret).await?;
+    admin_ok(
+        env,
+        http::Method::PUT,
+        &format!("/rustfs/admin/v3/add-canned-policy?name={policy_name}"),
+        Some(
+            serde_json::json!({
+                "Version": "2012-10-17",
+                "Statement": statements,
+            })
+            .to_string(),
+        ),
+    )
+    .await?;
+    admin_ok(
+        env,
+        http::Method::POST,
+        "/rustfs/admin/v3/idp/builtin/policy/attach",
+        Some(serde_json::json!({ "policies": [policy_name], "user": user }).to_string()),
+    )
+    .await?;
+    Ok(())
+}
+
+async fn create_user(env: &RustFSTestEnvironment, user: &str, secret: &str) -> TestResult {
+    admin_ok(
+        env,
+        http::Method::PUT,
+        &format!("/rustfs/admin/v3/add-user?accessKey={user}"),
+        Some(serde_json::json!({ "secretKey": secret, "status": "enabled" }).to_string()),
+    )
+    .await?;
+    Ok(())
+}
+
+async fn assert_access_denied(client: &Client, context: &str) -> TestResult {
+    let error = client
+        .assume_role()
+        .role_arn("arn:aws:iam::123456789012:role/test")
+        .role_session_name("sts-query-compat-e2e")
+        .send()
+        .await
+        .expect_err("AssumeRole must be denied");
+    let service_error = error
+        .as_service_error()
+        .ok_or_else(|| format!("{context} should deserialize as an STS service error: {error:?}"))?;
+
+    assert_eq!(error.raw_response().map(|response| response.status().as_u16()), Some(403));
+    assert_eq!(service_error.code(), Some("AccessDenied"));
+    assert_eq!(service_error.message(), Some("Access Denied"));
+    assert!(
+        error.request_id().is_some_and(|request_id| !request_id.is_empty()),
+        "{context} should include a request ID"
+    );
+    Ok(())
+}
+
+async fn handle_opa_request(
+    request: Request<Incoming>,
+    requests: mpsc::UnboundedSender<Value>,
+    validation_started: mpsc::UnboundedSender<()>,
+    validation_mode: OpaValidationMode,
+    expected_authorization: Option<String>,
+) -> Result<Response<Full<Bytes>>, Infallible> {
+    if let Some(expected_authorization) = expected_authorization
+        && request.headers().get(AUTHORIZATION).and_then(|value| value.to_str().ok()) != Some(expected_authorization.as_str())
+    {
+        return Ok(Response::builder()
+            .status(401)
+            .body(Full::new(Bytes::new()))
+            .expect("static OPA unauthorized response must be valid"));
+    }
+
+    let body = match request.into_body().collect().await {
+        Ok(body) => body.to_bytes(),
+        Err(error) => {
+            return Ok(Response::builder()
+                .status(400)
+                .body(Full::new(Bytes::from(error.to_string())))
+                .expect("static OPA error response must be valid"));
+        }
+    };
+
+    let payload = if body.is_empty() {
+        None
+    } else {
+        match serde_json::from_slice::<Value>(&body) {
+            Ok(payload) => Some(payload),
+            Err(error) => {
+                return Ok(Response::builder()
+                    .status(400)
+                    .body(Full::new(Bytes::from(error.to_string())))
+                    .expect("static OPA error response must be valid"));
+            }
+        }
+    };
+    if payload.is_none() {
+        let _ = validation_started.send(());
+        if let OpaValidationMode::DelayedUnavailable(release) = validation_mode {
+            release.notified().await;
+            return Ok(Response::builder()
+                .status(503)
+                .body(Full::new(Bytes::new()))
+                .expect("static OPA unavailable response must be valid"));
+        }
+    }
+    let allow = match payload.as_ref().and_then(|value| value.pointer("/input/identity/account")) {
+        Some(Value::String(account)) if account == "opaallow" => payload
+            .as_ref()
+            .and_then(|value| value.pointer("/input/context/deny_only"))
+            .and_then(Value::as_bool)
+            .unwrap_or(false),
+        Some(Value::String(account)) if account == "opadeny" => false,
+        None => true,
+        _ => false,
+    };
+    if let Some(payload) = payload {
+        let _ = requests.send(payload);
+    }
+    let body =
+        serde_json::to_vec(&serde_json::json!({ "result": { "allow": allow } })).expect("static OPA response must serialize");
+    Ok(Response::builder()
+        .header(CONTENT_TYPE, "application/json")
+        .body(Full::new(Bytes::from(body)))
+        .expect("static OPA response must be valid"))
+}
+
+#[derive(Clone)]
+enum OpaValidationMode {
+    Ready,
+    DelayedUnavailable(Arc<Notify>),
+}
+
+struct OpaMock {
+    url: String,
+    requests: mpsc::UnboundedReceiver<Value>,
+    validation_started: mpsc::UnboundedReceiver<()>,
+    validation_release: Option<Arc<Notify>>,
+    task: JoinHandle<()>,
+}
+
+impl OpaMock {
+    async fn start() -> Result<Self, BoxError> {
+        Self::start_with_mode(OpaValidationMode::Ready, Some(OPA_AUTH_TOKEN)).await
+    }
+
+    async fn start_delayed_unavailable() -> Result<Self, BoxError> {
+        let release = Arc::new(Notify::new());
+        Self::start_with_mode(OpaValidationMode::DelayedUnavailable(release), None).await
+    }
+
+    async fn start_with_mode(validation_mode: OpaValidationMode, auth_token: Option<&str>) -> Result<Self, BoxError> {
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let url = format!("http://{}/v1/data/rustfs/authz/allow", listener.local_addr()?);
+        let (requests_tx, requests) = mpsc::unbounded_channel();
+        let (validation_started_tx, validation_started) = mpsc::unbounded_channel();
+        let expected_authorization = auth_token.map(|token| format!("Bearer {token}"));
+        let validation_release = match &validation_mode {
+            OpaValidationMode::Ready => None,
+            OpaValidationMode::DelayedUnavailable(release) => Some(Arc::clone(release)),
+        };
+        let task = tokio::spawn(async move {
+            let mut connections = JoinSet::new();
+            loop {
+                tokio::select! {
+                    accepted = listener.accept() => {
+                        let Ok((stream, _)) = accepted else { break };
+                        let requests = requests_tx.clone();
+                        let validation_started = validation_started_tx.clone();
+                        let validation_mode = validation_mode.clone();
+                        let expected_authorization = expected_authorization.clone();
+                        connections.spawn(async move {
+                            let handler = service_fn(move |request| {
+                                handle_opa_request(
+                                    request,
+                                    requests.clone(),
+                                    validation_started.clone(),
+                                    validation_mode.clone(),
+                                    expected_authorization.clone(),
+                                )
+                            });
+                            let _ = http1::Builder::new()
+                                .serve_connection(TokioIo::new(stream), handler)
+                                .await;
+                        });
+                    }
+                    _ = connections.join_next(), if !connections.is_empty() => {}
+                }
+            }
+        });
+        Ok(Self {
+            url,
+            requests,
+            validation_started,
+            validation_release,
+            task,
+        })
+    }
+
+    async fn next_request(&mut self) -> Result<Value, BoxError> {
+        timeout(Duration::from_secs(5), self.requests.recv())
+            .await?
+            .ok_or_else(|| "OPA request channel closed".into())
+    }
+
+    async fn wait_for_validation(&mut self) -> TestResult {
+        timeout(Duration::from_secs(5), self.validation_started.recv())
+            .await?
+            .ok_or_else(|| "OPA validation channel closed".into())
+    }
+
+    fn release_validation(&self) {
+        if let Some(release) = &self.validation_release {
+            release.notify_one();
+        }
+    }
+}
+
+impl Drop for OpaMock {
+    fn drop(&mut self) {
+        self.task.abort();
+    }
+}
+
+#[tokio::test]
+#[serial]
+async fn test_sts_query_responses_are_aws_sdk_compatible() -> TestResult {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let assumed = sts_client(&env.url, &env.access_key, &env.secret_key, None)
+        .assume_role()
+        .role_arn("arn:aws:iam::123456789012:role/test")
+        .role_session_name("sts-query-compat-e2e")
+        .send()
+        .await?;
+    assert!(
+        assumed.request_id().is_some_and(|request_id| !request_id.is_empty()),
+        "successful AssumeRole should include a request ID"
+    );
+    let temporary = assumed
+        .credentials()
+        .ok_or("successful AssumeRole response should contain credentials")?;
+
+    let invalid_signature = sts_client(&env.url, &env.access_key, "incorrect-secret-key", None)
+        .assume_role()
+        .role_arn("arn:aws:iam::123456789012:role/test")
+        .role_session_name("sts-query-invalid-signature")
+        .send()
+        .await
+        .expect_err("an invalid signature must be rejected");
+    assert_eq!(invalid_signature.raw_response().map(|response| response.status().as_u16()), Some(403));
+    let invalid_signature_service_error = invalid_signature
+        .as_service_error()
+        .ok_or_else(|| format!("invalid signature should deserialize as an STS service error: {invalid_signature:?}"))?;
+    assert_eq!(invalid_signature_service_error.code(), Some("SignatureDoesNotMatch"));
+    assert!(
+        invalid_signature_service_error
+            .message()
+            .is_some_and(|message| message.starts_with("The request signature we calculated does not match")),
+        "signature rejection should preserve the canonical error message"
+    );
+    assert!(
+        invalid_signature
+            .request_id()
+            .is_some_and(|request_id| !request_id.is_empty()),
+        "signature rejection should include a request ID"
+    );
+
+    assert_access_denied(
+        &sts_client(
+            &env.url,
+            temporary.access_key_id(),
+            temporary.secret_access_key(),
+            Some(temporary.session_token()),
+        ),
+        "temporary credential",
+    )
+    .await?;
+
+    let (service_access_key, service_secret_key) = create_root_service_account(&env).await?;
+    assert_access_denied(
+        &sts_client(&env.url, &service_access_key, &service_secret_key, None),
+        "service-account denial",
+    )
+    .await?;
+
+    let implicit_user = "stsimplicit";
+    let explicit_allow_user = "stsallow";
+    let explicit_deny_user = "stsdeny";
+    let policyless_user = "stspolicyless";
+    let secret = "stsAuthzSecret123";
+    create_user(&env, policyless_user, secret).await?;
+    assert_access_denied(&sts_client(&env.url, policyless_user, secret, None), "policyless user").await?;
+    create_user_with_policy(
+        &env,
+        implicit_user,
+        secret,
+        "sts-implicit-policy",
+        serde_json::json!([{
+            "Effect": "Allow",
+            "Action": ["s3:ListAllMyBuckets"],
+            "Resource": ["arn:aws:s3:::*"],
+        }]),
+    )
+    .await?;
+    create_user_with_policy(
+        &env,
+        explicit_allow_user,
+        secret,
+        "sts-allow-policy",
+        serde_json::json!([{
+            "Effect": "Allow",
+            "Action": ["sts:AssumeRole"],
+            "Resource": ["arn:aws:s3:::*"],
+        }]),
+    )
+    .await?;
+    create_user_with_policy(
+        &env,
+        explicit_deny_user,
+        secret,
+        "sts-deny-policy",
+        serde_json::json!([
+            {
+                "Effect": "Allow",
+                "Action": ["sts:AssumeRole"],
+                "Resource": ["arn:aws:s3:::*"],
+            },
+            {
+                "Effect": "Deny",
+                "Action": ["sts:AssumeRole"],
+                "Resource": ["arn:aws:s3:::*"],
+            }
+        ]),
+    )
+    .await?;
+
+    for user in [implicit_user, explicit_allow_user] {
+        let output = sts_client(&env.url, user, secret, None)
+            .assume_role()
+            .role_arn("arn:aws:iam::123456789012:role/test")
+            .role_session_name("sts-authz-e2e")
+            .send()
+            .await
+            .map_err(|error| format!("{user} should be allowed to call AssumeRole: {error:?}"))?;
+        let credentials = output
+            .credentials()
+            .ok_or_else(|| format!("{user} AssumeRole response should contain credentials"))?;
+        assert!(!credentials.access_key_id().is_empty());
+        assert!(!credentials.secret_access_key().is_empty());
+        assert!(!credentials.session_token().is_empty());
+    }
+    assert_access_denied(&sts_client(&env.url, explicit_deny_user, secret, None), "explicit sts:AssumeRole Deny").await?;
+
+    env.stop_server();
+    Ok(())
+}
+
+#[tokio::test]
+#[serial]
+async fn test_sts_assume_role_opa_contract() -> TestResult {
+    init_logging();
+
+    let mut opa = OpaMock::start().await?;
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server_with_env(
+        vec![],
+        &[
+            ("RUSTFS_POLICY_PLUGIN_URL", opa.url.as_str()),
+            ("RUSTFS_POLICY_PLUGIN_AUTH_TOKEN", OPA_AUTH_TOKEN),
+        ],
+    )
+    .await?;
+
+    let secret = "stsOpaSecret123";
+    create_user_with_policy(
+        &env,
+        "opaallow",
+        secret,
+        "sts-opa-local-deny-policy",
+        serde_json::json!([{
+            "Effect": "Deny",
+            "Action": ["sts:AssumeRole"],
+            "Resource": ["arn:aws:s3:::*"],
+        }]),
+    )
+    .await?;
+    create_user_with_policy(
+        &env,
+        "opadeny",
+        secret,
+        "sts-opa-local-allow-policy",
+        serde_json::json!([{
+            "Effect": "Allow",
+            "Action": ["sts:AssumeRole"],
+            "Resource": ["arn:aws:s3:::*"],
+        }]),
+    )
+    .await?;
+
+    sts_client(&env.url, "opaallow", secret, None)
+        .assume_role()
+        .role_arn("arn:aws:iam::123456789012:role/test")
+        .role_session_name("sts-opa-contract")
+        .send()
+        .await
+        .map_err(|error| format!("OPA allow should override the local explicit Deny: {error:?}"))?;
+    assert_access_denied(
+        &sts_client(&env.url, "opadeny", secret, None),
+        "OPA denial despite local sts:AssumeRole Allow",
+    )
+    .await?;
+
+    let mut accounts = BTreeSet::new();
+    for _ in 0..2 {
+        let request = opa.next_request().await?;
+        assert_eq!(request.pointer("/input/action").and_then(Value::as_str), Some("sts:AssumeRole"));
+        assert_eq!(request.pointer("/input/context/deny_only").and_then(Value::as_bool), Some(true));
+        let account = request
+            .pointer("/input/identity/account")
+            .and_then(Value::as_str)
+            .ok_or("OPA input should include identity.account")?;
+        accounts.insert(account.to_owned());
+    }
+    assert_eq!(accounts, BTreeSet::from(["opaallow".to_owned(), "opadeny".to_owned()]));
+
+    env.stop_server();
+    Ok(())
+}
+
+#[tokio::test]
+#[serial]
+async fn test_sts_assume_role_fails_closed_while_opa_is_unavailable() -> TestResult {
+    init_logging();
+
+    let mut opa = OpaMock::start_delayed_unavailable().await?;
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server_with_env(vec![], &[("RUSTFS_POLICY_PLUGIN_URL", opa.url.as_str())])
+        .await?;
+    opa.wait_for_validation().await?;
+
+    let user = "opaunavailable";
+    let secret = "stsOpaUnavailableSecret123";
+    create_user_with_policy(
+        &env,
+        user,
+        secret,
+        "sts-opa-unavailable-local-policy",
+        serde_json::json!([{
+            "Effect": "Allow",
+            "Action": ["s3:ListAllMyBuckets"],
+            "Resource": ["arn:aws:s3:::*"],
+        }]),
+    )
+    .await?;
+
+    assert_access_denied(&sts_client(&env.url, user, secret, None), "configured OPA initialization").await?;
+
+    opa.release_validation();
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    assert_access_denied(&sts_client(&env.url, user, secret, None), "configured OPA validation failure").await?;
+
+    env.stop_server();
+    Ok(())
+}
+
+#[tokio::test]
+#[serial]
+async fn test_sts_query_rate_limit_error_is_aws_sdk_compatible() -> TestResult {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server_with_env(
+        vec![],
+        &[
+            ("RUSTFS_API_RATE_LIMIT_ENABLE", "true"),
+            ("RUSTFS_API_RATE_LIMIT_RPM", "60"),
+            ("RUSTFS_API_RATE_LIMIT_BURST", "1"),
+        ],
+    )
+    .await?;
+
+    let client = sts_client(&env.url, &env.access_key, &env.secret_key, None);
+    let mut throttled = None;
+    let request = || {
+        client
+            .assume_role()
+            .role_arn("arn:aws:iam::123456789012:role/test")
+            .role_session_name("sts-query-rate-limit")
+            .send()
+    };
+    let (first, second, third, fourth) = tokio::join!(request(), request(), request(), request());
+    for result in [first, second, third, fourth] {
+        if let Err(error) = result
+            && error.raw_response().map(|response| response.status().as_u16()) == Some(429)
+        {
+            throttled = Some(error);
+            break;
+        }
+    }
+
+    let error = throttled.ok_or("at least one concurrent STS request should be throttled at burst one")?;
+    let service_error = error
+        .as_service_error()
+        .ok_or_else(|| format!("rate limit response should deserialize as an STS service error: {error:?}"))?;
+    assert_eq!(service_error.code(), Some("TooManyRequests"));
+    assert!(
+        service_error
+            .message()
+            .is_some_and(|message| message.starts_with("Request rate limit exceeded")),
+        "rate limit response should preserve the server message"
+    );
+    assert!(
+        error.request_id().is_some_and(|request_id| !request_id.is_empty()),
+        "rate limit response should include a request ID"
+    );
+
+    env.stop_server();
+    Ok(())
+}
@@ -33,14 +33,98 @@ workspace = true
 [features]
 default = []
 rio-v2 = ["dep:rustfs-rio-v2"]
-hotpath = ["dep:hotpath", "hotpath/hotpath", "rustfs-filemeta/hotpath", "rustfs-rio/hotpath"]
+hotpath = [
+    "hotpath/hotpath",
+    "hotpath/tokio",
+    "hotpath/futures",
+    "hotpath/async-channel",
+    "hotpath/parking_lot",
+    "hotpath/reqwest-0-13",
+    "rustfs-checksums/hotpath",
+    "rustfs-common/hotpath",
+    "rustfs-concurrency/hotpath",
+    "rustfs-config/hotpath",
+    "rustfs-credentials/hotpath",
+    "rustfs-data-usage/hotpath",
+    "rustfs-filemeta/hotpath",
+    "rustfs-io-metrics/hotpath",
+    "rustfs-lifecycle/hotpath",
+    "rustfs-lock/hotpath",
+    "rustfs-madmin/hotpath",
+    "rustfs-object-capacity/hotpath",
+    "rustfs-policy/hotpath",
+    "rustfs-protos/hotpath",
+    "rustfs-replication/hotpath",
+    "rustfs-rio/hotpath",
+    "rustfs-rio-v2?/hotpath",
+    "rustfs-s3-types/hotpath",
+    "rustfs-signer/hotpath",
+    "rustfs-storage-api/hotpath",
+    "rustfs-tls-runtime/hotpath",
+    "rustfs-utils/hotpath",
+    "rustfs-crypto/hotpath",
+]
+hotpath-alloc = [
+    "hotpath",
+    "hotpath/hotpath-alloc",
+    "rustfs-checksums/hotpath-alloc",
+    "rustfs-common/hotpath-alloc",
+    "rustfs-concurrency/hotpath-alloc",
+    "rustfs-config/hotpath-alloc",
+    "rustfs-credentials/hotpath-alloc",
+    "rustfs-data-usage/hotpath-alloc",
+    "rustfs-filemeta/hotpath-alloc",
+    "rustfs-io-metrics/hotpath-alloc",
+    "rustfs-lifecycle/hotpath-alloc",
+    "rustfs-lock/hotpath-alloc",
+    "rustfs-madmin/hotpath-alloc",
+    "rustfs-object-capacity/hotpath-alloc",
+    "rustfs-policy/hotpath-alloc",
+    "rustfs-protos/hotpath-alloc",
+    "rustfs-replication/hotpath-alloc",
+    "rustfs-rio/hotpath-alloc",
+    "rustfs-rio-v2?/hotpath-alloc",
+    "rustfs-s3-types/hotpath-alloc",
+    "rustfs-signer/hotpath-alloc",
+    "rustfs-storage-api/hotpath-alloc",
+    "rustfs-tls-runtime/hotpath-alloc",
+    "rustfs-utils/hotpath-alloc",
+    "rustfs-crypto/hotpath-alloc",
+]
+hotpath-cpu = [
+    "hotpath",
+    "hotpath/hotpath-cpu",
+    "rustfs-checksums/hotpath-cpu",
+    "rustfs-common/hotpath-cpu",
+    "rustfs-concurrency/hotpath-cpu",
+    "rustfs-config/hotpath-cpu",
+    "rustfs-credentials/hotpath-cpu",
+    "rustfs-data-usage/hotpath-cpu",
+    "rustfs-filemeta/hotpath-cpu",
+    "rustfs-io-metrics/hotpath-cpu",
+    "rustfs-lifecycle/hotpath-cpu",
+    "rustfs-lock/hotpath-cpu",
+    "rustfs-madmin/hotpath-cpu",
+    "rustfs-object-capacity/hotpath-cpu",
+    "rustfs-policy/hotpath-cpu",
+    "rustfs-protos/hotpath-cpu",
+    "rustfs-replication/hotpath-cpu",
+    "rustfs-rio/hotpath-cpu",
+    "rustfs-rio-v2?/hotpath-cpu",
+    "rustfs-s3-types/hotpath-cpu",
+    "rustfs-signer/hotpath-cpu",
+    "rustfs-storage-api/hotpath-cpu",
+    "rustfs-tls-runtime/hotpath-cpu",
+    "rustfs-utils/hotpath-cpu",
+    "rustfs-crypto/hotpath-cpu",
+]
 # Exposes shared lifecycle/tier test utilities (MockWarmBackend, fault
 # injection, xl.meta transition assertions) via `api::tier::test_util`.
 # Enable only from `[dev-dependencies]` (rustfs/backlog#1148 ilm-6).
 test-util = []

 [dependencies]
-hotpath = { workspace = true, optional = true }
+hotpath.workspace = true
 rustfs-filemeta.workspace = true
 rustfs-utils = { workspace = true, features = ["full"] }
 rustfs-rio.workspace = true
@@ -57,7 +141,6 @@ rustfs-policy.workspace = true
 rustfs-protos.workspace = true
 rustfs-replication.workspace = true
 rustfs-lifecycle.workspace = true
-rustfs-kms.workspace = true
 rustfs-s3-types = { workspace = true }
 rustfs-data-usage.workspace = true
 rustfs-object-capacity.workspace = true
@@ -105,6 +188,7 @@ tempfile.workspace = true
 hyper = { workspace = true, features = ["http2", "http1", "server"] }
 hyper-util = { workspace = true, features = ["tokio", "server-auto", "server-graceful", "tracing"] }
 hyper-rustls = { workspace = true, default-features = false, features = ["native-tokio", "http1", "tls12", "logging", "http2", "aws-lc-rs"] }
+hostname.workspace = true
 rustls = { workspace = true, default-features = false, features = ["aws-lc-rs", "logging", "tls12", "prefer-post-quantum", "std"] }
 rustls-pki-types.workspace = true
 tokio = { workspace = true, features = ["io-util", "sync", "signal", "fs", "rt-multi-thread"] }
@@ -124,8 +208,6 @@ libc.workspace = true
 rustix = { workspace = true, features = ["process", "fs"] }
 rustfs-madmin.workspace = true
 reqwest = { workspace = true }
-aes-gcm = { workspace = true, features = ["rand_core"] }
-chacha20poly1305.workspace = true
 aws-sdk-s3 = { workspace = true, default-features = false, features = ["sigv4a", "default-https-client", "rt-tokio"] }
 urlencoding = { workspace = true }
 smallvec = { workspace = true, features = ["serde"] }
@@ -153,11 +235,18 @@ metrics = { workspace = true }
 [target.'cfg(target_os = "linux")'.dependencies]
 rustfs-uring = "0.2.1"

+[target.'cfg(windows)'.dependencies]
+winapi-util.workspace = true
+windows-sys = { workspace = true, features = ["Win32_Foundation", "Win32_Storage_FileSystem"] }
+
 [dev-dependencies]
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "test-util", "fs"] }
 criterion = { workspace = true, features = ["html_reports"] }
 temp-env = { workspace = true, features = ["async_closure"] }
 tracing-subscriber = { workspace = true, features = ["json", "env-filter", "time"] }
+# Only for `pin_callsite_interest_for_test`, which registers a `NoSubscriber`
+# dispatcher to keep tracing's process-global callsite-interest cache honest.
+tracing-core = { workspace = true }
 serial_test = { workspace = true }
 opentelemetry_sdk = { workspace = true, features = ["rt-tokio"] }
 proptest = "1"
@@ -43,10 +43,35 @@ pub mod bucket {

        pub mod bucket_lifecycle_ops {
            pub use crate::bucket::lifecycle::bucket_lifecycle_ops::{
-                ExpiryState, LifecycleOps, RestoreRequestOps, TransitionState, TransitionedObject, apply_expiry_rule,
+                ExpiryState, LifecycleOps, ManualTransitionCancelCheck, ManualTransitionProgressSink,
+                ManualTransitionQueueSnapshot, ManualTransitionRunExecution, ManualTransitionRunOptions,
+                ManualTransitionRunReport, RestoreRequestOps, TransitionState, TransitionedObject, apply_expiry_rule,
                apply_transition_rule, enqueue_expiry_for_existing_objects, enqueue_transition_for_existing_objects,
+                enqueue_transition_for_existing_objects_scoped, enqueue_transition_for_existing_objects_scoped_with_cancel,
                enqueue_transition_immediate, expire_transitioned_object, get_global_expiry_state, get_global_transition_state,
-                init_background_expiry, post_restore_opts, run_stale_multipart_upload_cleanup_once, validate_transition_tier,
+                init_background_expiry, manual_transition_queue_snapshot, post_restore_opts,
+                run_stale_multipart_upload_cleanup_once, validate_transition_tier,
+            };
+        }
+
+        pub mod manual_transition_job {
+            pub use crate::bucket::lifecycle::manual_transition_job::{
+                ManualTransitionJobRecord, ManualTransitionJobState, ManualTransitionScopeAdmission,
+                ManualTransitionScopeAdmissionClaim, claim_manual_transition_scope_admission,
+                delete_manual_transition_scope_admission_if_current, load_manual_transition_job_record,
+                load_manual_transition_job_record_with_etag, load_manual_transition_scope_admission,
+                manual_transition_job_lease_expired, manual_transition_scope_admission_lease_expired,
+                manual_transition_scope_key, persist_manual_transition_job_progress, renew_manual_transition_job_lease,
+                request_manual_transition_job_cancel, save_manual_transition_job_record,
+                save_manual_transition_job_record_if_current, save_manual_transition_scope_admission_if_absent,
+            };
+        }
+
+        pub mod transition_transaction {
+            pub use crate::bucket::lifecycle::transition_transaction::{
+                TransitionOperatorDeleteResult, TransitionOperatorError, TransitionOperatorProbe, TransitionOperatorStatus,
+                delete_transition_candidate_for_operator, finalize_missing_transition_transaction_for_operator,
+                inspect_transition_transaction_for_operator,
            };
        }

@@ -105,12 +130,13 @@ pub mod bucket {

    pub mod metadata_sys {
        pub use crate::bucket::metadata_sys::{
-            BucketMetadataSys, delete, get, get_accelerate_config, get_bucket_policy, get_bucket_policy_raw,
-            get_bucket_targets_config, get_config_from_disk, get_cors_config, get_durability_config,
+            BucketMetadataSys, acquire_bucket_metadata_transaction_lock, delete, get, get_accelerate_config, get_bucket_policy,
+            get_bucket_policy_raw, get_bucket_targets_config, get_config_from_disk, get_cors_config, get_durability_config,
            get_global_bucket_metadata_sys, get_lifecycle_config, get_logging_config, get_notification_config,
            get_object_lock_config, get_public_access_block_config, get_quota_config, get_replication_config,
            get_request_payment_config, get_sse_config, get_tagging_config, get_versioning_config, get_website_config,
-            init_bucket_metadata_sys, list_bucket_targets, remove_bucket_metadata, set_bucket_metadata, update,
+            init_bucket_metadata_sys, list_bucket_targets, reload_bucket_metadata, remove_bucket_metadata, set_bucket_metadata,
+            update, update_bucket_targets_under_transaction_lock, update_config_with, update_under_transaction_lock,
        };
    }

@@ -147,18 +173,19 @@ pub mod bucket {

    pub mod replication {
        pub use crate::bucket::replication::{
-            BucketReplicationResyncStatus, BucketStats, DeletedObjectReplicationInfo, DynReplicationPool, MustReplicateOptions,
-            ObjectOpts, REPLICATE_INCOMING_DELETE, ReplicateDecision, ReplicateObjectInfo, ReplicationConfig,
-            ReplicationConfigurationExt, ReplicationDeleteScheduleInput, ReplicationDeleteStateSource,
-            ReplicationHealQueueResult, ReplicationObjectBridge, ReplicationObjectIO, ReplicationOperation, ReplicationPoolTrait,
-            ReplicationPriority, ReplicationQueueAdmission, ReplicationScannerBridge, ReplicationState, ReplicationStats,
-            ReplicationStatusType, ReplicationStorage, ReplicationTargetValidationError, ReplicationType, ResyncOpts,
-            ResyncStatusType, TargetReplicationResyncStatus, VersionPurgeStatusType, delete_replication_state_from_config,
-            delete_replication_version_id, get_global_replication_pool, get_global_replication_stats,
-            init_background_replication, replication_state_to_filemeta, replication_status_to_filemeta, replication_statuses_map,
-            replication_target_arns, should_remove_replication_target, should_schedule_delete_replication,
-            should_use_existing_delete_replication_info, should_use_existing_delete_replication_source,
-            validate_replication_config_target_arns, version_purge_status_to_filemeta,
+            BucketReplicationResyncStatus, BucketStats, DeletedObjectReplicationInfo, DurableMrfBacklog, DynReplicationPool,
+            MrfOpKind, MrfReplicateEntry, MustReplicateOptions, ObjectOpts, REPLICATE_INCOMING_DELETE, ReplicateDecision,
+            ReplicateObjectInfo, ReplicationConfig, ReplicationConfigurationExt, ReplicationDeleteScheduleInput,
+            ReplicationDeleteStateSource, ReplicationHealQueueResult, ReplicationObjectBridge, ReplicationObjectIO,
+            ReplicationOperation, ReplicationPoolTrait, ReplicationPriority, ReplicationQueueAdmission, ReplicationScannerBridge,
+            ReplicationState, ReplicationStats, ReplicationStatusType, ReplicationStorage, ReplicationTargetValidationError,
+            ReplicationType, ResyncOpts, ResyncStatusType, TargetReplicationResyncStatus, VersionPurgeStatusType,
+            delete_replication_state_from_config, delete_replication_version_id, get_global_replication_pool,
+            get_global_replication_stats, init_background_replication, read_durable_mrf_backlog, replication_state_to_filemeta,
+            replication_status_to_filemeta, replication_statuses_map, replication_target_arns, resync_start_conflict_id,
+            should_remove_replication_target, should_schedule_delete_replication, should_use_existing_delete_replication_info,
+            should_use_existing_delete_replication_source, validate_replication_config_target_arns,
+            version_purge_status_to_filemeta,
        };
    }

@@ -240,21 +267,24 @@ pub mod config {
    pub mod com {
        pub use crate::config::com::{
            COMMA_SEPARATED_LISTS, CONFIG_PREFIX, ENV_CONFIG_RECOVER_ON_CORRUPTION, STORAGE_CLASS_SUB_SYS,
-            ServerConfigCorruptError, delete_config, is_server_config_corrupt_error, lookup_configs, read_config,
-            read_config_no_lock, read_config_with_metadata, read_config_without_migrate, read_config_without_migrate_no_lock,
-            read_existing_server_config_no_lock, save_config, save_config_no_lock, save_config_with_opts, save_server_config,
-            save_server_config_no_lock, try_migrate_server_config, with_config_object_read_lock, with_config_object_write_lock,
+            ServerConfigCorruptError, ServerConfigSaveResult, ServerConfigSnapshot, delete_config,
+            is_server_config_corrupt_error, lookup_configs, read_config, read_config_no_lock, read_config_with_metadata,
+            read_config_without_migrate, read_config_without_migrate_no_lock, read_existing_server_config_no_lock,
+            read_server_config_snapshot, save_config, save_config_no_lock, save_config_with_opts, save_server_config,
+            save_server_config_no_lock, save_server_config_snapshot, save_server_config_snapshot_with_generation,
+            server_config_path, try_migrate_server_config, with_config_object_read_lock, with_config_object_write_lock,
            with_server_config_read_lock, with_server_config_write_lock,
        };
    }

    pub mod storageclass {
        pub use crate::config::storageclass::{
-            CLASS_RRS, CLASS_STANDARD, Config, DEEP_ARCHIVE, DEFAULT_INLINE_BLOCK, DEFAULT_KVS, DEFAULT_RRS_PARITY,
-            EXPRESS_ONEZONE, GLACIER, GLACIER_IR, INLINE_BLOCK, INLINE_BLOCK_ENV, INTELLIGENT_TIERING, MIN_PARITY_DRIVES,
-            ONEZONE_IA, OPTIMIZE, OPTIMIZE_ENV, OUTPOSTS, RRS, RRS_ENV, SCHEME_PREFIX, SNOW, STANDARD, STANDARD_ENV, STANDARD_IA,
-            StorageClass, default_parity_count, lookup_config, lookup_config_for_pools, parse_storage_class, validate_parity,
-            validate_parity_inner,
+            CAPABILITY_CONTRACT_VERSION, CLASS_RRS, CLASS_STANDARD, Config, DEEP_ARCHIVE, DEFAULT_INLINE_BLOCK, DEFAULT_KVS,
+            DEFAULT_RRS_PARITY, EXPRESS_ONEZONE, GLACIER, GLACIER_IR, INLINE_BLOCK, INLINE_BLOCK_ENV, INTELLIGENT_TIERING,
+            LEGACY_LABEL_BEHAVIOR, MIN_PARITY_DRIVES, ONEZONE_IA, OPTIMIZE, OPTIMIZE_ENV, OUTPOSTS, RRS, RRS_ENV, SCHEME_PREFIX,
+            SNOW, STANDARD, STANDARD_ENV, STANDARD_IA, SUPPORTED_WRITE_CLASSES, StorageClass, UNSUPPORTED_WRITE_ERROR,
+            default_parity_count, effective_class, is_supported_write_class, lookup_config, lookup_config_for_pools,
+            parse_storage_class, validate_parity, validate_parity_inner,
        };
    }

@@ -266,10 +296,10 @@ pub mod config {
 pub mod data_usage {
    pub use crate::data_usage::{
        DATA_USAGE_CACHE_NAME, apply_bucket_usage_memory_overlay, compute_bucket_usage,
-        init_compression_total_memory_from_backend, live_bucket_usage_computations, load_compression_total_from_memory,
-        load_data_usage_from_backend, load_data_usage_from_backend_cached, record_bucket_delete_marker_memory,
-        record_bucket_object_delete_memory, record_bucket_object_version_write_memory, record_bucket_object_write_memory,
-        record_bucket_object_write_unknown_previous_memory, record_compression_total_memory,
+        init_compression_total_memory_from_backend, invalidate_data_usage_snapshot_cache, live_bucket_usage_computations,
+        load_compression_total_from_memory, load_data_usage_from_backend, load_data_usage_from_backend_cached,
+        record_bucket_delete_marker_memory, record_bucket_object_delete_memory, record_bucket_object_version_write_memory,
+        record_bucket_object_write_memory, record_bucket_object_write_unknown_previous_memory, record_compression_total_memory,
        refresh_bucket_usage_from_object_layer, refresh_versioned_bucket_usage_from_object_layer,
        remove_bucket_usage_from_backend, replace_bucket_usage_memory_from_info, store_compression_total_in_backend,
        store_data_usage_in_backend,
@@ -282,9 +312,10 @@ pub mod disk {
    pub use crate::disk::{
        BATCH_READ_VERSION_MAX_ITEMS, BUCKET_META_PREFIX, BatchReadVersionItem, BatchReadVersionReq, BatchReadVersionResp,
        CheckPartsResp, DeleteOptions, Disk, DiskAPI, DiskInfo, DiskInfoOptions, DiskLocation, DiskOption, DiskStore,
-        FileInfoVersions, FileReader, FileWriter, HEALING_MARKER_PATH, OldCurrentSize, RUSTFS_META_BUCKET, ReadMultipleReq,
-        ReadMultipleResp, ReadOptions, RenameDataResp, STORAGE_FORMAT_FILE, UpdateMetadataOpts, VolumeInfo, WalkDirOptions,
-        new_disk, validate_batch_read_version_item_count,
+        FileInfoVersions, FileReader, FileWriter, HEALING_MARKER_PATH, NsScannerOpenRequest, OldCurrentSize,
+        PartTransactionAction, RUSTFS_META_BUCKET, ReadMultipleReq, ReadMultipleResp, ReadOptions, RenameDataResp,
+        STORAGE_FORMAT_FILE, SnapshotLeaseToken, UpdateMetadataOpts, VolumeInfo, WalkDirOptions, new_disk,
+        validate_batch_read_version_item_count,
    };
    pub use bytes::Bytes;
    pub use endpoint::Endpoint;
@@ -355,15 +386,18 @@ pub mod metrics {
 pub mod notification {
    pub use crate::services::notification_sys::{
        NotificationPeerErr, NotificationSys, get_global_notification_sys, new_global_notification_sys,
+        start_remote_version_state_fleet_probe,
    };
 }

 pub mod object {
    pub use crate::object_api::{
-        BLOCK_SIZE_V2, ERASURE_ALGORITHM, GetObjectBodyCacheHook, GetObjectBodyCacheHookLookup, GetObjectBodySource,
-        GetObjectReader, ObjectInfo, ObjectMutationHook, ObjectOptions, PutObjReader, RangedDecompressReader, StreamConsumer,
-        get_object_body_cache_plaintext_len, lookup_get_object_body_cache_hook, register_get_object_body_cache_hook,
-        register_object_mutation_hook, unregister_get_object_body_cache_hook, unregister_object_mutation_hook,
+        BLOCK_SIZE_V2, ERASURE_ALGORITHM, EncryptionResolutionError, EncryptionResolutionErrorKind, GetObjectBodyCacheHook,
+        GetObjectBodyCacheHookLookup, GetObjectBodySource, GetObjectReader, ObjectEncryptionResolver, ObjectInfo,
+        ObjectMutationHook, ObjectOptions, PutObjReader, RangedDecompressReader, ReadEncryptionMaterial, ReadEncryptionMode,
+        ReadEncryptionRequest, StreamConsumer, get_object_body_cache_plaintext_len, lookup_get_object_body_cache_hook,
+        register_get_object_body_cache_hook, register_object_mutation_hook, unregister_get_object_body_cache_hook,
+        unregister_object_mutation_hook,
    };
    pub use crate::store::PreparedGetObjectReader;
 }
@@ -385,12 +419,15 @@ pub mod rio {

 pub mod rpc {
    pub use crate::cluster::rpc::{
-        LocalPeerS3Client, PEER_RESTDRY_RUN, PEER_RESTSIGNAL, PEER_RESTSUB_SYS, PeerRestClient, PeerS3Client,
-        SERVICE_SIGNAL_REFRESH_CONFIG, SERVICE_SIGNAL_RELOAD_DYNAMIC, ScannerPeerActivity, TONIC_RPC_PREFIX, TonicInterceptor,
-        gen_signature_headers, gen_tonic_signature_headers, gen_tonic_signature_interceptor, node_service_time_out_client,
-        node_service_time_out_client_no_auth, normalize_tonic_rpc_audience, set_tonic_canonical_body_digest,
-        sign_tonic_rpc_response_proof, verify_rpc_signature, verify_tonic_canonical_body_digest, verify_tonic_rpc_response_proof,
-        verify_tonic_rpc_signature,
+        AuthenticatedChannel, KMS_SIGNAL_SUBSYSTEM, LocalPeerS3Client, PEER_RESTDRY_RUN, PEER_RESTSIGNAL, PEER_RESTSUB_SYS,
+        PeerRestClient, PeerS3Client, S3PeerSys, SERVICE_SIGNAL_REFRESH_CONFIG, SERVICE_SIGNAL_RELOAD_DYNAMIC,
+        ScannerBucketListing, ScannerPeerActivity, TONIC_RPC_PREFIX, TonicInterceptor, gen_signature_headers,
+        gen_tonic_replay_scope_headers, gen_tonic_signature_headers, gen_tonic_signature_interceptor,
+        node_service_time_out_client, node_service_time_out_client_no_auth, normalize_tonic_rpc_audience,
+        set_tonic_canonical_body_digest, sign_ns_scanner_capability, sign_tonic_rpc_response_proof, tonic_boot_epoch_challenge,
+        tonic_boot_epoch_response_headers, verify_rpc_signature, verify_tonic_boot_epoch_response,
+        verify_tonic_canonical_body_digest, verify_tonic_mutation_body_digest, verify_tonic_rpc_response_proof,
+        verify_tonic_rpc_signature, verify_tonic_rpc_signature_with_bootstrap,
    };
 }

@@ -807,15 +807,29 @@ impl BucketTargetSys {
            && !new_targets.is_empty()
        {
            for target in &new_targets.targets {
-                if let Ok(client) = self.get_remote_target_client_internal(target).await {
-                    arn_remotes_map.insert(
-                        target.arn.clone(),
-                        ArnTarget {
-                            client: Some(Arc::new(client)),
-                            last_refresh: OffsetDateTime::now_utc(),
-                        },
-                    );
-                    self.update_bandwidth_limit(bucket, &target.arn, target.bandwidth_limit);
+                match self.get_remote_target_client_internal(target).await {
+                    Ok(client) => {
+                        arn_remotes_map.insert(
+                            target.arn.clone(),
+                            ArnTarget {
+                                client: Some(Arc::new(client)),
+                                last_refresh: OffsetDateTime::now_utc(),
+                            },
+                        );
+                        self.update_bandwidth_limit(bucket, &target.arn, target.bandwidth_limit);
+                    }
+                    // The target stays in `targets_map`, so it keeps showing up in
+                    // `bucket remote ls` while no client exists to replicate through it —
+                    // replication then drops every object for this ARN. Without this the
+                    // rejection (loopback endpoint, bad CA, unparseable URL) left no trace
+                    // anywhere.
+                    Err(err) => warn!(
+                        bucket = %bucket,
+                        arn = %target.arn,
+                        endpoint = %target.endpoint,
+                        error = %err,
+                        "replication target client unavailable; objects for this ARN will not replicate"
+                    ),
                }
            }
            targets_map.insert(bucket.to_string(), new_targets.targets.clone());
--- a/Show More
+++ b/Show More