docs: add MinIO replication compatibility review and P1 remediation plan

perf(observability): avoid cgroup path allocation (#5711 )
* perf(observability): avoid cgroup path allocation Co-Authored-By: heihutu <heihutu@gmail.com> * test(e2e): satisfy regression test clippy Co-Authored-By: heihutu <heihutu@gmail.com> --------- Co-authored-by: heihutu <heihutu@gmail.com>
2026-08-13 16:46:55 +00:00 · 2026-08-07 01:15:39 +08:00 · 2026-08-04 17:47:07 +00:00 · 2026-08-04 23:21:36 +08:00 · 2026-08-04 23:21:01 +08:00 · 2026-08-04 23:20:55 +08:00
837 changed files with 244498 additions and 50391 deletions
@@ -84,6 +84,9 @@ Null report example: "Rewrote the diff as an in-place edit (no smaller equivalen
 - For any secret/token/signature/password comparison in the diff, check it uses a constant-time compare (e.g. subtle/constant_time_eq), not == or early-return byte loops. Then check the failure-response paths: construct an invalid-user request and an invalid-secret request and confirm they are indistinguishable (same error, no early length short-circuit) so an attacker cannot enumerate valid users or time-side-channel the secret.
  - Where: crates/protocols/ (FTPS/WebDAV/FormPost auth), crates/credentials/, rustfs/src/auth.rs, RPC signature verification
  - Evidence: GHSA-3p3x-734c-h5vx (FTPS/WebDAV early-return string equality + distinguishable invalid-user vs invalid-password). Fix commits 3c3113619 (constant-time FTPS/WebDAV) and c41062f27 (constant-time FormPost signature). 3p3x was fixed by PR #4403.
+- If the diff parses or transports secret-bearing config (env vars, key files, connection strings), grep every error-construction and format site on that value's path (`format!` feeding `Error::other`/`configuration_error`/`panic!`/`expect`) for interpolation of the raw value or of variables named like secret material. Construct the likeliest misconfiguration: the operator supplies the bare secret without the expected `<name>:` prefix (or with a stray newline) — if the parse-failure hint echoes the input, the secret lands in startup logs. Error strings are log content; the hint may name the env var and expected format, never the value. If the diff re-implements an existing parse helper, diff the two error paths — the duplicate is where the leak hides.
+  - Where: rustfs/src/init.rs (env plumbing), crates/kms/src/config.rs, crates/credentials/, any from_env/parse on secret values; mechanical backstop in scripts/check_logging_guardrails.sh (secret-interpolation check)
+  - Evidence: PR #5222 introduced `got: {secret_str}` in build_static_kms_config's format-hint error — a bare base64 key (the secret itself) would have been echoed into startup logs; fixed by PR #5243. The parallel parse in KmsConfig::from_env already omitted the value: the leak lived only in the duplicated copy (AGENTS.md 'Reuse Before You Write').
 - If the diff touches internode/RPC auth secret handling, trace whether the RPC HMAC secret can fall back to a public default (e.g. 'rustfsadmin', 'rustfs rpc') or be derived deterministically from the S3 root credentials. Construct the case where RUSTFS_RPC_SECRET is unset and confirm the code fails closed rather than silently using a default or a root-derived key. Verify RPC signing keys are independent random secrets, not reused across S3-root/RPC-HMAC/STS-JWT roles.
  - Where: crates/credentials/, crates/ecstore/src/rpc/, internode auth setup
  - Evidence: GHSA-r5qv-rc46-hv8q (fell back to 'rustfsadmin'), GHSA-75fx/68cw (RPC secret derivable from root creds → forgeable signatures), GHSA-h956 (hard-coded 'rustfs rpc'), GHSA-m77q (STS JWT reused root secret). Fix commit 7b2055405 (fail closed when deriving RPC secret from default credentials, PR#4402).
@@ -10,10 +10,16 @@ never weaken a check to get green.

 ## `check_layer_dependencies.sh` — layer DAG in `rustfs/src`

-Enforces `interface (admin, storage/ecfs, storage/s3_api) → app → infra`; no
-upward imports. Known legacy violations live in
+Enforces `composition (server, startup/init) → interface (admin,
+storage/ecfs, storage/s3_api) → app → infra`; no upward imports. Server source
+files are composition roots, while imports of their exported HTTP contracts
+are classified as interface dependencies. Known legacy violations live in
 `scripts/layer-dependency-baseline.txt`.

+Dedicated `*_test.rs` and `tests/` modules are outside this production guard.
+Inline `#[cfg(test)]` imports remain checked under their source file's layer;
+move architecture-crossing test scaffolding into a dedicated test module.
+
 - **New violation**: restructure your change so the dependency points
  downward (move the shared type/function to the lower layer).
 - **You legitimately removed a baseline entry**: run
@@ -1,19 +1,21 @@
 ---
 name: rustfs-release-publish
-description: "End-to-end RustFS release pipeline: bump version files on main directly to the final target version, cut a preview tag on that commit, verify the CI build and release artifacts, run the downloaded binary locally and exercise the console, validate the server with the latest rc client, then publish the final tag on the SAME validated commit — never a new bump commit, never latest main. Use whenever the user wants to release/publish a RustFS version (发版/发布)."
+description: "End-to-end RustFS release pipeline: first publish any merged-but-unreleased rustfs/console changes and wait for its latest Release asset, then bump RustFS version files on main directly to the final target, publish a visible GitHub prerelease from a preview tag without updating latest channels, validate it, and publish the final tag on the SAME commit. Use whenever the user wants to release/publish a RustFS version (发版/发布)."
 ---
 # RustFS Release Publish (preview-validated pipeline)

 This skill orchestrates a full release. It wraps `rustfs-release-version-bump` (which only edits version files and opens the PR) with a mandatory preview-tag validation loop before the final tag is published.

-Core design: **version files never carry a `-preview.N` suffix**. The preview suffix exists only in tag names. This works because the binary self-reports the git tag it was built from (`build::TAG` via shadow_rs, see `rustfs/src/config/cli.rs` `SHORT_VERSION`), and `build.yml` derives artifact names and prerelease classification from the tag name — Cargo.toml's version is only a no-tag fallback. Therefore the preview tag and the final tag can (and MUST) point at the exact same commit: what you validated is byte-for-byte the source that ships.
+Core design: **version files never carry a `-preview.N` suffix**. The preview suffix exists only in tag names. A preview tag creates a visible GitHub Release marked Prerelease and uploads versioned assets, but it never becomes GitHub Latest and never updates `*-latest`, `latest.json`, R2, Docker, or Helm channels. This works because the binary self-reports the git tag it was built from (`build::TAG` via shadow_rs, see `rustfs/src/config/cli.rs` `SHORT_VERSION`), and `build.yml` derives artifact names and preview classification from the tag name — Cargo.toml's version is only a no-tag fallback. Therefore the preview tag and the final tag can (and MUST) point at the exact same commit: what you validated is byte-for-byte the source that ships.

 Pipeline shape:

 ```
-bump version files to <target> (final version, ONE commit) -> merge
+check console main against its latest Release
+  -> if ahead: publish console -> wait for Release asset + latest API
+  -> bump RustFS version files to <target> (final version, ONE commit) -> merge
  -> tag <preview-tag> at that commit -> CI green
-  -> verify release artifacts -> run binary locally + console checks
+  -> verify preview Release assets -> run binary locally + console checks
  -> validate with latest rc client
  -> tag <target> at the SAME commit (zero delta) -> re-verify CI/release
 ```
@@ -23,7 +25,7 @@ On validation failure: fix lands on main via normal PR (version files are alread
 ## Required inputs

 - Final target version, for example `1.0.0-beta.10`.
- Preview iteration `N` (default: next unused preview tag for that target; check with `git tag -l '<target>-preview.*'` — and for stable targets `git tag -l '<target>-rc.*'` — after `git fetch --tags`).
+- Preview iteration `N` (default: next unused preview tag for that target; check with `git tag -l '<target>-preview.*'` after `git fetch --tags`).

 If the target version is missing or ambiguous, stop and ask before doing anything (see the semver gate below).

@@ -45,14 +47,18 @@ Rules:

 ## Preview tag naming

- Prerelease target (contains `alpha`/`beta`/`rc`): preview tag is `<target>-preview.N`, e.g. `1.0.0-beta.10-preview.3`. It contains `beta`, so `build.yml`'s substring-based classification marks it prerelease — safe.
- **Stable** target (e.g. `1.1.0`): NEVER tag `1.1.0-preview.N` — `build.yml` marks a tag prerelease only if its name contains `alpha`, `beta`, or `rc`, so `1.1.0-preview.N` would be treated as a stable release and overwrite `latest.json` as stable. Use `1.1.0-rc.N` as the preview tag instead.
+- Use `<target>-preview.N` for every target, e.g. `1.0.0-beta.10-preview.3` or `1.1.0-preview.1`.
+- The canonical suffix is exactly `-preview.<digits>`. `build.yml` recognizes it before alpha/beta/rc classification and routes it to the preview-only path; any other tag containing `-preview` fails closed instead of being treated as a release.
+- A preview Release MUST be published with `isPrerelease=true` and `isLatest=false`. Any `*-latest` preview asset or preview-triggered `latest.json`, R2, Docker, or Helm publication is a pipeline failure.

 ## Hard rules

 - Version files (Cargo.toml, Cargo.lock, README, flake.nix, Chart.yaml, rustfs.spec) are bumped ONCE, directly to `<target>`. Never write a `-preview.N` suffix into any version file. If `rustfs-release-version-bump` is ever asked for a `-preview` version, that is a pipeline bug — stop.
+- Preview Release assets are versioned and intentionally visible on the Releases page. Do not label them Latest or use them to update any latest distribution channel.
 - Tags have no `v` prefix. Always annotated: `git tag -a <tag> -m "Release <tag>"`.
 - The final tag MUST point at exactly `PREVIEW_HASH` — the commit the validated preview tag points at. Never tag current `main` HEAD (commits merged after validation are unvalidated), and never create an extra version-bump commit between preview and final.
+- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
+- Generated Release notes carry a workflow-management marker so retries can repair them. Before manually curating a generated body, remove that marker; unmarked non-placeholder notes are preserved by later workflow runs.
 - Phases run in order; a failure in any phase blocks everything after it. After the fix lands on main, restart from Phase 2 with the next preview iteration against the new `origin/main` hash — do not resume mid-pipeline against a stale hash.
 - If the release is abandoned after Phase 1 merged, main's version files claim a version that was never tagged. Either revert the bump PR or leave it to be overwritten by the next release — but tell the user explicitly and record the decision.
 - User-facing status updates in Chinese; commits, PR titles/bodies, and tag messages in English. No hard-wrapping in commit messages, PR bodies, or documentation prose — one logical line per sentence/paragraph, let soft wrap handle display.
@@ -63,6 +69,61 @@ Rules:
 - `gh auth status` works; confirm you can view `gh release list -L 3`.
 - Confirm the exact final target version with the user if not explicit.

+### Console release gate
+
+Complete this gate before changing any RustFS version file or creating any RustFS tag. RustFS `build.yml` downloads the asset returned by `repos/rustfs/console/releases/latest`, so a successful Console build alone is insufficient.
+
+1. Read the latest published Console tag and compare it with Console `main`:
+
+```bash
+CONSOLE_REPO="rustfs/console"
+CONSOLE_LATEST=$(gh api "repos/${CONSOLE_REPO}/releases/latest" --jq .tag_name)
+gh api "repos/${CONSOLE_REPO}/compare/${CONSOLE_LATEST}...main" \
+  --jq '{status, ahead_by, behind_by, commits: [.commits[] | {sha, message: .commit.message}]}'
+```
+
+- `ahead_by == 0`: no merged Console change is waiting for release. Still verify the current latest asset using step 4, then continue to Phase 1.
+- `ahead_by > 0` and `behind_by == 0`: publish Console before continuing. Report the merged commits and select the next unused `vX.Y.Z` tag. Default to the next patch version when the changes are fixes or backward-compatible UI work; stop for confirmation if a minor/major bump is plausible.
+- Any diverged history or `behind_by > 0`: stop and resolve the Console release baseline explicitly. Do not guess a range or publish RustFS.
+
+2. Clone/fetch `rustfs/console` into a scratch directory and record its exact `main` commit. Before creating a tag, check for a `v*` tag or Release workflow already associated with that hash. If one is in progress, wait for it instead of creating another version:
+
+```bash
+CONSOLE_SCRATCH=$(mktemp -d)
+gh repo clone "$CONSOLE_REPO" "$CONSOLE_SCRATCH/console"
+git -C "$CONSOLE_SCRATCH/console" fetch origin main --tags
+CONSOLE_HASH=$(git -C "$CONSOLE_SCRATCH/console" rev-parse origin/main)
+git -C "$CONSOLE_SCRATCH/console" tag --points-at "$CONSOLE_HASH" 'v*'
+gh run list -R "$CONSOLE_REPO" --workflow release.yml --commit "$CONSOLE_HASH" --limit 5
+```
+
+If no release exists or is running for `CONSOLE_HASH`, create the selected annotated tag at that exact hash and push it:
+
+```bash
+git -C "$CONSOLE_SCRATCH/console" tag -a "<console-tag>" -m "Release <console-tag>" "$CONSOLE_HASH"
+git -C "$CONSOLE_SCRATCH/console" push origin "<console-tag>"
+```
+
+Console tags include the `v` prefix. Pushing the tag triggers `.github/workflows/release.yml` (`🚀 Release`). Remove `CONSOLE_SCRATCH` after the gate completes.
+
+3. Find the exact tag run and wait for completion:
+
+```bash
+gh run list -R "$CONSOLE_REPO" --workflow release.yml --branch "<console-tag>" --limit 1
+gh run watch -R "$CONSOLE_REPO" "<console-run-id>" --exit-status
+```
+
+4. Block until the published Release is non-draft, the latest endpoint returns the expected tag, and `rustfs-console-<console-tag>.zip` is uploaded, non-empty, and carries a `sha256:` digest:
+
+```bash
+gh release view -R "$CONSOLE_REPO" "<console-tag>" --json isDraft,isPrerelease,assets,url
+test "$(gh api "repos/${CONSOLE_REPO}/releases/latest" --jq .tag_name)" = "<console-tag>"
+test "$(gh api "repos/${CONSOLE_REPO}/releases/tags/<console-tag>" \
+  --jq '[.assets[] | select(.name == "rustfs-console-<console-tag>.zip" and .state == "uploaded" and .size > 0 and (.digest | startswith("sha256:")))] | length')" -eq 1
+```
+
+Treat a missing/mismatched asset, digest, latest tag, or failed/cancelled workflow as BLOCKED. Do not start Phase 1 until the Console gate passes. Record `CONSOLE_TAG`, `CONSOLE_HASH`, Console run URL, and Release URL for the final report.
+
 ## Phase 1 — Version bump to the final target (once)

 - If main's version files already read `<target>` (e.g. this is a restart after a failed preview), verify with `rg -n "<target>" Cargo.toml rustfs.spec helm/rustfs/Chart.yaml` and skip to Phase 2.
@@ -85,16 +146,17 @@ git push origin "<preview-tag>"

 Pushing the tag triggers `.github/workflows/build.yml` ("Build and Release"); `docker.yml` chains off it via `workflow_run`.

+The preview run builds versioned artifacts and publishes them in a GitHub prerelease. Its latest-channel, R2, Docker, and Helm jobs must be skipped. Those publication paths run only after the final tag is pushed.
+
 On a restart (N+1), refresh `PREVIEW_HASH=$(git rev-parse origin/main)` first — it must contain the fix — and re-report it.

-## Phase 3 — CI and artifact verification
+## Phase 3 — CI and preview Release verification

- Watch the tag build: `gh run list --workflow build.yml --limit 5` then `gh run watch <run-id>`. Every matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64) plus the release and latest.json jobs.
- Verify the GitHub release: `gh release view "<preview-tag>" --json isPrerelease,assets`
-  - `isPrerelease` must be `true`.
-  - Assets must include all 6 platform zips in both versioned (`rustfs-<platform>-v<tag>.zip`) and `-latest` forms, plus `SHA256SUMS`, `SHA512SUMS`, `rustfs-<tag>.sbom.cdx.json`, `rustfs-<tag>.provenance.json`.
- Verify the chained Docker run succeeded: `gh run list --workflow docker.yml --limit 3`.
- Checksum spot-check for the platform you will run locally: download the zip and `SHA256SUMS`, verify with `shasum -a 256 -c` (grep to one line).
+- Find and watch the tag build: `gh run list --workflow build.yml --branch "<preview-tag>" --limit 1` then `gh run watch <run-id>`. Every build matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64).
+- Confirm the Release publication jobs (`create-release`, `upload-release-assets`, and `publish-release`) succeed while `update-latest-version` is skipped.
+- Verify `gh release view "<preview-tag>" --json isPrerelease,assets,url`: `isPrerelease` must be `true`, and the Release must contain all 6 versioned platform zips, checksums, SBOM, and provenance with no `-latest` assets. Confirm `gh api repos/{owner}/{repo}/releases/latest --jq .tag_name` does not return `<preview-tag>`.
+- Record `PREVIOUS_DELIVERABLE`, selected from published Releases by `publishedAt` after excluding the current tag and every `-preview.N` tag. Verify `gh release view "<preview-tag>" --json body --jq .body` contains `## What's Changed` and, when `PREVIOUS_DELIVERABLE` exists, `**Full Changelog**: https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<preview-tag>`. For a repository with no previous deliverable, verify a Full Changelog link exists and record the GitHub baseline fallback.
+- Confirm preview-triggered Docker and Helm jobs are skipped. Preview validation covers the built RustFS binaries, embedded console, and rc compatibility; Docker image construction and Helm publication are deferred to the final tag because the Dockerfiles consume GitHub Release assets.

 ## Phase 4 — Run the artifact locally, verify the console

@@ -157,13 +219,15 @@ git push origin "<target>"
 ```

 - CI rebuilds from the same source; the only changed input is the tag name, so the binary now self-reports `<target>`.
- Re-run the Phase 3 verification against the final tag: all matrix jobs green; `gh release view "<target>"` shows the full asset set; for a prerelease target `isPrerelease` is `true`, for a stable target it must be `false` and `latest.json` must be updated.
+- Verify the final tag's complete publication path: all matrix and release jobs green; `gh release view "<target>"` shows the full versioned and `-latest` asset set plus checksums, SBOM, and provenance; Docker and Helm workflows succeed; `latest.json` points to `<target>`. A stable target must have `isPrerelease=false` and `isLatest=true`. An alpha/beta/rc target must have `isPrerelease=true`; GitHub does not permit prereleases to be Latest, but the project `latest.json` still advances to the final non-preview target.
+- Verify the final Release body contains `## What's Changed` and a Full Changelog link. When `PREVIOUS_DELIVERABLE` exists, the link MUST be `https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<target>` and the baseline MUST equal the preview Release baseline; for example, both `1.0.0-beta.12-preview.1` and `1.0.0-beta.12` compare from `1.0.0-beta.11`.
 - Optionally spot-check `./rustfs --version` from a final-tag artifact — it must report `<target>`.

 ## Output contract

 Always report:

+- Console gate result: previous/latest Console tags, whether merged changes required a release, `CONSOLE_HASH`, and Console run/Release URLs when a release was published.
 - Target version, preview tag(s) used, `PREVIEW_HASH` (which both tags point at).
- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: CI run URLs, release URLs, console check results, the rc command matrix.
+- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: preview and final Release URLs, preview `isPrerelease`/`isLatest` state, final latest-channel state, console check results, and the rc command matrix.
 - Any deviation from this pipeline and why the user approved it.
@@ -18,7 +18,7 @@ Validated baseline: release pattern used in PR `#2957`.

 If target version is missing or ambiguous, stop and ask before editing.

-Reject any target version containing a `-preview.` suffix: preview identifiers are tag-only (see `rustfs-release-publish`) and must never be written into version files. If asked for one, stop and point to the release pipeline instead of editing.
+Reject any target version containing `-preview`: preview identifiers are tag-only (see `rustfs-release-publish`) and must never be written into version files. If asked for one, stop and point to the release pipeline instead of editing.

 ## Read before editing

@@ -99,6 +99,8 @@ For the full pattern map, read [advisory-patterns.md](references/advisory-patter
 ### Logging and debug output
 - Logs must never include access keys beyond safe identifiers, secret keys, session tokens, JWT claims, HMAC secrets, expected signatures, license secrets, or raw response bodies containing credentials.
 - Treat `Debug` implementations, `?value` tracing, merged config dumps, and dependency-level HTTP body logging as leak surfaces.
+- Error and panic messages are log content: they propagate through `?` and get printed by `error!`/startup logging far from where they were constructed. Never interpolate a raw config or credential value into an error string.
+- A value that fails secret-format parsing is usually the secret itself (e.g. a bare base64 key missing its `<name>:` prefix), so a parse-failure hint must name the env var or file and the expected format, never echo the input. Redacting `Debug` impls does not cover this channel.
 - Add log-capture tests or targeted unit tests for redaction wrappers when changing credential structs or response bodies.

 ### RPC, parsing, and panic safety
@@ -139,6 +141,7 @@ Use these prompts while reviewing a diff:
 - Does a public/default/empty config change security behavior from fail-closed to fail-open?
 - Is any attacker-controlled value later used as a path, policy condition, credential identity, log field, URL, Origin, or response body?
 - Does this response contain stored replication, remote target, or service credentials that need redaction or stricter authorization?
+- Does any error constructor or `format!` interpolate a variable that can hold secret material, including a config parse error that echoes the raw input?
 - Does an IAM export/import path expose or trust plaintext credential secrets beyond the caller's intended authority?
 - Can this STS/OIDC path issue credentials without SigV4, trusted issuer validation, allowlisted redirects, or trusted-proxy host/scheme handling?
 - Can a service-account or STS token omit `exp`, forge `sessionPolicy`, or use a principal-controlled key as signing authority?
@@ -60,6 +60,11 @@ body-cache-whitelist-check: ## Check the body-cache eligibility gate stays a fai
 	@echo "🧱 Checking body-cache whitelist guard..."
 	./scripts/check_body_cache_whitelist.sh

+.PHONY: fips-wording-check
+fips-wording-check: ## Check outward docs do not make unsupported FIPS claims
+	@echo "📣 Checking FIPS wording guard..."
+	./scripts/check_fips_wording.sh
+
 .PHONY: log-analyzer-rules-check
 log-analyzer-rules-check: core-deps ## Check log-analyzer rule anchors still exist verbatim in source
 	@echo "🩺 Checking log-analyzer rule anchors..."
@@ -19,13 +19,13 @@ planning-docs-check: ## Check that no planning-type documents are committed
 	./scripts/check_no_planning_docs.sh

 .PHONY: pre-commit
-pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
+pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check fips-wording-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
 	@echo "✅ All pre-commit checks passed!"

 .PHONY: pre-pr
-pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests
+pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check fips-wording-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests
 	@echo "✅ All pre-PR checks passed!"

 .PHONY: dev-check
-dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks
+dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check fips-wording-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks
 	@echo "✅ Fast development checks passed!"
@@ -26,6 +26,13 @@ script-tests: ## Run shell script tests
 	@echo "Running script tests..."
 	./scripts/test_build_rustfs_options.sh
 	./scripts/test_entrypoint_credentials.sh
+	./scripts/test_internode_grpc_ab_bench.sh
+	./scripts/test_object_batch_bench_enhanced.sh
+	./scripts/test_hotpath_warp_ab_gate.sh
+	./scripts/test_hotpath_warp_abba.sh
+	./scripts/test_exact_1mib_handoff_abba.sh
+	./scripts/test_pinned_paired_abba_bench.sh
+	./scripts/test_manual_transition_runbooks.sh
 	bash -n ./scripts/validate_object_data_cache_cold_stampede.sh
 	python3 ./scripts/check_object_data_cache_follower_samples.py --self-test
 	./scripts/validate_object_data_cache_cold_stampede.sh --self-test
@@ -1,17 +1,16 @@
 # nextest configuration for RustFS.
 #
-# Serialize two known load-sensitive / global-state-sharing ecstore test groups
-# so the full parallel nextest suite stops producing spurious failures
-# (backlog #937). These tests pass in isolation but flake under the loaded
-# parallel run for two distinct reasons:
+# Serialize the ecstore tests that share the process-wide disk registry or
+# exercise a multi-disk commit handoff across nextest process boundaries.
 #
 #   * store::bucket::tests::bucket_delete_* share process/global state (disk
 #     registry, lock client) and race make_bucket into InsufficientWriteQuorum
 #     when run concurrently with other ecstore tests.
 #   * bucket_lifecycle_ops::tests::concurrent_resend_same_part_commits_one_generation
-#     asserts a lock-acquire correctness property whose serialized cross-disk
-#     commits exceed the (already max'd, 60s) acquire deadline only when the
-#     suite saturates disk I/O.
+#     uses the shared multipart fixture and a deterministic uploadId-lock
+#     handoff, so it must not overlap another process mutating that fixture.
+#   * bucket::metadata_sys::tests::concurrent_config_writes_from_separate_nodes_do_not_lose_writes
+#     uses the shared transaction lock and must not overlap other ecstore tests.
 #
 # serial_test's #[serial] attribute does NOT serialize these across runs:
 # nextest executes each test in its own process, where the in-process
@@ -39,10 +38,11 @@ ecstore-serial-flaky = { max-threads = 1 }
 # servers never run at once. ci-7's nightly picks these up via the e2e suite;
 # they are deliberately NOT in the fast PR `e2e-smoke` filter.
 e2e-reliability = { max-threads = 1 }
+e2e-inline-boundaries = { max-threads = 1 }

 # --- default profile (local): serialize the flaky groups, never retry --------
 [[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(/^store::bucket::tests::bucket_delete_(mark_delete|purge_removes|default_s3_delete)/))'
+filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(concurrent_config_writes_from_separate_nodes_do_not_lose_writes) | test(/^store::bucket::tests::bucket_delete_(mark_delete|purge_removes|default_s3_delete)/))'
 test-group = 'ecstore-serial-flaky'

 # Serialize the multipart crash-consistency scenarios (dist-2, backlog#1150):
@@ -54,6 +54,22 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::multipart::tests::crash_consistency::/)'
 test-group = 'ecstore-serial-flaky'

+# Serialize the durable manual-transition checkpoint test across nextest's
+# process boundary; it mutates bucket lifecycle metadata and is not quarantined.
+[[profile.default.overrides]]
+filter = 'package(rustfs-ecstore) & test(manual_transition_page_checkpoint_persists_durable_job_progress)'
+test-group = 'ecstore-serial-flaky'
+
+# Serialize the bucket-incarnation / lifecycle-fence tests. They drive
+# init_bucket_metadata_sys and bucket_metadata_sys_of, i.e. process-global
+# OnceLock state that serial_test's #[serial] cannot protect across nextest's
+# process boundary, and they delete+recreate buckets — the same shape that
+# raced into InsufficientWriteQuorum in backlog#937. Preventive only, no
+# retries. The matching ci-profile override is after [profile.ci].
+[[profile.default.overrides]]
+filter = 'package(rustfs-ecstore) & (test(bucket_delete_waits_for_config_mutation_fence) | test(stale_config_request_cannot_mutate_a_recreated_bucket) | test(disk_incarnation_read_detects_stale_cache_until_peer_reload) | test(lifecycle_expiry_fails_closed_on_corrupt_object_lock_metadata) | test(expiry_configs_are_resolved_from_the_owning_store))'
+test-group = 'ecstore-serial-flaky'
+
 # Serialize the 4-disk reliability / degraded-read e2e tests (see the
 # e2e-reliability test-group note above). The matching ci-profile override is at
 # the end of the file, after [profile.ci] is declared.
@@ -61,6 +77,10 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression)_test::/)'
 test-group = 'e2e-reliability'

+[[profile.default.overrides]]
+filter = 'package(e2e_test) & test(/^inline_fast_path_cluster_test::/)'
+test-group = 'e2e-inline-boundaries'
+
 # ---------------------------------------------------------------------------
 # ci profile — the strict CI gate (ci.yml `cargo nextest run --profile ci`)
 # ---------------------------------------------------------------------------
@@ -89,13 +109,6 @@ path = "junit.xml"
 # profile's own overrides list, not the default profile's).
 # ===========================================================================

-# QUARANTINE: OPEN backlog#937 — concurrent_resend lock-acquire deadline flakes
-# under saturated disk I/O in the full parallel suite.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(concurrent_resend_same_part_commits_one_generation)'
-test-group = 'ecstore-serial-flaky'
-retries = 2
-
 # QUARANTINE: OPEN backlog#937 — store::bucket::tests::bucket_delete_* race
 # make_bucket into InsufficientWriteQuorum via shared global state under load.
 [[profile.ci.overrides]]
@@ -103,6 +116,11 @@ filter = 'package(rustfs-ecstore) & test(/^store::bucket::tests::bucket_delete_(
 test-group = 'ecstore-serial-flaky'
 retries = 2

+# Keep deterministic ECStore write handoffs isolated across nextest processes.
+[[profile.ci.overrides]]
+filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(concurrent_config_writes_from_separate_nodes_do_not_lose_writes))'
+test-group = 'ecstore-serial-flaky'
+
 # QUARANTINE: OPEN rustfs#4690 — walk_dir stall-budget accounting test depends
 # on producer/consumer timing windows that stretch past the budget on loaded
 # CI runners (regression test for rustfs#4644; failed on a zero-Rust-diff PR).
@@ -125,6 +143,18 @@ test-group = 'e2e-reliability'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::multipart::tests::crash_consistency::/)'
 test-group = 'ecstore-serial-flaky'

+# Serialize the durable manual-transition checkpoint test under the ci profile
+# too. No retries: failures stay visible.
+[[profile.ci.overrides]]
+filter = 'package(rustfs-ecstore) & test(manual_transition_page_checkpoint_persists_durable_job_progress)'
+test-group = 'ecstore-serial-flaky'
+
+# Serialize the bucket-incarnation / lifecycle-fence tests under the ci profile
+# too (see the matching default-profile override near the top). No retries.
+[[profile.ci.overrides]]
+filter = 'package(rustfs-ecstore) & (test(bucket_delete_waits_for_config_mutation_fence) | test(stale_config_request_cannot_mutate_a_recreated_bucket) | test(disk_incarnation_read_detects_stale_cache_until_peer_reload) | test(lifecycle_expiry_fails_closed_on_corrupt_object_lock_metadata) | test(expiry_configs_are_resolved_from_the_owning_store))'
+test-group = 'ecstore-serial-flaky'
+
 # ---------------------------------------------------------------------------
 # e2e-smoke profile — PR smoke subset of the e2e_test crate (backlog#1149 ci-4)
 # ---------------------------------------------------------------------------
@@ -156,7 +186,7 @@ test-group = 'ecstore-serial-flaky'
 # the nightly profile derives its set as "the replication module MINUS this
 # allowlist", so any new replication test lands in nightly by default (never
 # silently unrun) until it is explicitly blessed as fast here. Keep the two
-# regexes byte-identical. Count invariant: 20 here + 27 nightly = 47 total
+# regexes byte-identical. Count invariant: 20 here + 28 nightly = 48 total
 # (authority: `cargo nextest list`; docs/testing/e2e-suite-inventory.md).
 # HISTORY (2026-07-11): the 20 fast tests were briefly pulled out of this lane
 # (#4724) because they set a loopback (127.0.0.1) replication target that the
@@ -192,7 +222,7 @@ test-group = 'ecstore-serial-flaky'
 [profile.e2e-smoke]
 default-filter = """
    package(e2e_test) & (
-        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_source_invalid_date|content_encoding|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools)_test::|^fake_s3_target::/)
+        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|multipart_storage_class|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat)_test::|^fake_s3_target::/)
        | test(/^replication_extension_test::(test_replication_check_succeeds_with_remote_target|test_replication_check_rejects_target_without_object_lock|test_set_remote_target_rejects_unversioned_source_bucket|test_replication_check_rejects_unversioned_source_bucket|test_replication_check_rejects_missing_replication_config|test_replication_check_rejects_invalid_bucket|test_set_remote_target_rejects_same_bucket_on_same_deployment|test_set_remote_target_rejects_unversioned_target_bucket|test_set_remote_target_update_requires_arn|test_set_remote_target_update_rejects_missing_target|test_set_remote_target_rejects_invalid_target_url|test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify|test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem|test_list_remote_targets_rejects_empty_bucket|test_list_remote_targets_rejects_invalid_bucket|test_remove_remote_target_rejects_missing_target|test_remove_remote_target_rejects_missing_arn|test_remove_remote_target_rejects_invalid_bucket|test_remove_remote_target_rejects_target_used_by_replication|test_delete_bucket_replication_removes_remote_target)$/)
        | test(/^reliant::lifecycle::/)
        | test(/^reliant::tiering::/)
@@ -200,6 +230,17 @@ default-filter = """
 """
 fail-fast = false

+[profile.e2e-smoke.junit]
+path = "junit.xml"
+
+# The pagination boundary cases can stall when a server/listing regression
+# prevents the continuation request from completing. Keep the timeout scoped
+# to those known failure modes so legitimate lifecycle/tiering waits retain
+# their test-level timing budget.
+[[profile.e2e-smoke.overrides]]
+filter = 'package(e2e_test) & test(/^list_objects_v2_pagination_test::tests::(test_list_objects_v2_delimiter_small_page_traverses_all|test_list_objects_v2_max_keys_above_limit_returns_token|test_list_objects_v2_maxkeys_above_limit_with_delimiter)$/)'
+slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
+
 # ---------------------------------------------------------------------------
 # e2e-repl-nightly profile — scheduled full replication e2e lane (repl-1)
 # ---------------------------------------------------------------------------
@@ -211,7 +252,7 @@ fail-fast = false
 #     and poll until source and target converge; two replicate over HTTPS, two
 #     pin active SSE failure contracts, and one guards event/history observers.
 #     The SSE-S3 contract remains ignored under backlog#1291.
-#   * 11 `_real_dual_node` site-replication tests — each spawns TWO full rustfs
+#   * 12 `_real_dual_node` site-replication tests — each spawns TWO full rustfs
 #     servers and drives the cross-process site-replication control plane.
 #   * 1 `_real_three_node` site-replication test.
 #   * 1 `_real_single_node` service-account round-trip test.
@@ -288,9 +329,6 @@ path = "junit.xml"
 # negative-path siblings of each family stay in as regression guards.
 #   * rustfs#4843 — over-limit archive entry paths hard-reject the whole
 #     archive even under ignore-errors semantics.
-#   * rustfs#4846 — distributed-lock quorum tests misclassify as timeout
-#     under parallel load (multi-node in-process clusters; natural home is
-#     ci-7's nightly cluster lane).
 [profile.e2e-full]
 default-filter = """
    package(e2e_test)
@@ -299,7 +337,6 @@ default-filter = """
    & !test(/^replication_extension_test::/)
    & !test(/^multipart_auth_test::test_signed_put_object_extract_skips_invalid_entry_when_ignore_errors_enabled$/)
    & !test(/^snowball_auto_extract_test::tests::snowball_auto_extract_(ignores_invalid_entries_when_requested|supports_standard_headers_with_combined_extract_options)$/)
-    & !test(/^reliant::lock::test_distributed_lock_(2_nodes_grpc_read_survives_failed_node|4_nodes_grpc_read_write_quorum_split_with_two_failed_nodes)$/)
 """
 fail-fast = false

@@ -314,3 +351,7 @@ path = "junit.xml"
 [[profile.e2e-full.overrides]]
 filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression)_test::/)'
 test-group = 'e2e-reliability'
+
+[[profile.e2e-full.overrides]]
+filter = 'package(e2e_test) & test(/^inline_fast_path_cluster_test::/)'
+test-group = 'e2e-inline-boundaries'
@@ -60,6 +60,16 @@ The file `prometheus-rules/rustfs-get-optimization-alerts.yaml` contains pre-con
 | `CodecStreamingFallbackSpike` | Warning | Codec streaming fallback > 10x baseline for 10m |
 | `IoQueueSaturation` | Warning | IO queue utilization > 90% for 5m |

+The file `prometheus-rules/rustfs-kms-alerts.yml` contains alerting rules for the KMS backend operation metrics. Thresholds are conservative defaults pending staging baseline calibration; response procedures live in `docs/operations/kms-observability-runbook.md`, and the matching dashboard is `deploy/observability/grafana/rustfs-kms-observability.json`.
+
+| Alert | Severity | Condition |
+|-------|----------|-----------|
+| `KmsBackendFatalErrors` | Critical | Fatal (non-retryable) attempt failures > 0 for 5m |
+| `KmsBackendHighErrorRate` | Critical | Non-success operation ratio > 5% for 10m (with traffic guard) |
+| `KmsBackendP99LatencyHigh` | Warning | Operation p99 duration (incl. retries) > 2s for 10m |
+| `KmsBackendAttemptFailureSpike` | Warning | Attempt failure rate > 0.5/s for 10m |
+| `KmsBackendRetryBudgetExhausted` | Warning | budget_exhausted / deadline_exceeded outcomes > 0.05/s for 10m |
+
 ### Enabling Alert Rules

 Add the alert rules file to your Prometheus configuration:
@@ -60,6 +60,16 @@
 | `CodecStreamingFallbackSpike` | 警告 | Codec streaming 回退 > 10x 基线，持续 10 分钟 |
 | `IoQueueSaturation` | 警告 | IO 队列利用率 > 90%，持续 5 分钟 |

+文件 `prometheus-rules/rustfs-kms-alerts.yml` 包含 KMS 后端操作指标的告警规则。阈值为保守默认值，待 staging 基线校准；响应流程见 `docs/operations/kms-observability-runbook.md`，配套仪表盘为 `deploy/observability/grafana/rustfs-kms-observability.json`。
+
+| 告警 | 级别 | 条件 |
+|------|------|------|
+| `KmsBackendFatalErrors` | 严重 | fatal（不可重试）尝试失败 > 0，持续 5 分钟 |
+| `KmsBackendHighErrorRate` | 严重 | 非 success 操作占比 > 5%，持续 10 分钟（含流量下限保护） |
+| `KmsBackendP99LatencyHigh` | 警告 | 操作 p99 耗时（含重试）> 2s，持续 10 分钟 |
+| `KmsBackendAttemptFailureSpike` | 警告 | 尝试失败率 > 0.5/s，持续 10 分钟 |
+| `KmsBackendRetryBudgetExhausted` | 警告 | budget_exhausted / deadline_exceeded 结果 > 0.05/s，持续 10 分钟 |
+
 ### 启用告警规则

 在 Prometheus 配置中添加告警规则文件：
@@ -11500,6 +11500,831 @@
      ],
      "title": "Compression Operations Rate",
      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 332
+      },
+      "id": 531,
+      "panels": [],
+      "title": "Metrics Dimensions Drilldown",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "ops"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 333
+      },
+      "id": 532,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "12.3.2",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "A",
+          "expr": "sum by (server, name, type) (rate(rustfs_api_requests_requests_total_by_server{job=~\"$job\",server=~\"$server\",name=~\"$api\"}[$__rate_interval]))",
+          "legendFormat": "{{server}} | {{name}} | {{type}}"
+        }
+      ],
+      "title": "API Requests by Server and API",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byFrameRefID",
+              "options": "A"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "none"
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 333
+      },
+      "id": 533,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "12.3.2",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "A",
+          "expr": "max by (server, drive, pool_index, set_index, drive_index, state) (rustfs_system_drive_runtime_state{job=~\"$job\",server=~\"$server\",drive=~\"$drive\"})",
+          "legendFormat": "{{server}} | {{drive}} | p{{pool_index}}/s{{set_index}}/d{{drive_index}} | {{state}}"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "B",
+          "expr": "max by (server, drive, pool_index, set_index, drive_index) (rustfs_system_drive_offline_duration_seconds{job=~\"$job\",server=~\"$server\",drive=~\"$drive\"})",
+          "legendFormat": "{{server}} | {{drive}} | offline seconds"
+        }
+      ],
+      "title": "Drive Runtime State and Offline Duration",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "ops"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 341
+      },
+      "id": 534,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "12.3.2",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "A",
+          "expr": "sum by (server, drive, pool_index, set_index, drive_index, api) (rate(rustfs_system_drive_api_calls_total{job=~\"$job\",server=~\"$server\",drive=~\"$drive\",api=~\"$drive_api\"}[$__rate_interval]))",
+          "legendFormat": "{{server}} | {{drive}} | p{{pool_index}}/s{{set_index}}/d{{drive_index}} | {{api}}"
+        }
+      ],
+      "title": "Drive API Calls by Operation",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "ops"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byFrameRefID",
+              "options": "B"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "short"
+              },
+              {
+                "id": "custom.axisPlacement",
+                "value": "right"
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 341
+      },
+      "id": 535,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "12.3.2",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "A",
+          "expr": "sum by (server, source, state) (rate(rustfs_scanner_source_work_total{job=~\"$job\",server=~\"$server\",source=~\"$scanner_source\"}[$__rate_interval]))",
+          "legendFormat": "{{server}} | {{source}} | {{state}}"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "B",
+          "expr": "sum by (server, cycle_scope, source, state) (rustfs_scanner_cycle_source_work{job=~\"$job\",server=~\"$server\",source=~\"$scanner_source\"})",
+          "legendFormat": "{{server}} | {{cycle_scope}} | {{source}} | {{state}}"
+        }
+      ],
+      "title": "Scanner Source Work by Server",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "ops"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byFrameRefID",
+              "options": "B"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "short"
+              },
+              {
+                "id": "custom.axisPlacement",
+                "value": "right"
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 349
+      },
+      "id": 536,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "12.3.2",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "A",
+          "expr": "sum by (server, bucket, drive, result) (rate(rustfs_scanner_bucket_drive_result_total{job=~\"$job\",server=~\"$server\",bucket=~\"$bucket\",drive=~\"$drive\",result=~\"$scanner_result\"}[$__rate_interval]))",
+          "legendFormat": "{{server}} | {{bucket}} | {{drive}} | {{result}}"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "B",
+          "expr": "sum by (server, cycle_scope, bucket, drive, result) (rustfs_scanner_cycle_bucket_drive_result{job=~\"$job\",server=~\"$server\",bucket=~\"$bucket\",drive=~\"$drive\",result=~\"$scanner_result\"})",
+          "legendFormat": "{{server}} | {{cycle_scope}} | {{bucket}} | {{drive}} | {{result}}"
+        }
+      ],
+      "title": "Scanner Bucket Drive Results",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "ops"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byFrameRefID",
+              "options": "B"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "Bps"
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 349
+      },
+      "id": 537,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "12.3.2",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "A",
+          "expr": "sum by (bucket, target_arn) (rate(rustfs_bucket_replication_target_sent_count{job=~\"$job\",bucket=~\"$bucket\",target_arn=~\"$target_arn\"}[$__rate_interval]))",
+          "legendFormat": "sent objects | {{bucket}} | {{target_arn}}"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "B",
+          "expr": "sum by (bucket, target_arn) (rate(rustfs_bucket_replication_target_sent_bytes{job=~\"$job\",bucket=~\"$bucket\",target_arn=~\"$target_arn\"}[$__rate_interval]))",
+          "legendFormat": "sent bytes | {{bucket}} | {{target_arn}}"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "C",
+          "expr": "sum by (bucket, target_arn) (rate(rustfs_bucket_replication_target_total_failed_count{job=~\"$job\",bucket=~\"$bucket\",target_arn=~\"$target_arn\"}[$__rate_interval]))",
+          "legendFormat": "failed objects | {{bucket}} | {{target_arn}}"
+        }
+      ],
+      "title": "Bucket Replication Target Flow",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "smooth",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "showValues": false,
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 357
+      },
+      "id": 538,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull",
+            "max"
+          ],
+          "displayMode": "table",
+          "placement": "right",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "pluginVersion": "12.3.2",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "A",
+          "expr": "max by (server, target_id) (rustfs_audit_target_queue_length_by_server{job=~\"$job\",server=~\"$server\"})",
+          "legendFormat": "audit queue | {{server}} | {{target_id}}"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "range": true,
+          "refId": "B",
+          "expr": "max by (server, action, state) (rustfs_ilm_action_tasks{job=~\"$job\",server=~\"$server\"})",
+          "legendFormat": "ilm | {{server}} | {{action}} | {{state}}"
+        }
+      ],
+      "title": "Audit and ILM by Server",
+      "type": "timeseries"
    }
  ],
  "preload": false,
@@ -11551,6 +12376,32 @@
        "sort": 1,
        "type": "query"
      },
+      {
+        "allValue": ".*",
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(rustfs_system_drive_api_calls_total,api)",
+        "includeAll": true,
+        "label": "Drive API",
+        "multi": true,
+        "name": "drive_api",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(rustfs_system_drive_api_calls_total,api)",
+          "refId": "PrometheusVariableQueryEditor-drive_api"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      },
      {
        "allValue": ".*",
        "current": {
@@ -11670,6 +12521,136 @@
        "regex": "",
        "sort": 1,
        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(rustfs_api_requests_requests_total_by_server,server)",
+        "includeAll": true,
+        "label": "Server",
+        "multi": true,
+        "name": "server",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(rustfs_api_requests_requests_total_by_server,server)",
+          "refId": "PrometheusVariableQueryEditor-server"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(rustfs_api_requests_requests_total_by_server,name)",
+        "includeAll": true,
+        "label": "API",
+        "multi": true,
+        "name": "api",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(rustfs_api_requests_requests_total_by_server,name)",
+          "refId": "PrometheusVariableQueryEditor-api"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values({__name__=\"rustfs_bucket_replication_target_sent_count\",bucket=~\"$bucket\"},target_arn)",
+        "includeAll": true,
+        "label": "Target ARN",
+        "multi": true,
+        "name": "target_arn",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values({__name__=\"rustfs_bucket_replication_target_sent_count\",bucket=~\"$bucket\"},target_arn)",
+          "refId": "PrometheusVariableQueryEditor-target_arn"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(rustfs_scanner_source_work_total,source)",
+        "includeAll": true,
+        "label": "Scanner Source",
+        "multi": true,
+        "name": "scanner_source",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(rustfs_scanner_source_work_total,source)",
+          "refId": "PrometheusVariableQueryEditor-scanner_source"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(rustfs_scanner_bucket_drive_result_total,result)",
+        "includeAll": true,
+        "label": "Scanner Result",
+        "multi": true,
+        "name": "scanner_result",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(rustfs_scanner_bucket_drive_result_total,result)",
+          "refId": "PrometheusVariableQueryEditor-scanner_result"
+        },
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
      }
    ]
  },
@@ -0,0 +1,214 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# =============================================================================
+# RustFS KMS backend — Prometheus alerting rules
+# =============================================================================
+#
+# Metric source: the KMS operation-policy choke point in
+# crates/kms/src/policy.rs. All label values are bounded static strings
+# (operation, op_class, outcome, error_class, backend, scope); key identifiers,
+# key material, and tokens never appear in labels.
+#
+# Response procedures: docs/operations/kms-observability-runbook.md
+#
+# IMPORTANT — threshold status: every numeric threshold below is a
+# conservative default chosen without a production baseline. Calibrate against
+# a staging baseline before relying on these alerts for paging, and prefer
+# loosening over tightening until the baseline exists. Formal SLO targets are
+# deliberately not encoded here (see rustfs/backlog#1584).
+#
+# NOTE: prometheus.yml loads /etc/prometheus/rules/*.yml — keep the .yml
+# extension or the file is silently ignored by the docker-compose stack.
+#
+# Validate: promtool check rules rustfs-kms-alerts.yml
+# =============================================================================
+
+groups:
+  # ==========================================================================
+  # Critical alerts — immediate action required
+  # ==========================================================================
+  - name: rustfs-kms-critical
+    interval: 30s
+    rules:
+      # ------------------------------------------------------------------
+      # 1. KmsBackendFatalErrors
+      #    Any attempt failure classified as fatal (non-retryable): auth
+      #    or permission errors, malformed requests, missing keys. The
+      #    policy never retries these, so even a low rate means real
+      #    operations are failing right now.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendFatalErrors
+        expr: |
+          sum by (operation) (rate(rustfs_kms_backend_attempt_failures_total{error_class="fatal"}[5m])) > 0
+        for: 5m
+        labels:
+          severity: critical
+          component: kms
+        annotations:
+          summary: "KMS backend fatal errors on operation {{ $labels.operation }}"
+          description: >-
+            Attempt failures classified as fatal are occurring at
+            {{ $value | printf "%.3f" }}/s on operation
+            {{ $labels.operation }}. Fatal failures are not retried:
+            each one is a KMS backend call that failed permanently
+            (authentication, permissions, malformed request, or a
+            missing key/version).
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendfatalerrors"
+
+      # ------------------------------------------------------------------
+      # 2. KmsBackendHighErrorRate
+      #    Sustained share of operations terminating without success
+      #    (fatal, budget/deadline exhaustion, admission backpressure,
+      #    or an open circuit). The cancelled outcome is excluded because
+      #    shutdowns legitimately produce it.
+      #    The traffic guard keeps a single failure on a near-idle
+      #    cluster from firing the alert.
+      #    Threshold: 5% for 10m — conservative default, calibrate
+      #    against a staging baseline.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendHighErrorRate
+        expr: |
+          (
+            sum(rate(rustfs_kms_backend_operations_total{outcome!~"success|cancelled"}[5m]))
+            /
+            clamp_min(sum(rate(rustfs_kms_backend_operations_total[5m])), 1e-9)
+          ) > 0.05
+          and
+          sum(rate(rustfs_kms_backend_operations_total[5m])) > 0.02
+        for: 10m
+        labels:
+          severity: critical
+          component: kms
+        annotations:
+          summary: "KMS backend non-success ratio above 5% for 10m"
+          description: >-
+            {{ $value | humanizePercentage }} of KMS backend operations
+            are terminating in fatal, budget_exhausted,
+            deadline_exceeded, backpressure_timeout,
+            backpressure_rejected, or circuit_open. Object encryption
+            and decryption paths depending on the KMS are degraded or
+            failing.
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendhigherrorrate"
+
+  # ==========================================================================
+  # Warning alerts — investigation needed
+  # ==========================================================================
+  - name: rustfs-kms-warning
+    interval: 30s
+    rules:
+      # ------------------------------------------------------------------
+      # 3. KmsBackendP99LatencyHigh
+      #    p99 wall-clock duration of whole operations (attempts plus
+      #    backoff) is sustained above 2 seconds. Because the histogram
+      #    includes retries, a high p99 usually means the retry policy
+      #    is absorbing backend failures, not that every call is slow.
+      #    Threshold: 2s for 10m — conservative default, calibrate
+      #    against a staging baseline.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendP99LatencyHigh
+        expr: |
+          histogram_quantile(0.99,
+            sum by (le) (rate(rustfs_kms_backend_operation_duration_seconds_bucket[5m]))
+          ) > 2
+        for: 10m
+        labels:
+          severity: warning
+          component: kms
+        annotations:
+          summary: "KMS backend operation p99 latency above 2s for 10m"
+          description: >-
+            The 99th-percentile KMS backend operation duration is
+            {{ $value | humanizeDuration }}, including retries and
+            backoff. Encryption and decryption latency is leaking into
+            S3 request latency.
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendp99latencyhigh"
+
+      # ------------------------------------------------------------------
+      # 4. KmsBackendAttemptFailureSpike
+      #    Aggregate attempt-failure rate (all error classes) sustained
+      #    above an absolute floor. An absolute threshold is used instead
+      #    of an offset-1d baseline ratio because fresh deployments have
+      #    no baseline and an empty offset vector would keep a ratio
+      #    alert from ever firing; switch to a baseline-relative form
+      #    (see rustfs-get-optimization-alerts.yaml for the pattern)
+      #    once a stable staging baseline exists.
+      #    Threshold: 0.5/s for 10m — conservative default, calibrate
+      #    against a staging baseline.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendAttemptFailureSpike
+        expr: |
+          sum(rate(rustfs_kms_backend_attempt_failures_total[5m])) > 0.5
+        for: 10m
+        labels:
+          severity: warning
+          component: kms
+        annotations:
+          summary: "KMS backend attempt failures above 0.5/s for 10m"
+          description: >-
+            KMS backend attempts are failing at
+            {{ $value | printf "%.2f" }}/s across all error classes.
+            The retry policy may still be masking these from callers —
+            check the error-class breakdown before it stops absorbing
+            them.
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendattemptfailurespike"
+
+      # ------------------------------------------------------------------
+      # 5. KmsBackendRetryBudgetExhausted
+      #    Operations are running out of retry budget (budget_exhausted)
+      #    or operation deadline (deadline_exceeded). These surface to
+      #    callers as failed KMS operations even though every individual
+      #    failure was retryable — the backend is unhealthy for longer
+      #    than the policy can bridge.
+      #    Threshold: 0.05/s for 10m — conservative default, calibrate
+      #    against a staging baseline.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendRetryBudgetExhausted
+        expr: |
+          sum by (outcome) (rate(rustfs_kms_backend_operations_total{outcome=~"budget_exhausted|deadline_exceeded"}[5m])) > 0.05
+        for: 10m
+        labels:
+          severity: warning
+          component: kms
+        annotations:
+          summary: "KMS backend operations exhausting retry budget ({{ $labels.outcome }})"
+          description: >-
+            KMS backend operations are terminating as
+            {{ $labels.outcome }} at {{ $value | printf "%.3f" }}/s.
+            Retryable failures are outlasting the retry budget, so
+            callers are seeing hard failures.
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendretrybudgetexhausted"
+
+      # ------------------------------------------------------------------
+      # 6. KmsBackendCircuitOpen
+      #    Direct circuit-state signal, independent of operation traffic.
+      #    A transient open can recover on its first half-open probe; alert
+      #    only when the circuit remains open or half-open for one minute.
+      # ------------------------------------------------------------------
+      - alert: KmsBackendCircuitOpen
+        expr: |
+          rustfs_kms_backend_circuit_open > 0
+        for: 1m
+        labels:
+          severity: warning
+          component: kms
+        annotations:
+          summary: "KMS backend circuit open ({{ $labels.backend }}/{{ $labels.scope }})"
+          description: >-
+            The KMS backend circuit for {{ $labels.backend }} scope
+            {{ $labels.scope }} has remained open or half-open for one
+            minute. Operations in this scope can terminate as
+            circuit_open until the half-open probe succeeds or returns
+            a non-retryable failure.
+          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendcircuitopen"
@@ -25,9 +25,13 @@ inputs:
    required: false
    default: "rustfs-deps"
  cache-save-if:
-    description: "Condition for saving cache"
+    description: >-
+      Whether to save the cache. The fail-safe default is 'false': a caller that
+      wants to populate a cache must opt in explicitly, so a forgotten input
+      costs a cold cache (minutes) rather than silently consuming the
+      repository-wide 10GB Actions cache quota and evicting other lanes.
    required: false
-    default: "true"
+    default: "false"
  install-cross-tools:
    description: "Install cross-compilation tools"
    required: false
@@ -36,28 +40,43 @@ inputs:
    description: "Target architecture to add"
    required: false
    default: ""
-  github-token:
-    description: "GitHub token for API access"
+  install-build-packaging-tools:
+    description: >-
+      Install musl-tools/zip/unzip, needed for musl linking and release
+      packaging. Off for CI test lanes, which use none of them.
    required: false
-    default: ""
+    default: "true"
+  install-test-tools:
+    description: >-
+      Install cargo-nextest and the rustfmt/clippy components. Off for release
+      and audit lanes, which run no tests and no lints.
+    required: false
+    default: "true"

 runs:
  using: "composite"
  steps:
+    # protobuf-compiler is deliberately absent: the setup-protoc step below
+    # installs 34.1 into the tool cache and prepends it to PATH, so the apt
+    # build (older, and never version-matched) was shadowed on every run and
+    # simply never used.
    - name: Install system dependencies (Ubuntu)
      if: runner.os == 'Linux'
      shell: bash
      run: |
        sudo apt-get update
        sudo apt-get install -y \
-          musl-tools \
          build-essential \
          pkg-config \
          libssl-dev \
-          ripgrep \
-          unzip \
-          zip \
-          protobuf-compiler
+          ripgrep
+
+    # musl-gcc is needed by the native musl release leg, and zip/unzip by the
+    # release packaging steps. No CI test lane touches any of them.
+    - name: Install packaging and cross-linking dependencies (Ubuntu)
+      if: runner.os == 'Linux' && inputs.install-build-packaging-tools == 'true'
+      shell: bash
+      run: sudo apt-get install -y musl-tools zip unzip

    - name: Install protoc
      uses: rustfs/setup-protoc@a3705324d8f9bf5b6c3573fb6cf8ae421db55dd6 # v3.0.1
@@ -75,7 +94,7 @@ runs:
      with:
        toolchain: ${{ inputs.rust-version }}
        targets: ${{ inputs.target }}
-        components: rustfmt, clippy
+        components: ${{ inputs.install-test-tools == 'true' && 'rustfmt, clippy' || '' }}

    - name: Install Zig
      if: inputs.install-cross-tools == 'true'
@@ -86,12 +105,24 @@ runs:
      uses: taiki-e/install-action@a21ae4029b089b9ddc45704028756f51ab8abe48 # cargo-zigbuild

    - name: Install cargo-nextest
+      if: inputs.install-test-tools == 'true'
      uses: taiki-e/install-action@96c7780c1d8a2b8723e12031def873a434d39d8d # nextest

    - name: Setup Rust cache
      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      with:
-        cache-all-crates: true
+        # false is rust-cache's own default. With true, cleanup.ts returns
+        # *before* pruning ~/.cargo/registry/src, and config.ts archives the
+        # whole registry — so every cache carried the unpacked source tree of
+        # every dependency, not just "a few extra crates".
+        #
+        # No coverage is lost: getPackages runs `cargo metadata --all-features`,
+        # a strict superset of any single lane's feature closure, and -sys crates
+        # are explicitly exempted from pruning (their src timestamps would
+        # otherwise trigger rebuilds). Anything pruned is re-unpacked from the
+        # .crate files still in registry/cache, whose mtimes crates.io
+        # normalises, so cargo fingerprints stay valid.
+        cache-all-crates: false
        cache-on-failure: true
        shared-key: ${{ inputs.cache-shared-key }}
        save-if: ${{ inputs.cache-save-if }}
@@ -37,6 +37,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -45,8 +46,11 @@ jobs:
    name: Architecture Migration Rules
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Install ripgrep
        run: |
@@ -23,6 +23,9 @@ on:
      - 'deny.toml'
      - '.github/actions/**'
      - '.github/workflows/**'
+      - 'scripts/release/create_or_update_release.sh'
+      - 'scripts/security/check_performance_ab_workflow.sh'
+      - 'scripts/security/check_preview_release_workflow.sh'
      - 'scripts/security/check_workflow_pins.sh'
  pull_request:
    types: [ opened, synchronize, reopened, closed ]
@@ -33,9 +36,17 @@ on:
      - 'deny.toml'
      - '.github/actions/**'
      - '.github/workflows/**'
+      - 'scripts/release/create_or_update_release.sh'
+      - 'scripts/security/check_performance_ab_workflow.sh'
+      - 'scripts/security/check_preview_release_workflow.sh'
      - 'scripts/security/check_workflow_pins.sh'
  schedule:
-    - cron: '0 3 * * 0' # Weekly on Sunday 03:00 UTC (staggered after the midnight ci/build crons)
+    # Daily, not weekly. This schedule exists to catch RustSec advisories
+    # published against an unchanged dependency tree; at weekly cadence a new
+    # advisory could sit unnoticed for seven days. The check list is unchanged —
+    # splitting it into a light daily advisories-only run and a weekly full run
+    # would create runs where sources/bans/licenses go unverified.
+    - cron: '0 3 * * *' # Daily 03:00 UTC (staggered after the midnight ci/build crons)
  workflow_dispatch:

 permissions:
@@ -55,6 +66,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -70,11 +82,32 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
        with:
-          cache-shared-key: rustfs-cargo-deny
+          persist-credentials: false
+
+      # cargo-deny compiles nothing, so the full setup composite (apt packages,
+      # protoc, flatc, nextest, rustfmt/clippy) was pure overhead here. It does
+      # still need a real cargo: `cargo deny check` runs `cargo metadata`, and
+      # Cargo.toml pins datafusion and s3s as git dependencies, which must be
+      # materialised into ~/.cargo/git — a cold clone is hundreds of MB, so the
+      # cache stays.
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      # Was relying on the composite's default, which used to be "true": every
+      # PR touching Cargo.toml/Cargo.lock saved a second, PR-scoped copy of this
+      # cache and pushed the main-scoped lanes out of the 10GB quota. The
+      # default is now "false", but state it explicitly — see
+      # scripts/security/check_cache_save_if.sh.
+      - name: Setup Rust cache
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          # Same reasoning as the setup composite: true archives every
+          # dependency's unpacked source tree.
+          cache-all-crates: false
+          cache-on-failure: true
+          shared-key: rustfs-cargo-deny
+          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install cargo-deny
        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
@@ -92,13 +125,31 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Report unpinned GitHub Actions
        run: ./scripts/security/check_workflow_pins.sh --enforce

+      - name: Check setup cache-save-if is explicit
+        run: ./scripts/security/check_cache_save_if.sh
+
+      - name: Check every job declares a timeout
+        run: ./scripts/security/check_job_timeouts.sh
+
+      - name: Check checkouts clear their credentials
+        run: ./scripts/security/check_persist_credentials.sh
+
+      - name: Check preview release workflow policy
+        run: ./scripts/security/check_preview_release_workflow.sh
+
+      - name: Check performance A/B workflow trust boundary
+        run: ./scripts/security/check_performance_ab_workflow.sh
+
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    if: github.event_name == 'pull_request' && github.event.action != 'closed'
    permissions:
      contents: read
@@ -106,6 +157,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
@@ -118,3 +171,28 @@ jobs:
          # conscious re-review of the license/provenance claim (backlog#1181).
          allow-dependencies-licenses: pkg:cargo/rustfs-uring@0.1.0
          comment-summary-in-pr: always
+
+  alert-on-failure:
+    name: Alert on scheduled failure
+    # dependency-review is deliberately excluded: it only runs on pull_request,
+    # so it can never contribute a failure to a scheduled run.
+    needs: [cargo-deny, workflow-pin-report]
+    # A scheduled cargo-deny failure usually means the dependency tree just
+    # matched a newly published advisory — the single most important signal this
+    # workflow produces, and until now it was only visible to whoever happened to
+    # open the Actions tab. Same ci-8 mechanism coverage.yml and
+    # e2e-replication-nightly.yml already use.
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Open or update failure-tracking issue
+        uses: ./.github/actions/schedule-failure-issue
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -50,12 +50,18 @@ on:
      - "**/*.svg"
      - ".gitignore"
      - ".dockerignore"
+      - "flake.lock"
  schedule:
    - cron: "0 1 * * 0" # Weekly on Sunday 01:00 UTC (staggered after the ci.yml midnight cron)
  workflow_dispatch:
    inputs:
      build_docker:
-        description: "Build and push Docker images after binary build"
+        # Advisory only. docker.yml triggers on workflow_run and its job-level
+        # condition requires the triggering event to be a tag push, so a manual
+        # dispatch of this workflow never produces images regardless of this
+        # value. Kept because the summary step reports it; wiring it up would
+        # mean teaching docker.yml's version parser a second event shape.
+        description: "Build and push Docker images after binary build (ignored: dispatch runs never reach docker.yml)"
        required: false
        default: true
        type: boolean
@@ -83,6 +89,7 @@ jobs:
  build-check:
    name: Build Strategy Check
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    outputs:
      should_build: ${{ steps.check.outputs.should_build }}
      build_type: ${{ steps.check.outputs.build_type }}
@@ -92,6 +99,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Determine build strategy
        id: check
@@ -107,13 +116,21 @@ jobs:

          # Determine build type based on trigger
          if [[ "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]]; then
-            # Tag push - release or prerelease
+            # Tag push - preview, release, or prerelease
            should_build=true
            tag_name="${GITHUB_REF#refs/tags/}"
            version="${tag_name}"

-            # Check if this is a prerelease
-            if [[ "$tag_name" == *"alpha"* ]] || [[ "$tag_name" == *"beta"* ]] || [[ "$tag_name" == *"rc"* ]]; then
+            # Preview tags publish a GitHub prerelease for validation, but
+            # must not update any latest channel.
+            if [[ "$tag_name" =~ -preview\.[0-9]+$ ]]; then
+              build_type="preview"
+              is_prerelease=true
+              echo "🔍 Preview build detected: $tag_name"
+            elif [[ "$tag_name" == *"-preview"* ]]; then
+              echo "❌ Invalid preview tag: $tag_name (expected suffix: -preview.<number>)" >&2
+              exit 1
+            elif [[ "$tag_name" == *"alpha"* ]] || [[ "$tag_name" == *"beta"* ]] || [[ "$tag_name" == *"rc"* ]]; then
              build_type="prerelease"
              is_prerelease=true
              echo "🚀 Prerelease build detected: $tag_name"
@@ -156,6 +173,7 @@ jobs:
    name: Prepare Platform Matrix
    needs: build-check
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    outputs:
      matrix: ${{ steps.select.outputs.matrix }}
      selected: ${{ steps.select.outputs.selected }}
@@ -163,10 +181,14 @@ jobs:
      - name: Select target platforms
        id: select
        shell: bash
+        env:
+          # via env, not interpolation: a dispatch input is free-form text and
+          # would otherwise be pasted into the script for bash to evaluate.
+          RAW_PLATFORMS: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.platforms || 'all' }}
        run: |
          set -euo pipefail

-          selected="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.platforms || 'all' }}"
+          selected="$RAW_PLATFORMS"
          selected="$(echo "${selected}" | tr -d '[:space:]')"
          if [[ -z "${selected}" ]]; then
            selected="all"
@@ -237,6 +259,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          persist-credentials: false
          fetch-depth: 0

      - name: Setup Rust environment
@@ -245,9 +268,17 @@ jobs:
          rust-version: stable
          target: ${{ matrix.target }}
          cache-shared-key: build-${{ matrix.target }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
+          # main only. A cache saved on refs/tags/X is scoped to that tag: no
+          # other tag, no main run and no PR can restore it, so every release
+          # cycle wrote up to 12 entries of 1-2GB (preview tag plus final tag,
+          # six legs each) that nobody could read, evicting the hot lanes from
+          # the repo-wide 10GB quota. Tag builds still restore the main-scoped
+          # cache, since default-branch caches are readable from every ref.
+          # The one real cost: re-running a failed leg of the same tag no longer
+          # finds that tag's own warm cache and falls back to main's.
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
          install-cross-tools: ${{ matrix.cross }}
+          install-test-tools: 'false'

      - name: Download static console assets
        shell: bash
@@ -694,9 +725,14 @@ jobs:
    needs: [ build-check, build-rustfs ]
    if: always() && needs.build-check.outputs.should_build == 'true'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Build completion summary
        shell: bash
+        env:
+          # dispatch input via env: free-form text must not be pasted into the
+          # script for bash to evaluate.
+          INPUT_BUILD_DOCKER: ${{ github.event.inputs.build_docker }}
        run: |
          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
          VERSION="${{ needs.build-check.outputs.version }}"
@@ -714,6 +750,10 @@ jobs:
          echo ""

          case "$BUILD_TYPE" in
+            "preview")
+              echo "🔍 Preview artifacts are published in a GitHub prerelease"
+              echo "⏭️  Preview releases do not update latest channels"
+              ;;
            "development")
              echo "🛠️  Development build artifacts have been uploaded to OSS dev directory"
              echo "⚠️  This is a development build - not suitable for production use"
@@ -732,7 +772,9 @@ jobs:

          echo ""
          echo "🐳 Docker Images:"
-          if [[ "${{ github.event.inputs.build_docker }}" == "false" ]]; then
+          if [[ "$BUILD_TYPE" == "preview" ]]; then
+            echo "⏭️  Preview tags do not publish Docker images"
+          elif [[ "$INPUT_BUILD_DOCKER" == "false" ]]; then
            echo "⏭️  Docker image build was skipped (binary only build)"
          elif [[ "$BUILD_STATUS" == "success" ]]; then
            echo "🔄 Docker images will be built and pushed automatically via workflow_run event"
@@ -740,12 +782,13 @@ jobs:
            echo "❌ Docker image build will be skipped due to build failure"
          fi

-  # Create GitHub Release (only for tag pushes)
+  # Create GitHub Release for every valid release tag, including previews
  create-release:
    name: Create GitHub Release
    needs: [ build-check, build-rustfs ]
-    if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    permissions:
      contents: write
    outputs:
@@ -755,6 +798,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          persist-credentials: false
          fetch-depth: 0

      - name: Create GitHub Release
@@ -767,9 +811,12 @@ jobs:
          VERSION="${{ needs.build-check.outputs.version }}"
          IS_PRERELEASE="${{ needs.build-check.outputs.is_prerelease }}"
          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
+          TARGET_COMMITISH=$(git rev-parse --verify "refs/tags/${TAG}^{commit}")

          # Determine release type for title
-          if [[ "$BUILD_TYPE" == "prerelease" ]]; then
+          if [[ "$BUILD_TYPE" == "preview" ]]; then
+            RELEASE_TYPE="preview"
+          elif [[ "$BUILD_TYPE" == "prerelease" ]]; then
            if [[ "$TAG" == *"alpha"* ]]; then
              RELEASE_TYPE="alpha"
            elif [[ "$TAG" == *"beta"* ]]; then
@@ -783,61 +830,34 @@ jobs:
            RELEASE_TYPE="release"
          fi

-          # Check if release already exists
-          if gh release view "$TAG" >/dev/null 2>&1; then
-            echo "Release $TAG already exists"
-            RELEASE_ID=$(gh release view "$TAG" --json databaseId --jq '.databaseId')
-            RELEASE_URL=$(gh release view "$TAG" --json url --jq '.url')
+          # Create release title
+          if [[ "$IS_PRERELEASE" == "true" ]]; then
+            TITLE="RustFS $VERSION (${RELEASE_TYPE})"
          else
-            # Get release notes from tag message
-            RELEASE_NOTES=$(git tag -l --format='%(contents)' "${TAG}")
-            if [[ -z "$RELEASE_NOTES" || "$RELEASE_NOTES" =~ ^[[:space:]]*$ ]]; then
-              if [[ "$IS_PRERELEASE" == "true" ]]; then
-                RELEASE_NOTES="Pre-release ${VERSION} (${RELEASE_TYPE})"
-              else
-                RELEASE_NOTES="Release ${VERSION}"
-              fi
-            fi
-
-            # Create release title
-            if [[ "$IS_PRERELEASE" == "true" ]]; then
-              TITLE="RustFS $VERSION (${RELEASE_TYPE})"
-            else
-              TITLE="RustFS $VERSION"
-            fi
-
-            # Create the release
-            PRERELEASE_FLAG=""
-            if [[ "$IS_PRERELEASE" == "true" ]]; then
-              PRERELEASE_FLAG="--prerelease"
-            fi
-
-            gh release create "$TAG" \
-              --title "$TITLE" \
-              --notes "$RELEASE_NOTES" \
-              $PRERELEASE_FLAG \
-              --draft
-
-            RELEASE_ID=$(gh release view "$TAG" --json databaseId --jq '.databaseId')
-            RELEASE_URL=$(gh release view "$TAG" --json url --jq '.url')
+            TITLE="RustFS $VERSION"
          fi

-          echo "release_id=$RELEASE_ID" >> "$GITHUB_OUTPUT"
-          echo "release_url=$RELEASE_URL" >> "$GITHUB_OUTPUT"
-          echo "Created release: $RELEASE_URL"
+          ./scripts/release/create_or_update_release.sh \
+            "$TAG" \
+            "$TARGET_COMMITISH" \
+            "$TITLE" \
+            "$IS_PRERELEASE"

  # Prepare and upload release assets
  upload-release-assets:
    name: Upload Release Assets
    needs: [ build-check, build-rustfs, create-release ]
-    if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    permissions:
      contents: write
      actions: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download all build artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -920,9 +940,10 @@ jobs:
  # the pointed-to version is a prerelease.
  update-latest-version:
    name: Update Latest Version
-    needs: [ build-check, upload-release-assets ]
-    if: startsWith(github.ref, 'refs/tags/')
+    needs: [ build-check, publish-release ]
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    steps:
      - name: Update latest.json
        env:
@@ -980,51 +1001,34 @@ jobs:
  publish-release:
    name: Publish Release
    needs: [ build-check, create-release, upload-release-assets ]
-    if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    permissions:
      contents: write
    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Update release notes and publish
+      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          TAG="${{ needs.build-check.outputs.version }}"
-          VERSION="${{ needs.build-check.outputs.version }}"
-          IS_PRERELEASE="${{ needs.build-check.outputs.is_prerelease }}"
          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
+          RELEASE_ID="${{ needs.create-release.outputs.release_id }}"

-          # Determine release type
-          if [[ "$BUILD_TYPE" == "prerelease" ]]; then
-            if [[ "$TAG" == *"alpha"* ]]; then
-              RELEASE_TYPE="alpha"
-            elif [[ "$TAG" == *"beta"* ]]; then
-              RELEASE_TYPE="beta"
-            elif [[ "$TAG" == *"rc"* ]]; then
-              RELEASE_TYPE="rc"
-            else
-              RELEASE_TYPE="prerelease"
-            fi
+          # Publish the release and correct its channel state on retries.
+          # Only a stable final release may become GitHub Latest.
+          if [[ "$BUILD_TYPE" == "release" ]]; then
+            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
+              -F draft=false \
+              -F prerelease=false \
+              -f make_latest=true >/dev/null
          else
-            RELEASE_TYPE="release"
+            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
+              -F draft=false \
+              -F prerelease=true \
+              -f make_latest=false >/dev/null
          fi

-          # Get original release notes from tag
-          ORIGINAL_NOTES=$(git tag -l --format='%(contents)' "${TAG}")
-          if [[ -z "$ORIGINAL_NOTES" || "$ORIGINAL_NOTES" =~ ^[[:space:]]*$ ]]; then
-            if [[ "$IS_PRERELEASE" == "true" ]]; then
-              ORIGINAL_NOTES="Pre-release ${VERSION} (${RELEASE_TYPE})"
-            else
-              ORIGINAL_NOTES="Release ${VERSION}"
-            fi
-          fi
-
-          # Publish the release (remove draft status)
-          gh release edit "$TAG" --draft=false
-
          echo "🎉 Released $TAG successfully!"
          echo "📄 Release URL: ${{ needs.create-release.outputs.release_url }}"
@@ -0,0 +1,265 @@
+# Copyright 2026 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Sole writer of the Rust dependency caches that ci.yml restores.
+#
+# Why this is a separate workflow rather than steps inside ci.yml: ci.yml's
+# concurrency group cancels in-progress runs on main pushes, and merges land far
+# faster than its 70-minute pipeline. Measured over 15 consecutive main pushes:
+# 12 cancelled, 2 failed, 0 succeeded. A cancelled run never reaches
+# Swatinem/rust-cache's post step (cache-on-failure does not cover cancellation),
+# so the writer lanes were saving nothing and every PR paid a cold restore —
+# 11.8-20.9 minutes of "Setup Rust environment" against 0.7-3.4 warm.
+#
+# Splitting cache writing out of the test pipeline lets ci.yml keep cancelling
+# superseded runs (which is correct — nobody needs test results for a commit
+# that is already three merges behind) while the caches still get written.
+#
+# The group below deliberately does NOT cancel in progress; see the comment on
+# it for how that bounds concurrency and why it is scoped by event.
+#
+# Each job below owns exactly one shared-key and is the only place that sets
+# cache-save-if to anything but 'false' for it; every lane in ci.yml reads.
+# scripts/security/check_cache_save_if.sh keeps the declarations explicit.
+#
+# The builds are supersets of what the reading lanes compile, because a reader
+# restores only what the writer saved. Feature resolution matters here: a lane
+# built with e2e-test-hooks resolves dependency features differently, which
+# changes -Cmetadata, so the plain build does not cover it. See
+# rustfs/backlog#1600.
+
+name: Cache Warm
+
+on:
+  push:
+    branches: [ main ]
+    # Mirrors ci.yml's push paths-ignore: if a commit cannot change what ci.yml
+    # compiles, it cannot change what ci.yml needs restored either.
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
+      - "deploy/**"
+      - "scripts/dev_*.sh"
+      - "scripts/probe.sh"
+      - "LICENSE*"
+      - ".gitignore"
+      - ".dockerignore"
+      - "README*"
+      - "**/*.png"
+      - "**/*.jpg"
+      - "**/*.svg"
+      - ".github/workflows/build.yml"
+      - ".github/workflows/docker.yml"
+      - ".github/workflows/audit.yml"
+  workflow_dispatch:
+    inputs:
+      emit_timings:
+        description: >-
+          Also emit cargo --timings for the ci-dev build and upload it. Used to
+          decide whether sccache is worth adopting (rustfs/backlog#1601 gate).
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+# Scoped by event. A push run and a dispatch run do not compete: GitHub keeps
+# one running plus one pending per group, so with a single shared group a
+# manually dispatched run was displaced as pending by the next merge and
+# cancelled — observed three times in a row, which made the --timings gate in
+# rustfs/backlog#1601 effectively impossible to trigger while main was busy.
+#
+# Still no cancel-in-progress: a burst of merges collapses into "current run
+# finishes, newest queued run follows" rather than a pile-up, which is what
+# bounds this workflow to one self-hosted runner per event type.
+#
+# The two paths can now overlap and race to save the same key. That is benign:
+# the loser finds the key already present and skips, and both builds produce the
+# same artifacts from the same commit.
+concurrency:
+  group: cache-warm-${{ github.event_name }}
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  # Readers: test-and-lint, test-ilm-integration-serial, build-rustfs-debug-binary,
+  # e2e-tests, e2e-full.
+  warm-ci-dev:
+    name: Warm ci-dev
+    runs-on: sm-standard-4
+    timeout-minutes: 90
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-dev
+          cache-save-if: 'true'
+          install-build-packaging-tools: 'false'
+
+      # rustfs/backlog#1601 gate. sccache can only cache compilation units whose
+      # --emit includes link, so it covers workspace rlibs and nothing else:
+      # clippy is metadata-only, and the ~100 test binaries, the rustfs bin and
+      # every build script invoke the system linker. Before spending a bucket,
+      # credentials and a supply-chain boundary on it, measure how much of the
+      # build is actually rlib codegen.
+      #
+      # Read from the report: workspace lib codegen as a share of the build, and
+      # s3select-query's own rlib as a share. The plan adopts sccache only above
+      # 50% and 25% respectively; if linking dominates instead, the answer is
+      # mold/lld plus split-debuginfo, which is exactly the part sccache cannot
+      # touch. Off by default — this doubles the ci-dev build.
+      - name: Build ci-dev superset (with --timings)
+        if: inputs.emit_timings
+        env:
+          CARGO_BUILD_JOBS: "2"
+        run: cargo build --workspace --all-targets --timings
+
+      - name: Upload cargo timings report
+        if: inputs.emit_timings
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: cargo-timings-ci-dev
+          path: target/cargo-timings/
+          retention-days: 30
+          if-no-files-found: error
+
+      # --all-targets covers the test binaries nextest builds, including
+      # e2e_test, which test-and-lint's own run excludes. The second build adds
+      # the e2e-test-hooks feature resolution that build-rustfs-debug-binary uses
+      # and that no lint lane enables.
+      - name: Build ci-dev superset
+        env:
+          # Same limit ci.yml puts on its nextest step: this builds the same
+          # ~100 workspace test binaries, and three concurrent links saturate the
+          # self-hosted runner's overlay I/O and can wedge Cargo (#5394).
+          CARGO_BUILD_JOBS: "2"
+        run: |
+          cargo build --workspace --all-targets
+          cargo build -p rustfs --bins --features e2e-test-hooks
+
+      # Runs before rust-cache's post step, so these are the sizes it is about
+      # to archive. Reported so the cache-all-crates decision stays evidence-led:
+      # registry/src is what that flag prunes, registry/cache is what the pruned
+      # sources are re-unpacked from. See rustfs/backlog#1600.
+      - name: Report cache input sizes
+        if: always()
+        run: |
+          # tee, not a plain redirect: sent only to $GITHUB_STEP_SUMMARY these
+          # numbers are readable in the UI but absent from the job log, and the
+          # REST API exposes the log, not the summary — which made the figures
+          # unreachable for exactly the scripted comparison they exist for.
+          sizes="$(du -sh ~/.cargo/registry/src ~/.cargo/registry/cache \
+                          ~/.cargo/registry/index ~/.cargo/git target 2>/dev/null || true)"
+          echo "cache-input-sizes-begin"
+          printf '%s\n' "$sizes"
+          echo "cache-input-sizes-end"
+          {
+            echo "### Cache input sizes (ci-dev)"
+            echo '```'
+            printf '%s\n' "$sizes"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # Readers: test-and-lint-rio-v2, build-rustfs-debug-binary-rio-v2.
+  warm-ci-feat-rio:
+    name: Warm ci-feat-rio
+    runs-on: sm-standard-4
+    timeout-minutes: 90
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-feat-rio
+          cache-save-if: 'true'
+          install-build-packaging-tools: 'false'
+
+      - name: Build ci-feat-rio superset
+        run: |
+          cargo build -p rustfs -p rustfs-ecstore --all-targets --features rio-v2
+          cargo build -p rustfs --bins --features rio-v2,e2e-test-hooks
+
+  # Readers: the swift and sftp legs of test-and-lint-protocols. Built in
+  # sequence rather than as `--features swift,sftp`, which is a combination no
+  # lane actually compiles; running both leaves the union in target/.
+  warm-ci-feat-proto:
+    name: Warm ci-feat-proto
+    runs-on: sm-standard-4
+    timeout-minutes: 90
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-feat-proto
+          cache-save-if: 'true'
+          install-build-packaging-tools: 'false'
+
+      - name: Build ci-feat-proto superset
+        run: |
+          cargo build -p rustfs -p rustfs-protocols --all-targets --features swift
+          cargo build -p rustfs -p rustfs-protocols --all-targets --features sftp
+
+  # Reader: uring-integration. Runs on ubuntu-latest to match it: rust-cache's
+  # key covers runner.os and arch but not the runner label or image, so a cache
+  # written on sm-standard-4 would be restored by the hosted runner as if it
+  # belonged to it.
+  warm-ci-uring:
+    name: Warm ci-uring
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-uring
+          cache-save-if: 'true'
+          install-build-packaging-tools: 'false'
+
+      - name: Install build dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
+      - name: Build ci-uring superset
+        run: cargo build -p rustfs-ecstore --all-targets
@@ -12,18 +12,24 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# Companion to ci.yml for the required "Test and Lint" status check.
+# Companion to ci.yml for required status checks.
 #
-# ci.yml skips docs-only pull requests via paths-ignore, but the branch
-# ruleset requires a check named "Test and Lint" — without this workflow a
-# docs-only PR would wait on that check forever. This workflow triggers on
-# exactly the paths ci.yml ignores and reports an instant success under the
-# same job name. Mixed PRs trigger both workflows and the real check still
-# gates: a required check with any failing run blocks the merge.
+# ci.yml skips docs-only pull requests via paths-ignore, but the branch ruleset
+# requires a check named "Test and Lint" — without this workflow a docs-only PR
+# would wait on it forever. This workflow triggers on exactly the paths ci.yml
+# ignores and reports success under the same job name. Mixed PRs trigger both
+# workflows and the real check still gates: a required check with any failing
+# run blocks the merge.
 # https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
 #
+# "Quick Checks" is mirrored here ahead of the ruleset change that will make it
+# required too (rustfs/backlog#1599). Until that change lands this job is
+# inert; mirroring it first is what lets the ruleset change happen without
+# stranding docs-only PRs on a check nobody reports.
+#
 # Keep the paths list below in sync with the pull_request paths-ignore list
-# in ci.yml.
+# in ci.yml, and keep the quick-checks steps below byte-identical to the
+# quick-checks job in ci.yml.

 name: Continuous Integration (docs only)

@@ -47,17 +53,82 @@ on:
      - ".github/workflows/build.yml"
      - ".github/workflows/docker.yml"
      - ".github/workflows/audit.yml"
+      - "flake.lock"

 permissions:
  contents: read

 jobs:
-  test-and-lint:
-    name: Test and Lint
+  # Deliberately NOT a bare `echo`. Once "Quick Checks" becomes a required
+  # check, ci.yml gates every expensive job behind it, so a mixed PR reports
+  # two check runs with this name: the real one (45-51s) and this companion.
+  # GitHub has no written contract for how it picks between same-named
+  # required check runs ("latest wins" vs "any failure blocks"), so instead of
+  # relying on ordering we make both runs execute the same commands against
+  # the same merge ref — their conclusions are then necessarily identical and
+  # the choice does not matter. Keep these steps byte-identical to the
+  # quick-checks job in ci.yml (a guard script that asserts this, and the paths
+  # sync below, is tracked in rustfs/backlog#1603).
+  #
+  # For a genuinely docs-only PR this adds no strictness (no code changed, so
+  # fmt and the guards always pass) and costs ~50s of ubuntu-latest.
+  quick-checks:
+    name: Quick Checks
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install ripgrep
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          components: rustfmt
+
+      - name: Check code formatting
+        run: cargo fmt --all --check
+
+      - name: Check unsafe code allowances
+        run: ./scripts/check_unsafe_code_allowances.sh
+
+      - name: Check layered dependencies
+        run: ./scripts/check_layer_dependencies.sh
+
+      - name: Check architecture migration rules
+        run: ./scripts/check_architecture_migration_rules.sh
+
+      - name: Check tokio io-uring feature guard
+        run: ./scripts/check_no_tokio_io_uring.sh
+
+      - name: Check extension schema boundaries
+        run: ./scripts/check_extension_schema_boundaries.sh
+
+      - name: Check body-cache whitelist guard
+        run: ./scripts/check_body_cache_whitelist.sh
+
+      - name: Check no planning docs committed
+        run: ./scripts/check_no_planning_docs.sh
+
+      - name: Check CI paths stay in sync
+        run: ./scripts/check_ci_paths_sync.sh
+
+      - name: Check io_uring lane --lib precondition
+        run: ./scripts/check_uring_lane_lib_only.sh
+
+  test-and-lint:
+    name: Test and Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      # Docs-only PRs skip the full code CI, but they are exactly where a
      # planning-type document could be slipped in (git add -f bypasses
@@ -33,6 +33,7 @@ on:
      - ".github/workflows/build.yml"
      - ".github/workflows/docker.yml"
      - ".github/workflows/audit.yml"
+      - "flake.lock"
  pull_request:
    types: [ opened, synchronize, reopened, closed ]
    branches: [ main ]
@@ -54,6 +55,7 @@ on:
      - ".github/workflows/build.yml"
      - ".github/workflows/docker.yml"
      - ".github/workflows/audit.yml"
+      - "flake.lock"
  merge_group:
    types: [ checks_requested ]
  schedule:
@@ -81,6 +83,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -89,13 +92,20 @@ jobs:
    name: Typos
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Typos check with custom config file
        uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # master

  # Fast, compile-free checks that fail early so contributors get feedback in
  # ~1 minute instead of waiting for the full test job.
+  #
+  # These steps are mirrored byte-for-byte in ci-docs-only.yml so that a mixed
+  # PR, which reports two check runs named "Quick Checks", cannot get one red
+  # and one green. Edit both jobs together.
  quick-checks:
    name: Quick Checks
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
@@ -104,6 +114,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Install ripgrep
        run: sudo apt-get update && sudo apt-get install -y ripgrep
@@ -137,35 +149,157 @@ jobs:
      - name: Check no planning docs committed
        run: ./scripts/check_no_planning_docs.sh

+      - name: Check CI paths stay in sync
+        run: ./scripts/check_ci_paths_sync.sh
+
+      - name: Check io_uring lane --lib precondition
+        run: ./scripts/check_uring_lane_lib_only.sh
+
  test-and-lint:
    name: Test and Lint
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
-    timeout-minutes: 60
+    timeout-minutes: 90
+    # Both lines are required. Job-level `permissions` replaces the workflow
+    # block rather than merging with it, so declaring only `actions: write`
+    # would drop `contents: read` and break this job's checkout and the
+    # repo-token the setup action hands to setup-protoc.
+    permissions:
+      contents: read
+      actions: write
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          # This job's token can cancel runs and delete Actions caches. Checkout
+          # otherwise writes it into .git/config, where a PR's own build.rs or
+          # proc-macro could read it back out.
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-test
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          # Every lane in this workflow reads its cache and none writes it.
+          # cache-warm.yml is the sole writer for all four keys: this workflow
+          # cancels superseded runs on main, and a cancelled run never reaches
+          # rust-cache's post step, so writing from here saved nothing (12 of 15
+          # consecutive main-push runs were cancelled). See rustfs/backlog#1600.
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'
+
+      - name: Prepare test evidence
+        run: |
+          mkdir -p artifacts/test-and-lint
+          {
+            echo "run_id=${GITHUB_RUN_ID}"
+            echo "job=${GITHUB_JOB}"
+            echo "runner=${RUNNER_NAME}"
+            echo "started_at=$(date --utc --iso-8601=seconds)"
+          } > artifacts/test-and-lint/run-metadata.txt

      # Clippy runs before the test pass: lint failures are the most common
      # CI-only breakage and should surface in minutes, not after 20+ minutes
      # of tests.
+      # Sampled too: clippy is the natural control arm for any CARGO_BUILD_JOBS
+      # experiment, since --all-targets is check-only for workspace members and
+      # never links the ~100 test binaries the limit exists to throttle.
      - name: Run clippy lints
-        run: cargo clippy --all-targets -- -D warnings
-
-      - name: Run tests
        run: |
-          cargo nextest run --profile ci --all --exclude e2e_test
-          cargo test --all --doc
+          ./scripts/ci/resource_sampler.sh start clippy
+          trap './scripts/ci/resource_sampler.sh stop' EXIT
+          cargo clippy --all-targets -- -D warnings
+
+      - name: Run nextest tests
+        env:
+          # #5394 mitigation, now under a measured experiment (backlog#1601).
+          #
+          # 2 was chosen when three concurrent workspace test links were believed
+          # to saturate the runner's overlay I/O and wedge Cargo until the 75m
+          # timeout. cgroup v2 readings from the sampler show the pod actually
+          # has 14 CPUs and 28GB (peak use 2.1GB), so 2 throttles compilation to
+          # a seventh of what is available and memory was never the constraint —
+          # the label name "sm-standard-4" had led everyone, including the
+          # original mitigation, to assume 4 cores.
+          #
+          # Raised to 3 on main pushes and manual dispatches; PRs keep 2 so the
+          # merge path is untouched while the experiment runs.
+          #
+          # Dispatch is included because push alone cannot supply the samples:
+          # this workflow cancels superseded runs on main, and only 4 of the last
+          # 20 push-triggered Test and Lint jobs reached a terminal state — at
+          # that rate ten samples would take roughly fifty merges. The
+          # concurrency group is scoped by event_name, so a dispatched run has
+          # its own group and is not cancelled by merge traffic, which makes the
+          # sample collectable on demand rather than by waiting.
+          #
+          # Baseline over 17 samples at 2:
+          # median nextest/clippy step ratio 1.95, spread 1.85-2.06. The gate-2
+          # criterion is that ratio dropping at least 10% (below ~1.76) with no
+          # 75m timeout and no run showing three consecutive samples of
+          # rustc/collect2/rust-lld in D state. If it does not, the conclusion is
+          # "this limit is not the bottleneck" — fix it back at 2 and record the
+          # experiment, which is a result, not a failure.
+          #
+          # Must stay step-level: rust-cache hashes CARGO/CC/CFLAGS/CXX/CMAKE/RUST
+          # prefixed variables from process.env into the cache key, so promoting
+          # this to job level would rotate every key on this lane.
+          CARGO_BUILD_JOBS: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && '3' || '2' }}
+        run: |
+          mkdir -p artifacts/test-and-lint
+          ./scripts/ci/resource_sampler.sh start nextest
+          trap './scripts/ci/resource_sampler.sh stop' EXIT
+          set +e
+          NEXTEST_HIDE_PROGRESS_BAR=1 timeout --verbose --signal=TERM --kill-after=30s 75m \
+            cargo nextest run --profile ci --all --exclude e2e_test \
+            --status-level all --final-status-level all \
+            2>&1 | tee artifacts/test-and-lint/nextest.log
+          status=${PIPESTATUS[0]}
+          {
+            echo "command=cargo nextest run --profile ci --all --exclude e2e_test"
+            echo "exit_status=${status}"
+            echo "finished_at=$(date --utc --iso-8601=seconds)"
+            echo
+            echo "Remaining test-related processes:"
+            pgrep -af 'cargo|nextest|target/.*/deps/' || true
+            echo
+            echo "Kernel OOM / kill events:"
+            dmesg -T 2>/dev/null | grep -iE 'oom|out of memory|killed process' | tail -20 || true
+          } > artifacts/test-and-lint/nextest-diagnostics.txt
+          exit "${status}"
+
+      - name: Run documentation tests
+        run: |
+          mkdir -p artifacts/test-and-lint
+          set +e
+          timeout --verbose --signal=TERM --kill-after=30s 15m \
+            cargo test --all --doc \
+            2>&1 | tee artifacts/test-and-lint/doctest.log
+          status=${PIPESTATUS[0]}
+          {
+            echo "command=cargo test --all --doc"
+            echo "exit_status=${status}"
+            echo "finished_at=$(date --utc --iso-8601=seconds)"
+            echo
+            echo "Remaining test-related processes:"
+            pgrep -af 'cargo|rustdoc|target/.*/deps/' || true
+          } > artifacts/test-and-lint/doctest-diagnostics.txt
+          exit "${status}"
+
+      - name: Upload test reports and diagnostics
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: junit-test-and-lint-${{ github.run_number }}
+          path: |
+            target/nextest/ci/junit.xml
+            artifacts/test-and-lint
+          retention-days: 3
+          if-no-files-found: error

      # rustfs/backlog#1289: fail if a seed rule's log anchor no longer exists
      # verbatim in the source tree (log message drifted without updating the
@@ -174,15 +308,6 @@ jobs:
      - name: Check log-analyzer rule anchors
        run: ./scripts/check_log_analyzer_rules.sh

-      - name: Upload test junit report
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: junit-test-and-lint-${{ github.run_number }}
-          path: target/nextest/ci/junit.xml
-          retention-days: 3
-          if-no-files-found: ignore
-
      # Explicit gate for migration-critical suites. These tests already ran in
      # the full nextest pass above; a single filtered nextest invocation keeps
      # the named gate without rebuilding or re-running them one package at a time.
@@ -199,6 +324,50 @@ jobs:
      - name: Run rebalance/decommission migration proofs
        run: ./scripts/check_migration_gate_count.sh

+      # Early stop. Once this job has failed the PR cannot merge, so the sibling
+      # lanes are burning runners on a result nobody can act on: on run
+      # 30674613104 three lanes had already failed while Test and Lint and the
+      # rio-v2 variant kept going past 70 minutes.
+      #
+      # Only this job may cancel. The lanes that are NOT required checks
+      # (protocols, ILM, e2e, s3-tests) must never hold that power: a flake in
+      # one of them would turn the required "Test and Lint" into `cancelled`,
+      # which blocks the merge. Today a maintainer can merge with sftp red, and
+      # that has to stay true.
+      #
+      # These steps run last so the `if: always()` artifact upload above still
+      # captures logs and diagnostics before the run goes away.
+      - name: Annotate early-stop reason
+        if: failure() && github.event_name == 'pull_request'
+        run: |
+          {
+            echo "## CI early-stop"
+            echo "Job \`${GITHUB_JOB}\` (Test and Lint) failed; cancelling run ${GITHUB_RUN_ID} to free runners."
+            echo "Sibling jobs showing **cancelled** were stopped by this job, not by their own failure."
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      # curl rather than `gh`: every existing `gh` call in this repo runs on
+      # ubuntu-latest, and the sm-standard-* images are custom and trimmed (they
+      # ship no C toolchain, see the e2e job below), so `gh` is not known to
+      # exist here.
+      #
+      # Fork PRs are excluded explicitly instead of relying on the error path:
+      # their GITHUB_TOKEN is forced read-only and job-level permissions cannot
+      # raise it, so the call would always 403. Skipping keeps their logs clean.
+      - name: Cancel run on failure (same-repo PR only)
+        if: >-
+          failure() && github.event_name == 'pull_request'
+          && github.event.pull_request.head.repo.full_name == github.repository
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          curl -fsS -X POST \
+            -H "Authorization: Bearer ${GH_TOKEN}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/cancel" || true
+
  # Dedicated serial lane for the ILM / lifecycle integration tests. These tests
  # drive the object layer through process-global singletons (the GLOBAL_ENV
  # ECStore, the global tier-config manager, background-expiry workers) and bind
@@ -212,6 +381,7 @@ jobs:
  test-ilm-integration-serial:
    name: ILM Integration (serial)
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 45
    env:
@@ -219,14 +389,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-ilm-serial
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      # test_transition_and_restore_flows was re-enabled by rustfs/backlog#1303:
      # its "missing xl.meta on disk2" was a test-util bug (open_disk hardcoded
@@ -249,6 +421,7 @@ jobs:
  test-and-lint-rio-v2:
    name: Test and Lint (rio-v2)
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 60
    env:
@@ -256,14 +429,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-test-rio-v2
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-feat-rio
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      - name: Run rio-v2 clippy lints
        run: cargo clippy -p rustfs -p rustfs-ecstore --all-targets --features rio-v2 -- -D warnings
@@ -276,10 +451,17 @@ jobs:
  test-and-lint-protocols:
    name: "Test and Lint (${{ matrix.features.name }})"
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 60
    strategy:
-      fail-fast: false
+      # On a PR, one failing protocol leg is enough to know the PR is not ready,
+      # so stop the sibling leg instead of paying another ~40 minutes for it.
+      # Everywhere else (main pushes, the merge queue, the weekly schedule) keep
+      # the full signal: there we want to know whether swift AND sftp are broken,
+      # not just whichever failed first. This is the only part of the early-stop
+      # work that also covers fork PRs, since it needs no token.
+      fail-fast: ${{ github.event_name == 'pull_request' }}
      matrix:
        features:
          - name: swift
@@ -291,14 +473,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-test-${{ matrix.features.name }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-feat-proto
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      - name: Run clippy with ${{ matrix.features.name }}
        run: |
@@ -311,6 +495,7 @@ jobs:
  build-rustfs-debug-binary:
    name: Build RustFS Debug Binary
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 30
    env:
@@ -318,17 +503,19 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-rustfs-debug-binary
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      - name: Build debug binary
-        run: cargo build -p rustfs --bins
+        run: cargo build -p rustfs --bins --features e2e-test-hooks

      - name: Upload debug binary
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
@@ -341,6 +528,7 @@ jobs:
  build-rustfs-debug-binary-rio-v2:
    name: Build RustFS Debug Binary (rio-v2)
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 30
    env:
@@ -348,17 +536,19 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-rustfs-debug-binary-rio-v2
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-shared-key: ci-feat-rio
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      - name: Build debug binary with rio-v2
-        run: cargo build -p rustfs --bins --features rio-v2
+        run: cargo build -p rustfs --bins --features rio-v2,e2e-test-hooks

      - name: Upload debug binary
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
@@ -370,6 +560,14 @@ jobs:

  uring-integration:
    name: io_uring Integration (real)
+    # The pull_request trigger includes `closed` purely so the concurrency
+    # group cancels in-flight runs of a closed PR; every other job opts out of
+    # that run with this guard (or is skipped through its `needs` chain). This
+    # job had neither, so each closed/merged PR really ran the whole io_uring
+    # suite (measured 4m17s / 7m19s / 7m31s on runs 30678272341 / 30678117601 /
+    # 30662728539) and kept the cancellation run in progress for minutes.
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    needs: [ quick-checks ]
    # GitHub-hosted ubuntu-latest runs a recent kernel with io_uring and, unlike
    # a container, applies no seccomp filter that would block io_uring_setup — so
    # the probe succeeds and the tests exercise the real UringBackend/FdCache/
@@ -380,17 +578,24 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
+          # Keeps its own key rather than joining ci-dev. rust-cache's key is
+          # built from runner.os/arch plus rustc and lockfile fingerprints — it
+          # does NOT include the runner label or image. ubuntu-latest and
+          # sm-standard-4 are therefore indistinguishable to it, so sharing a key
+          # would let two different system images overwrite each other's
+          # artifacts, and would make a 2-core hosted runner unpack ci-dev's ~3GB
+          # instead of this lane's ~1.3GB. cache-warm.yml warms this key on
+          # ubuntu-latest for the same reason.
          cache-shared-key: ci-uring
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: Install build dependencies
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      # ext4 supports O_DIRECT; the runner's default TMPDIR may sit on tmpfs or
      # overlayfs, where open(O_DIRECT) returns EINVAL/EOPNOTSUPP and the native
@@ -417,7 +622,17 @@ jobs:
          RUSTFS_IO_URING_READ_ENABLE: "true"
          RUSTFS_URING_TESTS_MUST_RUN: "1"
          TMPDIR: /mnt/rustfs-odirect
-        run: cargo test -p rustfs-ecstore uring_ -- --test-threads=1 --nocapture
+        # --lib narrows what gets compiled, not what gets run: every selected
+        # test lives in the lib target. The 7 integration binaries under
+        # crates/ecstore/tests/ each reported "running 0 tests" here, so they
+        # were compiled and linked for nothing.
+        #
+        # The `uring_` filter must stay exactly as it is. libtest matches on
+        # substring, so it also selects names containing `during_` — 6 of the 18
+        # selected tests are such incidental matches. Narrowing the filter to
+        # `io_uring` would silently drop them, which is a coverage change.
+        # scripts/check_uring_lane_lib_only.sh guards the --lib precondition.
+        run: cargo test -p rustfs-ecstore --lib uring_ -- --test-threads=1 --nocapture

  e2e-tests:
    name: End-to-End Tests
@@ -427,6 +642,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      # Full setup with dependency caching: the smoke-suite step below
      # compiles the e2e_test crate, which pulls in most of the workspace.
@@ -435,9 +652,9 @@ jobs:
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-e2e
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      # Download after the cache restore so the freshly built binary from the
      # build job always wins over anything restored into target/debug.
@@ -450,15 +667,17 @@ jobs:
      - name: Make binary executable
        run: chmod +x ./target/debug/rustfs

-      # Guard the security negative-auth smoke subset (backlog#1151 sec-5)
-      # against a rename or deletion silently dropping it out of the e2e-smoke
-      # filter. The script lists what the profile selects and fails if the count
-      # of security auth-rejection tests falls below the committed floor in
-      # .config/security-smoke-floor.txt (infra-12 count-floor mechanism). Run
-      # before the smoke suite so a thinned gate fails fast; the `nextest list`
-      # here compiles the e2e_test binaries the run below reuses.
-      - name: Check security smoke subset count floor
-        run: ./scripts/check_security_smoke_count.sh check
+      # Build the e2e test graph once. The archive is reused by the security
+      # count-floor check and the smoke run below, avoiding a second compile of
+      # the same e2e_test target on cold runners (backlog#1645).
+      - name: Archive e2e smoke test binaries
+        env:
+          NEXTEST_ARCHIVE: ${{ runner.temp }}/rustfs-e2e-smoke.tar.zst
+          NEXTEST_LISTING: ${{ runner.temp }}/rustfs-e2e-smoke-list.json
+        run: |
+          cargo nextest archive --profile e2e-smoke -p e2e_test --archive-file "${NEXTEST_ARCHIVE}"
+          cargo nextest list --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" --message-format json > "${NEXTEST_LISTING}"
+          ./scripts/check_security_smoke_count.sh check "${NEXTEST_LISTING}"

      # PR smoke subset of the in-repo e2e suite (backlog#1149 ci-4). The
      # profile.e2e-smoke default-filter in .config/nextest.toml is the single
@@ -466,7 +685,30 @@ jobs:
      # adding new e2e jobs here. Each test spawns its own rustfs server on a
      # random port and reuses the downloaded debug binary above.
      - name: Run e2e smoke suite
-        run: cargo nextest run --profile e2e-smoke -p e2e_test
+        env:
+          NEXTEST_ARCHIVE: ${{ runner.temp }}/rustfs-e2e-smoke.tar.zst
+          RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-smoke-logs
+        run: |
+          cargo nextest run --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" \
+            --status-level all --final-status-level all --failure-output final
+
+      - name: Upload e2e smoke diagnostics
+        if: failure()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: e2e-smoke-diagnostics-${{ github.run_number }}
+          path: |
+            ${{ runner.temp }}/rustfs-e2e-smoke-logs/
+            ${{ runner.temp }}/rustfs-e2e-smoke-list.json
+          if-no-files-found: warn
+
+      - name: Upload e2e smoke JUnit report
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: e2e-smoke-junit-${{ github.run_number }}
+          path: target/nextest/e2e-smoke/junit.xml
+          if-no-files-found: warn

      - name: Install s3s-e2e test tool
        uses: taiki-e/cache-cargo-install-action@7447f04c51f2ba27ca35e7f1e28fab848c5b3ba7 # v2
@@ -511,14 +753,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-e2e
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'

      # Download after the cache restore so the freshly built binary from the
      # build job always wins over anything restored into target/debug.
@@ -554,6 +798,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Clean up previous test run
        run: |
@@ -608,6 +854,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download debug binary
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -668,12 +916,20 @@ jobs:
  # evaluates ILM within ~2s of the due time, well inside the poll window.
  s3-lifecycle-behavior-tests:
    name: S3 Lifecycle Behavior Tests
-    needs: [ build-rustfs-debug-binary ]
+    # Also gated on e2e-tests, matching s3-implemented-tests: when the e2e smoke
+    # suite is already red this lane cannot tell us anything new, and it holds a
+    # sm-standard-4 for up to 30 minutes doing so. Both lanes only download the
+    # prebuilt debug binary (no cargo build), and s3-implemented-tests — which
+    # already waits on e2e-tests — finishes later anyway, so a green PR's total
+    # wall clock is unchanged.
+    needs: [ build-rustfs-debug-binary, e2e-tests ]
    runs-on: sm-standard-4
    timeout-minutes: 30
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download debug binary
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -22,11 +22,18 @@ on:
  issue_comment:
    types: [created, edited]

+# Least privilege at the top, widened per job below. This workflow runs on
+# pull_request_target and issue_comment, so it holds full secrets on every fork
+# PR and on any comment anyone writes — the one place in this repository where a
+# compromised action would be handed a repo-write token. It does not check out
+# or execute PR code, so there is no pwn-request path today, but the blast
+# radius should not depend on that staying true.
+#
+# contents: write in particular was never used: the signature records are
+# written to rustfs/cla through the scoped app token created below, and nothing
+# here writes to this repository's contents.
 permissions:
-  contents: write
-  pull-requests: write
-  issues: write
-  checks: write
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
@@ -36,14 +43,26 @@ jobs:
  cancel-closed-pr-runs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request_target' && github.event.action == 'closed'
+    # Echoes one line; the run exists only so the concurrency group cancels the
+    # in-flight run of a closed PR.
+    permissions: {}
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."

  cla:
    if: ${{ (github.event_name != 'issue_comment' || github.event.issue.pull_request) && (github.event_name != 'pull_request_target' || github.event.action != 'closed') }}
+    # checks: write reports the merge-queue check run; pull-requests and issues
+    # let cla-bot comment and label. contents stays read — see the note above.
+    permissions:
+      contents: read
+      checks: write
+      issues: write
+      pull-requests: write
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    steps:
      - name: Report CLA result for merge queue
        if: github.event_name == 'merge_group'
@@ -62,14 +62,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
          cache-shared-key: ci-coverage
-          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          install-build-packaging-tools: 'false'

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
@@ -116,6 +118,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -66,7 +66,7 @@ env:
  CARGO_TERM_COLOR: always
  REGISTRY_DOCKERHUB: rustfs/rustfs
  REGISTRY_GHCR: ghcr.io/${{ github.repository }}
-  REGISTRY_QUAY: quay.io/${{ secrets.QUAY_USERNAME }}/rustfs
+  REGISTRY_QUAY: quay.io/rustfs/rustfs
  DOCKER_PLATFORMS: linux/amd64,linux/arm64

 jobs:
@@ -82,8 +82,10 @@ jobs:
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'push' &&
-       github.event.workflow_run.head_branch != 'main')
+       github.event.workflow_run.head_branch != 'main' &&
+       !contains(github.event.workflow_run.head_branch, '-preview'))
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    outputs:
      should_build: ${{ steps.check.outputs.should_build }}
      should_push: ${{ steps.check.outputs.should_push }}
@@ -96,11 +98,18 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          persist-credentials: false
          # For workflow_run events, checkout the specific commit that triggered the workflow
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}

      - name: Check build conditions
        id: check
+        env:
+          # dispatch inputs via env, not `${{ }}` interpolation: they are
+          # free-form strings and would otherwise be evaluated by bash.
+          INPUT_VERSION: ${{ github.event.inputs.version }}
+          INPUT_PUSH_IMAGES: ${{ github.event.inputs.push_images }}
+          INPUT_FORCE_REBUILD: ${{ github.event.inputs.force_rebuild }}
        run: |
          should_build=false
          should_push=false
@@ -201,9 +210,9 @@ jobs:

          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            # Manual trigger
-            input_version="${{ github.event.inputs.version }}"
+            input_version="$INPUT_VERSION"
            version="${input_version}"
-            should_push="${{ github.event.inputs.push_images }}"
+            should_push="$INPUT_PUSH_IMAGES"
            should_build=true

            # Get short SHA
@@ -211,7 +220,7 @@ jobs:

            echo "🎯 Manual Docker build triggered:"
            echo "   📋 Requested version: $input_version"
-            echo "   🔧 Force rebuild: ${{ github.event.inputs.force_rebuild }}"
+            echo "   🔧 Force rebuild: $INPUT_FORCE_REBUILD"
            echo "   🚀 Push images: $should_push"

            case "$input_version" in
@@ -220,6 +229,13 @@ jobs:
                create_latest=true
                echo "🚀 Building with latest stable release version"
                ;;
+              *-preview*)
+                build_type="preview"
+                is_prerelease=true
+                should_build=false
+                should_push=false
+                echo "⏭️  Preview tags do not publish Docker images"
+                ;;
              # Prerelease versions (must match first, more specific)
              v*alpha*|v*beta*|v*rc*|*alpha*|*beta*|*rc*)
                build_type="prerelease"
@@ -290,6 +306,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
@@ -325,32 +343,28 @@ jobs:
          CREATE_LATEST="${{ needs.build-check.outputs.create_latest }}"
          VARIANT_SUFFIX="${{ matrix.suffix }}"

-          # Convert version format for Dockerfile compatibility
+          # Convert version format for Dockerfile compatibility. The former
+          # DOCKER_CHANNEL was "release" down every branch and was passed as a
+          # build-arg no Dockerfile declares, so it is gone.
          case "$VERSION" in
            "latest")
-              # For stable latest, use RELEASE=latest + release CHANNEL
              DOCKER_RELEASE="latest"
-              DOCKER_CHANNEL="release"
              ;;
            v*)
              # For versioned releases (v1.0.0), remove 'v' prefix for Dockerfile
              DOCKER_RELEASE="${VERSION#v}"
-              DOCKER_CHANNEL="release"
              ;;
            *)
              # For other versions, pass as-is
              DOCKER_RELEASE="${VERSION}"
-              DOCKER_CHANNEL="release"
              ;;
          esac

          echo "docker_release=$DOCKER_RELEASE" >> "$GITHUB_OUTPUT"
-          echo "docker_channel=$DOCKER_CHANNEL" >> "$GITHUB_OUTPUT"

          echo "🐳 Docker build parameters:"
          echo "  - Original version: $VERSION"
          echo "  - Docker RELEASE: $DOCKER_RELEASE"
-          echo "  - Docker CHANNEL: $DOCKER_CHANNEL"

          # Generate tags based on build type
          # Only support release and prerelease builds (no development builds)
@@ -404,18 +418,24 @@ jobs:
          push: ${{ needs.build-check.outputs.should_push == 'true' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: |
-            type=gha,scope=docker-${{ matrix.variant }}
-          cache-to: |
-            type=gha,mode=max,scope=docker-${{ matrix.variant }}
+          # No layer cache. This build compiles nothing — it downloads a
+          # release zip and runs apk/apt — so the cache could only save the
+          # minute or two those take, while creating a correctness problem: with
+          # RELEASE=latest the binary URL is resolved by curl *inside* a RUN
+          # layer, and the layer key does not include what that resolved to. A
+          # rebuild at the same RELEASE value (dispatch with version=latest, or
+          # a re-run of the same version) would hit the old layer and ship the
+          # previous release's binary. mode=max also consumed the same 10GB
+          # Actions cache quota the Rust lanes are fighting over.
+          #
+          # Only RELEASE is passed: it is the sole build-arg the Dockerfiles
+          # declare besides TARGETARCH. BUILDTIME, VERSION, BUILD_TYPE, REVISION
+          # and CHANNEL were never read by any stage (and BUILDTIME's $(date ...)
+          # was a literal here, not a shell substitution). BUILD_DATE and VCS_REF
+          # are declared by the Dockerfiles but deliberately left unset —
+          # supplying them would change the published image labels.
          build-args: |
-            BUILDTIME=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
-            VERSION=${{ needs.build-check.outputs.version }}
-            BUILD_TYPE=${{ needs.build-check.outputs.build_type }}
-            REVISION=${{ github.sha }}
            RELEASE=${{ steps.meta.outputs.docker_release }}
-            CHANNEL=${{ steps.meta.outputs.docker_channel }}
-            BUILDKIT_INLINE_CACHE=1
          provenance: true
          sbom: true
          # Add retry mechanism by splitting the build process
@@ -431,6 +451,7 @@ jobs:
    needs: [ build-check, build-docker ]
    if: needs.build-check.outputs.should_build == 'true' && needs.build-check.outputs.should_push == 'true'
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
@@ -485,6 +506,7 @@ jobs:
    needs: [ build-check, build-docker ]
    if: always() && needs.build-check.outputs.should_build == 'true'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Docker build completion summary
        run: |
@@ -64,14 +64,16 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
          cache-shared-key: ci-e2e-repl
-          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          install-build-packaging-tools: 'false'

      # awscurl lets the STS dual-node test actually exercise its path. Without
      # it the test skips gracefully with a visible log line
@@ -124,6 +126,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -45,6 +45,13 @@
 # The PR gate (ci.yml s3-implemented-tests) is unaffected: it avoids Docker
 # via DEPLOY_MODE=binary and defers all pip setup to run.sh's self-bootstrap.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: e2e-s3tests

 on:
@@ -135,6 +142,8 @@ jobs:
      TEST_MODE: ${{ matrix.test-mode }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      # Provision Python explicitly rather than trusting the runner image to
      # ship a working pip (ci-1: a bare python3 without pip is what broke the
@@ -354,6 +363,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -12,6 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: Fuzz

 on:
@@ -59,6 +66,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -79,13 +87,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: nightly
          cache-shared-key: fuzz-${{ hashFiles('fuzz/Cargo.lock') }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'schedule' }}

      - name: Install cargo-fuzz
@@ -145,6 +154,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download prebuilt fuzz binaries
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -200,6 +211,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Download prebuilt fuzz binaries
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -247,6 +260,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -32,12 +32,14 @@ permissions:
 jobs:
  build-helm-package:
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    if: |
-      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'workflow_dispatch' && !contains(github.event.inputs.version, '-preview')) ||
      (
        github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.event == 'push' &&
-        contains(github.event.workflow_run.head_branch, '.')
+        contains(github.event.workflow_run.head_branch, '.') &&
+        !contains(github.event.workflow_run.head_branch, '-preview')
      )

    outputs:
@@ -48,16 +50,26 @@ jobs:
    steps:
      - name: Checkout helm chart repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

+      # Both inputs reach the shell through env rather than `${{ }}`
+      # interpolation. A git ref name may contain `$(...)` — anything without a
+      # space is a legal tag — and interpolation pastes it into the script
+      # verbatim, where bash would run it. Reading "$RAW_INPUT" instead makes it
+      # data.
      - name: Normalize release version
        id: version
+        env:
+          RAW_INPUT: ${{ github.event.inputs.version }}
+          RAW_BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: |
          set -eux

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            RAW="${{ github.event.inputs.version }}"
+            RAW="$RAW_INPUT"
          else
-            RAW="${{ github.event.workflow_run.head_branch }}"
+            RAW="$RAW_BRANCH"
          fi

          case "$RAW" in
@@ -72,10 +84,13 @@ jobs:
          ./scripts/helm_chart_version.sh "$RAW_TAG"

      - name: Replace chart version and app version
+        env:
+          CHART_VERSION: ${{ steps.version.outputs.chart_version }}
+          APP_VERSION: ${{ steps.version.outputs.app_version }}
        run: |
          set -eux
-          sed -i -E 's/^version:.*/version: "${{ steps.version.outputs.chart_version }}"/' helm/rustfs/Chart.yaml
-          sed -i -E 's/^appVersion:.*/appVersion: "${{ steps.version.outputs.app_version }}"/' helm/rustfs/Chart.yaml
+          sed -i -E "s/^version:.*/version: \"${CHART_VERSION}\"/" helm/rustfs/Chart.yaml
+          sed -i -E "s/^appVersion:.*/appVersion: \"${APP_VERSION}\"/" helm/rustfs/Chart.yaml

      - name: Set up Helm
        uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
@@ -100,6 +115,7 @@ jobs:

  publish-helm-package:
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    needs: [ build-helm-package ]
    if: needs.build-helm-package.result == 'success'

@@ -107,6 +123,8 @@ jobs:
      - name: Checkout helm package repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          # persist-credentials-exempt: this checkout's token IS the push credential —
+          # the job git-pushes to rustfs/helm below. Clearing it breaks chart publishing.
          repository: rustfs/helm
          token: ${{ secrets.RUSTFS_HELM_PACKAGE }}

@@ -122,11 +140,19 @@ jobs:
      - name: Generate index
        run: helm repo index . --url https://charts.rustfs.com

+      # app_version is derived from the triggering tag name, and this job holds
+      # the cross-repository push token with rustfs/helm already checked out —
+      # the worst place in the repo to paste an attacker-influenced string into
+      # a shell line. Passed through env so bash treats it as data.
      - name: Push helm package and index file
+        env:
+          GIT_USERNAME: ${{ secrets.USERNAME }}
+          GIT_EMAIL: ${{ secrets.EMAIL_ADDRESS }}
+          APP_VERSION: ${{ needs.build-helm-package.outputs.app_version }}
        run: |
          set -eux
-          git config --global user.name "${{ secrets.USERNAME }}"
-          git config --global user.email "${{ secrets.EMAIL_ADDRESS }}"
+          git config --global user.name "${GIT_USERNAME}"
+          git config --global user.email "${GIT_EMAIL}"
          git add .
-          git commit -m "Update rustfs helm package with ${{ needs.build-helm-package.outputs.app_version }}." || echo "No changes to commit"
+          git commit -m "Update rustfs helm package with ${APP_VERSION}." || echo "No changes to commit"
          git push origin main
@@ -12,6 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: "issue-translator"
 on:
  issue_comment:
@@ -26,6 +33,7 @@ permissions:
 jobs:
  build:
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - uses: usthe/issues-translate-action@b41f55ddc81d7d54bd542a4f289fe28ec081898e # v2.7
        with:
@@ -18,11 +18,25 @@
 # This is NOT a PR gate. The fixtures are real MinIO backend trees generated on
 # the fly (they are gitignored, never committed), so the job regenerates them
 # each run with Docker and then runs the `#[ignore]` reader tests in
-# crates/ecstore/tests/minio_generated_read_test.rs.
+# rustfs/src/storage/minio_generated_read_test.rs.
+#
+# Scope: end-to-end MinIO-to-RustFS SSE interop is NOT implemented yet. Both
+# envelope parsers reject MinIO's own wrapped-DEK shape — see
+# `is_data_key_envelope` in crates/kms/src/encryption/dek.rs and the
+# `deny_unknown_fields` `LocalSseDekEnvelope` in rustfs/src/storage/sse.rs — and
+# closing that gap is tracked in rustfs/backlog#1638. Treat this job as the
+# harness for #1638, not as standing evidence that a MinIO migration reads back.
 #
 # Runner: GitHub-hosted `ubuntu-latest`. It reliably ships Docker + Python,
 # unlike the self-hosted fleet, whose pods drift in Docker/pip availability
 # (see the infra note in e2e-s3tests.yml). Nightly + manual only.
+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: minio-interop

 on:
@@ -48,23 +62,62 @@ jobs:
    env:
      # Fixed 32-byte test KMS key baked into the fixture lab; not a secret.
      RUSTFS_MINIO_STATIC_KMS_KEY_B64: IyqsU3kMFloCNup4BsZtf/rmfHVcTgznO2F25CkEH1g=
+      # Single definition of "the interop tests", shared by the guard step and
+      # the run step so the two cannot drift apart.
+      #
+      # These used to live in crates/ecstore/tests/minio_generated_read_test.rs
+      # and were selected with `-p rustfs-ecstore -E
+      # 'binary(minio_generated_read_test)'`. #5435 moved them into the `rustfs`
+      # crate as a `#[cfg(test)] mod`, which deleted that test binary; the
+      # selector was never updated and has selected zero interop tests ever
+      # since (cargo-nextest 0.9.140 now rejects it outright: "operator didn't
+      # match any binary names", exit 94).
+      INTEROP_PACKAGE: rustfs
+      INTEROP_FEATURES: rio-v2
+      INTEROP_FILTER: "test(minio_generated_read_test::)"
+      INTEROP_REQUIRED_TESTS: '["reads_minio_generated_sse_s3_multipart_fixture", "reads_minio_generated_sse_kms_multipart_fixture", "rejects_minio_generated_sse_s3_fixture_with_wrong_kms_key", "rejects_minio_generated_sse_s3_fixture_with_truncated_ciphertext"]'
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
          cache-shared-key: ci-minio-interop
-          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Generate real MinIO fixtures via Docker
        run: bash crates/rio-v2/tests/minio_fixture_lab/capture_via_docker.sh

+      # `binary(...)` at least dies loudly when nothing matches, but `test(...)`
+      # is a perfectly valid filterset that matches zero tests, so the next
+      # rename or module move would leave this job selecting nothing and
+      # reporting success without executing a single interop assertion. Count
+      # the selection and require every core reader test, while allowing new
+      # reader cases to be added without changing this guard.
+      #
+      # Count only `filter-match.status == "matches"`: the top-level
+      # `test-count` in the JSON is the package total and ignores `-E` entirely.
+      - name: Assert the interop selector still matches tests
+        run: |
+          set -euo pipefail
+          selection="$(cargo nextest list --run-ignored ignored-only \
+            -p "$INTEROP_PACKAGE" --features "$INTEROP_FEATURES" \
+            -E "$INTEROP_FILTER" --message-format json \
+            | python3 -c 'import json,os,sys; d=json.load(sys.stdin); required=json.loads(os.environ["INTEROP_REQUIRED_TESTS"]); matched=[name for suite in d.get("rust-suites", {}).values() for name,test in suite.get("testcases", {}).items() if test.get("filter-match", {}).get("status") == "matches"]; missing=[test for test in required if not any(name.endswith("minio_generated_read_test::" + test) for name in matched)]; print(len(matched)); print(",".join(missing))')"
+          count="$(printf '%s\n' "$selection" | sed -n '1p')"
+          missing="$(printf '%s\n' "$selection" | sed -n '2p')"
+          echo "interop tests selected: ${count}"
+          if [ -n "${missing}" ]; then
+            echo "::error::Selector '${INTEROP_FILTER}' in package '${INTEROP_PACKAGE}' is missing required tests: ${missing}. The MinIO interop reader tests have moved or been renamed; fix the selector instead of running an incomplete matrix. Context: rustfs/backlog#1638."
+            exit 1
+          fi
+
      - name: Run MinIO interop reader tests
        run: |
-          cargo nextest run --run-ignored ignored-only \
-            -p rustfs-ecstore --features rio-v2 \
-            -E 'binary(minio_generated_read_test)'
+          cargo nextest run --run-ignored ignored-only --no-tests=fail \
+            -p "$INTEROP_PACKAGE" --features "$INTEROP_FEATURES" \
+            -E "$INTEROP_FILTER"
@@ -45,6 +45,13 @@
 # docker-capable self-hosted `dind-sm-standard-2` label was the alternative but
 # has fewer cores and reintroduces fleet-state risk for no reliability gain.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: mint

 on:
@@ -118,6 +125,8 @@ jobs:
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Enable buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
@@ -263,6 +272,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -0,0 +1,57 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Nightly GNU Build
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+      timezone: "Asia/Shanghai"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nightly-gnu-build-main-${{ github.event_name }}
+  cancel-in-progress: ${{ github.event_name == 'workflow_dispatch' }}
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+jobs:
+  build:
+    name: Build x86_64 GNU
+    runs-on: sm-standard-2
+    timeout-minutes: 150
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - name: Checkout main branch
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+          ref: main
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          cache-shared-key: build-x86_64-unknown-linux-gnu
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'
+          install-test-tools: 'false'
+
+      - name: Build RustFS
+        run: cargo build --release --locked --target x86_64-unknown-linux-gnu -p rustfs --bins
@@ -19,9 +19,12 @@ on:
  schedule:
    - cron: '0 5 * * 0' # Weekly on Sunday 05:00 UTC (staggered after the midnight ci/build crons)

+# GITHUB_TOKEN only needs to read the repository here: the branch push and the
+# pull request are both created by update-flake-lock using the
+# FLAKE_UPDATE_TOKEN PAT below, not by this token. Leaving write on it hands a
+# repo-write credential to an unattended weekly job that does not use it.
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -37,6 +40,10 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        # persist-credentials-exempt: update-flake-lock pushes the branch and opens
+        # the PR. It passes FLAKE_UPDATE_TOKEN to create-pull-request itself rather
+        # than reusing .git/config, but that is unverified — exempt until a
+        # workflow_dispatch run confirms it (rustfs/backlog#1602).

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3
@@ -12,6 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: Nix CI

 on:
@@ -46,6 +53,7 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -63,6 +71,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@4eea0b33e3d1f02ecfe37cf16e7204c424009606 # v3.21.0
@@ -17,11 +17,18 @@
 # Two entry points, honestly scoped:
 #   * schedule (nightly, on main): post-merge detection — catches a regression
 #     within 24h of landing, not before merge.
-#   * pull_request labeled `perf-ab`: opt-in pre-merge gate for a specific PR.
-# The `perf-deliberate-tradeoff` label runs the gate with --allow-regression so
-# a deliberate correctness cost (e.g. the #4221 fsync durability fix) is
-# recorded but does not block (rustfs/backlog#935 correction 1).
+#   * workflow_dispatch: an explicitly selected trusted ref.
+# The dispatch input can run the gate with --allow-regression so a deliberate
+# correctness cost (e.g. the #4221 fsync durability fix) is recorded, not
+# blocked (rustfs/backlog#935 correction 1).

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: Performance A/B

 on:
@@ -39,8 +46,6 @@ on:
        required: false
        default: false
        type: boolean
-  pull_request:
-    types: [labeled, synchronize, reopened]
  push:
    # Every main commit pre-builds and caches its release binary (perf-3) so the
    # nightly A/B restores a ready baseline instead of paying the double build.
@@ -48,14 +53,6 @@ on:

 permissions:
  contents: read
-  pull-requests: write
-
-# Per-PR: a new push cancels the previous (up to 90-minute) A/B run instead of
-# stacking them. Nightly schedule and manual dispatch get a unique group and
-# always run to completion.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

 env:
  CARGO_TERM_COLOR: always
@@ -63,8 +60,8 @@ env:

 jobs:
  # perf-3: on every push to main, build the release binary once and cache it
-  # keyed by commit SHA (rustfs-baseline-<sha>). The nightly A/B (and, later, the
-  # perf-7 PR gate) restore this instead of paying the ~32min-per-side source
+  # keyed by commit SHA (rustfs-baseline-<sha>). The warp-ab measurements
+  # restore this instead of paying the ~32min-per-side source
  # build. That double build is what pushed the expanded 24-cell nightly past its
  # ceiling — 2026-07-11..07-14 all cancelled on the 120min timeout. Incremental
  # builds off the shared cargo cache keep each push cheap, and building on the
@@ -92,6 +89,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
@@ -99,7 +98,6 @@ jobs:
          rust-version: stable
          cache-shared-key: warp-ab-${{ hashFiles('**/Cargo.lock') }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build release rustfs
        run: cargo build --release --bin rustfs
@@ -118,17 +116,11 @@ jobs:

  warp-ab:
    name: Warp A/B budget gate
-    # Always run on schedule / manual dispatch. Opt-in on PRs: only when the
-    # `perf-ab` label is present, and for `labeled` events only when the label
-    # being added is `perf-ab` itself (adding an unrelated label to an opted-in
-    # PR must not re-run the gate). Never on push — that event only feeds
-    # build-baseline-cache above.
+    # Always run on schedule / manual dispatch. Never on push — that event only
+    # feeds build-baseline-cache above.
    if: >-
      github.event_name == 'schedule' ||
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'pull_request' &&
-       contains(github.event.pull_request.labels.*.name, 'perf-ab') &&
-       (github.event.action != 'labeled' || github.event.label.name == 'perf-ab'))
+      github.event_name == 'workflow_dispatch'
    runs-on: sm-standard-2
    # With perf-3's cached baseline binary the common (cache-hit) nightly is
    # measurement-only and finishes well under 50min. This ceiling stays
@@ -142,6 +134,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
+          persist-credentials: false
          fetch-depth: 0 # baseline is built from origin/main

      - name: Setup Rust environment
@@ -150,7 +143,6 @@ jobs:
          rust-version: stable
          cache-shared-key: warp-ab-${{ hashFiles('**/Cargo.lock') }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install warp
        run: |
@@ -162,13 +154,11 @@ jobs:

      - name: Decide exemption
        id: exempt
+        env:
+          INPUT_ALLOW_REGRESSION: ${{ github.event.inputs.allow_regression }}
        run: |
          allow="false"
-          if [[ "${{ github.event_name }}" == "pull_request" ]] \
-            && ${{ contains(github.event.pull_request.labels.*.name, 'perf-deliberate-tradeoff') }}; then
-            allow="true"
-          fi
-          if [[ "${{ github.event.inputs.allow_regression }}" == "true" ]]; then
+          if [[ "$INPUT_ALLOW_REGRESSION" == "true" ]]; then
            allow="true"
          fi
          echo "allow_regression=$allow" >> "$GITHUB_OUTPUT"
@@ -215,8 +205,34 @@ jobs:
          cp target/release/rustfs baseline-bin/rustfs
          echo "built=true" >> "$GITHUB_OUTPUT"

+      - name: Build baseline on cache miss (different candidate)
+        id: baseline_build
+        if: >-
+          steps.baseline_cache.outputs.cache-hit != 'true' &&
+          steps.commits.outputs.baseline_sha != steps.commits.outputs.candidate_sha
+        run: |
+          set -euo pipefail
+          baseline_root="$RUNNER_TEMP/rustfs-baseline-${{ github.run_id }}"
+          baseline_target="$RUNNER_TEMP/rustfs-baseline-target-${{ github.run_id }}"
+          git worktree add --detach "$baseline_root" "${{ steps.commits.outputs.baseline_sha }}"
+          cargo build --release --manifest-path "$baseline_root/Cargo.toml" --bin rustfs --target-dir "$baseline_target"
+          mkdir -p baseline-bin
+          cp "$baseline_target/release/rustfs" baseline-bin/rustfs
+          git worktree remove --force "$baseline_root"
+          echo "built=true" >> "$GITHUB_OUTPUT"
+
+      - name: Build candidate binary
+        id: candidate_build
+        if: steps.commits.outputs.baseline_sha != steps.commits.outputs.candidate_sha
+        run: |
+          set -euo pipefail
+          cargo build --release --bin rustfs
+          mkdir -p candidate-bin
+          cp target/release/rustfs candidate-bin/rustfs
+          echo "built=true" >> "$GITHUB_OUTPUT"
+
      - name: Save self-healed baseline to cache
-        if: steps.selfheal.outputs.built == 'true'
+        if: steps.selfheal.outputs.built == 'true' || steps.baseline_build.outputs.built == 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: baseline-bin/rustfs
@@ -224,62 +240,66 @@ jobs:

      - name: Run warp A/B and gate
        id: ab
+        env:
+          INPUT_DURATION: ${{ github.event.inputs.duration }}
        run: |
          set -euo pipefail
-          # Budget note: with perf-3's cached baseline the nightly does no source
-          # build on a cache hit, so the wall-clock is dominated by the short warp
-          # matrix — duration/rounds/cooldown are kept small to fit all 24 cells
-          # (6 workloads x 2 phases x 2 drive-sync) rather than dropping cells.
+          # The formal runner executes A1 baseline -> B1 candidate -> B2 candidate
+          # -> A2 baseline for each workload and drive-sync cell. It requires three
+          # rounds per leg to emit tail latency and error-rate evidence.
          # --health-timeout 180 outlasts the server's own 120s startup-readiness
          # budget, which the rig's previous 60s health poll undershot (the first
          # two nightly failures). perf-6 recalibrates these once the noise study
          # lands.
-          duration="${{ github.event.inputs.duration || '12s' }}"
+          duration="${INPUT_DURATION:-12s}"
          baseline_sha="${{ steps.commits.outputs.baseline_sha }}"
          candidate_sha="${{ steps.commits.outputs.candidate_sha }}"
          baseline_hit="${{ steps.baseline_cache.outputs.cache-hit }}"
          selfheal_built="${{ steps.selfheal.outputs.built }}"
+          baseline_built="${{ steps.baseline_build.outputs.built }}"
+          candidate_built="${{ steps.candidate_build.outputs.built }}"

-          args=(--duration "$duration" --rounds 2 --cooldown 5 --health-timeout 180)
+          args=(--duration "$duration" --rounds 3 --cooldown 5 --health-timeout 180 --baseline-revision "$baseline_sha" --candidate-revision "$candidate_sha")

-          if [[ "$baseline_hit" == "true" || "$selfheal_built" == "true" ]]; then
+          if [[ "$baseline_hit" == "true" || "$selfheal_built" == "true" || "$baseline_built" == "true" ]]; then
            chmod +x baseline-bin/rustfs
            base_bin="$PWD/baseline-bin/rustfs"
            args+=(--baseline-bin "$base_bin")
            if [[ "$baseline_hit" == "true" ]]; then
              base_src="actions-cache (rustfs-baseline-$baseline_sha)"
-            else
+            elif [[ "$selfheal_built" == "true" ]]; then
              base_src="source build (cache self-heal, saved as rustfs-baseline-$baseline_sha)"
+            else
+              base_src="isolated origin/main source build (saved as rustfs-baseline-$baseline_sha)"
            fi
            if [[ "$candidate_sha" == "$baseline_sha" ]]; then
              # Nightly on main: the candidate is the same commit as the baseline,
              # so reuse the one binary for both phases and skip all builds.
-              args+=(--candidate-bin "$base_bin" --skip-build)
+              args+=(--candidate-bin "$base_bin")
              cand_src="same binary as baseline (same commit)"
-            else
+            elif [[ "$candidate_built" == "true" ]]; then
+              chmod +x candidate-bin/rustfs
+              args+=(--candidate-bin "$PWD/candidate-bin/rustfs")
              cand_src="source build of the checked-out ref"
+            else
+              echo "::error::candidate binary was not built" >&2
+              exit 2
            fi
          else
-            # Cache miss with candidate != baseline (opt-in PR gate only): fall
-            # back to the source double-build. With the post-#4806 LTO profile
-            # this will overrun the job budget and alert; rerun once the push
-            # cache build for origin/main has completed, or wait for perf-7's
-            # merge-base caching.
-            args+=(--baseline-ref origin/main)
-            base_src="source build of origin/main (cache miss)"
-            cand_src="source build of the checked-out ref"
+            echo "::error::baseline binary was not restored or built" >&2
+            exit 2
          fi

-          args+=(--provenance-note "baseline commit: $baseline_sha - $base_src")
-          args+=(--provenance-note "candidate commit: $candidate_sha - $cand_src")
+          echo "baseline binary: $base_src"
+          echo "candidate binary: $cand_src"

          if [[ "${{ steps.exempt.outputs.allow_regression }}" == "true" ]]; then
-            args+=(--allow-regression --exemption-reason "labeled perf-deliberate-tradeoff / dispatch override")
+            args+=(--allow-regression --exemption-reason "workflow dispatch override")
          fi
          # Do not let a gate FAIL abort the job here; capture status and surface
-          # it after the PR comment is posted.
+          # it after the step summary is written.
          set +e
-          bash scripts/run_hotpath_warp_ab.sh "${args[@]}"
+          bash scripts/run_hotpath_warp_abba.sh "${args[@]}"
          echo "status=$?" >> "$GITHUB_OUTPUT"
          set -e
          # Locate the newest run dir + gate.md for the summary/comment/artifact
@@ -287,10 +307,10 @@ jobs:
          # holds server-logs/ for diagnosis.
          # Run dirs are UTC-timestamp names (no special chars); ls is safe here.
          # shellcheck disable=SC2012
-          run_dir="$(ls -td target/hotpath-ab/*/ 2>/dev/null | head -n1 || true)"
+          run_dir="$(ls -td target/hotpath-abba/*/ 2>/dev/null | head -n1 || true)"
          echo "run_dir=${run_dir%/}" >> "$GITHUB_OUTPUT"
          # shellcheck disable=SC2012
-          gate_md="$(ls -t target/hotpath-ab/*/gate.md 2>/dev/null | head -n1 || true)"
+          gate_md="$(ls -t target/hotpath-abba/*/candidate_gate.md 2>/dev/null | head -n1 || true)"
          echo "gate_md=$gate_md" >> "$GITHUB_OUTPUT"

      - name: Upload A/B results
@@ -298,10 +318,10 @@ jobs:
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: hotpath-warp-ab-${{ github.run_number }}
-          # Includes per-cell median_summary.csv / baseline_compare.csv, gate.md,
+          # Includes per-cell median_summary.csv / baseline_compare.csv, both gates,
          # and server-logs/ (rustfs.log + startup env per phase) so a failed run
          # is diagnosable. Short retention: this is churny nightly debug data.
-          path: target/hotpath-ab/
+          path: target/hotpath-abba/
          if-no-files-found: warn
          retention-days: 14

@@ -342,13 +362,6 @@ jobs:
            fi
          } >> "$GITHUB_STEP_SUMMARY"

-      - name: Comment gate result on PR
-        if: always() && github.event_name == 'pull_request' && steps.ab.outputs.gate_md != ''
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh pr comment "${{ github.event.pull_request.number }}" --body-file "${{ steps.ab.outputs.gate_md }}"
-
      # Scheduled failure alerting is handled by the alert-on-failure job below
      # (perf-2 consuming ci-8's schedule-failure-issue composite action).

@@ -357,7 +370,7 @@ jobs:
        run: |
          status="${{ steps.ab.outputs.status }}"
          if [[ "$status" != "0" ]]; then
-            echo "::error::warp A/B budget gate failed (exit $status). See the step summary / PR comment / gate.md artifact." >&2
+            echo "::error::warp A/B budget gate failed (exit $status). See the step summary / gate.md artifact." >&2
            exit "$status"
          fi
          echo "warp A/B budget gate passed."
@@ -367,14 +380,12 @@ jobs:
    needs: [warp-ab]
    # `always()` is required: without it this job is skipped when a needed
    # job fails. Alerts only for scheduled (nightly) runs (backlog#1149
-    # ci-8); PR and manual dispatch failures are already watched by a human.
+    # ci-8); manual dispatch failures are already watched by a human.
    # `cancelled` is included alongside `failure` on purpose: a job that hits
    # timeout-minutes ends as `cancelled`, and the 2026-07-11..07-14 nightly
    # timeouts went silent precisely because the guard was failure-only. The
    # composite action already reports cancelled/timed-out jobs in the issue
-    # body. (Scheduled runs get a unique concurrency group with
-    # cancel-in-progress off, so a cancellation here means a timeout/manual
-    # abort, never a superseding run.)
+    # body.
    if: >-
      always() && github.event_name == 'schedule' &&
      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
@@ -385,6 +396,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -0,0 +1,81 @@
+# Copyright 2026 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Asserts that the self-hosted runners are still ephemeral — one job per pod.
+#
+# This repository is public and its pull_request jobs run on those runners,
+# executing the PR's own build.rs, proc-macros and tests. The only thing keeping
+# that code from reaching a later job is that each ARC pod handles exactly one
+# job and is then destroyed. That guarantee lives in the ARC scale-set
+# configuration, outside this repository, where it can be changed without any PR
+# — so it is asserted here from the outside, against real run data, instead of
+# being assumed.
+#
+# Monthly rather than per-PR: the property changes only when someone
+# reconfigures the scale set, and the check costs a few dozen API calls.
+# See docs/ci/runners.md and rustfs/backlog#1602.
+
+name: Runner Hygiene
+
+on:
+  schedule:
+    - cron: "0 6 1 * *" # Monthly, 1st at 06:00 UTC (after the daily audit cron)
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: runner-hygiene
+  cancel-in-progress: false
+
+jobs:
+  check-ephemerality:
+    name: Check runner ephemerality
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      # Exit 2 (inconclusive / broken) is deliberately not a pass: a window
+      # where every sm-* job was still queued would otherwise look identical to
+      # a clean bill of health.
+      - name: Assert one job per self-hosted runner
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./scripts/ci/check_runner_ephemerality.sh 40
+
+  alert-on-failure:
+    name: Alert on scheduled failure
+    needs: [check-ephemerality]
+    # Same ci-8 mechanism as coverage.yml, audit.yml and the nightly lanes:
+    # scheduled runs file a tracking issue, manual dispatch stays quiet so
+    # debugging never produces a spurious alert.
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Open or update failure-tracking issue
+        uses: ./.github/actions/schedule-failure-issue
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -24,6 +24,13 @@
 # The run itself is expected to end red (the forced failure); only the
 # alert-on-failure job result matters.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: Schedule Failure Alert Drill

 on:
@@ -56,6 +63,8 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -12,6 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
+#
 name: "Mark stale issues"
 on:
  schedule:
@@ -20,6 +27,7 @@ on:
 jobs:
  stale:
    runs-on: ubuntu-latest
+    timeout-minutes: 30
    steps:
      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
        with:
@@ -15,6 +15,7 @@ concurrency:
 jobs:
  update:
    runs-on: ubuntu-latest
+    timeout-minutes: 10
    steps:
      - uses: overtrue/repo-visuals-action@72f34d24769ff5d341956da2f23952594ef2f1e2 # v1.3.0
        with:
@@ -0,0 +1,86 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Windows Filesystem Tests
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - "crates/ecstore/src/disk/**"
+      - "crates/ecstore/src/store/init_format.rs"
+      - "crates/ecstore/Cargo.toml"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/actions/setup/**"
+      - ".github/workflows/windows-filesystem.yml"
+  pull_request:
+    branches: [ main ]
+    paths:
+      - "crates/ecstore/src/disk/**"
+      - "crates/ecstore/src/store/init_format.rs"
+      - "crates/ecstore/Cargo.toml"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/actions/setup/**"
+      - ".github/workflows/windows-filesystem.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  RUST_BACKTRACE: 1
+
+jobs:
+  rename-safety:
+    name: Rename Safety
+    runs-on: windows-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: build-x86_64-pc-windows-msvc
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'
+          install-test-tools: 'false'
+
+      - name: Test guarded rename publication
+        shell: pwsh
+        run: cargo test -p rustfs-ecstore --lib rename_all_ -- --nocapture
+
+      - name: Test Windows handle guards
+        shell: pwsh
+        run: cargo test -p rustfs-ecstore --lib windows_ -- --nocapture
+
+      - name: Test startup temporary-directory cleanup
+        shell: pwsh
+        run: cargo test -p rustfs-ecstore --lib cleanup_tmp_on_startup_ -- --nocapture
+
+      - name: Test fresh format publication
+        shell: pwsh
+        run: cargo test -p rustfs-ecstore --lib fresh_format_load_initializes_all_disks -- --nocapture
@@ -83,3 +83,7 @@ worktrees/*

 # Local AI-agent review artifacts (omo evidence dumps)
 .omo/
+
+# insta scratch files; the accepted .snap files ARE the assertions and are committed
+*.snap.new
+*.pending-snap
@@ -0,0 +1,116 @@
+---
+name: issue-triage
+description: Triage a GitHub issue — determine if it is already fixed, needs implementation, or should be closed. Searches related commits and PRs, verifies implementation status, and posts a triage comment or closes the issue. Use when the user provides an issue URL and asks whether it can be closed or needs work.
+---
+
+# Issue Triage
+
+Use this skill when the user provides a GitHub issue URL and asks "can this be closed?", "is this already implemented?", "check completion status", or similar triage questions.
+
+## Workflow
+
+### 1. Fetch issue context
+
+```bash
+gh issue view <N> --repo <owner/repo> --json title,body,state,comments,labels,updatedAt
+```
+
+Read the issue body to understand what was requested. Extract:
+- The specific feature/fix/behavior described.
+- Any linked PRs or commits mentioned in the body or comments.
+- Any checklist items or sub-issues.
+
+### 2. Search for related work
+
+Search git history for commits referencing the issue:
+```bash
+git log --oneline --all --grep="<N>" | head -30
+```
+
+Search for related PRs:
+```bash
+gh pr list --search "fixes #<N> OR closes #<N> OR #<N>" --state all --json number,title,state,mergedAt
+```
+
+If the issue mentions specific PRs, check their status:
+```bash
+gh pr view <PR_N> --json state,mergedAt,title
+```
+
+### 3. Verify implementation
+
+For each linked or related PR that is merged, verify the fix is actually present on the current main branch:
+```bash
+git log --oneline main | grep -i "<keyword>"
+# or
+git log --oneline main --grep="<PR_N>"
+```
+
+If the issue describes a specific defect, check the relevant code to confirm the fix is in place:
+```bash
+grep -n "<pattern>" crates/<relevant>/src/<file>.rs
+```
+
+For issues with checklists, verify each item individually. If sub-items are tracked as separate issues, check those too:
+```bash
+gh issue view <SUB_N> --repo <owner/repo> --json state
+```
+
+### 4. Determine verdict
+
+- **All items fixed and merged**: Close with a summary comment listing what was fixed and which PRs.
+- **Some items fixed, some remaining**: Comment with status of each item. Do not close.
+- **Not yet implemented**: Comment with a summary of what remains. Do not close.
+- **Superseded or no longer relevant**: Close with explanation.
+
+### 5. Take action
+
+Close with comment:
+```bash
+gh issue close <N> --repo <owner/repo> --comment "<body>"
+```
+
+Comment without closing:
+```bash
+gh issue comment <N> --repo <owner/repo> --body-file /tmp/triage.md
+```
+
+Update issue labels if needed:
+```bash
+gh issue edit <N> --repo <owner/repo> --add-label "completed" --remove-label "needs-triage"
+```
+
+Always use `--body-file` for multiline content, never inline `--body`.
+
+### 6. Handle multi-issue batches
+
+When the user asks to check multiple issues (e.g., "check all issues by user X" or "scan backlog for closable issues"):
+1. List the issues: `gh issue list --repo <repo> --author <user> --state open --json number,title,updatedAt`
+2. For each issue, run steps 1-5 above.
+3. Report a summary table of all triaged issues with verdicts.
+
+## Output format
+
+### Issue Triage: #<N> — <title>
+
+**State**: OPEN / CLOSED
+**Linked PRs**: <list with merge status>
+
+#### Assessment
+<what was requested vs what is implemented>
+
+#### Verdict
+- Close — all items resolved by <PR list>
+- Keep open — <remaining items>
+- Not started — <what needs to be done>
+
+#### Action taken
+- Closed with comment / Commented / No action
+
+## Notes
+
+- The user may ask in Chinese ("是否可以关闭", "检查完成情况"); respond in the same language.
+- When closing, always include a summary of what was fixed and which PRs resolved it — this creates a useful audit trail.
+- For issues in `rustfs/backlog`, use `--repo rustfs/backlog`.
+- For issues in `rustfs/rustfs`, use `--repo rustfs/rustfs`.
+- If the issue has sub-issues (GitHub sub-issues API), check each one's state before declaring the parent complete.
@@ -0,0 +1,147 @@
+---
+name: pr-review
+description: Review a GitHub PR end-to-end from a URL or number — fetch metadata, inspect the diff, run multi-role adversarial review, check CI status, and post the review comment. Use when the user provides a PR link and asks to review it.
+---
+
+# PR Review
+
+Use this skill when the user provides a GitHub PR URL or number and asks to review it. This covers the full review lifecycle: data gathering, code review, CI verification, and posting the result.
+
+## Prerequisites
+
+- Read `AGENTS.md` for the repository's adversarial validation policy and change-style rules.
+- The `adversarial-validation` skill handles the review role playbooks; this skill orchestrates the workflow around it.
+
+## Workflow
+
+### 1. Gather PR context
+
+```bash
+gh pr view <N> --json title,author,state,body,additions,deletions,changedFiles,commits,baseRefName,headRefName
+gh pr diff <N> --name-only
+```
+
+Read the PR body and linked issues to understand the change's purpose. If the PR references an issue, fetch that too:
+```bash
+gh issue view <ISSUE> --json title,body,state
+```
+
+### 2. Fetch the diff and classify the change
+
+```bash
+git fetch origin pull/<N>/head:pr-<N>
+git diff main...pr-<N> --stat
+```
+
+Classify the change by risk tier (per AGENTS.md):
+- **Exempt**: docs/comments/instruction-only, formatting, typos.
+- **Mechanical**: renames, file moves, test-only or tooling changes.
+- **Standard** (default): any behavior change.
+- **High risk**: locking, erasure coding, quorum/heal, replication, multipart, RPC, lifecycle/tiering, metadata formats, persistence/fsync, IAM/KMS/auth, on-disk/on-wire formats, S3 API-visible behavior.
+
+### 3. Cluster changed files and delegate review
+
+Group the changed files into logical clusters (by crate or functional area). For each cluster, spawn a subagent with a focused review prompt that includes:
+- The cluster's changed files and their diffs.
+- The applicable adversarial role probes (from the `adversarial-validation` skill).
+- The repository's AGENTS.md rules relevant to that domain.
+
+For standard-tier changes: correctness adversary + simplicity adversary + test-coverage skeptic, plus every role whose domain the diff touches.
+For high-risk changes: run all seven roles.
+
+Each subagent must produce findings (concrete failure scenario with file:line) or a null report ("attacked X, Y, Z — no break found").
+
+### 4. Check CI status
+
+```bash
+gh pr checks <N>
+```
+
+If any checks fail, investigate:
+```bash
+gh run view --log-failed --job=<JOB_ID>
+```
+
+Determine whether failures are pre-existing (on main), flaky, or caused by the PR.
+
+### 5. Synthesize findings
+
+Combine all subagent findings into a structured review:
+- **Summary**: one-paragraph overview of the change and overall assessment.
+- **Findings**: each finding with severity (critical/major/minor/nit), file:line, concrete failure scenario, and suggested fix.
+- **CI status**: pass/fail with notes on any failures.
+- **Verdict**: APPROVE, REQUEST_CHANGES, or COMMENT.
+
+### 6. Post the review
+
+Write the review body to a temp file and post via CLI:
+```bash
+# Request changes
+gh pr review <N> --request-changes --body-file /tmp/pr_review.md
+
+# Approve
+gh pr review <N> --approve --body-file /tmp/pr_review.md
+
+# Comment only (no verdict)
+gh pr review <N> --comment --body-file /tmp/pr_review.md
+```
+
+For inline comments on specific lines, use the GitHub API:
+```bash
+cat > /tmp/pr_review.json <<'EOF'
+{
+  "body": "review body",
+  "event": "REQUEST_CHANGES",
+  "comments": [
+    {
+      "path": "crates/foo/src/bar.rs",
+      "line": 42,
+      "body": "finding description"
+    }
+  ]
+}
+EOF
+gh api --method POST /repos/{owner}/{repo}/pulls/<N>/reviews --input /tmp/pr_review.json
+```
+
+Always use `--body-file` or `--input`, never inline multiline `--body`.
+
+### 7. Handle follow-up
+
+If the review requests changes:
+- Monitor for new commits: `gh pr view <N> --json commits`
+- Re-review changed files only: `git diff pr-<N>..origin/pull/<N>/head`
+- Update the review when findings are addressed.
+
+If CI was failing due to pre-existing main breakage:
+- Comment on the PR noting the failure is pre-existing.
+- Suggest updating the branch: `gh pr update-branch <N>`
+
+## Output format
+
+### PR Review: #<N> — <title>
+
+**Author**: <author>
+**Risk tier**: exempt | mechanical | standard | high-risk
+**Changed files**: <count> across <cluster count> clusters
+
+#### Summary
+<one-paragraph overview>
+
+#### Findings
+| Severity | Location | Finding |
+|----------|----------|---------|
+| critical | file:line | concrete failure scenario |
+
+#### CI Status
+- All checks pass / Failing: <details>
+
+#### Verdict
+APPROVE / REQUEST_CHANGES / COMMENT
+
+## Notes
+
+- The user may ask for review in Chinese; respond in the same language but keep the review body in English per AGENTS.md rules.
+- When the user asks for "多角色对抗 review", run the full adversarial validation protocol — this skill's step 3 covers that.
+- If the PR is from a fork, check `maintainerCanModify` before attempting to push fixes.
+- For very large PRs (>50 files), cluster aggressively and delegate in parallel to keep review time reasonable.
@@ -172,7 +172,7 @@
            ],
        },
        {
-            "name": "Debug executable target/debug/rustfs with sse",
+            "name": "Debug executable target/debug/rustfs with sse kms",
            "type":  "lldb",
            "request": "launch",
            "program": "${workspaceFolder}/target/debug/rustfs",
@@ -200,7 +200,7 @@
                // 2. kms local backend test key
                // "RUSTFS_KMS_ENABLE": "true",
                // "RUSTFS_KMS_BACKEND": "local",
-                // "RUSTFS_KMS_KEY_DIR": "./target/kms-key-dir",
+                // "RUSTFS_KMS_KEY_DIR": "/tmp/kms-key-dir",
                // "RUSTFS_KMS_LOCAL_MASTER_KEY": "my-secret-key", // Some Password
                // "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",

@@ -212,13 +212,40 @@
                // "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",

                // 4. kms vault transit backend test key
+                // "RUSTFS_KMS_ENABLE": "true",
+                // "RUSTFS_KMS_BACKEND": "vault-transit",
+                // "RUSTFS_KMS_VAULT_ADDRESS": "http://127.0.0.1:8200",
+                // "RUSTFS_KMS_VAULT_TOKEN": "Dev Token",
+                // "RUSTFS_KMS_VAULT_MOUNT_PATH": "transit",
+                // "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",
+                
+                // 5、kms static backend test key
                "RUSTFS_KMS_ENABLE": "true",
-                "RUSTFS_KMS_BACKEND": "vault-transit",
-                "RUSTFS_KMS_VAULT_ADDRESS": "http://127.0.0.1:8200",
-                "RUSTFS_KMS_VAULT_TOKEN": "Dev Token",
-                "RUSTFS_KMS_VAULT_MOUNT_PATH": "transit",
-                "RUSTFS_KMS_DEFAULT_KEY_ID": "rustfs-master-key",
-
+                "RUSTFS_KMS_BACKEND": "static",
+                "RUSTFS_KMS_STATIC_SECRET_KEY": "rustfs-master-key:2dfNXGHlsEflGVCxb+5DIdGEl1sIvtwX+QfmYasi5QM="
+            },
+            "sourceLanguages": [
+                "rust"
+            ],
+        },
+        {
+            "name": "Debug executable target/debug/rustfs with local sse",
+            "type": "lldb",
+            "request": "launch",
+            "program": "${workspaceFolder}/target/debug/rustfs",
+            "args": [],
+            "cwd": "${workspaceFolder}",
+            "env": {
+                "RUSTFS_ACCESS_KEY": "rustfsadmin",
+                "RUSTFS_SECRET_KEY": "rustfsadmin",
+                "RUSTFS_VOLUMES": "./target/volumes/test{1...4}",
+                "RUSTFS_ADDRESS": ":9000",
+                "RUSTFS_CONSOLE_ENABLE": "true",
+                "RUSTFS_CONSOLE_ADDRESS": "127.0.0.1:9001",
+                "RUSTFS_OBS_LOG_DIRECTORY": "./target/logs",
+                "RUSTFS_UNSAFE_BYPASS_DISK_CHECK": "true",
+                "RUSTFS_SSE_S3_MASTER_KEY": "xGb3aYSp825j2tPpg8JrUzghiXsIkfdOtmrsJ/iafiM=",
+                "RUST_LOG": "rustfs=debug,ecstore=debug,s3s=debug,iam=debug",
            },
            "sourceLanguages": [
                "rust"
@@ -21,6 +21,28 @@ If repo-level instructions conflict, follow the nearest file and keep behavior a
 - Avoid redundant file reads, repeated commands, and unnecessary exploratory work once enough context is available.
 - A good result is a minimal diff with clear assumptions, no over-engineering, and independent verification that survives Adversarial Validation (below).

+## Worktree and Disk Hygiene
+
+- Unless the requester explicitly says otherwise, treat every new implementation task as isolated work: fetch the latest `origin/main`, confirm the requested change is not already present there, and create a dedicated feature branch and worktree from that exact upstream commit before editing. Do not implement new work directly in the primary checkout or reuse a worktree from another task.
+- Check available disk space before creating the worktree or starting dependency downloads, builds, tests, coverage, or other artifact-heavy commands. For long-running or artifact-heavy work, re-check disk usage at natural phase boundaries and before broad validation; if remaining space may not safely accommodate the next command, stop and reclaim task-owned artifacts before continuing.
+- Keep cleanup scoped and safe: remove generated build/test/coverage artifacts and temporary files created by the task when they are no longer needed, and never delete another task's worktree or uncommitted files. Prefer shared dependency caches where supported instead of duplicating large artifacts across worktrees.
+- At handoff, report the disk-space checks, cleanup performed, and any retained worktree or artifacts with the reason they are still needed.
+
+## PR Lifecycle Monitoring
+
+- Creating or updating a PR is not the terminal state. Unless the requester explicitly limits the task to PR creation, monitor the PR through its terminal state: merged, closed, or explicitly handed off because progress requires user or maintainer action.
+- While the task is active, monitor CI/check runs, review decisions and unresolved threads, mergeability and conflicts, and unexpected head/base changes. Prefer event-driven or bounded waits provided by the current environment over frequent polling; report only state changes, actionable failures, or meaningful prolonged delays.
+- Investigate every failing check and review comment before changing code. Fix failures attributable to the task, run the verification required for the new diff, push the update, respond to or resolve the corresponding review threads, and resume monitoring. Do not weaken checks, dismiss valid feedback, or retry flaky failures merely to obtain a green result.
+- Treat opening, green CI, approval, and mergeability as intermediate states. Never merge without the required reviewer approval or explicit authority. If progress depends on credentials, infrastructure, a maintainer decision, or another external action, report the exact blocker and the evidence already collected.
+- If the current execution environment cannot remain active until the next PR event, use a supported automation, monitor, or thread wakeup when available and within scope. Otherwise leave an explicit handoff containing the PR, current state, next event to observe, and pending cleanup; do not imply that background monitoring exists when none is scheduled.
+- After observing a merge, verify the commits are preserved on the upstream base, ensure the worktree is clean, remove the dedicated worktree, prune stale worktree metadata, and delete the local task branch when it is no longer in use. For a closed or abandoned PR, preserve any unmerged work unless deletion was explicitly authorized. Do not delete remote branches unless explicitly requested or repository automation owns that cleanup.
+
+## Autonomy and Approval Boundaries
+
+- Inquiry tasks (answer, explain, review, diagnose, plan): report findings; do not change files unless a fix is explicitly requested.
+- Action tasks (change, build, fix): make in-scope local changes without asking for approval.
+- Ask for confirmation before destructive or hard-to-reverse operations (force-pushes, history rewrites, deleting data or branches), merging a PR (reviewer approval required), or any material expansion of the requested scope.
+
 ## Communication and Language

 - Respond in the same language used by the requester.
@@ -99,33 +121,78 @@ CI) fails the build if anything is committed under `docs/superpowers/`, even via

 ## Verification Before PR

-Convert changes into independently verifiable outcomes. Prefer focused tests for behavior changes and run the relevant checks before declaring completion.
-Non-exempt changes must also pass Adversarial Validation (next section) before the checks below count as completion.
+Convert changes into independently verifiable outcomes. This section controls
+agent-run local validation; preparing a commit or PR does not by itself require
+the broadest gate. Inspect only the final task-owned diff, classify it by
+behavioral impact rather than line count or path alone, and run the smallest
+set of checks that provides meaningful coverage. Do not let unrelated
+worktree changes or a generic contributor checklist expand the scope.
+Non-exempt changes must also pass Adversarial Validation (next section) before
+the checks below count as completion.

-For code changes, run and pass the following before opening a PR:
+### Validation floor

-```bash
-make pre-pr
-```
+- Every change that is not documentation-only must finish with
+  `cargo fmt --all --check` passing. An umbrella gate that runs this exact
+  check satisfies the requirement; do not run it twice. Use `cargo fmt --all`
+  only when formatting needs to be fixed. Run the configured formatter or
+  validator for other changed languages when one exists.
+- Documentation-only or instruction-only means all task-owned changes are
+  prose or documentation assets and cannot affect runtime, builds, CI,
+  dependencies, generated code, or tests. Run `git diff --check` and any
+  relevant documentation guard, but skip Cargo formatting, compilation,
+  Clippy, tests, `make pre-commit`, and `make pre-pr`.
+- Behavior changes require relevant existing or new tests. Prefer the most
+  focused test or affected package. A passing targeted test can also provide
+  sufficient compilation coverage when it builds every changed target and
+  feature involved; do not add a redundant `cargo check` in that case.
+- `cargo check` supplements compilation coverage; it never substitutes for a
+  behavioral test. If a relevant test cannot reasonably be added or run, use
+  the narrowest compilation check and report the reason and remaining risk.

-Before committing code changes, prefer focused verification for the touched
-surface and use the faster local gate when a broad smoke check is needed:
+### Validation tiers

-```bash
-make pre-commit
-```
+1. **Documentation/instruction-only:** Apply the exemption above. Run a guard
+   such as `make doc-paths-check` only when it is relevant to the edited text.
+2. **Non-behavioral source change:** For comments, formatting, or another
+   demonstrably non-executable change, run the formatting floor. Compilation,
+   Clippy, and tests may be skipped only when the edit cannot affect
+   compilation or runtime behavior; run targeted doctests if executable
+   documentation examples changed.
+3. **Localized or bounded behavior change:** Run the formatting floor and the
+   narrowest relevant tests. Add package-scoped `cargo check` or Clippy only
+   for changed targets, features, APIs, error handling, async behavior, or
+   control flow not already covered. When several crates are affected but the
+   dependency set is identifiable, validate those packages and known
+   dependents instead of the whole workspace. Use `make pre-commit` only when
+   a repository-wide fast gate adds useful confidence beyond those checks.
+4. **Broad or high-risk change:** Run `make pre-pr` only when targeted coverage
+   cannot bound the impact, including:
+   - dependency, feature, build-script, procedural-macro, code-generation,
+     toolchain, or CI changes that alter compilation or the test matrix;
+   - cross-crate public APIs, shared foundational code, or broad refactors with
+     an unbounded dependent set;
+   - locking, storage durability or formats, erasure coding, replication,
+     RPC/protocol compatibility, IAM/KMS/auth, cryptography, or other
+     security-sensitive behavior;
+   - a targeted check that reveals wider impact, an explicit user request, or
+     a release policy that requires the full gate.

-For migration batches, do not run the full `make pre-pr` gate before every
-intermediate commit. Use focused tests and `make pre-commit` during
-development, then reserve `make pre-pr` for the final PR-ready branch.
+Documentation-only and non-behavioral classifications take precedence over
+path-based triggers. A small diff can still be high-risk, while a CI comment,
+manifest comment, or release-note edit does not require full validation.

-Before pushing code changes, make sure formatting is clean:
+`make pre-pr` includes `make pre-commit` coverage. Never run both for the same
+unchanged diff, and do not repeat equivalent checks during PR preparation or
+because a local hook already ran them. Rerun only checks whose scope is affected
+by later edits. Full workspace checks do not replace a relevant integration or
+E2E test for changed behavior; run that focused test when required and
+available, or report why it was not run and the remaining risk.

- Run `cargo fmt --all`.
- Run `cargo fmt --all --check` and ensure no files are modified unexpectedly.
+If `make` is unavailable, run the equivalent checks defined under
+`.config/make/`. At handoff, list the checks actually run, checks intentionally
+skipped, and the reason for the selected tier.

-If `make` is unavailable, run the equivalent checks defined under `.config/make/`.
-Documentation-only or instruction-only changes are exempt from the verification commands above (including the `.config/make/` equivalents), though any locally installed git pre-commit hooks may still run on commit unless explicitly skipped.
 After build-based verification completes, clean generated build artifacts before wrapping up to avoid unnecessary disk usage.
 Do not open a PR with code changes when the required checks fail.
 Make a failing check pass by fixing the cause, never by weakening the gate:
@@ -280,6 +347,11 @@ cargo run -p rustfs-filemeta --example dump_fileinfo -- "/path/to/file/xl.meta"
  absent, empty, and nil all mean "no value", never `Uuid::nil()`.
 - A remote-tier version of `None`/`""` means the tier bucket is unversioned:
  send **no** `versionId` on tier GET/DELETE.
+- Structs persisted in the scanner data-usage cache (`DataUsageCacheInfo`,
+  `DataUsageEntry`) carry a hand-written map-encoded `Serialize`. MessagePack
+  encodes derived structs as arrays, where an appended field makes the whole
+  cache a decode error for older readers — keep new fields `#[serde(default)]`
+  and keep the map encoding rather than reverting to `derive(Serialize)`.

 ## Naming Conventions

@@ -68,8 +68,8 @@ resolver = "3"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
-rust-version = "1.96.0"
-version = "1.0.0-beta.11"
+rust-version = "1.97.1"
+version = "1.0.0-beta.12"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
@@ -86,58 +86,58 @@ redundant_clone = "warn"

 [workspace.dependencies]
 # RustFS Internal Crates
-rustfs = { path = "./rustfs", version = "1.0.0-beta.11" }
-rustfs-heal = { path = "crates/heal", version = "1.0.0-beta.11" }
-rustfs-audit = { path = "crates/audit", version = "1.0.0-beta.11" }
-rustfs-checksums = { path = "crates/checksums", version = "1.0.0-beta.11" }
-rustfs-common = { path = "crates/common", version = "1.0.0-beta.11" }
-rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-beta.11" }
-rustfs-config = { path = "./crates/config", version = "1.0.0-beta.11" }
-rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-beta.11" }
-rustfs-credentials = { path = "crates/credentials", version = "1.0.0-beta.11" }
-rustfs-crypto = { path = "crates/crypto", version = "1.0.0-beta.11" }
-rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-beta.11" }
-rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-beta.11" }
-rustfs-iam = { path = "crates/iam", version = "1.0.0-beta.11" }
-rustfs-keystone = { path = "crates/keystone", version = "1.0.0-beta.11" }
-rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-beta.11" }
-rustfs-kms = { path = "crates/kms", version = "1.0.0-beta.11" }
-rustfs-lock = { path = "crates/lock", version = "1.0.0-beta.11" }
-rustfs-madmin = { path = "crates/madmin", version = "1.0.0-beta.11" }
-rustfs-notify = { path = "crates/notify", version = "1.0.0-beta.11" }
-rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-beta.11" }
-rustfs-io-core = { path = "crates/io-core", version = "1.0.0-beta.11" }
-rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-beta.11" }
-rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-beta.11" }
-rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-beta.11" }
-rustfs-obs = { path = "crates/obs", version = "1.0.0-beta.11" }
-rustfs-policy = { path = "crates/policy", version = "1.0.0-beta.11" }
-rustfs-protos = { path = "crates/protos", version = "1.0.0-beta.11" }
-rustfs-protocols = { path = "crates/protocols", version = "1.0.0-beta.11" }
-rustfs-replication = { path = "crates/replication", version = "1.0.0-beta.11" }
-rustfs-rio = { path = "crates/rio", version = "1.0.0-beta.11" }
-rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-beta.11" }
-rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-beta.11" }
-rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-beta.11" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-beta.11" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-beta.11" }
-rustfs-scanner = { path = "crates/scanner", version = "1.0.0-beta.11" }
-rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-beta.11" }
-rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-beta.11" }
-rustfs-signer = { path = "crates/signer", version = "1.0.0-beta.11" }
-rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-beta.11" }
-rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-beta.11" }
-rustfs-targets = { path = "crates/targets", version = "1.0.0-beta.11" }
-rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-beta.11" }
-rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-beta.11" }
-rustfs-utils = { path = "crates/utils", version = "1.0.0-beta.11" }
-rustfs-zip = { path = "./crates/zip", version = "1.0.0-beta.11" }
+rustfs = { path = "./rustfs", version = "1.0.0-beta.12" }
+rustfs-heal = { path = "crates/heal", version = "1.0.0-beta.12" }
+rustfs-audit = { path = "crates/audit", version = "1.0.0-beta.12" }
+rustfs-checksums = { path = "crates/checksums", version = "1.0.0-beta.12" }
+rustfs-common = { path = "crates/common", version = "1.0.0-beta.12" }
+rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-beta.12" }
+rustfs-config = { path = "./crates/config", version = "1.0.0-beta.12" }
+rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-beta.12" }
+rustfs-credentials = { path = "crates/credentials", version = "1.0.0-beta.12" }
+rustfs-crypto = { path = "crates/crypto", version = "1.0.0-beta.12" }
+rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-beta.12" }
+rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-beta.12" }
+rustfs-iam = { path = "crates/iam", version = "1.0.0-beta.12" }
+rustfs-keystone = { path = "crates/keystone", version = "1.0.0-beta.12" }
+rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-beta.12" }
+rustfs-kms = { path = "crates/kms", version = "1.0.0-beta.12" }
+rustfs-lock = { path = "crates/lock", version = "1.0.0-beta.12" }
+rustfs-madmin = { path = "crates/madmin", version = "1.0.0-beta.12" }
+rustfs-notify = { path = "crates/notify", version = "1.0.0-beta.12" }
+rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-beta.12" }
+rustfs-io-core = { path = "crates/io-core", version = "1.0.0-beta.12" }
+rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-beta.12" }
+rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-beta.12" }
+rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-beta.12" }
+rustfs-obs = { path = "crates/obs", version = "1.0.0-beta.12" }
+rustfs-policy = { path = "crates/policy", version = "1.0.0-beta.12" }
+rustfs-protos = { path = "crates/protos", version = "1.0.0-beta.12" }
+rustfs-protocols = { path = "crates/protocols", version = "1.0.0-beta.12" }
+rustfs-replication = { path = "crates/replication", version = "1.0.0-beta.12" }
+rustfs-rio = { path = "crates/rio", version = "1.0.0-beta.12" }
+rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-beta.12" }
+rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-beta.12" }
+rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-beta.12" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-beta.12" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-beta.12" }
+rustfs-scanner = { path = "crates/scanner", version = "1.0.0-beta.12" }
+rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-beta.12" }
+rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-beta.12" }
+rustfs-signer = { path = "crates/signer", version = "1.0.0-beta.12" }
+rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-beta.12" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-beta.12" }
+rustfs-targets = { path = "crates/targets", version = "1.0.0-beta.12" }
+rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-beta.12" }
+rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-beta.12" }
+rustfs-utils = { path = "crates/utils", version = "1.0.0-beta.12" }
+rustfs-zip = { path = "./crates/zip", version = "1.0.0-beta.12" }

 # Async Runtime and Networking
 async-channel = "2.5.0"
 async_zip = { default-features = false, version = "0.0.18" }
 mysql_async = { default-features = false, version = "0.37" }
-async-compression = { version = "0.4.42" }
+async-compression = { version = "0.4.43" }
 async-recursion = "1.1.1"
 async-trait = "0.1.91"
 async-nats = { version = "0.50.0", default-features = false }
@@ -152,7 +152,7 @@ lapin = { default-features = false, version = "4.10.0" }
 hyper = { version = "1.11.0" }
 hyper-rustls = { default-features = false, version = "0.27.9" }
 hyper-util = { version = "0.1.20" }
-http = "1.4.2"
+http = "1.5.0"
 http-body = "1.1.0"
 http-body-util = "0.1.4"
 minlz = "1.2.3"
@@ -173,7 +173,7 @@ tower-http = { version = "0.7.0" }
 # Serialization and Data Formats
 apache-avro = "0.21.0"
 bytes = { version = "1.12.1" }
-bytesize = "2.4.2"
+bytesize = "2.7.0"
 byteorder = "1.5.0"
 flatbuffers = "25.12.19"
 form_urlencoded = "1.2.2"
@@ -196,13 +196,13 @@ blake2 = "=0.11.0-rc.6"
 chacha20poly1305 = { version = "=0.11.0" }
 crc-fast = "1.10.0"
 hmac = { version = "0.13.0" }
-jsonwebtoken = { version = "10.4.0" }
+jsonwebtoken = { version = "11.0.0" }
 openidconnect = { default-features = false, version = "4.0" }
 pbkdf2 = "0.13.0"
 rsa = { version = "=0.10.0-rc.18" }
-rustls = { default-features = false, version = "0.23.42" }
+rustls = { default-features = false, version = "0.23.43" }
 rustls-native-certs = "0.8"
-rustls-pki-types = "1.15.0"
+rustls-pki-types = "1.15.1"
 sha1 = "0.11.0"
 sha2 = "0.11.0"
 subtle = "2.6"
@@ -211,8 +211,8 @@ zeroize = { version = "1.9.0" }
 # Time and Date
 chrono = { version = "0.4.45" }
 humantime = "2.4.0"
-jiff = { version = "0.2.34" }
-time = { version = "0.3.54" }
+jiff = { version = "0.2.35" }
+time = { version = "0.3.55" }

 # Database
 deadpool-postgres = { version = "0.14" }
@@ -225,16 +225,18 @@ arc-swap = "1.9.2"
 astral-tokio-tar = "0.6.4"
 atoi = "3.1.0"
 atomic_enum = "0.3.0"
-aws-config = { version = "1.10.0" }
+aws-config = { version = "1.10.1" }
 aws-credential-types = { version = "1.3.0" }
-aws-sdk-s3 = { default-features = false, version = "1.139.0" }
+aws-sdk-kms = { default-features = false, version = "1.114.0" }
+aws-sdk-s3 = { default-features = false, version = "1.140.0" }
+aws-sdk-sts = { default-features = false, version = "1.110.0" }
 aws-smithy-http-client = { default-features = false, version = "1.2.0" }
-aws-smithy-runtime-api = { version = "1.13.0" }
+aws-smithy-runtime-api = { version = "1.14.0" }
 aws-smithy-types = { version = "1.6.1" }
-base64 = "0.22.1"
+base64 = "0.23.0"
 base64-simd = "0.8.0"
 brotli = "8.0.4"
-clap = { version = "4.6.4" }
+clap = { version = "4.6.5" }
 const-str = { version = "1.1.0" }
 convert_case = "0.11.0"
 criterion = { version = "0.8" }
@@ -243,17 +245,19 @@ crossbeam-channel = "0.5.16"
 crossbeam-deque = "0.8.7"
 crossbeam-utils = "0.8.22"
 datafusion = { default-features = false, git = "https://github.com/apache/datafusion.git", rev = "dae03ee062b2abf986de8df12ea82fb1578a2d99" }
+#datafusion = { default-features = false, version = "54.1.0" }
 derive_builder = "0.20.2"
 enumset = "1.1.14"
 faster-hex = "0.10.0"
 flate2 = "1.1.9"
 glob = "0.3.4"
-google-cloud-storage = "1.16.0"
-google-cloud-auth = "1.14.0"
+google-cloud-storage = "1.17.0"
+google-cloud-auth = "1.15.0"
 hashbrown = { version = "0.17.1" }
 hex = "0.4.3"
 hex-simd = "0.8.0"
 highway = { version = "1.3.0" }
+hostname = "0.4.2"
 ipnetwork = { version = "0.21.1" }
 lazy_static = "1.5.0"
 libc = "0.2.189"
@@ -263,7 +267,6 @@ memmap2 = "0.9.11"
 lz4 = "1.28.1"
 matchit = "0.9.2"
 md-5 = "0.11.0"
-md5 = "0.8.1"
 mime_guess = "2.0.5"
 moka = { version = "0.12.15" }
 netif = "0.1.6"
@@ -271,23 +274,23 @@ num_cpus = { version = "1.17.0" }
 nvml-wrapper = "0.12.1"
 parking_lot = "0.12.5"
 path-absolutize = "4.0.1"
-path-clean = "1.0.1"
 percent-encoding = "2.3.2"
 pin-project-lite = "0.2.17"
 pretty_assertions = "1.4.1"
 rand = { version = "0.10.2" }
 ratelimit = "0.10.1"
 rayon = "1.12.0"
-reed-solomon-erasure = { package = "rustfs-erasure-codec", version = "8.0.0" }
+reed-solomon-erasure = { package = "rustfs-erasure-codec", version = "8.0.2" }
 reed-solomon-simd = "3.1.0"
 regex = { version = "1.13.1" }
 rumqttc = { package = "rumqttc-next", version = "0.33.3" }
-redis = { version = "1.4.1" }
+redis = { version = "1.5.0" }
+rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.4" }
 rust-embed = { version = "8.12.0" }
 rustc-hash = { version = "2.1.3" }
-s3s = { git = "https://github.com/s3s-project/s3s.git", rev = "a5471625975f5014f7b28eee7e4d801f1b32f529" }
-serial_test = "3.5.0"
+s3s = { git = "https://github.com/cxymds/s3s.git", rev = "fe3941d91fa1c69956f209a9145995c9f0235bff" }
+serial_test = "4.0.1"
 shadow-rs = { default-features = false, version = "2.0.0" }
 siphasher = "1.0.3"
 smallvec = { version = "1.15.2" }
@@ -302,6 +305,7 @@ test-case = "3.3.1"
 thiserror = "2.0.19"
 tracing = { version = "0.1.44" }
 tracing-appender = "0.2.5"
+tracing-core = "0.1.36"
 tracing-error = "0.2.1"
 tracing-opentelemetry = { version = "0.33" }
 tracing-subscriber = { version = "0.3.23" }
@@ -312,7 +316,9 @@ uuid = { version = "1.24.0" }
 vaultrs = { version = "0.8.0" }
 tar = "0.4.46"
 walkdir = "2.5.0"
+winapi-util = "0.1.11"
 windows = { version = "0.62.2" }
+windows-sys = "0.61.2"
 xxhash-rust = { version = "0.8.18" }
 zip = "8.6.0"
 zstd = "0.13.3"
@@ -323,6 +329,7 @@ dial9-tokio-telemetry = "0.3"
 opentelemetry = { version = "0.32.0" }
 opentelemetry-appender-tracing = { version = "0.32.0" }
 opentelemetry-otlp = { version = "0.32.0" }
+opentelemetry-proto = { version = "0.32.0", default-features = false, features = ["metrics", "gen-tonic-messages"] }
 opentelemetry_sdk = { version = "0.32.1" }
 opentelemetry-semantic-conventions = { version = "0.32.1" }
 opentelemetry-stdout = { version = "0.32.0" }
@@ -333,15 +340,16 @@ libunftp = { version = "0.23.0" }
 unftp-core = "0.1.0"
 suppaftp = { version = "10.0.1" }
 rcgen = { version = "0.14.8", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
-russh = { version = "0.62.3" }
+russh = { version = "0.62.5" }
 russh-sftp = "2.3.0"

 # WebDAV
 dav-server = "0.11.0"

 # Performance Analysis and Memory Profiling
-mimalloc = "0.1.52"
-hotpath = "0.21.5"
+mimalloc = { version = "0.1.52", git = "https://github.com/xonatius/mimalloc_rust.git", rev = "1cdadea43e9c5a0f054b65be21200ce580e4eb13" }
+libmimalloc-sys = { version = "0.1.49", git = "https://github.com/xonatius/mimalloc_rust.git", rev = "1cdadea43e9c5a0f054b65be21200ce580e4eb13", features = ["extended"] }
+hotpath = { version = "0.23.0", default-features = false }
 # Snapshot testing for output format regression detection
 insta = { version = "1.48" }

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-FROM rust:1.97-trixie
+FROM rust:1.97.1-trixie

 RUN set -eux; \
    export DEBIAN_FRONTEND=noninteractive; \
@@ -32,7 +32,7 @@ ARG RUSTFS_BUILD_FEATURES=""
 # -----------------------------
 # Build stage
 # -----------------------------
-FROM rust:1.97-trixie AS builder
+FROM rust:1.97.1-trixie AS builder

 # Re-declare args after FROM
 ARG TARGETPLATFORM
@@ -0,0 +1,314 @@
+# RustFS 站点复制 / 桶复制 — MinIO 兼容性审查报告
+
+> 审查日期:2026-08-05
+> 审查对象:RustFS(worktree `reatang/minio-compatibility-review-03a7fb`)vs MinIO(`/Users/tang/Documents/GitHub/minio`)
+> 审查方式:白盒代码对比(5 个维度并行审查)+ P0 问题对抗性复核
+> 审查维度:站点复制白盒对比、桶复制白盒对比、mc 工具兼容性、S3 标准协议兼容性、代码结构与分层
+
+---
+
+## 一、总体结论
+
+| 领域 | 兼容性评价 |
+|---|---|
+| **站点复制(RustFS↔RustFS + mc 管理)** | 良好。admin 端点全覆盖、JSON 结构对齐 madmin-go、请求体 DARE 加密兼容,mc admin replicate 全家桶基本可用 |
+| **站点复制(RustFS↔MinIO 混合组网)** | **断裂**。4 个 P0:出站 join 路径 404、metainfo 大小写解析失败、STS item 类型名不一致、policy-mapping userType 数值错位 |
+| **桶复制(控制面,S3 标准 API)** | 良好。Put/Get/DeleteBucketReplication、错误码、状态机字符串、xl.meta 内部键均对齐 |
+| **桶复制(数据面,RustFS→MinIO)** | **断裂**。复制 PUT 缺 `?versionId=` 导致目标端版本漂移(P0);CopyObject 完全不复制(P0) |
+| **mc 桶复制命令** | **部分断裂**。`mc replicate add` 默认参数即失败(P0);status/resync/backlog 响应结构不匹配导致静默空输出(P1) |
+| **代码结构** | 桶复制侧迁移架构有纪律但成本高;**站点复制侧无领域层,约 9500 行业务逻辑堆在 admin handler,且存在 3 处反向依赖违反项目分层不变量(P0)** |
+
+**做得好的地方**(已确认兼容,无需整改):复制状态机字符串(PENDING/COMPLETED/FAILED/REPLICA 含 legacy COMPLETE)、xl.meta 内部键双前缀(x-rustfs-internal- + x-minio-internal-)读写、ReplicateDecision 内部状态串格式、复制内部头主链路双前缀、Delete/VersionPurge 语义、Resync reset-id 判定、admin 路由 `/minio/admin/v3` 前缀别名、madmin DARE 加密流解密、站点复制 gob netperf 编码、`site-repl-<deploymentID>` 规则模板。
+
+---
+
+## 二、P0 问题清单(8 项)
+
+| # | 问题 | 来源维度 | 断裂方向 |
+|---|---|---|---|
+| P0-1 | 出站 peer join 使用 MinIO 已移除的遗留路径 `/site-replication/join` → 404 | 站点复制 | RustFS→MinIO |
+| P0-2 | 解析 MinIO metainfo(SRInfo)字段大小写不匹配 → add preflight 失败 | 站点复制 | RustFS→MinIO |
+| P0-3 | STS 凭证复制 item 类型名 `sts-credential` vs `sts-account` | 站点复制 | 双向 |
+| P0-4 | policy-mapping `userType` 数值语义错位(RustFS: None=0/Svc=1/Sts=2/Reg=3;MinIO: reg=0/sts=1/svc=2)→ 权限静默漂移 | 站点复制 | 双向 |
+| P0-5 | 复制 PUT/CompleteMultipart 不携带 `?versionId=` query → MinIO 端版本号漂移、版本删除永久 no-op、双端静默发散(**功能视角复核:定级调整为 P1**,问题重述为"普通复制对象缺少可靠的源→目标版本身份策略";versionId query 是可行修复之一而非唯一正确方案) | 桶复制 | RustFS→MinIO |
+| P0-6 | CopyObject(含 metadata-replace 自拷贝)完全不触发复制调度,对象静默不复制(**功能视角复核:定级调整为 P1**;scanner 在 ExistingObjectReplication 启用+状态为空时可最终补齐,但同步复制语义失效,且继承 stale COMPLETED / 显式 Disabled 场景长期漏复制) | 桶复制 + S3 协议 | 所有方向 |
+| P0-7 | `mc replicate add` 默认参数(healthcheck-seconds=60)被硬拒 400;且字段单位按秒解析而 wire 为纳秒 | mc 兼容 | mc→RustFS |
+| P0-8 | 架构:站点复制约 9500 行业务逻辑堆在 admin handler 单文件;app/storage 层 3 处反向导入 admin 层,违反 ARCHITECTURE.md 分层不变量 #1(**对抗复核后降级为 P1**:反向边已被 arch 守卫棘轮基线锁死,属受控技术债) | 代码结构 | — |
+
+每项 P0 的对抗性复核结论、验证方案与解决方案见 **第五节**。
+
+**修复状态(2026-08-05)**:7 项确认 P0 已全部修复并创建 PR(红灯→绿灯 TDD):P0-1 [#5748](https://github.com/rustfs/rustfs/pull/5748)、P0-2 [#5749](https://github.com/rustfs/rustfs/pull/5749)、P0-3 [#5750](https://github.com/rustfs/rustfs/pull/5750)、P0-4 [#5751](https://github.com/rustfs/rustfs/pull/5751)、P0-5 [#5752](https://github.com/rustfs/rustfs/pull/5752)、P0-6+P1-10 [#5753](https://github.com/rustfs/rustfs/pull/5753)、P0-7 [#5754](https://github.com/rustfs/rustfs/pull/5754)。合并顺序:#5748+#5749 同批;#5752 先于 #5753。
+
+---
+
+## 三、P1 问题清单
+
+### 站点复制
+
+| # | 问题 | 证据 | 影响 |
+|---|---|---|---|
+| P1-1 | ILM(lc-config)复制语义:对外开关限定 `replicateILMExpiry`,但发送端把**完整** lifecycle.xml 放入 `expiry_lc_config`,接收端整体覆盖/删除本地配置(功能视角复核:**确认,维持 P1**;更新时间检查只能拒旧,不能修复整体覆盖语义) | RustFS `bucket_meta.rs:948-951`、`site_replication.rs:7590-7683` vs MinIO `site-replication.go:1784-1810,6138` | lifecycle 同时含 expiry 与本地 transition 时,非 expiry 规则被错误传播或本地 transition 被覆盖。**缺"同步 expiry 后保留本地 transition"测试** |
+| ~~P1-2~~→**P2-25** | `SRInfo.ilmExpiryRules` 从不填充,ILM 一致性状态恒为空(功能视角复核:**降级 P2**——仅影响管理面可观测性,不改变对象数据) | `site_replication.rs:4152-4266,4855-4868` | `mc admin replicate status --ilm-expiry-rules` 恒空,ILM 漂移不可见 |
+| P1-3 | 无自动跨站元数据 heal(MinIO 有周期 heal 协程) | RustFS 仅 600s 本地 wiring 修复(`site_replication_reconcile.rs:34,59-81`)+ 手动 repair 端点 vs MinIO `site-replication.go:4257-4288` | 错过的 IAM/bucket 元数据更新持续漂移,须手工 repair |
+| P1-4(拆分) | ①`sync` 同步复制指控:功能视角复核**不成立/证据不足**——RustFS 自身契约明确将 `sync_state` 定义为站点可达性/配置完整性健康状态且有测试,不能以他家同名字段判其错误(属"RustFS 独特设计保持不变"项,撤销);②`defaultbandwidth`:**确认,降级 P2**——公共 API 接受并持久化,但建 site replication bucket target 时不应用,reconcile 只保留既有 `bandwidth_limit`,配置成功但不生效 | `site_replication.rs:6303-6357,5004-5027` | ②为用户可见的"配置成功但无效"能力缺口 |
+
+### 桶复制 / S3 协议
+
+| # | 问题 | 证据 | 影响 |
+|---|---|---|---|
+| P1-5 | 未复制完成对象的 GET/HEAD 远端 proxy 未实现;也不识别 MinIO 的 `X-Minio-Source-Proxy-Request` 防环头 | 仅指标占位(`storage_api.rs:799-804`);`SUFFIX_SOURCE_PROXY_REQUEST` 定义后无人使用 vs MinIO `bucket-replication.go:2334,2409,2534` | active-active 复制滞后窗口内 RustFS 端 404 |
+| P1-6 | `X-Minio-Source-Replication-{Tagging,Retention,LegalHold}-Timestamp` 三个时间戳头收发均缺失 | `replication_target_boundary.rs:251-297` 填了 options 但 `PutObjectOptions::header()` 不序列化;接收端不解析 vs MinIO `object-api-options.go:377-399` | active-active 下标签/retention/legal-hold 并发修改的 LWW 冲突解析退化,可能元数据回滚 |
+| P1-7 | ARN 前缀 `arn:rustfs:` 与 `arn:minio:` 不互认(解析侧强制 `arn:rustfs:`) | `crates/ecstore/src/bucket/target/arn.rs:43,51` vs MinIO `bucket-targets.go:709` | 存量 MinIO 复制配置迁移被 StaleTarget 拒;原生 madmin SDK 解析 RustFS ARN 失败 |
+| P1-8 | PutBucketReplication 校验缺口(规则数/Priority 唯一/ID 长度/Filter 互斥/2MB 上限全缺)+ 主动拒绝 `Destination.StorageClass` 等 MinIO/AWS 合法字段 | `bucket_usecase.rs:582-616`、`config.rs:143-232` vs MinIO `internal/bucket/replication/replication.go:29-90` | 非法配置被接受、优先级冲突行为不可预测;存量 AWS/Terraform 配置(含 StorageClass)直接 400 |
+| ~~P1-9~~→**P2-26** | GetObject 响应缺 `x-amz-replication-status` 头(HEAD 有 GET 无),且 GET 专门把它从 metadata 过滤掉(功能视角复核:**降级 P2**;GET/HEAD 不一致确认,缺 GET replication-status 回归测试) | `object_usecase.rs:5696-5735`、`options.rs:702` vs MinIO `api-headers.go:236-238` | 依赖 GET 判断复制状态的客户端/监控失效;修复约一行 |
+| P1-10 | Snowball auto-extract 解包对象不触发复制(功能视角复核:**确认,维持 P1**,但"全部永不复制"不准确——scanner 在状态空+ExistingObjectReplication 启用时可补齐;显式 Disabled 等场景长期遗漏,即时复制始终失效。带 REPLICA 状态的入站成员须继续避免回环)。**已随 [#5753](https://github.com/rustfs/rustfs/pull/5753) 修复**(含入站复制 PUT 不再被误派发 extract 的次生缺陷) | `object_usecase.rs:8201` vs MinIO `object-handlers.go:2452,2510-2511` | 批量导入对象不即时复制;缺普通解包成员复制结果的测试(已在 #5753 补充 e2e) |
+
+### mc 响应结构(静默空输出类)
+
+| # | 问题 | 证据 | 影响 |
+|---|---|---|---|
+| P1-11 | `?replication-metrics[=2]` 响应为 Rust snake_case,minio-go MetricsV2 期望 camelCase(`currStats`/`queueStats`/…) | `stats.rs:617-770`、`admin/router.rs:1583-1592` vs MinIO `bucket-stats.go:154-188` | `mc replicate status` 不报错但全零(静默错误) |
+| P1-12 | replication-reset(resync)响应壳不匹配:`{"Targets":[{"Arn","ResetID",...}]}` vs `{"target":[{"arn","resetid","resyncStatus",...}]}` | `router.rs:126-198,1735-1803` vs MinIO `bucket-replication-utils.go:613-636` | `mc replicate resync start/status` 输出空;仅响应壳问题,修复成本低 |
+| P1-13 | `/v3/replication/mrf` 与 `/v3/replication/diff` 返回单个聚合对象而非条目流(代码自述 deliberate) | `replication.rs:695-725,879-911,998-1047` vs madmin-go `replication-api.go:104-176` | `mc replicate backlog` 输出空;`node`/`arn`/`verbose` 参数被忽略 |
+| P1-14 | set-remote-target 请求体 `deny_unknown_fields` + 字段名偏差(期望 `bandwidth_limit`,madmin 发 `bandwidthlimit`;`session_token` vs `sessionToken` 等) | `handlers/replication.rs:88-95,108-163` vs madmin-go `bucket-targets.go:76` | `mc replicate add/update --bandwidth` 整请求失败;凡 omitempty 字段一旦出现即 400 |
+
+### 代码结构
+
+| # | 问题 | 证据 | 影响 |
+|---|---|---|---|
+| P1-15 | 站点复制状态两套归一化实现(handler 类型化 vs service 无类型 JSON),且 reload 的 read→normalize→save 全程无共同分布式对象锁,存在 lost-update 竞争;repair state 已用 `with_config_object_write_lock` 包住完整 RMW,主 state 未采用同等保护(功能视角复核:**确认,维持 P1**;进程内 `SITE_REPLICATION_STATE_LOCK` 与单次 read/save 各自的对象锁均不能保护跨调用 RMW:A 读旧→B 另节点写入→A 用旧快照覆盖,B 丢失) | `handlers/site_replication.rs:114,347,1039-1130` vs `service/site_replication.rs:26-135` | 归一化语义可 drift;多节点/RPC 并发写状态互相覆盖。**缺多节点/双写者 lost-update 回归测试** |
+| P1-16 | 复制状态机类型双份定义:`rustfs-filemeta` 与 `rustfs-replication` 各持一份(ReplicationStatusType/VersionPurgeStatusType/ReplicationState/MrfReplicateEntry/ReplicateObjectInfo),靠 boundary 双向转换 | `crates/filemeta/src/replication.rs` vs `crates/replication/src/filemeta.rs` | 状态机语义修改须同步两处+转换层,漏一处即静默数据语义错误;建议加 enum 对账测试 |
+| P1-17 | 桶复制逻辑分裂:`crates/replication` 仅契约,执行引擎(pool 5947 行、resyncer 4090 行)仍在 ecstore,中间 20+ 个 boundary/bridge 微文件;迁移无完成判据,脚手架有固化风险 | `crates/ecstore/src/bucket/replication/README.md`、`mod.rs:15-45` | 可读性/可维护性成本;需设定迁移里程碑 |
+| P1-18 | 超长函数集中在复制热路径:`resync_bucket` 536 行、`replicate_all` 403 行、`start_mrf_processor` 305 行、`apply_iam_item` 248 行 | `replication_resyncer.rs:546`、`replication_pool.rs`、`site_replication.rs:7806` | 正确性审查与修改风险高 |
+
+### 第三方复审新增与调整项(功能视角二次复核后)
+
+| # | 问题 | 来源 | 影响 |
+|---|---|---|---|
+| P1-19 | 普通复制对象缺少可靠的源→目标版本身份策略:PUT 响应的目标版本 ID 未捕获/持久化,对不支持 versionId query 的目标(原生 AWS S3 等),后续版本删除复制落空;MRF 只会重试同一个错误身份,HEAD ETag fallback 不能修复删除 | P0-5 复审 | 非 MinIO 系目标的版本化复制双端发散。缺"目标自行分配版本 ID"场景测试 |
+| P1-20 | 缺少 scanner 补偿边界的 e2e:ExistingObjectReplication Enabled/Disabled × 空状态/继承状态 组合下的补齐与不补齐行为无回归覆盖(Copy 与 Snowball 两路径) | P0-6/P1-10 复审 | scanner 兜底语义变化不可见 |
+| P1-21 | delete-marker 延迟 purge 失败静默丢弃(由 P2-20① 升级):目标删除失败无日志/状态/MRF,目标端 marker/版本可能永久残留 | P2-20 复核升级 | 数据一致性;缺失败注入测试 |
+| P1-22 | 桶复制整体 SSE 支持能力缺口(替代原 P2-23):SSE-S3/SSE-KMS 所有复制模式统一 fail closed,SSE-C 失败被 e2e 钉为当前行为,无 encrypted-object resync e2e | P2-23 复核改写 | 加密对象跨站不复制;需覆盖普通复制/Heal/Resync/Multipart 四模式 |
+
+### 功能视角二次复核采纳记录(backlog#1675,基于 main f0c4fbd28)
+
+复核共 10 项,判定依据为 RustFS 自身功能契约与实际调用链,不以对齐 MinIO 为正确性标准。采纳结果:
+
+| 原编号 | 复核结论 | 采纳动作 |
+|---|---|---|
+| P0-5 | 确认,P0→P1,问题重述为"源→目标版本身份策略缺失" | 定级调整;修复已合 [#5752](https://github.com/rustfs/rustfs/pull/5752);残留缺口 P1-19 |
+| P0-6 | 确认,P0→P1,scanner 描述纠正 | 定级调整;修复已合 [#5753](https://github.com/rustfs/rustfs/pull/5753);测试缺口 P1-20 |
+| P1-1 | 确认,维持 P1 | 补记"expiry 同步后保留本地 transition"测试缺口 |
+| P1-2 | 确认,P1→P2(仅管理面可观测性) | 改编号 P2-25 |
+| P1-4 | 拆分:`sync` 指控不成立(RustFS 自身契约定义为健康状态,有测试);`defaultbandwidth` 确认为 P2 能力缺口 | `sync` 撤销并归入"独特设计保持不变";`defaultbandwidth` 降 P2 |
+| P1-9 | 确认,P1→P2 | 改编号 P2-26;补记缺 GET 回归测试 |
+| P1-10 | 确认,维持 P1,"全部永不复制"改为"即时复制失效+部分场景长期遗漏" | 已随 [#5753](https://github.com/rustfs/rustfs/pull/5753) 修复(含回环防护) |
+| P1-15 | 确认,维持 P1(竞争机理精确化:跨调用 RMW 无共同分布式锁) | 补记缺双写者 lost-update 测试 |
+| P2-20① | 确认,P2→P1(延迟 purge 失败静默丢弃部分) | 升级为 P1-21;②③维持 P2 |
+| P2-23 | resync 专属指控不成立;暴露桶复制整体 SSE 能力缺口 | 撤销原表述,改立 P1-22 |
+
+**复核指出的测试补齐清单**(均未运行跨实例集成验证,需落地):目标自行分配版本 ID、Copy/Snowball scanner 补偿边界、lifecycle expiry/transition 保留、site state 双写竞争、delayed purge 失败注入、encrypted-object resync。
+
+---
+
+## 四、P2 问题清单
+
+### 站点复制
+- **P2-1** `showDeleted` 选项与 `bucketDeletedTimestamp` 未实现(`site_replication.rs:1364-1381`)
+- **P2-2** 错误码泛化:统一 `InvalidRequest`/`InternalError`,无 MinIO 的 9 个 `XMinioSiteReplication*` 专用码(400/503 语义丢失)
+- **P2-3** `make-with-versioning` 忽略 `versioningEnabled`/`forceCreate` 参数,恒 true(`site_replication.rs:8597-8627`)
+- **P2-4** netperf 返回"不支持"占位(gob 格式兼容不会崩);devnull 有请求体大小上限(MinIO 无限 discard)
+- **P2-5** Metrics 摘要仅含本站,无 per-peer 链路统计(downtime/latency/失败窗口)
+- **P2-6** `external-user`/`credential` IAM item 未实现——与本仓 MinIO 版本等价缺失,结构已预留;对接新版 MinIO 时会成缺口
+- **P2-7** 本地 deploymentID 缺失时回退 endpoint 哈希(16 位 hex,非 UUID 形态)
+
+### 桶复制 / S3 协议
+- **P2-8** 遗留内部 client 头名错误:`X-Source-DeleteMarker`/`X-Check-Replication-Ready` 缺 `X-Minio-` 前缀(`client/api_stat.rs:191-231`,当前路径未激活,潜伏缺陷)
+- **P2-9** Remote target admin 错误码扁平化(MinIO 有 404/503 专用码,RustFS 统一 400/500)
+- **P2-10** Remote target 拒绝 `disableProxy`/`edge`/`edgeSyncBeforeExpiry` 等 madmin 字段(非默认参数,影响小)
+- **P2-11** `list-remote-targets` 序列化偏差:`bandwidth_limit`/`storage_class`/`deployment_id`/`reset_id`/`session_token` vs madmin 的 `bandwidthlimit`/`storageclass`/`deploymentID`/`resetID`/`sessionToken`;`healthCheckDuration`/`totalDowntime` 按秒序列化而 Go 按纳秒解;`type` 过滤参数被忽略
+- **P2-12** set-remote-target?update=true 忽略 madmin 的 op 标志(creds/sync/proxy/…),固定整体覆盖
+- **P2-13** XML 反序列化:Rule 内未知元素严格报 MalformedXML(顶层却跳过,行为不一致);缺 `<Role>` 报 MalformedXML(Go 容忍)——向前兼容性差,当前主流客户端不受影响
+- **P2-14** `ReplicaModifications` 默认 Disabled(与 AWS 一致、与 MinIO 的注入 Enabled 分歧);PUT 时不像 MinIO 那样注入默认元素回写
+- **P2-15** PutBucketReplication 要求预先注册 remote target(与 MinIO 同构、与纯 AWS 流程分歧),报错未指引先建 target
+- **P2-16** GetBucketReplication 响应无 xmlns(与 MinIO 一致,极少数严格 SDK 可能拒收)
+- **P2-17** 站点复制启用时不阻止普通用户直接改桶复制配置(MinIO 非 root 报 `ErrReplicationDenyEditError`)
+- **P2-18** Prometheus 指标名对齐 metrics-v3 但注册前缀为 rustfs 体系;versioning 错误文案与 MinIO 不同(code 一致)
+
+### 代码结构
+- **P2-19** `apply_iam_item` / bucket-ops 用裸字符串 match 分发,无法穷尽检查;建议改 `#[serde(tag)]` 枚举
+- **P2-20(拆分)** 静默吞错:①`replication_resyncer.rs:1693` delete-marker 延迟 purge 失败被 `let _ =` 丢弃,target client 缺失时直接跳过——**功能视角复核:升级为 P1-21**(失败后无日志、无状态更新、不入 MRF,目标 delete marker/版本可能永久残留;启动前的 5 次循环只是等源 marker 消失,不是对目标删除失败的重试。缺注入目标删除失败并验证重试/状态/MRF 的测试);②`site_replication.rs:8661` purge-deleted-bucket 吞掉非 NotFound 错误、`:9227` cancel resync 失败无痕迹——维持 P2
+- **P2-21** `MrfV2` 全套机制(Error/Capabilities/Readiness/Reader/Envelope)未接线,生产只用 v1,属投机代码
+- **P2-22** `persist_site_replication_state` 双重 clone + 双重 normalize(`site_replication.rs:1143-1152` → `:1116-1122`)
+- **P2-23(撤销并改写)** 原"resync 不处理 SSE"指控不成立——`ReplicationType::Resync` 与普通复制/Heal 最终走同一 `replication_put_object_options`,`// TODO: SSE` 不构成 resync 独立行为差异。真实状态:SSE-S3/SSE-KMS 在**所有复制模式**下统一 fail closed,SSE-C 普通桶复制失败已被现有 e2e 钉为当前行为,且无 encrypted-object resync e2e → 改立能力项 **P1-22"桶复制整体 SSE 支持"**(需分别覆盖普通复制、Heal、手动 Resync、Multipart)
+- **P2-24** `crates/replication` 命名误导(名为复制引擎实为契约库),建议 lib.rs 顶部文档说明
+- 正面确认:生产代码 unwrap/expect 纪律良好(几乎全在测试模块);MinIO 概念映射(ReplicationPool/Resyncer/MRF/TargetClient)桶复制侧清晰,站点复制侧缺 `SiteReplicationSys` 聚合体
+
+---
+
+## 五、P0 问题对抗性分析(复核结论 + 验证方案 + 解决方案)
+
+### P0-1 出站 peer join 路径 — **CONFIRMED(比原指控更严重)**
+
+**复核结论**:指控全部成立,且加重三点:
+1. `/minio/admin/v3/site-replication/join` 在 MinIO 历史上**从未存在过**(`git log -S` 追到功能诞生的 2021 年首个提交,注册的就是 `peer/join`)。RustFS 实现者疑似被 MinIO `admin-handlers-site-replication.go:76` 一条过时的文档注释误导。
+2. 无任何 404 回退、版本探测或 feature flag;唯一的重试逻辑只针对 secret 不匹配(`site_replication.rs:3036-3082`),404 直接失败。
+3. 现有单测 `:13683-13696` 正在**固化错误行为**(测试名声称匹配 MinIO 路由,断言的却是不存在的路由)。RustFS↔RustFS 之所以不暴雷,是因为 RustFS 入站自己注册了该错误路径的兼容别名,掩盖了 bug。
+
+**影响面**:RustFS 发起的 add(含 MinIO 站点)、服务账号轮换通知 MinIO peer 均断;MinIO→RustFS 与 RustFS↔RustFS 不受影响;其余 peer/* 端点走通用前缀改写,路径正确。
+
+**修路径还不够,还有三处 join 协议分歧须同批修**:①加密判定 `site_replication_peer_payload_encrypted`(:2899-2901)只对旧路径加密,MinIO `SRPeerJoin` 强制解密,须跟随路径改;②MinIO join 成功返回**空 body**,RustFS `:8163` 强制解析 `SRPeerJoinResponse` 会失败,须容忍空 body(peer 身份回退用 preflight 已取得的数据合成);③`deferSyncStateEnable`/`bootstrapToken` 对 MinIO 无效但不阻断(行为差异,建议日志标注)。
+
+**验证方案**:
+- 单测:翻转 `:13683`/`:13699` 两个测试断言为 `peer/join`(把固化 bug 的测试变成回归防护)。
+- 集成测:测试内起 axum stub 精确复刻 `admin-router.go` 路由(仅注册 `PUT .../peer/join`,其余 404),handler 内用 `decrypt_stream_io` 验证 body 是 madmin 兼容密文,返回 200 空 body;断言修复前 404、修复后全链路成功。
+- e2e:docker compose(rustfs+minio),RustFS 侧 `mc admin replicate add`,MinIO 侧 `mc admin trace -a` 断言 `PUT .../peer/join` 200。注意:**e2e 会先被 P0-2 的 preflight 挡住,两问题必须同批修复才能全链路验证**。
+
+**解决方案**(均在 `handlers/site_replication.rs`):删除 :2885-2886 的 join 特判使其落入通用前缀改写;:2899-2901 加密判定改为对 `peer/join` 返回 true;:8163 响应解析容忍空 body;更新两个单测。
+**滚动升级风险**:必须保留入站的 `/v3/site-replication/join` 旧路径路由(旧版 RustFS 出站仍发它);发版前对最近 release tag 复核旧版入站已注册 `peer/join`。
+
+### P0-2 SRInfo 大小写不匹配 — **CONFIRMED(范围精确化)**
+
+**复核结论**:成立。madmin-go v3.0.109(minio go.mod 锁定版)`SRInfo` 除 `APIVersion` 外 12 个顶层字段**全部无 json tag**,Go 按 PascalCase 序列化;RustFS `SRInfo` serde 大小写敏感、全字段 `#[serde(default)]` → 解析 MinIO 输出**不报错而是静默全空**。精确化:**不兼容仅限 SRInfo 顶层 12 个字段**,嵌套结构(SRBucketInfo/SRStateInfo/SRIAMPolicy 等)madmin 本就带小写 tag,不受影响。`:5581` 的 `"buckets"|"Buckets"` 手写双读证明作者已知 MinIO 输出 PascalCase,只是未系统化修复。
+
+**影响面**:RustFS 发起 add 时 preflight 硬失败("site did not report deploymentID")——**触发顺序先于 P0-1 的 join**;`mc admin replicate status` 对 MinIO peer 静默显示全空/全 mismatch(HTTP 200,无报错)。MinIO 读 RustFS 方向因 Go unmarshal 大小写不敏感而无恙。
+
+**验证方案**:
+- 单测(crates/madmin):用 Go `json.Marshal(madmin.SRInfo{...})` 真实生成的 PascalCase JSON 作 fixture,断言反序列化后字段非空;再加序列化回归断言输出仍为 camelCase(保证 RustFS↔RustFS 不回归)。
+- 集成测:stub 在 metainfo 端点返回 PascalCase body,走 `remote_add_preflight_info`,断言不再报错。
+- e2e:与 P0-1 同批,`mc admin replicate status --json` 断言 MinIO 站点条目完整。
+
+**解决方案**:`crates/madmin/src/site_replication.rs:642-670` 为 12 个顶层字段逐一加 `#[serde(alias = "...")]`(精确取 Go 字段名,注意是 `ILMExpiryRules` 不是 `IlmExpiryRules`)。alias 只影响反序列化,出站格式零变化,风险几乎为零。**只加顶层、不扩散到嵌套结构**,并留注释说明原因。回归防护关键是把 Go 真实输出固化为测试 fixture。
+
+### P0-7 `mc replicate add` 默认参数被拒 + 单位错误 — **CONFIRMED**
+
+**复核结论**:全部反驳方向反向坐实(本地有 mc 源码,非推断):
+- mc `replicate-add.go:93-95` 默认 `healthcheck-seconds=60`,`:301-303` 无条件调用 `SetRemoteTarget`,失败即终止,无跳过路径;
+- madmin `bucket-targets.go:79` `HealthCheckDuration time.Duration` 无自定义 Marshal → wire 上是纳秒整数 `60000000000`;
+- RustFS `handlers/replication.rs:213-225` 对非零值必拒 400;`mc replicate update` 同样失败;无老端点绕过。
+- **单位错误独立成立且双向**:请求侧按 `Duration::from_secs` 解析(60e9 ns 会被当 60e9 秒 ≈ 1900 年);响应/持久化侧 `bucket_target.rs:195-197` 按秒序列化,mc 按纳秒解(60s 显示为 60ns),同时构成与 MinIO `bucket-targets.json` 的持久化格式偏差。
+- **为何没被发现**:这是刻意的"能力契约式拒绝"策略,且有单测 `replication.rs:1353-1379` 固化拒绝行为;e2e 全部自行构造 JSON、不含该字段,测的是"RustFS 自己的请求形态"而非"mc 默认请求形态"。缓解:`--healthcheck-seconds 0` 时字段 omitempty 被省略可通过,但默认路径必失败,P0 成立。
+
+**验证方案**:复现——`mc replicate add rustfs/src --remote-bucket http://ak:sk@target/dst` 预期 400;修复后——madmin 形态 payload(60e9 ns)单测断言内部 Duration==60s;set→list 往返断言响应为纳秒;e2e 增加"mc 默认 payload"用例;持久化防御性读回归(旧秒格式升级后读取不变)。
+
+**解决方案(分阶段)**:
+1. **解阻塞**:从不支持清单移除 `healthCheckDuration`(能力契约版本号递增);请求按 `Duration::from_nanos` 解析(`total_downtime` 同步核查);调度上显式忽略并在契约/文档标注"接受但暂不生效";响应侧新增 DTO 按纳秒序列化(**勿直接改 `bucket_target.rs` 的 `duration_seconds`,它同时是持久化格式**);持久化读取加防御(≥10^7 视为纳秒),写入统一新格式。
+2. **落地语义**:`bucket_target_sys.rs:332-441` heartbeat 循环改为按 target 取值,对齐 MinIO(默认 5s、有下限)。
+3. **防复发**:建立容器内跑真 mc 命令的兼容 e2e 通道,覆盖 `replicate add/update/status`。
+
+### P0-8 站点复制架构 — **事实 CONFIRMED,定性部分 REFUTED,降级为 P1**
+
+**复核结论**:巨型文件(14614 行,非测试约 9533 行,24 个 handler)与三处反向导入全部属实;但"失察"定性被推翻:
+- `scripts/check_layer_dependencies.sh` **已建模并拦截**这些边,`layer-dependency-baseline.txt` 棘轮基线逐条列出全部 46 条存量反向边,**新增反向边 CI 必炸**;
+- `ecfs.rs` 被脚本刻意归类为 interface 层(有意的建模决策);
+- ARCHITECTURE.md 自己声明部分不变量 "currently violated... documenting them makes violations explicit and trackable";git 历史显示这是已知、受控、正在偿还的过渡态。
+- **结论:不构成正确性风险,从 P0 降为 P1(可维护性债务)**。真实成本:9.5k 行单文件的评审/合并冲突/增量编译负担,hook 直连使 app/storage 单测无法脱离 admin 层。
+
+**验证方案**:每阶段跑 `make pre-pr`;每消除一条反向边即**删除基线对应行**(而非重生成),使回归必炸;行为回归靠 site replication e2e + 路由快照测试 + `git diff --color-moved` 评审纯移动。
+
+**解决方案(分阶段)**:
+1. **解反向依赖(低风险,先做)**:复用 `site_replication_reconcile.rs` 已验证的 OnceLock 注册模式——bucket 三个 hook 在 app 层定义 fn-pointer 契约、admin 构建路由时注册;`node_service.rs` 的 reload 走 infra 层"运行时重载注册表"。注册缺失时显式降级(warn + no-op)。
+2. **文件拆分(纯移动)**:`site_replication.rs` → 模块目录:`transport`(peer client/DNS/TLS)、`gob`、`state`(注意 config key 路径不可变)、`iam_sync`、`heal`、`handlers`(24 个薄 handler)。
+3. **领域下沉(风险最高,最后做)**:hook 解耦后把 gob/transport/状态机移入独立 crate,注意全局状态清单(`docs/architecture/global-state-inventory.md:114`)。
+
+### P0-3 STS item 类型名不一致 — **CONFIRMED(双向硬断)**
+
+**复核结论**:成立,且两端都是**报错而非静默忽略**:MinIO 收到 `"sts-credential"` 走 default 分支返回 400 `errSRInvalidRequest`;RustFS 收到 `"sts-account"` 返回 NotImplemented。两端 heal/重试机制都会永久重试失败(MinIO 日志持续 "Unable to heal temporary credentials")。MinIO 当前版本 STS 复制发送面很广(AssumeRole/WebIdentity/ClientGrants/LDAPIdentity/Certificate 全系 + sftp/ftp + heal 路径)。除类型串外 `SRSTSCredential` 字段双方完全对齐——**只差这一个字符串**(推测 RustFS 实现时把 madmin 的 JSON 字段名 `stsCredential` 误当成了类型常量)。
+
+**影响面**:跨厂商 STS 临时凭证双向不复制(客户端在对端站点 `InvalidAccessKeyId`),纯可用性问题,无权限漂移;RustFS↔RustFS 自洽。
+
+**验证方案**:单测——出站产物断言 `type == "sts-account"`(改 `federated_identity.rs:497` 现有快照测试);入站构造 `"sts-account"` item 断言不落 NotImplemented。e2e——compose(RustFS+MinIO,root 凭证必须一致,否则 token 验签失败会误判修复无效):对 MinIO assume-role 拿临时凭证访问 RustFS,修复前 InvalidAccessKeyId、修复后成功;反向同测。
+
+**解决方案**:出站(`sts.rs:248`、`federated_identity.rs:241`)改发 `"sts-account"`(提常量集中定义);入站(`site_replication.rs:7857`)match 臂改 `"sts-account" | "sts-credential"`(**永久保留旧别名**兼容旧 RustFS peer)。滚动升级窗口内新→旧 RustFS 会降级(warn+重试,peer 升级后收敛);STS 凭证短生命周期,不建议为此拆两阶段发布。
+
+### P0-4 policy-mapping userType 数值错位 — **CONFIRMED(比指控更严重)**
+
+**复核结论**:数值表属实(RustFS: None=0/Svc=1/Sts=2/Reg=3;MinIO: unknown=-1/reg=0/sts=1/svc=2),wire 上确为数值、无翻译层。对抗复核修正与加重:
+- **RustFS→MinIO 方向今天"侥幸能用"**:RustFS 当前只出站 Reg=3 与组的 0,MinIO 对超范围值静默落 default 分支,恰好落对位置;
+- **MinIO→RustFS 方向三类断裂**:①**组映射硬失败(新发现)**——MinIO 组映射发 `UserType: -1`,RustFS `user_type: u64` 反序列化直接报错,整个 item 被拒,组→策略映射完全无法同步;②STS 用户映射(MinIO 发 1)被 RustFS 解释为 Svc,落错前缀/缓存,联邦用户在 RustFS 站点**静默丢权限**;③svc=2 被解释为 Sts,同类错位;
+- **低概率提权路径**:LDAP DN/OIDC 主体的映射被误存入常规用户缓存后,若本地恰有同名静态用户则继承本不属于它的策略——名字碰撞概率低但非零,这是保 P0 的理由。
+
+**验证方案**:单测——wire 编解码全矩阵(-1/0/1/2/3/非法值);e2e——MinIO 侧 `mc admin policy attach --group` 修复前 RustFS 查不到组实体、修复后可见;`mc idp ldap policy attach` 修复前落 `policydb/service-accounts/` 且访问被拒、修复后落 `sts-users/` 且放行;反向回归守住"侥幸兼容";混版本(旧+新 RustFS)双向 attach 互通。
+
+**解决方案(核心原则:不改 `UserType::to_u64/from_u64`)**——该编码被集群内部节点 RPC 使用(`node_service.rs:1513`),改动会破坏同集群滚动重启。只在站点复制 wire 边界加 MinIO 语义编解码:
+1. `SRPolicyMapping.user_type` 由 `u64` 改 `i64`(必须,才能收下 -1);
+2. 出站 `sr_wire_user_type`:Reg→0/Sts→1/Svc→2,组一律发 0(对 MinIO 与旧 RustFS 同时兼容);入站 `user_type_from_sr_wire`:-1→None/0→Reg/1→Sts/2→Svc/**3→Reg(旧 RustFS 别名,永久保留)**;
+3. 兼容矩阵已逐格验证:新↔旧 RustFS、MinIO↔新 RustFS 全通;唯一残余窗口(未来出站 Sts/Svc 映射对旧 RustFS 错读)当前不可达,在 doc comment 写明约束;
+4. 回归防护:编解码矩阵单测 + "wire 常量契约"字面值断言测试(防止将来被"顺手统一"回内部编码)+ e2e 进 P0 套件;顺带把 `SRCredInfo.iam_user_type` 一并改 `i64` 复用同一编解码,消除同族隐患。
+
+### P0-5 复制 PUT 缺 `?versionId=` query — **CONFIRMED**
+
+**复核结论**:所有反驳方向均失败,指控成立:
+- minio-go 官方复制端(v7.0.91)`api-put-object-streaming.go:767-776` 等三处全部是 `urlValues.Set("versionId", ...)`——**query,不是 header**;`x-minio-source-version-id` 这个 header 在 MinIO 全仓不存在,被静默忽略;
+- multipart 的版本在 **initiate 时**决定(`erasure-multipart.go:458-460`,为空即生成新 UUID),complete 不读 versionId;
+- aws-sdk-s3 `PutObjectInput` 无 versionId 成员属实,但 DELETE 路径已用 `.set_version_id()` 正确落 query,证明是遗漏而非不可行;
+- RustFS↔RustFS 不受影响的原因:RustFS 接收端有私有 header fallback(`options.rs:296-301`),恰好掩盖了 bug。
+
+**影响加重**:除版本漂移与按版本删除永久 no-op 外,目标校验/heal 用源 versionId `head_object` 永远 miss → **反复重传,目标端版本无限膨胀**。另有边缘缺陷:RustFS 内部 null 版本是 nil-UUID,直接发 query 会被 MinIO 当真实版本;minio-go 约定发字面 `"null"`。
+
+**验证方案**:L1 e2e(本仓可落地,红→绿)——复用 `crates/e2e_test/src/fake_s3_target/`(已解析 versionId query 并写 journal),断言 PutObject/CreateMultipartUpload 请求的 query == 源版本;L2 互操作(docker + 真 MinIO)`mc ls --versions` 断言目标 versionId == 源、删源版本目标同步消失;L3 单测 nil-UUID→`"null"` 映射。
+
+**解决方案**(`bucket_target_sys.rs`):`put_object`/`create_multipart_upload` 在 `map_request` 闭包内改写 URI 追加 `versionId` query(nil-UUID 映射 `"null"`);保留双 header 兼容旧版 RustFS 接收端;顺带核对 delete 路径的 nil-UUID 映射。**签名安全性已验证**:`map_request` 挂在 `modify_before_signing`,query 会进 canonical request,不会 SignatureDoesNotMatch。非版本化目标桶沿用"空则不发",`"null"` 值 MinIO 免检。
+
+### P0-6 CopyObject 不触发复制 — **CONFIRMED(附带加重发现)**
+
+**复核结论**:三个反驳方向全部不成立:
+- copy 直接调 `store.copy_object`,不经 put 路径;ecstore 层 copy 实现无任何调度;
+- **scanner 兜底不存在(关键)**:heal 入队条件是状态为 Pending/Failed 或手动 resync;而 copy 路径不 stamp PENDING(对照 put 路径 `object_usecase.rs:5255-5266`),状态为空 → heal 判定 Skip。
+- **加重发现**:copy 路径没有 MinIO `filterReplicationStatusMetadata` 的等价清理——COPY 指令下源对象的旧复制状态可能原样带到目的对象,**伪造 COMPLETED 假状态**。
+- 附带 P1(snowball `execute_put_object_extract`)同样确认:无 stamp 无 schedule。
+
+**影响面**:配复制规则的桶上,CopyObject 写入的对象(跨桶复制、rename 工作流、REPLACE 元数据更新)永不复制、scanner 不捞、仅手动 resync 可补;还可能带 stale 假状态。
+
+**验证方案**:e2e(参照 `replication_extension_test.rs` 双实例)——copy 后断言目的对象在目标桶超时内出现、源 COMPLETED、目标 REPLICA、无 stale 状态;snowball 参照 `snowball_auto_extract_test.rs` 加成员对象复制断言;usecase 单测用 `storage_api.rs:641` 现有 test-only 调用计数断言 copy/extract 触发决策与调度。
+
+**解决方案**(`object_usecase.rs`):
+1. `execute_copy_object` 在 `store.copy_object` 之前算一次 `dsc = must_replicate_object(...)`,`replicate_any` 时向 `dst_opts.user_defined` stamp pending + timestamp(严格镜像 put 路径,单一 dsc 决策贯穿两阶段);
+2. 同处清理源带来的复制状态 reserved 元数据;
+3. copy 成功、锁释放后 `schedule_object_replication`;
+4. `execute_put_object_extract` 对每个解出对象同样处理。
+风险已排除:replica 判定内置于 `must_replicate_object` 不会回环;self-copy 调度与 MinIO 一致。
+**落地顺序约束:先修 P0-5 再修 P0-6**——否则 copy 的失败重试经 heal 兜底后,只会在 MinIO 端制造更多漂移版本。
+
+### 第三方复审修正(2026-08-05,修复分支均已完成 review)
+
+**P0-5 修正**:问题的准确表述应为"**普通复制对象缺少可靠的源→目标版本身份策略**"——复制 PUT 只返回成功/失败,未捕获目标实际分配的版本 ID(已核实 `bucket_target_sys.rs` put 路径无 `res.version_id()` 捕获,delete 路径 :2030 有);multipart 只保留 upload ID。`fix/p0-5` 的 versionId query 方案对 MinIO/RustFS 目标成立(目标端沿用源版本 ID,身份问题消解),但对**忽略该私有 query 的目标(如原生 AWS S3)**身份问题仍在:目标自行生成版本 ID → 后续按源版本 ID 的删除复制落空。第三方建议定级 P1(修复已完成,残留缺口另行跟进):可选方案包括捕获 PUT 响应的 `x-amz-version-id` 并持久化源→目标映射。→ 记为 **P1-19(新增)**。
+
+**P0-6 修正**:scanner"兜底不存在"的表述过度。已核实 `crates/replication/src/operation.rs` `resync_target_for_object`:无 reset 记录且复制状态为 Empty 时返回 `replicate=true`,即 ExistingObjectReplication 启用时 scanner **可能最终补齐**空状态对象,无需手动 resync。准确结论:即时/同步复制语义失效(P0 定级依据),且以下场景**长期**漏复制——①源对象 COMPLETED 等复制元数据被 Copy 继承致误判(`fix/p0-6` 已修,清理先于决策);②显式 ExistingObjectReplication=Disabled;③其他无法进入 existing-object 补偿的场景。`fix/p0-6` 分支已含 copy 调度 e2e 与 stale 元数据白盒断言;**scanner 补偿边界的 e2e 仍缺** → 记为 **P1-20(新增)**。
+
+### 对抗性复核总览
+
+| 问题 | 复核结论 | 关键修正/加重 |
+|---|---|---|
+| P0-1 join 路径 | CONFIRMED,加重 | 路径在 MinIO 从未存在;现有单测固化错误;修复需同批改加密判定与空响应容忍 |
+| P0-2 SRInfo 大小写 | CONFIRMED,精确化 | 仅顶层 12 个无 tag 字段;preflight 失败先于 P0-1 触发 |
+| P0-3 STS 类型名 | CONFIRMED | 双向硬断、两端 heal 永久重试;只差一个字符串 |
+| P0-4 userType 错位 | CONFIRMED,加重 | MinIO 组映射发 -1 → RustFS u64 解析硬失败;存在低概率名字碰撞提权路径;修复不得触碰内部 RPC 编码 |
+| P0-5 versionId query | CONFIRMED,加重 | heal 反复重传致目标版本膨胀;nil-UUID 需映射 "null" |
+| P0-6 CopyObject | CONFIRMED,加重 | scanner 兜底不存在;stale COMPLETED 假状态;须在 P0-5 之后落地 |
+| P0-7 healthCheckDuration | CONFIRMED | 单位错误双向独立成立;有单测固化拒绝行为 |
+| P0-8 架构 | 事实 CONFIRMED,定性 REFUTED | 反向边被棘轮基线锁死,降级 P1(受控技术债) |
+
+---
+
+## 六、修复路线图(2026-08-05 更新)
+
+**✅ 第一批已完成**:全部 7 项 P0 已修复并创建 PR(见第二节修复状态;P1-10 snowball 随 #5753 一并修复)。待合并,注意顺序约束:#5748+#5749 同批、#5752 先于 #5753。
+
+**第二批(数据一致性优先,采纳功能视角复核定级)**
+1. **P1-21** delete-marker 延迟 purge 失败静默丢弃(复核升级,数据一致性,建议单独小 PR + 失败注入测试)
+2. **P1-19** 源→目标版本身份策略(捕获 PUT 响应 `x-amz-version-id` / 持久化映射,覆盖非 MinIO 系目标)
+3. **P1-1** ILM expiry 同步语义(只传播 expiry、保留接收端本地 transition + 对应测试)
+4. **P1-15** site state RMW 分布式锁统一(对齐 repair state 的 `with_config_object_write_lock` 模式)+ 双写者回归测试
+5. **P1-22** 桶复制 SSE 能力(普通复制/Heal/Resync/Multipart 四模式,先补 encrypted-object e2e 钉现状)
+
+**第三批(mc 可观测性与互操作补齐)**
+6. P1-11/12/14 mc 响应结构 serde rename(改动小、消除静默空输出)
+7. P1-7 ARN 解析侧兼容 `arn:minio:` 前缀
+8. P1-5 GET/HEAD proxy、P1-6 时间戳头、P1-3 自动跨站 heal
+9. P1-20 scanner 补偿边界 e2e;P0-7 阶段 2(per-target 心跳 + healthcheck update op)
+10. P2-26 GET 补 `x-amz-replication-status`(约一行)+ 回归测试;P2 清单其余项
+
+**第四批(架构与长期)**
+11. P0-8(降级 P1)架构:先解 3 处反向依赖(复用 reconcile 注册模式),再拆分/下沉站点复制领域模块
+12. P1-16 类型对账测试、P1-17 迁移完成判据、P1-8 配置校验补齐
@@ -0,0 +1,195 @@
+# P1 逐条复审订正与方案计划
+
+> 复审基线:main @ `77f2b948c`(7 个 P0 修复 #5748~#5754 已全部合入)
+> 复审方式:5 组对抗性复审 agent 并行,先怀疑后确认;以 RustFS 自身功能契约为正确性标准,不以"未对齐 MinIO"为根因;RustFS 更优/独特设计标注"保持不变"
+> 参照:MinIO 源码、mc@cf909e1063a9、madmin-go v3.0.109、minio-go v7.0.91
+> 日期:2026-08-06
+
+---
+
+## 〇、复审总裁定表
+
+| 项 | 主题 | 复审结论 | 关键订正 | 工作量 |
+|---|---|---|---|---|
+| P1-1 | ILM expiry 复制语义 | CONFIRMED(范围扩大) | 发送点共 4 处非 1 处;接收端无门禁;修复重心移到接收端 merge | M |
+| P1-3 | 自动跨站元数据 heal | CONFIRMED(范围收窄) | 真实缺口="retry queue 有账本无消费者";不移植 MinIO 全量 heal | M |
+| P1-5 | GET/HEAD 远端 proxy | CONFIRMED | 同步复制模式是已实现的部分缓解(保持不变);proxy 指标语义被出站 HEAD 污染 | L(P0 段 M) |
+| P1-6 | 三类时间戳头收发 | CONFIRMED(缺口扩大) | 实为三段缺失:tagging 无本地写入方 + 不发头 + 接收端无 LWW 合并点 | M |
+| P1-7 | ARN 前缀不互认 | CONFIRMED+(加重) | 新发现 FromStr id/region 互换 bug;madmin ParseARN 硬校验实锤 → 生成侧必须改 | M |
+| P1-8 | 配置校验缺口 + StorageClass | 部分 CONFIRMED | 2MB 子项 REFUTED(MinIO 亦无);StorageClass 属刻意设计成立(MinIO 也不消费 rule 级,target 级 RustFS 已生效)| S |
+| P1-11 | replication-metrics snake_case | CONFIRMED | BucketStats 复用内部 RPC 线格式实锤 → 必须独立响应 DTO | M |
+| P1-12 | replication-reset 响应壳 | CONFIRMED(面缩小) | 致命键仅 5 个(壳 `Targets`≠`target` + 4 个字段名);其余靠 Go 大小写不敏感能对上 | S |
+| P1-13 | mrf/diff 聚合响应 | CONFIRMED(症状加重) | 实际输出**伪数据行**而非空;diff/mrf 数据源均可支撑逐条流 | diff S / mrf M |
+| P1-14 | set-remote-target 请求体 | 原缺口已缓解;**新 CONFIRMED 阻断** | #5754 后 26 字段已全覆盖;但**零值 `expiration` 恒被拒 → mc replicate add 仍 100% 失败**;latency 单位 round-trip 污染 | S(**建议立即修**) |
+| P1-15 | site state RMW 竞争 | CONFIRMED(加重) | hook 路径 enqueue/dequeue 同进程内绕过既有 Mutex → 单节点即可触发 | M-L |
+| P1-16 | 状态机类型双份定义 | CONFIRMED(加重+收窄) | drift 已发生(MrfOpKind 两侧不一致);但 filemeta 侧 worker DTO 是死代码,活跃双份仅 3 个 wire 类型;"抽公共 crate"否决 | S+M |
+| P1-17 | 桶复制逻辑分裂 | CONFIRMED;微文件合并子项 REFUTED | boundary 微文件是棘轮机制的机械接缝(守护脚本按文件名锚定),合并负收益;缺的是完成判据 | M0=S,整体 L |
+| P1-18 | 超长函数 | 行数 CONFIRMED;apply_iam_item 降级 | apply_iam_item 长而不复杂(6 臂 dispatch),不拆降 P2;其余 4 个给纯移动拆分草案 | M |
+| P1-19 | 源→目标版本身份策略 | CONFIRMED(范围收窄) | delete-marker 的"捕获+持久化映射"模式已落地(保持不变);推荐能力探测+显式拒绝而非全量映射 | M |
+| P1-20 | scanner 补偿边界 e2e | CONFIRMED(缺口收窄) | 决策函数单测与 Failed-heal e2e 已存在;缺 existing-object 矩阵与 Replica 防环 e2e;附完整入队真值表 | M |
+| P1-21 | delayed purge 静默丢弃 | CONFIRMED | 映射损坏防护已加固(保持不变);`let _ =` 与无 MRF 通道仍在;附带发现 MRF outcome 恒 false 滞留问题 | M |
+| P1-22 | 桶复制 SSE 能力 | CONFIRMED(前提订正) | SSE-S3 自 #5633 已 fail closed,被 ignore 的 e2e 理由过期(先摘 ignore);SSE-C 缺的是目标侧头摄取 | L(4 阶段) |
+
+**"保持不变"清单(复审确认的 RustFS 更优/刻意设计,不纳入修复)**:per-PUT 即时元数据传播 hook(优于 MinIO 纯周期 heal)、单向推送+stale 守卫收敛模型、delete 走 merge-with-empty(优于 MinIO 整删)、delete-marker 版本映射持久化+损坏拒猜、同步复制模式(partition_by_sync)、能力契约式显式拒绝+`deny_unknown_fields`(字段清单已与 madmin v3.0.109 同步)、StorageClass 显式拒绝非 STANDARD(target 级已真正生效)、replication-check 真实探针写删、响应中的 RustFS 增强字段(ResetBeforeDate/Error/可观测性键,Go 忽略未知键可共存)。
+
+---
+
+## 一、紧急项(建议立即处理)
+
+### ⚡ P1-14 新阻断:零值 `expiration` 拒绝 → mc replicate add 仍 100% 失败
+
+- **证据**:Go `omitempty` 不省略零值 `time.Time`(已用 Go 程序按 madmin 逐字 tag 实测),mc/madmin marshal 恒输出 `"credentials":{"expiration":"0001-01-01T00:00:00Z"}` 与 `"resetBeforeDate":"0001-01-01T00:00:00Z"`;RustFS `handlers/replication.rs:286-291` 对 `expiration.is_some()` 一律 400。#5754 的测试全部用手写 payload(`expiration: None`),未被现网形状打中。
+- **修复(S)**:①`expiration` 改"非 Go 零值时间才拒"(与 `sessionToken` trim-empty 判断对称);②`latency` 请求字段直接忽略(消除 #5754 后纳秒响应 ↔ 毫秒请求的 round-trip 1e6 倍污染);③把"Go 真实 marshal 形状 payload"固化为测试夹具惯例。
+- **红灯测试**:用实测 Go marshal 全形状 body(含零值 expiration/resetBeforeDate/latency{0,0,0}/edge:false/healthCheckDuration:60000000000)打 set-remote-target,期望 200;非零 expiration 仍 400(能力契约保持)。
+
+### ⚡ P1-7 附带 bug:ARN FromStr 字段互换
+
+`arn.rs` Display 输出 `{type}:{region}:{id}:{bucket}`,FromStr 却读 `id=parts[3], region=parts[4]`——id 与 region 互换。当前仅因消费方只用 arn_type 而潜伏。随 P1-7 一并修。
+
+---
+
+## 二、逐项方案计划
+
+### P1-1 ILM expiry 复制语义(M)
+
+**订正后事实**:发送完整 lifecycle XML 的路径 4 处——PUT hook(`bucket_usecase.rs:2177-2180`)、DELETE hook(`:1512-1514`,触发接收端**整删**)、import(`bucket_meta.rs:948-951`)、build_sr_info/bootstrap(`site_replication.rs:4190,2241-2249`);接收端 `apply_bucket_meta_item`(`:7669-7683`)整体覆盖/删除,且**无 `replicate_ilm_expiry` 门禁**。P0 后已有缓解(发送开关、bootstrap 跳过、stale 判定)只解决"发不发/新旧",不解决"发什么/怎么合"。
+
+**方案**:接收端 merge 为主(信任边界),发送端 expiry-only 提取为辅:
+1. 新增纯函数 `extract_expiry_only(cfg)` 与 `merge_expiry_rules(local, incoming)`——语义对齐 MinIO `mergeWithCurrentLCConfig`,两处 RustFS 改进:incoming 一律先剥 transition(防旧端);`None` 走 merge-with-empty 而非整删(**MinIO 整删连本地 transition 一起删是缺陷,不照抄**);
+2. 接收端 lc-config 分支改 读→merge→条件写/删,保留 stale 判定与 incarnation 守卫;补 `replicate_ilm_expiry` 门禁;
+3. 4 个发送点接 `extract_expiry_only`;expiry 判定用 RustFS 口径(含 `del_marker_expiration`)。
+
+**红灯测试**:L1 单测 5 例(提取剥离/合并保留 T/防御剥离/merge-with-empty/import 无 transition);L3 e2e——B 配本地 transition,A PUT expiry → B 两者共存;A DELETE lifecycle → B transition 仍在。
+**兼容**:旧端发完整 XML → 新接收端剥后 merge 正确;新端 expiry-only → 旧接收端仍整覆盖(不劣于现状)。规则按 ID 对齐,`rule-{idx}` 撞名同 MinIO 语义,文档注明。
+
+### P1-3 自动跨站 heal → 改为"retry queue 自动 drain"(M)
+
+**订正后事实**:retry queue 是现成增量账本(失败即入队 `:3243-3262`,持久化于 state,`retry_count` 字段存在)但**全库无消费者**;手动 repair 是本地快照单向推送,收敛方向依赖运维判断。即时 hook + 显式 repair 模型保持不变。
+
+**方案**:
+- 阶段 1(核心):周期任务挂进现有 reconcile ticker,per-event 重发(body 从本地当前元数据重建,复用 `SiteReplicationRepairTask::send`,天然发"当前值"+对端 stale 守卫幂等);指数退避(`retry_count`+上限转 failed);drain 全程包分布式锁去抖(先用 `with_config_object_write_lock` 专用对象,P1-15 落地后并入统一 state store);结构化 tracing 汇总一条。
+- 阶段 2(可选,默认关闭):每 N tick 比对 repair plan token,不同才自动 dry-run→execute。**不移植** MinIO 跨站取最新 pull 语义(各站各自 drain 即双向收敛)。
+
+**红灯测试**:L2——state 带 retry event,调 `drain_site_replication_retry_queue()`(现不存在),fake peer 成功后断言队列清空;退避断言。L3——停 B→A PUT policy 失败入队→起 B→drain 后 B 收到且 SRRetryStats 归零。
+
+### P1-5 GET/HEAD 远端 proxy(L;P0 段 M)
+
+**订正后事实**:`SUFFIX_SOURCE_PROXY_REQUEST` 零消费者;`ProxyMetric` 字段与 admin 汇总通路已就位,但 resyncer 把**出站** HEAD 计入 `head_total` 污染语义;`disable_proxy` 管道存在无人消费;同步复制模式(`partition_by_sync`,`replication_pool.rs:2667-2689`)是部分缓解但不等价(手动 per-target、失败仍 404、不覆盖兜底窗口)。防环头当前仅潜在问题,但 proxy 实现与防环识别**必须同 PR**(否则 RustFS↔RustFS 成环)。
+
+**方案**(P0 段):新增 `replication_proxy_boundary.rs`——`proxy_targets`(version_suspended/入站 proxy 头/disable_proxy 三重 gate)+ `proxy_get/head_to_replication_target`(走现有 TargetClient,range/条件头透传);触发点在 usecase 层 NotFound/VersionNotFound 分支;接收侧 options.rs 解析防环头,出站双前缀发送;`tokio::timeout`(~3s env 可调)、仅 2xx 采纳其余回落本地 404、复用离线标记短路;指标接 `record_replication_proxy` 并纠正 resyncer 计数语义。P1 段:tagging 三操作 proxy(依赖 P1-6)。
+**红灯测试**:e2e 双站断复制链路后从对端 GET/HEAD 应 200(现 404);防环负例(带头请求不转发、计数不增);降级负例(target 全离线时限时 404);disable_proxy 负例。
+
+### P1-6 时间戳头收发(M;三段修复)
+
+**订正后事实**:①`SUFFIX_TAGGING_TIMESTAMP` 全仓无写入方(retention/legalhold 已有双前缀写入);②`PutObjectOptions::header()` 只序列化 4 个内部头,三类时间戳被丢弃,multipart 同;③接收端不解析,且 replica PUT 是 verbatim 覆盖——解析后必须在写盘前与本地版本做 per-类别 LWW 合并才有效;④`AdvancedPutOptions` 默认 `now_utc()` 无法当"未设置"哨兵,需 Option 化。
+
+**方案**:阶段 0——`put/delete_object_tagging` 落 `SUFFIX_TAGGING_TIMESTAMP`(双前缀);阶段 1——新增三个 suffix 常量(对齐 MinIO headers.go:239-243),三字段 Option 化,`header()` 与 multipart 条件序列化;阶段 2——接收端解析(仅授权复制请求)+ PUT 路径 LWW 合并并持久化赢家时间戳(合并仅限三类元数据,不触碰数据与其余元数据,与 verbatim-replica 不变式共存)。
+**红灯测试**:单测 header 双前缀序列化断言/未设置缺席断言;接收端解析单测;e2e active-active tagging 并发收敛(晚者胜,现 main 旧值覆盖新值为红)。
+
+### P1-7 ARN 前缀(M)
+
+**订正后事实**:madmin `ParseARN` 硬校验 `arn:minio:` 前缀 + ID/bucket 非空(v3.0.109 remote-target-commands.go:50-63);mc 爆炸点仅 `replicate update`(fatalIf)与 `replicate ls`(软降级);`replicate add` 把 ARN 当不透明串不受影响——解释了"add 通 update 挂"。RustFS ARN 结构(`type::id:bucket`)与 madmin 兼容,仅 vendor token 障碍;另有 FromStr id/region 互换 bug(见紧急项)。
+
+**方案(推荐路线 A)**:生成侧默认改 `arn:minio:`(留常量可品牌化);解析侧接受双前缀(存量 `arn:rustfs:` 靠双前缀解析 + 现有字符串等值匹配继续工作);修字段序;改 `generate_arn`、`site_replication.rs:6329` 与相关测试断言。混合版本集群前缀不一致靠双前缀解析吸收;不做存量数据前缀归一化改写。
+**红灯测试**:单测 `from_str("arn:minio:replication:us-east-1:depl:bucket")` 成功且 id/region 正确(现双重红灯);round-trip 属性测试;e2e set-remote-target 返回 ARN 可被 madmin 语义解析、预置 `arn:minio:` 目标可 remove。
+
+### P1-8 配置校验(S)
+
+**订正后事实**:2MB 上限 REFUTED(MinIO 亦无显式检查,剔除);StorageClass 已缓解且刻意设计成立——MinIO 自己也不消费 rule 级 `Destination.StorageClass`(复制 PUT 用 target 级 `tgt.StorageClass`),RustFS target 级 storage_class 已真正生效(`bucket_target_sys.rs:1633-1634`),容忍显式 STANDARD 已实现。仍缺:规则数≤1000、≥1 条、Priority 唯一非负、ID≤255、Filter 互斥、Tag×DeleteMarkerReplication 互斥、sameTarget 拒绝。
+
+**方案**:`config.rs` 新增 `validate_replication_config_structure` 纯函数,`bucket_usecase.rs:2418` 接入;StorageClass 保持现状+契约文档化("rule 级请改用 remote target 的 storageclass 字段")。
+**红灯测试**:单测逐格(1001 规则/重复 Priority/256 字符 ID/Filter 并存/Tag+DMR)期望特定错误;e2e aws-sdk 形状 XML 断言 InvalidRequest。
+
+### P1-11 replication-metrics DTO(M)
+
+**订正后事实**:`BucketStats` 走内部 peer RPC 线格式(`rmp_serde::to_vec_named` 字段名入线,node_service.rs:1401 / peer_rest_client.rs:88-104)——**改原结构 serde 名会破坏混合版本集群 RPC,禁止**;必须走 #5754 的响应 DTO 模式(同文件先例 `remote_target_admin_json`)。
+
+**方案**:新增仅 Serialize 的 `MetricsV2Dto{uptime,currStats,queueStats,downtimeInfo}`/`MetricsDto`/`TargetMetricsDto`,显式映射(`q_stat`→`queued`、`bandwidth_limit_bytes_per_sec`→`limitInBits`、failed→TimedErrStats total-only);`queueStats.nodes` 先填本机一条;RustFS 可观测性扩展键保留(Go 忽略未知键,双栖零成本)。
+**红灯测试**:e2e 用镜像 minio-go MetricsV2 tag 的结构反序列化断言 `currStats.completedReplicationSize > 0`(现全零);DTO 键名 snapshot 单测。
+
+### P1-12 replication-reset 响应壳(S)
+
+**订正后事实**:致命键仅 5 个——壳 `Targets`≠`target`、`Status`≠`resyncStatus`、`ReplicatedSize`≠`completedReplicationSize`、`ReplicatedCount`≠`replicationCount`、`FailedSize/FailedCount`≠`failedReplicationSize/failedReplicationCount`;其余(Arn/ResetID/StartTime/...)靠 Go 大小写不敏感能对上;`ResetBeforeDate`/`Error` 是增强字段可保留。响应结构是 router.rs 独立 DTO 无内部复用,改名零风险。
+
+**方案**:纯 serde rename(建议全字段精确对齐 madmin 小写形态),保留增强键+文档标注。
+**红灯测试**:e2e 断言响应含 `target` 数组且 `target[0].resetid` 非空、status 侧 `resyncStatus`/`completedReplicationSize` 键存在。
+
+### P1-13 mrf/diff 流式响应(diff S / mrf M)
+
+**订正后事实**:症状比"输出空"更糟——聚合对象会被 madmin `json.Decoder` 成功解码一次,`mc replicate backlog` 输出一条 object 为空的**伪行**(静默伪数据);路线 A(保持聚合+文档化)无法消除伪行且与 madmin 同 path 无内容协商,**不可行**。数据源评估:diff 已逐条扫描只需去壳;mrf 的 durable backlog(`MrfReplicateEntry` 字段恰好覆盖 `ReplicationMRF` 所需)已可枚举。
+
+**方案(路线 B)**:diff 去壳输出 NDJSON `DiffInfo` 形状(仅 `IsDeleteMarker`/`ReplicationStatus` 需 rename;truncation 信息入日志不入流);mrf 遍历 durable entries 逐条输出 `ReplicationMRF` 形状(nodeName 填本机);聚合响应保留在 `?aggregate=true`(RustFS 扩展,deliberate 注释随迁)。条目量有 `REPLICATION_DIFF_MAX_SCAN` 封顶,内存拼 NDJSON 即可不必真流式。
+**红灯测试**:e2e 制造失败复制后逐行反序列化断言至少一条 `object` 非空(现为伪空行);diff 断言无 `Entries` 壳。
+
+### P1-14 set-remote-target(S,含紧急项)
+
+见"一、紧急项"。另:`deny_unknown_fields` **保留**(推荐)——字段清单已与 madmin v3.0.109 全同步,严格模式+显式清单兼得契约哲学与防静默;代价写进维护清单:"madmin 版本升级时同步字段清单"(加对照 madmin tag 列表的常量测试防漂移)。
+
+### P1-15 site state 统一 store(M-L,两 PR)
+
+**订正后事实**:主 state 有进程内 Mutex(`:347`)但两处不完备——①无分布式锁(多节点 RMW 丢更新);②**retry event enqueue/dequeue 不持锁**(挂在所有 hook 广播路径上,同进程即可丢更新);reload 路径完全无锁(稳态不写盘收窄窗口,迁移期可覆盖并发写)。repair state 的 `with_config_object_write_lock` + no-lock IO 是正确样板(`:1097-1114`);两套归一化的语义差异(JSON-level 容忍畸形 peer)是**有意的**,统一时必须保留。锁序注释 `:346` 可挂靠。
+
+**方案**:PR1——新建 `admin/site_replication_state.rs`:两阶段归一化合一(JSON 宽容清洗→类型化)、`read_state()/update_state(F)`(分布式锁包完整 RMW,锁内禁网络调用与嵌套配置锁)、常量收敛;service reload 接入;迁移 service 侧 5 个归一化测试保语义。PR2——迁移全部 ~30 个 RMW 调用点(含 enqueue/dequeue),**移除**进程内 Mutex(避免双锁新顺序约束);dequeue 热路径保留"先无锁读、命中才进 update_state"两段式;更新锁序注释。每个调用点做重入审查(现有 drop-reacquire 模式保持)。
+**红灯测试**:L2 单进程并发——持锁 RMW(mark_pending_rotation_peer_acked)×绕锁写者(enqueue_retry_event)注入交错,断言最终 state 两者共存(现必丢其一,确定性红灯);L1 归一化等价性测试迁移;L3 双节点并发(nice-to-have)。
+**风险**:盘上格式不变;锁超时从"静默丢更新"变"显式报错",hook 路径保持 warn 不阻断 S3 主路径。
+
+### P1-16 类型对账护栏(S)+ 死代码清理(M)
+
+**订正后事实**:drift 已发生(filemeta 侧 `MrfOpKind` 缺 Metadata/Heal/ExistingObject 三 variant、`MrfReplicateEntry` 缺 force_delete/target_arns)——但 filemeta 侧 8 个 worker DTO 全是**死代码**(零消费者);活跃双份仅 `ReplicationStatusType/VersionPurgeStatusType/ReplicationState` 三个 wire 类型(filemeta 绑 xl.meta 磁盘格式,replication 绑 MRF/resync 持久化格式);boundary 枚举转换 `as_str()` 兜底 `_ => Empty` 会静默降级。"抽公共 leaf crate"否决(两 wire 格式演进节奏不同,迁移规则 #12 本意是所有权独立)。
+
+**方案**:Step 1(S,即刻)——boundary 加对账测试:两侧枚举穷尽 match(新增 variant 即编译失败)+ as_str 双向 round-trip + ReplicationState 全字段往返;Step 2(M)——清理 filemeta 侧 ~600 行死代码 DTO,注意 crates.io semver(先 `#[deprecated]` 一版再删);Step 3(S)——replication 侧注释指向对账测试。
+
+### P1-17 迁移完成判据(M0=S;整体 L)
+
+**订正后事实**:"合并 boundary 微文件"REFUTED——守护脚本按具体文件名锚定每个 boundary,合并要同步改脚本+mod+导入点而功能收益为零;微文件是棘轮机制的机械接缝。唯一可退役:`datatypes.rs`(消费者迁完即删)。README 建议的第一步(event sink/runtime boundary)实际已部分落地,文档滞后。
+
+**方案**:M0(S)文档 PR——完成判据 = Required Contracts 表 "Current dependency to remove" 列清空;终态 = pool/resyncer/state 移入 crates/replication,boundary 随 crate 移动自然消解;更新 split-plan "Proposal only" 状态。M2(M)resyncer 纯决策逻辑下沉;M3(L)trait 稳定后移 worker 运行时(全计划唯一高危段,最后做);M4(S)统一退役 boundary 与守护条目。**不做**批量合并微文件。
+
+### P1-18 超长函数拆分(M;4 个 PR)
+
+**订正后事实**:行数确认(resync_bucket 537 / start_mrf_processor 306 / replicate_all 409 / delete 路径 replicate_object 299 / apply_iam_item 255);`apply_iam_item` **降级 P2 不拆**(6 臂 dispatch,每臂线性短小,拆分违反 "Prefer direct, local code");`replicate_object` 有两个同名体,原清单指 delete 路径 trait impl。
+
+**方案**(每函数独立 PR,纯移动,`git diff --color-moved=dimmed-zebra` 验证):
+1. `resync_bucket`(最优先,三处历史并发 bug 注释所在):acquire_resync_leadership / load_resync_replication_config / spawn workers+collector 三段抽出,并发 bug 注释随代码移动,每个 return 前的 mark_status 逐一保持;
+2. `start_mrf_processor`:抽 `reconstruct_mrf_delete/object` 纯函数(主循环 -150 行,重建逻辑可单测);
+3. `replicate_all` + delete 路径 `replicate_object`:各拆 3-4 个阶段 helper;**明确不合并两函数**(delete-marker 404/405 校验语义是刻意差异)。
+**排序依赖**:先 P1-18 拆分、后 P1-17 M2/M3 迁移(小函数降低搬运风险)。
+
+### P1-19 版本身份策略(M,推荐方案 B)
+
+**订正后事实**:#5752 已合入(PUT/multipart initiate 带 query,RustFS 目标侧也支持);PUT 响应 `x-amz-version-id` 仍被丢弃(`:1891 Ok(_)`);**delete-marker 子案已系统性缓解**——`remove_object` 捕获目标版本号→`target_delete_marker_version_ids` 持久化进 xl.meta(含上限与损坏标记)→延迟 purge 优先用映射、损坏拒猜(**保持不变**);RustFS 无"仅支持 MinIO 目标"契约声明;replication-check 探针已捕获响应版本号但不比对。MinIO 同样丢弃响应版本号(平价),RustFS 已有两点增强。
+
+**方案对比**:A 全量映射持久化(完整但 xl.meta 膨胀、全链路改造,L);**B(推荐)**:契约=仅支持"沿用源版本 ID"的目标,在 replication-check 增加 VersionFidelity phase(探针 PUT 带 versionId query,比对响应版本号)+ `validate_target` 复用同一探测,不镜像则新错误 `BucketRemoteTargetVersionMismatch` 显式拒绝/告警(M);C 混合(无需求支撑)。探针是主动写,进 validate_target 会扩 set-target 副作用面——可先只做 check phase + 运行期首次 PUT 抽查告警。
+**红灯测试**:FakeS3Target 加 `assign_own_version_ids` 开关模拟原生 S3,断言版本删除复制落空(现红)与探测后显式拒绝(修后绿)。
+
+### P1-20 scanner 补偿边界 e2e(M,纯测试)
+
+**订正后事实**:决策函数单测(queue.rs 7 例等)与 scanner 驱动的 Failed-heal e2e(target 断电恢复/源重启重放,FAST_SCANNER_ENV)已存在;真实缺口=无任何"先写对象→后配复制"的 existing-object 用例。完整入队真值表已梳理(见复审记录):Enabled×Empty 补齐、Pending/Failed 恒补(不受 existing 开关影响)、Disabled×Empty 永不补、Replica 恒不补(防环)、null-version 永不入队、reset_id 重置补齐。
+
+**方案**:e2e 矩阵 1-2 个用例(先 PUT 四种来源对象含 Copy/Snowball 产物→后配 Enabled/Disabled 规则→正例 wait_for_replicated_object / 负例 assert_failed_replication_stays_absent_for ≥3 周期,**"永不补齐"是契约必须显式断言**)+ Replica 防环变体 + queue.rs 补 2 格单测;null-version 跳过行为先写"记录现状"断言并注明出处。不改产品代码。
+
+### P1-21 delayed purge 失败处理(M)
+
+**订正后事实**:静默点两处——target client 缺失 `continue` 无日志(`:1673-1675`)、`let _ = remove_object`(`:1693-1700`);5 次循环是等源 marker 消失非重试;purge 调用后无条件 break;MRF 入队接口(`queue_replica_delete_task`,队满自动落盘)同 crate 可用无分层障碍;映射优先/损坏拒猜是已加固项保持不变。**附带发现**(建议单独跟进):`requires_delayed_purge` 恒真使 delete-marker 类 MRF 条目 outcome 恒 false → 重放永远 Missed 保留,可能永久滞留。
+
+**方案**:①purge 函数返回 per-target 成败,失败 warn(带 event 常量)+ metrics,client 缺失同样 warn(S);②循环内失败重试、轮次耗尽入 MRF、入队失败 warn+metric 兜底(S/M);③两层失败注入测试(mock 503 断言重试/状态/MRF;FakeS3Target inject 断言故障清除后最终收敛)(M)。风险:MRF 重放重发 DELETE marker 创建——mtime 幂等,风险低。
+
+### P1-22 SSE 能力(L,4 阶段)
+
+**订正后事实**:fail-closed 由 #5633 引入(`replication_target_boundary.rs:101-174`),普通/Heal/Resync/Multipart 全走同一函数;SSE-C 发送半边已建(内部头→`X-Rustfs-Replication-*` 映射+CRC),**目标侧摄取代码完全缺失**(链路必断,e2e 已钉 FAILED);SSE-S3 契约 e2e 的 `#[ignore]` 理由(backlog#1291 silently drops)已被 #5633 过期;直传托管 SSE 不可行(封存密钥绑本站 KMS),MinIO 是源解密+目标重加密;ecstore 已有 `ObjectEncryptionResolver` trait seam,解密不破分层。
+
+**方案**:阶段 0(S)摘 ignore + 补 encrypted resync/heal e2e 钉全矩阵 fail-closed 现状;阶段 1(M)SSE-C 目标侧头摄取+加密尺寸/CRC(MinIO :1670-1740 参照);阶段 2(M/L)SSE-S3 经 resolver 解密+目标 AES256 重加密(resolver 未注册必须继续 fail closed;multipart 按明文尺寸分片);阶段 3(L)SSE-KMS + key id 随行开关(目标站无同名 key 显式失败,禁止回退 SSE-S3)。过渡期全矩阵维持 fail closed,禁止明文降级。
+
+---
+
+## 三、执行批次建议
+
+| 批次 | 内容 | 性质 |
+|---|---|---|
+| **B0 立即** | P1-14 零值 expiration + latency 忽略(S);P1-7 FromStr 字段互换(并入 P1-7 或先行) | mc 阻断修复 |
+| **B1 小改动高收益** | P1-12 响应壳 rename(S)、P1-13 diff 去壳(S)、P1-8 结构校验(S)、P1-16 Step1 对账测试(S)、P1-17 M0 文档判据(S)、P1-22 阶段 0 摘 ignore(S) | serde/校验/测试护栏 |
+| **B2 数据一致性** | P1-21 purge 失败处理(M)→ P1-20 scanner 矩阵 e2e(M,纯测试)→ P1-19 方案 B 能力探测(M)→ P1-15 state store PR1+PR2(M-L) | 一致性核心 |
+| **B3 互操作补齐** | P1-7 ARN 路线 A(M)、P1-11 MetricsV2 DTO(M)、P1-13 mrf 流(M)、P1-6 时间戳三段(M)、P1-1 ILM merge(M)、P1-3 retry drain(M) | mc/跨站语义 |
+| **B4 大功能与架构** | P1-5 proxy P0 段(M→L)、P1-22 阶段 1-3(L)、P1-18 四函数拆分(M)→ P1-17 M2-M4(L)、P1-16 Step2 死代码(M) | 长期 |
+
+**批内依赖**:P1-6 先于 P1-5 的 tagging proxy;P1-18 先于 P1-17 M2/M3;P1-15 PR1 的锁对象可先供 P1-3 drain 使用。
@@ -116,7 +116,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.11
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.12
 ```

 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command
@@ -163,6 +163,7 @@ docker run -d --name rustfs -p 9000:9000 \
  -e RUSTFS_NOTIFY_WEBHOOK_ENABLE_PRIMARY=on \
  -e RUSTFS_NOTIFY_WEBHOOK_ENDPOINT_PRIMARY=http://<host-ip>:3020/webhook \
  -e RUSTFS_NOTIFY_WEBHOOK_QUEUE_DIR_PRIMARY=/tmp/rustfs-events \
+  -e RUSTFS_OUTBOUND_ALLOW_ORIGINS=http://<host-ip>:3020 \
  rustfs/rustfs:latest
 ```

@@ -171,6 +172,11 @@ Notes:
 - For ARN `arn:rustfs:sqs::primary:webhook`, use instance-scoped env vars with `_PRIMARY`.
 - If queue dir is omitted, default is `/opt/rustfs/events`; ensure it is writable by the container runtime user.
 - `RUSTFS_NOTIFY_WEBHOOK_SKIP_TLS_VERIFY_PRIMARY` defaults to `false`; enabling it skips webhook TLS certificate verification, allows MITM attacks, and emits a startup warning. Prefer `RUSTFS_NOTIFY_WEBHOOK_CLIENT_CA_PRIMARY` for private CAs.
+- Since `1.0.0-beta.11`, webhook endpoints on private or container networks
+  (`Docker Compose service names`, `host.docker.internal`, RFC 1918 addresses) are
+  blocked unless their exact `scheme://host:port` origin is listed in
+  `RUSTFS_OUTBOUND_ALLOW_ORIGINS` (the origin only, without the path). See
+  [Outbound Connection Policy](docs/operations/outbound-connection-policy.md).

 **NOTE**: We recommend reviewing the `docker-compose.yml` file before running. It defines several services including Grafana, Prometheus, and Jaeger, which are helpful for RustFS observability. If you wish to start Redis or Nginx containers, you can specify the corresponding profiles.

@@ -262,7 +268,7 @@ rustfs --help
 2. **Create a Bucket**: Use the console to create a new bucket for your objects.
 3. **Upload Objects**: You can upload files directly through the console or use S3-compatible APIs/clients to interact with your RustFS instance.

-**NOTE**: To access the RustFS instance via `https`, please refer to the [TLS Configuration Docs](https://docs.rustfs.com/integration/tls-configured.html).
+**NOTE**: To access the RustFS instance via `https`, please refer to the [TLS Configuration Docs](https://docs.rustfs.com/integration/tls-configured).

 ### OIDC Roles Claim (Microsoft Entra ID)

@@ -113,7 +113,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.11
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.12
 ```

 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：
@@ -214,7 +214,7 @@ rustfs --help
 2. **创建存储桶**: 使用控制台为您的对象创建一个新的存储桶 (Bucket)。
 3. **上传对象**: 您可以直接通过控制台上传文件，或使用 S3 兼容的 API/客户端与您的 RustFS 实例进行交互。

-**注意**: 如果您希望通过 `https` 访问 RustFS 实例，请参考 [TLS 配置文档](https://docs.rustfs.com/integration/tls-configured.html)。
+**注意**: 如果您希望通过 `https` 访问 RustFS 实例，请参考 [TLS 配置文档](https://docs.rustfs.com/integration/tls-configured)。

 ## 文档

@@ -47,6 +47,9 @@ consts = "consts"
 Hashi = "Hashi"  # HashiCorp
 # Accept alternate spelling used in parser/XML comments.
 unparseable = "unparseable"
+# Disaster-recovery objectives: recovery time and recovery point.
+RTO = "RTO"
+rto = "rto"

 [files]
 extend-exclude = []
@@ -25,14 +25,40 @@ documentation = "https://docs.rs/rustfs-audit/latest/rustfs_audit/"
 keywords = ["audit", "target", "management", "fan-out", "RustFS"]
 categories = ["web-programming", "development-tools", "asynchronous", "api-bindings"]

+[features]
+default = []
+hotpath = [
+    "hotpath/hotpath",
+    "hotpath/tokio",
+    "hotpath/futures",
+    "rustfs-config/hotpath",
+    "rustfs-s3-types/hotpath",
+    "rustfs-targets/hotpath",
+]
+hotpath-alloc = [
+    "hotpath",
+    "hotpath/hotpath-alloc",
+    "rustfs-config/hotpath-alloc",
+    "rustfs-s3-types/hotpath-alloc",
+    "rustfs-targets/hotpath-alloc",
+]
+hotpath-cpu = [
+    "hotpath",
+    "hotpath/hotpath-cpu",
+    "rustfs-config/hotpath-cpu",
+    "rustfs-s3-types/hotpath-cpu",
+    "rustfs-targets/hotpath-cpu",
+]
+
 [dependencies]
+hotpath.workspace = true
 rustfs-targets = { workspace = true }
 rustfs-config = { workspace = true, features = ["audit", "server-config-model"] }
 rustfs-s3-types = { workspace = true }
-chrono = { workspace = true, features = ["serde"] }
 const-str = { workspace = true, features = ["std", "proc"] }
 futures = { workspace = true }
 hashbrown = { workspace = true, features = ["serde", "rayon"] }
+jiff = { workspace = true, features = ["serde"] }
 metrics = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, features = ["raw_value"] }
@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-use chrono::{DateTime, Utc};
 use hashbrown::HashMap;
+use jiff::Timestamp;
 use rustfs_s3_types::EventName;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
@@ -151,8 +151,8 @@ pub struct AuditEntry {
    pub deployment_id: Option<String>,
    #[serde(rename = "siteName", skip_serializing_if = "Option::is_none")]
    pub site_name: Option<String>,
-    #[serde(with = "chrono::serde::ts_milliseconds")]
-    pub time: DateTime<Utc>,
+    #[serde(with = "jiff::fmt::serde::timestamp::millisecond::required")]
+    pub time: Timestamp,
    pub event: EventName,
    #[serde(rename = "type", skip_serializing_if = "Option::is_none")]
    pub entry_type: Option<String>,
@@ -198,7 +198,7 @@ impl AuditEntryBuilder {
    pub fn new(version: impl Into<String>, event: EventName, trigger: impl Into<String>, api: ApiDetails) -> Self {
        Self(AuditEntry {
            version: version.into(),
-            time: Utc::now(),
+            time: Timestamp::now(),
            event,
            trigger: trigger.into(),
            api,
@@ -232,7 +232,7 @@ impl AuditEntryBuilder {
        self
    }

-    pub fn time(mut self, time: DateTime<Utc>) -> Self {
+    pub fn time(mut self, time: Timestamp) -> Self {
        self.0.time = time;
        self
    }
@@ -342,4 +342,23 @@ mod tests {
        assert_eq!(value["requestID"], Value::String("req-audit-123".to_string()));
        assert!(value.get("request_id").is_none(), "historical audit contract must not expose request_id");
    }
+
+    #[test]
+    fn audit_entry_time_serializes_as_epoch_milliseconds() {
+        let entry = AuditEntryBuilder::new(
+            "1",
+            EventName::ObjectCreatedPut,
+            "s3",
+            ApiDetailsBuilder::new()
+                .name("PutObject")
+                .status("OK")
+                .status_code(200)
+                .build(),
+        )
+        .time(Timestamp::from_millisecond(1_711_423_698_870).expect("timestamp should be valid"))
+        .build();
+
+        let value = serde_json::to_value(entry).expect("audit entry should serialize");
+        assert_eq!(value["time"], Value::Number(1_711_423_698_870_i64.into()));
+    }
 }
@@ -97,7 +97,7 @@ async fn test_audit_log_dispatch_performance() {
        return; // Alternatively: assert!(false, "AuditSystem failed to start");
    }

-    use chrono::Utc;
+    use jiff::Timestamp;
    use rustfs_targets::EventName;
    use serde_json::json;
    use std::collections::HashMap;
@@ -136,7 +136,7 @@ async fn test_audit_log_dispatch_performance() {
        version: "1".to_string(),
        deployment_id: Some(format!("test-deployment-{id}")),
        site_name: Some("test-site".to_string()),
-        time: Utc::now(),
+        time: Timestamp::now(),
        event: EventName::ObjectCreatedPut,
        entry_type: Some("object".to_string()),
        trigger: "api".to_string(),
@@ -298,7 +298,7 @@ fn test_performance_requirements() {
    for i in 0..3000 {
        // Simulate event name parsing and processing
        let _event_id = format!("s3:ObjectCreated:Put_{i}");
-        let _timestamp = chrono::Utc::now().to_rfc3339();
+        let _timestamp = jiff::Timestamp::now().to_string();

        // Simulate basic audit entry creation overhead
        let _entry_size = 512; // bytes
@@ -264,7 +264,7 @@ fn create_sample_audit_entry() -> AuditEntry {
 }

 fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {
-    use chrono::Utc;
+    use jiff::Timestamp;
    use rustfs_targets::EventName;
    use serde_json::json;

@@ -301,7 +301,7 @@ fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {
        version: "1".to_string(),
        deployment_id: Some(format!("test-deployment-{id}")),
        site_name: Some("test-site".to_string()),
-        time: Utc::now(),
+        time: Timestamp::now(),
        event: EventName::ObjectCreatedPut,
        entry_type: Some("object".to_string()),
        trigger: "api".to_string(),
@@ -25,7 +25,17 @@ keywords = ["checksum-calculation", "verification", "integrity", "authenticity",
 categories = ["web-programming", "development-tools", "network-programming"]
 documentation = "https://docs.rs/rustfs-checksums/latest/rustfs_checksum/"

+[lints]
+workspace = true
+
+[features]
+default = []
+hotpath = ["hotpath/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 bytes = { workspace = true, features = ["serde"] }
 crc-fast = { workspace = true }
 http = { workspace = true }
@@ -27,7 +27,14 @@ categories = ["web-programming", "development-tools", "data-structures"]
 [lints]
 workspace = true

+[features]
+default = []
+hotpath = ["hotpath/hotpath", "hotpath/tokio"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 tokio = { workspace = true, features = ["fs", "rt-multi-thread"] }
 tonic = { workspace = true, features = ["gzip", "deflate"] }
 uuid = { workspace = true, features = ["v4", "fast-rng", "macro-diagnostics"] }
@@ -356,6 +356,8 @@ pub struct HealChannelRequest {
    pub recursive: Option<bool>,
    /// Whether to dry run
    pub dry_run: Option<bool>,
+    /// Whether to skip namespace locking
+    pub no_lock: Option<bool>,
    /// Timeout in seconds (optional)
    pub timeout_seconds: Option<u64>,
    /// Origin of the request for operational status and queue accounting
@@ -560,6 +562,7 @@ pub fn create_heal_request(
        update_parity: None,
        recursive: None,
        dry_run: None,
+        no_lock: None,
        timeout_seconds: None,
        source: HealRequestSource::Internal,
        disk: None,
@@ -718,6 +721,7 @@ pub async fn send_heal_disk(set_disk_id: String, priority: Option<HealChannelPri
        update_parity: None,
        recursive: None,
        dry_run: None,
+        no_lock: None,
        timeout_seconds: None,
        source: HealRequestSource::AutoHeal,
    };
@@ -10,7 +10,17 @@ description = "Shared concurrency contract types for RustFS - workload admission
 keywords = ["rustfs", "concurrency", "admission", "backpressure", "workers"]
 categories = ["concurrency", "filesystem"]

+[lints]
+workspace = true
+
+[features]
+default = []
+hotpath = ["hotpath/hotpath", "hotpath/tokio", "rustfs-io-core/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc", "rustfs-io-core/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu", "rustfs-io-core/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 # Internal crates
 rustfs-io-core = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
@@ -25,6 +25,7 @@ keywords = ["configuration", "settings", "management", "rustfs", "Minio"]
 categories = ["web-programming", "development-tools", "config"]

 [dependencies]
+hotpath.workspace = true
 const-str = { workspace = true, optional = true, features = ["std", "proc"] }
 serde = { workspace = true, optional = true, features = ["derive"] }
 serde_json = { workspace = true, optional = true, features = ["raw_value"] }
@@ -34,6 +35,9 @@ workspace = true

 [features]
 default = ["constants"]
+hotpath = ["hotpath/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
 audit = ["dep:const-str", "constants"]
 constants = ["dep:const-str"]
 notify = ["dep:const-str", "constants"]
@@ -66,6 +66,10 @@ Current guidance:

 - `RUSTFS_BROWSER_REDIRECT_URL` sets the externally reachable browser origin used for OIDC callback, console success redirect, and logout fallback URLs. Configure it to the public scheme and authority without a path, for example `https://console.example.com`. In load-balancer deployments, keep OIDC authorize and callback requests on the same backend node because the in-flight OIDC `state` is local to the RustFS node.

+## Distributed endpoint locality
+
+- `RUSTFS_LOCAL_ENDPOINT_HOST` identifies this server's host in a distributed `RUSTFS_VOLUMES` topology without resolving every peer during startup. Set it to exactly one host, without a scheme, port, or path. It is accepted only for orchestrated URL topologies and must match at least one endpoint on the RustFS server port; invalid or unmatched values fail startup. Leave it unset to retain DNS-based locality discovery.
+
 ## Scanner environment aliases

 - `RUSTFS_SCANNER_SPEED` (canonical, also accepts `MINIO_SCANNER_SPEED`)
@@ -131,6 +131,10 @@ pub const ENV_RUSTFS_ADDRESS: &str = "RUSTFS_ADDRESS";
 /// Environment variable for server volumes.
 pub const ENV_RUSTFS_VOLUMES: &str = "RUSTFS_VOLUMES";

+/// Environment variable identifying this server's host in distributed endpoint
+/// lists without relying on DNS locality discovery.
+pub const ENV_LOCAL_ENDPOINT_HOST: &str = "RUSTFS_LOCAL_ENDPOINT_HOST";
+
 /// Environment variable to explicitly bypass local physical disk independence checks.
 pub const ENV_UNSAFE_BYPASS_DISK_CHECK: &str = "RUSTFS_UNSAFE_BYPASS_DISK_CHECK";

@@ -226,6 +230,19 @@ pub const ENV_RUSTFS_KMS_ENABLE: &str = "RUSTFS_KMS_ENABLE";
 /// Default value: false
 pub const DEFAULT_KMS_ENABLE: bool = false;

+/// Environment variable enabling per-key KMS authorization on the SSE-KMS data path.
+///
+/// When enabled, an SSE-KMS write additionally requires `kms:GenerateDataKey` and an
+/// SSE-KMS read additionally requires `kms:Decrypt` on the resolved key, evaluated as
+/// the requesting identity. SSE-S3 and SSE-C are unaffected.
+pub const ENV_RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY: &str = "RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY";
+
+/// Default per-key KMS authorization mode for the SSE-KMS data path.
+///
+/// Off for now so deployments whose identity policies only grant s3 actions keep
+/// working; the default flips to on in a later release.
+pub const DEFAULT_KMS_ENFORCE_SSE_KEY_POLICY: bool = false;
+
 /// Environment variable for server KMS backend.
 pub const ENV_RUSTFS_KMS_BACKEND: &str = "RUSTFS_KMS_BACKEND";

@@ -28,6 +28,15 @@ pub const MAX_ADMIN_REQUEST_BODY_SIZE: usize = 1024 * 1024; // 1 MB
 /// Rationale: ZIP archives with hundreds of IAM entities. 10MB allows ~10,000 small configs.
 pub const MAX_IAM_IMPORT_SIZE: usize = 10 * 1024 * 1024; // 10 MB

+/// Maximum total size the members of an IAM import ZIP may expand to (100 MB).
+/// Used for: bounding decompression of `ImportIam` archive members.
+/// Rationale: `MAX_IAM_IMPORT_SIZE` caps the *compressed* upload only. Deflate
+/// reaches ratios far above 100:1, so without a separate budget a 10 MB archive
+/// can expand without bound. 100 MB keeps a 10x headroom over the compressed cap
+/// — ample for legitimate IAM exports, which are small JSON documents — while
+/// keeping the worst case bounded.
+pub const MAX_IAM_IMPORT_EXPANDED_SIZE: u64 = 100 * 1024 * 1024; // 100 MB
+
 /// Maximum size for bucket metadata import operations (100 MB)
 /// Used for: Bucket metadata import containing configurations for many buckets
 /// Rationale: Large deployments may have thousands of buckets with various configs.
@@ -54,3 +63,12 @@ pub const MAX_HEAL_REQUEST_SIZE: usize = 1024 * 1024; // 1 MB
 /// 10MB provides generous headroom for legitimate responses while preventing
 /// memory exhaustion from malicious or misconfigured remote services.
 pub const MAX_S3_CLIENT_RESPONSE_SIZE: usize = 10 * 1024 * 1024; // 10 MB
+
+/// Maximum size for OIDC provider response bodies (1 MB)
+/// Used for: discovery documents, JWKS documents and token endpoint responses
+/// Rationale: a hostile or compromised identity provider must not be able to exhaust
+/// memory through an arbitrarily large or endless response body.
+/// - Discovery documents: typically < 10KB
+/// - JWKS documents: typically < 50KB
+/// - Token responses: typically < 10KB
+pub const MAX_OIDC_RESPONSE_SIZE: usize = 1024 * 1024; // 1 MB
@@ -97,19 +97,96 @@ pub const ENV_INTERNODE_RPC_MAX_MESSAGE_SIZE: &str = "RUSTFS_INTERNODE_RPC_MAX_M
 pub const ENV_INTERNODE_RPC_LARGE_PAYLOAD_WARN_BYTES: &str = "RUSTFS_INTERNODE_RPC_LARGE_PAYLOAD_WARN_BYTES";
 pub const DEFAULT_INTERNODE_RPC_LARGE_PAYLOAD_WARN_BYTES: usize = 8 * 1024 * 1024;

-/// Stop dual-writing the JSON compatibility strings on internode metadata RPCs and send only the
+/// Request stopping the JSON compatibility strings on internode metadata RPCs and sending only the
 /// msgpack `_bin` payloads (grpc-optimization P2-1).
 ///
-/// Defaults to `false` (dual-write, byte-for-byte legacy behavior). This is a rollout lever, not a
-/// wire-format change: it may only be enabled **after** the JSON-fallback counter
-/// (`rustfs_system_network_internode_msgpack_json_fallback_total`) has read zero across a release
-/// window fleet-wide, confirming every peer decodes `_bin` first. Single-env rollback. See
+/// Defaults to `false` (dual-write, byte-for-byte legacy behavior). This is only a request; RustFS
+/// keeps JSON compatibility fields unless [`ENV_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED`] is also
+/// true after the release-window convergence and rollback gates pass. See
 /// `docs/operations/internode-msgpack-json-convergence-runbook.md`.
 pub const ENV_INTERNODE_RPC_MSGPACK_ONLY: &str = "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY";
 pub const DEFAULT_INTERNODE_RPC_MSGPACK_ONLY: bool = false;

-// Compile-time invariant: dual-write by default so the base build is byte-for-byte legacy behavior.
+/// Explicit fleet-wide confirmation gate for [`ENV_INTERNODE_RPC_MSGPACK_ONLY`].
+///
+/// This separate default-off guard prevents a single legacy flag from accidentally emptying JSON
+/// fields in a mixed-version fleet where an older peer still reads the JSON field.
+pub const ENV_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED: &str = "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED";
+pub const DEFAULT_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED: bool = false;
+
+// Compile-time invariants: dual-write by default so the base build is byte-for-byte legacy behavior.
 const _: () = assert!(!DEFAULT_INTERNODE_RPC_MSGPACK_ONLY);
+const _: () = assert!(!DEFAULT_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED);
+
+/// Require target-bound v2 signatures on every internode gRPC request, rejecting the legacy
+/// constant-target fallback instead of accepting it (<https://github.com/rustfs/backlog/issues/1327>).
+///
+/// Defaults to `false` (fail-open): a request without any v2 auth headers keeps authenticating
+/// through the legacy signature, so legacy-only peers survive rolling upgrades with byte-for-byte
+/// the pre-gate acceptance behavior. This is a rollout lever, not a wire-format change: it may only
+/// be enabled **after** the v1-fallback counter
+/// (`rustfs_system_network_internode_signature_v1_fallback_total`) has read zero across a release
+/// window fleet-wide, confirming every peer already sends v2 authentication on every internode gRPC
+/// request. Single-env rollback. Requests that do carry v2 headers are unaffected by this switch:
+/// they are always verified as v2 with no downgrade, strict or not.
+pub const ENV_INTERNODE_RPC_SIGNATURE_STRICT: &str = "RUSTFS_INTERNODE_RPC_SIGNATURE_STRICT";
+pub const DEFAULT_INTERNODE_RPC_SIGNATURE_STRICT: bool = false;
+
+// Compile-time invariant: fail-open by default so legacy-only peers keep authenticating during
+// rolling upgrades until the fleet-wide v1-fallback counter reads zero.
+const _: () = assert!(!DEFAULT_INTERNODE_RPC_SIGNATURE_STRICT);
+
+/// Require a signature-bound canonical body digest on every mutating internode disk RPC
+/// (RenameData, DeleteVersion, DeleteVersions, WriteMetadata, UpdateMetadata, WriteAll, Delete,
+/// DeletePaths, RenameFile, RenamePart, DeleteVolume, MakeVolume, MakeVolumes), rejecting requests
+/// that authenticate without one (<https://github.com/rustfs/backlog/issues/1327>).
+///
+/// Defaults to `false` (fail-open): a mutating request without a body digest keeps authenticating
+/// through the method-bound v2 (or legacy) signature, so peers from releases that predate
+/// body-digest signing survive rolling upgrades unchanged. Requests that do carry a digest are
+/// always verified with no downgrade, strict or not — the digest value is part of the signed v2
+/// scope, so an on-path attacker cannot strip it without invalidating the signature. This is a
+/// rollout lever gated on the body-digest fallback counter
+/// (`rustfs_system_network_internode_body_digest_fallback_total`) reading zero across a release
+/// window fleet-wide. Single-env rollback. It is deliberately separate from
+/// [`ENV_INTERNODE_RPC_SIGNATURE_STRICT`]: the two enforcement flips converge on different
+/// counters and must not gate each other.
+pub const ENV_INTERNODE_RPC_BODY_DIGEST_STRICT: &str = "RUSTFS_INTERNODE_RPC_BODY_DIGEST_STRICT";
+pub const DEFAULT_INTERNODE_RPC_BODY_DIGEST_STRICT: bool = false;
+
+// Compile-time invariant: fail-open by default so digestless peers keep authenticating during
+// rolling upgrades until the fleet-wide body-digest fallback counter reads zero.
+const _: () = assert!(!DEFAULT_INTERNODE_RPC_BODY_DIGEST_STRICT);
+
+/// Require the replay-scoped internode RPC signature after the fleet has converged on it.
+///
+/// The default keeps v1/v2 peers available during a rolling upgrade. Operators may set this only
+/// after `rustfs_system_network_internode_replay_scope_fallback_total` remains zero for a full
+/// release window. The node still accepts a v2-authenticated `Ping` carrying an epoch challenge:
+/// that narrowly scoped bootstrap lets an upgraded client learn the receiving process epoch and
+/// immediately retry with the replay-scoped signature after a peer restart.
+pub const ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT: &str = "RUSTFS_INTERNODE_RPC_REPLAY_SCOPE_STRICT";
+pub const DEFAULT_INTERNODE_RPC_REPLAY_SCOPE_STRICT: bool = false;
+
+// Compile-time invariant: mixed-version clusters must remain available until operators make the
+// observed fallback counter an explicit strictness decision.
+const _: () = assert!(!DEFAULT_INTERNODE_RPC_REPLAY_SCOPE_STRICT);
+
+/// Capacity (distinct nonces) of the process-local internode RPC replay cache that enforces
+/// one-time consumption of authenticated RPC signatures.
+///
+/// The cache retains each nonce for the ~10-minute signature freshness envelope. Once peers use
+/// replay-scoped v3 authentication, every authenticated RPC consumes one entry, so the steady
+/// state holds roughly `authenticated RPC RPS x 601s` entries. The default sustains about 1,700
+/// authenticated RPCs per second (about 120 MiB worst case, allocated only under sustained load);
+/// operators must size it for the node's aggregate peak RPC rate before enabling strict replay
+/// scope. Overflow fails closed — legitimate signed traffic is the only thing that can fill the
+/// cache (replays are rejected before insertion, and an attacker cannot mint valid nonces without
+/// the shared secret) — and increments
+/// `rustfs_system_network_internode_replay_cache_overflow_total`, so a sustained non-zero overflow
+/// counter means this capacity is undersized for the node's peak authenticated RPC rate.
+pub const ENV_INTERNODE_RPC_REPLAY_CACHE_CAPACITY: &str = "RUSTFS_INTERNODE_RPC_REPLAY_CACHE_CAPACITY";
+pub const DEFAULT_INTERNODE_RPC_REPLAY_CACHE_CAPACITY: usize = 1_048_576;

 /// Consecutive-failure threshold after which an internode peer is marked offline (grpc-optimization
 /// P3 observability).
@@ -273,8 +350,36 @@ mod tests {

    #[test]
    fn internode_msgpack_only_env_name_is_stable() {
-        // The dual-write-by-default invariant is asserted at compile time next to the definition.
+        // The dual-write-by-default invariants are asserted at compile time next to the definitions.
        assert_eq!(ENV_INTERNODE_RPC_MSGPACK_ONLY, "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY");
+        assert_eq!(
+            ENV_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED,
+            "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY_FLEET_CONFIRMED"
+        );
+    }
+
+    #[test]
+    fn internode_signature_strict_env_name_is_stable() {
+        // The fail-open default invariant is asserted at compile time next to the definition.
+        assert_eq!(ENV_INTERNODE_RPC_SIGNATURE_STRICT, "RUSTFS_INTERNODE_RPC_SIGNATURE_STRICT");
+    }
+
+    #[test]
+    fn internode_body_digest_strict_env_name_is_stable() {
+        // The fail-open default invariant is asserted at compile time next to the definition.
+        assert_eq!(ENV_INTERNODE_RPC_BODY_DIGEST_STRICT, "RUSTFS_INTERNODE_RPC_BODY_DIGEST_STRICT");
+    }
+
+    #[test]
+    fn internode_replay_scope_strict_env_name_is_stable() {
+        // The fail-open default invariant is asserted at compile time next to the definition.
+        assert_eq!(ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT, "RUSTFS_INTERNODE_RPC_REPLAY_SCOPE_STRICT");
+    }
+
+    #[test]
+    fn internode_replay_cache_capacity_defaults_and_env_name() {
+        assert_eq!(ENV_INTERNODE_RPC_REPLAY_CACHE_CAPACITY, "RUSTFS_INTERNODE_RPC_REPLAY_CACHE_CAPACITY");
+        assert_eq!(DEFAULT_INTERNODE_RPC_REPLAY_CACHE_CAPACITY, 1_048_576);
    }

    #[test]
@@ -116,6 +116,27 @@ pub const ENV_OBJECT_GET_SKIP_BITROT_VERIFY: &str = "RUSTFS_OBJECT_GET_SKIP_BITR
 /// Default: bitrot verification is enabled on GetObject reads (do not skip).
 pub const DEFAULT_OBJECT_GET_SKIP_BITROT_VERIFY: bool = false;

+/// Request writing the complete remote-tier version state into object metadata.
+///
+/// This remains ineffective until
+/// [`ENV_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED`] is also enabled.
+pub const ENV_TIER_REMOTE_VERSION_STATE_WRITE: &str = "RUSTFS_TIER_REMOTE_VERSION_STATE_WRITE";
+pub const DEFAULT_TIER_REMOTE_VERSION_STATE_WRITE: bool = false;
+
+/// Operator-attested fleet-wide confirmation for
+/// [`ENV_TIER_REMOTE_VERSION_STATE_WRITE`].
+///
+/// This flag is an operational contract, not automatic capability discovery.
+/// Operators may enable it only after every node that can write or read
+/// transitioned object metadata supports the remote version-state schema and
+/// semantics. Keeping the confirmation separate makes a single-node request or
+/// a writer whose local opt-in is removed fail closed.
+pub const ENV_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED: &str = "RUSTFS_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED";
+pub const DEFAULT_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED: bool = false;
+
+const _: () = assert!(!DEFAULT_TIER_REMOTE_VERSION_STATE_WRITE);
+const _: () = assert!(!DEFAULT_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED);
+
 // =============================================================================
 // Concurrent Request Fix - Timeout and Backpressure Configuration
 // =============================================================================
@@ -617,3 +638,15 @@ pub const ENV_OBJECT_IO_RANDOM_READAHEAD_DISABLE_CONCURRENCY: &str = "RUSTFS_OBJ

 /// Default read-ahead disable concurrency threshold: 4.
 pub const DEFAULT_OBJECT_IO_RANDOM_READAHEAD_DISABLE_CONCURRENCY: usize = 4;
+
+#[cfg(test)]
+mod remote_version_state_tests {
+    #[test]
+    fn remote_version_state_gate_uses_stable_environment_names() {
+        assert_eq!(super::ENV_TIER_REMOTE_VERSION_STATE_WRITE, "RUSTFS_TIER_REMOTE_VERSION_STATE_WRITE");
+        assert_eq!(
+            super::ENV_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED,
+            "RUSTFS_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED"
+        );
+    }
+}
@@ -14,6 +14,7 @@

 // OIDC configuration field keys (used in KVS)
 pub const OIDC_CONFIG_URL: &str = "config_url";
+pub const OIDC_ISSUER: &str = "issuer";
 pub const OIDC_CLIENT_ID: &str = "client_id";
 pub const OIDC_CLIENT_SECRET: &str = "client_secret";
 pub const OIDC_SCOPES: &str = "scopes";
@@ -33,6 +34,7 @@ pub const OIDC_HIDE_FROM_UI: &str = "hide_from_ui";
 // Environment variable names for OIDC
 pub const ENV_IDENTITY_OPENID_ENABLE: &str = "RUSTFS_IDENTITY_OPENID_ENABLE";
 pub const ENV_IDENTITY_OPENID_CONFIG_URL: &str = "RUSTFS_IDENTITY_OPENID_CONFIG_URL";
+pub const ENV_IDENTITY_OPENID_ISSUER: &str = "RUSTFS_IDENTITY_OPENID_ISSUER";
 pub const ENV_IDENTITY_OPENID_CLIENT_ID: &str = "RUSTFS_IDENTITY_OPENID_CLIENT_ID";
 pub const ENV_IDENTITY_OPENID_CLIENT_SECRET: &str = "RUSTFS_IDENTITY_OPENID_CLIENT_SECRET";
 pub const ENV_IDENTITY_OPENID_SCOPES: &str = "RUSTFS_IDENTITY_OPENID_SCOPES";
@@ -50,9 +52,10 @@ pub const ENV_IDENTITY_OPENID_USERNAME_CLAIM: &str = "RUSTFS_IDENTITY_OPENID_USE
 pub const ENV_IDENTITY_OPENID_HIDE_FROM_UI: &str = "RUSTFS_IDENTITY_OPENID_HIDE_FROM_UI";

 /// List of all environment variable keys for an OIDC provider.
-pub const ENV_IDENTITY_OPENID_KEYS: &[&str; 17] = &[
+pub const ENV_IDENTITY_OPENID_KEYS: &[&str; 18] = &[
    ENV_IDENTITY_OPENID_ENABLE,
    ENV_IDENTITY_OPENID_CONFIG_URL,
+    ENV_IDENTITY_OPENID_ISSUER,
    ENV_IDENTITY_OPENID_CLIENT_ID,
    ENV_IDENTITY_OPENID_CLIENT_SECRET,
    ENV_IDENTITY_OPENID_SCOPES,
@@ -74,6 +77,7 @@ pub const ENV_IDENTITY_OPENID_KEYS: &[&str; 17] = &[
 pub const IDENTITY_OPENID_KEYS: &[&str] = &[
    crate::ENABLE_KEY,
    OIDC_CONFIG_URL,
+    OIDC_ISSUER,
    OIDC_CLIENT_ID,
    OIDC_CLIENT_SECRET,
    OIDC_SCOPES,
@@ -57,6 +57,7 @@ pub const ENV_WEBDAV_CERTS_DIR: &str = "RUSTFS_WEBDAV_CERTS_DIR";
 pub const ENV_WEBDAV_CA_FILE: &str = "RUSTFS_WEBDAV_CA_FILE";
 pub const ENV_WEBDAV_MAX_BODY_SIZE: &str = "RUSTFS_WEBDAV_MAX_BODY_SIZE";
 pub const ENV_WEBDAV_REQUEST_TIMEOUT: &str = "RUSTFS_WEBDAV_REQUEST_TIMEOUT";
+pub const ENV_WEBDAV_MAX_CONNECTIONS: &str = "RUSTFS_WEBDAV_MAX_CONNECTIONS";

 /// Default SFTP server bind address.
 pub const DEFAULT_SFTP_ADDRESS: &str = "0.0.0.0:2222";
@@ -220,12 +220,10 @@ pub const ENV_SCANNER_YIELD_EVERY_N_OBJECTS: &str = "RUSTFS_SCANNER_YIELD_EVERY_
 pub const DEFAULT_SCANNER_IDLE_MODE: bool = true;

 /// Default set scan concurrency budget.
-/// `0` means no additional limit beyond deployment topology.
-pub const DEFAULT_SCANNER_MAX_CONCURRENT_SET_SCANS: usize = 0;
+pub const DEFAULT_SCANNER_MAX_CONCURRENT_SET_SCANS: usize = 4;

 /// Default disk scan concurrency budget.
-/// `0` means no additional limit beyond available disks in the set.
-pub const DEFAULT_SCANNER_MAX_CONCURRENT_DISK_SCANS: usize = 0;
+pub const DEFAULT_SCANNER_MAX_CONCURRENT_DISK_SCANS: usize = 4;

 /// Default object interval for cooperative scanner yields.
 pub const DEFAULT_SCANNER_YIELD_EVERY_N_OBJECTS: u64 = 128;
@@ -142,6 +142,10 @@ pub const DEFAULT_H2_KEEP_ALIVE_TIMEOUT: u64 = 10;
 /// proxy's upstream idle-keepalive, or lower the proxy's keepalive below this
 /// value. Environments that expose RustFS directly to untrusted slow clients and
 /// want tighter slowloris protection can lower it via the env var below.
+///
+/// The same budget bounds the TLS handshake on the listener, so an unauthenticated
+/// peer cannot park an accept task and its socket indefinitely by opening a
+/// connection and then stalling the handshake.
 pub const ENV_HTTP1_HEADER_READ_TIMEOUT: &str = "RUSTFS_HTTP1_HEADER_READ_TIMEOUT";
 pub const DEFAULT_HTTP1_HEADER_READ_TIMEOUT: u64 = 75;

@@ -24,7 +24,14 @@ description = "Credentials management utilities for RustFS, enabling secure hand
 keywords = ["rustfs", "Minio", "credentials", "authentication", "authorization"]
 categories = ["web-programming", "development-tools", "data-structures", "security"]

+[features]
+default = []
+hotpath = ["hotpath/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 base64-simd = { workspace = true }
 hmac = { workspace = true }
 rand = { workspace = true, features = ["serde"] }
@@ -29,6 +29,7 @@ documentation = "https://docs.rs/rustfs-crypto/latest/rustfs_crypto/"
 workspace = true

 [dependencies]
+hotpath.workspace = true
 aes-gcm = { workspace = true, optional = true, features = ["rand_core"] }
 argon2 = { workspace = true, optional = true }
 chacha20poly1305 = { workspace = true, optional = true }
@@ -49,6 +50,9 @@ time = { workspace = true, features = ["parsing", "formatting", "macros", "serde

 [features]
 default = ["crypto", "fips"]
+hotpath = ["hotpath/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
 fips = []
 crypto = [
    "dep:aes-gcm",
@@ -27,9 +27,15 @@ categories = ["data-structures", "filesystem"]
 [lints]
 workspace = true

+[features]
+default = []
+hotpath = ["hotpath/hotpath", "rustfs-filemeta/hotpath"]
+hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc", "rustfs-filemeta/hotpath-alloc"]
+hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu", "rustfs-filemeta/hotpath-cpu"]
+
 [dependencies]
+hotpath.workspace = true
 serde = { workspace = true, features = ["derive"] }
-path-clean = { workspace = true }
 rmp-serde = { workspace = true }
 async-trait = { workspace = true }
 rustfs-filemeta = { workspace = true }
@@ -25,11 +25,60 @@ workspace = true

 [features]
 default = []
+hotpath = [
+    "hotpath/hotpath",
+    "hotpath/tokio",
+    "hotpath/futures",
+    "hotpath/reqwest-0-13",
+    "rustfs-config/hotpath",
+    "rustfs-credentials/hotpath",
+    "rustfs-data-usage/hotpath",
+    "rustfs-ecstore/hotpath",
+    "rustfs-filemeta/hotpath",
+    "rustfs-lock/hotpath",
+    "rustfs-madmin/hotpath",
+    "rustfs-protos/hotpath",
+    "rustfs-rio/hotpath",
+    "rustfs-signer/hotpath",
+    "rustfs-utils/hotpath",
+]
+hotpath-alloc = [
+    "hotpath",
+    "hotpath/hotpath-alloc",
+    "rustfs-config/hotpath-alloc",
+    "rustfs-credentials/hotpath-alloc",
+    "rustfs-data-usage/hotpath-alloc",
+    "rustfs-ecstore/hotpath-alloc",
+    "rustfs-filemeta/hotpath-alloc",
+    "rustfs-lock/hotpath-alloc",
+    "rustfs-madmin/hotpath-alloc",
+    "rustfs-protos/hotpath-alloc",
+    "rustfs-rio/hotpath-alloc",
+    "rustfs-signer/hotpath-alloc",
+    "rustfs-utils/hotpath-alloc",
+]
+hotpath-cpu = [
+    "hotpath",
+    "hotpath/hotpath-cpu",
+    "rustfs-config/hotpath-cpu",
+    "rustfs-credentials/hotpath-cpu",
+    "rustfs-data-usage/hotpath-cpu",
+    "rustfs-ecstore/hotpath-cpu",
+    "rustfs-filemeta/hotpath-cpu",
+    "rustfs-lock/hotpath-cpu",
+    "rustfs-madmin/hotpath-cpu",
+    "rustfs-protos/hotpath-cpu",
+    "rustfs-rio/hotpath-cpu",
+    "rustfs-signer/hotpath-cpu",
+    "rustfs-utils/hotpath-cpu",
+]
 ftps = []
 sftp = []

 [dependencies]
+hotpath.workspace = true
 rustfs-config = { workspace = true, features = ["constants"] }
+rustfs-credentials.workspace = true
 rustfs-ecstore.workspace = true
 rustfs-data-usage.workspace = true
 rustfs-rio.workspace = true
@@ -49,6 +98,7 @@ rustfs-filemeta.workspace = true
 bytes = { workspace = true, features = ["serde"] }
 serial_test = { workspace = true }
 aws-sdk-s3 = { workspace = true, default-features = false, features = ["sigv4a", "default-https-client", "rt-tokio"] }
+aws-sdk-sts = { workspace = true, default-features = false, features = ["default-https-client", "rt-tokio"] }
 aws-config = { workspace = true }
 aws-smithy-http-client = { workspace = true, default-features = false, features = ["rustls-aws-lc"] }
 async-compression = { workspace = true, features = ["tokio", "bzip2", "xz"] }
@@ -68,7 +118,10 @@ walkdir.workspace = true
 base64 = { workspace = true }
 rand = { workspace = true, features = ["serde"] }
 chrono = { workspace = true, features = ["serde"] }
-md5 = { workspace = true }
+hex = { workspace = true }
+md-5 = { workspace = true }
+opentelemetry-proto = { workspace = true }
+prost.workspace = true
 sha2 = { workspace = true }
 astral-tokio-tar = { workspace = true }
 s3s = { workspace = true, features = ["minio"] }
@@ -46,6 +46,45 @@ mod tests {
    use std::time::{Duration, Instant};

    const ADMIN_INFO_PATH: &str = "/rustfs/admin/v3/info";
+    const ADMIN_MANUAL_TRANSITION_BUCKET: &str = "auth-deny-manual-transition";
+    const ADMIN_MANUAL_TRANSITION_PATH: &str =
+        "/rustfs/admin/v3/ilm/transition/run?bucket=auth-deny-manual-transition&maxObjects=1&mode=async";
+
+    fn assert_no_raw_manual_transition_markers(body: &str, context: &str) {
+        assert!(
+            !body.contains("\"marker\"") && !body.contains("\"versionMarker\"") && !body.contains("\"version_marker\""),
+            "{context} must not expose raw manual transition resume markers, body: {body}"
+        );
+    }
+
+    async fn wait_for_terminal_manual_transition_job(
+        env: &RustFSTestEnvironment,
+        status_endpoint: &str,
+    ) -> Result<String, Box<dyn Error + Send + Sync>> {
+        let deadline = Instant::now() + Duration::from_secs(30);
+        loop {
+            let (status, body) =
+                signed_request(&env.url, http::Method::GET, status_endpoint, None, &env.access_key, &env.secret_key).await?;
+            assert_eq!(
+                status,
+                reqwest::StatusCode::OK,
+                "root credential must query manual transition job status, body: {body}"
+            );
+            assert_no_raw_manual_transition_markers(&body, "manual transition status response");
+            let value: serde_json::Value = serde_json::from_str(&body)?;
+            let job_status = value
+                .get("status")
+                .and_then(serde_json::Value::as_str)
+                .ok_or("manual transition job status response must include status")?;
+            if matches!(job_status, "completed" | "partial" | "cancelled" | "failed" | "unknown") {
+                return Ok(body);
+            }
+            if Instant::now() >= deadline {
+                return Err(format!("manual transition job did not reach terminal status within 30s; last={body}").into());
+            }
+            tokio::time::sleep(Duration::from_millis(250)).await;
+        }
+    }

    /// Send a SigV4-signed request to `path` (optionally with a JSON `body`) and
    /// return `(status, body)`. Uses the `UNSIGNED_PAYLOAD` content hash so a
@@ -158,6 +197,130 @@ mod tests {
        Ok(())
    }

+    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
+    async fn non_admin_credential_denied_on_manual_transition_run() -> Result<(), Box<dyn Error + Send + Sync>> {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(vec![]).await?;
+
+        let user_ak = "ilmtransitionlimited";
+        let user_sk = "ilmtransitionlimitedsecret";
+        create_limited_user(&env, user_ak, user_sk).await?;
+        env.create_s3_client()
+            .create_bucket()
+            .bucket(ADMIN_MANUAL_TRANSITION_BUCKET)
+            .send()
+            .await?;
+
+        let (root_status, root_body) = signed_request(
+            &env.url,
+            http::Method::POST,
+            ADMIN_MANUAL_TRANSITION_PATH,
+            None,
+            &env.access_key,
+            &env.secret_key,
+        )
+        .await?;
+        assert_eq!(
+            root_status,
+            reqwest::StatusCode::ACCEPTED,
+            "root credential must reach the manual transition handler, body: {root_body}"
+        );
+        assert!(
+            root_body.contains("\"mode\":\"durable_job\""),
+            "root response should be the durable manual transition JSON contract, body: {root_body}"
+        );
+        assert_no_raw_manual_transition_markers(&root_body, "manual transition run response");
+        let root_value: serde_json::Value = serde_json::from_str(&root_body)?;
+        let job_id = root_value
+            .get("job_id")
+            .and_then(serde_json::Value::as_str)
+            .ok_or("manual transition async response must include job_id")?;
+        let status_endpoint = root_value
+            .get("status_endpoint")
+            .and_then(serde_json::Value::as_str)
+            .ok_or("manual transition async response must include status_endpoint")?;
+        let cancel_endpoint = root_value
+            .get("cancel_endpoint")
+            .and_then(serde_json::Value::as_str)
+            .ok_or("manual transition async response must include cancel_endpoint")?;
+        assert_eq!(
+            cancel_endpoint, status_endpoint,
+            "manual transition durable jobs currently use the same status/cancel endpoint"
+        );
+        assert!(
+            status_endpoint.ends_with(job_id),
+            "status endpoint must address the returned job id, job_id={job_id}, status_endpoint={status_endpoint}"
+        );
+
+        let terminal_body = wait_for_terminal_manual_transition_job(&env, status_endpoint).await?;
+        let terminal: serde_json::Value = serde_json::from_str(&terminal_body)?;
+        assert_eq!(terminal.get("job_id").and_then(serde_json::Value::as_str), Some(job_id));
+        assert_eq!(
+            terminal
+                .get("report")
+                .and_then(|report| report.get("bucket"))
+                .and_then(serde_json::Value::as_str),
+            Some(ADMIN_MANUAL_TRANSITION_BUCKET)
+        );
+
+        let (root_status, root_body) =
+            signed_request(&env.url, http::Method::DELETE, status_endpoint, None, &env.access_key, &env.secret_key).await?;
+        assert_eq!(
+            root_status,
+            reqwest::StatusCode::OK,
+            "root credential must cancel/query a terminal manual transition job idempotently, body: {root_body}"
+        );
+        assert_no_raw_manual_transition_markers(&root_body, "manual transition cancel response");
+        let root_cancel: serde_json::Value = serde_json::from_str(&root_body)?;
+        assert_eq!(root_cancel.get("job_id").and_then(serde_json::Value::as_str), Some(job_id));
+        assert!(
+            matches!(
+                root_cancel.get("status").and_then(serde_json::Value::as_str),
+                Some("completed" | "partial" | "failed" | "unknown")
+            ),
+            "terminal cancel must not rewrite the job into cancelled state, body: {root_body}"
+        );
+
+        let (status, body) =
+            signed_request(&env.url, http::Method::POST, ADMIN_MANUAL_TRANSITION_PATH, None, user_ak, user_sk).await?;
+        assert_eq!(
+            status,
+            reqwest::StatusCode::FORBIDDEN,
+            "non-admin credential must get 403 on manual transition run, body: {body}"
+        );
+        assert!(
+            body.contains("AccessDenied"),
+            "manual transition rejection must carry the AccessDenied S3 error code, body: {body}"
+        );
+        let (status, body) = signed_request(&env.url, http::Method::GET, status_endpoint, None, user_ak, user_sk).await?;
+        assert_eq!(
+            status,
+            reqwest::StatusCode::FORBIDDEN,
+            "non-admin credential must get 403 on manual transition status, body: {body}"
+        );
+        assert_no_raw_manual_transition_markers(&body, "manual transition status rejection");
+        assert!(
+            body.contains("AccessDenied"),
+            "manual transition status rejection must carry the AccessDenied S3 error code, body: {body}"
+        );
+        let (status, body) = signed_request(&env.url, http::Method::DELETE, status_endpoint, None, user_ak, user_sk).await?;
+        assert_eq!(
+            status,
+            reqwest::StatusCode::FORBIDDEN,
+            "non-admin credential must get 403 on manual transition cancel, body: {body}"
+        );
+        assert_no_raw_manual_transition_markers(&body, "manual transition cancel rejection");
+        assert!(
+            body.contains("AccessDenied"),
+            "manual transition cancel rejection must carry the AccessDenied S3 error code, body: {body}"
+        );
+
+        env.stop_server();
+        Ok(())
+    }
+
    /// Rotating the root credentials (restart with new `--access-key` /
    /// `--secret-key` on the same data directory) takes effect: the new
    /// credential is accepted and the old one is rejected, on both the S3 data
@@ -26,75 +26,16 @@
 //! Later batches tracked on backlog#1154: config get/set, info, pools status,
 //! group lifecycle, import/export IAM.

-use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
+use crate::common::{RustFSTestEnvironment, admin_ok, admin_request, init_logging};
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::{Client, Config};
-use http::header::{CONTENT_TYPE, HOST};
 use reqwest::StatusCode;
-use rustfs_signer::constants::UNSIGNED_PAYLOAD;
-use rustfs_signer::sign_v4;
-use s3s::Body;
 use serial_test::serial;
 use std::error::Error;
 use tokio::time::{Duration, sleep};

 type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
-type BoxError = Box<dyn Error + Send + Sync>;
-
-/// Signs and sends an admin HTTP request with the given credential, returning
-/// status and body. Native `/rustfs/admin/v3` requests and responses are plain
-/// JSON (the MinIO-compat encryption applies only to `/minio/admin/v3` paths).
-async fn admin_request(
-    base_url: &str,
-    method: http::Method,
-    path_and_query: &str,
-    body: Option<String>,
-    access_key: &str,
-    secret_key: &str,
-) -> Result<(StatusCode, String), BoxError> {
-    let url = format!("{base_url}{path_and_query}");
-    let uri = url.parse::<http::Uri>()?;
-    let authority = uri.authority().ok_or("admin URL missing authority")?.to_string();
-    let mut builder = http::Request::builder()
-        .method(method.clone())
-        .uri(uri)
-        .header(HOST, authority)
-        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
-    if body.is_some() {
-        builder = builder.header(CONTENT_TYPE, "application/json");
-    }
-
-    let content_len = body.as_ref().map(|b| b.len() as i64).unwrap_or_default();
-    let signed = sign_v4(builder.body(Body::empty())?, content_len, access_key, secret_key, "", "us-east-1");
-
-    let reqwest_method = reqwest::Method::from_bytes(method.as_str().as_bytes())?;
-    let mut request = local_http_client().request(reqwest_method, &url);
-    for (name, value) in signed.headers() {
-        request = request.header(name, value);
-    }
-    if let Some(body) = body {
-        request = request.body(body);
-    }
-    let response = request.send().await?;
-    let status = response.status();
-    let text = response.text().await.unwrap_or_default();
-    Ok((status, text))
-}
-
-/// Root-credential admin request that must succeed; returns the response body.
-async fn admin_ok(
-    env: &RustFSTestEnvironment,
-    method: http::Method,
-    path_and_query: &str,
-    body: Option<String>,
-) -> Result<String, BoxError> {
-    let (status, text) = admin_request(&env.url, method.clone(), path_and_query, body, &env.access_key, &env.secret_key).await?;
-    if !status.is_success() {
-        return Err(format!("{method} {path_and_query} failed: {status} {text}").into());
-    }
-    Ok(text)
-}

 fn build_s3_client(url: &str, access_key: &str, secret_key: &str) -> Client {
    let config = Config::builder()
@@ -170,3 +170,81 @@ async fn test_anonymous_access_allowed_when_restrict_public_buckets_disabled()
    info!("Test passed: anonymous access allowed with RestrictPublicBuckets=false");
    Ok(())
 }
+
+/// A policy granting anonymous `s3:ListBucket` also permits ListObjectVersions.
+/// That grant must still be subject to RestrictPublicBuckets: the versions listing
+/// reaches authorization through a fallback branch, and that branch has to apply the
+/// same public-access gate as a direct grant.
+#[tokio::test]
+#[serial]
+async fn ghsa_x298_anonymous_list_object_versions_denied_when_restrict_public_buckets_enabled()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+    info!("Starting test: anonymous ListObjectVersions denied with RestrictPublicBuckets=true...");
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket_name = "anon-test-restrict-versions";
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket_name).send().await?;
+
+    let policy_json = serde_json::json!({
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "AllowAnonymousListBucket",
+                "Effect": "Allow",
+                "Principal": "*",
+                "Action": ["s3:ListBucket"],
+                "Resource": [format!("arn:aws:s3:::{}", bucket_name)]
+            }
+        ]
+    })
+    .to_string();
+
+    admin_client
+        .put_bucket_policy()
+        .bucket(bucket_name)
+        .policy(&policy_json)
+        .send()
+        .await?;
+
+    admin_client
+        .put_object()
+        .bucket(bucket_name)
+        .key("test.txt")
+        .body(aws_sdk_s3::primitives::ByteStream::from_static(b"hello anonymous"))
+        .send()
+        .await?;
+
+    // Without the public-access block the fallback grant is expected to work.
+    let versions_url = format!("{}/{}?versions=", env.url, bucket_name);
+    let resp = local_http_client().get(&versions_url).send().await?;
+    assert_eq!(
+        resp.status().as_u16(),
+        200,
+        "Anonymous ListObjectVersions should succeed via the s3:ListBucket grant"
+    );
+
+    admin_client
+        .put_public_access_block()
+        .bucket(bucket_name)
+        .public_access_block_configuration(
+            PublicAccessBlockConfiguration::builder()
+                .restrict_public_buckets(true)
+                .build(),
+        )
+        .send()
+        .await?;
+
+    let resp = local_http_client().get(&versions_url).send().await?;
+    assert_eq!(
+        resp.status().as_u16(),
+        403,
+        "Anonymous ListObjectVersions must be denied when RestrictPublicBuckets is true"
+    );
+
+    info!("Test passed: anonymous ListObjectVersions denied with RestrictPublicBuckets=true");
+    Ok(())
+}
@@ -0,0 +1,259 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Regression tests for bucket statistics and data usage accuracy.
+//!
+//! Covers the recurring pattern where bucket statistics (object count, size)
+//! show stale/incorrect values, remain at 0, or oscillate between complete,
+//! partial, and zero. This has regressed 10+ times.
+//!
+//! ## Regression Issues
+//!
+//! - rustfs#5615: bucket statistics remain unchanged after data expiration
+//! - rustfs#5008: Admin usage reports only one pool
+//! - rustfs#5116: Admin usage reports stale 0/0 for non-empty bucket after upgrade
+//! - rustfs#5055: console object count and size still loading
+//! - rustfs#5010: Storage usage info changed abnormally
+//! - rustfs#3662: Incorrect bucket, object count and size
+//! - rustfs#3898: DataUsageInfo undercounts versioned bucket versions
+//! - rustfs#1012: Object count in the console doesn't change
+
+#[cfg(test)]
+mod tests {
+    use crate::common::{RustFSTestEnvironment, awscurl_get, init_logging};
+    use aws_sdk_s3::primitives::ByteStream;
+    use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use rustfs_data_usage::DataUsageInfo;
+    use serial_test::serial;
+    use std::error::Error;
+    use tokio::time::{Duration, sleep};
+    use tracing::info;
+
+    type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+
+    async fn get_data_usage(env: &RustFSTestEnvironment) -> Result<DataUsageInfo, Box<dyn Error + Send + Sync>> {
+        let url = format!("{}/rustfs/admin/v3/datausageinfo", env.url);
+        let resp = awscurl_get(&url, &env.access_key, &env.secret_key).await?;
+        Ok(serde_json::from_str(&resp)?)
+    }
+
+    /// RT-09: Verify bucket object count updates after PUT.
+    ///
+    /// Regression pattern: bucket stats remain at 0 after objects are uploaded
+    /// (rustfs#5055, rustfs#1012).
+    ///
+    /// Steps:
+    /// 1. Create a bucket
+    /// 2. Upload 10 objects
+    /// 3. Query admin data usage API
+    /// 4. Verify object count > 0
+    #[tokio::test]
+    #[serial]
+    async fn test_bucket_object_count_updates_after_put() -> TestResult {
+        init_logging();
+        info!("RT-09: bucket object count updates after PUT");
+
+        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
+            .await
+            .expect("start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "rt09-stats-put";
+
+        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
+
+        // Upload 10 objects
+        for i in 0..10 {
+            client
+                .put_object()
+                .bucket(bucket)
+                .key(format!("stat-obj-{i:04}.txt"))
+                .body(ByteStream::from_static(b"statistical data"))
+                .send()
+                .await
+                .expect("put object");
+        }
+
+        // Wait for scanner to process (up to 90 seconds)
+        let mut found_nonzero = false;
+        for attempt in 0..18 {
+            sleep(Duration::from_secs(5)).await;
+
+            if let Ok(usage) = get_data_usage(&env).await
+                && let Some(bucket_usage) = usage.buckets_usage.get(bucket)
+            {
+                info!("  attempt {attempt}: objectsCount = {}", bucket_usage.objects_count);
+                if bucket_usage.objects_count >= 10 {
+                    found_nonzero = true;
+                    break;
+                }
+            }
+        }
+
+        assert!(
+            found_nonzero,
+            "RT-09 FAIL: bucket object count did not update after PUT 10 objects (regression: stats stuck at 0)"
+        );
+
+        info!("RT-09 PASS: bucket object count updates after PUT");
+        Ok(())
+    }
+
+    /// RT-09b: Verify bucket stats update after DELETE.
+    ///
+    /// Regression pattern: stats remain unchanged after objects are deleted
+    /// (rustfs#5615).
+    #[tokio::test]
+    #[serial]
+    async fn test_bucket_object_count_updates_after_delete() -> TestResult {
+        init_logging();
+        info!("RT-09b: bucket object count updates after DELETE");
+
+        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
+            .await
+            .expect("start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "rt09b-stats-delete";
+
+        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
+
+        // Upload 5 objects
+        for i in 0..5 {
+            client
+                .put_object()
+                .bucket(bucket)
+                .key(format!("del-stat-{i}.txt"))
+                .body(ByteStream::from_static(b"data"))
+                .send()
+                .await
+                .expect("put object");
+        }
+
+        // Delete all objects
+        for i in 0..5 {
+            client
+                .delete_object()
+                .bucket(bucket)
+                .key(format!("del-stat-{i}.txt"))
+                .send()
+                .await
+                .expect("delete object");
+        }
+
+        // Wait for scanner to update stats (up to 90 seconds)
+        let mut found_zero = false;
+        for attempt in 0..18 {
+            sleep(Duration::from_secs(5)).await;
+
+            if let Ok(usage) = get_data_usage(&env).await
+                && let Some(bucket_usage) = usage.buckets_usage.get(bucket)
+            {
+                info!("  attempt {attempt}: objectsCount = {}", bucket_usage.objects_count);
+                if bucket_usage.objects_count == 0 {
+                    found_zero = true;
+                    break;
+                }
+            }
+        }
+
+        assert!(
+            found_zero,
+            "RT-09b FAIL: bucket object count did not update to 0 after deleting all objects (regression rustfs#5615)"
+        );
+
+        info!("RT-09b PASS: bucket object count updates to 0 after DELETE");
+        Ok(())
+    }
+
+    /// RT-09c: Verify versioned bucket stats count all versions.
+    ///
+    /// Regression pattern: DataUsageInfo undercounts versioned bucket versions
+    /// and delete markers (rustfs#3898).
+    #[tokio::test]
+    #[serial]
+    async fn test_versioned_bucket_stats_count_all_versions() -> TestResult {
+        init_logging();
+        info!("RT-09c: versioned bucket stats count all versions");
+
+        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
+            .await
+            .expect("start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "rt09c-versioned-stats";
+
+        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
+
+        client
+            .put_bucket_versioning()
+            .bucket(bucket)
+            .versioning_configuration(
+                VersioningConfiguration::builder()
+                    .status(BucketVersioningStatus::Enabled)
+                    .build(),
+            )
+            .send()
+            .await
+            .expect("enable versioning");
+
+        // Create 3 versions of the same object
+        for i in 0..3 {
+            client
+                .put_object()
+                .bucket(bucket)
+                .key("multi-version.txt")
+                .body(ByteStream::from(format!("version-{i}").into_bytes()))
+                .send()
+                .await
+                .expect("put version");
+        }
+
+        // Create a delete marker
+        client
+            .delete_object()
+            .bucket(bucket)
+            .key("multi-version.txt")
+            .send()
+            .await
+            .expect("create delete marker");
+
+        // Verify versions via API (immediate, no scanner wait)
+        let versions = client
+            .list_object_versions()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("list versions");
+
+        assert_eq!(
+            versions.versions().len(),
+            3,
+            "RT-09c FAIL: expected 3 versions, found {}",
+            versions.versions().len()
+        );
+        assert_eq!(
+            versions.delete_markers().len(),
+            1,
+            "RT-09c FAIL: expected 1 delete marker, found {}",
+            versions.delete_markers().len()
+        );
+
+        info!("RT-09c PASS: versioned bucket correctly tracks all versions and delete markers");
+        Ok(())
+    }
+}
@@ -24,9 +24,10 @@ mod tests {
    use aws_sdk_s3::types::{ChecksumAlgorithm, ChecksumMode, CompletedMultipartUpload, CompletedPart};
    use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
    use base64::Engine;
+    use md5::{Digest as Md5Digest, Md5};
    use rustfs_rio::{Checksum, ChecksumType as RioChecksumType};
    use serial_test::serial;
-    use sha2::{Digest, Sha256};
+    use sha2::Sha256;
    use tracing::info;

    fn create_s3_client(env: &RustFSTestEnvironment) -> Client {
@@ -70,7 +71,9 @@ mod tests {
    }

    fn content_md5_base64(body: &[u8]) -> String {
-        let digest = md5::compute(body);
+        let mut hasher = Md5::new();
+        hasher.update(body);
+        let digest = hasher.finalize();
        base64::engine::general_purpose::STANDARD.encode(digest.as_slice())
    }

@@ -24,7 +24,12 @@
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::{Client, Config};
 use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
+use http::header::{CONTENT_TYPE, HOST};
 use reqwest::Client as HttpClient;
+use reqwest::StatusCode;
+use rustfs_signer::constants::UNSIGNED_PAYLOAD;
+use rustfs_signer::sign_v4;
+use s3s::Body;
 use std::ffi::OsStr;
 use std::fs as stdfs;
 use std::path::{Path, PathBuf};
@@ -45,6 +50,21 @@ pub const ENV_RUSTFS_BUILD_FEATURES: &str = "RUSTFS_BUILD_FEATURES";
 pub const TEST_BUCKET: &str = "e2e-test-bucket";
 const RUSTFS_FULL_FEATURE: &str = "full";

+fn capture_log_path(log_dir: &Path, temp_dir: &str) -> Option<PathBuf> {
+    let temp_name = Path::new(temp_dir).file_name()?.to_string_lossy();
+    Some(log_dir.join(format!("{temp_name}.log")))
+}
+
+fn configured_capture_log_path(temp_dir: &str) -> Option<String> {
+    let log_dir = std::env::var_os("RUSTFS_E2E_LOG_DIR")?;
+    if stdfs::create_dir_all(&log_dir).is_err() {
+        warn!(?log_dir, "failed to create configured E2E server log directory");
+        return None;
+    }
+
+    capture_log_path(Path::new(&log_dir), temp_dir).map(|path| path.to_string_lossy().into_owned())
+}
+
 fn build_test_s3_config(endpoint_url: &str, access_key: &str, secret_key: &str, provider_name: &'static str) -> Config {
    let credentials = Credentials::new(access_key, secret_key, None, None, provider_name);
    let mut config = Config::builder()
@@ -75,6 +95,58 @@ pub fn local_http_client() -> HttpClient {
        .expect("failed to build local reqwest client")
 }

+/// Signs and sends an admin HTTP request with the given credentials.
+pub(crate) async fn admin_request(
+    base_url: &str,
+    method: http::Method,
+    path_and_query: &str,
+    body: Option<String>,
+    access_key: &str,
+    secret_key: &str,
+) -> Result<(StatusCode, String), Box<dyn std::error::Error + Send + Sync>> {
+    let url = format!("{base_url}{path_and_query}");
+    let uri = url.parse::<http::Uri>()?;
+    let authority = uri.authority().ok_or("admin URL missing authority")?.to_string();
+    let mut request = http::Request::builder()
+        .method(method.clone())
+        .uri(uri)
+        .header(HOST, authority)
+        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
+    if body.is_some() {
+        request = request.header(CONTENT_TYPE, "application/json");
+    }
+
+    let content_length = i64::try_from(body.as_ref().map_or(0, String::len)).map_err(|_| "admin request body is too large")?;
+    let signed = sign_v4(request.body(Body::empty())?, content_length, access_key, secret_key, "", "us-east-1");
+
+    let mut request = local_http_client().request(method, &url);
+    for (name, value) in signed.headers() {
+        request = request.header(name, value);
+    }
+    if let Some(body) = body {
+        request = request.body(body);
+    }
+    let response = request.send().await?;
+    let status = response.status();
+    let body = response.text().await?;
+    Ok((status, body))
+}
+
+/// Sends a root-credential admin request and returns its successful response body.
+pub(crate) async fn admin_ok(
+    env: &RustFSTestEnvironment,
+    method: http::Method,
+    path_and_query: &str,
+    body: Option<String>,
+) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+    let (status, response_body) =
+        admin_request(&env.url, method.clone(), path_and_query, body, &env.access_key, &env.secret_key).await?;
+    if !status.is_success() {
+        return Err(format!("{method} {path_and_query} failed: {status} {response_body}").into());
+    }
+    Ok(response_body)
+}
+
 /// Resolve the RustFS binary relative to the workspace.
 pub fn rustfs_binary_path() -> PathBuf {
    rustfs_binary_path_with_features(requested_rustfs_build_features().as_deref())
@@ -304,6 +376,7 @@ impl RustFSTestEnvironment {
    pub async fn new() -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
        let temp_dir = format!("/tmp/rustfs_e2e_test_{}", Uuid::new_v4());
        fs::create_dir_all(&temp_dir).await?;
+        let capture_log_path = configured_capture_log_path(&temp_dir);

        // Use a unique port for each test environment
        let port = Self::find_available_port().await?;
@@ -317,7 +390,7 @@ impl RustFSTestEnvironment {
            access_key: DEFAULT_ACCESS_KEY.to_string(),
            secret_key: DEFAULT_SECRET_KEY.to_string(),
            process: None,
-            capture_log_path: None,
+            capture_log_path,
        })
    }

@@ -325,6 +398,7 @@ impl RustFSTestEnvironment {
    pub async fn with_address(address: &str) -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
        let temp_dir = format!("/tmp/rustfs_e2e_test_{}", Uuid::new_v4());
        fs::create_dir_all(&temp_dir).await?;
+        let capture_log_path = configured_capture_log_path(&temp_dir);

        let url = format!("http://{address}");

@@ -335,7 +409,7 @@ impl RustFSTestEnvironment {
            access_key: DEFAULT_ACCESS_KEY.to_string(),
            secret_key: DEFAULT_SECRET_KEY.to_string(),
            process: None,
-            capture_log_path: None,
+            capture_log_path,
        })
    }

@@ -892,6 +966,7 @@ pub struct RustFSTestClusterEnvironment {
    pub access_key: String,
    pub secret_key: String,
    pub extra_env: Vec<(String, String)>,
+    pub node_extra_env: Vec<Vec<(String, String)>>,
    pub topology: ClusterTopology,
 }

@@ -990,6 +1065,7 @@ impl RustFSTestClusterEnvironment {
            access_key: "rustfs-cluster-test-access".to_string(),
            secret_key: "rustfs-cluster-test-secret".to_string(),
            extra_env,
+            node_extra_env: vec![Vec::new(); topology.node_count],
            topology,
        })
    }
@@ -1003,6 +1079,22 @@ impl RustFSTestClusterEnvironment {
        self.extra_env.push((key.into(), value.into()));
    }

+    /// Add an extra environment variable applied to a single cluster node.
+    pub fn set_node_env<K, V>(
+        &mut self,
+        node_idx: usize,
+        key: K,
+        value: V,
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>>
+    where
+        K: Into<String>,
+        V: Into<String>,
+    {
+        self.ensure_node_index(node_idx)?;
+        self.node_extra_env[node_idx].push((key.into(), value.into()));
+        Ok(())
+    }
+
    fn ensure_node_index(&self, node_idx: usize) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        if node_idx >= self.nodes.len() {
            return Err(format!("node_idx {node_idx} is invalid").into());
@@ -1089,6 +1181,9 @@ impl RustFSTestClusterEnvironment {
            for (key, value) in &self.extra_env {
                command.env(key, value);
            }
+            for (key, value) in &self.node_extra_env[i] {
+                command.env(key, value);
+            }

            let process = command.current_dir(&node.data_dir).spawn()?;

@@ -1130,6 +1225,9 @@ impl RustFSTestClusterEnvironment {
        for (key, value) in &self.extra_env {
            command.env(key, value);
        }
+        for (key, value) in &self.node_extra_env[node_idx] {
+            command.env(key, value);
+        }

        let process = command.current_dir(&node.data_dir).spawn()?;
        node.process = Some(process);
@@ -1311,6 +1409,14 @@ mod tests {
        assert_eq!(normalize_rustfs_build_features(" , "), None);
    }

+    #[test]
+    fn capture_log_path_uses_temp_directory_basename() {
+        assert_eq!(
+            capture_log_path(Path::new("/tmp/e2e-logs"), "/tmp/rustfs_e2e_test_abc"),
+            Some(PathBuf::from("/tmp/e2e-logs/rustfs_e2e_test_abc.log"))
+        );
+    }
+
    #[test]
    fn full_feature_enables_any_required_feature() {
        assert!(rustfs_build_feature_enabled(Some("full"), "sftp"));
@@ -1371,6 +1477,7 @@ mod tests {
            access_key: DEFAULT_ACCESS_KEY.to_string(),
            secret_key: DEFAULT_SECRET_KEY.to_string(),
            extra_env: Vec::new(),
+            node_extra_env: vec![Vec::new(); topology.node_count],
            topology,
        }
    }
@@ -1455,4 +1562,24 @@ mod tests {
        assert!(ClusterTopology::single_pool_multidrive(4, 4).validate().is_ok());
        assert!(ClusterTopology::single_pool_multidrive(1, 1).validate().is_ok());
    }
+
+    #[test]
+    fn cluster_node_env_supports_per_node_overrides() {
+        let mut env = fake_cluster(ClusterTopology::single_pool(4));
+        env.set_node_env(2, "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY", "true").unwrap();
+        assert_eq!(
+            env.node_extra_env[2].as_slice(),
+            [("RUSTFS_INTERNODE_RPC_MSGPACK_ONLY".to_string(), "true".to_string())]
+        );
+    }
+
+    #[test]
+    fn cluster_node_env_rejects_invalid_index() {
+        let mut env = fake_cluster(ClusterTopology::single_pool(4));
+        let err = env
+            .set_node_env(4, "RUSTFS_INTERNODE_RPC_MSGPACK_ONLY", "true")
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("invalid"), "unexpected error: {err}");
+    }
 }
@@ -80,6 +80,25 @@ mod tests {
        assert_eq!(head_resp.content_encoding(), Some("zstd"), "HEAD should return Content-Encoding: zstd");
        assert_eq!(head_resp.content_type(), Some("text/plain"), "HEAD should return correct Content-Type");

+        client
+            .delete_object()
+            .bucket(bucket)
+            .key(key)
+            .send()
+            .await
+            .expect("DELETE object failed");
+        client
+            .delete_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("DELETE bucket failed");
+        client
+            .list_buckets()
+            .send()
+            .await
+            .expect("RustFS must remain available after deleting a bucket");
+
        env.stop_server();
    }

@@ -12,18 +12,24 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-//! Regression test for Issue #4996: CopyObject must return the destination object's
-//! checksum in `CopyObjectResult` and persist it so a later checksum-mode HEAD/GET
-//! returns the same value. Covers both the requested-algorithm case (compute fresh)
-//! and the no-algorithm case (preserve the source object's existing checksum).
+//! CopyObject checksum compatibility tests. Covers all supported algorithms,
+//! source-checksum preservation, explicit override, and fail-closed handling of
+//! unsupported algorithms before destination mutation.

 #[cfg(test)]
 mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
+    use aws_sdk_s3::config::{Credentials, Region, RequestChecksumCalculation};
+    use aws_sdk_s3::error::ProvideErrorMetadata;
    use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::{BucketVersioningStatus, ChecksumAlgorithm, ChecksumMode, VersioningConfiguration};
+    use aws_sdk_s3::types::{
+        BucketVersioningStatus, ChecksumAlgorithm, ChecksumMode, ChecksumType, CompletedMultipartUpload, CompletedPart,
+        VersioningConfiguration,
+    };
+    use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
    use base64::Engine as _;
    use base64::engine::general_purpose::STANDARD as BASE64;
+    use rustfs_rio::{Checksum, ChecksumType as RioChecksumType};
    use serial_test::serial;
    use sha2::{Digest, Sha256};
    use tracing::info;
@@ -48,6 +54,401 @@ mod tests {
            .expect("Failed to enable versioning");
    }

+    fn create_s3_client_no_auto_checksum(env: &RustFSTestEnvironment) -> aws_sdk_s3::Client {
+        let credentials = Credentials::new(&env.access_key, &env.secret_key, None, None, "copy-checksum-e2e");
+        let config = aws_sdk_s3::Config::builder()
+            .credentials_provider(credentials)
+            .region(Region::new("us-east-1"))
+            .endpoint_url(format!("http://{}", env.address))
+            .force_path_style(true)
+            .behavior_version_latest()
+            .request_checksum_calculation(RequestChecksumCalculation::WhenRequired)
+            .http_client(SmithyHttpClientBuilder::new().build_http())
+            .build();
+        aws_sdk_s3::Client::from_conf(config)
+    }
+
+    fn algorithms() -> [(ChecksumAlgorithm, RioChecksumType); 10] {
+        [
+            (ChecksumAlgorithm::Crc32, RioChecksumType::CRC32),
+            (ChecksumAlgorithm::Crc32C, RioChecksumType::CRC32C),
+            (ChecksumAlgorithm::Crc64Nvme, RioChecksumType::CRC64_NVME),
+            (ChecksumAlgorithm::Sha1, RioChecksumType::SHA1),
+            (ChecksumAlgorithm::Sha256, RioChecksumType::SHA256),
+            (ChecksumAlgorithm::Md5, RioChecksumType::MD5),
+            (ChecksumAlgorithm::Sha512, RioChecksumType::SHA512),
+            (ChecksumAlgorithm::Xxhash3, RioChecksumType::XXHASH3),
+            (ChecksumAlgorithm::Xxhash64, RioChecksumType::XXHASH64),
+            (ChecksumAlgorithm::Xxhash128, RioChecksumType::XXHASH128),
+        ]
+    }
+
+    fn result_checksums(result: &aws_sdk_s3::types::CopyObjectResult) -> [Option<&str>; 10] {
+        [
+            result.checksum_crc32(),
+            result.checksum_crc32_c(),
+            result.checksum_crc64_nvme(),
+            result.checksum_sha1(),
+            result.checksum_sha256(),
+            result.checksum_md5(),
+            result.checksum_sha512(),
+            result.checksum_xxhash3(),
+            result.checksum_xxhash64(),
+            result.checksum_xxhash128(),
+        ]
+    }
+
+    fn head_checksums(output: &aws_sdk_s3::operation::head_object::HeadObjectOutput) -> [Option<&str>; 10] {
+        [
+            output.checksum_crc32(),
+            output.checksum_crc32_c(),
+            output.checksum_crc64_nvme(),
+            output.checksum_sha1(),
+            output.checksum_sha256(),
+            output.checksum_md5(),
+            output.checksum_sha512(),
+            output.checksum_xxhash3(),
+            output.checksum_xxhash64(),
+            output.checksum_xxhash128(),
+        ]
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn test_copy_supports_all_checksum_algorithms() {
+        init_logging();
+
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = create_s3_client_no_auto_checksum(&env);
+        let src_bucket = "copy-all-checksums-src";
+        let dst_bucket = "copy-all-checksums-dst";
+        let src_key = "objects/source.bin";
+        let content = b"deterministic CopyObject payload for all ten checksum algorithms";
+
+        create_versioned_bucket(&client, src_bucket).await;
+        create_versioned_bucket(&client, dst_bucket).await;
+        client
+            .put_object()
+            .bucket(src_bucket)
+            .key(src_key)
+            .body(ByteStream::from_static(content))
+            .send()
+            .await
+            .expect("PUT source failed");
+
+        for (index, (sdk_algorithm, rio_algorithm)) in algorithms().into_iter().enumerate() {
+            let expected = Checksum::new_from_data(rio_algorithm, content)
+                .expect("supported checksum must be computable")
+                .encoded;
+            let dst_key = format!("objects/destination-{index}.bin");
+            let copy = client
+                .copy_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .copy_source(format!("{src_bucket}/{src_key}"))
+                .checksum_algorithm(sdk_algorithm)
+                .send()
+                .await
+                .expect("CopyObject with supported checksum must succeed");
+            let result = copy.copy_object_result().expect("CopyObject result");
+            let checksums = result_checksums(result);
+            assert_eq!(checksums[index], Some(expected.as_str()), "{rio_algorithm}: response checksum");
+            assert_eq!(
+                checksums.iter().filter(|checksum| checksum.is_some()).count(),
+                1,
+                "{rio_algorithm}: only the requested checksum may be returned"
+            );
+
+            let head = client
+                .head_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .checksum_mode(ChecksumMode::Enabled)
+                .send()
+                .await
+                .expect("HEAD destination failed");
+            let checksums = head_checksums(&head);
+            assert_eq!(checksums[index], Some(expected.as_str()), "{rio_algorithm}: persisted checksum");
+            assert_eq!(
+                checksums.iter().filter(|checksum| checksum.is_some()).count(),
+                1,
+                "{rio_algorithm}: destination must persist only the requested checksum"
+            );
+
+            let body = client
+                .get_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .send()
+                .await
+                .expect("GET destination failed")
+                .body
+                .collect()
+                .await
+                .expect("collect destination body")
+                .into_bytes();
+            assert_eq!(body.as_ref(), content, "{rio_algorithm}: full copied body");
+        }
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn test_copy_without_algorithm_preserves_every_supported_source_checksum() {
+        init_logging();
+
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = create_s3_client_no_auto_checksum(&env);
+        let src_bucket = "copy-preserve-all-src";
+        let dst_bucket = "copy-preserve-all-dst";
+        let content = b"source checksum preservation payload for all ten algorithms";
+
+        create_versioned_bucket(&client, src_bucket).await;
+        create_versioned_bucket(&client, dst_bucket).await;
+
+        for (index, (_sdk_algorithm, rio_algorithm)) in algorithms().into_iter().enumerate() {
+            let expected = Checksum::new_from_data(rio_algorithm, content)
+                .expect("supported checksum must be computable")
+                .encoded;
+            let checksum_header = rio_algorithm.key().expect("supported checksum header");
+            let request_checksum = expected.clone();
+            let src_key = format!("objects/source-{index}.bin");
+            let dst_key = format!("objects/destination-{index}.bin");
+            client
+                .put_object()
+                .bucket(src_bucket)
+                .key(&src_key)
+                .body(ByteStream::from_static(content))
+                .customize()
+                .mutate_request(move |request| {
+                    request.headers_mut().insert(checksum_header, request_checksum.clone());
+                })
+                .send()
+                .await
+                .expect("PUT checksummed source failed");
+
+            let copy = client
+                .copy_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .copy_source(format!("{src_bucket}/{src_key}"))
+                .send()
+                .await
+                .expect("CopyObject without algorithm must succeed");
+            let result = copy.copy_object_result().expect("CopyObject result");
+            let checksums = result_checksums(result);
+            assert_eq!(checksums[index], Some(expected.as_str()), "{rio_algorithm}: preserved response checksum");
+            assert_eq!(checksums.iter().filter(|checksum| checksum.is_some()).count(), 1);
+
+            let head = client
+                .head_object()
+                .bucket(dst_bucket)
+                .key(&dst_key)
+                .checksum_mode(ChecksumMode::Enabled)
+                .send()
+                .await
+                .expect("HEAD destination failed");
+            let checksums = head_checksums(&head);
+            assert_eq!(checksums[index], Some(expected.as_str()), "{rio_algorithm}: preserved stored checksum");
+            assert_eq!(checksums.iter().filter(|checksum| checksum.is_some()).count(), 1);
+        }
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn test_copy_without_algorithm_preserves_composite_checksum_type() {
+        init_logging();
+
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = create_s3_client_no_auto_checksum(&env);
+        let bucket = "copy-preserve-composite";
+        let source_key = "objects/multipart-source.bin";
+        let destination_key = "objects/copied-multipart.bin";
+        let content = b"multipart source checksum must remain composite";
+
+        create_versioned_bucket(&client, bucket).await;
+        let created = client
+            .create_multipart_upload()
+            .bucket(bucket)
+            .key(source_key)
+            .checksum_algorithm(ChecksumAlgorithm::Sha256)
+            .send()
+            .await
+            .expect("CreateMultipartUpload failed");
+        let upload_id = created.upload_id().expect("multipart upload ID");
+        let checksum = Checksum::new_from_data(RioChecksumType::SHA256, content)
+            .expect("SHA256 checksum")
+            .encoded;
+        let uploaded = client
+            .upload_part()
+            .bucket(bucket)
+            .key(source_key)
+            .upload_id(upload_id)
+            .part_number(1)
+            .checksum_sha256(&checksum)
+            .body(ByteStream::from_static(content))
+            .send()
+            .await
+            .expect("UploadPart failed");
+        let completed_part = CompletedPart::builder()
+            .part_number(1)
+            .e_tag(uploaded.e_tag().expect("part ETag"))
+            .checksum_sha256(uploaded.checksum_sha256().expect("part checksum"))
+            .build();
+        client
+            .complete_multipart_upload()
+            .bucket(bucket)
+            .key(source_key)
+            .upload_id(upload_id)
+            .multipart_upload(CompletedMultipartUpload::builder().parts(completed_part).build())
+            .send()
+            .await
+            .expect("CompleteMultipartUpload failed");
+
+        let source_head = client
+            .head_object()
+            .bucket(bucket)
+            .key(source_key)
+            .checksum_mode(ChecksumMode::Enabled)
+            .send()
+            .await
+            .expect("HEAD multipart source failed");
+        let source_checksum = source_head.checksum_sha256().expect("multipart source checksum");
+        assert_eq!(source_head.checksum_type(), Some(&ChecksumType::Composite));
+
+        let copied = client
+            .copy_object()
+            .bucket(bucket)
+            .key(destination_key)
+            .copy_source(format!("{bucket}/{source_key}"))
+            .send()
+            .await
+            .expect("CopyObject without algorithm failed");
+        let result = copied.copy_object_result().expect("CopyObject result");
+        assert_eq!(result.checksum_sha256(), Some(source_checksum));
+        assert_eq!(result.checksum_type(), Some(&ChecksumType::Composite));
+
+        let destination_head = client
+            .head_object()
+            .bucket(bucket)
+            .key(destination_key)
+            .checksum_mode(ChecksumMode::Enabled)
+            .send()
+            .await
+            .expect("HEAD copied multipart object failed");
+        assert_eq!(destination_head.checksum_sha256(), Some(source_checksum));
+        assert_eq!(destination_head.checksum_type(), Some(&ChecksumType::Composite));
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn test_copy_rejects_unknown_algorithm_without_destination_mutation() {
+        init_logging();
+
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-reject-unknown-checksum";
+        let src_key = "objects/source.bin";
+        let dst_key = "objects/destination.bin";
+        let source = b"source must never replace destination";
+        let destination = b"pre-existing destination must remain byte-for-byte unchanged";
+        let expected = Checksum::new_from_data(RioChecksumType::SHA256, destination)
+            .expect("SHA256 checksum")
+            .encoded;
+
+        create_versioned_bucket(&client, bucket).await;
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(src_key)
+            .body(ByteStream::from_static(source))
+            .send()
+            .await
+            .expect("PUT source failed");
+        let original = client
+            .put_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .metadata("state", "original")
+            .checksum_algorithm(ChecksumAlgorithm::Sha256)
+            .body(ByteStream::from_static(destination))
+            .send()
+            .await
+            .expect("PUT destination failed");
+        let original_version = original.version_id().expect("versioned PUT must return a version id");
+
+        let missing_source_error = client
+            .copy_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .copy_source(format!("{bucket}/objects/missing-source.bin"))
+            .checksum_algorithm(ChecksumAlgorithm::from("BLAKE3"))
+            .send()
+            .await
+            .expect_err("checksum validation must precede source lookup");
+        assert_eq!(
+            missing_source_error.as_service_error().and_then(|value| value.code()),
+            Some("InvalidArgument")
+        );
+        assert_eq!(missing_source_error.raw_response().map(|response| response.status().as_u16()), Some(400));
+
+        let error = client
+            .copy_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .copy_source(format!("{bucket}/{src_key}"))
+            .checksum_algorithm(ChecksumAlgorithm::from("BLAKE3"))
+            .send()
+            .await
+            .expect_err("unsupported checksum algorithm must fail");
+        assert_eq!(error.as_service_error().and_then(|value| value.code()), Some("InvalidArgument"));
+        assert_eq!(error.raw_response().map(|response| response.status().as_u16()), Some(400));
+
+        let head = client
+            .head_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .checksum_mode(ChecksumMode::Enabled)
+            .send()
+            .await
+            .expect("HEAD unchanged destination");
+        assert_eq!(head.version_id(), Some(original_version));
+        assert_eq!(
+            head.metadata().and_then(|metadata| metadata.get("state").map(String::as_str)),
+            Some("original")
+        );
+        assert_eq!(head.checksum_sha256(), Some(expected.as_str()));
+
+        let body = client
+            .get_object()
+            .bucket(bucket)
+            .key(dst_key)
+            .send()
+            .await
+            .expect("GET unchanged destination")
+            .body
+            .collect()
+            .await
+            .expect("collect unchanged destination")
+            .into_bytes();
+        assert_eq!(body.as_ref(), destination);
+
+        env.stop_server();
+    }
+
    /// Requested algorithm: a CopyObject asking for SHA256 must compute it over the copied
    /// bytes, return it in `CopyObjectResult.ChecksumSHA256`, and persist it so a checksum-mode
    /// HEAD on the destination returns the identical value.
@@ -17,14 +17,17 @@
 #[cfg(test)]
 mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
-    use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::MetadataDirective;
+    use aws_sdk_s3::error::ProvideErrorMetadata;
+    use aws_sdk_s3::primitives::{ByteStream, DateTime, DateTimeFormat};
+    use aws_sdk_s3::types::{
+        BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, MetadataDirective, StorageClass, VersioningConfiguration,
+    };
    use serial_test::serial;
    use tracing::info;

    #[tokio::test]
    #[serial]
-    async fn test_self_copy_replace_metadata_preserves_readable_object() {
+    async fn copy_object_standard_metadata_copy_replace_and_clear() {
        init_logging();
        info!("Issue #2789: self-copy metadata replacement must preserve object data");

@@ -35,6 +38,14 @@ mod tests {
        let bucket = "self-copy-metadata-replace-test";
        let key = "assets/chunk-2F3R7JUG.js";
        let content = b"console.log('metadata replacement should keep object data readable');";
+        let source_expires = DateTime::from_secs(1_893_456_000);
+        let source_expires_http_date = source_expires
+            .fmt(DateTimeFormat::HttpDate)
+            .expect("Test timestamp should format as an HTTP date");
+        let replacement_expires = DateTime::from_secs(1_924_992_000);
+        let replacement_expires_http_date = replacement_expires
+            .fmt(DateTimeFormat::HttpDate)
+            .expect("Test timestamp should format as an HTTP date");

        client
            .create_bucket()
@@ -47,7 +58,14 @@ mod tests {
            .put_object()
            .bucket(bucket)
            .key(key)
+            .cache_control("max-age=60")
+            .content_disposition("inline; filename=source.js")
+            .content_encoding("br")
+            .content_language("en-US")
            .content_type("text/javascript; charset=utf-8")
+            .expires(source_expires)
+            .website_redirect_location("/source.html")
+            .storage_class(StorageClass::ReducedRedundancy)
            .metadata("mtime", "1777992333")
            .metadata("stale", "must-be-removed")
            .body(ByteStream::from_static(content))
@@ -55,13 +73,137 @@ mod tests {
            .await
            .expect("PUT failed");

+        let copied_key = "assets/default-copy.js";
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key(copied_key)
+            .copy_source(format!("{bucket}/{key}"))
+            .send()
+            .await
+            .expect("default CopyObject failed");
+
+        let copied_head = client
+            .head_object()
+            .bucket(bucket)
+            .key(copied_key)
+            .send()
+            .await
+            .expect("HEAD failed after default copy");
+        assert_eq!(copied_head.cache_control(), Some("max-age=60"));
+        assert_eq!(copied_head.content_disposition(), Some("inline; filename=source.js"));
+        assert_eq!(copied_head.content_encoding(), Some("br"));
+        assert_eq!(copied_head.content_language(), Some("en-US"));
+        assert_eq!(copied_head.content_type(), Some("text/javascript; charset=utf-8"));
+        assert_eq!(copied_head.expires_string(), Some(source_expires_http_date.as_str()));
+        assert_eq!(
+            copied_head.storage_class(),
+            None,
+            "CopyObject without a storage class should write STANDARD"
+        );
+        assert_eq!(
+            copied_head.website_redirect_location(),
+            Some("/source.html"),
+            "default CopyObject should preserve source metadata"
+        );
+        assert_eq!(
+            copied_head.metadata().and_then(|metadata| metadata.get("stale")),
+            Some(&"must-be-removed".to_string())
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("assets/explicit-copy.js")
+            .copy_source(format!("{bucket}/{key}"))
+            .metadata_directive(MetadataDirective::Copy)
+            .customize()
+            .mutate_request(|request| {
+                request.headers_mut().insert("content-type", "application/octet-stream");
+                request.headers_mut().insert("x-amz-meta-request-only", "ignored");
+            })
+            .send()
+            .await
+            .expect("explicit COPY directive with request metadata failed");
+        let explicit_copy_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("assets/explicit-copy.js")
+            .send()
+            .await
+            .expect("HEAD failed after explicit COPY");
+        assert_eq!(explicit_copy_head.cache_control(), Some("max-age=60"));
+        assert_eq!(explicit_copy_head.content_type(), Some("text/javascript; charset=utf-8"));
+        assert_eq!(
+            explicit_copy_head.metadata().and_then(|metadata| metadata.get("mtime")),
+            Some(&"1777992333".to_string())
+        );
+        assert_eq!(
+            explicit_copy_head
+                .metadata()
+                .and_then(|metadata| metadata.get("request-only")),
+            None,
+            "COPY must ignore request metadata"
+        );
+        assert_eq!(
+            explicit_copy_head.website_redirect_location(),
+            None,
+            "explicit COPY does not inherit website redirect metadata"
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("assets/explicit-copy-redirect.js")
+            .copy_source(format!("{bucket}/{key}"))
+            .metadata_directive(MetadataDirective::Copy)
+            .website_redirect_location("/explicit-copy.html")
+            .send()
+            .await
+            .expect("explicit COPY with redirect failed");
+        let explicit_redirect_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("assets/explicit-copy-redirect.js")
+            .send()
+            .await
+            .expect("HEAD failed after explicit COPY with redirect");
+        assert_eq!(explicit_redirect_head.website_redirect_location(), Some("/explicit-copy.html"));
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("assets/explicit-storage-class.js")
+            .copy_source(format!("{bucket}/{key}"))
+            .storage_class(StorageClass::ReducedRedundancy)
+            .send()
+            .await
+            .expect("CopyObject with an explicit storage class failed");
+        let explicit_storage_class_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("assets/explicit-storage-class.js")
+            .send()
+            .await
+            .expect("HEAD failed after explicit storage class copy");
+        assert_eq!(
+            explicit_storage_class_head.storage_class().map(StorageClass::as_str),
+            Some("REDUCED_REDUNDANCY")
+        );
+
        client
            .copy_object()
            .bucket(bucket)
            .key(key)
            .copy_source(format!("{bucket}/{key}"))
            .metadata_directive(MetadataDirective::Replace)
-            .content_type("text/javascript; charset=utf-8")
+            .cache_control("no-cache")
+            .content_disposition("attachment; filename=replaced.js")
+            .content_encoding("gzip")
+            .content_language("fr-FR")
+            .content_type("application/javascript")
+            .expires(replacement_expires)
+            .website_redirect_location("/replaced.html")
            .metadata("mtime", "1777992348")
            .send()
            .await
@@ -85,6 +227,14 @@ mod tests {
            None,
            "HEAD should not return metadata omitted by REPLACE"
        );
+        assert_eq!(head_resp.cache_control(), Some("no-cache"));
+        assert_eq!(head_resp.content_disposition(), Some("attachment; filename=replaced.js"));
+        assert_eq!(head_resp.content_encoding(), Some("gzip"));
+        assert_eq!(head_resp.content_language(), Some("fr-FR"));
+        assert_eq!(head_resp.content_type(), Some("application/javascript"));
+        assert_eq!(head_resp.expires_string(), Some(replacement_expires_http_date.as_str()));
+        assert_eq!(head_resp.website_redirect_location(), Some("/replaced.html"));
+        assert_eq!(head_resp.storage_class(), None, "REPLACE without a storage class should write STANDARD");

        let get_resp = client
            .get_object()
@@ -123,6 +273,13 @@ mod tests {
            None,
            "HEAD should not return metadata omitted by empty REPLACE"
        );
+        assert_eq!(empty_head_resp.cache_control(), None);
+        assert_eq!(empty_head_resp.content_disposition(), None);
+        assert_eq!(empty_head_resp.content_encoding(), None);
+        assert_eq!(empty_head_resp.content_language(), None);
+        assert_eq!(empty_head_resp.content_type(), None);
+        assert_eq!(empty_head_resp.expires_string(), None);
+        assert_eq!(empty_head_resp.website_redirect_location(), None);

        let empty_get_resp = client
            .get_object()
@@ -141,4 +298,319 @@ mod tests {

        env.stop_server();
    }
+
+    #[tokio::test]
+    #[serial]
+    async fn copy_object_replace_accepts_each_standard_field_independently() {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-object-metadata-fields";
+        let source = "source.txt";
+        client
+            .create_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("Failed to create bucket");
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(source)
+            .cache_control("source-cache")
+            .content_disposition("inline")
+            .content_encoding("br")
+            .content_language("en")
+            .content_type("text/source")
+            .expires(DateTime::from_secs(1_893_456_000))
+            .body(ByteStream::from_static(b"field-by-field"))
+            .send()
+            .await
+            .expect("PUT failed");
+        let replacement_expires = DateTime::from_secs(1_924_992_000);
+        let replacement_expires_http_date = replacement_expires
+            .fmt(DateTimeFormat::HttpDate)
+            .expect("Test timestamp should format as an HTTP date");
+
+        for field in [
+            "cache-control",
+            "content-disposition",
+            "content-encoding",
+            "content-language",
+            "content-type",
+            "expires",
+            "website-redirect",
+        ] {
+            let destination = format!("{field}.txt");
+            let request = client
+                .copy_object()
+                .bucket(bucket)
+                .key(&destination)
+                .copy_source(format!("{bucket}/{source}"))
+                .metadata_directive(MetadataDirective::Replace);
+            let request = match field {
+                "cache-control" => request.cache_control("field-cache"),
+                "content-disposition" => request.content_disposition("attachment"),
+                "content-encoding" => request.content_encoding("gzip"),
+                "content-language" => request.content_language("de"),
+                "content-type" => request.content_type("text/field"),
+                "expires" => request.expires(replacement_expires),
+                "website-redirect" => request.website_redirect_location("/field.html"),
+                _ => unreachable!("field table contains only supported entries"),
+            };
+            request.send().await.expect("field-specific CopyObject failed");
+
+            let head = client
+                .head_object()
+                .bucket(bucket)
+                .key(&destination)
+                .send()
+                .await
+                .expect("HEAD failed");
+            assert_eq!(head.cache_control(), (field == "cache-control").then_some("field-cache"));
+            assert_eq!(head.content_disposition(), (field == "content-disposition").then_some("attachment"));
+            assert_eq!(head.content_encoding(), (field == "content-encoding").then_some("gzip"));
+            assert_eq!(head.content_language(), (field == "content-language").then_some("de"));
+            assert_eq!(head.content_type(), (field == "content-type").then_some("text/field"));
+            assert_eq!(
+                head.expires_string(),
+                (field == "expires").then_some(replacement_expires_http_date.as_str())
+            );
+            assert_eq!(head.website_redirect_location(), (field == "website-redirect").then_some("/field.html"));
+        }
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("user-metadata-collision.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .metadata("content-type", "user-content-type")
+            .metadata("content-encoding", "user-content-encoding")
+            .send()
+            .await
+            .expect("CopyObject should preserve user metadata namespaces");
+        let collision_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("user-metadata-collision.txt")
+            .send()
+            .await
+            .expect("HEAD failed for metadata collision case");
+        assert_eq!(collision_head.content_type(), None);
+        assert_eq!(collision_head.content_encoding(), None);
+        assert_eq!(
+            collision_head.metadata().and_then(|metadata| metadata.get("content-type")),
+            Some(&"user-content-type".to_string())
+        );
+        assert_eq!(
+            collision_head
+                .metadata()
+                .and_then(|metadata| metadata.get("content-encoding")),
+            Some(&"user-content-encoding".to_string())
+        );
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn copy_object_replace_handles_versioned_multipart_source() {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-object-metadata-multipart";
+        let source = "source.bin";
+        let multipart_body = b"multipart historical source";
+        client
+            .create_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("Failed to create bucket");
+        client
+            .put_bucket_versioning()
+            .bucket(bucket)
+            .versioning_configuration(
+                VersioningConfiguration::builder()
+                    .status(BucketVersioningStatus::Enabled)
+                    .build(),
+            )
+            .send()
+            .await
+            .expect("Failed to enable versioning");
+
+        let upload = client
+            .create_multipart_upload()
+            .bucket(bucket)
+            .key(source)
+            .content_type("application/source")
+            .send()
+            .await
+            .expect("Failed to create multipart upload");
+        let upload_id = upload.upload_id().expect("Multipart upload should return an ID");
+        let part = client
+            .upload_part()
+            .bucket(bucket)
+            .key(source)
+            .upload_id(upload_id)
+            .part_number(1)
+            .body(ByteStream::from_static(multipart_body))
+            .send()
+            .await
+            .expect("Failed to upload multipart part");
+        let completed = client
+            .complete_multipart_upload()
+            .bucket(bucket)
+            .key(source)
+            .upload_id(upload_id)
+            .multipart_upload(
+                CompletedMultipartUpload::builder()
+                    .parts(
+                        CompletedPart::builder()
+                            .part_number(1)
+                            .e_tag(part.e_tag().expect("Uploaded part should return an ETag"))
+                            .build(),
+                    )
+                    .build(),
+            )
+            .send()
+            .await
+            .expect("Failed to complete multipart upload");
+        let historical_version = completed
+            .version_id()
+            .expect("Versioned multipart upload should return a version ID")
+            .to_string();
+
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(source)
+            .body(ByteStream::from_static(b"new current version"))
+            .send()
+            .await
+            .expect("Failed to write current version");
+
+        let copy = client
+            .copy_object()
+            .bucket(bucket)
+            .key("restored.bin")
+            .copy_source(format!("{bucket}/{source}?versionId={historical_version}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .content_type("application/replaced")
+            .send()
+            .await
+            .expect("Failed to copy historical multipart version");
+        assert_eq!(copy.copy_source_version_id(), Some(historical_version.as_str()));
+
+        let restored = client
+            .get_object()
+            .bucket(bucket)
+            .key("restored.bin")
+            .send()
+            .await
+            .expect("Failed to read copied multipart source");
+        assert_eq!(restored.content_type(), Some("application/replaced"));
+        assert_eq!(
+            restored
+                .body
+                .collect()
+                .await
+                .expect("Failed to collect restored body")
+                .into_bytes()
+                .as_ref(),
+            multipart_body
+        );
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn invalid_replacement_metadata_does_not_mutate_destination() {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_REJECT_ARCHIVE_CONTENT_ENCODING", "true")])
+            .await
+            .expect("Failed to start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-object-invalid-metadata";
+        let key = "destination.zip";
+        client
+            .create_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("Failed to create bucket");
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(key)
+            .content_type("application/zip")
+            .metadata("state", "original")
+            .body(ByteStream::from_static(b"original destination"))
+            .send()
+            .await
+            .expect("Failed to write destination");
+
+        let error = client
+            .copy_object()
+            .bucket(bucket)
+            .key(key)
+            .copy_source(format!("{bucket}/{key}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .content_type("application/zip")
+            .content_encoding("gzip")
+            .send()
+            .await
+            .expect_err("Invalid replacement metadata should be rejected");
+        assert_eq!(error.as_service_error().and_then(|err| err.code()), Some("InvalidArgument"));
+
+        let invalid_directive = client
+            .copy_object()
+            .bucket(bucket)
+            .key(key)
+            .copy_source(format!("{bucket}/{key}"))
+            .customize()
+            .mutate_request(|request| {
+                request.headers_mut().insert("x-amz-metadata-directive", "UNKNOWN");
+            })
+            .send()
+            .await
+            .expect_err("Unknown metadata directives should be rejected");
+        assert_eq!(
+            invalid_directive.as_service_error().and_then(|error| error.code()),
+            Some("InvalidArgument")
+        );
+
+        let unchanged = client
+            .get_object()
+            .bucket(bucket)
+            .key(key)
+            .send()
+            .await
+            .expect("Destination should remain readable");
+        assert_eq!(unchanged.content_type(), Some("application/zip"));
+        assert_eq!(
+            unchanged.metadata().and_then(|metadata| metadata.get("state")),
+            Some(&"original".to_string())
+        );
+        assert_eq!(
+            unchanged
+                .body
+                .collect()
+                .await
+                .expect("Failed to collect destination body")
+                .into_bytes()
+                .as_ref(),
+            b"original destination"
+        );
+
+        env.stop_server();
+    }
 }
@@ -0,0 +1,468 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! CopyObject tagging directive regression tests.
+
+#[cfg(test)]
+mod tests {
+    use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
+    use aws_sdk_s3::Client;
+    use aws_sdk_s3::error::ProvideErrorMetadata;
+    use aws_sdk_s3::primitives::ByteStream;
+    use aws_sdk_s3::types::{BucketVersioningStatus, MetadataDirective, TaggingDirective, VersioningConfiguration};
+    use serial_test::serial;
+    use std::collections::BTreeMap;
+
+    async fn object_tags(client: &Client, bucket: &str, key: &str) -> BTreeMap<String, String> {
+        client
+            .get_object_tagging()
+            .bucket(bucket)
+            .key(key)
+            .send()
+            .await
+            .expect("GetObjectTagging should succeed")
+            .tag_set()
+            .iter()
+            .map(|tag| (tag.key().to_string(), tag.value().to_string()))
+            .collect()
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn copy_object_applies_copy_replace_and_empty_tagging_directives() {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new()
+            .await
+            .expect("test environment should initialize");
+        env.start_rustfs_server(vec![]).await.expect("RustFS should start");
+
+        let client = env.create_s3_client();
+        let bucket = "copy-object-tagging-directive";
+        let source = "source.txt";
+
+        client
+            .create_bucket()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("bucket creation should succeed");
+        client
+            .put_bucket_versioning()
+            .bucket(bucket)
+            .versioning_configuration(
+                VersioningConfiguration::builder()
+                    .status(BucketVersioningStatus::Enabled)
+                    .build(),
+            )
+            .send()
+            .await
+            .expect("versioning should be enabled");
+
+        let first_version = client
+            .put_object()
+            .bucket(bucket)
+            .key(source)
+            .tagging("project=rustfs&stage=first")
+            .body(ByteStream::from_static(b"first"))
+            .send()
+            .await
+            .expect("first source version should be written")
+            .version_id()
+            .expect("versioned PUT should return a version ID")
+            .to_string();
+
+        client
+            .put_object()
+            .bucket(bucket)
+            .key(source)
+            .tagging("project=rustfs&stage=current")
+            .body(ByteStream::from_static(b"current"))
+            .send()
+            .await
+            .expect("current source version should be written");
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("default-copy.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .send()
+            .await
+            .expect("default CopyObject should preserve current source tags");
+        assert_eq!(
+            object_tags(&client, bucket, "default-copy.txt").await,
+            BTreeMap::from([
+                ("project".to_string(), "rustfs".to_string()),
+                ("stage".to_string(), "current".to_string()),
+            ])
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("explicit-copy.txt")
+            .copy_source(format!("{bucket}/{source}?versionId={first_version}"))
+            .tagging_directive(TaggingDirective::Copy)
+            .send()
+            .await
+            .expect("COPY should preserve the selected historical version's tags");
+        assert_eq!(
+            object_tags(&client, bucket, "explicit-copy.txt").await,
+            BTreeMap::from([
+                ("project".to_string(), "rustfs".to_string()),
+                ("stage".to_string(), "first".to_string()),
+            ])
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("replace.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::Replace)
+            .tagging("project=cli&label=copy%20test")
+            .send()
+            .await
+            .expect("REPLACE should atomically apply requested tags");
+        assert_eq!(
+            object_tags(&client, bucket, "replace.txt").await,
+            BTreeMap::from([
+                ("label".to_string(), "copy test".to_string()),
+                ("project".to_string(), "cli".to_string()),
+            ])
+        );
+        let replace_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("replace.txt")
+            .send()
+            .await
+            .expect("HEAD should succeed after tag replacement");
+        assert_eq!(replace_head.tag_count(), Some(2));
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("empty-replace.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::Replace)
+            .send()
+            .await
+            .expect("REPLACE without Tagging should clear the destination tag set");
+        assert!(object_tags(&client, bucket, "empty-replace.txt").await.is_empty());
+        let empty_head = client
+            .head_object()
+            .bucket(bucket)
+            .key("empty-replace.txt")
+            .send()
+            .await
+            .expect("HEAD should succeed after empty tag replacement");
+        assert_eq!(empty_head.tag_count(), None);
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("metadata-replace-tag-copy.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .metadata("updated", "true")
+            .send()
+            .await
+            .expect("metadata REPLACE must preserve tags under the default COPY directive");
+        assert_eq!(
+            object_tags(&client, bucket, "metadata-replace-tag-copy.txt").await,
+            BTreeMap::from([
+                ("project".to_string(), "rustfs".to_string()),
+                ("stage".to_string(), "current".to_string()),
+            ])
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key("combined-replace.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .metadata_directive(MetadataDirective::Replace)
+            .metadata("updated", "true")
+            .tagging_directive(TaggingDirective::Replace)
+            .tagging("project=combined")
+            .send()
+            .await
+            .expect("metadata and tagging REPLACE directives must be independent");
+        assert_eq!(
+            object_tags(&client, bucket, "combined-replace.txt").await,
+            BTreeMap::from([("project".to_string(), "combined".to_string())])
+        );
+
+        client
+            .copy_object()
+            .bucket(bucket)
+            .key(source)
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::Replace)
+            .tagging("project=self-copy")
+            .send()
+            .await
+            .expect("self-copy with tag replacement should update tags atomically");
+        assert_eq!(
+            object_tags(&client, bucket, source).await,
+            BTreeMap::from([("project".to_string(), "self-copy".to_string())])
+        );
+        let self_copy_body = client
+            .get_object()
+            .bucket(bucket)
+            .key(source)
+            .send()
+            .await
+            .expect("self-copy destination should remain readable")
+            .body
+            .collect()
+            .await
+            .expect("self-copy body should be complete")
+            .into_bytes();
+        assert_eq!(self_copy_body.as_ref(), b"current", "tag-only self-copy must preserve the object body");
+
+        client
+            .put_object()
+            .bucket(bucket)
+            .key("malformed.txt")
+            .tagging("state=original")
+            .body(ByteStream::from_static(b"original destination"))
+            .send()
+            .await
+            .expect("preexisting malformed-test destination should be written");
+
+        let malformed = client
+            .copy_object()
+            .bucket(bucket)
+            .key("malformed.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::Replace)
+            .tagging("project=rustfs%ZZ")
+            .send()
+            .await
+            .expect_err("malformed tags must fail CopyObject");
+        assert_eq!(malformed.as_service_error().and_then(ProvideErrorMetadata::code), Some("InvalidTag"));
+        assert_eq!(
+            object_tags(&client, bucket, "malformed.txt").await,
+            BTreeMap::from([("state".to_string(), "original".to_string())])
+        );
+        let preserved_body = client
+            .get_object()
+            .bucket(bucket)
+            .key("malformed.txt")
+            .send()
+            .await
+            .expect("malformed tags must not replace an existing destination")
+            .body
+            .collect()
+            .await
+            .expect("preserved destination body should be readable")
+            .into_bytes();
+        assert_eq!(
+            preserved_body.as_ref(),
+            b"original destination",
+            "malformed tags must leave destination data unchanged"
+        );
+
+        let discarded = client
+            .copy_object()
+            .bucket(bucket)
+            .key("discarded.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging("project=must-not-be-discarded")
+            .send()
+            .await
+            .expect_err("Tagging without REPLACE must fail instead of discarding requested tags");
+        assert_eq!(discarded.as_service_error().and_then(ProvideErrorMetadata::code), Some("InvalidRequest"));
+
+        let invalid_directive = client
+            .copy_object()
+            .bucket(bucket)
+            .key("invalid-directive.txt")
+            .copy_source(format!("{bucket}/{source}"))
+            .tagging_directive(TaggingDirective::from("UNKNOWN"))
+            .send()
+            .await
+            .expect_err("an unknown TaggingDirective must fail");
+        assert_eq!(
+            invalid_directive.as_service_error().and_then(ProvideErrorMetadata::code),
+            Some("InvalidArgument")
+        );
+
+        env.stop_server();
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn copy_object_tag_replacement_honors_request_tag_policy_denial() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
+    {
+        init_logging();
+        let source_bucket = "copy-tags-policy-source";
+        let destination_bucket = "copy-tags-policy-destination";
+
+        let mut env = RustFSTestEnvironment::new().await?;
+        env.start_rustfs_server(vec![]).await?;
+        let admin = env.create_s3_client();
+        admin.create_bucket().bucket(source_bucket).send().await?;
+        admin.create_bucket().bucket(destination_bucket).send().await?;
+        admin
+            .put_object()
+            .bucket(source_bucket)
+            .key("source.txt")
+            .tagging("source=allowed")
+            .body(ByteStream::from_static(b"source"))
+            .send()
+            .await?;
+        admin
+            .put_object()
+            .bucket(source_bucket)
+            .key("conditioned.txt")
+            .body(ByteStream::from_static(b"conditioned source"))
+            .send()
+            .await?;
+
+        let source_policy = serde_json::json!({
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Effect": "Allow",
+                    "Principal": "*",
+                    "Action": ["s3:GetObject"],
+                    "Resource": [format!("arn:aws:s3:::{source_bucket}/source.txt")]
+                },
+                {
+                    "Effect": "Allow",
+                    "Principal": "*",
+                    "Action": ["s3:GetObject"],
+                    "Resource": [format!("arn:aws:s3:::{source_bucket}/conditioned.txt")],
+                    "Condition": {
+                        "StringEquals": {
+                            "s3:RequestObjectTag/classification": "public"
+                        }
+                    }
+                }
+            ]
+        })
+        .to_string();
+        admin
+            .put_bucket_policy()
+            .bucket(source_bucket)
+            .policy(source_policy)
+            .send()
+            .await?;
+
+        let destination_policy = serde_json::json!({
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Effect": "Allow",
+                    "Principal": "*",
+                    "Action": ["s3:PutObject"],
+                    "Resource": [format!("arn:aws:s3:::{destination_bucket}/*")]
+                },
+                {
+                    "Effect": "Deny",
+                    "Principal": "*",
+                    "Action": ["s3:PutObject"],
+                    "Resource": [format!("arn:aws:s3:::{destination_bucket}/*")],
+                    "Condition": {
+                        "StringEquals": {
+                            "s3:RequestObjectTag/classification": "restricted"
+                        }
+                    }
+                }
+            ]
+        })
+        .to_string();
+        admin
+            .put_bucket_policy()
+            .bucket(destination_bucket)
+            .policy(destination_policy)
+            .send()
+            .await?;
+
+        let copy_source = format!("/{source_bucket}/source.txt");
+        let allowed = local_http_client()
+            .put(format!("{}/{destination_bucket}/allowed.txt", env.url))
+            .header("x-amz-copy-source", &copy_source)
+            .header("x-amz-tagging-directive", "REPLACE")
+            .header("x-amz-tagging", "classification=public")
+            .send()
+            .await?;
+        assert_eq!(
+            allowed.status(),
+            reqwest::StatusCode::OK,
+            "a tag set allowed by the request-tag policy should copy successfully"
+        );
+        assert_eq!(
+            object_tags(&admin, destination_bucket, "allowed.txt").await,
+            BTreeMap::from([("classification".to_string(), "public".to_string())])
+        );
+
+        let denied = local_http_client()
+            .put(format!("{}/{destination_bucket}/denied.txt", env.url))
+            .header("x-amz-copy-source", copy_source)
+            .header("x-amz-tagging-directive", "REPLACE")
+            .header("x-amz-tagging", "classification=restricted")
+            .send()
+            .await?;
+        assert_eq!(
+            denied.status(),
+            reqwest::StatusCode::FORBIDDEN,
+            "CopyObject must honor a request-tag policy Deny"
+        );
+
+        let source_condition_bypass = local_http_client()
+            .put(format!("{}/{destination_bucket}/source-condition.txt", env.url))
+            .header("x-amz-copy-source", format!("/{source_bucket}/conditioned.txt"))
+            .header("x-amz-tagging-directive", "REPLACE")
+            .header("x-amz-tagging", "classification=public")
+            .send()
+            .await?;
+        assert_eq!(
+            source_condition_bypass.status(),
+            reqwest::StatusCode::FORBIDDEN,
+            "destination request tags must not satisfy source GetObject policy conditions"
+        );
+
+        let missing_destination = admin
+            .head_object()
+            .bucket(destination_bucket)
+            .key("denied.txt")
+            .send()
+            .await
+            .expect_err("an access-denied copy must not create a destination object");
+        assert_eq!(
+            missing_destination.as_service_error().and_then(ProvideErrorMetadata::code),
+            Some("NotFound")
+        );
+        let missing_bypass_destination = admin
+            .head_object()
+            .bucket(destination_bucket)
+            .key("source-condition.txt")
+            .send()
+            .await
+            .expect_err("a source authorization denial must not create a destination object");
+        assert_eq!(
+            missing_bypass_destination
+                .as_service_error()
+                .and_then(ProvideErrorMetadata::code),
+            Some("NotFound")
+        );
+
+        env.stop_server();
+        Ok(())
+    }
+}
@@ -56,6 +56,21 @@ mod tests {
        );
    }

+    async fn assert_current_list_hides_delete_marker(client: &Client, bucket: &str, key: &str) {
+        let listed = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .prefix(key)
+            .send()
+            .await
+            .expect("list current objects after delete marker");
+
+        assert!(
+            listed.contents().iter().all(|object| object.key() != Some(key)),
+            "ListObjectsV2 must hide an object whose latest version is a delete marker"
+        );
+    }
+
    #[tokio::test]
    #[serial]
    async fn test_versioning_only_delete_marker_has_minio_compatible_visibility_for_migration_proof() {
@@ -94,6 +109,7 @@ mod tests {
        assert_eq!(markers[0].version_id(), Some(delete_marker_version_id));
        assert_eq!(markers[0].is_latest(), Some(true));
        assert_current_get_is_delete_marker_not_found(&client, bucket, key).await;
+        assert_current_list_hides_delete_marker(&client, bucket, key).await;
    }

    #[tokio::test]
@@ -118,6 +134,17 @@ mod tests {
            .await
            .expect("put historical version");
        let data_version_id = put.version_id().expect("put should return data version id");
+        let listed_before_delete = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .prefix(key)
+            .send()
+            .await
+            .expect("list current object before creating delete marker");
+        assert!(
+            listed_before_delete.contents().iter().any(|object| object.key() == Some(key)),
+            "ListObjectsV2 must include the current object before it is deleted"
+        );

        let delete_marker = client
            .delete_object()
@@ -145,6 +172,7 @@ mod tests {
        assert_eq!(markers[0].version_id(), Some(delete_marker_version_id));
        assert_eq!(markers[0].is_latest(), Some(true));
        assert_current_get_is_delete_marker_not_found(&client, bucket, key).await;
+        assert_current_list_hides_delete_marker(&client, bucket, key).await;

        let historical = client
            .get_object()
@@ -0,0 +1,445 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Regression tests for object delete operations.
+//!
+//! Covers the recurring pattern where DELETE succeeds at the API level but the
+//! object remains visible in LIST, or deleted objects reappear after restart,
+//! or versioned delete operations fail with FileAccessDenied.
+//! This has regressed 15+ times across the entire release history.
+//!
+//! ## Regression Issues
+//!
+//! - rustfs#5375: delete object in a bucket list api also exist this object
+//! - rustfs#5349: The deleted bucket was rebuilt after some time
+//! - rustfs#5339: data not delete in Object Lock bucket
+//! - rustfs#5029: Node Does Not Remove Files After Reconnect to Cluster
+//! - rustfs#4978: DELETE fails with InternalError/FileAccessDenied on beta 10
+//! - rustfs#760: Cannot delete a versioned bucket
+
+#[cfg(test)]
+mod tests {
+    use crate::common::{RustFSTestEnvironment, init_logging};
+    use aws_sdk_s3::primitives::ByteStream;
+    use aws_sdk_s3::types::{BucketVersioningStatus, Delete, ObjectIdentifier, VersioningConfiguration};
+    use serial_test::serial;
+    use std::error::Error;
+    use tracing::info;
+
+    type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+
+    /// RT-05: Verify DELETE → LIST → HEAD consistency.
+    ///
+    /// Regression pattern: DELETE returns 200 but the object remains in LIST.
+    /// Covers rustfs#5375.
+    ///
+    /// Steps:
+    /// 1. Create a bucket and upload an object
+    /// 2. Verify the object is in LIST
+    /// 3. DELETE the object
+    /// 4. Verify the object is NOT in LIST
+    /// 5. Verify HEAD returns 404
+    #[tokio::test]
+    #[serial]
+    async fn test_delete_removes_object_from_list() -> TestResult {
+        init_logging();
+        info!("RT-05: delete removes object from list");
+
+        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
+            .await
+            .expect("start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "rt05-delete-consistency";
+
+        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
+
+        // Upload an object
+        client
+            .put_object()
+            .bucket(bucket)
+            .key("to-delete.txt")
+            .body(ByteStream::from_static(b"will be deleted"))
+            .send()
+            .await
+            .expect("put object");
+
+        // Verify it appears in LIST
+        let list = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("list objects before delete");
+
+        assert!(
+            list.contents()
+                .iter()
+                .map(|o| o.key().unwrap_or(""))
+                .any(|key| key == "to-delete.txt"),
+            "RT-05 FAIL: object not in LIST before delete"
+        );
+
+        // DELETE
+        client
+            .delete_object()
+            .bucket(bucket)
+            .key("to-delete.txt")
+            .send()
+            .await
+            .expect("delete object");
+
+        // Verify NOT in LIST
+        let list = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("list objects after delete");
+
+        assert!(
+            !list
+                .contents()
+                .iter()
+                .map(|o| o.key().unwrap_or(""))
+                .any(|key| key == "to-delete.txt"),
+            "RT-05 FAIL: deleted object still in LIST (regression rustfs#5375)"
+        );
+
+        // Verify HEAD returns 404
+        let head = client.head_object().bucket(bucket).key("to-delete.txt").send().await;
+
+        assert!(head.is_err(), "RT-05 FAIL: HEAD on deleted object should return error, got success");
+
+        info!("RT-05 PASS: delete correctly removes object from LIST and HEAD");
+        Ok(())
+    }
+
+    /// RT-05c: Verify batch delete (DeleteObjects) consistency.
+    ///
+    /// Regression pattern: batch delete returns success but some objects
+    /// remain in LIST.
+    #[tokio::test]
+    #[serial]
+    async fn test_batch_delete_removes_all_objects() -> TestResult {
+        init_logging();
+        info!("RT-05c: batch delete removes all objects");
+
+        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
+            .await
+            .expect("start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "rt05c-batch-delete";
+
+        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
+
+        // Upload multiple objects
+        let keys: Vec<String> = (0..5).map(|i| format!("batch-{i:04}.txt")).collect();
+        for key in &keys {
+            client
+                .put_object()
+                .bucket(bucket)
+                .key(key)
+                .body(ByteStream::from_static(b"batch-delete-me"))
+                .send()
+                .await
+                .expect("put object");
+        }
+
+        // Verify all in LIST
+        let list = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("list before batch delete");
+
+        assert_eq!(
+            list.contents().len(),
+            5,
+            "RT-05c FAIL: expected 5 objects before batch delete, found {}",
+            list.contents().len()
+        );
+
+        // Batch delete
+        let objects: Vec<ObjectIdentifier> = keys
+            .iter()
+            .map(|k| ObjectIdentifier::builder().key(k).build().expect("build object id"))
+            .collect();
+
+        client
+            .delete_objects()
+            .bucket(bucket)
+            .delete(Delete::builder().set_objects(Some(objects)).build().expect("build delete"))
+            .send()
+            .await
+            .expect("batch delete");
+
+        // Verify all removed
+        let list = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("list after batch delete");
+
+        assert!(
+            list.contents().is_empty(),
+            "RT-05c FAIL: {} objects remain after batch delete (regression: delete objects not fully applied)",
+            list.contents().len()
+        );
+
+        info!("RT-05c PASS: batch delete removes all objects");
+        Ok(())
+    }
+
+    /// RT-05d: Verify versioned delete → permanent delete → object gone.
+    ///
+    /// Covers the pattern where permanent deletion of a specific version
+    /// fails with FileAccessDenied (rustfs#4978).
+    #[tokio::test]
+    #[serial]
+    async fn test_versioned_permanent_delete() -> TestResult {
+        init_logging();
+        info!("RT-05d: versioned permanent delete");
+
+        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
+            .await
+            .expect("start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "rt05d-permanent-delete";
+
+        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
+
+        client
+            .put_bucket_versioning()
+            .bucket(bucket)
+            .versioning_configuration(
+                VersioningConfiguration::builder()
+                    .status(BucketVersioningStatus::Enabled)
+                    .build(),
+            )
+            .send()
+            .await
+            .expect("enable versioning");
+
+        // Upload a single object (single version)
+        let put_resp = client
+            .put_object()
+            .bucket(bucket)
+            .key("single-version.txt")
+            .body(ByteStream::from_static(b"to-be-permanently-deleted"))
+            .send()
+            .await
+            .expect("put object");
+
+        let version_id = put_resp.version_id().expect("version ID should be present").to_string();
+
+        // Permanently delete the specific version (rustfs#4978: FileAccessDenied)
+        client
+            .delete_object()
+            .bucket(bucket)
+            .key("single-version.txt")
+            .version_id(&version_id)
+            .send()
+            .await
+            .expect("permanent delete should succeed (regression rustfs#4978)");
+
+        // Verify the object is completely gone
+        let versions = client
+            .list_object_versions()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("list versions");
+
+        assert!(
+            versions.versions().is_empty(),
+            "RT-05d FAIL: version still present after permanent delete"
+        );
+
+        info!("RT-05d PASS: versioned permanent delete succeeds");
+        Ok(())
+    }
+
+    /// RT-05e: Verify delete marker + version history interaction.
+    ///
+    /// Covers the pattern where creating a delete marker and then listing
+    /// versions shows incorrect state (rustfs#760).
+    #[tokio::test]
+    #[serial]
+    async fn test_versioned_delete_marker_and_list_consistency() -> TestResult {
+        init_logging();
+        info!("RT-05e: versioned delete marker and list consistency");
+
+        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
+            .await
+            .expect("start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "rt05e-dm-consistency";
+
+        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
+
+        client
+            .put_bucket_versioning()
+            .bucket(bucket)
+            .versioning_configuration(
+                VersioningConfiguration::builder()
+                    .status(BucketVersioningStatus::Enabled)
+                    .build(),
+            )
+            .send()
+            .await
+            .expect("enable versioning");
+
+        // Create 3 versions
+        for i in 0..3 {
+            client
+                .put_object()
+                .bucket(bucket)
+                .key("history.txt")
+                .body(ByteStream::from(format!("v{i}").into_bytes()))
+                .send()
+                .await
+                .expect("put version");
+        }
+
+        // Create a delete marker
+        let del = client
+            .delete_object()
+            .bucket(bucket)
+            .key("history.txt")
+            .send()
+            .await
+            .expect("delete (create marker)");
+
+        assert!(del.delete_marker().unwrap_or(false), "RT-05e FAIL: should have created a delete marker");
+
+        // ListObjectVersions should show 3 versions + 1 delete marker
+        let versions = client
+            .list_object_versions()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("list versions");
+
+        assert_eq!(
+            versions.versions().len(),
+            3,
+            "RT-05e FAIL: expected 3 versions, found {}",
+            versions.versions().len()
+        );
+        assert_eq!(
+            versions.delete_markers().len(),
+            1,
+            "RT-05e FAIL: expected 1 delete marker, found {}",
+            versions.delete_markers().len()
+        );
+
+        // Now delete the delete marker (restore the object)
+        let dm_version = &versions.delete_markers()[0];
+        client
+            .delete_object()
+            .bucket(bucket)
+            .key("history.txt")
+            .version_id(dm_version.version_id().expect("dm version id"))
+            .send()
+            .await
+            .expect("delete delete-marker");
+
+        // HEAD should succeed now (latest version is accessible)
+        let head = client.head_object().bucket(bucket).key("history.txt").send().await;
+
+        assert!(head.is_ok(), "RT-05e FAIL: HEAD should succeed after removing delete marker");
+
+        info!("RT-05e PASS: versioned delete marker and list consistency");
+        Ok(())
+    }
+
+    /// RT-05f: Verify object deletion does not leave orphan data on disk.
+    ///
+    /// Regression pattern: after delete, the object data files remain on disk
+    /// (rustfs#5029: Node Does Not Remove Files After Reconnect).
+    #[tokio::test]
+    #[serial]
+    async fn test_delete_removes_object_head_returns_404() -> TestResult {
+        init_logging();
+        info!("RT-05f: delete → HEAD 404 consistency");
+
+        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
+        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
+            .await
+            .expect("start RustFS");
+
+        let client = env.create_s3_client();
+        let bucket = "rt05f-delete-head";
+
+        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
+
+        // Upload, delete, verify HEAD returns 404
+        let keys = vec!["small.txt", "medium.txt", "with-slash.txt", "special+chars.txt"];
+
+        for key in &keys {
+            client
+                .put_object()
+                .bucket(bucket)
+                .key(*key)
+                .body(ByteStream::from_static(b"delete-me"))
+                .send()
+                .await
+                .expect("put object");
+        }
+
+        for key in &keys {
+            client
+                .delete_object()
+                .bucket(bucket)
+                .key(*key)
+                .send()
+                .await
+                .expect("delete object");
+        }
+
+        // All HEAD requests should return 404
+        for key in &keys {
+            let head = client.head_object().bucket(bucket).key(*key).send().await;
+
+            assert!(head.is_err(), "RT-05f FAIL: HEAD on deleted key '{key}' should return error");
+        }
+
+        // LIST should be empty
+        let list = client
+            .list_objects_v2()
+            .bucket(bucket)
+            .send()
+            .await
+            .expect("list after all deletes");
+
+        assert!(
+            list.contents().is_empty(),
+            "RT-05f FAIL: {} objects remain after deleting all",
+            list.contents().len()
+        );
+
+        info!("RT-05f PASS: all deleted objects return 404 on HEAD");
+        Ok(())
+    }
+}
@@ -0,0 +1,202 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Regression tests for distributed cluster startup and quorum.
+//!
+//! Covers the recurring pattern where multi-node clusters fail to start due to
+//! lock quorum issues, DNS resolution delays, or erasure quorum deadlocks.
+//! This has regressed 7+ times.
+//!
+//! ## Regression Issues
+//!
+//! - rustfs#5416: RustFS cannot cold-start with 2/3 quorum when Pod DNS missing
+//! - rustfs#2945: Distributed mode fails on K8s: erasure quorum deadlock
+//! - rustfs#2794: distributed deployment does not become ready
+//! - rustfs#2601: fresh pod immediately enters FaultyDisk state
+//! - rustfs#4040: Distributed startup can fail lock quorum before AppContext initializes
+//! - rustfs#5655: fix(ecstore): bootstrap fresh four-node clusters reliably
+//! - rustfs#4954: S3/health endpoint unavailability after multi-pool scale-up
+
+#[cfg(test)]
+mod tests {
+    use crate::common::{RustFSTestClusterEnvironment, init_logging};
+    use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
+    use std::error::Error;
+    use tokio::time::{Duration, sleep};
+    use tracing::info;
+
+    type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+
+    /// RT-10: Verify 4-node cluster starts successfully and all nodes are ready.
+    ///
+    /// Regression pattern: distributed startup fails with quorum deadlock or
+    /// lock acquisition timeout (rustfs#2945, rustfs#5655).
+    ///
+    /// Steps:
+    /// 1. Create a 4-node cluster
+    /// 2. Start all nodes simultaneously
+    /// 3. Verify all nodes report healthy
+    /// 4. Verify S3 operations work through any node
+    #[tokio::test]
+    #[serial]
+    async fn test_four_node_cluster_startup_and_health() -> TestResult {
+        init_logging();
+        info!("RT-10: 4-node cluster startup and health");
+
+        let mut cluster = RustFSTestClusterEnvironment::new(4).await.expect("create 4-node cluster");
+
+        cluster.start().await.expect("start 4-node cluster");
+
+        // Create a bucket and verify it's accessible from all nodes
+        cluster
+            .create_test_bucket("rt10-startup")
+            .await
+            .expect("create bucket on cluster");
+
+        let clients = cluster.create_all_clients().expect("create per-node clients");
+
+        // Verify S3 operations work from every node
+        for (i, client) in clients.iter().enumerate() {
+            client
+                .put_object()
+                .bucket("rt10-startup")
+                .key(format!("from-node-{i}.txt"))
+                .body(ByteStream::from_static(b"hello from node"))
+                .send()
+                .await
+                .unwrap_or_else(|e| panic!("PUT from node {i} failed: {e}"));
+        }
+
+        // Verify all objects are visible from node 0
+        let list = clients[0]
+            .list_objects_v2()
+            .bucket("rt10-startup")
+            .send()
+            .await
+            .expect("list objects from node 0");
+
+        assert_eq!(
+            list.contents().len(),
+            4,
+            "RT-10 FAIL: expected 4 objects (one per node), found {}",
+            list.contents().len()
+        );
+
+        info!("RT-10 PASS: 4-node cluster starts and serves S3 from all nodes");
+        Ok(())
+    }
+
+    /// RT-10b: Verify cluster handles node restart gracefully.
+    ///
+    /// Regression pattern: after a node restart, it cannot rejoin the cluster
+    /// or enters a faulty state (rustfs#2601).
+    #[tokio::test]
+    #[serial]
+    async fn test_cluster_survives_node_restart() -> TestResult {
+        init_logging();
+        info!("RT-10b: cluster survives node restart");
+
+        let mut cluster = RustFSTestClusterEnvironment::new(4).await.expect("create 4-node cluster");
+
+        cluster.start().await.expect("start cluster");
+
+        cluster.create_test_bucket("rt10b-restart").await.expect("create bucket");
+
+        // Write data
+        let clients = cluster.create_all_clients()?;
+        clients[0]
+            .put_object()
+            .bucket("rt10b-restart")
+            .key("before-restart.txt")
+            .body(ByteStream::from_static(b"persistent data"))
+            .send()
+            .await
+            .expect("put object before restart");
+
+        // Stop node 3
+        cluster.stop_node(3).expect("stop node 3");
+        sleep(Duration::from_secs(2)).await;
+
+        // Verify cluster still works with 3/4 nodes (quorum)
+        clients[0]
+            .put_object()
+            .bucket("rt10b-restart")
+            .key("during-offline.txt")
+            .body(ByteStream::from_static(b"written while node 3 down"))
+            .send()
+            .await
+            .expect("PUT should succeed with 3/4 nodes");
+
+        // Restart node 3
+        cluster.start_node(3).await.expect("restart node 3");
+
+        // Wait for node to rejoin
+        sleep(Duration::from_secs(3)).await;
+
+        // Verify the restarted node can serve reads
+        let list = clients[3]
+            .list_objects_v2()
+            .bucket("rt10b-restart")
+            .send()
+            .await
+            .expect("list from restarted node");
+
+        assert!(
+            list.contents().len() >= 2,
+            "RT-10b FAIL: restarted node sees {} objects, expected >= 2",
+            list.contents().len()
+        );
+
+        info!("RT-10b PASS: cluster survives and recovers from node restart");
+        Ok(())
+    }
+
+    /// RT-10c: Verify bucket creation persists across all nodes.
+    ///
+    /// Regression pattern: bucket metadata is not replicated to all nodes,
+    /// causing NoSuchBucket errors on some nodes (rustfs#3191).
+    #[tokio::test]
+    #[serial]
+    async fn test_bucket_visible_from_all_nodes() -> TestResult {
+        init_logging();
+        info!("RT-10c: bucket visible from all nodes");
+
+        let mut cluster = RustFSTestClusterEnvironment::new(4).await.expect("create 4-node cluster");
+
+        cluster.start().await.expect("start cluster");
+
+        cluster
+            .create_test_bucket("rt10c-bucket-visibility")
+            .await
+            .expect("create bucket");
+
+        let clients = cluster.create_all_clients()?;
+
+        // Verify the bucket is visible from every node
+        for (i, client) in clients.iter().enumerate() {
+            let resp = client
+                .list_objects_v2()
+                .bucket("rt10c-bucket-visibility")
+                .send()
+                .await
+                .unwrap_or_else(|e| panic!("list from node {i} failed (NoSuchBucket?): {e}"));
+
+            assert!(resp.contents().is_empty(), "RT-10c: fresh bucket should be empty on node {i}");
+        }
+
+        info!("RT-10c PASS: bucket visible from all 4 nodes");
+        Ok(())
+    }
+}
@@ -25,6 +25,7 @@ use hyper::body::Incoming;
 use hyper::server::conn::http1;
 use hyper::service::service_fn;
 use hyper_util::rt::{TokioIo, TokioTimer};
+use md5::{Digest as Md5Digest, Md5};
 use s3s::access::{S3Access, S3AccessContext};
 use s3s::auth::SimpleAuth;
 use s3s::dto::{
@@ -827,13 +828,25 @@ fn ensure_body_growth(current: usize, added: usize) -> S3Result {

 async fn md5_digest(body: Bytes, permit: OwnedSemaphorePermit) -> S3Result<([u8; 16], OwnedSemaphorePermit)> {
    if body.len() < 1024 * 1024 {
-        return Ok((md5::compute(body).0, permit));
+        return Ok((md5_bytes(body), permit));
    }
-    tokio::task::spawn_blocking(move || (md5::compute(body).0, permit))
+    tokio::task::spawn_blocking(move || (md5_bytes(body), permit))
        .await
        .map_err(|error| s3s::s3_error!(InternalError, "MD5 worker failed: {error}"))
 }

+fn md5_bytes(input: impl AsRef<[u8]>) -> [u8; 16] {
+    let mut hasher = Md5::new();
+    hasher.update(input.as_ref());
+    hasher.finalize().into()
+}
+
+fn md5_hex(input: impl AsRef<[u8]>) -> String {
+    let mut hasher = Md5::new();
+    hasher.update(input.as_ref());
+    hex::encode(hasher.finalize())
+}
+
 fn ensure_store_budget(state: &StoreState, removed_bytes: usize, added_bytes: usize, adds_version: bool) -> S3Result {
    let total_bytes = state
        .total_bytes
@@ -1005,7 +1018,7 @@ impl S3 for FakeBackend {
            Some(value) => value,
            None => {
                let (digest, _body_permit) = md5_digest(body.clone(), _body_permit).await?;
-                format!("{:x}", md5::Digest(digest))
+                hex::encode(digest)
            }
        };
        let version = ObjectVersion {
@@ -1208,7 +1221,7 @@ impl S3 for FakeBackend {
        }
        let body = collect_stream(input.body, input.content_length, fault.as_ref(), &self.control).await?;
        let (digest, _body_permit) = md5_digest(body.clone(), _body_permit).await?;
-        let e_tag = format!("{:x}", md5::Digest(digest));
+        let e_tag = hex::encode(digest);
        let mut state = lock(&self.store);
        let existing_bytes = state
            .uploads
@@ -1336,7 +1349,7 @@ impl S3 for FakeBackend {
            .collect();
        let (body, digests, _body_permits) = assemble_multipart(assembly_parts, total_len, _body_permits).await?;
        let part_count = requested.len();
-        let e_tag = source_etag(&headers)?.unwrap_or_else(|| format!("{:x}-{part_count}", md5::compute(digests)));
+        let e_tag = source_etag(&headers)?.unwrap_or_else(|| format!("{}-{part_count}", md5_hex(digests)));
        let version = ObjectVersion {
            version_id: upload.version_id.clone(),
            body,
@@ -45,10 +45,10 @@
 //!   * Parity reconstruction: one data disk is taken offline
 //!     (`take_disk_offline`) and the SAME object matrix is GET both ways while
 //!     the EC 2+2 set rebuilds each large object from the surviving shards. The
-//!     codec-streaming reader gate never inspects drive health, so the codec
-//!     fast path is exercised end-to-end through reconstruction; the test
-//!     asserts byte- and header-equality vs the legacy path AND that the codec
-//!     phase never fell back to a duplex pipe while reconstructing.
+//!     eager first/single-part setup may keep its conservative whole-request
+//!     fallback when shard placement makes codec streaming unsafe, so this phase
+//!     asserts byte- and header-equality vs the legacy path rather than requiring
+//!     zero duplex fallbacks under degraded drive health.
 //!   * Missing object: a GET for an absent key is compared across both phases
 //!     to prove the error semantics (HTTP status + S3 error code) are identical
 //!     — the codec env must not perturb the NoSuchKey negative path.
@@ -475,15 +475,14 @@ mod tests {
            "ranged GET length diverged with codec streaming enabled"
        );

-        // ---- Phase B degraded: the same reconstruction, now on the codec path ----
-        // Re-run the reconstruction A/B with the codec-streaming gates still
-        // open. The reader gate decision is independent of drive health (it
-        // never inspects disk state), so the codec fast path is exercised
-        // end-to-end while the EC set rebuilds each large object from the
-        // surviving shards — this is a real codec-vs-legacy reconstruction test,
-        // not legacy-vs-legacy. Snapshot the duplex count first (the range GET
-        // above already used the duplex path) so we can measure only the markers
-        // these degraded codec GETs add.
+        // ---- Phase B degraded: the same reconstruction, with codec gates open ----
+        // Re-run the reconstruction A/B with codec-streaming enabled. If eager
+        // first/single-part setup cannot prove the codec path is safe for the
+        // surviving shards, the implementation intentionally preserves the
+        // whole-request legacy fallback; later multipart parts can degrade in
+        // place. This phase verifies parity-reconstructed bytes and headers,
+        // while the healthy phase above remains the strict zero-duplex path
+        // confirmation.
        let dup_codec_before_degraded = count_marker(&codec_log, DUPLEX_MARKER);
        harness.take_disk_offline(0)?;
        let mut codec_degraded: BTreeMap<String, GetView> = BTreeMap::new();
@@ -511,16 +510,11 @@ mod tests {
            );
        }

-        // Path confirmation under reconstruction: the codec fast path must have
-        // served the reconstructed large objects without ever falling back to
-        // the legacy duplex pipe. Without this, the equivalence above could be
-        // legacy-vs-legacy and prove nothing about codec reconstruction.
+        // Keep degraded duplex markers as diagnostic evidence only: eager setup
+        // may fall back before streaming when shard safety cannot be proven.
        sleep(Duration::from_millis(300)).await;
        let dup_codec_degraded = count_marker(&codec_log, DUPLEX_MARKER).saturating_sub(dup_codec_before_degraded);
-        assert_eq!(
-            dup_codec_degraded, 0,
-            "codec phase created {dup_codec_degraded} duplex pipe(s) while reconstructing large objects with disk0 offline; the codec fast path was not exercised under degraded reads (see {codec_log})"
-        );
+        info!(dup_codec_degraded, "codec phase degraded-read legacy duplex marker count");

        info!(
            objects = baseline.len(),
@@ -0,0 +1,776 @@
+#![cfg(test)]
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Cross-process replay / tamper acceptance for internode NodeService RPC
+//! signatures (<https://github.com/rustfs/backlog/issues/1327>,
+//! <https://github.com/rustfs/backlog/issues/1542>).
+//!
+//! # Why this exists on top of the in-process tests
+//!
+//! `http_auth.rs` unit-tests the signature algebra by calling the verifier
+//! directly. That proves the crypto, but it cannot prove that a *deployed*
+//! server actually reaches it: the request has to survive the hybrid HTTP/gRPC
+//! router, `check_auth`, tonic's own metadata handling, and finally the
+//! per-handler body-digest gate. A handler that forgets its
+//! `verify_disk_mutation_digest` call, or a router change that bypasses
+//! `check_auth`, is invisible in-process and wide open in production. These
+//! tests drive a real `rustfs` child process over a real TCP socket, so every
+//! one of those layers is in the path.
+//!
+//! # Attacker model
+//!
+//! The adversary is on-path: it observed one legitimately signed request and
+//! can resend, retarget, or edit those bytes — including individual headers.
+//! It does **not** hold the RPC secret. The test process does hold the secret,
+//! but uses it for exactly one purpose: minting the request that stands in for
+//! the captured one. Every attack then only *reuses or edits* an already-minted
+//! header set; no attack step ever re-signs. If any of these tests could pass
+//! by re-signing, it would be testing nothing.
+//!
+//! # Isolating one variable at a time
+//!
+//! Each rejection is paired with an acceptance that differs in exactly one
+//! respect, because a misconfigured harness (wrong audience, dead server,
+//! ambient strict env) would otherwise make every "rejected" assertion pass
+//! vacuously. Two pairings carry most of the weight:
+//!
+//! - Editing the body alone is caught by the *handler* (`PermissionDenied`);
+//!   editing the body **and** repairing the digest header to match is caught by
+//!   the *signature* (`Unauthenticated`). The second only fails closed if the
+//!   digest is genuinely inside the signed scope, so the pair pins both layers.
+//! - Replaying a captured nonce is caught by the replay cache; swapping in a
+//!   fresh nonce is caught by the signature. Again, only the pair proves the
+//!   nonce is signed rather than merely cached.
+//!
+//! # Why `MakeVolume` against a non-existent disk
+//!
+//! Every covered handler checks the digest before touching storage, and
+//! `MakeVolume` resolves its disk *after* that check. Aiming at a disk that
+//! cannot exist gives three cleanly separable outcomes with zero side effects
+//! on the server's real data:
+//!
+//! - `Err(Unauthenticated)` — rejected by `check_auth` (signature layer).
+//! - `Err(PermissionDenied)` — rejected by the handler's body-digest gate.
+//! - `Ok(success: false)` — **authentication passed**; the request reached
+//!   handler logic and only then failed on the bogus disk.
+//!
+//! # Coverage of the issue's acceptance matrix
+//!
+//! | Acceptance item | Test |
+//! |---|---|
+//! | replay a signature onto another method → reject | [`cross_method_signature_transplant_is_rejected`] |
+//! | replay same method + body after nonce consumed → reject | [`nonce_replay_of_a_captured_mutation_is_rejected`] |
+//! | nonce is signed, not just cached → reject a swapped nonce | [`swapping_in_a_fresh_nonce_is_rejected`] |
+//! | tamper one byte of the body → reject | [`tampered_mutation_body_is_rejected`] |
+//! | body digest is inside the signed scope → reject a repaired digest | [`rewriting_the_digest_to_match_a_tampered_body_is_rejected`] |
+//! | wrong destination node identity → reject | [`signature_minted_for_another_node_is_rejected`] |
+//! | mixed version: legacy-only still served, not blocked | [`legacy_only_signature_is_accepted_in_default_posture`] |
+//! | strict flip closes the signature downgrade | [`signature_strict_rejects_legacy_only_downgrade`] |
+//! | strict flip closes the body-digest downgrade, incl. v1 | [`body_digest_strict_rejects_digestless_mutation`] |
+//! | replay scope binds every RPC and rejects restart replay | [`replay_scope_rejects_replay_path_transplant_and_stale_epoch_e2e`] |
+//! | strict replay scope allows only Ping bootstrap before v3 | [`replay_scope_strict_requires_v3_after_ping_bootstrap_e2e`] |
+//!
+//! Two acceptance items are deliberately left to the in-process tests. A stale
+//! timestamp cannot be forged from outside — it is inside the HMAC — so
+//! observing it would mean idling out the full freshness window. And the
+//! `signature_v1_fallback_total` / `body_digest_fallback_total` counter deltas
+//! that gate the strict flips are asserted directly in `http_auth.rs`; the
+//! legacy test below proves only the *accepted* half of that behaviour.
+
+use crate::common::{RustFSTestEnvironment, init_logging};
+use crate::storage_api::internode_rpc_signature::{
+    TONIC_RPC_PREFIX, gen_signature_headers, gen_tonic_replay_scope_headers, gen_tonic_signature_headers,
+    node_service_time_out_client_no_auth, verify_tonic_boot_epoch_response,
+};
+use http::{HeaderMap, Method};
+use rustfs_config::{
+    ENV_INTERNODE_RPC_BODY_DIGEST_STRICT, ENV_INTERNODE_RPC_REPLAY_CACHE_CAPACITY, ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT,
+    ENV_INTERNODE_RPC_SIGNATURE_STRICT,
+};
+use rustfs_protos::canonical_make_volume_request_body;
+use rustfs_protos::proto_gen::node_service::{MakeVolumeRequest, MakeVolumeResponse, PingRequest, PingResponse};
+use serial_test::serial;
+use sha2::{Digest, Sha256};
+use std::error::Error;
+use tonic::{Code, Request, Response, Status};
+use uuid::Uuid;
+
+type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+
+/// Shared internode secret handed to both the child server and this process.
+///
+/// Must not be the default credential: `resolve_rpc_secret` fails closed on
+/// defaults (GHSA-r5qv), so a default here would break every request rather
+/// than test anything.
+const TEST_RPC_SECRET: &str = "rustfs-internode-signature-e2e-secret";
+
+/// A disk path the server cannot possibly have configured, so a request that
+/// clears authentication stops harmlessly at `find_disk`.
+const ABSENT_DISK: &str = "/nonexistent/rustfs-signature-e2e-disk";
+
+/// Wire names of the v2 and replay-scope headers these black-box tests edit. They are
+/// `pub(crate)` in ecstore, so they are repeated here rather than imported.
+/// [`overwrite_header`] asserts the header it replaces was actually present, which turns a
+/// rename into a loud failure instead of silently reducing an attack to a no-op.
+const CONTENT_SHA256_HEADER: &str = "x-rustfs-content-sha256";
+const NONCE_HEADER: &str = "x-rustfs-rpc-nonce";
+const TIMESTAMP_HEADER: &str = "x-rustfs-timestamp";
+const BOOT_EPOCH_CHALLENGE_HEADER: &str = "x-rustfs-rpc-boot-epoch-challenge";
+
+/// gRPC service name carried in the signed scope, i.e. `TONIC_RPC_PREFIX`
+/// without its leading `/`.
+fn node_service_name() -> &'static str {
+    TONIC_RPC_PREFIX.trim_start_matches('/')
+}
+
+/// Make the RPC secret of this test process match the child server's.
+///
+/// The secret lands in a process-wide `OnceLock`, so the first writer wins for
+/// the whole test binary. Every test here uses the same constant, and the
+/// assertion turns a cross-test collision into an explicit failure instead of a
+/// confusing wall of signature rejections.
+fn align_rpc_secret_with_server() {
+    let _ = rustfs_credentials::set_global_rpc_secret(TEST_RPC_SECRET.to_string());
+    let effective = rustfs_credentials::try_get_rpc_token().expect("RPC secret must resolve in the test process");
+    assert_eq!(
+        effective, TEST_RPC_SECRET,
+        "another test in this binary already fixed a different process-wide RPC secret; \
+         the signature tests cannot mint requests the child server will accept"
+    );
+}
+
+/// Start a `rustfs` child process sharing [`TEST_RPC_SECRET`], with the rollout
+/// posture pinned explicitly.
+///
+/// The child inherits the ambient environment, so the strict gates and the
+/// replay-cache capacity are set here rather than assumed: a developer or CI
+/// runner exporting `RUSTFS_INTERNODE_RPC_*` would otherwise silently flip the
+/// posture and fail these tests for a non-security reason. `extra_env` is
+/// applied last so the strict tests can still override.
+///
+/// Uses the no-cleanup spawn so a `pkill` pattern cannot reap servers belonging
+/// to other tests running in the same binary.
+fn server_env(extra_env: &[(&'static str, &'static str)]) -> Vec<(&'static str, &'static str)> {
+    let mut child_env = vec![
+        ("RUSTFS_RPC_SECRET", TEST_RPC_SECRET),
+        (ENV_INTERNODE_RPC_SIGNATURE_STRICT, "false"),
+        (ENV_INTERNODE_RPC_BODY_DIGEST_STRICT, "false"),
+        (ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT, "false"),
+        (ENV_INTERNODE_RPC_REPLAY_CACHE_CAPACITY, "1048576"),
+    ];
+    child_env.extend_from_slice(extra_env);
+    child_env
+}
+
+async fn start_server_with_env(child_env: &[(&str, &str)]) -> Result<RustFSTestEnvironment, Box<dyn Error + Send + Sync>> {
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server_without_cleanup_with_env(child_env).await?;
+    Ok(env)
+}
+
+async fn start_server(extra_env: &[(&'static str, &'static str)]) -> Result<RustFSTestEnvironment, Box<dyn Error + Send + Sync>> {
+    start_server_with_env(&server_env(extra_env)).await
+}
+
+/// Stop the child and drop the cached gRPC channel for its address.
+///
+/// `node_service_time_out_client_no_auth` memoises channels in a process-global
+/// map keyed by URL, and ports handed out by `find_available_port` can recur
+/// within one test binary. Evicting here keeps a later test from inheriting a
+/// channel aimed at this test's dead server.
+async fn stop_server(mut env: RustFSTestEnvironment, url: &str) {
+    env.stop_server();
+    rustfs_protos::evict_failed_connection(url).await;
+}
+
+/// The audience the server binds into the v2 signature: its own node authority.
+///
+/// A single-node server started with `--address 127.0.0.1:PORT` over filesystem
+/// endpoints has no URL peer set, so `init_local_peer` falls back to
+/// `host:port` — exactly the address we dialed. The positive controls below
+/// fail loudly if that ever stops holding.
+fn audience_of(env: &RustFSTestEnvironment) -> String {
+    env.address.clone()
+}
+
+fn hex_sha256(bytes: &[u8]) -> String {
+    Sha256::digest(bytes).iter().fold(String::new(), |mut acc, byte| {
+        use std::fmt::Write as _;
+        let _ = write!(acc, "{byte:02x}");
+        acc
+    })
+}
+
+fn make_volume_request(volume: &str) -> MakeVolumeRequest {
+    MakeVolumeRequest {
+        disk: ABSENT_DISK.to_string(),
+        volume: volume.to_string(),
+    }
+}
+
+fn canonical_digest(request: &MakeVolumeRequest) -> String {
+    hex_sha256(&canonical_make_volume_request_body(request).expect("canonical body must encode"))
+}
+
+/// Mint a full v2 header set for `(audience, rpc_method, content_sha256)`.
+///
+/// This is the only place a signature is produced. Tests treat the returned map
+/// as an opaque captured artifact.
+fn mint_v2_headers(audience: &str, rpc_method: &str, content_sha256: Option<&str>) -> HeaderMap {
+    gen_tonic_signature_headers(audience, node_service_name(), rpc_method, content_sha256)
+        .expect("minting a v2 signature must succeed once the RPC secret is aligned")
+}
+
+/// Mint the pre-v2 header set: a signature over the fixed
+/// `TONIC_RPC_PREFIX|GET|timestamp` constant, with no v2 headers at all. This is
+/// both what an un-upgraded peer sends and what an attacker sends to force a
+/// downgrade.
+fn mint_legacy_only_headers() -> HeaderMap {
+    gen_signature_headers(TONIC_RPC_PREFIX, &Method::GET).expect("minting a legacy signature must succeed")
+}
+
+/// Replace one header of a captured set, asserting it was there to begin with.
+fn overwrite_header(headers: &mut HeaderMap, name: &'static str, value: &str) {
+    assert!(
+        headers.contains_key(name),
+        "minted headers must carry {name}; the wire contract changed and this attack would edit nothing"
+    );
+    headers.insert(name, value.parse().expect("header value must be valid"));
+}
+
+/// Send `request` to the server's NodeService with exactly `headers` attached
+/// and nothing else — no interceptor adds or rewrites auth metadata, so the
+/// bytes on the wire are the ones the test chose.
+async fn call_make_volume(url: &str, request: MakeVolumeRequest, headers: HeaderMap) -> Result<MakeVolumeResponse, Status> {
+    call_make_volume_response(url, request, headers)
+        .await
+        .map(Response::into_inner)
+}
+
+async fn call_make_volume_response(
+    url: &str,
+    request: MakeVolumeRequest,
+    headers: HeaderMap,
+) -> Result<Response<MakeVolumeResponse>, Status> {
+    let mut client = node_service_time_out_client_no_auth(&url.to_string())
+        .await
+        .map_err(|err| Status::unavailable(format!("cannot reach the node service: {err}")))?;
+    let mut rpc_request = Request::new(request);
+    rpc_request.metadata_mut().as_mut().extend(headers);
+    client.make_volume(rpc_request).await
+}
+
+async fn call_ping_response(url: &str, headers: HeaderMap) -> Result<Response<PingResponse>, Status> {
+    let mut client = node_service_time_out_client_no_auth(&url.to_string())
+        .await
+        .map_err(|err| Status::unavailable(format!("cannot reach the node service: {err}")))?;
+    let mut rpc_request = Request::new(PingRequest {
+        version: 1,
+        body: bytes::Bytes::new(),
+    });
+    rpc_request.metadata_mut().as_mut().extend(headers);
+    client.ping(rpc_request).await
+}
+
+fn attach_boot_epoch_challenge(headers: &mut HeaderMap) -> Uuid {
+    let challenge = Uuid::new_v4();
+    headers.insert(
+        BOOT_EPOCH_CHALLENGE_HEADER,
+        challenge.to_string().parse().expect("UUID must be a valid header value"),
+    );
+    challenge
+}
+
+fn mint_replay_scope_headers(audience: &str, path: &str, content_sha256: &str, boot_epoch: Uuid) -> HeaderMap {
+    let mut headers = mint_v2_headers(audience, "MakeVolume", Some(content_sha256));
+    let timestamp = headers
+        .get(TIMESTAMP_HEADER)
+        .and_then(|value| value.to_str().ok())
+        .expect("v2 headers must carry a timestamp")
+        .to_string();
+    headers.extend(
+        gen_tonic_replay_scope_headers(audience, path, &timestamp, content_sha256, boot_epoch)
+            .expect("replay-scope headers must mint with the aligned RPC secret"),
+    );
+    headers
+}
+
+async fn learn_boot_epoch_from_make_volume(url: &str, audience: &str) -> Uuid {
+    let request = make_volume_request("signature-e2e-epoch-bootstrap");
+    let mut headers = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&request)));
+    let challenge = attach_boot_epoch_challenge(&mut headers);
+    let response = call_make_volume_response(url, request, headers)
+        .await
+        .expect("v2 request with epoch challenge must clear default authentication");
+    let boot_epoch = verify_tonic_boot_epoch_response(audience, challenge, response.metadata().as_ref())
+        .expect("server must HMAC-authenticate the advertised boot epoch");
+    assert_authenticated(
+        Ok(response.into_inner()),
+        "a v2 epoch-challenge request in the default replay-scope posture",
+    );
+    boot_epoch
+}
+
+async fn learn_boot_epoch_from_ping(url: &str, audience: &str) -> Uuid {
+    let mut headers = mint_v2_headers(audience, "Ping", None);
+    let challenge = attach_boot_epoch_challenge(&mut headers);
+    let response = call_ping_response(url, headers)
+        .await
+        .expect("v2 Ping with an epoch challenge must bootstrap strict replay scope");
+    verify_tonic_boot_epoch_response(audience, challenge, response.metadata().as_ref())
+        .expect("strict replay-scope Ping must return a valid boot epoch proof")
+}
+
+/// Assert a call cleared authentication.
+///
+/// Receiving *any* `Ok` response is the load-bearing signal: both auth layers
+/// reject with a `Status`, so an `Ok` means the request reached handler logic.
+/// The failed disk lookup underneath is what keeps it side-effect free.
+fn assert_authenticated(result: Result<MakeVolumeResponse, Status>, context: &str) {
+    match result {
+        Ok(response) => {
+            assert!(
+                !response.success,
+                "{context}: the absent disk {ABSENT_DISK} must not yield a successful volume creation"
+            );
+            assert!(
+                response.error.is_some(),
+                "{context}: expected the request to reach disk lookup and fail there, got no error"
+            );
+        }
+        Err(status) => panic!(
+            "{context}: the request must clear authentication, but was rejected with {:?}: {}",
+            status.code(),
+            status.message()
+        ),
+    }
+}
+
+/// Assert a call was rejected, optionally pinning which check spoke.
+///
+/// `PermissionDenied` responses carry the reason on the wire, so the digest
+/// tests pin it and cannot be satisfied by an unrelated digest-gate failure.
+/// `Unauthenticated` is deliberately generic on the wire; those tests pin their
+/// cause structurally instead, by differing from a passing request in exactly
+/// one respect.
+fn assert_rejected(result: Result<MakeVolumeResponse, Status>, expected: Code, expected_message: Option<&str>, context: &str) {
+    match result {
+        Ok(response) => panic!(
+            "{context}: the request must be rejected, but the server accepted it and ran the handler \
+             (success={}, error={:?})",
+            response.success, response.error
+        ),
+        Err(status) => {
+            assert_eq!(
+                status.code(),
+                expected,
+                "{context}: expected {expected:?}, got {:?}: {}",
+                status.code(),
+                status.message()
+            );
+            if let Some(needle) = expected_message {
+                assert!(
+                    status.message().contains(needle),
+                    "{context}: expected the rejection to cite {needle:?}, got {:?}",
+                    status.message()
+                );
+            }
+        }
+    }
+}
+
+/// Default posture (both strict gates off): the protections that hold without
+/// any operator flip.
+///
+/// Grouped into one server start because each case is independent and spawning
+/// a `rustfs` process per assertion would dominate the runtime.
+#[tokio::test]
+#[serial]
+async fn internode_rpc_signature_default_posture_e2e() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let env = start_server(&[]).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+
+    signed_mutations_are_accepted(&url, &audience).await;
+    unsigned_request_is_rejected(&url).await;
+    cross_method_signature_transplant_is_rejected(&url, &audience).await;
+    nonce_replay_of_a_captured_mutation_is_rejected(&url, &audience).await;
+    swapping_in_a_fresh_nonce_is_rejected(&url, &audience).await;
+    tampered_mutation_body_is_rejected(&url, &audience).await;
+    rewriting_the_digest_to_match_a_tampered_body_is_rejected(&url, &audience).await;
+    signature_minted_for_another_node_is_rejected(&url).await;
+    legacy_only_signature_is_accepted_in_default_posture(&url).await;
+
+    stop_server(env, &url).await;
+    Ok(())
+}
+
+/// A replay-scoped signature is usable exactly once against the exact gRPC path and the server
+/// process epoch that minted it. This crosses the child-process boundary twice: the HMAC-protected
+/// epoch is learned from a real response, then the same server is restarted in place to prove its
+/// replacement epoch rejects the captured request even though the nonce cache is necessarily new.
+#[tokio::test]
+#[serial]
+async fn replay_scope_rejects_replay_path_transplant_and_stale_epoch_e2e() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let child_env = server_env(&[]);
+    let mut env = start_server_with_env(&child_env).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+    let boot_epoch = learn_boot_epoch_from_make_volume(&url, &audience).await;
+
+    let request = make_volume_request("replay-scope-e2e-once");
+    let captured = mint_replay_scope_headers(
+        &audience,
+        &format!("{TONIC_RPC_PREFIX}/MakeVolume"),
+        &canonical_digest(&request),
+        boot_epoch,
+    );
+    assert_authenticated(
+        call_make_volume(&url, request.clone(), captured.clone()).await,
+        "the first replay-scoped mutation delivery",
+    );
+    assert_rejected(
+        call_make_volume(&url, request.clone(), captured).await,
+        Code::Unauthenticated,
+        None,
+        "the same replay-scoped mutation delivered twice",
+    );
+
+    let transplanted =
+        mint_replay_scope_headers(&audience, &format!("{TONIC_RPC_PREFIX}/Ping"), &canonical_digest(&request), boot_epoch);
+    assert_rejected(
+        call_make_volume(&url, request.clone(), transplanted).await,
+        Code::Unauthenticated,
+        None,
+        "a replay-scoped Ping signature transplanted onto MakeVolume",
+    );
+
+    let stale_epoch = mint_replay_scope_headers(
+        &audience,
+        &format!("{TONIC_RPC_PREFIX}/MakeVolume"),
+        &canonical_digest(&request),
+        boot_epoch,
+    );
+    env.restart_server_preserving_data(Vec::new(), &child_env).await?;
+    rustfs_protos::evict_failed_connection(&url).await;
+    assert_rejected(
+        call_make_volume(&url, request.clone(), stale_epoch).await,
+        Code::Unauthenticated,
+        None,
+        "a replay-scoped signature captured before the receiving process restart",
+    );
+
+    let restarted_epoch = learn_boot_epoch_from_make_volume(&url, &audience).await;
+    assert_ne!(boot_epoch, restarted_epoch, "a restarted child process must advertise a new boot epoch");
+    let fresh_epoch = mint_replay_scope_headers(
+        &audience,
+        &format!("{TONIC_RPC_PREFIX}/MakeVolume"),
+        &canonical_digest(&request),
+        restarted_epoch,
+    );
+    assert_authenticated(
+        call_make_volume(&url, request, fresh_epoch).await,
+        "a replay-scoped mutation signed with the replacement process epoch",
+    );
+
+    stop_server(env, &url).await;
+    Ok(())
+}
+
+/// Strict replay scope leaves one authenticated v2 bootstrap: `Ping` carrying a fresh challenge.
+/// A mutating v2 request cannot use that lane; once the epoch proof is returned, the first v3
+/// mutation succeeds. This protects a server restart without reopening a general downgrade path.
+#[tokio::test]
+#[serial]
+async fn replay_scope_strict_requires_v3_after_ping_bootstrap_e2e() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let env = start_server(&[(ENV_INTERNODE_RPC_REPLAY_SCOPE_STRICT, "true")]).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+
+    let v2_request = make_volume_request("replay-scope-e2e-strict-v2");
+    assert_rejected(
+        call_make_volume(
+            &url,
+            v2_request.clone(),
+            mint_v2_headers(&audience, "MakeVolume", Some(&canonical_digest(&v2_request))),
+        )
+        .await,
+        Code::Unauthenticated,
+        None,
+        "a v2 mutation after replay-scope strictness is enabled",
+    );
+
+    let boot_epoch = learn_boot_epoch_from_ping(&url, &audience).await;
+    let request = make_volume_request("replay-scope-e2e-strict-v3");
+    let replay_scoped = mint_replay_scope_headers(
+        &audience,
+        &format!("{TONIC_RPC_PREFIX}/MakeVolume"),
+        &canonical_digest(&request),
+        boot_epoch,
+    );
+    assert_authenticated(
+        call_make_volume(&url, request, replay_scoped).await,
+        "a replay-scoped mutation after Ping bootstrap under strict replay scope",
+    );
+
+    stop_server(env, &url).await;
+    Ok(())
+}
+
+/// Baseline: correctly signed mutations are accepted, both with and without a
+/// body digest.
+///
+/// These anchor every rejection below. The body-bound case proves the audience
+/// the server verifies against really is the address we dialed. The digestless
+/// case is the control the transplant test needs: without it, a regression that
+/// rejected every `UNSIGNED-PAYLOAD` request would make the transplant
+/// assertion pass for entirely the wrong reason. It also documents that the
+/// default posture still serves digestless mutations.
+async fn signed_mutations_are_accepted(url: &str, audience: &str) {
+    let bound = make_volume_request("signature-e2e-control-bound");
+    let bound_headers = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&bound)));
+    assert_authenticated(
+        call_make_volume(url, bound, bound_headers).await,
+        "a correctly signed body-bound mutation",
+    );
+
+    let digestless = make_volume_request("signature-e2e-control-digestless");
+    let digestless_headers = mint_v2_headers(audience, "MakeVolume", None);
+    assert_authenticated(
+        call_make_volume(url, digestless, digestless_headers).await,
+        "a correctly signed digestless mutation in the default posture",
+    );
+}
+
+/// A request with no auth metadata at all must never reach a handler.
+async fn unsigned_request_is_rejected(url: &str) {
+    let result = call_make_volume(url, make_volume_request("signature-e2e-unsigned"), HeaderMap::new()).await;
+    assert_rejected(result, Code::Unauthenticated, None, "an entirely unsigned mutation");
+}
+
+/// GHSA-c667 class: a signature captured from one gRPC method must not be
+/// replayable onto another.
+///
+/// Before method-path binding every NodeService call signed the same constant,
+/// so a captured `Ping` — the cheapest, least privileged call on the service —
+/// authenticated a `MakeVolume` just as well. The captured `Ping` signature is
+/// transplanted verbatim; the server recomputes the scope with
+/// `rpc_method = MakeVolume` and the HMAC no longer matches. It differs from the
+/// accepted digestless control above only in the method it was minted for.
+async fn cross_method_signature_transplant_is_rejected(url: &str, audience: &str) {
+    let captured_ping = mint_v2_headers(audience, "Ping", None);
+    let result = call_make_volume(url, make_volume_request("signature-e2e-transplant"), captured_ping).await;
+    assert_rejected(
+        result,
+        Code::Unauthenticated,
+        None,
+        "a Ping signature transplanted onto a MakeVolume mutation",
+    );
+}
+
+/// A body-bound mutation must be consumable exactly once.
+///
+/// The first send establishes that the captured artifact is genuinely valid —
+/// without it, the second rejection could just mean the headers were malformed
+/// all along. The replay reuses the identical `(signature, timestamp, nonce)`
+/// well inside the freshness window, so only the server's replay cache can
+/// stop it.
+async fn nonce_replay_of_a_captured_mutation_is_rejected(url: &str, audience: &str) {
+    let request = make_volume_request("signature-e2e-replay");
+    let captured = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&request)));
+
+    let first = call_make_volume(url, request.clone(), captured.clone()).await;
+    assert_authenticated(first, "the captured mutation on its first delivery");
+
+    let replayed = call_make_volume(url, request, captured).await;
+    assert_rejected(
+        replayed,
+        Code::Unauthenticated,
+        None,
+        "the same captured mutation replayed after its nonce was consumed",
+    );
+}
+
+/// The nonce must be *signed*, not merely remembered.
+///
+/// A replay cache alone would be trivially defeated: swap in a fresh UUID and
+/// the cache has never seen it. This request is byte-identical to one the server
+/// would accept apart from that one header, so it can only be stopped by the
+/// nonce being inside the signed scope.
+async fn swapping_in_a_fresh_nonce_is_rejected(url: &str, audience: &str) {
+    let request = make_volume_request("signature-e2e-nonce-swap");
+    let mut captured = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&request)));
+    overwrite_header(&mut captured, NONCE_HEADER, &Uuid::new_v4().to_string());
+
+    let result = call_make_volume(url, request, captured).await;
+    assert_rejected(
+        result,
+        Code::Unauthenticated,
+        None,
+        "a captured mutation resent under a freshly minted nonce",
+    );
+}
+
+/// Editing the body of a captured request must invalidate it, in the default
+/// posture, with no operator flip required.
+///
+/// The headers are left byte-identical — including the signed digest of the
+/// original body — so `check_auth` still passes. Only the handler, recomputing
+/// the canonical body from the fields it actually received, can catch this. It
+/// is the test that fails if a handler ever loses its digest gate.
+async fn tampered_mutation_body_is_rejected(url: &str, audience: &str) {
+    let signed = make_volume_request("signature-e2e-tamper-a");
+    let captured = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&signed)));
+
+    // Exactly one byte of the volume name differs from what the digest covers.
+    let tampered = make_volume_request("signature-e2e-tamper-b");
+    let result = call_make_volume(url, tampered, captured).await;
+    assert_rejected(
+        result,
+        Code::PermissionDenied,
+        Some("RPC content SHA-256 mismatch"),
+        "a mutation whose body was edited after signing",
+    );
+}
+
+/// The body digest must be *inside the signed scope*, not merely cross-checked
+/// by the handler.
+///
+/// This is the same tampered body as above, except the attacker also repairs the
+/// digest header so it matches what it sends — defeating the handler's
+/// comparison. The only thing left standing is the signature, which covers the
+/// digest header itself. Drop `content_sha256` from `update_signature_v2` and
+/// this is the test that goes green when it should not.
+async fn rewriting_the_digest_to_match_a_tampered_body_is_rejected(url: &str, audience: &str) {
+    let signed = make_volume_request("signature-e2e-scope-a");
+    let mut captured = mint_v2_headers(audience, "MakeVolume", Some(&canonical_digest(&signed)));
+
+    let tampered = make_volume_request("signature-e2e-scope-b");
+    overwrite_header(&mut captured, CONTENT_SHA256_HEADER, &canonical_digest(&tampered));
+
+    let result = call_make_volume(url, tampered, captured).await;
+    assert_rejected(
+        result,
+        Code::Unauthenticated,
+        None,
+        "a tampered mutation whose digest header was repaired to match",
+    );
+}
+
+/// A signature is bound to its destination node, so a request captured against
+/// one node cannot be aimed at another.
+///
+/// `127.0.0.1:1` stands in for a different peer; the audience is inside the
+/// HMAC, so the server's own authority no longer reproduces it.
+async fn signature_minted_for_another_node_is_rejected(url: &str) {
+    let request = make_volume_request("signature-e2e-wrong-node");
+    let headers = mint_v2_headers("127.0.0.1:1", "MakeVolume", Some(&canonical_digest(&request)));
+    let result = call_make_volume(url, request, headers).await;
+    assert_rejected(result, Code::Unauthenticated, None, "a signature minted for a different node");
+}
+
+/// Rolling-upgrade compatibility: a peer that predates v2 must still be served
+/// while the strict gates are off.
+///
+/// This is the case the issue insists must not fail closed during an upgrade.
+/// It is also, honestly, the open downgrade window: an attacker can strip the
+/// v2 headers and land here too. That window is what
+/// [`signature_strict_rejects_legacy_only_downgrade`] closes.
+async fn legacy_only_signature_is_accepted_in_default_posture(url: &str) {
+    let result = call_make_volume(url, make_volume_request("signature-e2e-legacy"), mint_legacy_only_headers()).await;
+    assert_authenticated(result, "a legacy-only signature in the default posture");
+}
+
+/// With `RUSTFS_INTERNODE_RPC_SIGNATURE_STRICT` on, the legacy downgrade lane is
+/// closed: the exact request accepted in the default posture is now refused.
+///
+/// The paired v2 positive control rules out "strict simply breaks everything".
+#[tokio::test]
+#[serial]
+async fn signature_strict_rejects_legacy_only_downgrade() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let env = start_server(&[(ENV_INTERNODE_RPC_SIGNATURE_STRICT, "true")]).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+
+    let downgraded = call_make_volume(&url, make_volume_request("signature-e2e-strict-legacy"), mint_legacy_only_headers()).await;
+    assert_rejected(
+        downgraded,
+        Code::Unauthenticated,
+        None,
+        "a legacy-only signature once signature-strict is enabled",
+    );
+
+    let request = make_volume_request("signature-e2e-strict-v2");
+    let signed = mint_v2_headers(&audience, "MakeVolume", Some(&canonical_digest(&request)));
+    assert_authenticated(
+        call_make_volume(&url, request, signed).await,
+        "a v2-signed mutation under signature-strict",
+    );
+
+    stop_server(env, &url).await;
+    Ok(())
+}
+
+/// With `RUSTFS_INTERNODE_RPC_BODY_DIGEST_STRICT` on, any mutation that arrives
+/// without a body digest is refused — including one that downgraded all the way
+/// to the legacy signature.
+///
+/// This gate converges independently of the signature gate, so it is exercised
+/// on its own server with signature-strict left off. Both rejected requests
+/// clear `check_auth` on their own terms (one is properly v2-signed, the other
+/// takes the still-open legacy lane), which is what pins the rejection to the
+/// handler's digest gate; the cited message confirms which check spoke.
+#[tokio::test]
+#[serial]
+async fn body_digest_strict_rejects_digestless_mutation() -> TestResult {
+    init_logging();
+    align_rpc_secret_with_server();
+    let env = start_server(&[(ENV_INTERNODE_RPC_BODY_DIGEST_STRICT, "true")]).await?;
+    let url = env.url.clone();
+    let audience = audience_of(&env);
+
+    let digestless = mint_v2_headers(&audience, "MakeVolume", None);
+    assert_rejected(
+        call_make_volume(&url, make_volume_request("signature-e2e-digestless"), digestless).await,
+        Code::PermissionDenied,
+        Some("RPC mutation requires a body-bound v2 signature"),
+        "a v2-signed but digestless mutation once body-digest-strict is enabled",
+    );
+
+    assert_rejected(
+        call_make_volume(&url, make_volume_request("signature-e2e-digestless-legacy"), mint_legacy_only_headers()).await,
+        Code::PermissionDenied,
+        Some("RPC mutation requires a body-bound v2 signature"),
+        "a v1-downgraded mutation once body-digest-strict is enabled",
+    );
+
+    let request = make_volume_request("signature-e2e-digest-bound");
+    let bound = mint_v2_headers(&audience, "MakeVolume", Some(&canonical_digest(&request)));
+    assert_authenticated(
+        call_make_volume(&url, request, bound).await,
+        "a body-bound mutation under body-digest-strict",
+    );
+
+    stop_server(env, &url).await;
+    Ok(())
+}
@@ -29,6 +29,11 @@ use aws_sdk_s3::Client;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::ServerSideEncryption;
 use base64::{Engine, engine::general_purpose::STANDARD as BASE64};
+use http::header::{CONTENT_TYPE, HOST};
+use md5::{Digest as Md5Digest, Md5};
+use rustfs_signer::constants::UNSIGNED_PAYLOAD;
+use rustfs_signer::sign_v4;
+use s3s::Body;
 use serde_json;
 use std::process::{Child, Command};
 use std::time::Duration;
@@ -64,7 +69,52 @@ pub fn skip_if_kms_admin_tool_unavailable(test_name: &str) -> bool {
 }

 pub fn sse_customer_key_md5_base64(key: &str) -> String {
-    BASE64.encode(md5::compute(key).0)
+    let mut hasher = Md5::new();
+    hasher.update(key.as_bytes());
+    BASE64.encode(hasher.finalize())
+}
+
+pub async fn kms_admin_request(
+    base_url: &str,
+    method: http::Method,
+    path_and_query: &str,
+    body: Option<&str>,
+    access_key: &str,
+    secret_key: &str,
+) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+    let url = format!("{base_url}{path_and_query}");
+    let uri = url.parse::<http::Uri>()?;
+    let authority = uri.authority().ok_or("KMS admin URL missing authority")?.to_string();
+    let mut builder = http::Request::builder()
+        .method(method.clone())
+        .uri(uri)
+        .header(HOST, authority)
+        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
+    if body.is_some() {
+        builder = builder.header(CONTENT_TYPE, "application/json");
+    }
+
+    let content_len = match body {
+        Some(value) => i64::try_from(value.len())?,
+        None => 0,
+    };
+    let signed = sign_v4(builder.body(Body::empty())?, content_len, access_key, secret_key, "", "us-east-1");
+
+    let mut request = local_http_client().request(method.clone(), &url);
+    for (name, value) in signed.headers() {
+        request = request.header(name, value);
+    }
+    if let Some(value) = body {
+        request = request.body(value.to_owned());
+    }
+
+    let response = request.send().await?;
+    let status = response.status();
+    let response_body = response.text().await?;
+    if !status.is_success() {
+        return Err(format!("{method} {path_and_query} failed with {status}: {response_body}").into());
+    }
+    Ok(response_body)
 }

 // KMS-specific helper functions
@@ -75,8 +125,19 @@ pub async fn configure_kms(
    access_key: &str,
    secret_key: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let url = format!("{base_url}/rustfs/admin/v3/kms/configure");
-    awscurl_post(&url, config_json, access_key, secret_key).await?;
+    let response = kms_admin_request(
+        base_url,
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/configure",
+        Some(config_json),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let response: serde_json::Value = serde_json::from_str(&response)?;
+    if response["success"] != true {
+        return Err(format!("KMS configuration failed: {}", response["message"].as_str().unwrap_or("unknown error")).into());
+    }
    info!("KMS configured successfully");
    Ok(())
 }
@@ -87,8 +148,19 @@ pub async fn start_kms(
    access_key: &str,
    secret_key: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let url = format!("{base_url}/rustfs/admin/v3/kms/start");
-    awscurl_post(&url, "{}", access_key, secret_key).await?;
+    let response = kms_admin_request(
+        base_url,
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/start",
+        Some("{}"),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let response: serde_json::Value = serde_json::from_str(&response)?;
+    if response["success"] != true {
+        return Err(format!("KMS start failed: {}", response["message"].as_str().unwrap_or("unknown error")).into());
+    }
    info!("KMS started successfully");
    Ok(())
 }
@@ -99,8 +171,8 @@ pub async fn get_kms_status(
    access_key: &str,
    secret_key: &str,
 ) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
-    let url = format!("{base_url}/rustfs/admin/v3/kms/status");
-    let status = awscurl_get(&url, access_key, secret_key).await?;
+    let status =
+        kms_admin_request(base_url, http::Method::GET, "/rustfs/admin/v3/kms/status", None, access_key, secret_key).await?;
    info!("KMS status retrieved: {}", status);
    Ok(status)
 }
@@ -508,7 +580,8 @@ impl VaultTestEnvironment {
            },
            "mount_path": VAULT_TRANSIT_PATH,
            "default_key_id": VAULT_KEY_NAME,
-            "skip_tls_verify": true
+            "skip_tls_verify": true,
+            "allow_insecure_dev_defaults": true
        })
        .to_string();

@@ -657,14 +730,19 @@ pub async fn test_multipart_upload_with_config(
        .build();

    info!("🔗 Completing multipart upload");
-    let complete_output = s3_client
+    let mut complete_request = s3_client
        .complete_multipart_upload()
        .bucket(bucket)
        .key(&config.object_key)
        .upload_id(upload_id)
-        .multipart_upload(completed_multipart_upload)
-        .send()
-        .await?;
+        .multipart_upload(completed_multipart_upload);
+    if let EncryptionType::SSEC { .. } = &config.encryption_type {
+        complete_request = complete_request
+            .sse_customer_algorithm("AES256")
+            .sse_customer_key(sse_c_key_b64.as_ref().unwrap())
+            .sse_customer_key_md5(sse_c_key_md5.as_ref().unwrap());
+    }
+    let complete_output = complete_request.send().await?;

    debug!("Multipart upload finalized with ETag {:?}", complete_output.e_tag());

@@ -796,7 +874,8 @@ impl LocalKMSTestEnvironment {
            "backend_type": "Local",
            "key_dir": self.kms_keys_dir,
            "file_permissions": 0o600,
-            "default_key_id": default_key_id
+            "default_key_id": default_key_id,
+            "allow_insecure_dev_defaults": true
        })
        .to_string();

@@ -0,0 +1,460 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Configured-backend validation for the KMS admin and SSE-KMS round-trip
+//! contract tracked by rustfs/backlog#1378.
+
+use super::common::{
+    LocalKMSTestEnvironment, VAULT_KEY_NAME, VaultTestEnvironment, configure_kms, get_kms_status, kms_admin_request, start_kms,
+};
+use aws_sdk_s3::primitives::ByteStream;
+use aws_sdk_s3::types::{BucketVersioningStatus, ServerSideEncryption, VersioningConfiguration};
+use serial_test::serial;
+use std::error::Error;
+use uuid::Uuid;
+
+type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+
+async fn assert_configured_status(
+    base_url: &str,
+    access_key: &str,
+    secret_key: &str,
+    expected_backend: &str,
+    expected_default_key: &str,
+) -> TestResult {
+    let body = get_kms_status(base_url, access_key, secret_key).await?;
+    let status: serde_json::Value = serde_json::from_str(&body)?;
+    assert_eq!(status["backend_type"], expected_backend);
+    assert_eq!(status["backend_status"], "healthy");
+    assert_eq!(status["default_key_id"], expected_default_key);
+    Ok(())
+}
+
+async fn create_and_verify_key(
+    base_url: &str,
+    access_key: &str,
+    secret_key: &str,
+) -> Result<String, Box<dyn Error + Send + Sync>> {
+    let create_body = serde_json::json!({
+        "key_usage": "EncryptDecrypt",
+        "description": "configured KMS round-trip e2e key",
+        "tags": {
+            "test": "backlog-1378"
+        }
+    })
+    .to_string();
+    let created = kms_admin_request(
+        base_url,
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys",
+        Some(&create_body),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let created: serde_json::Value = serde_json::from_str(&created)?;
+    assert_eq!(created["success"], true);
+    let key_id = created["key_id"]
+        .as_str()
+        .ok_or("create KMS key response omitted key_id")?
+        .to_string();
+
+    let described = kms_admin_request(
+        base_url,
+        http::Method::GET,
+        &format!("/rustfs/admin/v3/kms/keys/{key_id}"),
+        None,
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let described: serde_json::Value = serde_json::from_str(&described)?;
+    assert_eq!(described["success"], true);
+    assert_eq!(described["key_metadata"]["key_id"], key_id);
+    assert_eq!(described["key_metadata"]["key_state"], "Enabled");
+
+    let listed =
+        kms_admin_request(base_url, http::Method::GET, "/rustfs/admin/v3/kms/keys", None, access_key, secret_key).await?;
+    let listed: serde_json::Value = serde_json::from_str(&listed)?;
+    let keys = listed["keys"].as_array().ok_or("list KMS keys response omitted keys")?;
+    assert!(keys.iter().any(|key| key["key_id"] == key_id), "created KMS key must appear in list");
+    Ok(key_id)
+}
+
+async fn assert_key_deletion_lifecycle(base_url: &str, access_key: &str, secret_key: &str, key_id: &str) -> TestResult {
+    let scheduled = kms_admin_request(
+        base_url,
+        http::Method::DELETE,
+        "/rustfs/admin/v3/kms/keys/delete",
+        Some(
+            &serde_json::json!({
+                "key_id": key_id,
+                "pending_window_in_days": 7,
+                "force_immediate": false
+            })
+            .to_string(),
+        ),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let scheduled: serde_json::Value = serde_json::from_str(&scheduled)?;
+    assert_eq!(scheduled["success"], true);
+    assert!(scheduled["deletion_date"].is_string());
+
+    let cancelled = kms_admin_request(
+        base_url,
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys/cancel-deletion",
+        Some(&serde_json::json!({ "key_id": key_id }).to_string()),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let cancelled: serde_json::Value = serde_json::from_str(&cancelled)?;
+    assert_eq!(cancelled["success"], true);
+    assert_eq!(cancelled["key_metadata"]["key_state"], "Enabled");
+
+    // A window outside 7-30 days is refused at the endpoint, whatever the
+    // backend: the bound is enforced once in the service, so no backend can
+    // stretch or skip it (rustfs/backlog#1585).
+    for days in [6, 31] {
+        let refused = kms_admin_request(
+            base_url,
+            http::Method::DELETE,
+            "/rustfs/admin/v3/kms/keys/delete",
+            Some(
+                &serde_json::json!({
+                    "key_id": key_id,
+                    "pending_window_in_days": days
+                })
+                .to_string(),
+            ),
+            access_key,
+            secret_key,
+        )
+        .await
+        .err()
+        .ok_or_else(|| format!("a {days}-day deletion window must be refused"))?;
+        assert!(
+            refused.to_string().contains("400 Bad Request"),
+            "a {days}-day deletion window must report a client error: {refused}"
+        );
+    }
+
+    // Immediate deletion is no longer reachable through the query string, so it
+    // fails before the service gate is even consulted.
+    let refused = kms_admin_request(
+        base_url,
+        http::Method::DELETE,
+        &format!("/rustfs/admin/v3/kms/keys/delete?keyId={key_id}&force_immediate=true"),
+        None,
+        access_key,
+        secret_key,
+    )
+    .await
+    .err()
+    .ok_or("immediate KMS key deletion must not be reachable through the query string")?;
+    assert!(
+        refused.to_string().contains("400 Bad Request"),
+        "a query-string immediate deletion must report a client error: {refused}"
+    );
+
+    // A default server refuses to skip the waiting window (rustfs/backlog#1585):
+    // immediate deletion is unrecoverable and takes every object encrypted under
+    // the key with it, so the endpoint must reject it rather than honour it.
+    let refused = kms_admin_request(
+        base_url,
+        http::Method::DELETE,
+        "/rustfs/admin/v3/kms/keys/delete",
+        Some(
+            &serde_json::json!({
+                "key_id": key_id,
+                "force_immediate": true
+            })
+            .to_string(),
+        ),
+        access_key,
+        secret_key,
+    )
+    .await
+    .err()
+    .ok_or("immediate KMS key deletion must be refused on a default server")?;
+    assert!(
+        refused.to_string().contains("400 Bad Request"),
+        "refused immediate deletion must report a client error: {refused}"
+    );
+
+    // The refused requests left the key alone, so the window-bounded path still
+    // has something to schedule.
+    let described = kms_admin_request(
+        base_url,
+        http::Method::GET,
+        &format!("/rustfs/admin/v3/kms/keys/{key_id}"),
+        None,
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let described: serde_json::Value = serde_json::from_str(&described)?;
+    assert_eq!(
+        described["key_metadata"]["key_state"], "Enabled",
+        "a refused immediate deletion must leave the key usable"
+    );
+
+    let rescheduled = kms_admin_request(
+        base_url,
+        http::Method::DELETE,
+        "/rustfs/admin/v3/kms/keys/delete",
+        Some(
+            &serde_json::json!({
+                "key_id": key_id,
+                "pending_window_in_days": 7
+            })
+            .to_string(),
+        ),
+        access_key,
+        secret_key,
+    )
+    .await?;
+    let rescheduled: serde_json::Value = serde_json::from_str(&rescheduled)?;
+    assert_eq!(rescheduled["success"], true);
+    assert!(rescheduled["deletion_date"].is_string());
+
+    let listed =
+        kms_admin_request(base_url, http::Method::GET, "/rustfs/admin/v3/kms/keys", None, access_key, secret_key).await?;
+    let listed: serde_json::Value = serde_json::from_str(&listed)?;
+    assert_eq!(listed["success"], true);
+    let keys = listed["keys"]
+        .as_array()
+        .ok_or("final list KMS keys response omitted keys after deletion")?;
+    let key = keys
+        .iter()
+        .find(|key| key["key_id"] == key_id)
+        .ok_or("a key awaiting its deletion window must still be listed")?;
+    assert_eq!(key["status"], "PendingDeletion", "a scheduled key must be pending deletion");
+    Ok(())
+}
+
+async fn assert_versioned_sse_kms_roundtrip_and_cleanup(
+    env: &crate::common::RustFSTestEnvironment,
+    key_id: &str,
+    bucket_prefix: &str,
+) -> TestResult {
+    let client = env.create_s3_client();
+    let bucket = format!("{bucket_prefix}-{}", Uuid::new_v4().simple());
+    let object = format!("configured-kms-probe/{}/object", Uuid::new_v4().simple());
+    let first_body = b"configured KMS version one";
+    let second_body = b"configured KMS version two";
+
+    client.create_bucket().bucket(&bucket).send().await?;
+    client
+        .put_bucket_versioning()
+        .bucket(&bucket)
+        .versioning_configuration(
+            VersioningConfiguration::builder()
+                .status(BucketVersioningStatus::Enabled)
+                .build(),
+        )
+        .send()
+        .await?;
+
+    let first = client
+        .put_object()
+        .bucket(&bucket)
+        .key(&object)
+        .server_side_encryption(ServerSideEncryption::AwsKms)
+        .ssekms_key_id(key_id)
+        .body(ByteStream::from_static(first_body))
+        .send()
+        .await?;
+    assert_eq!(first.server_side_encryption(), Some(&ServerSideEncryption::AwsKms));
+    assert_eq!(first.ssekms_key_id(), Some(key_id));
+    let first_version = first.version_id().ok_or("first SSE-KMS PUT omitted version_id")?.to_string();
+
+    let second = client
+        .put_object()
+        .bucket(&bucket)
+        .key(&object)
+        .server_side_encryption(ServerSideEncryption::AwsKms)
+        .ssekms_key_id(key_id)
+        .body(ByteStream::from_static(second_body))
+        .send()
+        .await?;
+    assert_eq!(second.server_side_encryption(), Some(&ServerSideEncryption::AwsKms));
+    assert_eq!(second.ssekms_key_id(), Some(key_id));
+    let second_version = second
+        .version_id()
+        .ok_or("second SSE-KMS PUT omitted version_id")?
+        .to_string();
+    assert_ne!(first_version, second_version);
+    let storage_root = std::path::Path::new(&env.temp_dir);
+    super::encryption_metadata_test::assert_storage_encrypted(storage_root, &bucket, &object, first_body);
+    super::encryption_metadata_test::assert_storage_encrypted(storage_root, &bucket, &object, second_body);
+
+    for (version_id, expected) in [
+        (&first_version, first_body.as_slice()),
+        (&second_version, second_body.as_slice()),
+    ] {
+        let response = client
+            .get_object()
+            .bucket(&bucket)
+            .key(&object)
+            .version_id(version_id)
+            .send()
+            .await?;
+        assert_eq!(response.server_side_encryption(), Some(&ServerSideEncryption::AwsKms));
+        assert_eq!(response.ssekms_key_id(), Some(key_id));
+        let actual = response.body.collect().await?.into_bytes();
+        assert_eq!(actual.len(), expected.len());
+        assert_eq!(actual.as_ref(), expected);
+    }
+
+    let marker = client.delete_object().bucket(&bucket).key(&object).send().await?;
+    assert_eq!(marker.delete_marker(), Some(true));
+    assert!(marker.version_id().is_some(), "versioned delete must create a delete marker");
+
+    let before_cleanup = client.list_object_versions().bucket(&bucket).prefix(&object).send().await?;
+    assert_eq!(
+        before_cleanup
+            .versions()
+            .iter()
+            .filter(|version| version.key() == Some(object.as_str()))
+            .count(),
+        2
+    );
+    assert_eq!(
+        before_cleanup
+            .delete_markers()
+            .iter()
+            .filter(|delete_marker| delete_marker.key() == Some(object.as_str()))
+            .count(),
+        1
+    );
+
+    client
+        .delete_object()
+        .bucket(&bucket)
+        .key(&object)
+        .customize()
+        .mutate_request(|request| {
+            request.headers_mut().insert("x-rustfs-force-delete", "true");
+        })
+        .send()
+        .await?;
+
+    let after_cleanup = client.list_object_versions().bucket(&bucket).prefix(&object).send().await?;
+    assert!(
+        after_cleanup
+            .versions()
+            .iter()
+            .all(|version| version.key() != Some(object.as_str())),
+        "force cleanup must remove every encrypted object version"
+    );
+    assert!(
+        after_cleanup
+            .delete_markers()
+            .iter()
+            .all(|delete_marker| delete_marker.key() != Some(object.as_str())),
+        "force cleanup must remove the delete marker"
+    );
+    let head_error = match client.head_object().bucket(&bucket).key(&object).send().await {
+        Ok(_) => return Err("force-cleaned probe object remained readable".into()),
+        Err(error) => error,
+    };
+    let service_error = head_error
+        .as_service_error()
+        .ok_or_else(|| format!("force-cleaned HEAD failed with a non-service error: {head_error}"))?;
+    assert!(
+        service_error.is_not_found(),
+        "force-cleaned HEAD returned the wrong service error: {service_error:?}"
+    );
+
+    client.delete_bucket().bucket(&bucket).send().await?;
+    Ok(())
+}
+
+#[tokio::test]
+#[serial]
+async fn test_configured_local_kms_admin_and_versioned_cleanup() -> TestResult {
+    let mut env = LocalKMSTestEnvironment::new().await?;
+    env.base_env.start_rustfs_server(Vec::new()).await?;
+
+    let start_error = match start_kms(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await {
+        Ok(()) => return Err("unconfigured KMS start unexpectedly succeeded".into()),
+        Err(error) => error,
+    };
+    assert!(
+        start_error.to_string().contains("no configuration provided"),
+        "unconfigured KMS start returned the wrong business error: {start_error}"
+    );
+
+    let insecure_config = serde_json::json!({
+        "backend_type": "Local",
+        "key_dir": env.kms_keys_dir,
+        "file_permissions": 0o600,
+        "default_key_id": "rustfs-e2e-test-default-key"
+    })
+    .to_string();
+    let configure_error =
+        match configure_kms(&env.base_env.url, &insecure_config, &env.base_env.access_key, &env.base_env.secret_key).await {
+            Ok(()) => return Err("insecure Local KMS configuration unexpectedly succeeded".into()),
+            Err(error) => error,
+        };
+    assert!(
+        configure_error.to_string().contains("requires a master key"),
+        "invalid Local KMS configuration returned the wrong business error: {configure_error}"
+    );
+
+    let default_key_id = env.configure_local_kms().await?;
+    start_kms(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;
+    assert_configured_status(
+        &env.base_env.url,
+        &env.base_env.access_key,
+        &env.base_env.secret_key,
+        "local",
+        &default_key_id,
+    )
+    .await?;
+    let key_id = create_and_verify_key(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;
+    assert_versioned_sse_kms_roundtrip_and_cleanup(&env.base_env, &key_id, "kms-local-configured").await?;
+    assert_key_deletion_lifecycle(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key, &key_id).await?;
+    Ok(())
+}
+
+#[tokio::test]
+#[serial]
+#[ignore = "requires a Vault binary"]
+async fn test_configured_vault_kms_admin_and_versioned_cleanup() -> TestResult {
+    let mut env = VaultTestEnvironment::new().await?;
+    env.start_vault().await?;
+    env.setup_vault_transit().await?;
+    env.start_rustfs_for_vault().await?;
+    env.configure_vault_transit_kms().await?;
+    start_kms(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;
+    assert_configured_status(
+        &env.base_env.url,
+        &env.base_env.access_key,
+        &env.base_env.secret_key,
+        "vault-transit",
+        VAULT_KEY_NAME,
+    )
+    .await?;
+
+    let key_id = create_and_verify_key(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;
+    assert_ne!(key_id, VAULT_KEY_NAME, "key lifecycle test must create a distinct Vault key");
+    assert_versioned_sse_kms_roundtrip_and_cleanup(&env.base_env, &key_id, "kms-vault-configured").await?;
+    assert_key_deletion_lifecycle(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key, &key_id).await?;
+    Ok(())
+}
@@ -0,0 +1,351 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Regression test: a same-key CopyObject that only rewrites metadata must never re-key a
+//! managed-SSE (SSE-S3 / SSE-KMS) object.
+//!
+//! On an **unversioned** bucket the handler marks a same-name copy `metadata_only`, and the
+//! store layer then updates `xl.meta` in place without touching the data blocks. The handler
+//! nevertheless strips the source encryption metadata and generates a *fresh* DEK for the
+//! destination. Combining the two writes "new DEK + old ciphertext": the object is permanently
+//! undecryptable. The fix forces a full data rewrite whenever the copy re-derives managed
+//! encryption material, so the stored bytes always match the key metadata beside them.
+//!
+//! Companion to `copy_object_version_restore_sse_test` (issue #4238), which pins the same
+//! invariant for the versioned historical-restore path.
+
+use super::common::{LocalKMSTestEnvironment, create_key_with_specific_id};
+use crate::common::init_logging;
+use aws_sdk_s3::primitives::ByteStream;
+use aws_sdk_s3::types::{
+    MetadataDirective, ServerSideEncryption, ServerSideEncryptionByDefault, ServerSideEncryptionConfiguration,
+    ServerSideEncryptionRule,
+};
+use serial_test::serial;
+use tracing::info;
+
+#[tokio::test]
+#[serial]
+async fn test_metadata_replace_self_copy_of_sse_object_stays_decryptable() {
+    init_logging();
+    info!("same-key CopyObject with REPLACE metadata must not re-key an SSE-S3 object");
+
+    let mut kms_env = LocalKMSTestEnvironment::new().await.expect("failed to create local KMS env");
+    let default_key_id = "rustfs-e2e-test-default-key";
+    let keys_dir = kms_env.kms_keys_dir.clone();
+    create_key_with_specific_id(&keys_dir, default_key_id)
+        .await
+        .expect("failed to create local KMS key");
+    kms_env
+        .base_env
+        .start_rustfs_server_with_env(
+            vec![
+                "--kms-enable",
+                "--kms-backend",
+                "local",
+                "--kms-key-dir",
+                &keys_dir,
+                "--kms-default-key-id",
+                default_key_id,
+            ],
+            &[("RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS", "true")],
+        )
+        .await
+        .expect("failed to start RustFS with local KMS");
+    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+
+    let client = kms_env.base_env.create_s3_client();
+    // Deliberately an UNVERSIONED bucket: that is the branch where the store layer can service
+    // the self-copy as a pure metadata update.
+    let bucket = "copy-object-self-copy-sse-test";
+    let key = "secrets/report.txt";
+
+    client
+        .create_bucket()
+        .bucket(bucket)
+        .send()
+        .await
+        .expect("failed to create bucket");
+
+    // Content long enough that a truncated/garbled decrypt cannot coincidentally match.
+    let content = b"encrypted payload that must survive a metadata-only self copy -- 0123456789";
+    let put = client
+        .put_object()
+        .bucket(bucket)
+        .key(key)
+        .content_type("text/plain; charset=utf-8")
+        .metadata("stage", "before")
+        .server_side_encryption(ServerSideEncryption::Aes256)
+        .body(ByteStream::from_static(content))
+        .send()
+        .await
+        .expect("PUT failed");
+    assert_eq!(put.server_side_encryption(), Some(&ServerSideEncryption::Aes256));
+
+    // Copy the object onto itself, replacing user metadata. This is the `mc cp --attr` /
+    // "edit metadata in place" shape that AWS supports on an existing object.
+    let copy_out = client
+        .copy_object()
+        .bucket(bucket)
+        .key(key)
+        .copy_source(format!("{bucket}/{key}"))
+        .metadata_directive(MetadataDirective::Replace)
+        .content_type("text/plain; charset=utf-8")
+        .metadata("stage", "after")
+        .server_side_encryption(ServerSideEncryption::Aes256)
+        .send()
+        .await
+        .expect("same-key CopyObject with REPLACE metadata must succeed");
+    assert_eq!(copy_out.server_side_encryption(), Some(&ServerSideEncryption::Aes256));
+
+    // The object must still decrypt to the original plaintext. Before the fix the stored
+    // ciphertext was left untouched while the metadata carried a brand-new DEK, so this GET
+    // either failed outright or returned garbage.
+    let get = client
+        .get_object()
+        .bucket(bucket)
+        .key(key)
+        .send()
+        .await
+        .expect("GET after self-copy failed: the object was re-keyed without rewriting the ciphertext");
+    assert_eq!(get.server_side_encryption(), Some(&ServerSideEncryption::Aes256));
+    assert_eq!(
+        get.metadata().and_then(|m| m.get("stage")),
+        Some(&"after".to_string()),
+        "REPLACE metadata must take effect"
+    );
+    let body = get.body.collect().await.expect("collect body").into_bytes();
+    assert_eq!(
+        body.as_ref(),
+        content,
+        "object must still decrypt to the original plaintext after a metadata-only self copy"
+    );
+
+    kms_env.base_env.stop_server();
+}
+
+#[tokio::test]
+#[serial]
+async fn test_metadata_replace_self_copy_dropping_sse_rewrites_plaintext() {
+    init_logging();
+    info!("same-key CopyObject that drops SSE must rewrite the data, not orphan the ciphertext");
+
+    let mut kms_env = LocalKMSTestEnvironment::new().await.expect("failed to create local KMS env");
+    let default_key_id = "rustfs-e2e-test-default-key";
+    let keys_dir = kms_env.kms_keys_dir.clone();
+    create_key_with_specific_id(&keys_dir, default_key_id)
+        .await
+        .expect("failed to create local KMS key");
+    kms_env
+        .base_env
+        .start_rustfs_server_with_env(
+            vec![
+                "--kms-enable",
+                "--kms-backend",
+                "local",
+                "--kms-key-dir",
+                &keys_dir,
+                "--kms-default-key-id",
+                default_key_id,
+            ],
+            &[("RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS", "true")],
+        )
+        .await
+        .expect("failed to start RustFS with local KMS");
+    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+
+    let client = kms_env.base_env.create_s3_client();
+    // Unversioned, and deliberately WITHOUT a bucket default-encryption rule, so the copy below
+    // resolves to "no destination encryption".
+    let bucket = "copy-object-self-copy-drop-sse-test";
+    let key = "secrets/report.txt";
+
+    client
+        .create_bucket()
+        .bucket(bucket)
+        .send()
+        .await
+        .expect("failed to create bucket");
+
+    let content = b"encrypted payload whose ciphertext must not survive as bogus plaintext -- 0123456789";
+    client
+        .put_object()
+        .bucket(bucket)
+        .key(key)
+        .metadata("stage", "before")
+        .server_side_encryption(ServerSideEncryption::Aes256)
+        .body(ByteStream::from_static(content))
+        .send()
+        .await
+        .expect("PUT failed");
+
+    // Self-copy with REPLACE and no SSE header. Per AWS semantics the destination ends up
+    // unencrypted. The dangerous outcome is the silent one: the handler strips the source key
+    // metadata while a metadata-only copy leaves the ciphertext in place, so a later GET would
+    // hand back raw ciphertext as if it were plaintext — corruption with no error anywhere.
+    client
+        .copy_object()
+        .bucket(bucket)
+        .key(key)
+        .copy_source(format!("{bucket}/{key}"))
+        .metadata_directive(MetadataDirective::Replace)
+        .metadata("stage", "after")
+        .send()
+        .await
+        .expect("same-key CopyObject dropping SSE must succeed");
+
+    let get = client
+        .get_object()
+        .bucket(bucket)
+        .key(key)
+        .send()
+        .await
+        .expect("GET after self-copy failed");
+    assert_eq!(
+        get.server_side_encryption(),
+        None,
+        "destination must be unencrypted once the copy drops SSE"
+    );
+    assert_eq!(
+        get.metadata().and_then(|m| m.get("stage")),
+        Some(&"after".to_string()),
+        "REPLACE metadata must take effect"
+    );
+    let body = get.body.collect().await.expect("collect body").into_bytes();
+    assert_eq!(
+        body.as_ref(),
+        content,
+        "object must read back as the original plaintext, not the orphaned ciphertext"
+    );
+
+    kms_env.base_env.stop_server();
+}
+
+#[tokio::test]
+#[serial]
+async fn test_metadata_replace_self_copy_under_bucket_default_sse_stays_decryptable() {
+    init_logging();
+    info!("bucket default encryption must also keep a same-key copy off the metadata-only path");
+
+    let mut kms_env = LocalKMSTestEnvironment::new().await.expect("failed to create local KMS env");
+    let default_key_id = "rustfs-e2e-test-default-key";
+    let keys_dir = kms_env.kms_keys_dir.clone();
+    create_key_with_specific_id(&keys_dir, default_key_id)
+        .await
+        .expect("failed to create local KMS key");
+    kms_env
+        .base_env
+        .start_rustfs_server_with_env(
+            vec![
+                "--kms-enable",
+                "--kms-backend",
+                "local",
+                "--kms-key-dir",
+                &keys_dir,
+                "--kms-default-key-id",
+                default_key_id,
+            ],
+            &[("RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS", "true")],
+        )
+        .await
+        .expect("failed to start RustFS with local KMS");
+    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+
+    let client = kms_env.base_env.create_s3_client();
+    let bucket = "copy-object-self-copy-bucket-default-sse-test";
+    let key = "secrets/report.txt";
+
+    client
+        .create_bucket()
+        .bucket(bucket)
+        .send()
+        .await
+        .expect("failed to create bucket");
+
+    // Store the object as PLAINTEXT first: no SSE header and no bucket default rule yet. This is
+    // what makes the case sharp — at copy time the source metadata carries no encryption markers,
+    // so the source-side half of the guard cannot fire.
+    let content = b"plaintext payload that must not be orphaned under a new DEK -- 0123456789";
+    let put = client
+        .put_object()
+        .bucket(bucket)
+        .key(key)
+        .metadata("stage", "before")
+        .body(ByteStream::from_static(content))
+        .send()
+        .await
+        .expect("PUT failed");
+    assert_eq!(put.server_side_encryption(), None, "the object must start out unencrypted");
+
+    // Only NOW enable bucket default encryption. The destination's encryption therefore comes
+    // from the bucket rule and from nowhere else: the source is unencrypted and the copy request
+    // carries no SSE header. A guard that only inspects request headers (MinIO decides
+    // `isTargetEncrypted` from `crypto.S3.IsRequested(r.Header)`) would let this through, yet
+    // `sse_encryption` still mints a fresh DEK from the resolved bucket default — which is why
+    // the guard keys off the *effective* encryption rather than the requested one.
+    let encryption_config = ServerSideEncryptionConfiguration::builder()
+        .rules(
+            ServerSideEncryptionRule::builder()
+                .apply_server_side_encryption_by_default(
+                    ServerSideEncryptionByDefault::builder()
+                        .sse_algorithm(ServerSideEncryption::Aes256)
+                        .build()
+                        .unwrap(),
+                )
+                .build(),
+        )
+        .build()
+        .unwrap();
+    client
+        .put_bucket_encryption()
+        .bucket(bucket)
+        .server_side_encryption_configuration(encryption_config)
+        .send()
+        .await
+        .expect("failed to set bucket default encryption");
+
+    // No SSE header on the copy — the bucket default alone drives the destination encryption.
+    client
+        .copy_object()
+        .bucket(bucket)
+        .key(key)
+        .copy_source(format!("{bucket}/{key}"))
+        .metadata_directive(MetadataDirective::Replace)
+        .metadata("stage", "after")
+        .send()
+        .await
+        .expect("same-key CopyObject under bucket default encryption must succeed");
+
+    let get = client
+        .get_object()
+        .bucket(bucket)
+        .key(key)
+        .send()
+        .await
+        .expect("GET after self-copy failed: the object was re-keyed without rewriting the ciphertext");
+    assert_eq!(get.server_side_encryption(), Some(&ServerSideEncryption::Aes256));
+    assert_eq!(
+        get.metadata().and_then(|m| m.get("stage")),
+        Some(&"after".to_string()),
+        "REPLACE metadata must take effect"
+    );
+    let body = get.body.collect().await.expect("collect body").into_bytes();
+    assert_eq!(
+        body.as_ref(),
+        content,
+        "object must still decrypt to the original plaintext after a metadata-only self copy"
+    );
+
+    kms_env.base_env.stop_server();
+}
@@ -42,7 +42,7 @@ fn assert_managed_encryption_metadata_hidden(metadata: Option<&HashMap<String, S
    }
 }

-fn assert_storage_encrypted(storage_root: &std::path::Path, bucket: &str, key: &str, plaintext: &[u8]) {
+pub(super) fn assert_storage_encrypted(storage_root: &std::path::Path, bucket: &str, key: &str, plaintext: &[u8]) {
    let mut stack = VecDeque::from([storage_root.to_path_buf()]);
    let mut scanned = 0;
    let mut plaintext_path: Option<std::path::PathBuf> = None;
@@ -0,0 +1,483 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Negative authorization matrix for per-key KMS access control.
+//!
+//! Every case here is an end-to-end denial that the pre-`kms` resource server
+//! allowed, so a regression that reopens one of them fails this file rather than
+//! only a unit test. The matrix varies one dimension at a time:
+//!
+//! - **wrong identity**: a caller holding S3 rights but no `kms` grant at all
+//! - **wrong key**: a caller scoped to key A naming key B
+//! - **wrong action**: a caller holding `kms:GenerateDataKey` but not `kms:Decrypt`
+//!   (and, on the admin plane, `kms:DisableKey` but not `kms:RotateKey`)
+//! - **wrong context**: an explicit `Deny` beating a wildcard `Allow`, and SSE-S3
+//!   staying exempt from `kms` authorization
+//!
+//! Each matrix opens with a positive control. Without it a denial proves nothing:
+//! an identity whose policy has not propagated yet is denied everything.
+
+use super::common::{LocalKMSTestEnvironment, create_key_with_specific_id};
+use crate::common::{admin_ok, admin_request, init_logging};
+use aws_sdk_s3::Client;
+use aws_sdk_s3::config::{Config, Credentials, Region};
+use aws_sdk_s3::error::ProvideErrorMetadata;
+use aws_sdk_s3::primitives::ByteStream;
+use aws_sdk_s3::types::ServerSideEncryption;
+use serial_test::serial;
+use std::time::Duration;
+use tracing::info;
+
+type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
+
+const ALLOWED_KEY: &str = "kms-matrix-allowed-key";
+const OTHER_KEY: &str = "kms-matrix-other-key";
+const BUCKET: &str = "kms-authz-matrix";
+const SECRET: &str = "kms-matrix-secret";
+const PAYLOAD: &[u8] = b"kms authorization matrix payload";
+
+/// How long an identity change may take to reach the request path.
+const IAM_PROPAGATION: Duration = Duration::from_secs(20);
+
+fn s3_client(url: &str, access_key: &str, secret_key: &str) -> Client {
+    let config = Config::builder()
+        .credentials_provider(Credentials::new(access_key, secret_key, None, None, "kms-authz-matrix"))
+        .region(Region::new("us-east-1"))
+        .endpoint_url(url)
+        .force_path_style(true)
+        .behavior_version_latest()
+        .build();
+    Client::from_conf(config)
+}
+
+/// Start a server whose SSE-KMS data path authorizes against the named key.
+///
+/// The enforcement switch defaults to off for compatibility, so it has to be set
+/// explicitly; without it every negative case below would silently pass as an allow.
+async fn start_enforcing_server(env: &mut LocalKMSTestEnvironment, extra_env: &[(&str, &str)]) -> TestResult {
+    create_key_with_specific_id(&env.kms_keys_dir, ALLOWED_KEY).await?;
+    create_key_with_specific_id(&env.kms_keys_dir, OTHER_KEY).await?;
+
+    let key_dir = env.kms_keys_dir.clone();
+    let args = vec![
+        "--kms-enable",
+        "--kms-backend",
+        "local",
+        "--kms-key-dir",
+        key_dir.as_str(),
+        "--kms-default-key-id",
+        ALLOWED_KEY,
+    ];
+
+    let mut envs = vec![("RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS", "true")];
+    envs.extend_from_slice(extra_env);
+
+    env.base_env.start_rustfs_server_with_env(args, &envs).await?;
+    Ok(())
+}
+
+/// Create `user` with `policy_document` attached under a canned policy of the same name.
+async fn provision_user(env: &LocalKMSTestEnvironment, user: &str, policy_document: &str) -> TestResult {
+    admin_ok(
+        &env.base_env,
+        http::Method::PUT,
+        &format!("/rustfs/admin/v3/add-canned-policy?name={user}"),
+        Some(policy_document.to_string()),
+    )
+    .await?;
+    provision_user_with_policy(env, user, user).await
+}
+
+/// Create `user` and attach an existing policy (built-in or canned) by name.
+async fn provision_user_with_policy(env: &LocalKMSTestEnvironment, user: &str, policy_name: &str) -> TestResult {
+    admin_ok(
+        &env.base_env,
+        http::Method::PUT,
+        &format!("/rustfs/admin/v3/add-user?accessKey={user}"),
+        Some(serde_json::json!({ "secretKey": SECRET, "status": "enabled" }).to_string()),
+    )
+    .await?;
+    admin_ok(
+        &env.base_env,
+        http::Method::PUT,
+        &format!("/rustfs/admin/v3/set-user-or-group-policy?policyName={policy_name}&userOrGroup={user}&isGroup=false"),
+        None,
+    )
+    .await?;
+    Ok(())
+}
+
+/// The S3 half of every data-path policy below: full object access, no KMS grant.
+fn s3_full_access_statement() -> serde_json::Value {
+    serde_json::json!({
+        "Effect": "Allow",
+        "Action": ["s3:*"],
+        "Resource": ["arn:aws:s3:::*"]
+    })
+}
+
+fn policy_document(statements: Vec<serde_json::Value>) -> String {
+    serde_json::json!({ "Version": "2012-10-17", "Statement": statements }).to_string()
+}
+
+async fn put_sse_kms(client: &Client, key: &str, kms_key_id: &str) -> Result<(), aws_sdk_s3::Error> {
+    client
+        .put_object()
+        .bucket(BUCKET)
+        .key(key)
+        .body(ByteStream::from_static(PAYLOAD))
+        .server_side_encryption(ServerSideEncryption::AwsKms)
+        .ssekms_key_id(kms_key_id)
+        .send()
+        .await
+        .map(|_| ())
+        .map_err(aws_sdk_s3::Error::from)
+}
+
+/// Assert the operation failed with `AccessDenied` rather than any other error.
+///
+/// A bare `is_err` would also accept `KMSKeyDisabled` or an internal error, which
+/// would hide both a leak of key state and an outage masquerading as a denial.
+fn assert_access_denied<T: std::fmt::Debug>(result: Result<T, aws_sdk_s3::Error>, what: &str) {
+    let error = result.expect_err(&format!("{what} must be denied"));
+    assert_eq!(error.code(), Some("AccessDenied"), "{what} must fail with AccessDenied: {error:?}");
+}
+
+/// Retry an SSE-KMS write until the identity's policy has reached the request path.
+async fn wait_for_sse_kms_write(client: &Client, key: &str, kms_key_id: &str) -> TestResult {
+    let deadline = tokio::time::Instant::now() + IAM_PROPAGATION;
+    loop {
+        match put_sse_kms(client, key, kms_key_id).await {
+            Ok(()) => return Ok(()),
+            Err(error) if tokio::time::Instant::now() >= deadline => {
+                return Err(format!("positive control never became authorized: {error:?}").into());
+            }
+            Err(_) => tokio::time::sleep(Duration::from_millis(500)).await,
+        }
+    }
+}
+
+/// Retry an admin call until it stops returning 403, i.e. the policy is live.
+async fn wait_for_admin_success(
+    env: &LocalKMSTestEnvironment,
+    user: &str,
+    method: http::Method,
+    path: &str,
+    body: Option<String>,
+) -> TestResult {
+    let deadline = tokio::time::Instant::now() + IAM_PROPAGATION;
+    loop {
+        let (status, response) = admin_request(&env.base_env.url, method.clone(), path, body.clone(), user, SECRET).await?;
+        if status.is_success() {
+            return Ok(());
+        }
+        if tokio::time::Instant::now() >= deadline {
+            return Err(format!("positive control never became authorized: {method} {path} -> {status} {response}").into());
+        }
+        tokio::time::sleep(Duration::from_millis(500)).await;
+    }
+}
+
+async fn assert_admin_denied(
+    env: &LocalKMSTestEnvironment,
+    user: &str,
+    method: http::Method,
+    path: &str,
+    body: Option<String>,
+    what: &str,
+) -> TestResult {
+    let (status, response) = admin_request(&env.base_env.url, method, path, body, user, SECRET).await?;
+    assert_eq!(status.as_u16(), 403, "{what} must be denied, got {status}: {response}");
+    assert!(response.contains("AccessDenied"), "{what} must carry AccessDenied: {response}");
+    Ok(())
+}
+
+fn disable_body(key_id: &str) -> String {
+    serde_json::json!({ "key_id": key_id }).to_string()
+}
+
+/// Data-path matrix: SSE-KMS writes and reads are authorized against the resolved key.
+#[tokio::test]
+#[serial]
+async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
+    init_logging();
+
+    let mut env = LocalKMSTestEnvironment::new().await?;
+    start_enforcing_server(&mut env, &[("RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY", "true")]).await?;
+    env.base_env.create_test_bucket(BUCKET).await?;
+
+    // Scoped to ALLOWED_KEY only.
+    provision_user(
+        &env,
+        "kmsmatrixscoped",
+        &policy_document(vec![
+            s3_full_access_statement(),
+            serde_json::json!({
+                "Effect": "Allow",
+                "Action": ["kms:GenerateDataKey", "kms:Decrypt"],
+                "Resource": [format!("arn:aws:kms:::key/{ALLOWED_KEY}")]
+            }),
+        ]),
+    )
+    .await?;
+    // S3 rights only: the identity shape that existed before per-key authorization.
+    provision_user(&env, "kmsmatrixs3only", &policy_document(vec![s3_full_access_statement()])).await?;
+    // May wrap a data key but may never unwrap one.
+    provision_user(
+        &env,
+        "kmsmatrixwriter",
+        &policy_document(vec![
+            s3_full_access_statement(),
+            serde_json::json!({
+                "Effect": "Allow",
+                "Action": ["kms:GenerateDataKey"],
+                "Resource": ["arn:aws:kms:::*"]
+            }),
+        ]),
+    )
+    .await?;
+    // Wildcard allow, explicit deny on one key.
+    provision_user(
+        &env,
+        "kmsmatrixdenied",
+        &policy_document(vec![
+            s3_full_access_statement(),
+            serde_json::json!({
+                "Effect": "Allow",
+                "Action": ["kms:*"],
+                "Resource": ["arn:aws:kms:::*"]
+            }),
+            serde_json::json!({
+                "Effect": "Deny",
+                "Action": ["kms:*"],
+                "Resource": [format!("arn:aws:kms:::key/{OTHER_KEY}")]
+            }),
+        ]),
+    )
+    .await?;
+
+    let scoped = s3_client(&env.base_env.url, "kmsmatrixscoped", SECRET);
+    let s3_only = s3_client(&env.base_env.url, "kmsmatrixs3only", SECRET);
+    let writer = s3_client(&env.base_env.url, "kmsmatrixwriter", SECRET);
+    let denied = s3_client(&env.base_env.url, "kmsmatrixdenied", SECRET);
+
+    // --- positive control -----------------------------------------------------
+    wait_for_sse_kms_write(&scoped, "scoped/allowed", ALLOWED_KEY).await?;
+    let read = scoped.get_object().bucket(BUCKET).key("scoped/allowed").send().await?;
+    assert_eq!(read.body.collect().await?.into_bytes().as_ref(), PAYLOAD);
+    info!("positive control: scoped identity may write and read under its own key");
+
+    // --- wrong key ------------------------------------------------------------
+    assert_access_denied(
+        put_sse_kms(&scoped, "scoped/other", OTHER_KEY).await,
+        "SSE-KMS write under a key outside the identity's scope",
+    );
+
+    // --- wrong identity -------------------------------------------------------
+    assert_access_denied(
+        put_sse_kms(&s3_only, "s3only/allowed", ALLOWED_KEY).await,
+        "SSE-KMS write by an identity holding no kms grant",
+    );
+    // The object the scoped identity wrote is readable by its owner only.
+    assert_access_denied(
+        s3_only
+            .get_object()
+            .bucket(BUCKET)
+            .key("scoped/allowed")
+            .send()
+            .await
+            .map(|_| ())
+            .map_err(aws_sdk_s3::Error::from),
+        "SSE-KMS read by an identity holding no kms grant",
+    );
+
+    // --- wrong action ---------------------------------------------------------
+    wait_for_sse_kms_write(&writer, "writer/allowed", ALLOWED_KEY).await?;
+    assert_access_denied(
+        writer
+            .get_object()
+            .bucket(BUCKET)
+            .key("writer/allowed")
+            .send()
+            .await
+            .map(|_| ())
+            .map_err(aws_sdk_s3::Error::from),
+        "SSE-KMS read by an identity holding kms:GenerateDataKey but not kms:Decrypt",
+    );
+
+    // --- wrong context: explicit Deny beats a wildcard Allow -------------------
+    wait_for_sse_kms_write(&denied, "denied/allowed", ALLOWED_KEY).await?;
+    assert_access_denied(
+        put_sse_kms(&denied, "denied/other", OTHER_KEY).await,
+        "SSE-KMS write under a key covered by an explicit Deny",
+    );
+
+    // --- wrong context: SSE-S3 is out of scope --------------------------------
+    // SSE-S3 wraps its data key with a server-owned key the caller never names, so
+    // it must stay reachable for an identity with no kms grant at all.
+    s3_only
+        .put_object()
+        .bucket(BUCKET)
+        .key("s3only/sse-s3")
+        .body(ByteStream::from_static(PAYLOAD))
+        .server_side_encryption(ServerSideEncryption::Aes256)
+        .send()
+        .await?;
+    let sse_s3_read = s3_only.get_object().bucket(BUCKET).key("s3only/sse-s3").send().await?;
+    assert_eq!(sse_s3_read.body.collect().await?.into_bytes().as_ref(), PAYLOAD);
+
+    // ... and so must an unencrypted object.
+    s3_only
+        .put_object()
+        .bucket(BUCKET)
+        .key("s3only/plain")
+        .body(ByteStream::from_static(PAYLOAD))
+        .send()
+        .await?;
+    s3_only.get_object().bucket(BUCKET).key("s3only/plain").send().await?;
+
+    Ok(())
+}
+
+/// Admin-plane matrix: KMS key endpoints are authorized against the key they name.
+///
+/// Runs without the SSE enforcement switch: admin scoping is unconditional, and
+/// leaving the switch off proves the two planes are independent.
+#[tokio::test]
+#[serial]
+async fn kms_admin_per_key_authorization_negative_matrix() -> TestResult {
+    init_logging();
+
+    let mut env = LocalKMSTestEnvironment::new().await?;
+    start_enforcing_server(&mut env, &[]).await?;
+
+    // Built-in role templates, attached by name.
+    provision_user_with_policy(&env, "kmsmatrixkeyadmin", "KMSKeyAdministrator").await?;
+    provision_user_with_policy(&env, "kmsmatrixauditor", "KMSAuditor").await?;
+    // A narrowed copy of the administrator template, scoped to one key.
+    provision_user(
+        &env,
+        "kmsmatrixscopedadmin",
+        &policy_document(vec![serde_json::json!({
+            "Effect": "Allow",
+            "Action": ["kms:DisableKey", "kms:EnableKey"],
+            "Resource": [format!("arn:aws:kms:::key/{ALLOWED_KEY}")]
+        })]),
+    )
+    .await?;
+
+    // --- positive control -----------------------------------------------------
+    wait_for_admin_success(
+        &env,
+        "kmsmatrixkeyadmin",
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys/disable",
+        Some(disable_body(OTHER_KEY)),
+    )
+    .await?;
+    admin_request(
+        &env.base_env.url,
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys/enable",
+        Some(disable_body(OTHER_KEY)),
+        "kmsmatrixkeyadmin",
+        SECRET,
+    )
+    .await?;
+
+    // --- wrong action: the administrator template withholds service-wide powers -
+    assert_admin_denied(
+        &env,
+        "kmsmatrixkeyadmin",
+        http::Method::GET,
+        "/rustfs/admin/v3/kms/config",
+        None,
+        "KMSKeyAdministrator reading the KMS backend configuration (kms:Configure)",
+    )
+    .await?;
+    assert_admin_denied(
+        &env,
+        "kmsmatrixkeyadmin",
+        http::Method::GET,
+        "/rustfs/admin/v3/kms/backup",
+        None,
+        "KMSKeyAdministrator exporting a backup bundle (kms:Backup)",
+    )
+    .await?;
+    // Separation of duties: managing a key never implies using it.
+    assert_admin_denied(
+        &env,
+        "kmsmatrixkeyadmin",
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/generate-data-key",
+        Some(serde_json::json!({ "key_id": ALLOWED_KEY }).to_string()),
+        "KMSKeyAdministrator generating a data key (kms:GenerateDataKey)",
+    )
+    .await?;
+
+    // --- wrong action: the auditor template is read-only ----------------------
+    wait_for_admin_success(&env, "kmsmatrixauditor", http::Method::GET, "/rustfs/admin/v3/kms/keys", None).await?;
+    assert_admin_denied(
+        &env,
+        "kmsmatrixauditor",
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys/disable",
+        Some(disable_body(ALLOWED_KEY)),
+        "KMSAuditor disabling a key (kms:DisableKey)",
+    )
+    .await?;
+
+    // --- wrong key ------------------------------------------------------------
+    wait_for_admin_success(
+        &env,
+        "kmsmatrixscopedadmin",
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys/disable",
+        Some(disable_body(ALLOWED_KEY)),
+    )
+    .await?;
+    assert_admin_denied(
+        &env,
+        "kmsmatrixscopedadmin",
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys/disable",
+        Some(disable_body(OTHER_KEY)),
+        "key-scoped administrator disabling a key outside its scope",
+    )
+    .await?;
+    // --- wrong action, same key ----------------------------------------------
+    assert_admin_denied(
+        &env,
+        "kmsmatrixscopedadmin",
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys/rotate",
+        Some(disable_body(ALLOWED_KEY)),
+        "key-scoped administrator rotating a key it may only enable and disable",
+    )
+    .await?;
+
+    // --- wrong identity -------------------------------------------------------
+    provision_user(&env, "kmsmatrixnokms", &policy_document(vec![s3_full_access_statement()])).await?;
+    assert_admin_denied(
+        &env,
+        "kmsmatrixnokms",
+        http::Method::POST,
+        "/rustfs/admin/v3/kms/keys/disable",
+        Some(disable_body(ALLOWED_KEY)),
+        "identity holding no kms grant disabling a key",
+    )
+    .await?;
+
+    Ok(())
+}
@@ -25,12 +25,18 @@ use super::common::{LocalKMSTestEnvironment, sse_customer_key_md5_base64};
 use crate::common::{TEST_BUCKET, init_logging};
 use aws_sdk_s3::types::ServerSideEncryption;
 use base64::Engine;
-use md5::compute;
+use md5::{Digest as Md5Digest, Md5};
 use serial_test::serial;
 use std::sync::Arc;
 use tokio::sync::Semaphore;
 use tracing::{info, warn};

+fn md5_hex(input: impl AsRef<[u8]>) -> String {
+    let mut hasher = Md5::new();
+    hasher.update(input.as_ref());
+    hex::encode(hasher.finalize())
+}
+
 /// Test encryption of zero-byte files (empty files)
 #[tokio::test]
 #[serial]
@@ -294,7 +300,7 @@ async fn test_kms_invalid_key_scenarios() -> Result<(), Box<dyn std::error::Erro
    info!("🔍 Testing invalid SSE-C key length");
    let invalid_short_key = "short"; // Too short
    let invalid_key_b64 = base64::engine::general_purpose::STANDARD.encode(invalid_short_key);
-    let invalid_key_md5 = format!("{:x}", compute(invalid_short_key));
+    let invalid_key_md5 = md5_hex(invalid_short_key);

    let invalid_key_result = s3_client
        .put_object()
--- a/Show More
+++ b/Show More