fix(heal): wait for held legacy responsibility in replay test

* fix(scanner): diagnose and verify pause backlog recovery

Expose the retained replica snapshot and claimed membership in abnormal
admin status responses. Keep diagnostics off metrics updates and verify
single-pool recovery and conflicting-proof preservation across 24 sets.

Co-Authored-By: heihutu <heihutu@gmail.com>
Co-Authored-By: zhi22915 <qiuzgang@gmail.com>

* refactor(scanner): move replica snapshots into diagnostics

Consume the terminal admin read snapshot in a single state match and move
membership, revision, and error buffers into the response. Verify buffer
handoff and the unchanged JSON contract without altering ledger authority.

Co-Authored-By: heihutu <heihutu@gmail.com>
Co-Authored-By: zhi22915 <qiuzgang@gmail.com>

---------

Co-authored-by: heihutu <heihutu@gmail.com>
Co-authored-by: zhi22915 <qiuzgang@gmail.com>

.agents/references/implementation.md

@@ -58,13 +58,6 @@ are repository-relative. Read only the relevant sections during read-only review
 - Attach error context once where it is actionable. Do not erase typed errors
   below aggregation or quorum layers.
 
-## Rust Boundaries
-
-- Production `unwrap`/`expect` must follow a type guarantee or checked invariant; explain only non-obvious guarantees.
-- Public APIs do not return `Result<_, String>`. Library APIs use domain errors unless intentional erasure is part of the boundary contract; expose a stored inner error through `Error::source()`.
-- Numeric conversions must not silently truncate. Use fallible conversions for untrusted values; validate finiteness, sign, and range before float-to-integer conversion. Clamp/saturate only when required by the domain.
-- Do not add crate-root `#![allow(dead_code)]`.
-
 ## Naming
 
 Use Rust API naming: `SCREAMING_SNAKE_CASE` constants/statics, `snake_case`

.agents/skills/adversarial-validation/references/concurrency-durability.md

@@ -2,12 +2,8 @@
 
 - For every changed lock, enumerate overlapping lock sets and construct the
   ABBA interleaving. Multiple-lock order must be documented and consistent.
-- Mark guard lifetimes and every `.await`, disk,
-  and RPC call; estimate contention/timeouts. Tokio read/write guards across
-  `.await` need bounded hold time; long-lived reads can wedge writers (#4195).
-  Keep `std::sync::Mutex` holds brief and never across `.await`.
-- Use direct `fetch_*` for unconditional atomic read-modify-write and
-  `compare_exchange` for conditional updates.
+- Mark guard lifetimes and every `.await`, disk, and RPC call inside them.
+  Estimate contention and timeout behavior under concurrent requests.
 - Object commits remain fenced if the distributed lock is lost after shard
   writes and before metadata rename.
 - For write/rename changes, trace `write tmp -> sync tmp -> rename -> sync parent

.agents/skills/adversarial-validation/references/correctness.md

@@ -15,8 +15,6 @@ Attack the changed behavior, not every subsystem in the repository.
   bytes and length.
 - For multipart/object commits, fail before/after rename and cleanup; committed
   data must remain readable and pre-commit cleanup must not destroy parts.
-- Bound recursion over untrusted or persisted input; handle corrupted/cyclic
-  tree and cache traversals safely.
 - For version/index ordering, test `len - 1`, `len`, equal timestamps, missing
   versions, and deterministic tie-breaking.
 - For directory-object behavior, trace `__XLDIR__` at the store layer; branches

.agents/skills/adversarial-validation/references/test-coverage.md

@@ -19,8 +19,7 @@
   serialization is required.
 - Internal metadata tests assert both RustFS and MinIO keys, not only read-back
   through a helper that prefers one key.
-- Avoid duplicate tests of the same production path and poison-value class.
-  Boundary companions are distinct coverage: `n == max` vs `max + 1`, and
+- Boundary companions are distinct coverage: `n == max` vs `max + 1`, and
   absent vs empty vs nil UUID.
 - A focused test proves only the targets/features it builds. Add compilation or
   Clippy only for uncovered changed targets.

.agents/skills/arch-checks/SKILL.md

@@ -1,5 +1,9 @@
+---
+name: arch-checks
+description: Diagnose failures from check_layer_dependencies.sh, check_architecture_migration_rules.sh, check_unsafe_code_allowances.sh, check_logging_guardrails.sh, check_doc_paths.sh, or check_no_planning_docs.sh. Use when one of these guards fails, not for every architecture question or documentation edit.
+---
 
-# Architecture Guard Troubleshooting
+# Architecture Guard Checks
 
 Read only the section for the failing guard. Use `.config/make/` and the current
 workflow to verify its wiring; not every guard is part of every gate. Fix the

.agents/skills/code-change-verification/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: code-change-verification
+description: Review a commit, PR, or merged patch when the user requests ordinary code-change verification. Do not combine with adversarial-validation; use that skill instead for explicitly adversarial, substantial, or high-risk RustFS reviews.
+---
+
+# Code Change Verification
+
+Use this skill for an ordinary requested review. If the root policy or user calls
+for adversarial validation, use `adversarial-validation` instead of running both.
+
+## Core Workflow
+
+### 1) Scope and assumptions
+- Derive the change source, target branch, and relevant runtime/version from the
+  supplied diff and metadata. Ask only when missing context could change the verdict.
+- Focus only on requested scope; avoid reviewing unrelated files.
+
+### 2) Risk map
+- Prioritize in this order:
+  - Data correctness and user-visible behavior
+  - API/contract compatibility
+  - Security and authz/authn boundaries
+  - Concurrency and lifecycle correctness
+  - Performance and resource usage
+- Give higher priority to stateful paths, migration logic, defaults, and error handling.
+
+### 3) Evidence-based inspection
+- Read each modified hunk with neighboring context.
+- Trace call paths and call-site expectations.
+- Check for:
+  - invariant breaks and missing guards
+  - unchecked assumptions and null/empty/error-path handling
+  - stale tests, fixtures, and configs
+  - hidden coupling to shared helpers/constants/features
+- Apply root `AGENTS.md`'s finding standard: try to disprove a candidate before
+  reporting it. Mention an unresolved question only when it could materially
+  change the verdict; do not fill the report with speculative possibilities.
+
+#### Rust-specific checks
+
+For changed Rust behavior, use the matching sections of [rust-code-quality](../rust-code-quality/SKILL.md). Reuse checks already performed by the selected review workflow. Comment-only or formatting-only Rust diffs do not require the full Rust checklist. Carry its P0–P3 ratings over unchanged and use this skill's output format.
+
+### 4) Findings-first output
+- Order supported findings by P0–P3 severity; preserve the Rust ratings above.
+  Include `path:line`, the failure and impact, a focused fix, and its validation.
+- If no supported issues remain, state `No findings` with the reviewed scope and
+  any material verification limitation. Do not append optional improvements to
+  make a clean review look productive.
+
+Close after the required review. Recommend additional verification only for an
+identified unresolved risk or required gate; reuse evidence for unchanged code.

.agents/skills/code-change-verification/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Change Verification"
+  short_description: "Prioritize risks and verify code changes before merge."
+  default_prompt: "Use $code-change-verification for an ordinary requested diff review with prioritized findings."

.agents/skills/issue-triage/SKILL.md

@@ -1,13 +1,112 @@
 ---
 name: issue-triage
-description: Verify issue completion against current implementation and merged work. Use for issue triage; comment, close, or change labels only when authorized.
+description: Assess whether a GitHub issue is fixed, needs implementation, or can be closed by checking related work and current code. Use for issue completion/triage requests. Status questions are read-only; comment, close, or change labels only when the conversation authorizes that action.
 ---
+
 # Issue Triage
 
-- Resolve the issue repository separately from the implementation repository: `rustfs/backlog` tracks work in `rustfs/rustfs`. Pass `--repo` explicitly to GitHub queries.
-- Read the issue body, relevant comments, linked PRs, checklist, and sub-issues with `gh issue view`. Search explicit links, the full issue URL, qualified references, and subject keywords; an empty search result does not prove implementation is absent.
-- Fetch the implementation base and inspect its current code. For each merged candidate, verify `git merge-base --is-ancestor <merge-commit> <remote>/<base>`; a title, commit message, or merged state alone is insufficient. A local checkout may be stale or on another branch.
-- Verify every checklist/sub-issue before declaring completion. For batches, paginate the entire requested issue scope, exclude PR entries, and filter by author only when requested.
-- Recommend closing only when all requested behavior is present or evidence shows the issue is superseded. Otherwise name what remains. A status request is read-only; reuse existing authority for comments/closing/labels, and follow [Git and PR rules](../../references/pull-requests.md) before posting. Use Chinese for `rustfs/backlog`, existing repository labels only, and a closing comment naming the verified behavior and PRs.
+Use this skill when the user provides a GitHub issue URL and asks "can this be closed?", "is this already implemented?", "check completion status", or similar triage questions.
 
-Report the issue, current state, implementation evidence, remaining work, verdict, and action actually taken. Use a table for batches. Write multiline comments via `--body-file`; when closing, post the prepared comment before closing without an inline multiline body.
+## Workflow
+
+### 1. Fetch issue context
+
+```bash
+gh issue view <N> --repo <owner/repo> --json title,body,state,comments,labels,updatedAt
+```
+
+Read the issue body to understand what was requested. Extract:
+- The specific feature/fix/behavior described.
+- Any linked PRs or commits mentioned in the body or comments.
+- Any checklist items or sub-issues.
+
+Resolve the issue repository and implementation repository separately (for example, `rustfs/backlog` tracks work in `rustfs/rustfs`). Pass the implementation repository explicitly to PR queries; the current checkout may belong to another repository.
+
+### 2. Search for related work
+
+Search git history for commits referencing the issue:
+```bash
+git log --oneline --all --grep="<N>" | head -30
+```
+
+Search for related PRs:
+```bash
+gh pr list --repo <implementation-repo> --search "<issue-url>" --state all --json number,title,state,mergedAt
+```
+
+Also search qualified issue references and subject keywords; for same-repository
+issues, include `#<N>`. Follow explicit links even without a text match. A search
+page with no match does not prove the work is absent.
+
+If the issue mentions specific PRs, check their status:
+```bash
+gh pr view <PR_N> --repo <implementation-repo> --json state,mergedAt,title,mergeCommit,baseRefName
+```
+
+### 3. Verify implementation
+
+Fetch the implementation repository's current base branch. For each merged candidate, verify its merge commit is present and inspect the current code for the claimed behavior; a commit message match alone is not proof:
+```bash
+git fetch <implementation-remote> <base-branch>
+git merge-base --is-ancestor <merge-commit> <implementation-remote>/<base-branch>
+```
+
+If the issue describes a specific defect, inspect the fetched base's code rather than assuming the current checkout contains it:
+```bash
+git show <implementation-remote>/<base-branch>:crates/<relevant>/src/<file>.rs
+```
+
+For issues with checklists, verify each item individually. If sub-items are tracked as separate issues, check those too:
+```bash
+gh issue view <SUB_N> --repo <owner/repo> --json state
+```
+
+### 4. Determine verdict
+
+- **All items fixed and merged**: Recommend closing; name the verified PRs and behavior.
+- **Some items fixed, some remaining**: Keep open; report each remaining item.
+- **Not yet implemented**: Keep open; report what remains.
+- **Superseded or no longer relevant**: Recommend closing with evidence.
+
+### 5. Take action
+
+For a status-only request, return the assessment without GitHub writes. If commenting, closing, or label edits are authorized, perform only those actions; do not ask again for authority already given. Prepare the final assessment before asking for any missing authority. Write `rustfs/backlog` issue content in Chinese.
+
+Close with comment:
+```bash
+gh issue close <N> --repo <owner/repo> --comment "<body>"
+```
+
+Comment without closing:
+```bash
+gh issue comment <N> --repo <owner/repo> --body-file /tmp/triage.md
+```
+
+Update labels only when label changes are authorized, using existing repository labels; never add tool-specific labels:
+```bash
+gh issue edit <N> --repo <owner/repo> --add-label "<existing-label>"
+```
+
+Always use `--body-file` for multiline content, never inline `--body`.
+
+### 6. Handle multi-issue batches
+
+When the user asks to check multiple issues (e.g., "check all issues by user X" or "scan backlog for closable issues"):
+1. List the full requested scope with pagination (for example `gh api --paginate 'repos/<repo>/issues?state=open&per_page=100'`, excluding entries with `pull_request`). Add an author filter only when the user requested one; the default page/limit is not evidence that all issues were checked.
+2. For each issue, run steps 1-5 above.
+3. Report a summary table of all triaged issues with verdicts.
+
+## Report
+
+Identify the issue and current state, verified implementation/PR evidence,
+remaining items, verdict, and action actually taken. Use a table for batches;
+a single issue does not require a heading for each field. Follow step 4's
+verdicts without repeating the assessment in another template.
+
+## Notes
+
+- The user may ask in Chinese ("是否可以关闭", "检查完成情况"); respond in the same language.
+- When closing, always include a summary of what was fixed and which PRs resolved it — this creates a useful audit trail.
+- For issues in `rustfs/backlog`, use `--repo rustfs/backlog`.
+- For issues in `rustfs/rustfs`, use `--repo rustfs/rustfs`.
+- If the issue has sub-issues (GitHub sub-issues API), check each one's state before declaring the parent complete.

.agents/skills/pr-review/SKILL.md

@@ -1,20 +1,93 @@
 ---
 name: pr-review
-description: Review a GitHub PR using its exact base/head and repository risk policy. Use for requested PR reviews; publish or fix only within conversation authorization.
+description: Review a GitHub PR from a URL or number using its actual base/head and risk-appropriate code review. Use when the user asks for a PR review, not a status lookup or PR wording edit. Publish a review only when authorized; delegation and monitoring follow the requested scope and root AGENTS.md.
 ---
+
 # PR Review
 
-1. Resolve the PR repository and remote; the current checkout may belong elsewhere. Read the PR purpose and linked issues, then fetch the actual base and PR head:
+Use this skill for PR context and review delivery. An ordinary review request is read-only unless the conversation also authorizes posting or fixes. Reuse that authorization without asking again; prepare the review before requesting any missing publication approval.
 
-   ```bash
-   gh pr view <N> --repo <owner/repo> --json title,author,state,body,baseRefName,headRefName,baseRefOid,headRefOid
-   git fetch <repo-remote> <baseRefName> refs/pull/<N>/head
-   git diff <baseRefOid>...<headRefOid>
-   ```
+## Prerequisites
 
-   Record both SHAs; refresh if either moved during fetching. Follow relevant [implementation boundaries](../../references/implementation.md).
-2. Apply the [risk policy](../../references/adversarial-validation.md). Ordinary reviews use the root finding standard directly. For explicit adversarial, substantial, or high-risk reviews, use [the domain probes](../adversarial-validation/SKILL.md). File count does not authorize delegation; use exactly two independent reviewers only when authorized, otherwise two fresh sequential passes for that risk tier. Reviewers do not spawn further agents.
-3. Check `gh pr checks <N> --repo <owner/repo>`. Investigate failures when relevant to a finding or a requested CI/readiness diagnosis. Distinguish pending, unavailable, pre-existing, flaky, and PR-caused states using evidence; a code review does not authorize unrelated repairs.
-4. Report the reviewed SHAs, risk tier, supported findings or `No findings`, material verification limits, check state, and verdict. P0/P1 findings block approval. Severity: P0 = demonstrated data loss, security breach, remote crash, or deadlock; P1 = correctness, compatibility, or material hot-path regression; P2 = a concrete maintainability defect; P3 = optional style, only when requested.
-5. When posting is authorized, follow [Git and PR rules](../../references/pull-requests.md), recheck the remote head, and review any delta before submitting. Use `gh pr review` with `--approve`, `--request-changes`, or `--comment` and `--body-file`; use [the API example](references/posting.md) for authorized inline comments. Reuse existing authorization.
-6. Follow the repository PR lifecycle and explicit monitoring scope. Fetch new heads before comparing to the reviewed SHA; never rely on an unfetched `origin/pull/<N>/head`. Push fixes or resolve threads only when authorized; check `maintainerCanModify` before a fork push.
+- Follow root `AGENTS.md`; classify risk with the [review policy](../../references/adversarial-validation.md) and consult relevant [change-style and boundary rules](../../references/implementation.md).
+- Select `code-change-verification` for ordinary review or `adversarial-validation` for explicitly adversarial, substantial, or high-risk review; do not run both on the same diff.
+
+## Workflow
+
+### 1. Gather PR context
+
+```bash
+gh pr view <N> --repo <owner/repo> --json title,author,state,body,additions,deletions,changedFiles,commits,baseRefName,headRefName,baseRefOid,headRefOid
+gh pr diff <N> --repo <owner/repo> --name-only
+```
+
+Read the PR body and linked issues to understand the change's purpose. If the PR references an issue, fetch that too:
+```bash
+gh issue view <ISSUE> --repo <issue-owner/repo> --json title,body,state
+```
+
+### 2. Fetch the diff and classify the change
+
+```bash
+git fetch <repo-remote> <baseRefName> refs/pull/<N>/head
+git diff <baseRefOid>...<headRefOid> --stat
+```
+
+Resolve `<repo-remote>` to the PR repository; do not assume the current checkout's `origin` or `main` matches. Record the exact base/head used. If either moved during fetching, refresh the snapshot before reviewing. Classify using the repository review policy; instruction changes that affect agent execution are mechanical, not exempt.
+
+### 3. Review the changed behavior
+
+Group files by functional area to trace callers and invariants. Use the root risk tier's review shape and only matching lenses. File count does not authorize delegation. When delegation is explicitly authorized, high-risk/substantial reviews use exactly two independent reviewers with the applicable lenses split between them; otherwise use two fresh sequential passes. Reviewers do not spawn further agents.
+
+Findings need a concrete failure scenario with `file:line`; a null verdict briefly names the relevant probes. Reuse existing evidence and choose local checks from the final diff under the root verification policy.
+
+### 4. Check CI status
+
+```bash
+gh pr checks <N> --repo <owner/repo>
+```
+
+Investigate a failed check when it bears on a finding or the user requested CI diagnosis/merge readiness:
+```bash
+gh run view --repo <owner/repo> --log-failed --job=<JOB_ID>
+```
+
+Use current evidence to distinguish pre-existing, flaky, and PR-caused failures. Do not classify them by guesswork or turn a code-only review into unrelated CI repair.
+
+### 5. Synthesize findings
+
+Report the PR, reviewed base/head, and risk tier, then summarize the assessment.
+Use the selected review's P0–P3 ratings and root finding standard: supported
+findings with `file:line`, failure scenario, and fix, or `No findings`.
+State the observed check status, including pending or unavailable checks, and
+the verdict (`APPROVE`, `REQUEST_CHANGES`, or `COMMENT`). Do not infer a pass
+from missing checks or add style nits to populate a clean review.
+
+### 6. Post the review
+
+Only when posting is authorized, write the review body to a temp file and post via CLI. Refresh the PR head first; if it changed, review the delta and update the verdict before posting:
+```bash
+# Request changes
+gh pr review <N> --repo <owner/repo> --request-changes --body-file /tmp/pr_review.md
+
+# Approve
+gh pr review <N> --repo <owner/repo> --approve --body-file /tmp/pr_review.md
+
+# Comment only (no verdict)
+gh pr review <N> --repo <owner/repo> --comment --body-file /tmp/pr_review.md
+```
+
+For authorized inline comments, use [the submission example](references/posting.md).
+
+Always use `--body-file` or `--input`, never inline multiline `--body`.
+
+### 7. Handle follow-up
+
+Follow the [PR lifecycle](../../references/pull-requests.md) and any explicit monitoring request. For follow-up, fetch the new head and compare the recorded reviewed SHA with the new SHA; revisit affected callers and findings. Never use an unfetched `origin/pull/<N>/head` ref as evidence. Update the posted review or resolve addressed threads only within existing authorization.
+
+## Notes
+
+- The user may ask for review in Chinese; respond in the same language but keep the review body in English per AGENTS.md rules.
+- When the user asks for "多角色对抗 review", run the full adversarial validation protocol — this skill's step 3 covers that.
+- If the PR is from a fork, check `maintainerCanModify` before attempting to push fixes.
+- For very large PRs, batch the review by functional area while keeping the same bounded review shape.

.agents/skills/rust-code-quality/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: rust-code-quality
+description: Run a focused Rust quality review when the user requests one or a selected review workflow needs Rust-specific checks for changed behavior. Do not auto-load for every implementation edit, comment-only or formatting-only Rust diff, or repeat an already completed review.
+---
+
+# Rust Code Quality Gate
+
+Use this skill for a dedicated Rust review to cover rules that `cargo clippy`
+does not catch.
+
+Search matches and checklist items are candidates, not findings. Apply the root
+finding standard; distinguish a demonstrated bug, an explicit rule violation,
+and an optional preference. P2/P3 suggestions do not need to be invented or
+included in an otherwise clean correctness review.
+
+## Quick Start
+
+1. Identify changed `.rs` files.
+2. Run the matching candidate searches on changed files.
+3. Apply the manual checklist sections whose behavior the diff touches.
+4. Report or rebut every finding with evidence; P0/P1 findings block approval.
+   Fix them when implementation is authorized; a read-only review reports them.
+
+## Automated Checks
+
+Use these searches to find candidates in changed `.rs` files. Inspect syntax,
+`#[cfg(test)]` scope, and the changed hunk before reporting a finding; text
+filters do not reliably distinguish production code from tests.
+
+```bash
+# 1. unwrap/expect candidates
+rg -n '\.unwrap\(\)|\.expect\(' <changed-files>
+
+# 2. Silent type truncation via `as` cast
+rg -n ' as (u8|u16|u32|u64|usize|i8|i16|i32|i64|isize)\b' <changed-files>
+
+# 3. String as error type
+rg -n 'Result<.*String>' <changed-files>
+
+# 4. Box<dyn Error> in public APIs
+rg -n 'Box<dyn.*Error' <changed-files>
+
+# 5. println/eprintln in production
+rg -n 'println!|eprintln!' <changed-files>
+
+# 6. Ordering::Relaxed usage (verify each is intentional)
+rg -n 'Ordering::Relaxed' <changed-files>
+
+# 7. Default substituted for a possibly-required value (judge each: is the value optional by domain?)
+rg -n 'unwrap_or_default\(\)|unwrap_or\(' <changed-files>
+```
+
+## Manual Review Checklist
+
+For the Rust diff under review, verify:
+
+### Error Handling
+- [ ] Every production `unwrap()` or `expect()` is infallible by type or a checked invariant; explain only non-obvious invariants, using an existing type, a useful `expect` message, or a concise comment
+- [ ] No `Result<_, String>` in public API signatures
+- [ ] Public library APIs use domain errors unless deliberate error erasure at a boundary is part of the contract
+- [ ] `Error::source()` is overridden when inner error is stored
+- [ ] Error messages are actionable without exposing secret input
+
+### Type Safety
+- [ ] No silent `as` truncation (negative→unsigned, large→small)
+- [ ] Fallible numeric conversions use `TryFrom`/`try_into()` and return a typed error; clamp or saturate only when the domain explicitly requires it
+- [ ] Floating-point to integer conversion validates finiteness, sign, and range before conversion
+
+### Concurrency
+- [ ] Lock acquisition order is documented when multiple locks are used, and matches every other call site taking any overlapping subset (ABBA check)
+- [ ] No `tokio::sync` lock guard (read or write) held across `.await` without bounded hold time — long-lived read guards wedge writers (#4195)
+- [ ] Atomic read-modify-write uses the direct `fetch_*` operation when possible; use `compare_exchange` only for conditional updates
+- [ ] `std::sync::Mutex` in async context is held only briefly, never across `.await`
+
+### Memory and Performance
+- [ ] On an identified hot path, report cloning or allocation only with a concrete per-request/per-object cost or benchmark signal
+- [ ] Prefer borrowing, moving, `Bytes`/`Arc`, or capacity reservation only when it reduces that cost without obscuring ownership or APIs
+
+### Recursion Safety
+- [ ] Recursion over untrusted, persisted, or otherwise unbounded input has a depth limit or uses iterative traversal
+- [ ] Tree/cache traversals handle corrupted/cyclic input safely
+
+### Testing
+- [ ] Tests have an observable failure criterion; delegated assertions, `#[should_panic]`, snapshot/property checks, and meaningful `Result` failures do not need a redundant `assert!`
+- [ ] Use `expect` only when its message improves failure diagnosis; do not add boilerplate to self-evident test setup
+- [ ] Test volume and line count are never treated as production-code growth
+
+### Serde
+- [ ] Structs from untrusted input reject unknown fields where the compatibility contract permits; otherwise validate security-critical fields explicitly and test the supported input shape
+- [ ] `#[serde(default)]` not used on security-critical fields without validation
+
+### Code Hygiene
+- [ ] No `#![allow(dead_code)]` at crate root
+- [ ] No camelCase statics or Hungarian notation
+- [ ] New string literals don't duplicate existing constants
+
+### Reuse and Necessity
+- [ ] No new helper duplicates `crates/utils`, `crates/common`, the touched crate, the likely domain-owning crate, a relevant direct dependency, or plain std/tokio behavior; reused helpers match the call site's semantics
+- [ ] No branch without a nameable concrete trigger; no re-validation of what a validated upstream layer on the same path already guarantees (Cross-Cutting Domain Invariant patterns and pre-destructive-action re-checks are load-bearing — keep them)
+- [ ] Error context attached once where actionable, not re-wrapped at every hop; no typed→generic error conversion below aggregation/quorum layers
+- [ ] Comments avoid narration and change history while completely stating non-obvious lock, `SAFETY`, durability, compatibility, and unwrap invariants
+- [ ] No near-duplicate test pinning the same code path and poison-value class as an existing test (boundary companions — n==max vs max+1, absent/empty/nil UUID — are never near-duplicates)
+
+## Severity Classification
+
+- **P0 (Block merge)**: demonstrated data loss, security breach, remote crash, or deadlock
+- **P1 (Must fix)**: concrete correctness, compatibility, or material hot-path regression
+- **P2 (Should fix)**: avoidable duplication or maintainability issue with a concrete simpler replacement
+- **P3 (Nice to fix)**: local style or clarity issue with no behavioral risk
+
+## Output Template
+
+Use the calling review's output format. For a standalone review, report supported
+findings with severity, location, impact, fix, and validation, or `No findings`.
+Include only material unverified checks. Candidate counts are not a quality
+metric and do not need a separate scan report.

.agents/skills/rustfs-logging-governance/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: rustfs-logging-governance
+description: Add or review RustFS `tracing` events with the repository field shape, level policy, privacy boundaries, and guardrails. Use when a change adds or edits a tracing macro/instrumentation site or the logging guardrail script.
+---
+
+# RustFS Logging Governance
+
+Apply this skill only to changed logging sites; do not turn a local log edit into
+a broad logging cleanup.
+
+## Workflow
+
+1. Read the changed function/module context and classify the site as lifecycle,
+   request/hot path, fallback, external fetch, or summary.
+2. Match neighboring structured events and reuse existing `EVENT_*`,
+   `LOG_COMPONENT_*`, and `LOG_SUBSYSTEM_*` constants.
+3. Put stable fields first (`event`, `component`, `subsystem`, `state`/`result`,
+   then context) and a short label last.
+4. Select the level by operational meaning:
+   - `error`: behavior/security-affecting failure;
+   - `warn`: degraded/fallback/operator-actionable state;
+   - `info`: low-frequency lifecycle/mode change;
+   - `debug`: targeted diagnostics;
+   - `trace`: repetitive request/object/shard success paths.
+5. Never log secrets, tokens, auth headers, credential payloads, raw
+   attacker-controlled bodies, or merged config dumps. Error strings and
+   `Debug` output are log surfaces too.
+6. Prefer one aggregate summary over inventories or startup banners.
+7. Run `./scripts/check_logging_guardrails.sh` and the checks selected by root
+   `AGENTS.md`.
+
+Read [logging-governance.md](references/logging-governance.md) only for a broad
+logging audit, event-model migration, or guardrail expansion. Ordinary single-
+site edits do not require the full workspace scope map.

.agents/skills/rustfs-logging-governance/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "RustFS Logging Governance"
+  short_description: "Standardize RustFS logs with structured events and guardrails."
+  default_prompt: "Use $rustfs-logging-governance to standardize or review RustFS logging, reduce noise, and update guardrails."

.agents/skills/rustfs-logging-governance/references/logging-governance.md

@@ -1,6 +1,5 @@
 # Logging Audit and Migration Reference
 
-Use the [root logging rules](../../AGENTS.md#logging) for individual events.
 Read this reference only for a broad logging audit, an event-model migration,
 or a change to `scripts/check_logging_guardrails.sh`. Use `Cargo.toml` for the
 current workspace/crate list instead of maintaining one here.

.agents/skills/rustfs-release-publish/SKILL.md

@@ -1,42 +1,170 @@
 ---
 name: rustfs-release-publish
-description: Publish a RustFS version through Console, release-branch CI, preview acceptance, human confirmation, and final publication. Use only for an explicit release request.
+description: "Run the RustFS console gate, source version bump, release-branch CI, preview validation, human confirmation, final-tag publication, and post-release installation and website updates. Use only when the user explicitly asks to release or publish a RustFS version (发版/发布)."
 ---
-# RustFS Release
+# RustFS Release Publish (preview-validated pipeline)
 
-Require the exact final SemVer target before version edits or publication. If unspecified, inspect current releases/tags and ask with concrete candidates; do not guess the channel or bump. A named bump type resolves to an exact version that still needs confirmation. Report the confirmed target verbatim; resolve any later mismatch before proceeding. Independent read-only preflight may continue.
+This skill orchestrates a full release. It wraps `rustfs-release-version-bump` (invoked here with the authorized commit/push/PR scope) with a mandatory preview-tag validation loop before the final tag is published.
 
-## Invariants
+The binary reports its build tag (`build::TAG` via shadow_rs; `SHORT_VERSION` in
+`rustfs/src/config/cli.rs`), and `build.yml` derives asset names and preview
+classification from that tag. Cargo.toml supplies only the no-tag fallback.
+Preview and final tags must therefore share the validated source commit;
+their tag-dependent version and asset names differ. The channel and cleanup
+constraints are defined once under Preview tag naming and Hard rules below.
 
-- Cargo stores `<target>`, never `-preview.N`. Before publication, installation defaults retain the previous available deliverable. Final and preview binaries embed their own tag names, so version/asset names differ despite identical source.
-- Use annotated tags without `v`. Preview names are exactly `<target>-preview.<digits>`; choose the next unused iteration after fetching tags. Preview Releases are prereleases, never Latest; publish only versioned assets/exact Docker tags, never latest assets, R2, Helm, moving Docker channels, or installation/banner updates.
-- `release/<target>` owns the candidate. Retain its history, backport only reviewed fixes, and never merge main wholesale or force-push it. Pin `PREVIEW_HASH` to its exact commit with complete passing CI. Preview and final tags both point there; never tag a later main/branch HEAD or insert another bump.
-- Phase failures block dependents. Keep preview Releases until final publication and notes generation finish; CI removes Releases while retaining tags. Never move an existing preview or final tag.
+Pipeline shape:
 
-## Read by Phase
+```
+check console main against its latest Release
+  -> if ahead: publish console -> wait for Release asset + latest API
+  -> bump Cargo.toml and Cargo.lock to <target> -> merge
+  -> cut release/<target> from a selected main commit containing the bump
+  -> CI green for that exact release-branch commit
+  -> tag <preview-tag> at that commit
+  -> verify preview Release assets -> run binary locally + console checks
+  -> validate with latest rc client
+  -> report preview acceptance results -> STOP for explicit human confirmation
+  -> tag <target> at the SAME commit (zero delta) -> re-verify CI/release
+  -> CI deletes the <target>-preview.N Releases (tags kept)
+  -> verify published images -> publish Helm chart from the validated source
+  -> update installation references on main -> update rustfs.com announcement
+```
 
-Read only the current phase's procedure; retain completed evidence across turns. Follow root verification, Git/PR, and authorization rules.
+On candidate or preview validation failure: fix lands on main via normal PR, then backport only the needed fix to `release/<target>` through a reviewed PR. Re-run release-branch CI at the new commit and, if a preview was already tagged, tag `<preview-tag N+1>` there and restart acceptance. Installation references remain on the previous published deliverable throughout preview validation.
 
-| Phase | Procedure |
-|---|---|
-| 0 | Clean tree, fetch main/tags, verify GitHub access, then complete the mandatory [Console release gate](references/console-gate.md). A green Console build alone is insufficient. |
-| 1–2 | [Prepare/reuse the release candidate and run exact-SHA branch CI](references/release-candidate.md). Source version changes use `rustfs-release-version-bump` with authorized delivery scope. |
-| 3 | [Verify the preview build, assets, channels, and notes](references/preview-release.md). |
-| 4–5 | [Run the downloaded binary, Console CRUD, and latest-rc matrix](references/preview-acceptance.md). Every check must pass. |
-| Confirmation | Complete the gate below and end the turn. |
-| 6 | After fresh confirmation, [publish and verify the final tag](references/final-release.md) at `PREVIEW_HASH`. |
-| 7 | [Maintain milestones, installation references, and the website](references/post-release-updates.md) only after complete publication. |
+## Required inputs
 
-## Human Confirmation
+- Final target version, for example `1.0.0-beta.10`.
+- Preview iteration `N` (default: next unused preview tag for that target; check with `git tag -l '<target>-preview.*'` after `git fetch --tags`).
 
-After Phases 3–5 pass, recheck that the release branch still equals `PREVIEW_HASH`. Report the target, branch, preview tag/hash, branch CI run, preview Release URL, Console result, and rc matrix. Explicitly ask whether to publish the final tag and end the turn without creating/pushing it.
+If the target version is missing or ambiguous, collect the current release/tag baseline and ask before version edits or publication. Continue independent read-only preflight while the answer is pending (see the semver gate below).
 
-Only a new affirmative user reply to that exact report authorizes Phase 6. The original release request, earlier confirmation, silence, or automated follow-up does not count. Confirmation binds the target, preview tag, and hash; a changed value or repeated/failed acceptance cycle invalidates it. Revalidate and obtain fresh confirmation before continuing.
+## Semver gate — resolve the target before version edits or publication
 
-## Recovery
+Versions follow [SemVer 2.0.0](https://semver.org/). Precedence reminder:
 
-- Before the final tag exists, land fixes on main, backport to the candidate, verify target versions, and restart branch CI/acceptance. Use a new preview iteration once a preview was tagged; main may advance independently.
-- Once the final tag exists, retry publication jobs for that exact tag. A source fix requires a newly confirmed target, not retagging or a newer preview. Phase 7 retries recheck artifact availability and superseding releases.
-- If abandoned after the bump merged, report the unpublished version on main and record whether to revert or let the next release overwrite it. Deleting candidate branches or preview tags requires an explicit decision.
+```
+1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0 < 1.0.1 < 1.1.0 < 2.0.0
+```
 
-Report completed phase results and incomplete work with evidence: Console previous/latest tags, release need, hash and run/Release URLs; target, branch CI/SHA, previews and hash, confirmation state; preview/final assets, latest-channel state, Console/rc results and cleanup; both milestone states, installation PR checks/merge state, and website text/link/PR/deployment state. Keep artifact publication separate from follow-up delivery; do not call an open PR a live update. Report deviations and their authorization.
+Numeric prerelease identifiers compare numerically (`beta.9 < beta.10`), not lexically — see [semver.org spec item 11](https://semver.org/#spec-item-11). Preview tags are internal validation tags layered on top of the target's prerelease channel — they are never themselves a deliverable version and never appear in version files.
+
+Rules:
+
+- A request like "发个版" / "release the next version" without an exact version string is ALWAYS ambiguous. Derive the current latest tag (`git tag --sort=-v:refname | head`), then ask the user to choose with concrete candidates, e.g. from `1.0.0-beta.10`: next prerelease `1.0.0-beta.11`, promote to `1.0.0-rc.1`, promote to stable `1.0.0`. Never guess between these — they have very different meanings (channel promotion vs. iteration) and different CI classification consequences.
+- After a stable `X.Y.Z` exists, the next version must state which component bumps: patch `X.Y.(Z+1)` for fixes only, minor `X.(Y+1).0` for backward-compatible features, major `(X+1).0.0` for breaking changes. If the user names a bump type but not a number, compute it from the latest stable tag and echo the exact resulting version back for confirmation.
+- Echo the final confirmed version string verbatim in your first status report; every later phase must use exactly that string. If at any point the user's wording and the confirmed version diverge, stop and re-confirm.
+
+## Preview tag naming
+
+- Use `<target>-preview.N` for every target, e.g. `1.0.0-beta.10-preview.3` or `1.1.0-preview.1`.
+- The canonical suffix is exactly `-preview.<digits>`. `build.yml` recognizes it before alpha/beta/rc classification and routes it to the preview-only path; any other tag containing `-preview` fails closed instead of being treated as a release.
+- A preview Release MUST be published with `isPrerelease=true` and `isLatest=false`. Any `*-latest` preview asset or preview-triggered `latest.json`, R2, Helm, or moving Docker channel tag is a pipeline failure. Docker images may use the exact preview version tag, including its existing variant suffixes.
+- Preview Releases are cleaned up by the `cleanup-preview-releases` job after `publish-release` succeeds for the deliverable tag. It deletes every Release whose tag is exactly `<target>-preview.<digits>` and never passes `--cleanup-tag`, so the tags survive.
+
+## Hard rules
+
+- Before preview, bump only Cargo.toml (workspace package and internal dependency versions) and the corresponding workspace members in Cargo.lock, directly to `<target>`. Keep README installation examples, flake.nix, Chart.yaml, and rustfs.spec on the previous published deliverable until Phase 7. Never write a `-preview.N` suffix into these files; preview identifiers belong to validation tags and artifacts.
+- Publishing a tag alone does not make an installation target available. Verify the exact image manifest, Release assets, and source archive before advancing references that consume them. Helm packaging derives its versions from the final tag and waits for that image; it does not require an early Chart.yaml bump on main.
+- Preview Release assets are versioned and intentionally visible on the Releases page for the duration of validation. Do not label them Latest or use them to update any latest distribution channel.
+- Never delete a preview Release by hand before Phase 6 finishes — Phase 4 downloads its assets and the final Release notes are generated while it still exists. Cleanup is CI's job; only step in manually (`gh release delete "<preview-tag>" --yes`, never `--cleanup-tag`) if `cleanup-preview-releases` failed.
+- Tags have no `v` prefix. Always annotated: `git tag -a <tag> -m "Release <tag>"`.
+- The release branch is the candidate source during multi-day acceptance. Do not merge main wholesale into it, force-push it, or advance it with unrelated changes. The final tag MUST point at exactly `PREVIEW_HASH` — the commit the validated preview tag points at. Never tag current `main` HEAD or an advanced release-branch HEAD, and never create an extra version-bump commit between preview and final. Phase 7 updates installation references on main after publication; neither tag moves to that follow-up commit.
+- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag — cleanup runs after the notes are generated, so the preview Release is still present and would otherwise be picked as the baseline. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
+- Generated Release notes carry a workflow-management marker so retries can repair them. Before manually curating a generated body, remove that marker; unmarked non-placeholder notes are preserved by later workflow runs.
+- Phases run in order; a failure blocks dependent steps. For a candidate or preview/source acceptance failure before the final tag exists, land the fix on main, backport it to the release branch, verify Cargo there still matches the confirmed target, and restart from release-branch CI in Phase 2. Use the next preview iteration if any preview was already tagged. Main may advance to another target without changing this release candidate.
+- Once the final tag exists, preserve its commit. Retry failed publication jobs for that exact tag; do not recreate the tag or restart preview on newer main. If a source change is required after final-tag publication, report the failure and obtain a new target version. Phase 7 failures resume only the failed follow-up after rechecking artifact availability and whether a newer release has superseded it.
+- Completing preview acceptance does not authorize the final tag. After Phases 3–5 pass, report the acceptance evidence and stop until the user explicitly confirms continuation. The original release request, an earlier confirmation, silence, or an automated follow-up does not satisfy this gate.
+- Confirmation is scoped to the reported `<target>`, `<preview-tag>`, and `PREVIEW_HASH`. A failed or repeated acceptance cycle, including any new preview iteration, invalidates prior confirmation and requires a new one.
+- If the release is abandoned after Phase 1 merged, main's version files claim a version that was never tagged. Either revert the bump PR or leave it to be overwritten by the next release — but tell the user explicitly and record the decision. Do not delete the release branch or preview tags as part of abandonment without an explicit decision.
+- User-facing status updates in Chinese; commits, PR titles/bodies, and tag messages in English. No hard-wrapping in commit messages, PR bodies, or documentation prose — one logical line per sentence/paragraph, let soft wrap handle display.
+
+## Phase 0 — Preflight
+
+- `git status --short` clean; `git fetch origin main --tags`.
+- `gh auth status` works; confirm you can view `gh release list -L 3`.
+- Confirm the exact final target version with the user if not explicit.
+- Check whether `release/<target>` already exists before creating it; a resumed release reuses the existing branch and its history. For an in-flight release that already has a preview tag but no branch, anchor the new branch to that tag's commit only after verifying its target versions and prior acceptance evidence.
+
+### Console release gate
+
+Read and complete [the Console gate](references/console-gate.md) before Phase 1. Verify the latest published Console asset and exact commit; if Console main is ahead, complete its release and asset verification first. A successful build alone does not satisfy this gate.
+
+## Phase 1 — Source version bump to the final target (once)
+
+- If `release/<target>` exists, verify its Cargo.toml and workspace members in Cargo.lock read `<target>` and skip the source bump, even if main has advanced. If the branch versions differ, stop and resolve the mismatch without downgrading main.
+- If no branch exists but an unfinished preview tag does, verify its commit has `<target>` in both version files and skip the bump; Phase 2 anchors the branch to that commit. Stop if those files disagree. Otherwise, if main already has `<target>` in both files, skip the bump. Installation references intentionally retain the previous published deliverable during preview; if they were advanced to an unavailable target, restore that baseline before choosing the next candidate.
+- Only when neither the release branch, an unfinished preview tag, nor current main already has `<target>`: if main is at a later version, select and verify a historical commit containing `<target>` rather than downgrading main; block if none exists. Otherwise invoke the `rustfs-release-version-bump` skill with stage `prepare`, the final `<target>` (NOT a preview version), and full GitHub flow (commit/push/PR).
+- If a bump PR was needed, get it merged into main and record its merge commit. For a new release branch when main already has `<target>`, identify the main commit that introduced those versions. Phase 2 chooses a release candidate containing that commit; an existing release branch keeps its own history and a newer main HEAD is not required.
+
+Do not wait for the moving latest main HEAD to become green. The release-branch CI in Phase 2 validates the chosen commit before a preview tag is created.
+
+## Phase 2 — Pin and validate the release candidate, then publish the preview tag
+
+- Use `release/<target>`. On the first attempt, create it from a selected main commit containing the version bump and intended changes; it need not be the latest main HEAD. On a restart, retain the existing branch and backport only reviewed fixes from main. Verify the branch's Cargo versions still equal `<target>`. If adopting an existing preview, run this branch CI before continuing its acceptance; reuse the tag only when it points to the validated SHA.
+- The current `ci.yml` runs automatically on main pushes, not release-branch pushes. Dispatch it explicitly with `gh workflow run ci.yml --ref "release/<target>"`. Locate that dispatch run, verify its `head_sha` equals the release branch's remote HEAD, and require the full expected CI job set to pass, including `Quick Checks`, `Test and Lint`, and `End-to-End Tests (full merge gate)`. Treat a missing or skipped required lane as incomplete. A successful PR check or CI run for a different SHA does not qualify. If the branch advances or a run is cancelled, validate the new SHA again. Do not tag a candidate with failing or incomplete CI.
+- Prefer protecting `release/*` against force pushes and deletion and requiring reviewed backport PRs. Check live rulesets rather than assuming the main ruleset covers release branches; report a missing release-branch rule as a gap.
+- Set `PREVIEW_HASH` to the CI-validated release-branch commit and recheck the remote branch HEAD immediately before tagging. Report the branch, commit, and CI run URL; do not derive `PREVIEW_HASH` from a later `origin/main` fetch. When adopting an existing preview tag at this SHA, skip tag creation and continue Phase 3.
+
+```bash
+git tag -a "<preview-tag>" -m "Release <preview-tag>" "$PREVIEW_HASH"
+git push origin "<preview-tag>"
+```
+
+Pushing the tag triggers `.github/workflows/build.yml` ("Build and Release"); `docker.yml` chains off it via `workflow_run`.
+
+The preview run builds versioned artifacts and publishes them in a GitHub prerelease. Docker may publish exact preview image tags. Latest-channel, R2, and Helm publication must be skipped; installation references and the website announcement stay unchanged.
+
+On a restart after a backport, re-run release-branch CI before setting the new `PREVIEW_HASH`. Use the next unused preview iteration when the validated commit differs from an existing preview tag; never move an existing tag.
+
+## Phase 3 — CI and preview Release verification
+
+- Find and watch the tag build: `gh run list --workflow build.yml --branch "<preview-tag>" --limit 1` then `gh run watch <run-id>`. Every build matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64).
+- Confirm the preview tag resolves to the Phase 2 CI-validated `PREVIEW_HASH`. If the release branch advances during acceptance, repeat Phases 2–5 with a new preview tag.
+- Confirm the Release publication jobs (`create-release`, `upload-release-assets`, and `publish-release`) succeed while `update-latest-version` is skipped.
+- Verify `gh release view "<preview-tag>" --json isPrerelease,assets,url`: `isPrerelease` must be `true`, and the Release must contain all 6 versioned platform zips, checksums, SBOM, and provenance with no `-latest` assets. Confirm `gh api repos/{owner}/{repo}/releases/latest --jq .tag_name` does not return `<preview-tag>`.
+- Record `PREVIOUS_DELIVERABLE`, selected from published Releases by `publishedAt` after excluding the current tag and every `-preview.N` tag. Verify `gh release view "<preview-tag>" --json body --jq .body` contains `## What's Changed` and, when `PREVIOUS_DELIVERABLE` exists, `**Full Changelog**: https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<preview-tag>`. For a repository with no previous deliverable, verify a Full Changelog link exists and record the GitHub baseline fallback.
+- Confirm Helm is skipped. If preview Docker images are published, confirm they use only exact preview tags (and variant suffixes), with no `latest`, `alpha`, `beta`, or `rc` channel updates. Preview validation covers the built RustFS binaries, embedded console, and rc compatibility; it does not authorize advancing any installation default.
+
+## Phases 4–5 — Local artifact, Console, and rc acceptance
+
+Read and complete [preview acceptance](references/preview-acceptance.md): verify the downloaded binary's tag/SHA and readiness, exercise Console CRUD with byte-identical download, and pass the full latest-rc command matrix. Any failure blocks final publication. Retain the results for the confirmation gate below.
+
+### Manual confirmation gate
+
+After every Phase 3–5 check passes, verify the release branch still points to `PREVIEW_HASH`. Report the target, release branch, preview tag, `PREVIEW_HASH`, release-branch CI run, preview Release URL, console result, and rc matrix, then explicitly ask the user whether to publish the final tag. End the turn without creating or pushing `<target>`.
+
+Continue to Phase 6 only after a new user reply explicitly confirms the reported target, preview tag, and commit. A clear affirmative reply to that exact report, such as `确认继续`, is sufficient; if the reply is ambiguous or any reported value changed, ask again.
+
+## Phase 6 — Publish the final tag on the validated commit
+
+No second source version bump. Before creating the final tag, recheck the remote `release/<target>` HEAD equals `PREVIEW_HASH`. If it moved after confirmation, the approval no longer applies; validate and obtain confirmation for a new preview. The final tag goes on the exact commit the preview validated:
+
+```bash
+git fetch origin --tags
+git rev-parse "<preview-tag>^{commit}"          # must equal PREVIEW_HASH — abort if not
+git tag -a "<target>" -m "Release <target>" "$PREVIEW_HASH"
+git push origin "<target>"
+```
+
+- CI rebuilds from the same source; the only changed input is the tag name, so the binary now self-reports `<target>`.
+- Verify the final tag's complete publication path: all matrix and release jobs green; `gh release view "<target>"` shows the full versioned and `-latest` asset set plus checksums, SBOM, and provenance; Docker and Helm workflows succeed; `latest.json` points to `<target>`. A stable target must have `isPrerelease=false` and `isLatest=true`. An alpha/beta/rc target must have `isPrerelease=true`; GitHub does not permit prereleases to be Latest, but the project `latest.json` still advances to the final non-preview target.
+- Verify the final Release body contains `## What's Changed` and a Full Changelog link. When `PREVIOUS_DELIVERABLE` exists, the link MUST be `https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<target>` and the baseline MUST equal the preview Release baseline; for example, both `1.0.0-beta.12-preview.1` and `1.0.0-beta.12` compare from `1.0.0-beta.11`.
+- Verify the preview cleanup: `cleanup-preview-releases` must succeed, `gh release view "<preview-tag>"` must then report `release not found` for every preview iteration of this target, and `git rev-parse "<preview-tag>^{commit}"` must still resolve to `PREVIEW_HASH` (the tag is kept). If the job failed, delete the leftover Releases manually with `gh release delete "<preview-tag>" --yes` and report it.
+- Optionally spot-check `./rustfs --version` from a final-tag artifact — it must report `<target>`.
+
+## Phase 7 — Installation references and website announcement
+
+Only after Phase 6 succeeds, complete [post-release updates](references/post-release-updates.md): align installation references on main, then update the existing top banner in `rustfs/rustfs.com`. A failed or incomplete publication leaves both on the previous available version. These follow-up commits never change `PREVIEW_HASH` or either release tag. Track their PR, merge, and deployment states separately from artifact publication; an open PR is not a live website update.
+
+## Output contract
+
+Always report:
+
+- Console gate result: previous/latest Console tags, whether merged changes required a release, `CONSOLE_HASH`, and Console run/Release URLs when a release was published.
+- Target version, release branch, release-branch CI run and validated SHA, preview tag(s) used, `PREVIEW_HASH` (which both tags point at).
+- Manual confirmation gate status (`WAITING_FOR_CONFIRMATION` or `CONFIRMED`) and its exact target, preview tag, and `PREVIEW_HASH`.
+- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: preview and final Release URLs, preview `isPrerelease`/`isLatest` state, final latest-channel state, console check results, the rc command matrix, and the preview-Release cleanup result (deleted Releases plus surviving tags).
+- Post-release installation PR and verification results; website banner target, text, link, PR, and observed deployment state. Report any remaining merge authorization or failed deployment explicitly rather than claiming the banner is live.
+- Any deviation from this pipeline and why the user approved it.

.agents/skills/rustfs-release-publish/references/final-release.md

@@ -1,22 +0,0 @@
-# Final Release Publication
-
-Read only after fresh user confirmation of the preview acceptance report. The [parent confirmation gate](../SKILL.md#human-confirmation) applies.
-
-## Phase 6 — Publish the final tag on the validated commit
-
-No second source version bump. Before creating the final tag, recheck the remote `release/<target>` HEAD equals `PREVIEW_HASH`. If it moved after confirmation, the approval no longer applies; validate and obtain confirmation for a new preview. The final tag goes on the exact commit the preview validated:
-
-```bash
-git fetch origin --tags
-git rev-parse "<preview-tag>^{commit}"          # must equal PREVIEW_HASH — abort if not
-git tag -a "<target>" -m "Release <target>" "$PREVIEW_HASH"
-git push origin "<target>"
-```
-
-- CI rebuilds from the same source; the only changed input is the tag name, so the binary now self-reports `<target>`.
-- Verify the final tag's complete publication path: all matrix and release jobs green; `gh release view "<target>"` shows the full versioned and `-latest` asset set plus checksums, SBOM, and provenance; Docker and Helm workflows succeed; `latest.json` points to `<target>`. A stable target must have `isPrerelease=false` and `isLatest=true`. An alpha/beta/rc target must have `isPrerelease=true`; GitHub does not permit prereleases to be Latest, but the project `latest.json` still advances to the final non-preview target.
-- Verify the final Release body contains `## What's Changed` and a Full Changelog link. When `PREVIOUS_DELIVERABLE` exists, the link MUST be `https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<target>` and the baseline MUST equal the preview Release baseline; for example, both `1.0.0-beta.12-preview.1` and `1.0.0-beta.12` compare from `1.0.0-beta.11`.
-- Verify the preview cleanup: `cleanup-preview-releases` must succeed, `gh release view "<preview-tag>"` must then report `release not found` for every preview iteration of this target, and `git rev-parse "<preview-tag>^{commit}"` must still resolve to `PREVIEW_HASH` (the tag is kept). If the job failed, delete the leftover Releases manually with `gh release delete "<preview-tag>" --yes` and report it.
-- Optionally spot-check `./rustfs --version` from a final-tag artifact — it must report `<target>`.
-
-Never pass `--cleanup-tag` when removing preview Releases. Remove them manually only if `cleanup-preview-releases` failed, after final publication and notes generation. Record deleted Releases and surviving tags.

.agents/skills/rustfs-release-publish/references/post-release-updates.md

@@ -1,15 +1,7 @@
-# Post-release Milestone, Installation, and Website Updates
+# Post-release Installation and Website Updates
 
 Read only after the final non-preview tag has passed Phase 6. Tag creation or a green binary build alone is insufficient: the release assets, source archive, container images, Helm package, and applicable latest channels must be available. Preview tags never enter this phase.
 
-## Version milestones
-
-1. Query all pages of both open and closed milestones in the RustFS release repository, matching titles exactly to version strings without a `v` prefix. A failed or incomplete query is not evidence that a milestone is absent; resolve the lookup before making changes.
-2. Close the milestone matching the published `<target>` if it is open; an already closed milestone needs no change. If it is missing, report the gap and continue checking the next version. Do not create a substitute for the released milestone or close/reassign its issues or PRs.
-3. Use an explicitly planned next version when provided; otherwise, for a stable `X.Y.Z`, use `X.Y.(Z+1)`. For example, after `1.0.1` is published, close milestone `1.0.1` and ensure milestone `1.0.2` exists. For an alpha/beta/rc target with a trailing numeric counter, increment that counter within the same channel unless a different next version was specified. If the next version cannot be determined, ask for that version and report this follow-up as blocked. Creating a planning milestone does not confirm the target of a future release or bypass the semver gate.
-4. Reuse an existing next-version milestone, whether open or closed; do not reopen it or create a duplicate. Only when the complete query confirms it is absent, create an open milestone with the exact next-version title. Do not invent a due date or description. After an uncertain creation result, query again before retrying.
-5. Read back both milestones and report their titles, URLs, and actual states, including whether the next milestone was reused or created. A failed close, create, or verification leaves milestone maintenance incomplete; retry only the unfinished operation after refreshing live state. Continue independent installation and website work without moving or republishing the release tag.
-
 ## Installation references
 
 1. Re-read the published deliverable state before edits or a retry. If a newer release has superseded this target, do not downgrade installation references or the website announcement. Report the superseding release and leave those defaults intact.

.agents/skills/rustfs-release-publish/references/preview-release.md

@@ -1,24 +0,0 @@
-# Preview Release Verification
-
-Read for Phase 3 after the candidate passed exact-SHA CI. The [parent release invariants](../SKILL.md) apply.
-
-## Preview channels
-
-- Use `<target>-preview.N` for every target, e.g. `1.0.0-beta.10-preview.3` or `1.1.0-preview.1`.
-- The canonical suffix is exactly `-preview.<digits>`. `build.yml` recognizes it before alpha/beta/rc classification and routes it to the preview-only path; any other tag containing `-preview` fails closed instead of being treated as a release.
-- A preview Release MUST be published with `isPrerelease=true` and `isLatest=false`. Any `*-latest` preview asset or preview-triggered `latest.json`, R2, Helm, or moving Docker channel tag is a pipeline failure. Docker images may use the exact preview version tag, including its existing variant suffixes.
-- Preview Releases are cleaned up by the `cleanup-preview-releases` job after `publish-release` succeeds for the deliverable tag. It deletes every Release whose tag is exactly `<target>-preview.<digits>` and never passes `--cleanup-tag`, so the tags survive.
-
-## Phase 3 — CI and preview Release verification
-
-- Find and watch the tag build: `gh run list --workflow build.yml --branch "<preview-tag>" --limit 1` then `gh run watch <run-id>`. Every build matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64).
-- Confirm the preview tag resolves to the Phase 2 CI-validated `PREVIEW_HASH`. If the release branch advances during acceptance, repeat Phases 2–5 with a new preview tag.
-- Confirm the Release publication jobs (`create-release`, `upload-release-assets`, and `publish-release`) succeed while `update-latest-version` is skipped.
-- Verify `gh release view "<preview-tag>" --json isPrerelease,assets,url`: `isPrerelease` must be `true`, and the Release must contain all 6 versioned platform zips, checksums, SBOM, and provenance with no `-latest` assets. Confirm `gh api repos/{owner}/{repo}/releases/latest --jq .tag_name` does not return `<preview-tag>`.
-- Record `PREVIOUS_DELIVERABLE`, selected from published Releases by `publishedAt` after excluding the current tag and every `-preview.N` tag. Verify `gh release view "<preview-tag>" --json body --jq .body` contains `## What's Changed` and, when `PREVIOUS_DELIVERABLE` exists, `**Full Changelog**: https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<preview-tag>`. For a repository with no previous deliverable, verify a Full Changelog link exists and record the GitHub baseline fallback.
-- Confirm Helm is skipped. If preview Docker images are published, confirm they use only exact preview tags (and variant suffixes), with no `latest`, `alpha`, `beta`, or `rc` channel updates. Preview validation covers the built RustFS binaries, embedded console, and rc compatibility; it does not authorize advancing any installation default.
-
-## Release notes
-
-- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag — cleanup runs after the notes are generated, so the preview Release is still present and would otherwise be picked as the baseline. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
-- Generated Release notes carry a workflow-management marker so retries can repair them. Before manually curating a generated body, remove that marker; unmarked non-placeholder notes are preserved by later workflow runs.

.agents/skills/rustfs-release-publish/references/release-candidate.md

@@ -1,37 +0,0 @@
-# Release Candidate Preparation
-
-Read for Phases 1–2. The [parent release invariants](../SKILL.md) and Console gate apply.
-
-## Candidate Resume Preflight
-
-- `git status --short` clean; `git fetch origin main --tags`.
-- `gh auth status` works; confirm you can view `gh release list -L 3`.
-- Confirm the exact final target version with the user if not explicit.
-- Check whether `release/<target>` already exists before creating it; a resumed release reuses the existing branch and its history. For an in-flight release that already has a preview tag but no branch, anchor the new branch to that tag's commit only after verifying its target versions and prior acceptance evidence.
-
-## Phase 1 — Source version bump to the final target (once)
-
-- If `release/<target>` exists, verify its Cargo.toml and workspace members in Cargo.lock read `<target>` and skip the source bump, even if main has advanced. If the branch versions differ, stop and resolve the mismatch without downgrading main.
-- If no branch exists but an unfinished preview tag does, verify its commit has `<target>` in both version files and skip the bump; Phase 2 anchors the branch to that commit. Stop if those files disagree. Otherwise, if main already has `<target>` in both files, skip the bump. Installation references intentionally retain the previous published deliverable during preview; if they were advanced to an unavailable target, restore that baseline before choosing the next candidate.
-- Only when neither the release branch, an unfinished preview tag, nor current main already has `<target>`: if main is at a later version, select and verify a historical commit containing `<target>` rather than downgrading main; block if none exists. Otherwise invoke the `rustfs-release-version-bump` skill with stage `prepare`, the final `<target>` (NOT a preview version), and full GitHub flow (commit/push/PR).
-- If a bump PR was needed, get it merged into main and record its merge commit. For a new release branch when main already has `<target>`, identify the main commit that introduced those versions. Phase 2 chooses a release candidate containing that commit; an existing release branch keeps its own history and a newer main HEAD is not required.
-
-Do not wait for the moving latest main HEAD to become green. The release-branch CI in Phase 2 validates the chosen commit before a preview tag is created.
-
-## Phase 2 — Pin and validate the release candidate, then publish the preview tag
-
-- Use `release/<target>`. On the first attempt, create it from a selected main commit containing the version bump and intended changes; it need not be the latest main HEAD. On a restart, retain the existing branch and backport only reviewed fixes from main. Verify the branch's Cargo versions still equal `<target>`. If adopting an existing preview, run this branch CI before continuing its acceptance; reuse the tag only when it points to the validated SHA.
-- The current `ci.yml` runs automatically on main pushes, not release-branch pushes. Dispatch it explicitly with `gh workflow run ci.yml --ref "release/<target>"`. Locate that dispatch run, verify its `head_sha` equals the release branch's remote HEAD, and require the full expected CI job set to pass, including `Quick Checks`, `Test and Lint`, and `End-to-End Tests (full merge gate)`. Treat a missing or skipped required lane as incomplete. A successful PR check or CI run for a different SHA does not qualify. If the branch advances or a run is cancelled, validate the new SHA again. Do not tag a candidate with failing or incomplete CI.
-- Prefer protecting `release/*` against force pushes and deletion and requiring reviewed backport PRs. Check live rulesets rather than assuming the main ruleset covers release branches; report a missing release-branch rule as a gap.
-- Set `PREVIEW_HASH` to the CI-validated release-branch commit and recheck the remote branch HEAD immediately before tagging. Report the branch, commit, and CI run URL; do not derive `PREVIEW_HASH` from a later `origin/main` fetch. When adopting an existing preview tag at this SHA, skip tag creation and continue Phase 3.
-
-```bash
-git tag -a "<preview-tag>" -m "Release <preview-tag>" "$PREVIEW_HASH"
-git push origin "<preview-tag>"
-```
-
-Pushing the tag triggers `.github/workflows/build.yml` ("Build and Release"); `docker.yml` chains off it via `workflow_run`.
-
-The preview run builds versioned artifacts and publishes them in a GitHub prerelease. Docker may publish exact preview image tags. Latest-channel, R2, and Helm publication must be skipped; installation references and the website announcement stay unchanged.
-
-On a restart after a backport, re-run release-branch CI before setting the new `PREVIEW_HASH`. Use the next unused preview iteration when the validated commit differs from an existing preview tag; never move an existing tag.

.agents/skills/rustfs-release-version-bump/SKILL.md

@@ -1,24 +1,118 @@
 ---
 name: rustfs-release-version-bump
-description: Prepare an exact RustFS Cargo version or align installation references after publication. Use for requested version bumps or the release workflow.
+description: "Prepare Cargo versions for an exact RustFS target, or align installation references after its artifacts are published, with verification and optional commit/push/PR delivery. Use for an explicit version bump or when invoked by the release-publish workflow."
 ---
-# Release Version Files
+# RustFS Release Version Bump
 
-Require an exact target; ask if missing or ambiguous. Reject targets containing `-preview`: those are tag-only. Infer `post-release` only from an explicit request or parent workflow; otherwise use `prepare`. Delivery defaults to local edit/verify; commit, push, PR, and merge follow existing authorization and [Git rules](../../references/pull-requests.md).
+Use this skill to prepare and verify release version files. Commit, push, and PR steps apply only when included in the user's delivery scope; publishing release tags belongs to `rustfs-release-publish`.
 
-| Stage | Files and constraints |
-|---|---|
-| `prepare` | Only `Cargo.toml` and `Cargo.lock`: workspace package, internal dependency, and workspace member versions become `<target>`. External dependencies stay unchanged. |
-| `post-release` | Only `README.md`, `README_ZH.md`, `flake.nix`, `helm/rustfs/Chart.yaml`, and `rustfs.spec`. Cargo may already target the next release; leave it untouched. |
+## Required inputs
 
-Before installation edits, verify the exact non-preview Release, downloadable assets/source archive, pullable `rustfs/rustfs:<target>` image manifest, and published Helm chart. Block on missing artifacts. Do not downgrade defaults if a newer deliverable superseded the target. Preview preparation retains the previous published installation references; follow-up commits never replace either validated tag.
+- Exact target version, for example `1.0.0-beta.4`.
+- Stage: `prepare` (default) or `post-release`. Infer `post-release` only when the user or parent release workflow explicitly requests installation updates after publication; a normal version bump means `prepare`.
+- Delivery scope: local (`edit/verify`), git (`commit/push`), or GitHub
+  (`commit/push/PR`). Derive it from the conversation; when unspecified, prepare
+  and verify locally without blocking on a delivery question.
 
-Packaging policy:
+If target version is missing or ambiguous, stop and ask before editing.
 
-- Docker image tags have no `v` prefix. Derive chart/app versions with `scripts/helm_chart_version.sh <target>` (`beta.N -> 0.N.0`; other versions unchanged). Helm CI derives versions from the final tag, so no early chart bump is required.
-- RPM `Version` is numeric; `Release` is the prerelease suffix or `1` for stable. Expanded `Source0` and the unpack directory must resolve to the exact target including its suffix. Add the changelog entry using current git identity, date, and target; never copy an example identity/date.
-- Changing these mappings requires explicit confirmation.
+Reject any target version containing `-preview`: preview identifiers are tag-only (see `rustfs-release-publish`) and must never be written into version files. If asked for one, stop and point to the release pipeline instead of editing.
 
-Verification follows root tiers: `prepare` validates Cargo metadata with the updated lockfile and checks every workspace/internal version with no unrelated lockfile updates. `post-release` renders Helm with the verified image, runs `scripts/test_helm_chart_version.sh` for chart version edits, and checks README, Nix, and RPM references. Run `git diff --check`; report unresolved required checks as `BLOCKED` without unrelated fixes.
+## Read before editing
 
-For authorized commits, keep stages separate: `chore(release): prepare <target>` or `chore(release): align installation references for <target>`. Report target/stage, changed files, verification, material uncertainty, and actual commit/push/PR state.
+- `AGENTS.md` (root and nearest path-specific files).
+- `.github/pull_request_template.md` only when preparing a PR.
+- Current branch status and diff against `origin/main`.
+
+## Stage boundaries
+
+`prepare` updates only:
+
+- `Cargo.toml`
+- `Cargo.lock`
+
+`post-release` updates installation and packaging references only:
+
+- `README.md`
+- `README_ZH.md`
+- `flake.nix`
+- `helm/rustfs/Chart.yaml`
+- `rustfs.spec`
+
+During preview, installation references intentionally retain the previous published deliverable. Do not sweep them into a source bump to make every version string match. `flake.nix` builds local source, but its package label is aligned with the other packaging references after publication.
+
+Before `post-release` edits, verify that the exact non-preview target has a published GitHub Release, downloadable assets and source archive, and a pullable `rustfs/rustfs:<target>` image manifest. If any prerequisite is missing, report `BLOCKED` and leave installation references unchanged. If a newer deliverable has already superseded this target, do not downgrade installation defaults during a retry.
+
+Helm CI derives chart versions from the triggering tag, so the final tag can retain the previous Chart.yaml values. Update the repository copy only after the target image and published chart are available. Neither post-release changes nor their merge commit may replace the preview-validated final tag.
+
+## Hard release policy
+
+- Docker doc tags use `<version>` (for example `rustfs/rustfs:1.0.0-beta.4`), not `v<version>`.
+- Derive Helm chart and app versions with `scripts/helm_chart_version.sh <target>`; the existing mapping is `beta.N -> 0.N.0`, with other target versions retained.
+- `rustfs.spec` `Release` uses the prerelease suffix (for example `beta.4`), or `1` for a stable release.
+- Do not change these rules without explicit confirmation.
+
+## Step-by-step workflow
+
+1. Confirm intent and isolate scope
+- Use the exact target and delivery scope already supplied; ask only for a missing or ambiguous target or a material release-policy choice.
+- Inspect current branch and ensure only release-related files are touched for this task.
+
+2. Update workspace versions (`prepare` only)
+- Bump `[workspace.package].version` in `Cargo.toml`.
+- Bump internal workspace crate dependency versions in `Cargo.toml`.
+- Update `Cargo.lock` so workspace package versions match target version.
+- Re-scan Cargo.toml and workspace members in Cargo.lock for partial leftovers; leave external dependency versions unchanged.
+
+3. Update installation references (`post-release` only)
+- `README.md` and `README_ZH.md`: update versioned Docker examples to target version.
+- `flake.nix`: update package version to target version.
+- `helm/rustfs/Chart.yaml`: use the app and chart versions returned by `scripts/helm_chart_version.sh <target>`.
+- `rustfs.spec`:
+- Set `Version` to the numeric version and `Release` to the prerelease suffix (example `beta.4`), or `1` for a stable release. Verify that `Source0` and the unpacked source directory resolve to the exact published target, including its prerelease suffix when present.
+- Add/update top changelog entry with exact format:
+- `* Thu May 20 2026 houseme <housemecn@gmail.com>`
+- `- Update RPM package to RustFS 1.0.0-beta.4`
+- Changelog identity and time must come from current environment:
+- `git config --get user.name`
+- `git config --get user.email`
+- `date '+%a %b %d %Y'`
+- Changelog version text must match target release version exactly.
+
+4. Verify before shipping
+- Follow the root verification tiers for the final diff instead of running a full-workspace gate for version strings.
+- For `prepare`, validate Cargo metadata with the updated lockfile and confirm workspace package/internal dependency versions agree. Do not accept a lockfile containing unrelated dependency updates.
+- For `post-release`, render the Helm chart and confirm its default image is the verified target; run `scripts/test_helm_chart_version.sh` when chart versions change. Check the README image tags, Nix package version, and expanded RPM source URL against that same target.
+- Run `git diff --check` for either stage. Report unresolved required checks as `BLOCKED`; do not silently widen scope to fix unrelated issues.
+
+5. Commit strategy (only when committing is authorized)
+- Use `chore(release): prepare <version>` for `prepare` and `chore(release): align installation references for <version>` for `post-release`.
+- These stages happen on opposite sides of publication; do not combine them in a preview-preparation commit or PR.
+- Stage only intended release files; do not include unrelated working tree changes.
+
+6. Push and PR (only for the authorized delivery scope)
+- Push branch:
+- Use the user-requested or configured push remote: `git push -u <push-remote> <branch>` (first push), or `git push` when tracking is already configured.
+- Create PR with template headings unchanged:
+- `gh pr create --base main --head <branch> --title ... --body-file ...`
+- PR title/body must be English.
+- Use `N/A` for non-applicable template sections.
+- Include verification commands and any `BLOCKED` reason clearly.
+
+## Recommended check commands
+
+- `git status --short --branch`
+- `git diff --name-only origin/main...HEAD`
+- `git diff --stat origin/main...HEAD`
+- `rg -n "<old_version>|<new_version>" Cargo.toml Cargo.lock README.md README_ZH.md flake.nix helm/rustfs/Chart.yaml rustfs.spec`
+
+## Output contract
+
+When using this skill, always report:
+
+- Target version and stage.
+- Files changed.
+- Any assumptions or uncertainties requiring confirmation.
+- Verification result (`PASSED` or `BLOCKED`) with key evidence.
+- Commit message(s) used.
+- Push status and PR URL when GitHub flow is requested.

.agents/skills/security-advisory-lessons/references/advisory-patterns.md

@@ -50,7 +50,6 @@ Update this file only when an advisory adds or changes a reusable lesson, affect
 
 - `GHSA-g8w9-qw9q-fghr` and `GHSA-xm99-m3gq-83g8`: a valid presigned `PutObject` accepted extra `x-amz-*` headers omitted from `SignedHeaders`; `x-amz-copy-source` could turn that upload capability into a cross-bucket read performed as the signer. Lesson: a presigned URL is a bounded capability; inspect all received security-sensitive headers and reject unsigned ones before selecting the S3 operation or reaching storage.
 - `GHSA-3ppv-fx5m-m749`: explicit `versionId` reads and copy sources authorized `s3:GetObject` instead of `s3:GetObjectVersion`. Lesson: version-specific object access must select version-specific actions for direct reads, `CopyObject`, and `UploadPartCopy`, with tests proving the backend is not reached on denial.
-- `GHSA-gjph-xcgw-4p7w`: `PutObject` and browser POST accepted a caller-supplied `versionId` and replaced an unlocked historical version with only `s3:PutObject`. Lesson: only replication-authorized writes may choose an existing version ID; ordinary uploads must not rewrite version history.
 - `GHSA-x298-9x87-fvjq`: anonymous `ListObjectVersions` fell back to `ListBucket` and returned before public-access-block gates. Lesson: compatibility fallbacks must converge on the same post-authorization checks as direct grants, especially `RestrictPublicBuckets` and anonymous data-plane denies.
 - `GHSA-mx42-j6wv-px98`: `UploadPartCopy` missed source authorization and allowed cross-bucket object exfiltration. Lesson: multipart copy must enforce the same source and destination contract as `CopyObject`.
 - `GHSA-wfxj-ph3v-7mjf`: `UploadPartCopy` checked source and destination independently but missed destination copy-source policy constraints. Lesson: source read and destination write checks are not sufficient when policy constrains allowed copy sources.
@@ -61,14 +60,12 @@ Update this file only when an advisory adds or changes a reusable lesson, affect
 - `GHSA-3g29-xff2-92vp`: FTP `RETR` and `SIZE`/`MDTM` read paths authenticated the user but skipped IAM before calling storage. Lesson: non-HTTP protocol frontends must enforce the same per-operation authorization as the S3 API before backend access.
 - `GHSA-g3vq-vv42-f647`: FTPS `MKD` called `create_bucket` without checking `s3:CreateBucket`. Lesson: protocol command handlers need action-specific checks even when sibling handlers already authorize correctly.
 - `GHSA-3p3x-734c-h5vx`: FTPS and WebDAV compared secret keys with early-return string equality, while FTPS also returned distinguishable invalid-user and invalid-password failures. Lesson: password-style protocol auth needs constant-time secret comparison, indistinguishable failures where practical, and rate limiting.
-- `GHSA-rhg6-jrf2-29c4`: WebDAV, FTP/FTPS, and SFTP used identity-policy checks with empty conditions and bypassed S3 bucket-policy explicit denies and condition-key denies. Lesson: alternate listeners must evaluate the same effective policy and trustworthy request context before storage access.
 
 ### Filesystem paths and object key traversal
 
 - `GHSA-pq29-69jg-9mxc`: RPC `read_file_stream` joined untrusted paths under a volume directory without canonical boundary checks. Lesson: `PathBuf::join` plus length checks are not path security.
 - `GHSA-8r6f-hmq2-28rg`: object keys containing traversal sequences bypassed bucket/object authorization when mapped to filesystem paths. Lesson: reject traversal at object-key parsing and verify final storage paths remain under the expected bucket/key root.
 - `GHSA-f4vq-9ffr-m8m3`: Snowball auto-extract accepted archive entries such as `../victim-bucket/object`, authorized the raw attacker-bucket path, then storage path cleaning crossed bucket boundaries. Lesson: archive entries become object keys and need traversal rejection plus consistent authz/storage normalization before writes.
-- `GHSA-g7fq-6xjm-mxf4`: versioned `DeleteObjects` accepted dot-segment keys, authorized the literal prefix, then wrote delete markers under a resolved sibling prefix. Lesson: validate each batch key before authorization and storage normalization, using the same object-name rules as single delete.
 
 ### Secrets, defaults, and cryptographic misuse
 
@@ -109,7 +106,6 @@ Update this file only when an advisory adds or changes a reusable lesson, affect
 ### Object Lock and retention invariants
 
 - `GHSA-j548-9grx-fh4f`: Object Lock enforcement treated unreadable, fabricated, or unparsable bucket metadata as absent configuration and allowed retained objects to be deleted or expired. Lesson: retention must fail closed unless Object Lock absence is authoritative, and every delete, lifecycle, scanner, force-delete, and default-retention path needs the same state distinction.
-- `GHSA-28w4-rp2p-636w` and `GHSA-c7hx-vr97-45rg`: an authorized `DeleteBucket` with `x-rustfs-force-delete: true` removed active COMPLIANCE-retained versions even though ordinary version deletion was denied. Lesson: bucket force-delete must enforce retention across every version, including against root/owner callers.
 
 ### Serde deserialization and input validation
 
@@ -139,17 +135,16 @@ rg -n "deny_unknown_fields|serde.default|as u32|as usize|as i32" rustfs crates
 ## Minimum Regression Test Expectations
 
 - Authz fixes: include unauthenticated, valid low-privilege, wrong-action, correct-action, owner, non-owner, and root/admin cases as applicable.
-- Protocol frontend authz fixes: include denied `RETR`, `SIZE`/`MDTM`, `MKD`, bucket probe, and sibling allowed-operation cases; test bucket-policy explicit denies and condition-key denies on each enabled listener against an S3 control, and assert denied paths do not reach storage.
+- Protocol frontend authz fixes: include denied `RETR`, `SIZE`/`MDTM`, `MKD`, bucket probe, and sibling allowed-operation cases, and assert denied paths do not reach the storage backend.
 - IAM fixes: include import/update/list service-account cases with attacker-controlled parent, claims, access key, secret key, and policy.
 - Copy/upload fixes: include cross-bucket, cross-user, source-denied, destination-denied, copy-source-condition, and multipart completion cases.
 - Presigned upload fixes: include a valid presign with extra unsigned tagging, redirect, storage-class, and cross-bucket copy-source headers; require rejection before source or destination storage access, and verify explicitly signed equivalents still work.
 - Version-action fixes: include historical UUID, explicit current version, `null`, range, partNumber, presigned, STS/session, service-account, anonymous bucket-policy, copy source, and multipart-copy source cases.
-- Version-write fixes: a `PutObject`-only principal must not replace an existing version through `PutObject` or browser POST `?versionId=`; verify replication-authorized writes and versioned, suspended, and unversioned buckets separately.
 - Policy-condition fixes: include reserved-key header collisions, missing keys, partially overlapping multi-value sets, plugin mode, and built-in policy mode.
-- Path fixes: include encoded traversal, absolute path, nested traversal, archive entries with `..`, valid object keys that resemble traversal text but should be rejected, and canonical bucket/prefix boundary checks; test per-key `DeleteObjects` errors and prefix-scoped denials on versioned buckets.
+- Path fixes: include encoded traversal, absolute path, nested traversal, archive entries with `..`, valid object keys that resemble traversal text but should be rejected, and canonical bucket/prefix boundary checks.
 - Logging fixes: assert redacted output for structs and response bodies that may contain credentials.
 - IAM export fixes: assert exported archives omit plaintext user and service-account secrets unless the format deliberately encrypts or seals them.
 - RPC auth fixes: include captured metadata replay across two concrete methods, stale timestamps, wrong path, wrong method surrogate, wrong secret, and valid same-method calls.
 - Browser/CORS fixes: assert no credentials on reflected/default origins, correct behavior for explicit allowlists, and no same-origin script execution for previewed object content.
 - SSE fixes: inspect stored bytes and verify API metadata, read-back behavior, and on-disk ciphertext together; for ETags, upload equal plaintext under different keys and assert list-only callers cannot derive or correlate the plaintext digest, including multipart objects.
-- Object Lock fixes: include unreadable metadata, fabricated metadata defaults, unparsable config, confirmed absent config, COMPLIANCE/GOVERNANCE retention, lifecycle expiry, scanner sweeps, and force-delete paths; an authorized force-delete must preserve active COMPLIANCE versions.
+- Object Lock fixes: include unreadable metadata, fabricated metadata defaults, unparsable config, confirmed absent config, COMPLIANCE/GOVERNANCE retention, lifecycle expiry, scanner sweeps, and force-delete paths.

.agents/skills/test-coverage-improver/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: test-coverage-improver
+description: Analyze a supplied coverage report or perform an explicitly requested RustFS coverage assessment, rank uncovered risks, and propose focused tests. Do not trigger for ordinary implementation verification, a single regression test, documentation wording, or release preparation without a coverage request.
+---
+
+# Test Coverage Improver
+
+Use this skill when you need a prioritized, risk-aware plan to improve tests from coverage results.
+
+## Usage assumptions
+- Focus scope is either changed lines/files, a module, or the whole repository.
+- Reuse a supplied coverage artifact when its revision, scope, and format match.
+- If required context is missing, call out assumptions explicitly before proposing work.
+
+## Workflow
+
+1. Define scope and baseline
+   - Derive the revision and scope from the request, diff, or supplied report.
+   - Default to the affected files/module; whole-workspace coverage requires that
+     scope in the request. Ask only if a wrong scope would change the result.
+
+2. Obtain coverage evidence
+   - First inspect a matching existing artifact; do not regenerate it merely
+     because this skill was selected.
+   - If measurement is needed, read the Coverage section of
+     [the testing guide](../../../docs/testing/README.md#coverage), check disk
+     space/tool availability, and select package/test-scoped `cargo llvm-cov`
+     using the repository's nextest configuration. `make coverage` measures the
+     whole workspace (excluding E2E) and is only for that requested scope.
+   - Collect only metrics the report supports. Missing branch/changed-line
+     coverage is unknown, not zero.
+   - If measurement cannot run, continue with code-based test proposals and
+     mark measured coverage unverified; do not invent a coverage percentage.
+
+3. Rank highest-risk gaps
+   - Prioritize changed code, branch coverage gaps, and low-confidence boundaries.
+   - Apply the risk rubric in [coverage-prioritization.md](references/coverage-prioritization.md).
+   - Report up to 5–8 evidenced gaps; do not pad a small scope.
+   - For each gap, capture: file, lines, uncovered branches, and estimated risk score.
+
+4. Propose high-impact tests
+   - For each gap, name the behavior and regression, distinguishing assertions,
+     relevant normal/edge/failure cases, necessary setup, and estimated effort.
+   - Include only scenarios and setup that apply; reuse shared fixture details.
+
+5. Close with validation plan
+   - State which gaps remain after proposals.
+   - Give a scoped verification command and behavior-based acceptance criterion;
+     use a coverage threshold only when the task or repository requires one.
+   - List assumptions or blockers (environment, fixtures, flaky dependencies).
+
+## Report
+
+Summarize the supported metrics, then combine each ranked gap with its proposed
+test and validation. Include source lines only when supplied or inspected;
+mark missing metrics or locations as unknown. Do not duplicate gaps and tests
+in separate templates or fill empty categories for an otherwise small report.

.agents/skills/test-coverage-improver/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Test Coverage Improver"
+  short_description: "Find top uncovered risk areas and propose high-impact tests."
+  default_prompt: "Use $test-coverage-improver to analyze coverage for the requested scope, reuse matching reports, and propose tests for evidenced risks."

.agents/skills/test-coverage-improver/references/coverage-prioritization.md

@@ -0,0 +1,25 @@
+# Coverage Gap Prioritization Guide
+
+Use this rubric for each uncovered area.
+
+Score = (Criticality × 2) + CoverageDebt + (Volatility × 0.5)
+
+- Criticality:
+  - 5: authz/authn, data-loss, payment/consistency path
+  - 4: state mutation, cache invalidation, scheduling
+  - 3: error handling + fallbacks in user-visible flows
+  - 2: parsing/format conversion paths
+  - 1: logging-only or low-impact utilities
+
+- CoverageDebt:
+  - 0: 0–5 uncovered lines
+  - 1: 6–20 uncovered lines
+  - 2: 21–40 uncovered lines
+  - 3: 41+ uncovered lines
+
+- Volatility:
+  - 1: stable legacy code with few recent edits
+  - 2: changed in last 2 releases
+  - 3: touched in last 30 days or currently in active PR
+
+Sort by score descending, then by business impact.

.config/e2e-distributed-selection.txt

@@ -1,2 +1,2 @@
-sha256-linux=233bd7a68777eda1f044b6cb77128056be2b6492583c0dfd114b21e98a6102ef
-sha256-darwin=233bd7a68777eda1f044b6cb77128056be2b6492583c0dfd114b21e98a6102ef
+sha256-linux=6fc377fa1f9f06e065f077c7bd53d04efbccf4453f95dde67afaa47778185377
+sha256-darwin=6fc377fa1f9f06e065f077c7bd53d04efbccf4453f95dde67afaa47778185377

.config/e2e-full-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=98dff0961c6eb21d6128bfd2d4a6100a624ddf1fb7db05dba360a5d3d0a310c2
-sha256-linux=890f5925b87e1bf3710c356253f3b2276d901e156df9ccc04ec9315374de6d22
+sha256-darwin=14c8cd76b8cbf643329c371daa70a5edd4357d42259a2fd9c653e548675d4a6d
+sha256-linux=80d0fae627007c31f250fb1fb21c8a952861195d53d7f60b6e71636d5ca65b46

.config/e2e-protocols-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=a2cb67d91eb0d093928371d6e84a84b2dd41b2ba975a28094e81879bd65838ad
-sha256-linux=82db0561cf9b111f11782d647d0859c9d2a44c5c68481b5e39c48505828bd392
+sha256-darwin=55534a97fbd376f64c8f6c341d319017d11ff77cad6da8629a1a7f6a874e0315
+sha256-linux=c06fb8c19aed6f388b9dc61cb8251b7a44f8561a9bf764ad2b9e635598f8dc17

.config/e2e-smoke-selection.txt

@@ -1 +1 @@
-sha256=ba8f392b617cf9f2338142233a417e43927b28096635e628233ce8a60cf49d10
+sha256=476cb92aa9e385c9bb509ee5df3e5bd07e8c929730040b60d16791b6c0616d00

.config/ecstore-required-tests.json

@@ -55,281 +55,6 @@
       "invariant": "odm-source-contract-gcs",
       "suite": "rustfs",
       "name": "on_demand_migration::gcs::tests::gcs_native_backend_satisfies_the_shared_backend_contract"
-    },
-    {
-      "invariant": "rollback-inspection",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_incomplete_preserves_overwrite_data_dirs_and_staging"
-    },
-    {
-      "invariant": "rollback-closed-inspection-channel",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_closed_heal_receiver_preserves_recovery_material"
-    },
-    {
-      "invariant": "rollback-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_incomplete_cancelled_task_is_not_success"
-    },
-    {
-      "invariant": "rollback-completion-equivalence",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_incomplete_matches_early_ack_and_full_wait_after_reopen"
-    },
-    {
-      "invariant": "rollback-physical-owner",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_children_keep_namespace_ownership_after_coordinator_panic"
-    },
-    {
-      "invariant": "late-ack-retains-commit",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_data_early_ack_post_mutation_tail_error_never_rolls_back_commit"
-    },
-    {
-      "invariant": "tail-drained-cas",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::tail_drained_put_waits_for_tail_and_allows_immediate_cas"
-    },
-    {
-      "invariant": "seeded-put-tail-pressure",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::seeded_put_completion_pressure_drains_every_real_tail"
-    },
-    {
-      "invariant": "borrowed-lock-tail",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::no_lock_put_waits_for_rename_tail_under_outer_guard"
-    },
-    {
-      "invariant": "cancelled-writer-owner",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::tail_drained_put_owned_commit_survives_waiter_cancellation"
-    },
-    {
-      "invariant": "get-body-reconstruction",
-      "suite": "rustfs-ecstore",
-      "name": "ecstore_validation_blackbox::blackbox_get_restores_body_after_one_shard_file_is_removed"
-    },
-    {
-      "invariant": "range-reconstruction",
-      "suite": "rustfs-ecstore",
-      "name": "ecstore_validation_blackbox::blackbox_range_read_restores_exact_slice_with_one_offline_disk"
-    },
-    {
-      "invariant": "multipart-abort-linearization",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::abort_and_complete_linearize_for_plain_sse_and_legacy_layouts"
-    },
-    {
-      "invariant": "multipart-write-quorum",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::abort_enforces_delete_write_quorum_boundary"
-    },
-    {
-      "invariant": "multipart-physical-owner",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::complete_multipart_timeout_keeps_namespace_owner_until_physical_publication"
-    },
-    {
-      "invariant": "restore-abort-cleanup",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::transition_commit_failure_tests::multipart_restore_aborts_every_post_create_failure"
-    },
-    {
-      "invariant": "legacy-metadata",
-      "suite": "rustfs-filemeta",
-      "name": "filemeta::test::test_issue_2288_legacy_xlmeta_compatibility"
-    },
-    {
-      "invariant": "legacy-nil-version",
-      "suite": "rustfs-filemeta",
-      "name": "filemeta::test::test_into_fileinfo_reads_legacy_nil_uuid_inline_key"
-    },
-    {
-      "invariant": "commit-phase-schedule",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::commit_fault_schedule_keeps_multiple_disk_phases_independent"
-    },
-    {
-      "invariant": "commit-phase-ownership",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::commit_fault_schedule_rejects_duplicate_checkpoint_without_disarming_owner"
-    },
-    {
-      "invariant": "metadata-observation-all-four-slot-states-and-arrival-orders-preserve-reduction",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_all_four_slot_states_and_arrival_orders_preserve_reduction"
-    },
-    {
-      "invariant": "metadata-observation-mixed-current-identity-arrivals-preserve-selection",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_mixed_current_identity_arrivals_preserve_selection"
-    },
-    {
-      "invariant": "metadata-observation-pending-newer-version-and-same-time-different-directory-force-full-wait",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_pending_newer_version_and_same_time_different_directory_force_full_wait"
-    },
-    {
-      "invariant": "metadata-observation-duplicate-shard-cannot-supply-a-read-reserve",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_duplicate_shard_cannot_supply_a_read_reserve"
-    },
-    {
-      "invariant": "metadata-observation-null-versions-markers-and-invalid-success-keep-their-meaning",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_null_versions_markers_and_invalid_success_keep_their_meaning"
-    },
-    {
-      "invariant": "metadata-cache-real-get-and-range-preserve-body-across-read-modes",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::read::metadata_cache_tests::metadata_cache_real_get_and_range_preserve_body_across_read_modes"
-    },
-    {
-      "invariant": "late-metadata-refresh-rejects-changed-generation-and-mapped-shards",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::read::metadata_cache_tests::late_metadata_refresh_rejects_changed_generation_and_mapped_shards"
-    },
-    {
-      "invariant": "late-full-get-rejects-changed-object-generation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::prepared_get_object_metadata_tests::non_inline_two_phase_get_rejects_generation_change_before_late_refresh"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-static-namespace",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_static_namespace"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-cross-subdirectory-limit",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_cross_subdirectory_limit"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-max-and-max-plus-one",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_max_and_max_plus_one"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-fixed-seed-marker-and-prefix",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_fixed_seed_marker_and_prefix"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-offline-corrupt-and-minority-stale",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_offline_corrupt_and_minority_stale"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-versions-delete-markers-and-free-versions",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_versions_delete_markers_and_free_versions"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-orphan-cleanup-requires-authoritative-evidence",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_orphan_cleanup_requires_authoritative_evidence"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-consumer-drop-joins-real-disk-producer",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_consumer_drop_joins_real_disk_producer"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-cancelled-quorum-walk-releases-senders-and-disk-lock",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_cancelled_quorum_walk_releases_senders_and_disk_lock"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-enabled-index-contracts",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_enabled_index_contracts"
-    },
-    {
-      "invariant": "borrowed-context-boundary",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::borrowed_write_context_rejects_wrong_namespace_and_cache_flag"
-    },
-    {
-      "invariant": "borrowed-put-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::borrowed_tail_drained_put_keeps_owner_after_caller_cancel"
-    },
-    {
-      "invariant": "borrowed-mpu-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::borrowed_complete_keeps_namespace_owner_after_caller_cancel"
-    },
-    {
-      "invariant": "pool-cas-owner",
-      "suite": "rustfs-ecstore",
-      "name": "core::pools::pools_tests::pool_meta_cas_context_retains_actual_owner_for_exact_target"
-    },
-    {
-      "invariant": "pool-cas-released-owner",
-      "suite": "rustfs-ecstore",
-      "name": "core::pools::pools_tests::pool_meta_cas_rejects_released_owner"
-    },
-    {
-      "invariant": "copy-tail-drained",
-      "suite": "rustfs-ecstore",
-      "name": "store::object::tests::borrowed_copy_tail_drained_waits_for_rename_tail"
-    },
-    {
-      "invariant": "catalog-borrowed-publication",
-      "suite": "rustfs",
-      "name": "admin::handlers::table_catalog::tests::commit_backend_borrowed_put_preserves_owner_authorization_and_precondition"
-    },
-    {
-      "invariant": "directory-marker-quorum",
-      "suite": "rustfs-filemeta",
-      "name": "metacache::tests::resolve_directory_marker_and_prefix_preserve_quorum_in_both_orders"
-    },
-    {
-      "invariant": "logical-prefix-limit",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::test::list_path_gather_results_counts_common_prefixes_before_page_limit"
-    },
-    {
-      "invariant": "quota-same-name-owner-and-disk-authority",
-      "suite": "rustfs-ecstore",
-      "name": "bucket::metadata_sys::tests::quota_snapshot_reuses_same_name_owner_and_rereads_disk_authority"
-    },
-    {
-      "invariant": "quota-snapshot-scope-and-owner",
-      "suite": "rustfs-ecstore",
-      "name": "bucket::metadata_sys::tests::quota_snapshot_rejects_wrong_scope_incarnation_and_transaction_guard"
-    },
-    {
-      "invariant": "quota-snapshot-lifecycle-and-incarnation",
-      "suite": "rustfs-ecstore",
-      "name": "bucket::metadata_sys::tests::quota_snapshot_rejects_lifecycle_loss_during_read_and_changed_disk_incarnation"
-    },
-    {
-      "invariant": "marker-purge-receipt-reopen",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::marker_purge_receipt_tests::quorum_marker_purge_receipt_survives_reopen_with_stale_member"
-    },
-    {
-      "invariant": "external-minio-shards",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_minio_shards_decode_and_reconstruct_plaintext"
-    },
-    {
-      "invariant": "external-legacy-shards",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_legacy_shards_decode_and_reconstruct_plaintext"
-    },
-    {
-      "invariant": "external-shard-bitrot",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_erasure_shards_reject_bitrot_corruption"
-    },
-    {
-      "invariant": "external-shard-quorum-codec",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_erasure_shards_reject_insufficient_quorum_and_wrong_codec"
     }
   ],
   "fixtures": [
@@ -357,36 +82,6 @@
       "path": "crates/ecstore/tests/fixtures/minio/bucket_metadata_full.xlmeta.hex",
       "sha256": "3b6de589519c08a1614c8bd409bb8199c17d42043861b07bce513075e6fbfc12",
       "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/minio/README.md"
-    },
-    {
-      "path": "crates/filemeta/tests/fixtures/issue_2288_legacy_xlmeta.hex",
-      "sha256": "b3e8d32f9950a38b5dc71f679519cc830a2b2a807e8b0b39f78840b238d8eacf",
-      "source": "Legacy xl.meta captured for rustfs/backlog#2288; filemeta::test::test_issue_2288_legacy_xlmeta_compatibility"
-    },
-    {
-      "path": "crates/filemeta/tests/fixtures/issue_2265_legacy_meta_v2_object.hex",
-      "sha256": "89dd7ec92d16e54b5d31e0c49c9edffff8a7aa58890aaeff59bc2ff84da0a62f",
-      "source": "Legacy metadata v2 object captured for rustfs/backlog#2265; crates/filemeta/src/test_data.rs"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/list_namespace_keys.json",
-      "sha256": "5afddb60565deba0938e617470255563f0e15a15fab699645c59bb7ccc84898e",
-      "source": "Shared static LIST namespace corpus; ECStore differential tests and ODM list_through_static_namespace_boundary_matrix"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/erasure-shards/minio/manifest.json",
-      "sha256": "c398f8dcb76903f6cf8eee07931c76592895ced201ff9d59ed4ff9b0ead2b13c",
-      "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/erasure-shards/README.md"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/erasure-shards/legacy/manifest.json",
-      "sha256": "dce397d5b2f42748eb5091b4355bb9d133a50cbba003626fafac28095dbe540b",
-      "source": "RustFS 1.0.0-alpha.37; crates/ecstore/tests/fixtures/erasure-shards/README.md"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/erasure-shards/plaintext.bin",
-      "sha256": "b5a83332327961a31b65a8731c64559fd04ff8ac9f6124022201dbbdba5ffa01",
-      "source": "Independent fixed SHA256 counter-stream oracle; crates/ecstore/tests/fixtures/erasure-shards/README.md"
     }
   ]
 }

.config/nextest.toml

@@ -64,26 +64,6 @@ command = ['sh', '-c', 'echo RUST_MIN_STACK=33554432 >> "$NEXTEST_ENV"']
 command = ['sh', '-c', 'echo RUST_MIN_STACK=33554432 >> "$NEXTEST_ENV"']
 
 # --- default profile (local): serialize the flaky groups, never retry --------
-# These real-disk progress oracles exercise fsync, quorum IO, and crash/replay
-# boundaries. Reserve the run's capacity so unrelated fixtures cannot starve
-# their existing deadlines and typed-failure assertions (rustfs/backlog#2706).
-# Keep each test's internal concurrency and zero-retry policy unchanged.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(/^connect::diagnostics::schedule::tests::/)'
-threads-required = "num-test-threads"
-
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & (test(/^set_disk::tests::streaming_get_blocks_concurrent_/) | test(=store::object::tests::retired_marker_converges_after_bucket_recreation_on_sixteen_disks))'
-threads-required = "num-test-threads"
-
-[[profile.default.overrides]]
-filter = 'package(rustfs-heal) & (binary(mrf_partial_write_test) | (binary(mrf_pipeline_test) & test(/^journal_replay_survives_/)) | test(=admin_selector_survives_sigkill_with_original_scope_and_receipts))'
-threads-required = "num-test-threads"
-
-[[profile.default.overrides]]
-filter = 'package(rustfs-scanner) & (test(/^scanner::backlog::tests::native_(writer|retirement)_/) | test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(/^scanner_io::tests::service_cohort::/))'
-threads-required = "num-test-threads"
-
 [[profile.default.scripts]]
 filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(batch_transitioned_delete_uses_free_version_per_item|decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|dispatched_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|force_tier_remove_blocks_on_physical_free_version_hidden_by_other_pool|legacy_unknown_transition_delete_falls_back_for_single_batch_and_blocks_prefix|multi_pool_(recursive_prefix_rejects_legacy_or_hidden_merge_loser_before_delete|same_remote_tuple_(batch|single)_delete_waits_for_all_sources|same_tuple_recursive_prefix_uses_one_journal_owner|transitioned_delete_persists_one_free_version_per_remote_tuple)|recursive_prefix_partial_(pool|set)_failure_keeps_prepared_cleanup_owners|restored_transitioned_delete_uses_free_version_as_cleanup_owner|stable_transitioned_recursive_prefix_delete_uses_journal_owners|suspended_null_transition_delete_uses_free_version_as_sole_owner|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)|transitioned_delete_(free_version_replays_after_store_restart|local_quorum_failure_rolls_back_without_cleanup_owner|uses_free_version_as_cleanup_owner)|versioned_delete_marker_keeps_transitioned_source_and_remote_object|versioned_explicit_transition_delete_preserves_other_version_then_allows_bucket_delete))$/)'
 setup = 'ecstore-large-stack'
@@ -92,12 +72,6 @@ setup = 'ecstore-large-stack'
 filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
 setup = 'ecstore-base-stack'
 
-# These handler/store fixtures and the relocated-pool GET compose deep storage
-# futures in libtest threads; on Linux they overflow the default 2 MiB stack.
-[[profile.default.scripts]]
-filter = 'package(rustfs) & (test(/^admin::handlers::table_catalog::tests::/) | test(/^table_catalog::store::tests::/) | test(=app::object::get::tests::execute_get_object_resumes_from_relocated_pool_without_splicing_body))'
-setup = 'ecstore-base-stack'
-
 [[profile.default.scripts]]
 filter = 'binary(lifecycle_integration_test) | (package(rustfs) & test(/^app::lifecycle_transition_api_test::/))'
 setup = 'lifecycle-large-stack'
@@ -176,11 +150,10 @@ filter = 'package(rustfs) & (binary(/^embedded.*_test$/) | binary(admin_diagnost
 test-group = 'embedded-test-ports'
 
 # Registration, inventory delivery, and real drive/object probes include
-# filesystem or HTTP IO in short deadlines. Reserve capacity so sibling test
+# durable filesystem IO in short deadlines. Reserve capacity so sibling test
 # processes cannot exhaust those budgets. Keep deadlines and assertions intact.
-# The short HTTP fixtures are tracked in rustfs/backlog#2714.
 [[profile.default.overrides]]
-filter = 'package(rustfs) & (binary(/^connect_registration$/) | binary(connect_inventory) | binary(connect_perf_drive) | (binary(connect_perf_client) & test(=configured_proxy_and_direct_endpoint_failures_are_distinct)) | (binary(connect_perf_object) & test(/^(real_rustfs_endpoint_and_production_cli_support_bounded_get_and_put|cleanup_uses_a_budget_independent_of_the_measurement_window|oversized_response_is_rejected_without_buffering_it)$/)))'
+filter = 'package(rustfs) & (binary(/^connect_registration$/) | binary(connect_inventory) | binary(connect_perf_drive) | (binary(connect_perf_object) & test(=real_rustfs_endpoint_and_production_cli_support_bounded_get_and_put)))'
 threads-required = "num-test-threads"
 
 # This cancellation probe hashes the serving executable before acquiring its
@@ -317,24 +290,6 @@ fail-fast = false
 # marker is the observable signal the flake policy is built around.
 path = "junit.xml"
 
-# Match the local durable-progress reservations. All members, deadlines,
-# assertions, and internal concurrency remain enabled without retries.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(/^connect::diagnostics::schedule::tests::/)'
-threads-required = "num-test-threads"
-
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & (test(/^set_disk::tests::streaming_get_blocks_concurrent_/) | test(=store::object::tests::retired_marker_converges_after_bucket_recreation_on_sixteen_disks))'
-threads-required = "num-test-threads"
-
-[[profile.ci.overrides]]
-filter = 'package(rustfs-heal) & (binary(mrf_partial_write_test) | (binary(mrf_pipeline_test) & test(/^journal_replay_survives_/)) | test(=admin_selector_survives_sigkill_with_original_scope_and_receipts))'
-threads-required = "num-test-threads"
-
-[[profile.ci.overrides]]
-filter = 'package(rustfs-scanner) & (test(/^scanner::backlog::tests::native_(writer|retirement)_/) | test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(/^scanner_io::tests::service_cohort::/))'
-threads-required = "num-test-threads"
-
 [[profile.ci.scripts]]
 filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(batch_transitioned_delete_uses_free_version_per_item|decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|dispatched_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|force_tier_remove_blocks_on_physical_free_version_hidden_by_other_pool|legacy_unknown_transition_delete_falls_back_for_single_batch_and_blocks_prefix|multi_pool_(recursive_prefix_rejects_legacy_or_hidden_merge_loser_before_delete|same_remote_tuple_(batch|single)_delete_waits_for_all_sources|same_tuple_recursive_prefix_uses_one_journal_owner|transitioned_delete_persists_one_free_version_per_remote_tuple)|recursive_prefix_partial_(pool|set)_failure_keeps_prepared_cleanup_owners|restored_transitioned_delete_uses_free_version_as_cleanup_owner|stable_transitioned_recursive_prefix_delete_uses_journal_owners|suspended_null_transition_delete_uses_free_version_as_sole_owner|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)|transitioned_delete_(free_version_replays_after_store_restart|local_quorum_failure_rolls_back_without_cleanup_owner|uses_free_version_as_cleanup_owner)|versioned_delete_marker_keeps_transitioned_source_and_remote_object|versioned_explicit_transition_delete_preserves_other_version_then_allows_bucket_delete))$/)'
 setup = 'ecstore-large-stack'
@@ -343,10 +298,6 @@ setup = 'ecstore-large-stack'
 filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
 setup = 'ecstore-base-stack'
 
-[[profile.ci.scripts]]
-filter = 'package(rustfs) & (test(/^admin::handlers::table_catalog::tests::/) | test(/^table_catalog::store::tests::/) | test(=app::object::get::tests::execute_get_object_resumes_from_relocated_pool_without_splicing_body))'
-setup = 'ecstore-base-stack'
-
 [[profile.ci.scripts]]
 filter = 'binary(lifecycle_integration_test) | (package(rustfs) & test(/^app::lifecycle_transition_api_test::/))'
 setup = 'lifecycle-large-stack'
@@ -439,7 +390,7 @@ filter = 'package(rustfs) & (binary(/^embedded.*_test$/) | binary(admin_diagnost
 test-group = 'embedded-test-ports'
 
 [[profile.ci.overrides]]
-filter = 'package(rustfs) & (binary(/^connect_registration$/) | binary(connect_inventory) | binary(connect_perf_drive) | (binary(connect_perf_client) & test(=configured_proxy_and_direct_endpoint_failures_are_distinct)) | (binary(connect_perf_object) & test(/^(real_rustfs_endpoint_and_production_cli_support_bounded_get_and_put|cleanup_uses_a_budget_independent_of_the_measurement_window|oversized_response_is_rejected_without_buffering_it)$/)))'
+filter = 'package(rustfs) & (binary(/^connect_registration$/) | binary(connect_inventory) | binary(connect_perf_drive) | (binary(connect_perf_object) & test(=real_rustfs_endpoint_and_production_cli_support_bounded_get_and_put)))'
 threads-required = "num-test-threads"
 
 # Preserve the cancellation probe's startup budget and assertions in CI too.

.github/actions/quick-checks/action.yml

@@ -98,10 +98,6 @@ runs:
       shell: bash
       run: make script-tests
 
-    - name: Check object generation protocol model
-      shell: bash
-      run: python3 ./scripts/test_object_generation_protocol_model.py
-
     - name: Check test wiring
       shell: bash
       run: python3 ./scripts/check_test_wiring.py

.github/workflows/audit.yml

@@ -88,7 +88,7 @@ jobs:
   # database lookup with a second ignore list to maintain.
   cargo-deny:
     name: Cargo Deny
-    if: github.repository == 'rustfs/rustfs' && (github.event_name != 'pull_request' || github.event.action != 'closed')
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: sm-standard-2
     timeout-minutes: 20
     steps:
@@ -131,7 +131,7 @@ jobs:
 
   workflow-pin-report:
     name: Workflow Pin Report
-    if: github.repository == 'rustfs/rustfs' && (github.event_name != 'pull_request' || github.event.action != 'closed')
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: sm-standard-2
     timeout-minutes: 5
     steps:
@@ -203,7 +203,7 @@ jobs:
     # workflow produces, and until now it was only visible to whoever happened to
     # open the Actions tab. Same ci-8 mechanism coverage.yml and
     # e2e-replication-nightly.yml already use.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/build.yml

@@ -440,17 +440,6 @@ jobs:
             fi
           done
 
-      - name: Verify macOS binary has no dynamic liblzma dependency
-        if: matrix.platform == 'macos'
-        shell: bash
-        run: |
-          binary="target/${{ matrix.target }}/release/rustfs"
-          if otool -L "$binary" | grep -E 'liblzma.*\.dylib'; then
-            echo "macOS release binary must not depend on a dynamic liblzma library" >&2
-            exit 1
-          fi
-          "$binary" --version
-
       - name: Generate the CPU symbol catalog
         if: endsWith(matrix.target, '-linux-gnu') && matrix.features == 'pyroscope'
         shell: bash

.github/workflows/ci.yml

@@ -36,9 +36,7 @@ on:
       - "flake.lock"
   pull_request:
     types: [ opened, synchronize, reopened, closed ]
-    # gateway/integration carries main's ruleset (rustfs/backlog#2734), so its
-    # pull requests must produce the same required checks.
-    branches: [ main, gateway/integration ]
+    branches: [ main ]
   merge_group:
     types: [ checks_requested ]
   schedule:
@@ -511,7 +509,7 @@ jobs:
     runs-on: sm-standard-4
     timeout-minutes: 90
     strategy:
-      # Preserve independent results when one protocol fails, so diagnosis
+      # Preserve both independent results when one protocol fails, so diagnosis
       # and a focused fix do not require rebuilding an interrupted sibling.
       fail-fast: false
       matrix:
@@ -520,8 +518,6 @@ jobs:
             flags: "--features swift"
           - name: sftp
             flags: "--features sftp"
-          - name: http3
-            flags: "--features http3,swift"
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:

.github/workflows/docker.yml

@@ -551,6 +551,54 @@ jobs:
           if-no-files-found: error
           retention-days: 30
 
+  # Docker Hub's overview is a separate `full_description` field that
+  # `docker push` never touches, so it drifted from README.md and kept
+  # linking to pages that no longer exist (#7995). Republish it from the
+  # commit the images were built from, only when images were pushed.
+  sync-dockerhub-description:
+    name: Sync Docker Hub Description
+    needs: [ build-check, build-docker ]
+    if: needs.build-check.outputs.should_build == 'true' && needs.build-check.outputs.should_push == 'true'
+    runs-on: sm-standard-2
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        with:
+          persist-credentials: false
+          ref: ${{ needs.build-check.outputs.source_ref }}
+          sparse-checkout: README.md
+          sparse-checkout-cone-mode: false
+
+      - name: Sync Docker Hub description
+        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
+        with:
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          repository: ${{ env.REGISTRY_DOCKERHUB }}
+          readme-filepath: ./README.md
+          # README.md links to docs/ and CONTRIBUTING.md by relative path;
+          # rewrite those to github.com URLs so they resolve on Docker Hub.
+          enable-url-completion: true
+
+      # Docker Hub caps `full_description` at 25,000 bytes and the action
+      # truncates to fit with only a warning, which would publish a README
+      # cut off mid-sentence. README.md is already near the cap, so read the
+      # published overview back and fail if it hit the limit.
+      - name: Check published description was not truncated
+        env:
+          REPOSITORY: ${{ env.REGISTRY_DOCKERHUB }}
+        run: |
+          limit=25000
+          published=$(curl -sSf "https://hub.docker.com/v2/repositories/${REPOSITORY}/" \
+            | jq -j '.full_description' | wc -c | tr -d ' ')
+          echo "Published overview: ${published} bytes (Docker Hub limit: ${limit})"
+          # Truncation lands within one UTF-8 character of the cap.
+          if [ "$published" -ge $((limit - 4)) ]; then
+            echo "::error file=README.md::Docker Hub overview was truncated at ${limit} bytes; trim README.md before the next release."
+            exit 1
+          fi
+
   # Docker build summary
   docker-summary:
     name: Docker Build Summary

.github/workflows/e2e-distributed.yml

@@ -78,7 +78,6 @@ concurrency:
 
 jobs:
   distributed:
-    if: github.repository == 'rustfs/rustfs'
     name: Distributed 4-node 4-disk e2e
     # GitHub-hosted VM: loop and tmpfs mounts work here. sm-standard-4 is an
     # ARC pod and rejects both (`mount -o loop` ENOENT, tmpfs "read-only").
@@ -168,13 +167,11 @@ jobs:
           FILTER: ${{ inputs.filter }}
         run: |
           set -euo pipefail
-          rm -f target/nextest/e2e-distributed/junit.xml
           if [ -n "${FILTER}" ]; then
             python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-distributed -p e2e_test -E "${FILTER}"
           else
             python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-distributed -p e2e_test --no-tests=fail
           fi
-          test -s target/nextest/e2e-distributed/junit.xml
 
       - name: Upload distributed e2e diagnostics
         if: always()
@@ -203,7 +200,7 @@ jobs:
   alert-on-failure:
     name: Alert on scheduled failure
     needs: [distributed]
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/e2e-replication-nightly.yml

@@ -53,7 +53,6 @@ concurrency:
 
 jobs:
   repl-nightly:
-    if: github.repository == 'rustfs/rustfs'
     name: Replication e2e (nightly)
     # dual-node tests spawn two full rustfs servers each; the extra headroom
     # over the per-PR sm-standard-2 e2e job keeps the parallel process fan-out
@@ -120,7 +119,6 @@ jobs:
           if-no-files-found: ignore
 
   cluster-nightly:
-    if: github.repository == 'rustfs/rustfs'
     name: Cluster fault e2e (nightly)
     runs-on: sm-standard-4
     timeout-minutes: 90
@@ -170,7 +168,6 @@ jobs:
           if-no-files-found: warn
 
   protocols-nightly:
-    if: github.repository == 'rustfs/rustfs'
     name: Protocol e2e (nightly)
     runs-on: sm-standard-4
     timeout-minutes: 90
@@ -232,7 +229,7 @@ jobs:
     # Only scheduled runs open/append the tracking issue (backlog#1149 ci-8);
     # manual workflow_dispatch runs stay quiet so a debugging run never files a
     # spurious alert.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/functional-chain-health.yml

@@ -11,7 +11,6 @@ concurrency:
   cancel-in-progress: false
 jobs:
   collect:
-    if: github.repository == 'rustfs/rustfs'
     runs-on: smoke-testing
     timeout-minutes: 15
     steps:

.github/workflows/fuzz.yml

@@ -72,11 +72,9 @@ jobs:
   fuzz-build:
     name: Build Fuzz Harness
     if: >
-      github.repository == 'rustfs/rustfs' && (
-        (github.event_name == 'pull_request' && github.event.action != 'closed') ||
-        github.event_name == 'schedule' ||
-        github.event_name == 'workflow_dispatch'
-      )
+      (github.event_name == 'pull_request' && github.event.action != 'closed') ||
+      github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch'
     runs-on: sm-standard-4
     timeout-minutes: 60
     env:
@@ -241,7 +239,7 @@ jobs:
     # `always()` is required: without it this job is skipped when a needed
     # job fails. Alerts only for scheduled (nightly) runs (backlog#1149
     # ci-8); PR and manual dispatch failures are already watched by a human.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/gateway-integration-sync.yml

@@ -1,197 +0,0 @@
-# Copyright 2026 RustFS Team
-# SPDX-License-Identifier: Apache-2.0
-
-name: Gateway Integration Sync
-
-# Merges `main` into the long-lived `gateway/integration` branch every weekday
-# so the s3s -> gateway migration (rustfs/backlog#2734, task T0.1 in #2736)
-# never accumulates merge debt. A clean merge lands as a `--no-ff` merge commit
-# pushed straight to the branch. A conflicting merge is aborted and surfaced as
-# a pull request from `sync/<source>-<date>`, whose head is the un-merged
-# source commit, so the conflict is resolved the same day, in review, with no
-# other change riding along. The run itself stays green in that case: the pull
-# request is the signal. Any other failure (push rejected, pull request not
-# created) fails the run and, on the schedule, files the shared failure issue.
-#
-# Resolving a conflict pull request: merge `origin/gateway/integration` into
-# the sync branch, resolve, push, get the review. Land it with a fast-forward
-# push of the resolved merge commit to `gateway/integration`, not with the
-# squash button: a squash drops the merge ancestry and the same hunks conflict
-# again on the next run.
-#
-# Write scope: only `gateway/integration` and `sync/*` are ever pushed, and
-# both push targets below are literal refs. The pushes use a one-hour
-# installation token of the organisation's own GitHub App (contents: write)
-# because that app is the only non-admin bypass actor of the
-# `gateway/integration` ruleset; GITHUB_TOKEN cannot be a ruleset bypass actor,
-# so it cannot push through the required reviews and checks. The conflict pull
-# request is opened with FLAKE_UPDATE_TOKEN, the PAT that already opens the
-# weekly flake.lock pull requests, because this repository keeps "Allow GitHub
-# Actions to create and approve pull requests" switched off. GITHUB_TOKEN is
-# therefore read-only here.
-#
-# `schedule` fires only from the default branch, so the cron is live once this
-# file exists on `main`. `workflow_dispatch` runs from any ref that carries the
-# file and always acts on `gateway/integration`.
-
-on:
-  schedule:
-    - cron: "0 2 * * 1-5" # Weekdays 02:00 UTC
-  workflow_dispatch:
-    inputs:
-      source_ref:
-        description: >-
-          Branch to merge into gateway/integration. The schedule always merges
-          main; only the conflict acceptance test (rustfs/backlog#2736) sets
-          another branch.
-        required: false
-        default: main
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-env:
-  TARGET_BRANCH: gateway/integration
-
-jobs:
-  sync:
-    name: Merge main into gateway/integration
-    if: github.repository == 'rustfs/rustfs'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Create the branch push token
-        id: push-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
-        with:
-          app-id: ${{ vars.CLA_BOT_APP_ID }}
-          private-key: ${{ secrets.CLA_BOT_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: rustfs
-          permission-contents: write
-
-      - name: Checkout gateway/integration
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          # persist-credentials-exempt: this checkout's token IS the push
-          # credential — the merge commit and the sync branch are pushed with it
-          # below. It is a one-hour installation token scoped to contents.
-          ref: gateway/integration
-          fetch-depth: 0
-          token: ${{ steps.push-token.outputs.token }}
-
-      - name: Configure the bot identity
-        run: |
-          git config user.name "rustfs-cla-assistant[bot]"
-          git config user.email "273121464+rustfs-cla-assistant[bot]@users.noreply.github.com"
-
-      - name: Merge the source branch
-        id: merge
-        env:
-          SOURCE_REF: ${{ inputs.source_ref || 'main' }}
-        run: |
-          set -euo pipefail
-          if ! [[ "$SOURCE_REF" =~ ^[A-Za-z0-9][A-Za-z0-9._/-]*$ ]] \
-            || [[ "$SOURCE_REF" == *..* ]] \
-            || [[ "$SOURCE_REF" == "$TARGET_BRANCH" ]]; then
-            echo "::error::refusing source_ref '${SOURCE_REF}'"
-            exit 1
-          fi
-          git fetch origin "refs/heads/${SOURCE_REF}:refs/remotes/origin/${SOURCE_REF}"
-          source_sha=$(git rev-parse "origin/${SOURCE_REF}")
-          target_sha=$(git rev-parse HEAD)
-          {
-            echo "source_ref=${SOURCE_REF}"
-            echo "source_sha=${source_sha}"
-            echo "target_sha=${target_sha}"
-          } >> "$GITHUB_OUTPUT"
-          if git merge --no-ff --no-edit "origin/${SOURCE_REF}"; then
-            if [[ "$(git rev-parse HEAD)" == "$target_sha" ]]; then
-              echo "result=up-to-date" >> "$GITHUB_OUTPUT"
-              echo "\`${TARGET_BRANCH}\` already contains \`${SOURCE_REF}\` (${source_sha}); nothing to push." >> "$GITHUB_STEP_SUMMARY"
-            else
-              echo "result=merged" >> "$GITHUB_OUTPUT"
-            fi
-            exit 0
-          fi
-          git diff --name-only --diff-filter=U > "$RUNNER_TEMP/conflicts.txt"
-          git merge --abort
-          if [[ ! -s "$RUNNER_TEMP/conflicts.txt" ]]; then
-            echo "::error::git merge failed without reporting conflicting paths; this is not a conflict"
-            exit 1
-          fi
-          echo "result=conflict" >> "$GITHUB_OUTPUT"
-
-      - name: Push the merge commit
-        if: steps.merge.outputs.result == 'merged'
-        env:
-          SOURCE_REF: ${{ steps.merge.outputs.source_ref }}
-          SOURCE_SHA: ${{ steps.merge.outputs.source_sha }}
-        run: |
-          set -euo pipefail
-          git push origin HEAD:refs/heads/gateway/integration
-          echo "Merged \`${SOURCE_REF}\` (${SOURCE_SHA}) into \`${TARGET_BRANCH}\` as $(git rev-parse HEAD)." >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Open the conflict pull request
-        if: steps.merge.outputs.result == 'conflict'
-        env:
-          GH_TOKEN: ${{ secrets.FLAKE_UPDATE_TOKEN }}
-          SOURCE_REF: ${{ steps.merge.outputs.source_ref }}
-          SOURCE_SHA: ${{ steps.merge.outputs.source_sha }}
-          TARGET_SHA: ${{ steps.merge.outputs.target_sha }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          date_utc=$(date -u +%Y-%m-%d)
-          sync_branch="sync/${SOURCE_REF//\//-}-${date_utc}"
-          git push origin "refs/remotes/origin/${SOURCE_REF}:refs/heads/${sync_branch}"
-          {
-            echo "The scheduled merge of \`${SOURCE_REF}\` into \`${TARGET_BRANCH}\` stopped on conflicts and was aborted; \`${TARGET_BRANCH}\` is unchanged."
-            echo
-            echo "This branch is the un-merged \`${SOURCE_REF}\` head. Merge \`origin/${TARGET_BRANCH}\` into it, resolve the files below, push, and get the review. Land the resolved merge commit with a fast-forward push to \`${TARGET_BRANCH}\`; a squash merge drops the merge ancestry and the same hunks conflict again on the next run. Do not include any change that is not conflict resolution."
-            echo
-            echo "- Run: ${RUN_URL}"
-            echo "- Source: \`${SOURCE_REF}\` at ${SOURCE_SHA}"
-            echo "- Target: \`${TARGET_BRANCH}\` at ${TARGET_SHA}"
-            echo
-            echo "## Conflicting files"
-            echo
-            echo "Output of \`git diff --name-only --diff-filter=U\` captured before \`git merge --abort\`:"
-            echo
-            sed 's/^/- /' "$RUNNER_TEMP/conflicts.txt"
-          } > "$RUNNER_TEMP/pr-body.md"
-          title="sync: merge ${SOURCE_REF} ${date_utc} (conflicts)"
-          existing=$(gh pr list --repo "$GITHUB_REPOSITORY" --base "$TARGET_BRANCH" --head "$sync_branch" --state open --json number --jq '.[0].number // empty')
-          if [[ -n "$existing" ]]; then
-            gh pr edit "$existing" --repo "$GITHUB_REPOSITORY" --title "$title" --body-file "$RUNNER_TEMP/pr-body.md"
-            pr_url=$(gh pr view "$existing" --repo "$GITHUB_REPOSITORY" --json url --jq .url)
-          else
-            pr_url=$(gh pr create --repo "$GITHUB_REPOSITORY" --base "$TARGET_BRANCH" --head "$sync_branch" --title "$title" --body-file "$RUNNER_TEMP/pr-body.md")
-          fi
-          echo "Conflicts in \`${SOURCE_REF}\` -> \`${TARGET_BRANCH}\`; pull request: ${pr_url}" >> "$GITHUB_STEP_SUMMARY"
-
-  alert-on-failure:
-    name: Alert on scheduled failure
-    needs: [sync]
-    # Same ci-8 mechanism audit.yml and coverage.yml use: a scheduled run that
-    # could not push or could not open the conflict pull request must not stay
-    # visible only in the Actions tab.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - name: Open or update failure-tracking issue
-        uses: ./.github/actions/schedule-failure-issue
-        with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}

.github/workflows/helm-package.yml

@@ -130,21 +130,6 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
 
-      - name: Install yq
-        run: |
-          set -euo pipefail
-          yq_version="4.54.1"
-          yq_sha256="8e34fc298390875de416e6a4afcb8cabeceb25d9aa8506c1a2f9353cf702ea5f"
-          tools_dir="$RUNNER_TEMP/rustfs-helm-tools"
-          mkdir -p "$tools_dir"
-          curl --fail --silent --show-error --location --retry 3 \
-            "https://github.com/mikefarah/yq/releases/download/v${yq_version}/yq_linux_amd64" \
-            --output "$tools_dir/yq"
-          printf '%s  %s\n' "$yq_sha256" "$tools_dir/yq" | sha256sum --check -
-          chmod +x "$tools_dir/yq"
-          echo "$tools_dir" >> "$GITHUB_PATH"
-          "$tools_dir/yq" --version
-
       - name: Test Helm Chart Templates
         run: ./scripts/test_helm_templates.sh
 

.github/workflows/nightly-gnu.yml

@@ -43,7 +43,6 @@ env:
 
 jobs:
   resolve-source:
-    if: github.repository == 'rustfs/rustfs'
     name: Resolve nightly source
     runs-on: sm-standard-2
     timeout-minutes: 10
@@ -497,10 +496,8 @@ jobs:
     name: Alert on scheduled failure
     needs: [build, kms-vault-lane, kms-vault-ha-failover]
     if: >-
-      github.repository == 'rustfs/rustfs' && (
-        always() && github.event_name == 'schedule' &&
-        (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
-      )
+      always() && github.event_name == 'schedule' &&
+      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/nix-flake-update.yml

@@ -32,7 +32,6 @@ concurrency:
 
 jobs:
   update-flake:
-    if: github.repository == 'rustfs/rustfs'
     name: Update flake.lock
     runs-on: sm-standard-2
     timeout-minutes: 90

.github/workflows/performance-ab.yml

@@ -49,7 +49,6 @@ env:
 
 jobs:
   warp-ab:
-    if: github.repository == 'rustfs/rustfs'
     name: Warp A/B budget gate
     runs-on: sm-standard-2
     # A normal nightly restores the last successful binary and builds only the
@@ -365,10 +364,8 @@ jobs:
     # composite action already reports cancelled/timed-out jobs in the issue
     # body.
     if: >-
-      github.repository == 'rustfs/rustfs' && (
-        always() && github.event_name == 'schedule' &&
-        (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
-      )
+      always() && github.event_name == 'schedule' &&
+      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/runner-hygiene.yml

@@ -42,7 +42,6 @@ concurrency:
 
 jobs:
   check-ephemerality:
-    if: github.repository == 'rustfs/rustfs'
     name: Check runner ephemerality
     runs-on: sm-standard-2
     timeout-minutes: 15
@@ -66,7 +65,7 @@ jobs:
     # Same ci-8 mechanism as coverage.yml, audit.yml and the nightly lanes:
     # scheduled runs file a tracking issue, manual dispatch stays quiet so
     # debugging never produces a spurious alert.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/rustfs-pool-expand-test.yml

@@ -266,10 +266,7 @@ jobs:
         # the previous 45m step cap killed four consecutive runs mid-rebalance
         # with steps 1-7 green. 240m covers the observed pace (rebalance 1/4
         # in ~21m) plus one decommission pass; override per dispatch.
-        # fromJSON coerces the string dispatch input to the number that
-        # timeout-minutes requires; the bare || form yielded the string '240'
-        # and the runner rejected the template (Unexpected value '240').
-        timeout-minutes: ${{ fromJSON(inputs.pool_timeout_minutes || '240') }}
+        timeout-minutes: ${{ inputs.pool_timeout_minutes || 240 }}
         # Case failures keep the run green: the report and the backlog
         # issue manager carry the product signal.
         continue-on-error: true
@@ -586,6 +583,25 @@ jobs:
             echo "pool test script reported a failure (step FAIL verdict or die() abort)" >&2
             failed=1
           fi
+          # A runner-level kill (step timeout) truncates the suite without a
+          # FAIL verdict or an [ERROR] line, so require every expected
+          # [POOL-STEP] marker to be present with PASS - missing markers mean
+          # the run was truncated, not green. This also closes the gap for
+          # standalone dispatches, where the chain driver's evidence
+          # validation does not run.
+          last_step=6
+          if [ "${{ inputs.pools || '3' }}" = "3" ]; then
+            last_step=8
+            if [ "${{ inputs.run_decommission != 'false' }}" = "true" ]; then
+              last_step=9
+            fi
+          fi
+          for n in $(seq 1 "${last_step}"); do
+            grep -q "^\[POOL-STEP\] ${n} .* PASS" "${POOL_ARTIFACT_DIR}/pool-test.log" 2>/dev/null || {
+              echo "pool test log is missing [POOL-STEP] ${n} PASS (expected through step ${last_step}); the run was truncated" >&2
+              failed=1
+            }
+          done
           [ "${failed}" -eq 0 ] || exit 1
 
       - name: Upload functional report to dashboard

.github/workflows/scheduled-validation-freshness.yml

@@ -28,7 +28,6 @@ concurrency:
 
 jobs:
   check-freshness:
-    if: github.repository == 'rustfs/rustfs'
     name: Check scheduled validation freshness
     # Stay on GitHub-hosted runners: this monitor must keep running when the
     # self-hosted sm-standard-* pool is down, which is exactly when the

.github/workflows/scheduled-validation-watchdog.yml

@@ -39,7 +39,6 @@ jobs:
   alert-on-incomplete-run:
     name: Alert on incomplete scheduled run
     if: >-
-      github.repository == 'rustfs/rustfs' &&
       github.event.workflow_run.event == 'schedule' &&
       github.event.workflow_run.conclusion != 'success' &&
       github.event.workflow_run.conclusion != 'failure'

.github/workflows/stale.yml

@@ -26,7 +26,6 @@ on:
 
 jobs:
   stale:
-    if: github.repository == 'rustfs/rustfs'
     runs-on: sm-standard-2
     timeout-minutes: 30
     steps:

.github/workflows/star-history.yml

@@ -14,7 +14,6 @@ concurrency:
 
 jobs:
   update:
-    if: github.repository == 'rustfs/rustfs'
     runs-on: sm-standard-2
     timeout-minutes: 10
     steps:

.github/workflows/targets-integration.yml

@@ -40,7 +40,6 @@ env:
 
 jobs:
   targets-live:
-    if: github.repository == 'rustfs/rustfs'
     name: PostgreSQL, MySQL, AMQP, and NATS
     runs-on: sm-standard-2
     timeout-minutes: 90
@@ -176,10 +175,8 @@ jobs:
     name: Alert on scheduled failure
     needs: [targets-live]
     if: >-
-      github.repository == 'rustfs/rustfs' && (
-        always() && github.event_name == 'schedule' &&
-        (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
-      )
+      always() && github.event_name == 'schedule' &&
+      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

AGENTS.md

@@ -17,8 +17,6 @@ rules. A skill cannot expand the user's requested scope or grant authorization.
 
 - Inquiry, diagnosis, review, and planning tasks are read-only unless the user
   explicitly requests changes.
-- Ordinary diff/commit reviews use the finding standard below directly; no
-  generic review skill is required. PR and high-risk reviews retain their workflows.
 - For implementation, read the relevant code, tests, and local guidance, then
   make the smallest change that satisfies the request.
 - State assumptions only when they affect behavior or verification. Ask only
@@ -90,9 +88,6 @@ runtime/build output:
 
 - Run `cargo fmt --all --check` for Rust changes.
 - Run the narrowest test that exercises the changed behavior.
-- For an explicitly requested coverage assessment, use the
-  [coverage guide](docs/testing/README.md#coverage); a regression test alone does
-  not require coverage measurement.
 - Add package-scoped `cargo check` or Clippy only for targets, features, public
   APIs, error handling, or control flow not compiled by the focused test.
 - Use `make pre-commit` only when its repository-wide fast checks add confidence
@@ -155,18 +150,13 @@ For every added or edited `tracing` call:
 
 - Reuse the module's `EVENT_*`, `LOG_COMPONENT_*`, and `LOG_SUBSYSTEM_*`
   constants and field shape.
-- Put stable fields first (`event`, `component`, `subsystem`, `state`/`result`,
-  then context when available) and a short label last.
+- Put fields first and a short label last.
 - Use `error` for behavior/security failure, `warn` for degradation/fallback,
   `info` for low-frequency lifecycle, `debug` for diagnostics, and `trace` for
   repetitive request/object success paths.
-- Never log secrets, credential payloads, raw untrusted bodies, or merged configs,
-  including through error strings and `Debug` output.
-- Prefer one aggregate summary over inventories or startup banners.
+- Never log secrets, credential payloads, or merged configs.
 
-Run `./scripts/check_logging_guardrails.sh` for changed logging sites. For a broad
-logging audit, event-model migration, or guardrail expansion, read
-[logging governance](docs/operations/logging-governance.md).
+Use `.agents/skills/rustfs-logging-governance/SKILL.md` for logging changes.
 
 ## Cross-Cutting Storage Invariants
 

CHANGELOG.md

@@ -25,8 +25,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Presigned URLs honour only signed headers** (GHSA-g8w9-qw9q-fghr): a SigV4 presigned request that carries an `x-amz-*` request header not listed in `X-Amz-SignedHeaders` is now rejected with `403 AccessDenied` ("There were headers present in the request which were not signed"), matching AWS S3. Previously the holder of a presigned `PutObject` URL could add unsigned `x-amz-tagging`, `x-amz-storage-class`, `x-amz-website-redirect-location`, ACL, metadata, Object Lock or SSE headers and have them applied. Presigners that intend a property must set it before signing so the SDK lists the header in `SignedHeaders`; `x-amz-cf-id` (CloudFront) remains tolerated unsigned. Header-signed SigV4 and SigV2 requests are unchanged.
 
 ### Fixed
-- **SSE-C TLS requirement now covers copy-source keys**: with `RUSTFS_SSE_C_REQUIRE_TLS=true`, a `CopyObject` or `UploadPartCopy` that carried only the `x-amz-copy-source-server-side-encryption-customer-*` headers (an SSE-C source copied to a destination that is not SSE-C) was accepted on a plaintext transport and was not counted in `rustfs_ssec_plaintext_requests_total`, although those headers carry the source object's customer key. They now count as SSE-C headers: such requests are counted, and refused with `400 InvalidRequest` when the switch is on. Requests over TLS are unaffected.
-- **SSE-KMS encryption context could replace the location entry**: data keys are wrapped under an encryption-context entry, keyed by the bucket name, that ties them to the object's location. A client `x-amz-server-side-encryption-context` entry under the same key replaced it, and because the client context is stored with the object, the replacement also applied on every read. SSE-KMS writes now refuse such a context with `400 InvalidArgument`; other keys, including the names of other buckets, are unaffected. Objects stored with such an entry by an earlier release remain readable. See `docs/operations/kms-backend-security.md`.
 - **Two admin handlers reported a missing policy or user as `500 InternalError`**: `GET /rustfs/admin/v3/info-canned-policy` and `DELETE /rustfs/admin/v3/remove-user` wrapped every IAM error as an internal fault instead of classifying it, so a lookup for something that does not exist answered `500 InternalError` where the rest of the admin API answers `404 NoSuchResource` — `GET /rustfs/admin/v3/user-info` already did, and `iam_error_to_s3_error` already mapped `NoSuchPolicy`, `NoSuchUser`, `NoSuchServiceAccount` and `NoSuchTempAccount` to `NoSuchResource`. A client could not tell "does not exist" from a real server failure, and a controller that checks existence before creating (a Kubernetes operator reconciling policies or users) could never create the object: the missing-policy lookup failed with a `500` and it retried forever. Both handlers now map their IAM errors through the shared `iam_error_to_s3_error` helper, so a missing policy or user is `404 NoSuchResource` and the `error` is preserved as the S3 error's source; the three IAM calls in the removal path (temporary-user lookup, service-account lookup, delete) are all reclassified, and every other IAM error stays `500 InternalError`. Fixes #8117.
 - **Vault backends accepted key names that escape the key prefix**: only the Local backend refused a key identifier containing a path separator, so on Vault KV2 `POST /rustfs/admin/v3/kms/keys` with a name such as `bad/name` succeeded and created a nested KV2 path that the key listing then reported as a directory rather than a key, and an identifier containing `..` addressed a record outside the configured key prefix once the HTTP client normalised the URL. Both Vault backends now apply the Local backend's containment rule at the point where the identifier becomes a path or a Transit key name: an empty identifier, one containing `/`, `\\` or NUL, or the dot segments `.` and `..` is refused with `400` (`InvalidKey`) before any request reaches Vault. The AWS backend is unaffected, since it addresses keys by ARN and alias. A Vault deployment that created such a key on an earlier build must re-create it under a plain name; objects encrypted under the old name stay readable only until that key is refused, so migrate them first. Refs rustfs/backlog#2474.
 - **Fresh multi-pool bootstrap with distinct format creators**: a new deployment whose pools have their first endpoint on different nodes (for example two single-node pools) could never publish its initial `pool.bin`: each node held fresh-bootstrap proof only for the pool it formatted, the deployment-wide proof collapsed to none, and every node died with `pool metadata recovery required: no durable bootstrap identity or pool.bin replica is available` after the startup retry budget. The first pool's creator now mints the pending cluster identity on its own pool, every other creator copies that nonce-bound identity onto the pool it formatted first-hand, and the elected writer publishes `pool.bin` once every pool replica carries the same pending identity. Corrupt or disagreeing replicas, pools that merely have a format, expansion pools joining an initialized deployment, and restarts without first-hand proof still fail closed. Non-elected nodes that start before `pool.bin` exists, and the elected writer while it waits for the other creators, no longer latch their pool-metadata write gate for the life of the process. Refs rustfs/backlog#2338, rustfs/backlog#2375.

Cargo.lock

@@ -2,6 +2,16 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "Inflector"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe438c63458706e03479442743baae6c88256498e6431708f6dfc520a26515d3"
+dependencies = [
+ "lazy_static",
+ "regex",
+]
+
 [[package]]
 name = "addr2line"
 version = "0.25.1"
@@ -763,9 +773,9 @@ dependencies = [
 
 [[package]]
 name = "async-rs"
-version = "0.8.13"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "407bdac3815af195d2d63fa50595610ea8ba4d47b7fc5a37895b05d3b571c241"
+checksum = "c5f55b2bcef73a79a2feb5496478693077b60b7337896f0b72431cd5311d988a"
 dependencies = [
  "async-compat",
  "async-global-executor",
@@ -966,9 +976,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-kms"
-version = "1.123.0"
+version = "1.122.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bbe8833a7ad3b970f2a6a856939c9cb171942dcdfd2ab65f2db3a8baaf73cc1"
+checksum = "ae92186214a60f1316f6e25df2b5bef8f67b5b08b45f8e3eb6e1278b9ddd7b29"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -991,9 +1001,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-s3"
-version = "1.152.0"
+version = "1.151.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "004d5acbd6850ab58789a43822e0a2ef23927a46b012c17f8fa51253103db9f8"
+checksum = "c82d4b41fe41bfca3c9e1de55645d9a525868ef5ce5e14cee9499ccaf1fc7225"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -1027,9 +1037,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sso"
-version = "1.114.0"
+version = "1.113.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12be2f9c8eef7f5fc919c96d538e629698469a02b4cb75408b26b1bd984ebe79"
+checksum = "87184f36ade012f46cdc773c7be10031b4545a1aea70a9a22a044e8f36f1e5c5"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -1052,9 +1062,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.116.0"
+version = "1.115.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7645db8724ea3b82fdccfb67e1b0f637c9d8ab0e7ef29d84884d8d8d73f805d"
+checksum = "84edc7495d56e006dff0031cbc9782784902456f7024651c2da902a3d2336262"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -1077,9 +1087,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sts"
-version = "1.119.0"
+version = "1.118.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03e490aa904849b38e770922faac779dd245f5cf8be81f19065acf18d276e4ad"
+checksum = "df7572569d018ca72923073494eac3c4671a0daea90b9e3923c2d27a3a02a2c1"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -1685,18 +1695,18 @@ dependencies = [
 
 [[package]]
 name = "bon"
-version = "3.10.2"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "214f5df094ce551a10a30ffb9c70243d61f121a3d985a6495933e181dee6a7d2"
+checksum = "60eafe0d77c3a2fc292c1d1346c3041b33c0a108085a2afabf672b70f69dbbc9"
 dependencies = [
  "bon-macros",
 ]
 
 [[package]]
 name = "bon-macros"
-version = "3.10.2"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2706da6c749998cc555d04184909608956a69ad3f8ab1a076fbc867b4a3c3ce5"
+checksum = "bd0f9631d8aaaee112c41985d675ef269e02acbd4f33122836af4f0c5f699ff6"
 dependencies = [
  "darling 0.24.1",
  "ident_case",
@@ -1950,9 +1960,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.6.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
+checksum = "f360145194ee8e21db5ee7f3fcd4fe52210864c75c985dae33218202c8bbe040"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -2622,9 +2632,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.3"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
 dependencies = [
  "cmov",
  "subtle",
@@ -3767,9 +3777,9 @@ dependencies = [
 
 [[package]]
 name = "dial9"
-version = "0.5.3"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b35f95885a2167602b457c77caf898670c02eb0aaba72bef76ac5b0faef86e14"
+checksum = "a6b45b31143736103e8dca37f060493047908aa2c6ce02624c423ffaf38dca37"
 dependencies = [
  "bon",
  "dial9-core",
@@ -3784,11 +3794,10 @@ dependencies = [
 
 [[package]]
 name = "dial9-core"
-version = "0.5.3"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82f826078c782919cf9a4fb0b2b6755dab24d6c908b5181469b23cf6eb8f6fff"
+checksum = "e917e087ee3b643449ac7dd23786c80734bd4a255984802154fe8fad04facb3b"
 dependencies = [
- "ahash",
  "arc-swap",
  "bon",
  "bytes",
@@ -3818,9 +3827,9 @@ dependencies = [
 
 [[package]]
 name = "dial9-metrique"
-version = "0.5.3"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c59e35e7b38ce255d3dc6310b48c3ea54307c42a0589eda44ea91ba24eadf67"
+checksum = "ef5c59184dc198a59300361f876874106f0faeb09a7339fa15b10e71ccb5b099"
 dependencies = [
  "dial9-core",
  "dial9-trace-format",
@@ -3832,9 +3841,9 @@ dependencies = [
 
 [[package]]
 name = "dial9-perf-self-profile"
-version = "0.5.3"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c429b209bc07612b2e60267e8bca80cd2b249f498e9a0b83f7caf514d5f5388"
+checksum = "951556d3105a96b5daf28782d7628fde16c104fe014a1366925a6dde2f9979fd"
 dependencies = [
  "blazesym",
  "bon",
@@ -3851,9 +3860,9 @@ dependencies = [
 
 [[package]]
 name = "dial9-tokio-telemetry"
-version = "0.5.3"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aee46c0a97dd88ba151f9688c79de60c41cd7efc6855e6eb369af06326cba8f3"
+checksum = "89efd773588cfecbaa1b686baec990544ea184fa416e92da92084cc76359d993"
 dependencies = [
  "bon",
  "bytes",
@@ -3876,11 +3885,10 @@ dependencies = [
 
 [[package]]
 name = "dial9-trace-format"
-version = "0.5.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "258116805212db80e607656c81d2bf9830e66d5747e6ed6a29d17eeb2e673ff2"
+checksum = "7a74503a498a7fe5616f0ad4952c333f5237473bf7e3c4d40f94ceed376a6cbe"
 dependencies = [
- "ahash",
  "dial9-trace-format-derive",
  "serde",
  "typeid",
@@ -3888,9 +3896,9 @@ dependencies = [
 
 [[package]]
 name = "dial9-trace-format-derive"
-version = "0.5.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b6700840c894de4a66d698850647560a1ae889183d419211877d049a063aad"
+checksum = "d7062a8c4af86a878843c8ac2f99d9ecbce30de9069700e70b1aef333976719f"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -3977,12 +3985,6 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "780955b8b195a21ab8e4ac6b60dd1dbdcec1dc6c51c0617964b08c81785e12c9"
 
-[[package]]
-name = "dtoa"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
-
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -4092,7 +4094,7 @@ dependencies = [
  "elliptic-curve 0.14.1",
  "rfc6979 0.6.0",
  "signature 3.0.0",
- "spki 0.8.1",
+ "spki 0.8.0",
  "zeroize",
 ]
 
@@ -4149,9 +4151,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.19.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
 [[package]]
 name = "elliptic-curve"
@@ -4986,9 +4988,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.20"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -5003,34 +5005,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "h3"
-version = "0.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10872b55cfb02a821b69dc7cf8dc6a71d6af25eb9a79662bec4a9d016056b3be"
-dependencies = [
- "bytes",
- "fastrand",
- "futures-util",
- "http 1.5.0",
- "pin-project-lite",
- "tokio",
-]
-
-[[package]]
-name = "h3-quinn"
-version = "0.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2e732c8d91a74731663ac8479ab505042fbf547b9a207213ab7fbcbfc4f8b4"
-dependencies = [
- "bytes",
- "futures",
- "h3",
- "quinn",
- "tokio",
- "tokio-util",
-]
-
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -5297,9 +5271,9 @@ dependencies = [
 
 [[package]]
 name = "hotpath"
-version = "0.28.5"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34aabdeba3c81cef2075a2961a370ebfe1d9cc3f8d2242fd400ce6ef6f3bbfcb"
+checksum = "d8345e171844f80e5ae4cbed8bc8276e094f6ff2293a6f8e547c200183976674"
 dependencies = [
  "arc-swap",
  "async-channel",
@@ -5332,15 +5306,15 @@ dependencies = [
 
 [[package]]
 name = "hotpath-drain"
-version = "0.28.5"
+version = "0.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4b61a4a77e6563bdc37f831cd6aa5e2089429b62ea377dd759bbabafc207d7a"
+checksum = "e149b660b611650bdf3307941ef3e9b81be3c30ed1dfdbe7f670319674f023a6"
 
 [[package]]
 name = "hotpath-macros"
-version = "0.28.5"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c6275c8d1931d280bd505debb7ef91dbeae2c23477aabbfe10487b7430bdeb3"
+checksum = "bf73e28fe4a7595c322e4265c1608cb10c215cbbce11e49cfcc258766ba686d6"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5429,9 +5403,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.12.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -5684,9 +5658,9 @@ dependencies = [
 
 [[package]]
 name = "insta"
-version = "1.49.0"
+version = "1.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67d3d2e287e4b86c10b3f3b641033d1f89b74bdb39d05f34952e2b9a6fe21cd"
+checksum = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f5e6b644fe7dd4ef6b82"
 dependencies = [
  "console",
  "once_cell",
@@ -5815,9 +5789,9 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jiff"
-version = "0.2.38"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2b005715dcbeb0089a3c0dab99f2ff1cc3b2525323552703d648585d342a383"
+checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb"
 dependencies = [
  "defmt 1.1.1",
  "jiff-core",
@@ -5842,9 +5816,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-static"
-version = "0.2.38"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cc9817253cf7c7ee4684451bd327e88d6f3658014e54a29198625590650695c"
+checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
 dependencies = [
  "jiff-core",
  "proc-macro2",
@@ -5854,9 +5828,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-tzdb"
-version = "0.1.9"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa8377070c6bae868759445e5a77f66d84f0b72f3a054bfb00e6d038b8282da7"
+checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
 
 [[package]]
 name = "jiff-tzdb-platform"
@@ -6037,9 +6011,9 @@ dependencies = [
 
 [[package]]
 name = "lazy-regex"
-version = "3.6.2"
+version = "3.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0a2cce8a22920a29fdcc8c9170aa5d29edd9fbcf8bea856e24c2cb1c2419f67"
+checksum = "4994ba703f78b083e2f7946dac9251abd83fd43a0365f030e99b69be5b4b9ef9"
 dependencies = [
  "lazy-regex-proc_macros",
  "once_cell",
@@ -6048,14 +6022,14 @@ dependencies = [
 
 [[package]]
 name = "lazy-regex-proc_macros"
-version = "3.6.2"
+version = "3.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f1e4b1f1d8c71edb4ff2b2150ec4606445fd2ddf67ddc097655daf59286baa6"
+checksum = "fd97232314824e6dbef1918a871bb93f51070455e3715bf26e19a6d01aa977a0"
 dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 3.0.6",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -6132,9 +6106,9 @@ checksum = "34b357333733e8260735ba5894eb928c02ecc69c78715f01a8019e7fa7f2db4c"
 
 [[package]]
 name = "libc"
-version = "0.2.190"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libflate"
@@ -6498,9 +6472,9 @@ dependencies = [
 
 [[package]]
 name = "metrique"
-version = "0.1.33"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d73091a31175e903e78e876a246659bd2b2c8e2bd87b7b29bfc9ce2ad337015"
+checksum = "2b55bfa39e6f5e44a37a59a794915ce36d04371471cf62ae365cd9703f58a5e0"
 dependencies = [
  "itoa",
  "metrique-core",
@@ -6516,9 +6490,9 @@ dependencies = [
 
 [[package]]
 name = "metrique-core"
-version = "0.1.24"
+version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef48bd0b3616269daf647473b43a5a832db438392a2956c3a928ff859f9d2dac"
+checksum = "8bd60ab3f5d8e13e36aa1d1dd9cc4920012dd21a25bd7311ae3c39810648e068"
 dependencies = [
  "itertools 0.14.0",
  "metrique-writer-core",
@@ -6526,22 +6500,23 @@ dependencies = [
 
 [[package]]
 name = "metrique-macro"
-version = "0.1.24"
+version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c35873982fe77f6876b701e095058785491bb415eb6bdcfc5b0b291ead76099"
+checksum = "7605c49951713cce25af6bee77ed4432dde0839c5d9935bcb6f9643e6e82c7c3"
 dependencies = [
- "darling 0.24.1",
+ "Inflector",
+ "darling 0.23.0",
  "metrique-core",
  "proc-macro2",
  "quote",
- "syn 3.0.6",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "metrique-service-metrics"
-version = "0.1.24"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f3174803bacaeaa025a7b8ff998b415892d0bd0272d4694cb22ee55f93ee027"
+checksum = "24ee17caa35f83b730a83c8fa8f7a9aaa61a0becc7a71feb5bfb854bc75440d7"
 dependencies = [
  "metrique-writer",
 ]
@@ -6554,9 +6529,9 @@ checksum = "2faca4e4480069ff02b1763b3b79f5cec7e8628e24d9dc5b6073f53d2577a4d9"
 
 [[package]]
 name = "metrique-writer"
-version = "0.1.29"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3b3d251bde7a2ef3cb27371d41751770191041ffe56f6ac22d2fa30ca99e68b"
+checksum = "bb97854dd4e2a92fe54b30e6e19976dcc0b2b7d39da3e84e86e2ce1e2ed8ce0d"
 dependencies = [
  "ahash",
  "crossbeam-queue",
@@ -6575,30 +6550,28 @@ dependencies = [
 
 [[package]]
 name = "metrique-writer-core"
-version = "0.1.22"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e253373268b34ae3f1b0e0348dd56fd0924f45ea49b086913e18d273ee03098"
+checksum = "71c9fc241cff4eedc2b6c3e2edece7f3edab2920e7531f62aac864ce933cdbb6"
 dependencies = [
  "derive-where",
- "dtoa",
  "itertools 0.14.0",
- "itoa",
  "serde",
  "smallvec",
 ]
 
 [[package]]
 name = "metrique-writer-macro"
-version = "0.1.12"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f0c50a61ecf0e0afd1778768ccb662ae5aa759b7ff15748003a4a920d61ff51"
+checksum = "1eef190f855405b9df4166ee0495925162fb2a7985bac62c6ae44f40061fac00"
 dependencies = [
- "darling 0.24.1",
- "metrique-core",
+ "darling 0.23.0",
  "proc-macro2",
  "quote",
- "syn 3.0.6",
- "synstructure 0.14.0",
+ "str_inflector",
+ "syn 2.0.119",
+ "synstructure 0.13.2",
 ]
 
 [[package]]
@@ -6653,9 +6626,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.4"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
 dependencies = [
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
@@ -7136,9 +7109,9 @@ dependencies = [
 
 [[package]]
 name = "objc2"
-version = "0.6.5"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
+checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
 dependencies = [
  "objc2-encode",
 ]
@@ -7599,9 +7572,9 @@ dependencies = [
 
 [[package]]
 name = "pageant"
-version = "0.2.4"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0786409b5aaa884655c9b4065681db0835db0cc185a6fb19fb17a5d38656866"
+checksum = "6d8eab09a361a4afe0b1668be978cd97e4f052e927a92b0b608cf902965d49ce"
 dependencies = [
  "base16ct 1.0.0",
  "byteorder",
@@ -7953,7 +7926,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "986d2e952779af96ea048f160fd9194e1751b4faea78bcf3ceb456efe008088e"
 dependencies = [
  "der 0.8.2",
- "spki 0.8.1",
+ "spki 0.8.0",
 ]
 
 [[package]]
@@ -8000,7 +7973,7 @@ dependencies = [
  "rand_core 0.10.1",
  "scrypt 0.12.0",
  "sha2 0.11.0",
- "spki 0.8.1",
+ "spki 0.8.0",
 ]
 
 [[package]]
@@ -8022,7 +7995,7 @@ dependencies = [
  "der 0.8.2",
  "pkcs5 0.8.1",
  "rand_core 0.10.1",
- "spki 0.8.1",
+ "spki 0.8.0",
 ]
 
 [[package]]
@@ -8145,9 +8118,9 @@ dependencies = [
 
 [[package]]
 name = "powerfmt"
-version = "0.2.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppmd-rust"
@@ -8524,24 +8497,24 @@ dependencies = [
 
 [[package]]
 name = "qrcode-core"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "217eaaa981eea8acfefa0af24d0d48f7a63f43b966a0c4f054d90f9dccb76019"
+checksum = "26252cf2e15d05b24b4a2cb9335952d697e54f07949f79ee721951d563b19a71"
 
 [[package]]
 name = "qrcode-decode"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "905ca22d33d7e3fb5d49efe38a183cdcfd96b069fd0863cf99fca6149065fb89"
+checksum = "3054ba7f6b1906502789970337da290b1da2069d7225c9ec1c3f8351de807f78"
 dependencies = [
  "qrcode-core",
 ]
 
 [[package]]
 name = "qrcode-eps"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27ca6245ed82c10793d6aa40e56713197d522aaf2f3c1c8e6aeae0a5823c45d3"
+checksum = "c7a9f889b4a03011b029f20ad6b68450eac25c1be04d13ee22f7682496c1f069"
 dependencies = [
  "qrcode-core",
  "qrcode-render",
@@ -8549,9 +8522,9 @@ dependencies = [
 
 [[package]]
 name = "qrcode-html"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "782da10a42d39d8b835be9d77d6ee343e58cf4755dc578afbde0a4e3d280d467"
+checksum = "454af1fc1b8b56b2e38913f0aeba20241e0790dd031d3595ae1a098174944478"
 dependencies = [
  "qrcode-core",
  "qrcode-render",
@@ -8559,9 +8532,9 @@ dependencies = [
 
 [[package]]
 name = "qrcode-image"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e145e4a5b673a5aca2fe2a07c5c156015bf5c46e2f43f24a9bf827833e1329c"
+checksum = "9336db7ceee96a7909ebf412c9734fbfe498825ab29246d4dee27c9398baa9f9"
 dependencies = [
  "qrcode-core",
  "qrcode-render",
@@ -8569,15 +8542,15 @@ dependencies = [
 
 [[package]]
 name = "qrcode-parse"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "674b81fb75c3ae22430804961c50286c35312e278ae729499fa4cf4e1367b77a"
+checksum = "1ae80b5d21e40035a88f449e2031985522de0d6a2c16bbfacc75b983698bf731"
 
 [[package]]
 name = "qrcode-pdf"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21f31cff40711b9192e1501d179c635a24bd2524cc846944fca00511fd5f2207"
+checksum = "123246123420fdc135533e47f47b00636c4138bf71adf141c5de846f94f811ad"
 dependencies = [
  "qrcode-core",
  "qrcode-render",
@@ -8585,9 +8558,9 @@ dependencies = [
 
 [[package]]
 name = "qrcode-pic"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cab8b28113bd94c2d45421fab2fa7fabaa7e6d3f23b9a1838bed4b38e05b9f1"
+checksum = "18cbc03b812474442622453c1b9f925a4025cc00d9100255ecb1accef7953411"
 dependencies = [
  "qrcode-core",
  "qrcode-render",
@@ -8595,18 +8568,18 @@ dependencies = [
 
 [[package]]
 name = "qrcode-render"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8fd91fc36ca088759ec7b701c41aecf3581d613a6edc055c7060ab222dc14a5"
+checksum = "74445b565ffecbed5c6ad34096df2a81f487c4befd6b91b75d11bdbe61d73094"
 dependencies = [
  "qrcode-core",
 ]
 
 [[package]]
 name = "qrcode-rs"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de6acff5236b527bc35e00a462bce45f4fccbcacdbbd39d98528e03e2d1b629"
+checksum = "320f7c1c48a10a0850746b87d5adf95f1db5209320c7f1853556c0bb774fc0f6"
 dependencies = [
  "qrcode-core",
  "qrcode-decode",
@@ -8622,9 +8595,9 @@ dependencies = [
 
 [[package]]
 name = "qrcode-svg"
-version = "2.2.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e257fb833e290961b12beec7c4a7582d35f3926910e13703ced9eabc20e3c590"
+checksum = "daea027c13f12e97bc32aeefda12c4ce0298307e9094fe45731a731f544dabd0"
 dependencies = [
  "qrcode-core",
  "qrcode-render",
@@ -8677,7 +8650,6 @@ checksum = "4051e23e9185c255a7e33ef59cdbca87a22d359052eecd22fc6b901fb37d9d11"
 dependencies = [
  "bytes",
  "cfg_aliases",
- "futures-io",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
@@ -9257,7 +9229,7 @@ dependencies = [
  "rand_core 0.10.1",
  "sha2 0.11.0",
  "signature 3.0.0",
- "spki 0.8.1",
+ "spki 0.8.0",
  "zeroize",
 ]
 
@@ -9315,9 +9287,9 @@ dependencies = [
 
 [[package]]
 name = "russh"
-version = "0.64.1"
+version = "0.63.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba61e87b9ec9a39a59a6bbed4c0b8ff7fb07073405b24a767a1f2c8560ac8f58"
+checksum = "036204edbd199552a5b3832f63c60dcdf395dc44c7f06b4af1c0e8139cc11bce"
 dependencies = [
  "aes 0.9.3",
  "aws-lc-rs",
@@ -9373,7 +9345,7 @@ dependencies = [
  "sha2 0.11.0",
  "sha3 0.12.0",
  "signature 3.0.0",
- "spki 0.8.1",
+ "spki 0.8.0",
  "ssh-encoding",
  "ssh-key",
  "subtle",
@@ -9516,8 +9488,6 @@ dependencies = [
  "futures-lite",
  "futures-util",
  "google-cloud-auth",
- "h3",
- "h3-quinn",
  "hashbrown 0.17.1",
  "hex-simd",
  "hmac 0.13.0",
@@ -9549,7 +9519,6 @@ dependencies = [
  "prost 0.14.4",
  "pyroscope",
  "quick-xml",
- "quinn",
  "rand 0.10.3",
  "rcgen",
  "regex",
@@ -9963,7 +9932,6 @@ dependencies = [
  "rustfs-common",
  "rustfs-concurrency",
  "rustfs-config",
- "rustfs-data-usage",
  "rustfs-ecstore",
  "rustfs-filemeta",
  "rustfs-heal-contracts",
@@ -10078,9 +10046,9 @@ dependencies = [
 
 [[package]]
 name = "rustfs-kafka"
-version = "1.4.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd2f8b46ec4dd462c2235948d1efa2103957230c171e118c6ff8e5d1a845ab48"
+checksum = "759f8ddf709b497006e0f422a89890f11ac86c84c2c39df282891477c22f1a13"
 dependencies = [
  "base64 0.23.1",
  "bytes",
@@ -10103,9 +10071,9 @@ dependencies = [
 
 [[package]]
 name = "rustfs-kafka-async"
-version = "1.4.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b3b98705f6f9f5071b8793d29935de764c31668c6e9877553b229eb67127af6"
+checksum = "5aa574a13d91ef529e3a08f059a5c3ee8d4c3b16cf62f62c72595a6dc4f79f8f"
 dependencies = [
  "base64 0.23.1",
  "bytes",
@@ -10594,7 +10562,6 @@ dependencies = [
  "faster-hex",
  "futures",
  "hex-simd",
- "hmac 0.13.0",
  "hotpath",
  "http 1.5.0",
  "http-body-util",
@@ -11061,7 +11028,6 @@ dependencies = [
  "async-compression",
  "futures",
  "hotpath",
- "liblzma",
  "rustfs-rio",
  "rustfs-tokio-tar",
  "serde",
@@ -11266,7 +11232,8 @@ checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 [[package]]
 name = "s3s"
 version = "0.17.0"
-source = "git+https://github.com/s3s-project/s3s?rev=5761ddfe4c509fcac87e3b99fd5bd9e176b442c0#5761ddfe4c509fcac87e3b99fd5bd9e176b442c0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "030a43692a1fd97bbd2c594eeaad8f5c1e452a9d29ad6a3eebce1650937c4a77"
 dependencies = [
  "arc-swap",
  "arrayvec",
@@ -11276,6 +11243,7 @@ dependencies = [
  "bytes",
  "bytestring",
  "cfg-if",
+ "chrono",
  "crc-fast",
  "futures",
  "hex-simd",
@@ -11323,7 +11291,8 @@ dependencies = [
 [[package]]
 name = "s3s-multipart"
 version = "0.17.0"
-source = "git+https://github.com/s3s-project/s3s?rev=5761ddfe4c509fcac87e3b99fd5bd9e176b442c0#5761ddfe4c509fcac87e3b99fd5bd9e176b442c0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a543079d42c20c81781b7e31704ecacd64b0e3819b2384db5bf4869abf6c6f01"
 dependencies = [
  "arrayvec",
  "bytes",
@@ -11336,7 +11305,8 @@ dependencies = [
 [[package]]
 name = "s3s-rfc2047"
 version = "0.17.0"
-source = "git+https://github.com/s3s-project/s3s?rev=5761ddfe4c509fcac87e3b99fd5bd9e176b442c0#5761ddfe4c509fcac87e3b99fd5bd9e176b442c0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918b207c39474baef4774355100e712dfea46020e3289ddd5b4bc6e21927b826"
 dependencies = [
  "base64-simd",
  "thiserror 2.0.21",
@@ -11345,7 +11315,8 @@ dependencies = [
 [[package]]
 name = "s3s-sigv2"
 version = "0.17.0"
-source = "git+https://github.com/s3s-project/s3s?rev=5761ddfe4c509fcac87e3b99fd5bd9e176b442c0#5761ddfe4c509fcac87e3b99fd5bd9e176b442c0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0979baf8cdf30e38bdfba8e58ee2776d78e55bb3bd3d1f3502f917829da79933"
 dependencies = [
  "base64-simd",
  "hmac 0.13.0",
@@ -11358,7 +11329,8 @@ dependencies = [
 [[package]]
 name = "s3s-sigv4"
 version = "0.17.0"
-source = "git+https://github.com/s3s-project/s3s?rev=5761ddfe4c509fcac87e3b99fd5bd9e176b442c0#5761ddfe4c509fcac87e3b99fd5bd9e176b442c0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330996b9a24804b3df4ad37e62e7817968857d99cf6029c21512b6b64b97f645"
 dependencies = [
  "arrayvec",
  "base64-simd",
@@ -11370,7 +11342,6 @@ dependencies = [
  "sha2 0.11.0",
  "smallvec",
  "std-next",
- "subtle",
  "thiserror 2.0.21",
  "zeroize",
 ]
@@ -12062,9 +12033,9 @@ dependencies = [
 
 [[package]]
 name = "spki"
-version = "0.8.1"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
+checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
 dependencies = [
  "base64ct",
  "der 0.8.2",
@@ -12179,9 +12150,9 @@ dependencies = [
 
 [[package]]
 name = "starshard"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc45de5060fab0de00d7a42230877543ae00c37caf6f49975e69851089b023ac"
+checksum = "4155f6127729fef4a7b2aff334e9f05e697f52b67a8512e789b640e036195544"
 dependencies = [
  "async-trait",
  "hashbrown 0.17.1",
@@ -12208,6 +12179,16 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "str_inflector"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0b848d5a7695b33ad1be00f84a3c079fe85c9278a325ff9159e6c99cef4ef7"
+dependencies = [
+ "lazy_static",
+ "regex",
+]
+
 [[package]]
 name = "stringprep"
 version = "0.1.5"
@@ -12680,9 +12661,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.53.2"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
@@ -13150,9 +13131,9 @@ dependencies = [
 
 [[package]]
 name = "twox-hash"
-version = "2.1.5"
+version = "2.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
+checksum = "5283634e518fe9e82c7b20520bb4bc209009fd16c82077c802f8111ecbb0117a"
 
 [[package]]
 name = "typed-path"
@@ -13206,9 +13187,9 @@ dependencies = [
 
 [[package]]
 name = "unicase"
-version = "2.10.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357cc3acc6a036009fd6c973ed009037c732d60d0b4f6c673e9041497482a28f"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
 
 [[package]]
 name = "unicode-bidi"
@@ -13310,9 +13291,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.27.0"
+version = "1.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -13380,9 +13361,9 @@ dependencies = [
 
 [[package]]
 name = "want"
-version = "0.3.2"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
 dependencies = [
  "try-lock",
 ]
@@ -14044,18 +14025,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.60"
+version = "0.8.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6400fc4bb7426f6faac3fb07566122bb18622e3022bd2c36426a92ed489b1dbe"
+checksum = "6df92bf3d9227be3d53173901ddbffac2babc27ae50f397776ffd6dc33f800cb"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.60"
+version = "0.8.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99c27cc7525bad4df59a45e073c45b2c2aa820efb588234cc23a547ec69a34db"
+checksum = "ac4f328cf2f05d084e496c3e9c3f33ed0a183656a16e1fcec4d464d8373aec82"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -14085,9 +14066,9 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.9.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 dependencies = [
  "zeroize_derive",
 ]

Cargo.toml

@@ -73,7 +73,7 @@ resolver = "3"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
-rust-version = "1.99.0"
+rust-version = "1.98.1"
 version = "1.0.1"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
@@ -157,7 +157,7 @@ futures-util = "0.3.34"
 pollster = "1.0.1"
 pulsar = { default-features = false, version = "6.9.0" }
 lapin = { default-features = false, version = "4.12.0" }
-hyper = { version = "1.12.0" }
+hyper = { version = "1.11.1" }
 hyper-rustls = { default-features = false, version = "0.27.10" }
 hyper-util = { version = "0.1.21" }
 http = "1.5.0"
@@ -166,9 +166,9 @@ http-body-util = "0.1.5"
 memchr = "2.8.3"
 minlz = "1.2.3"
 reqwest = "0.13.5"
-rustfs-kafka-async = { version = "1.4.0" }
+rustfs-kafka-async = { version = "1.3.1" }
 socket2 = { version = "0.6.5" }
-tokio = { version = "1.53.2" }
+tokio = { version = "1.53.1" }
 tokio-rustls = { default-features = false, version = "0.26.6" }
 tokio-stream = { version = "0.1.19" }
 tokio-test = "0.4.6"
@@ -178,13 +178,6 @@ tonic-prost = { version = "0.14.6" }
 tonic-prost-build = { version = "0.14.6" }
 tower = { version = "0.5.3" }
 tower-http = { version = "0.7.1" }
-h3 = "0.0.8"
-h3-quinn = "0.0.10"
-quinn = { version = "0.11.11", default-features = false, features = [
-      "futures-io",
-      "runtime-tokio",
-      "rustls-aws-lc-rs",
-] }
 
 # Serialization and Data Formats
 apache-avro = { version = "0.22.0", features = ["snappy", "zstandard"] }
@@ -226,13 +219,13 @@ x509-parser = "0.18.1"
 sha1 = "0.11.0"
 sha2 = "0.11.0"
 subtle = "2.6"
-zeroize = { version = "1.9.1" }
+zeroize = { version = "1.9.0" }
 proptest = "1"
 
 # Time and Date
 chrono = { version = "0.4.45" }
 humantime = "2.4.0"
-jiff = { version = "0.2.38" }
+jiff = { version = "0.2.37" }
 time = { version = "0.3.55" }
 
 # Database
@@ -251,9 +244,9 @@ atoi = "3.1.0"
 atomic_enum = "0.3.0"
 aws-config = { version = "1.12.0" }
 aws-credential-types = { version = "1.3.0" }
-aws-sdk-kms = { default-features = false, version = "1.123.0" }
-aws-sdk-s3 = { default-features = false, version = "1.152.0" }
-aws-sdk-sts = { default-features = false, version = "1.119.0" }
+aws-sdk-kms = { default-features = false, version = "1.122.0" }
+aws-sdk-s3 = { default-features = false, version = "1.151.0" }
+aws-sdk-sts = { default-features = false, version = "1.118.0" }
 aws-smithy-async = { version = "1.3.0" }
 aws-smithy-http-client = { default-features = false, version = "1.5.0" }
 aws-smithy-runtime-api = { version = "1.19.0" }
@@ -286,7 +279,7 @@ highway = { version = "1.3.0" }
 hostname = "0.4.2"
 ipnetwork = { version = "0.21.1" }
 lazy_static = "1.5.1"
-libc = "0.2.190"
+libc = "0.2.189"
 libsystemd = "0.7.2"
 local-ip-address = "0.6.13"
 log = "0.4"
@@ -306,7 +299,7 @@ percent-encoding = "2.3.2"
 # Server-side QR rendering for TOTP enrollment, so neither the console nor the
 # CLI needs its own QR encoder. No default features: the image/render backends
 # pull in an image stack this only needs SVG and text output from.
-qrcode-rs = { version = "2.2.0", default-features = false, features = ["std", "svg"] }
+qrcode-rs = { version = "2.1.1", default-features = false, features = ["std", "svg"] }
 pin-project-lite = "0.2.17"
 pretty_assertions = "1.4.1"
 rand = { version = "0.10.3" }
@@ -321,15 +314,15 @@ rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.5" }
 rust-embed = { version = "8.12.0" }
 rustc-hash = { version = "2.1.3" }
-s3s = { git = "https://github.com/s3s-project/s3s", rev = "5761ddfe4c509fcac87e3b99fd5bd9e176b442c0", features = ["minio"] }
-s3s-sigv4 = { git = "https://github.com/s3s-project/s3s", rev = "5761ddfe4c509fcac87e3b99fd5bd9e176b442c0" }
+s3s = { version = "0.17.0", features = ["minio"] }
+s3s-sigv4 = "0.17.0"
 serial_test = "4.0.1"
 shadow-rs = { default-features = false, version = "2.0.0" }
 siphasher = "1.0.4"
 smallvec = { version = "1.16.2" }
 compact_str = "0.10.0"
 snap = "1.1.2"
-starshard = { version = "2.4.0" }
+starshard = { version = "2.3.0" }
 strum = { version = "0.28.0" }
 sysinfo = "0.39.6"
 temp-env = "0.3.6"
@@ -345,7 +338,7 @@ tracing-subscriber = { version = "0.3.23" }
 transform-stream = "0.3.1"
 url = "2.5.8"
 urlencoding = "2.1.3"
-uuid = { version = "1.27.0" }
+uuid = { version = "1.26.1" }
 vaultrs = { version = "0.8.0" }
 tar = "0.4.46"
 walkdir = "2.5.0"
@@ -359,7 +352,7 @@ zstd = "0.14.0"
 # Observability and Metrics
 metrics = "0.24.6"
 metrics-util = "0.20"
-dial9 = { version = "0.5.3", default-features = false }
+dial9 = { version = "0.5.2", default-features = false }
 opentelemetry = { version = "0.33.0" }
 opentelemetry-appender-tracing = { version = "0.33.0" }
 opentelemetry-otlp = { version = "0.33.0" }
@@ -374,7 +367,7 @@ libunftp = { version = "0.23.1" }
 unftp-core = "0.1.0"
 suppaftp = { version = "12.1.1" }
 rcgen = { version = "0.14.10", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
-russh = { version = "0.64.1" }
+russh = { version = "0.63.3" }
 russh-sftp = "3.0.1"
 
 # WebDAV
@@ -383,9 +376,9 @@ dav-server = "0.11.0"
 # Performance Analysis and Memory Profiling
 rustfs-mimalloc = { version = "0.5.6" }
 # Preserve Unicode focus filters until rustfs/backlog#2302 is resolved.
-hotpath = { version = "0.28.5", default-features = false }
+hotpath = { version = "0.28.0", default-features = false }
 # Snapshot testing for output format regression detection
-insta = { version = "1.49" }
+insta = { version = "1.48" }
 
 [workspace.metadata.cargo-shear]
 ignored = ["hotpath", "rustfs"]

README.md

@@ -141,7 +141,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
 
 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.1
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0
 ```
 
 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command
@@ -220,7 +220,7 @@ For developers who want to build RustFS Docker images from source with multi-arc
 ./docker-buildx.sh --push
 
 # Build specific version
-./docker-buildx.sh --release 1.0.1 --push
+./docker-buildx.sh --release v1.0.0 --push
 
 # Build for custom registry
 ./docker-buildx.sh --registry your-registry.com --namespace yourname --push
@@ -238,7 +238,7 @@ You can also use Make targets for convenience:
 ```bash
 make docker-buildx                    # Build locally
 make docker-buildx-push               # Build and push
-make docker-buildx-version VERSION=1.0.1  # Build specific version
+make docker-buildx-version VERSION=v1.0.0  # Build specific version
 make help-docker                      # Show all Docker-related commands
 ```
 

README_ZH.md

@@ -138,7 +138,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
 
 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.1
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0
 ```
 
 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：
@@ -176,7 +176,7 @@ docker compose -f docker-compose-simple.yml up -d
 ./docker-buildx.sh --push
 
 # 构建指定版本
-./docker-buildx.sh --release 1.0.1 --push
+./docker-buildx.sh --release v1.0.0 --push
 
 # 构建并推送到自定义仓库
 ./docker-buildx.sh --registry your-registry.com --namespace yourname --push
@@ -193,7 +193,7 @@ docker compose -f docker-compose-simple.yml up -d
 ```bash
 make docker-buildx                    # 本地构建
 make docker-buildx-push               # 构建并推送
-make docker-buildx-version VERSION=1.0.1  # 构建指定版本
+make docker-buildx-version VERSION=v1.0.0  # 构建指定版本
 make help-docker                      # 显示所有 Docker 相关命令
 ```
 

crates/config/src/constants/app.rs

@@ -18,8 +18,10 @@ use const_str::concat;
 /// Default value: RustFS
 /// Environment variable: RUSTFS_APP_NAME
 pub const APP_NAME: &str = "RustFS";
-/// Cargo package version for this workspace member.
-pub const VERSION: &str = env!("CARGO_PKG_VERSION");
+/// Application version
+/// Default value: 1.0.0
+/// Environment variable: RUSTFS_VERSION
+pub const VERSION: &str = "1.0.0";
 
 /// Default configuration logger level
 /// Default value: error
@@ -37,6 +39,12 @@ pub const SAMPLE_RATIO: f64 = 1.0;
 /// Default value: 30
 pub const METER_INTERVAL: u64 = 30;
 
+/// Default configuration service version
+/// Default value: 1.0.0
+/// Environment variable: RUSTFS_OBS_SERVICE_VERSION
+/// Uses the same value as VERSION constant
+pub const SERVICE_VERSION: &str = "1.0.0";
+
 /// Default configuration environment
 /// Default value: production
 pub const ENVIRONMENT: &str = "production";
@@ -402,6 +410,7 @@ mod tests {
             APP_NAME,
             VERSION,
             DEFAULT_LOG_LEVEL,
+            SERVICE_VERSION,
             ENVIRONMENT,
             RUSTFS_TLS_KEY,
             RUSTFS_TLS_CERT,
@@ -437,7 +446,8 @@ mod tests {
     fn test_configuration_consistency() {
         // Test configuration consistency
 
-        assert_eq!(VERSION, env!("CARGO_PKG_VERSION"));
+        // Version consistency
+        assert_eq!(VERSION, SERVICE_VERSION, "Application version should match service version");
 
         // Port conflict check
         let ports = [DEFAULT_PORT, DEFAULT_CONSOLE_PORT];

crates/config/src/constants/tls.rs

@@ -207,9 +207,3 @@ pub const ENV_TLS_RELOAD_INTERVAL: &str = "RUSTFS_TLS_RELOAD_INTERVAL";
 
 /// Default interval for TLS certificate reload check
 pub const DEFAULT_TLS_RELOAD_INTERVAL: u64 = 30;
-
-/// Environment variable to enable experimental HTTP/3 support.
-pub const ENV_HTTP3_ENABLE: &str = "RUSTFS_HTTP3_ENABLE";
-
-/// HTTP/3 is disabled unless explicitly enabled.
-pub const DEFAULT_HTTP3_ENABLE: bool = false;

crates/e2e_test/src/cluster_multidrive_pool_test.rs

@@ -33,10 +33,6 @@
 //! tracked separately.
 
 use crate::common::{ClusterTopology, RustFSTestClusterEnvironment};
-use crate::fault_proxy::FaultMode;
-use aws_sdk_s3::Client;
-use std::time::Duration;
-use tokio::time::{Instant, timeout};
 
 type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
 
@@ -148,99 +144,7 @@ async fn cluster_volume_fault_proxy_pass_smoke() -> TestResult {
         cluster.start().await?;
         cluster.create_test_bucket(BUCKET).await?;
         let payload = vec![0x6Du8; 256 * 1024];
-        put_get_roundtrip(&cluster, "volume-proxy/object", &payload).await?;
-
-        // Node 1 owns only two disks; a successful three-vote write must
-        // authenticate at least one disk mutation through node 0's proxy.
-        let client = cluster.create_s3_client(1)?;
-        let client = Client::from_conf(
-            client
-                .config()
-                .to_builder()
-                .retry_config(aws_sdk_s3::config::retry::RetryConfig::standard().with_max_attempts(1))
-                .build(),
-        );
-        let forwarded_before = proxy.forwarded_bytes();
-        client
-            .put_object()
-            .bucket(BUCKET)
-            .key("volume-proxy/authenticated")
-            .body(bytes::Bytes::copy_from_slice(&payload).into())
-            .send()
-            .await?;
-        assert!(
-            proxy.forwarded_bytes() > forwarded_before,
-            "successful peer-disk publication must traverse the proxy"
-        );
-
-        let dropped_before = proxy.dropped_bytes();
-        proxy.set_mode(FaultMode::Blackhole);
-        assert_eq!(proxy.mode(), FaultMode::Blackhole);
-        let error = timeout(
-            Duration::from_secs(30),
-            client
-                .put_object()
-                .bucket(BUCKET)
-                .key("volume-proxy/rejected")
-                .body(bytes::Bytes::copy_from_slice(&payload).into())
-                .send(),
-        )
-        .await?
-        .expect_err("two local disks cannot commit a write while the peer is blackholed");
-        assert_eq!(error.raw_response().map(|response| response.status().as_u16()), Some(503));
-        assert_eq!(error.as_service_error().and_then(|error| error.meta().code()), Some("ServiceUnavailable"));
-        assert!(
-            proxy.dropped_bytes() > dropped_before,
-            "the injected blackhole must discard actual peer traffic"
-        );
-
-        proxy.set_mode(FaultMode::Pass);
-        assert_eq!(proxy.mode(), FaultMode::Pass);
-        let http = reqwest::Client::builder()
-            .no_proxy()
-            .timeout(Duration::from_secs(3))
-            .build()?;
-        let deadline = Instant::now() + Duration::from_secs(30);
-        loop {
-            let response = http.get(format!("{}/health/ready", cluster.nodes[1].url)).send().await?;
-            let status = response.status();
-            let body: serde_json::Value = response.json().await?;
-            // Reachable peers can still have Returning disk handles that reject
-            // writes. Wait for this node's live writer inventory to be Online.
-            if status.as_u16() == 200
-                && body["details"]["storage"]["source"] == "local_runtime"
-                && body["details"]["storage"]["writeQuorum"] == true
-                && body["details"]["storage"]["unavailableDrives"]
-                    .as_array()
-                    .is_some_and(Vec::is_empty)
-                && body["details"]["lock"]["ready"] == true
-            {
-                break;
-            }
-            assert!(Instant::now() < deadline, "peer write quorum did not recover: HTTP {status}, {body}");
-            tokio::time::sleep(Duration::from_millis(200)).await;
-        }
-        client
-            .put_object()
-            .bucket(BUCKET)
-            .key("volume-proxy/recovered")
-            .body(bytes::Bytes::copy_from_slice(&payload).into())
-            .send()
-            .await?;
-        for key in ["volume-proxy/object", "volume-proxy/authenticated", "volume-proxy/recovered"] {
-            let got = client.get_object().bucket(BUCKET).key(key).send().await?;
-            let body = got.body.collect().await?.into_bytes();
-            assert_eq!(body.as_ref(), payload, "proxy recovery must preserve the full object body for {key}");
-        }
-        let rejected = client
-            .head_object()
-            .bucket(BUCKET)
-            .key("volume-proxy/rejected")
-            .send()
-            .await
-            .expect_err("a rejected proxied write must never become visible after recovery");
-        assert_eq!(rejected.raw_response().map(|response| response.status().as_u16()), Some(404));
-        Ok(())
+        put_get_roundtrip(&cluster, "volume-proxy/object", &payload).await
     }
     .await;
 

crates/e2e_test/src/common.rs

@@ -35,7 +35,7 @@ use s3s::Body;
 use serde_json;
 use std::fs as stdfs;
 use std::io::ErrorKind;
-use std::net::{Ipv6Addr, SocketAddr};
+use std::net::SocketAddr;
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Once;
@@ -1442,11 +1442,7 @@ impl RustFSTestClusterEnvironment {
             return Err(format!("a volume proxy is already configured for node {node_idx}").into());
         }
         let target = self.nodes[node_idx].address.parse::<SocketAddr>()?;
-        // Endpoint locality and RPC audience both use the advertised authority.
-        // Keep the node's port while the second loopback IP separates the proxy
-        // listener from the direct IPv4 server and S3 client address.
-        let listen = SocketAddr::from((Ipv6Addr::LOCALHOST, target.port()));
-        let proxy = crate::fault_proxy::FaultProxy::start_on(listen, target).await?;
+        let proxy = crate::fault_proxy::FaultProxy::start(target).await?;
         self.volume_proxy_addresses[node_idx] = Some(proxy.local_addr());
         Ok(proxy)
     }
@@ -2471,20 +2467,6 @@ mod tests {
 
         assert!(volumes.contains(&proxied), "volumes must use the proxy address: {volumes}");
         assert!(!volumes.contains(&direct), "volumes must not retain the direct address: {volumes}");
-        assert_eq!(proxy.local_addr().port(), proxy.target_addr().port());
-        assert_ne!(proxy.local_addr().ip(), proxy.target_addr().ip());
-        assert_eq!(env.nodes[0].address, direct, "S3 clients must retain the direct address");
-        let mut endpoint =
-            crate::storage_api::Endpoint::try_from(volumes.as_str()).expect("proxied volume should be a valid endpoint");
-        endpoint
-            .update_is_local(proxy.target_addr().port())
-            .expect("proxied endpoint locality should resolve");
-        assert!(endpoint.is_local, "the proxied node must keep its local disk and first-disk authority");
-        assert_eq!(
-            endpoint.host_port(),
-            proxied,
-            "the local RPC audience must be the advertised proxy authority"
-        );
 
         proxy.shutdown().await;
     }

crates/e2e_test/src/distributed/s3_basic_test.rs

@@ -20,60 +20,6 @@ use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{Delete, MetadataDirective, ObjectIdentifier};
 use std::time::Duration;
 
-#[tokio::test]
-async fn four_node_bucket_tags_opa_refreshes_warm_peer_caches() -> TestResult {
-    use super::harness::cluster_admin_ok;
-    use crate::sts_query_compat_test::{OPA_AUTH_TOKEN, OpaMock, set_department};
-
-    init_logging();
-    let mut opa = OpaMock::start().await?;
-    let dist = DistCluster::start_with_env(
-        DistLayout::FourNodeFourDisk,
-        &[
-            ("RUSTFS_POLICY_PLUGIN_URL", opa.url.as_str()),
-            ("RUSTFS_POLICY_PLUGIN_AUTH_TOKEN", OPA_AUTH_TOKEN),
-        ],
-    )
-    .await?;
-    let secret = uuid::Uuid::new_v4().to_string();
-    cluster_admin_ok(
-        &dist.cluster,
-        http::Method::PUT,
-        "/rustfs/admin/v3/add-user?accessKey=opabuckettags",
-        Some(serde_json::json!({"secretKey": secret, "status": "enabled"}).to_string()),
-    )
-    .await?;
-    let bucket = unique_bucket("opa-tags");
-    dist.create_bucket(&bucket).await?;
-    let admin = dist.client(0)?;
-    put_object(&admin, &bucket, "report", b"report".to_vec()).await?;
-    let clients = (0..4)
-        .map(|node| dist.client_with_credentials(node, "opabuckettags", &secret))
-        .collect::<Result<Vec<_>, _>>()?;
-
-    // Warm every peer, then verify the acknowledged updates/removal without
-    // polling or restarting nodes. This exercises healthy-peer metadata reload.
-    for department in [Some("finance"), Some("engineering"), None, Some("finance")] {
-        match department {
-            Some(value) => set_department(&admin, &bucket, value).await?,
-            None => {
-                admin.delete_bucket_tagging().bucket(&bucket).send().await?;
-            }
-        }
-        for client in &clients {
-            let result = client.get_object().bucket(&bucket).key("report").send().await;
-            if department == Some("finance") {
-                assert_eq!(result?.body.collect().await?.into_bytes().as_ref(), b"report");
-            } else {
-                let error = result.expect_err("updated or removed bucket tags must revoke this policy's read access");
-                assert_eq!(error.as_service_error().and_then(ProvideErrorMetadata::code), Some("AccessDenied"));
-            }
-            opa.expect_bucket_tags("s3:GetObject", &bucket, department).await?;
-        }
-    }
-    Ok(())
-}
-
 #[tokio::test]
 async fn four_node_four_drive_s3_put_get_head_list_copy_rename_delete_and_presign() -> TestResult {
     init_logging();

crates/e2e_test/src/distributed/upgrade_test.rs

@@ -31,7 +31,6 @@ use super::harness::{
 use crate::common::{
     AdminTransport, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via, init_logging,
 };
-use crate::upgrade_compatibility_test::wait_for_upgrade_write_readiness;
 use aws_sdk_s3::Client;
 use aws_sdk_s3::error::ProvideErrorMetadata;
 use std::path::{Path, PathBuf};
@@ -401,19 +400,6 @@ async fn four_node_direct_upgrade_preserves_history_and_iam_credentials() -> Tes
     Ok(())
 }
 
-async fn replace_node_and_wait_for_write_readiness(dist: &mut DistCluster, seed: &UpgradeSeed, node_idx: usize) -> TestResult {
-    dist.replace_node_with_current_binary(node_idx).await?;
-    // Node readiness proves reads can succeed; a rolling writer must also
-    // recover before replacing the next peer or checking upgrade contracts.
-    wait_for_upgrade_write_readiness(
-        &dist.clients()?,
-        &seed.history_bucket,
-        &format!("replaced-node-{node_idx}"),
-        CREDENTIAL_TIMEOUT,
-    )
-    .await
-}
-
 #[tokio::test]
 async fn four_node_rolling_upgrade_preserves_history_and_iam_credentials() -> TestResult {
     init_logging();
@@ -424,15 +410,15 @@ async fn four_node_rolling_upgrade_preserves_history_and_iam_credentials() -> Te
 
     let seed = seed_history_and_iam(&dist).await?;
 
-    replace_node_and_wait_for_write_readiness(&mut dist, &seed, 0).await?;
+    dist.replace_node_with_current_binary(0).await?;
     assert_history_and_iam(&dist, &seed, "one-current-node").await?;
 
     for node_idx in [1, 2] {
-        replace_node_and_wait_for_write_readiness(&mut dist, &seed, node_idx).await?;
+        dist.replace_node_with_current_binary(node_idx).await?;
     }
     assert_history_and_iam(&dist, &seed, "one-previous-node").await?;
 
-    replace_node_and_wait_for_write_readiness(&mut dist, &seed, 3).await?;
+    dist.replace_node_with_current_binary(3).await?;
     assert_history_and_iam(&dist, &seed, "homogeneous-current").await?;
     Ok(())
 }

crates/e2e_test/src/fake_s3_target/mod.rs

@@ -50,8 +50,8 @@ use std::collections::{BTreeMap, HashMap, VecDeque};
 use std::error::Error;
 use std::io;
 use std::net::SocketAddr;
-use std::sync::{Arc, Mutex, MutexGuard, OnceLock};
-use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+use std::sync::{Arc, Mutex, MutexGuard};
+use std::time::{Duration, SystemTime};
 use tokio::net::TcpListener;
 use tokio::sync::{OwnedSemaphorePermit, Semaphore, watch};
 use tokio::task::JoinHandle;
@@ -363,14 +363,6 @@ pub struct RequestRecord {
     pub upload_id: Option<String>,
     pub part_number: Option<i32>,
     pub content_length: Option<u64>,
-    pub source_version_id: Option<String>,
-    pub source_mtime: Option<String>,
-    pub source_etag: Option<String>,
-    pub source_replication_request: bool,
-    pub journaled_at_unix_millis: Option<u64>,
-    /// Computed by the target, before response stall/disconnect faults. This
-    /// does not prove that any response bytes reached the client.
-    pub prepared_response: Option<PreparedResponse>,
     pub consumed_bytes: Option<usize>,
     pub replication_timestamps: ReplicationTimestampHeaders,
     pub proxy_headers: ProxyHeaderSnapshot,
@@ -389,20 +381,6 @@ pub struct RequestRecord {
     pub fault: Option<FaultAction>,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PreparedResponse {
-    pub status: u16,
-    pub version_id: Option<String>,
-    pub etag: Option<String>,
-    pub last_modified: Option<String>,
-    pub content_length: Option<u64>,
-    pub prepared_at_unix_millis: Option<u64>,
-    pub elapsed: Duration,
-}
-
-#[derive(Clone, Default)]
-struct RequestSequence(Arc<OnceLock<u64>>);
-
 /// Integrity and framing headers of an upload. A remote target's acceptance
 /// rules key off exactly these (rustfs#6853: `aws-chunked` framing stored
 /// verbatim; rustfs#7082: Object Lock PUTs need `Content-MD5` or
@@ -452,10 +430,6 @@ impl TransportSnapshot {
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 struct JournaledHeaders {
     content_length: Option<u64>,
-    source_version_id: Option<String>,
-    source_mtime: Option<String>,
-    source_etag: Option<String>,
-    source_replication_request: bool,
     replication_timestamps: ReplicationTimestampHeaders,
     proxy_headers: ProxyHeaderSnapshot,
     transport: TransportSnapshot,
@@ -470,10 +444,6 @@ impl JournaledHeaders {
                 .get(CONTENT_LENGTH)
                 .and_then(|value| value.to_str().ok())
                 .and_then(|value| value.parse().ok()),
-            source_version_id: header_value(headers, &SOURCE_VERSION_ID_HEADERS).map(bounded_journal_value),
-            source_mtime: header_value(headers, &SOURCE_MTIME_HEADERS).map(bounded_journal_value),
-            source_etag: header_value(headers, &SOURCE_ETAG_HEADERS).map(bounded_journal_value),
-            source_replication_request: header_value(headers, &SOURCE_REPLICATION_REQUEST_HEADERS).as_deref() == Some("true"),
             replication_timestamps: ReplicationTimestampHeaders::from_headers(headers),
             proxy_headers: ProxyHeaderSnapshot::from_headers(headers),
             transport: TransportSnapshot::from_headers(headers),
@@ -541,10 +511,6 @@ struct StoreState {
     /// version id the target never had answers 404 `NoSuchVersion` instead of
     /// the idempotent 204 RustFS/MinIO give.
     reject_unknown_version_deletes: bool,
-    /// Models MinIO and its derivatives (Storj): `X-Minio-Internal-` is a reserved
-    /// metadata prefix, so a PutObject or UploadPart carrying any such request
-    /// header is refused with `InvalidArgument` (rustfs#8362).
-    reject_reserved_internal_headers: bool,
     limits: StoreLimits,
     buckets: HashMap<String, BucketState>,
     uploads: HashMap<String, MultipartState>,
@@ -772,7 +738,6 @@ impl FakeS3Target {
         let connection_limit = Arc::new(Semaphore::new(MAX_CONNECTIONS));
         let (active_connections_tx, active_connections) = watch::channel(0usize);
         let task_connection_limit = Arc::clone(&connection_limit);
-        let task_control = Arc::clone(&control);
 
         let task = tokio::spawn(async move {
             let mut connections = tokio::task::JoinSet::new();
@@ -786,7 +751,6 @@ impl FakeS3Target {
                         };
                         active_connections_tx.send_modify(|count| *count += 1);
                         let service = service.clone();
-                        let control = Arc::clone(&task_control);
                         let active_connections = active_connections_tx.clone();
                         let mut connection_gate = connection_gate.clone();
                         connections.spawn(async move {
@@ -800,7 +764,7 @@ impl FakeS3Target {
                             {
                                 return;
                             }
-                            let handler = service_fn(move |request| handle_request(request, service.clone(), Arc::clone(&control)));
+                            let handler = service_fn(move |request| handle_request(request, service.clone()));
                             let mut connection = http1::Builder::new();
                             connection
                                 .keep_alive(false)
@@ -1011,43 +975,6 @@ impl FakeS3Target {
         lock(&self.backend.store).reject_unknown_version_deletes = enabled;
     }
 
-    /// Refuse every PutObject / UploadPart that carries an `x-minio-internal-*`
-    /// request header, the way MinIO and Storj do.
-    pub fn reject_reserved_internal_headers(&self, enabled: bool) {
-        lock(&self.backend.store).reject_reserved_internal_headers = enabled;
-    }
-
-    /// Keys of every stored, non-delete object in the bucket, sorted.
-    pub fn stored_keys(&self, bucket: &str) -> Vec<String> {
-        let state = lock(&self.backend.store);
-        let mut keys: Vec<String> = state
-            .buckets
-            .get(bucket)
-            .map(|bucket| {
-                bucket
-                    .objects
-                    .iter()
-                    .filter(|(_, versions)| versions.last().is_some_and(|version| !version.delete_marker))
-                    .map(|(key, _)| key.clone())
-                    .collect()
-            })
-            .unwrap_or_default();
-        keys.sort();
-        keys
-    }
-
-    /// Body and user metadata (names as stored, without the `x-amz-meta-` prefix)
-    /// of the latest non-delete version of an object.
-    pub fn stored_object(&self, bucket: &str, key: &str) -> Option<(Bytes, HashMap<String, String>)> {
-        lock(&self.backend.store)
-            .buckets
-            .get(bucket)
-            .and_then(|bucket| bucket.objects.get(key))
-            .and_then(|versions| versions.last())
-            .filter(|version| !version.delete_marker)
-            .map(|version| (version.body.clone(), version.metadata.clone().unwrap_or_default()))
-    }
-
     pub fn require_checksum_for_object_lock(&self, enabled: bool) {
         lock(&self.backend.store).require_checksum_for_object_lock = enabled;
     }
@@ -1234,10 +1161,7 @@ impl S3Access for FaultAccess {
         let operation = operation_from_s3_name(context.s3_op().name());
         let journaled = JournaledHeaders::from_headers(context.headers());
         let aws_chunked = journaled.transport.aws_chunked;
-        let (sequence, fault) = record_request(&self.control, operation, context.method().clone(), parsed, journaled);
-        if let Some(slot) = context.extensions_mut().get::<RequestSequence>() {
-            let _ = slot.0.set(sequence);
-        }
+        let fault = record_request(&self.control, operation, context.method().clone(), parsed, journaled);
         if let Some(status) = fault.as_ref().and_then(|fault| scripted_status(&fault.action)) {
             return Err(scripted_status_error(status));
         }
@@ -1250,15 +1174,6 @@ impl S3Access for FaultAccess {
                 "this target does not decode aws-chunked request bodies; send a plain signed payload with an exact Content-Length"
             ));
         }
-        if matches!(operation, Operation::PutObject | Operation::UploadPart)
-            && lock(&self.store).reject_reserved_internal_headers
-            && context
-                .headers()
-                .keys()
-                .any(|name| name.as_str().starts_with("x-minio-internal-"))
-        {
-            return Err(s3s::s3_error!(InvalidArgument, "Your metadata headers are not supported."));
-        }
         let prebody_permit = if operation == Operation::CompleteMultipartUpload {
             Some(
                 timeout(
@@ -1313,7 +1228,7 @@ fn record_request(
     method: Method,
     parsed: ParsedRequest,
     headers: JournaledHeaders,
-) -> (u64, Option<RequestFault>) {
+) -> Option<RequestFault> {
     let mut state = lock(control);
     let action = parsed
         .key
@@ -1336,12 +1251,6 @@ fn record_request(
         upload_id: parsed.upload_id.map(bounded_journal_value),
         part_number: parsed.part_number,
         content_length: headers.content_length,
-        source_version_id: headers.source_version_id,
-        source_mtime: headers.source_mtime,
-        source_etag: headers.source_etag,
-        source_replication_request: headers.source_replication_request,
-        journaled_at_unix_millis: unix_millis(),
-        prepared_response: None,
         consumed_bytes: None,
         replication_timestamps: headers.replication_timestamps,
         proxy_headers: headers.proxy_headers,
@@ -1352,14 +1261,7 @@ fn record_request(
         continuation_token: parsed.continuation_token.map(bounded_journal_value),
         fault: action.clone(),
     });
-    (sequence, action.map(|action| RequestFault { sequence, action }))
-}
-
-fn unix_millis() -> Option<u64> {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .ok()
-        .and_then(|elapsed| u64::try_from(elapsed.as_millis()).ok())
+    action.map(|action| RequestFault { sequence, action })
 }
 
 fn bounded_journal_value(mut value: String) -> String {
@@ -1367,31 +1269,14 @@ fn bounded_journal_value(mut value: String) -> String {
     while !value.is_char_boundary(end) {
         end -= 1;
     }
-    if value.capacity() > MAX_RETAINED_IDENTIFIER_BYTES {
-        value[..end].to_owned()
-    } else {
-        value.truncate(end);
-        value
-    }
+    value.truncate(end);
+    value
 }
 
-async fn handle_request(
-    mut request: Request<Incoming>,
-    service: S3Service,
-    control: Arc<Mutex<ControlState>>,
-) -> Result<Response<Body>, BoxError> {
-    let started = Instant::now();
-    let sequence = RequestSequence::default();
-    request.extensions_mut().insert(sequence.clone());
-    let mut response = timeout(MAX_REQUEST_DURATION, async {
-        let result = call_s3(service, request.map(Body::from)).await;
-        if let (Ok(response), Some(sequence)) = (&result, sequence.0.get()) {
-            update_prepared_response(&control, *sequence, response, started.elapsed());
-        }
-        result
-    })
-    .await
-    .map_err(|_| io::Error::new(io::ErrorKind::TimedOut, "fake target request exceeded 65 seconds"))??;
+async fn handle_request(request: Request<Incoming>, service: S3Service) -> Result<Response<Body>, BoxError> {
+    let mut response = timeout(MAX_REQUEST_DURATION, call_s3(service, request.map(Body::from)))
+        .await
+        .map_err(|_| io::Error::new(io::ErrorKind::TimedOut, "fake target request exceeded 65 seconds"))??;
     if response.headers_mut().remove(DISCONNECT_HEADER).is_some() {
         return Err(io::Error::new(io::ErrorKind::ConnectionAborted, "fake target scripted disconnect").into());
     }
@@ -1646,25 +1531,6 @@ fn update_consumed(control: &Mutex<ControlState>, sequence: u64, consumed: usize
     }
 }
 
-fn update_prepared_response(control: &Mutex<ControlState>, sequence: u64, response: &Response<Body>, elapsed: Duration) {
-    let prepared = PreparedResponse {
-        status: response.status().as_u16(),
-        version_id: header_value(response.headers(), &["x-amz-version-id"]).map(bounded_journal_value),
-        etag: header_value(response.headers(), &[ETAG.as_str()]).map(bounded_journal_value),
-        last_modified: header_value(response.headers(), &[LAST_MODIFIED.as_str()]).map(bounded_journal_value),
-        content_length: response
-            .headers()
-            .get(CONTENT_LENGTH)
-            .and_then(|value| value.to_str().ok())
-            .and_then(|value| value.parse().ok()),
-        prepared_at_unix_millis: unix_millis(),
-        elapsed,
-    };
-    if let Some(record) = lock(control).requests.iter_mut().find(|record| record.sequence == sequence) {
-        record.prepared_response = Some(prepared);
-    }
-}
-
 async fn apply_non_body_fault(fault: Option<&RequestFault>, control: &Mutex<ControlState>) -> S3Result<()> {
     match fault.map(|fault| &fault.action) {
         Some(action @ (FaultAction::Status(_) | FaultAction::ResponseStatus(_))) => {
@@ -3364,38 +3230,10 @@ mod tests {
         let retry = client.clone();
         requests.spawn(async move { get_bytes(&retry, bucket, "held", None).await });
         timeout(Duration::from_secs(2), gate.entered.wait_for(|count| *count == 2)).await??;
-        let held_retry = target
-            .requests()
-            .into_iter()
-            .rev()
-            .find(|record| record.operation == Operation::GetObject && record.key.as_deref() == Some("held"))
-            .expect("the held retry must be journaled");
-        assert_eq!(held_retry.prepared_response, None);
         assert_eq!(
             timeout(Duration::from_secs(2), get_bytes(&client, bucket, "unrelated", None)).await??,
             Bytes::from_static(b"payload")
         );
-        let unrelated = target
-            .requests()
-            .into_iter()
-            .find(|record| record.operation == Operation::GetObject && record.key.as_deref() == Some("unrelated"))
-            .expect("the unrelated GET must be journaled");
-        let unrelated_response = unrelated.prepared_response.expect("the unrelated GET prepared a response");
-        assert_eq!(unrelated_response.status, 200);
-        assert_eq!(
-            unrelated_response.version_id.as_deref(),
-            Some(target.stored_versions(bucket, "unrelated")[0].0.as_str())
-        );
-        assert!(held_retry.sequence < unrelated.sequence);
-        assert_eq!(
-            target
-                .requests()
-                .into_iter()
-                .find(|record| record.sequence == held_retry.sequence)
-                .expect("the held retry remains journaled")
-                .prepared_response,
-            None
-        );
         assert!(requests.try_join_next().is_none(), "the retry must remain behind the gate");
         drop(gate);
         assert_eq!(
@@ -3404,18 +3242,6 @@ mod tests {
                 .expect("retried GET task")??,
             Bytes::from_static(b"payload")
         );
-        let held_response = target
-            .requests()
-            .into_iter()
-            .find(|record| record.sequence == held_retry.sequence)
-            .and_then(|record| record.prepared_response)
-            .expect("the released retry prepared its own response");
-        assert_eq!(held_response.status, 200);
-        assert_eq!(
-            held_response.version_id.as_deref(),
-            Some(target.stored_versions(bucket, "held")[0].0.as_str())
-        );
-        assert_ne!(held_response.version_id, unrelated_response.version_id);
         assert_eq!(get_bytes(&client, bucket, "held", None).await?, Bytes::from_static(b"payload"));
         assert_eq!(target.count_requests(Operation::GetObject, "held"), 3);
         Ok(())
@@ -3760,23 +3586,6 @@ mod tests {
             .await?;
         assert_eq!(first_head.content_length(), Some(5));
         assert_eq!(first_head.version_id(), first.version_id.as_deref());
-        let journaled_head = target
-            .requests()
-            .into_iter()
-            .rev()
-            .find(|record| record.operation == Operation::HeadObject)
-            .expect("the version HEAD must be journaled");
-        assert_eq!(journaled_head.version_id, first.version_id);
-        assert!(journaled_head.journaled_at_unix_millis.is_some());
-        let prepared_head = journaled_head
-            .prepared_response
-            .expect("the version HEAD prepared a response");
-        assert_eq!(prepared_head.status, 200);
-        assert_eq!(prepared_head.version_id.as_deref(), first_head.version_id());
-        assert_eq!(prepared_head.etag.as_deref(), first_head.e_tag());
-        assert_eq!(prepared_head.content_length, Some(5));
-        assert!(prepared_head.last_modified.is_some());
-        assert!(prepared_head.prepared_at_unix_millis.is_some());
         assert_eq!(
             get_bytes(&client, "target-bucket", "nested/key", None).await?,
             Bytes::from_static(b"second")
@@ -3802,20 +3611,6 @@ mod tests {
             .await
             .expect_err("deleted version must not remain readable");
         assert_sdk_error!(deleted, 404, "NoSuchVersion");
-        let deleted_record = target
-            .requests()
-            .into_iter()
-            .rev()
-            .find(|record| record.operation == Operation::GetObject)
-            .expect("the deleted version GET must be journaled");
-        assert_eq!(deleted_record.version_id, first.version_id);
-        assert_eq!(
-            deleted_record
-                .prepared_response
-                .expect("the error response was prepared")
-                .status,
-            404
-        );
         let marker = client
             .delete_object()
             .bucket("target-bucket")
@@ -4247,21 +4042,7 @@ mod tests {
             .await
             .expect_err("wrong part ETag must fail without consuming the upload");
         assert_sdk_error!(invalid_complete, 400, "InvalidPart");
-        let rejected_complete = target
-            .requests()
-            .into_iter()
-            .rev()
-            .find(|record| record.operation == Operation::CompleteMultipartUpload)
-            .expect("the rejected completion must be journaled");
-        assert_eq!(rejected_complete.upload_id.as_deref(), Some(upload_id.as_str()));
-        assert_eq!(
-            rejected_complete
-                .prepared_response
-                .expect("the rejection was prepared")
-                .status,
-            400
-        );
-        let successful_complete = client
+        client
             .complete_multipart_upload()
             .bucket("target-bucket")
             .key("multipart")
@@ -4269,18 +4050,6 @@ mod tests {
             .multipart_upload(CompletedMultipartUpload::builder().set_parts(Some(parts)).build())
             .send()
             .await?;
-        let completed_record = target
-            .requests()
-            .into_iter()
-            .rev()
-            .find(|record| record.operation == Operation::CompleteMultipartUpload)
-            .expect("the successful completion must be journaled");
-        assert_eq!(completed_record.upload_id.as_deref(), Some(upload_id.as_str()));
-        let prepared_complete = completed_record
-            .prepared_response
-            .expect("the completion response was prepared");
-        assert_eq!(prepared_complete.status, 200);
-        assert_eq!(prepared_complete.version_id.as_deref(), successful_complete.version_id());
         let completed = get_bytes(&client, "target-bucket", "multipart", None).await?;
         assert_eq!(completed.len(), MIN_MULTIPART_PART_BYTES + 5);
         assert_eq!(&completed[..MIN_MULTIPART_PART_BYTES], first_body.as_ref());
@@ -4661,32 +4430,6 @@ mod tests {
             .send()
             .await?;
         assert_eq!(completed.version_id(), Some(completed_version.as_str()));
-        let receipt_records = target.requests();
-        let receipt_create = receipt_records
-            .iter()
-            .find(|record| {
-                record.operation == Operation::CreateMultipartUpload && record.key.as_deref() == Some("multipart-receipt-time")
-            })
-            .expect("the source version must be retained on MPU creation");
-        assert_eq!(receipt_create.source_version_id.as_deref(), Some(completed_version.as_str()));
-        let receipt_complete = receipt_records
-            .iter()
-            .find(|record| {
-                record.operation == Operation::CompleteMultipartUpload
-                    && record.upload_id.as_deref() == Some(receipt_upload.as_str())
-            })
-            .expect("the source mtime must be retained on completion");
-        assert_eq!(receipt_complete.source_mtime.as_deref(), Some("1970-01-01T00:00:00Z"));
-        assert!(receipt_complete.source_replication_request);
-        assert_eq!(
-            receipt_complete
-                .prepared_response
-                .as_ref()
-                .expect("the receipt-time response was prepared")
-                .version_id
-                .as_deref(),
-            completed.version_id()
-        );
         assert_eq!(
             get_bytes(&client, "target-bucket", "multipart-receipt-time", None).await?,
             Bytes::from_static(b"completed"),
@@ -4905,23 +4648,6 @@ mod tests {
             .expect_err("disconnected request must not store an object");
         assert_sdk_error!(disconnected, 404, "NotFound");
 
-        target.inject_for_key(Operation::PutObject, "lost-response", FaultAction::DisconnectAfterResponse, 1);
-        client
-            .put_object()
-            .bucket("target-bucket")
-            .key("lost-response")
-            .body(ByteStream::from_static(b"stored"))
-            .send()
-            .await
-            .expect_err("a prepared response does not prove client delivery");
-        let lost_response_head = client
-            .head_object()
-            .bucket("target-bucket")
-            .key("lost-response")
-            .send()
-            .await?;
-        assert_eq!(lost_response_head.content_length(), Some(6));
-
         assert_eq!(
             parse_request(&Method::PUT, &"/target-bucket/key?uploadId=upload&partNumber=bad".parse::<Uri>()?).operation,
             Operation::Unknown
@@ -4935,28 +4661,6 @@ mod tests {
                 .count(),
             4
         );
-        assert!(
-            requests
-                .iter()
-                .filter(|request| request.fault == Some(FaultAction::Status(StatusCode::SERVICE_UNAVAILABLE)))
-                .all(|request| {
-                    request
-                        .prepared_response
-                        .as_ref()
-                        .is_some_and(|response| response.status == 503)
-                })
-        );
-        let lost_response = requests
-            .iter()
-            .find(|request| request.operation == Operation::PutObject && request.key.as_deref() == Some("lost-response"))
-            .expect("the disconnected response must be journaled");
-        assert_eq!(lost_response.fault, Some(FaultAction::DisconnectAfterResponse));
-        let prepared_lost_response = lost_response
-            .prepared_response
-            .as_ref()
-            .expect("the target prepared the successful response");
-        assert_eq!(prepared_lost_response.status, 200);
-        assert_eq!(prepared_lost_response.version_id.as_deref(), lost_response_head.version_id());
         assert!(
             requests
                 .iter()
@@ -5147,44 +4851,8 @@ mod tests {
             assert_eq!(records.len(), MAX_REQUEST_RECORDS);
             assert_eq!(records.front().map(|record| record.sequence), Some(2));
             assert_eq!(records.back().map(|record| record.sequence), Some((MAX_REQUEST_RECORDS + 1) as u64));
-            let mut oversized_allocation = String::with_capacity(MAX_RETAINED_IDENTIFIER_BYTES * 16);
-            oversized_allocation.push_str("short");
-            let short_value = bounded_journal_value(oversized_allocation);
-            assert_eq!(short_value, "short");
-            assert!(short_value.capacity() <= MAX_RETAINED_IDENTIFIER_BYTES);
-            let mut response = Response::new(Body::empty());
-            for name in ["x-amz-version-id", "etag", "last-modified"] {
-                response.headers_mut().insert(
-                    name,
-                    HeaderValue::from_str(&"r".repeat(MAX_RETAINED_IDENTIFIER_BYTES + 1)).expect("header"),
-                );
-            }
-            response.headers_mut().insert(CONTENT_LENGTH, HeaderValue::from_static("17"));
-            response
-                .headers_mut()
-                .insert("authorization", HeaderValue::from_static("unrecorded-response-authorization"));
-            response.headers_mut().insert(
-                "x-amz-server-side-encryption-customer-key",
-                HeaderValue::from_static("unrecorded-response-customer-key"),
-            );
-            update_prepared_response(&control, 1, &response, Duration::ZERO);
-            update_prepared_response(&control, u64::MAX, &response, Duration::ZERO);
-            assert_eq!(lock(&control).requests, records, "misses and evicted records must not be resurrected");
             let bounded_control = Mutex::new(ControlState::default());
             let utf8_boundary = format!("{}é", "a".repeat(MAX_RETAINED_IDENTIFIER_BYTES - 1));
-            let mut source_headers = HeaderMap::new();
-            for name in ["x-rustfs-source-version-id", "x-minio-source-mtime", "x-rustfs-source-etag"] {
-                source_headers.insert(
-                    name,
-                    HeaderValue::from_str(&"s".repeat(MAX_RETAINED_IDENTIFIER_BYTES + 1)).expect("header"),
-                );
-            }
-            source_headers.insert("x-minio-source-replication-request", HeaderValue::from_static("true"));
-            source_headers.insert("authorization", HeaderValue::from_static("unrecorded-request-authorization"));
-            source_headers.insert(
-                "x-amz-server-side-encryption-customer-key",
-                HeaderValue::from_static("unrecorded-request-customer-key"),
-            );
             record_request(
                 &bounded_control,
                 Operation::GetObject,
@@ -5197,9 +4865,8 @@ mod tests {
                     upload_id: Some("u".repeat(MAX_RETAINED_IDENTIFIER_BYTES + 1)),
                     ..Default::default()
                 },
-                JournaledHeaders::from_headers(&source_headers),
+                JournaledHeaders::default(),
             );
-            update_prepared_response(&bounded_control, 1, &response, Duration::from_millis(7));
             {
                 let bounded_records = lock(&bounded_control);
                 let bounded = &bounded_records.requests[0];
@@ -5207,39 +4874,7 @@ mod tests {
                 assert_eq!(bounded.key.as_ref().map(String::len), Some(MAX_RETAINED_IDENTIFIER_BYTES - 1));
                 assert_eq!(bounded.version_id.as_ref().map(String::len), Some(MAX_RETAINED_IDENTIFIER_BYTES));
                 assert_eq!(bounded.upload_id.as_ref().map(String::len), Some(MAX_RETAINED_IDENTIFIER_BYTES));
-                assert_eq!(bounded.source_version_id.as_ref().map(String::len), Some(MAX_RETAINED_IDENTIFIER_BYTES));
-                assert_eq!(bounded.source_mtime.as_ref().map(String::len), Some(MAX_RETAINED_IDENTIFIER_BYTES));
-                assert_eq!(bounded.source_etag.as_ref().map(String::len), Some(MAX_RETAINED_IDENTIFIER_BYTES));
-                for value in [&bounded.source_version_id, &bounded.source_mtime, &bounded.source_etag]
-                    .into_iter()
-                    .flatten()
-                {
-                    assert!(value.capacity() <= MAX_RETAINED_IDENTIFIER_BYTES);
-                }
-                assert!(bounded.source_replication_request);
-                let prepared = bounded
-                    .prepared_response
-                    .as_ref()
-                    .expect("the retained record receives its response");
-                assert_eq!(prepared.version_id.as_ref().map(String::len), Some(MAX_RETAINED_IDENTIFIER_BYTES));
-                assert_eq!(prepared.etag.as_ref().map(String::len), Some(MAX_RETAINED_IDENTIFIER_BYTES));
-                assert_eq!(prepared.last_modified.as_ref().map(String::len), Some(MAX_RETAINED_IDENTIFIER_BYTES));
-                for value in [&prepared.version_id, &prepared.etag, &prepared.last_modified]
-                    .into_iter()
-                    .flatten()
-                {
-                    assert!(value.capacity() <= MAX_RETAINED_IDENTIFIER_BYTES);
-                }
-                assert_eq!(prepared.content_length, Some(17));
-                assert_eq!(prepared.elapsed, Duration::from_millis(7));
-                assert!(
-                    !format!("{bounded:?}").contains("unrecorded-"),
-                    "authorization and customer keys must not enter the journal"
-                );
             }
-            lock(&bounded_control).requests.clear();
-            update_prepared_response(&bounded_control, 1, &response, Duration::ZERO);
-            assert!(lock(&bounded_control).requests.is_empty(), "a drained record must not be resurrected");
             let target = FakeS3Target::start().await.expect("target");
             target.create_bucket("b".repeat(63));
             let empty_bucket = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {

crates/e2e_test/src/fault_proxy.rs

@@ -61,8 +61,6 @@
 
 use std::io;
 use std::net::{Ipv4Addr, SocketAddr};
-use std::sync::Arc;
-use std::sync::atomic::{AtomicUsize, Ordering};
 use std::time::Duration;
 
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
@@ -110,33 +108,19 @@ pub struct FaultProxy {
     mode_tx: watch::Sender<FaultMode>,
     shutdown_tx: watch::Sender<bool>,
     accept_task: JoinHandle<()>,
-    traffic: Arc<ProxyTraffic>,
-}
-
-#[derive(Default)]
-struct ProxyTraffic {
-    forwarded_bytes: AtomicUsize,
-    dropped_bytes: AtomicUsize,
 }
 
 impl FaultProxy {
     /// Bind a listener on `127.0.0.1:0` and start forwarding accepted
     /// connections to `target`. Starts in [`FaultMode::Pass`].
     pub async fn start(target: SocketAddr) -> io::Result<Self> {
-        Self::start_on(SocketAddr::from((Ipv4Addr::LOCALHOST, 0)), target).await
-    }
-
-    /// Bind a specific address so advertised volume endpoints can retain the
-    /// server's port and authenticated RPC identity on another loopback IP.
-    pub async fn start_on(listen: SocketAddr, target: SocketAddr) -> io::Result<Self> {
-        let listener = TcpListener::bind(listen).await?;
+        let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).await?;
         let listen_addr = listener.local_addr()?;
 
         let (mode_tx, mode_rx) = watch::channel(FaultMode::Pass);
         let (shutdown_tx, shutdown_rx) = watch::channel(false);
 
-        let traffic = Arc::new(ProxyTraffic::default());
-        let accept_task = tokio::spawn(accept_loop(listener, target, mode_rx, shutdown_rx, traffic.clone()));
+        let accept_task = tokio::spawn(accept_loop(listener, target, mode_rx, shutdown_rx));
 
         Ok(Self {
             listen_addr,
@@ -144,20 +128,9 @@ impl FaultProxy {
             mode_tx,
             shutdown_tx,
             accept_task,
-            traffic,
         })
     }
 
-    /// Bytes actually forwarded in either direction, excluding dropped traffic.
-    pub fn forwarded_bytes(&self) -> usize {
-        self.traffic.forwarded_bytes.load(Ordering::Relaxed)
-    }
-
-    /// Bytes actually discarded by a blackhole or one-way partition.
-    pub fn dropped_bytes(&self) -> usize {
-        self.traffic.dropped_bytes.load(Ordering::Relaxed)
-    }
-
     /// Local address the proxy is listening on. Point clients here instead of
     /// the real target to route their traffic through the proxy.
     pub fn local_addr(&self) -> SocketAddr {
@@ -198,7 +171,6 @@ async fn accept_loop(
     target: SocketAddr,
     mode_rx: watch::Receiver<FaultMode>,
     mut shutdown_rx: watch::Receiver<bool>,
-    traffic: Arc<ProxyTraffic>,
 ) {
     loop {
         tokio::select! {
@@ -216,7 +188,6 @@ async fn accept_loop(
                             target,
                             mode_rx.clone(),
                             shutdown_rx.clone(),
-                            traffic.clone(),
                         ));
                     }
                     // A transient accept error should not tear the proxy down.
@@ -234,7 +205,6 @@ async fn handle_connection(
     target: SocketAddr,
     mode_rx: watch::Receiver<FaultMode>,
     shutdown_rx: watch::Receiver<bool>,
-    traffic: Arc<ProxyTraffic>,
 ) {
     let server = match TcpStream::connect(target).await {
         Ok(s) => s,
@@ -251,9 +221,8 @@ async fn handle_connection(
         server_wr,
         mode_rx.clone(),
         shutdown_rx.clone(),
-        traffic.clone(),
     ));
-    let down = tokio::spawn(pump(Direction::ServerToClient, server_rd, client_wr, mode_rx, shutdown_rx, traffic));
+    let down = tokio::spawn(pump(Direction::ServerToClient, server_rd, client_wr, mode_rx, shutdown_rx));
 
     let _ = up.await;
     let _ = down.await;
@@ -268,7 +237,6 @@ async fn pump<R, W>(
     mut to: W,
     mut mode_rx: watch::Receiver<FaultMode>,
     mut shutdown_rx: watch::Receiver<bool>,
-    traffic: Arc<ProxyTraffic>,
 ) where
     R: AsyncReadExt + Unpin,
     W: AsyncWriteExt + Unpin,
@@ -289,22 +257,15 @@ async fn pump<R, W>(
         let mode = *mode_rx.borrow_and_update();
         match mode {
             // Whole connection is a black hole: drain and drop.
-            FaultMode::Blackhole => {
-                traffic.dropped_bytes.fetch_add(n, Ordering::Relaxed);
-                continue;
-            }
+            FaultMode::Blackhole => continue,
             // This direction is partitioned off: drop its bytes; the peer keeps
             // reading nothing while the other direction may still flow.
-            FaultMode::Partition(blocked) if blocked == dir => {
-                traffic.dropped_bytes.fetch_add(n, Ordering::Relaxed);
-                continue;
-            }
+            FaultMode::Partition(blocked) if blocked == dir => continue,
             FaultMode::Latency(delay) => {
                 tokio::time::sleep(delay).await;
                 if to.write_all(&buf[..n]).await.is_err() {
                     break;
                 }
-                traffic.forwarded_bytes.fetch_add(n, Ordering::Relaxed);
                 if to.flush().await.is_err() {
                     break;
                 }
@@ -313,7 +274,6 @@ async fn pump<R, W>(
                 if to.write_all(&buf[..n]).await.is_err() {
                     break;
                 }
-                traffic.forwarded_bytes.fetch_add(n, Ordering::Relaxed);
                 if to.flush().await.is_err() {
                     break;
                 }
@@ -325,6 +285,7 @@ async fn pump<R, W>(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::sync::Arc;
     use std::time::Instant;
     use tokio::sync::Mutex;
 
@@ -414,8 +375,6 @@ mod tests {
 
         assert_eq!(got, payload, "pass mode must forward bytes unchanged");
         assert_eq!(echo.received().await, payload, "server must have received the bytes");
-        assert_eq!(proxy.forwarded_bytes(), payload.len() * 2);
-        assert_eq!(proxy.dropped_bytes(), 0);
 
         proxy.shutdown().await;
     }
@@ -455,8 +414,6 @@ mod tests {
 
         assert!(got.is_empty(), "blackhole mode must not return any bytes, got {got:?}");
         assert!(echo.received().await.is_empty(), "blackhole must not forward to the server");
-        assert_eq!(proxy.forwarded_bytes(), 0);
-        assert_eq!(proxy.dropped_bytes(), b"into-the-void".len());
 
         // Proxy is still alive and steerable after a blackholed connection.
         proxy.set_mode(FaultMode::Pass);

crates/e2e_test/src/list_objects_v2_pagination_test.rs

@@ -30,7 +30,6 @@ mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::Client;
     use aws_sdk_s3::primitives::ByteStream;
-    use futures::{StreamExt, stream};
     use std::collections::HashSet;
     use std::future::Future;
     use std::time::Duration;
@@ -562,23 +561,17 @@ mod tests {
         create_bucket(&client, bucket).await.expect("Failed to create bucket");
 
         let object_count = 1002;
-        // Finish every durable PUT before listing, with the same bounded fanout as the delimiter fixtures.
-        stream::iter(0..object_count)
-            .for_each_concurrent(16, |i| {
-                let client = &client;
-                async move {
-                    let key = format!("object{i:04}.txt");
-                    client
-                        .put_object()
-                        .bucket(bucket)
-                        .key(&key)
-                        .body(ByteStream::from_static(b"test content"))
-                        .send()
-                        .await
-                        .unwrap_or_else(|err| panic!("Failed to put fixture object {key}: {err}"));
-                }
-            })
-            .await;
+        for i in 0..object_count {
+            let key = format!("object{:04}.txt", i);
+            client
+                .put_object()
+                .bucket(bucket)
+                .key(&key)
+                .body(ByteStream::from_static(b"test content"))
+                .send()
+                .await
+                .expect("Failed to put object");
+        }
 
         eprintln!("Seeded {object_count} objects in {bucket}; starting ListObjectsV2 pagination");
         let deadline = Instant::now() + PAGINATION_TIMEOUT;
@@ -817,25 +810,23 @@ mod tests {
 
         create_bucket(&client, bucket).await.expect("Failed to create bucket");
 
-        // Keep every fixture key while overlapping durable PUTs within a bounded fanout.
-        let all_keys: Vec<String> = (0..100)
-            .flat_map(|dir| (0..10).map(move |file| format!("dir-{dir:03}/file{file:02}.txt")))
-            .collect();
-        stream::iter(&all_keys)
-            .for_each_concurrent(16, |key| {
-                let client = &client;
-                async move {
-                    client
-                        .put_object()
-                        .bucket(bucket)
-                        .key(key)
-                        .body(ByteStream::from_static(b"x"))
-                        .send()
-                        .await
-                        .unwrap_or_else(|err| panic!("Failed to put fixture object {key}: {err}"));
-                }
-            })
-            .await;
+        // Create 1000 objects: 100 directories with 10 files each
+        let mut all_keys = Vec::new();
+        let dirs: Vec<String> = (0..100).map(|i| format!("dir-{:03}/", i)).collect();
+        for dir in &dirs {
+            for i in 0..10 {
+                let key = format!("{dir}file{:02}.txt", i);
+                client
+                    .put_object()
+                    .bucket(bucket)
+                    .key(&key)
+                    .body(ByteStream::from_static(b"x"))
+                    .send()
+                    .await
+                    .expect("Failed to put object");
+                all_keys.push(key);
+            }
+        }
 
         eprintln!("Seeded {} objects in {bucket}; starting ListObjectsV2 pagination", all_keys.len());
         let deadline = Instant::now() + PAGINATION_TIMEOUT;
@@ -1038,6 +1029,8 @@ mod tests {
     /// tests the non-delimiter case.
     #[tokio::test]
     async fn test_list_objects_v2_maxkeys_above_limit_with_delimiter() {
+        use futures::{StreamExt, stream};
+
         init_logging();
         info!("Starting test: ListObjectsV2 MaxKeys above limit with delimiter");
 
@@ -1049,13 +1042,19 @@ mod tests {
 
         create_bucket(&client, bucket).await.expect("Failed to create bucket");
 
-        // Keep all 1200 raw keys while bounding upload concurrency so fixture setup
-        // leaves the test's timeout budget available for the listing regression.
+        // 12 dirs × 100 files = 1200 raw keys
         let dir_count = 12;
         let files_per_dir = 100;
+        const FIXTURE_CONCURRENCY: usize = 8;
         let fixture_started = std::time::Instant::now();
+        eprintln!(
+            "Preparing {} objects with at most {FIXTURE_CONCURRENCY} concurrent PUTs",
+            dir_count * files_per_dir
+        );
+        // Object creation order is irrelevant to this listing contract. Bound
+        // fixture I/O and await every PUT before issuing the LIST request.
         stream::iter((0..dir_count).flat_map(|d| (0..files_per_dir).map(move |f| (d, f))))
-            .for_each_concurrent(16, |(d, f)| {
+            .for_each_concurrent(FIXTURE_CONCURRENCY, |(d, f)| {
                 let client = &client;
                 async move {
                     let key = format!("dir-{d:02}/file{f:03}.txt");
@@ -1066,26 +1065,19 @@ mod tests {
                         .body(ByteStream::from_static(b"x"))
                         .send()
                         .await
-                        .unwrap_or_else(|err| panic!("Failed to put fixture object {key}: {err}"));
+                        .unwrap_or_else(|err| panic!("Failed to prepare fixture object {key}: {err:?}"));
                 }
             })
             .await;
-        info!(
-            event = "pagination_fixture_ready",
-            component = "e2e_test",
-            subsystem = "list_objects_v2",
-            object_count = dir_count * files_per_dir,
-            elapsed_ms = fixture_started.elapsed().as_millis(),
-            "Pagination fixture ready"
-        );
-
         eprintln!(
-            "Seeded {} objects in {bucket}; starting ListObjectsV2 pagination",
-            dir_count * files_per_dir
+            "Seeded {} objects in {bucket} in {:?}; starting ListObjectsV2 pagination",
+            dir_count * files_per_dir,
+            fixture_started.elapsed()
         );
         let deadline = Instant::now() + PAGINATION_TIMEOUT;
 
         // With delimiter: 12 CommonPrefixes visible, all fit within capped 1000
+        let list_started = std::time::Instant::now();
         let output =
             listing_request_before(deadline, client.list_objects_v2().bucket(bucket).delimiter("/").max_keys(2000).send())
                 .await
@@ -1109,10 +1101,6 @@ mod tests {
         assert!(output.contents().is_empty(), "all fixture objects must collapse into prefixes");
         assert_eq!(output.key_count(), Some(i32::try_from(dir_count).expect("fixture count fits i32")));
         assert_eq!(output.max_keys(), Some(1000));
-        assert!(
-            output.next_continuation_token().is_none(),
-            "a complete listing must not return a continuation token"
-        );
         // 12 visible < 1000 capped MaxKeys → not truncated
         assert!(
             !output.is_truncated().unwrap_or(false),
@@ -1120,6 +1108,11 @@ mod tests {
             output.common_prefixes().len()
         );
 
+        assert!(
+            output.next_continuation_token().is_none(),
+            "a complete page must not carry a continuation token"
+        );
+        eprintln!("ListObjectsV2 assertions completed in {:?}", list_started.elapsed());
         info!("MaxKeys above limit with delimiter test passed");
 
         env.stop_server();

crates/e2e_test/src/multipart_storage_class_test.rs

@@ -65,130 +65,6 @@ mod tests {
         Ok(())
     }
 
-    #[tokio::test]
-    async fn list_parts_sdk_paginator_terminates_and_preserves_completion() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
-    {
-        init_logging();
-        let mut env = RustFSTestEnvironment::new().await?;
-        env.start_rustfs_server(Vec::new()).await?;
-        let client = env.create_s3_client();
-        let bucket = "multipart-pagination";
-        let key = "sparse-parts.bin";
-        env.create_test_bucket(bucket).await?;
-        let upload = client.create_multipart_upload().bucket(bucket).key(key).send().await?;
-        let upload_id = upload.upload_id().ok_or("CreateMultipartUpload returned no upload ID")?;
-
-        let mut empty_pages = client
-            .list_parts()
-            .bucket(bucket)
-            .key(key)
-            .upload_id(upload_id)
-            .into_paginator()
-            .stop_on_duplicate_token(false)
-            .send();
-        let empty = tokio::time::timeout(std::time::Duration::from_secs(30), empty_pages.next())
-            .await?
-            .ok_or("empty upload must return one page")??;
-        assert!(empty.parts().is_empty());
-        assert_eq!(empty.is_truncated(), Some(false));
-        assert_eq!(empty.next_part_number_marker(), None);
-        assert!(
-            tokio::time::timeout(std::time::Duration::from_secs(30), empty_pages.next())
-                .await?
-                .is_none()
-        );
-
-        let mut expected_body = Vec::new();
-        let mut completed_parts = Vec::new();
-        for (part_number, body) in [(1, vec![b'a'; PART_SIZE]), (3, vec![b'b'; PART_SIZE]), (10, b"tail".to_vec())] {
-            expected_body.extend_from_slice(&body);
-            let uploaded = client
-                .upload_part()
-                .bucket(bucket)
-                .key(key)
-                .upload_id(upload_id)
-                .part_number(part_number)
-                .body(ByteStream::from(body))
-                .send()
-                .await?;
-            completed_parts.push(
-                CompletedPart::builder()
-                    .part_number(part_number)
-                    .set_e_tag(uploaded.e_tag().map(str::to_owned))
-                    .build(),
-            );
-        }
-
-        for (page_size, expected_pages) in [(1, 3), (2, 2), (3, 1), (1000, 1)] {
-            let mut pages = client
-                .list_parts()
-                .bucket(bucket)
-                .key(key)
-                .upload_id(upload_id)
-                .into_paginator()
-                .page_size(page_size)
-                // The server must terminate pagination even without the SDK's duplicate-token safeguard.
-                .stop_on_duplicate_token(false)
-                .send();
-            let mut page_count = 0;
-            let mut listed_parts = Vec::new();
-            while let Some(page) = tokio::time::timeout(std::time::Duration::from_secs(30), pages.next()).await? {
-                assert!(page_count < expected_pages, "paginator must terminate after the final page");
-                let page = page?;
-                page_count += 1;
-                let truncated = page_count < expected_pages;
-                assert_eq!(page.is_truncated(), Some(truncated));
-                let last_part = page.parts().last().and_then(|part| part.part_number());
-                let expected_marker = truncated.then(|| last_part.expect("truncated page must contain parts").to_string());
-                assert_eq!(page.next_part_number_marker(), expected_marker.as_deref());
-                listed_parts.extend(
-                    page.parts()
-                        .iter()
-                        .map(|part| part.part_number().expect("part number must be present")),
-                );
-            }
-            assert_eq!(page_count, expected_pages);
-            assert_eq!(listed_parts, [1, 3, 10]);
-        }
-
-        let mut resumed_pages = client
-            .list_parts()
-            .bucket(bucket)
-            .key(key)
-            .upload_id(upload_id)
-            .part_number_marker("2")
-            .into_paginator()
-            .page_size(1)
-            .stop_on_duplicate_token(false)
-            .send();
-        for (part_number, next_marker) in [(3, Some("3")), (10, None)] {
-            let page = tokio::time::timeout(std::time::Duration::from_secs(30), resumed_pages.next())
-                .await?
-                .ok_or("parts above a missing marker must still be listed")??;
-            assert_eq!(page.parts().len(), 1);
-            assert_eq!(page.parts()[0].part_number(), Some(part_number));
-            assert_eq!(page.is_truncated(), Some(next_marker.is_some()));
-            assert_eq!(page.next_part_number_marker(), next_marker);
-        }
-        assert!(
-            tokio::time::timeout(std::time::Duration::from_secs(30), resumed_pages.next())
-                .await?
-                .is_none()
-        );
-
-        client
-            .complete_multipart_upload()
-            .bucket(bucket)
-            .key(key)
-            .upload_id(upload_id)
-            .multipart_upload(CompletedMultipartUpload::builder().set_parts(Some(completed_parts)).build())
-            .send()
-            .await?;
-        assert_completed_object(&client, bucket, key, "STANDARD", &expected_body).await?;
-        env.stop_server();
-        Ok(())
-    }
-
     #[tokio::test]
     async fn multipart_upload_preserves_standard_and_rrs_across_retry_and_resume()
     -> Result<(), Box<dyn std::error::Error + Send + Sync>> {

crates/e2e_test/src/namespace_lock_quorum_test.rs

@@ -300,28 +300,17 @@ async fn test_degraded_cluster_read_quorum_follows_erasure_layout() -> TestResul
         }
 
         cluster.stop_node(read_quorum - 1)?;
-        let lock_read_quorum = node_count - node_count / 2;
-        // EC:2 on six nodes still has three shared lock votes after losing
-        // its fourth data shard. Preserve the distinct data-quorum error.
-        let expected_code = if read_quorum - 1 < lock_read_quorum {
-            "ServiceUnavailable"
-        } else {
-            "SlowDownRead"
-        };
         for client in clients.iter().take(read_quorum - 1) {
             match client.get_object().bucket(&bucket).key("below-quorum").send().await {
                 Ok(response) => assert!(
                     response.body.collect().await.is_err(),
                     "fewer than {read_quorum} valid fragments must not reconstruct an uncached object"
                 ),
-                Err(error) => {
-                    assert_eq!(error.raw_response().map(|response| response.status().as_u16()), Some(503));
-                    assert_eq!(
-                        error.as_service_error().and_then(|error| error.meta().code()),
-                        Some(expected_code),
-                        "a quorum loss must not be mistaken for a missing object"
-                    );
-                }
+                Err(error) => assert_eq!(
+                    error.as_service_error().and_then(|error| error.meta().code()),
+                    Some("ServiceUnavailable"),
+                    "a quorum loss must not be mistaken for a missing object"
+                ),
             }
         }
 
@@ -436,60 +425,6 @@ async fn test_concurrent_cluster_overwrites_do_not_fail_namespace_lock_quorum()
     Ok(())
 }
 
-fn unavailable_readiness_drive_indices(payload: &serde_json::Value) -> Vec<usize> {
-    let mut indices = payload["details"]["storage"]["unavailableDrives"]
-        .as_array()
-        .expect("node readiness must report unavailable drives")
-        .iter()
-        .map(|drive| {
-            usize::try_from(drive["diskIndex"].as_u64().expect("drive index must be unsigned"))
-                .expect("drive index must fit usize")
-        })
-        .collect::<Vec<_>>();
-    indices.sort_unstable();
-    indices
-}
-
-fn assert_node_readiness_contract(payload: &serde_json::Value, survivors: usize) {
-    let read_ready = survivors >= 2;
-    let write_ready = survivors >= 3;
-    let storage = &payload["details"]["storage"];
-    assert_eq!(payload["ready"], read_ready);
-    assert_eq!(storage["ready"], read_ready);
-    assert_eq!(storage["readQuorum"], read_ready);
-    assert_eq!(storage["writeQuorum"], write_ready);
-    assert_eq!(storage["readinessScope"], "read_quorum");
-    assert_eq!(storage["source"], "local_runtime");
-    assert_eq!(storage["status"], if read_ready { "connected" } else { "disconnected" });
-    assert_eq!(payload["details"]["poolMetadata"]["ready"], true);
-    assert_eq!(payload["details"]["iam"]["ready"], true);
-    assert_eq!(payload["details"]["lock"]["ready"], read_ready);
-    assert_eq!(unavailable_readiness_drive_indices(payload), (survivors..4).collect::<Vec<_>>());
-    for drive in storage["unavailableDrives"].as_array().expect("unavailable drives") {
-        assert_eq!(drive["poolIndex"], 0);
-        assert_eq!(drive["setIndex"], 0);
-        let state = drive["runtimeState"].as_str().expect("runtime state must be reported");
-        let host_online = drive["hostOnline"].as_bool().expect("host reachability must be reported");
-        assert!(
-            matches!(state, "online" | "suspect" | "offline" | "returning"),
-            "unknown runtime state: {state}"
-        );
-        assert!(
-            state != "online" || !host_online,
-            "a reachable online drive cannot be excluded from quorum"
-        );
-    }
-    if !read_ready {
-        assert!(
-            payload["degradedReasons"]
-                .as_array()
-                .expect("degraded reasons")
-                .iter()
-                .any(|reason| reason == "storage_and_lock_unavailable")
-        );
-    }
-}
-
 async fn assert_node_readiness_tracks_quorum(cluster: &mut RustFSTestClusterEnvironment) -> TestResult {
     let clients: Vec<_> = cluster
         .create_all_clients()?
@@ -548,14 +483,27 @@ async fn assert_node_readiness_tracks_quorum(cluster: &mut RustFSTestClusterEnvi
                     && payload["details"]["poolMetadata"]["ready"] == true
                     && payload["details"]["iam"]["ready"] == true
                     && payload["details"]["lock"]["ready"] == read_quorum
-                    && unavailable_readiness_drive_indices(&payload) == (survivors..4).collect::<Vec<_>>()
                 {
                     break payload;
                 }
                 assert!(Instant::now() < deadline, "node {idx}, survivors={survivors}: HTTP {status}, {payload}");
                 tokio::time::sleep(Duration::from_millis(200)).await;
             };
-            assert_node_readiness_contract(&payload, survivors);
+            assert_eq!(payload["details"]["storage"]["readinessScope"], "read_quorum");
+            assert_eq!(payload["details"]["storage"]["source"], "local_runtime");
+            assert_eq!(
+                payload["details"]["storage"]["status"],
+                if node_ready { "connected" } else { "disconnected" }
+            );
+            if !node_ready {
+                assert!(
+                    payload["degradedReasons"]
+                        .as_array()
+                        .expect("degraded reasons")
+                        .iter()
+                        .any(|reason| reason == "storage_and_lock_unavailable")
+                );
+            }
 
             for path in ["/health/ready", "/minio/health/ready"] {
                 let head = http.head(format!("{url}{path}")).send().await?;
@@ -564,9 +512,7 @@ async fn assert_node_readiness_tracks_quorum(cluster: &mut RustFSTestClusterEnvi
                 let response = http.get(format!("{url}{path}")).send().await?;
                 assert_eq!(response.status().as_u16(), node_status);
                 let body: serde_json::Value = response.json().await?;
-                // Each response samples live diagnostics; suspect -> offline
-                // must not change the quorum contract or excluded topology.
-                assert_node_readiness_contract(&body, survivors);
+                assert_eq!(body["details"]["storage"], payload["details"]["storage"]);
                 assert_eq!(body["details"]["poolMetadata"], payload["details"]["poolMetadata"]);
             }
             let live = http.get(format!("{url}/health/live")).send().await?;

crates/e2e_test/src/protocols/test_runner.rs

@@ -21,7 +21,7 @@ use crate::protocols::sftp_compliance::{
     test_sftp_compliance_readonly, test_sftp_compliance_standalone, test_sftp_compliance_suite,
 };
 use crate::protocols::sftp_core::{test_sftp_core_operations, test_sftp_idle_timeout_disconnects};
-use crate::protocols::webdav_core::{test_webdav_core_operations, test_webdav_quota_reporting};
+use crate::protocols::webdav_core::test_webdav_core_operations;
 use std::time::Instant;
 use tokio::time::{Duration, sleep};
 use tracing::{error, info};
@@ -99,10 +99,6 @@ impl ProtocolTestSuite {
                     info!("=== Starting WebDAV Core Test ===");
                     "WebDAV core operations (MKCOL, PUT, GET, DELETE, PROPFIND)"
                 }
-                "test_webdav_quota_reporting" => {
-                    info!("=== Starting WebDAV Quota Reporting Test ===");
-                    "WebDAV quota reporting (PROPFIND quota properties: bucket-quota sum and physical-capacity fallback)"
-                }
                 "test_sftp_core_operations" => {
                     info!("=== Starting SFTP Core Test ===");
                     "SFTP core operations (banner, mkdir, put, get with SHA compare, rename, delete, rmdir)"
@@ -162,7 +158,6 @@ impl ProtocolTestSuite {
         match test_def.name {
             "test_ftps_core_operations" => test_ftps_core_operations().await.map_err(|e| e.into()),
             "test_webdav_core_operations" => test_webdav_core_operations().await.map_err(|e| e.into()),
-            "test_webdav_quota_reporting" => test_webdav_quota_reporting().await.map_err(|e| e.into()),
             "test_sftp_core_operations" => test_sftp_core_operations().await.map_err(|e| e.into()),
             "test_sftp_compliance_suite" => test_sftp_compliance_suite().await.map_err(|e| e.into()),
             "test_sftp_compliance_readonly" => test_sftp_compliance_readonly().await.map_err(|e| e.into()),
@@ -208,10 +203,6 @@ fn all_protocol_tests() -> Vec<TestDefinition> {
             name: "test_webdav_core_operations",
             required_feature: "webdav",
         },
-        TestDefinition {
-            name: "test_webdav_quota_reporting",
-            required_feature: "webdav",
-        },
         TestDefinition {
             name: "test_sftp_core_operations",
             required_feature: "sftp",
@@ -262,10 +253,9 @@ mod tests {
     fn schedules_all_protocol_tests_without_feature_filter() {
         let names = scheduled_names(ProtocolTestSuite::with_requested_features(None));
 
-        assert_eq!(names.len(), 8);
+        assert_eq!(names.len(), 7);
         assert!(names.contains(&"test_ftps_core_operations"));
         assert!(names.contains(&"test_webdav_core_operations"));
-        assert!(names.contains(&"test_webdav_quota_reporting"));
         assert!(names.contains(&"test_sftp_core_operations"));
         assert!(names.contains(&"test_sftp_compliance_standalone"));
     }
@@ -274,14 +264,7 @@ mod tests {
     fn schedules_only_requested_non_sftp_protocols() {
         let names = scheduled_names(ProtocolTestSuite::with_requested_features(Some("ftps, webdav")));
 
-        assert_eq!(
-            names,
-            vec![
-                "test_ftps_core_operations",
-                "test_webdav_core_operations",
-                "test_webdav_quota_reporting"
-            ]
-        );
+        assert_eq!(names, vec!["test_ftps_core_operations", "test_webdav_core_operations"]);
     }
 
     #[test]
@@ -312,10 +295,9 @@ mod tests {
     fn full_feature_schedules_all_protocol_tests() {
         let names = scheduled_names(ProtocolTestSuite::with_requested_features(Some("full")));
 
-        assert_eq!(names.len(), 8);
+        assert_eq!(names.len(), 7);
         assert!(names.contains(&"test_ftps_core_operations"));
         assert!(names.contains(&"test_webdav_core_operations"));
-        assert!(names.contains(&"test_webdav_quota_reporting"));
         assert!(names.contains(&"test_sftp_core_operations"));
         assert!(names.contains(&"test_sftp_compliance_standalone"));
     }

crates/e2e_test/src/protocols/webdav_core.rs

@@ -33,14 +33,10 @@
 
 use crate::common::rustfs_binary_path_with_features;
 use crate::common::{AdminTransport, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via};
-use crate::common::{FAST_DATA_USAGE_SCANNER_ENV, admin_request};
 use crate::protocols::test_env::{DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY, ProtocolTestEnvironment};
 use anyhow::Result;
-use http::Method;
 use reqwest::Client;
-use std::time::{Duration, Instant};
 use tokio::process::Command;
-use tokio::time::sleep;
 use tracing::info;
 
 // Fixed WebDAV port for testing
@@ -773,261 +769,3 @@ pub async fn test_webdav_core_operations() -> Result<()> {
 async fn test_webdav_core_operations_direct() -> Result<()> {
     test_webdav_core_operations().await
 }
-
-/// Extract the numeric value of the first occurrence of a DAV property in a
-/// PROPFIND multistatus body. Namespace-prefix agnostic; a self-closing
-/// (unreported) property yields None.
-fn quota_prop_value(body: &str, prop: &str) -> Option<u64> {
-    let prop_start = body.find(prop)?;
-    let after_name = &body[prop_start + prop.len()..];
-    let value_start = after_name.find('>')? + 1;
-    let value_end = after_name[value_start..].find('<')? + value_start;
-    after_name[value_start..value_end].trim().parse().ok()
-}
-
-/// PROPFIND `/` at Depth 0 requesting the two quota properties, returning
-/// (quota-available-bytes, quota-used-bytes).
-async fn propfind_root_quota(client: &Client, base_url: &str, auth_header: &str) -> Result<(u64, u64)> {
-    let body = r#"<?xml version="1.0" encoding="utf-8"?>
-<D:propfind xmlns:D="DAV:"><D:prop><D:quota-available-bytes/><D:quota-used-bytes/></D:prop></D:propfind>"#;
-    let resp = client
-        .request(
-            reqwest::Method::from_bytes(b"PROPFIND").expect("PROPFIND is a valid HTTP method"),
-            base_url,
-        )
-        .header("Authorization", auth_header)
-        .header("Depth", "0")
-        .header("Content-Type", "application/xml")
-        .body(body)
-        .send()
-        .await?;
-    let status = resp.status();
-    let text = resp.text().await?;
-    anyhow::ensure!(status.as_u16() == 207, "PROPFIND / should return 207, got: {status} body: {text}");
-    let available = quota_prop_value(&text, "quota-available-bytes")
-        .ok_or_else(|| anyhow::anyhow!("quota-available-bytes missing from PROPFIND response: {text}"))?;
-    let used = quota_prop_value(&text, "quota-used-bytes")
-        .ok_or_else(|| anyhow::anyhow!("quota-used-bytes missing from PROPFIND response: {text}"))?;
-    Ok((available, used))
-}
-
-/// Set a HARD bucket quota, retrying while the admin API reports the quota
-/// subsystem as not yet ready (503), mirroring quota_test.rs readiness.
-async fn set_bucket_quota_with_retry(admin_base_url: &str, bucket: &str, quota_bytes: u64) -> Result<()> {
-    let quota_path = format!("/rustfs/admin/v3/quota/{bucket}");
-    let quota_config = serde_json::json!({
-        "quota": quota_bytes,
-        "quota_type": "HARD"
-    })
-    .to_string();
-    let deadline = Instant::now() + Duration::from_secs(30);
-    loop {
-        let (status, response) = admin_request(
-            admin_base_url,
-            Method::PUT,
-            &quota_path,
-            Some(quota_config.clone()),
-            DEFAULT_ACCESS_KEY,
-            DEFAULT_SECRET_KEY,
-        )
-        .await
-        .map_err(|e| anyhow::anyhow!("{e}"))?;
-        if status.is_success() {
-            return Ok(());
-        }
-        if status != http::StatusCode::SERVICE_UNAVAILABLE {
-            anyhow::bail!("failed to set quota for {bucket}: {status} {response}");
-        }
-        if Instant::now() >= deadline {
-            anyhow::bail!("quota readiness did not converge for {bucket} within 30 seconds");
-        }
-        sleep(Duration::from_secs(1)).await;
-    }
-}
-
-/// Test WebDAV: PROPFIND quota properties (quota-available-bytes /
-/// quota-used-bytes).
-///
-/// dav-server queries quota once per PROPFIND without a path argument, so the
-/// reported pair is session-scoped:
-///
-/// - Phase A: a visible bucket without quota (or no buckets at all) falls back
-///   to the cluster's usable physical capacity, the console dashboard numbers.
-/// - Phase B: once every visible bucket carries a HARD quota, the pair is the
-///   summed cached bucket usage against the summed quota limits.
-pub async fn test_webdav_quota_reporting() -> Result<()> {
-    // Dedicated ports: the core WebDAV test owns 9010/9080.
-    const QUOTA_S3_ADDRESS: &str = "127.0.0.1:9011";
-    const QUOTA_WEBDAV_PORT: u16 = 9081;
-    const QUOTA_WEBDAV_ADDRESS: &str = "127.0.0.1:9081";
-    const QUOTA_LIMIT: u64 = 1_073_741_824; // 1 GiB
-    const OBJECT_CONTENT: &[u8] = b"Hello, WebDAV!";
-
-    let env = ProtocolTestEnvironment::new().map_err(|e| anyhow::anyhow!("{}", e))?;
-    let admin_base_url = format!("http://{QUOTA_S3_ADDRESS}");
-
-    info!("Starting WebDAV server on {}", QUOTA_WEBDAV_ADDRESS);
-    let binary_path = rustfs_binary_path_with_features(Some("webdav"));
-    let mut server_command = Command::new(&binary_path);
-    server_command
-        .arg("--address")
-        .arg(QUOTA_S3_ADDRESS)
-        .env("RUSTFS_CONSOLE_ENABLE", "false")
-        .env("RUSTFS_WEBDAV_ENABLE", "true")
-        .env("RUSTFS_WEBDAV_ADDRESS", QUOTA_WEBDAV_ADDRESS)
-        .env("RUSTFS_WEBDAV_TLS_ENABLED", "false") // No TLS for testing
-        .arg(&env.temp_dir);
-    // Quota-mode reporting reads the data-usage scanner cache; run the scanner
-    // on a fast cycle so the uploaded object converges quickly.
-    for (key, value) in FAST_DATA_USAGE_SCANNER_ENV {
-        server_command.env(key, value);
-    }
-    let mut server_process = server_command.spawn()?;
-
-    // Ensure server is cleaned up even on failure
-    let result = async {
-        ProtocolTestEnvironment::wait_for_port_ready(QUOTA_WEBDAV_PORT, 30)
-            .await
-            .map_err(|e| anyhow::anyhow!("{}", e))?;
-
-        let client = create_client();
-        let auth_header = basic_auth_header();
-        let base_url = format!("http://{QUOTA_WEBDAV_ADDRESS}");
-
-        // Phase A: physical-capacity fallback (a visible bucket has no quota)
-        info!("Testing WebDAV quota: fallback to physical capacity without bucket quotas");
-        let phase_a_bucket = "quota-fallback-probe";
-        let resp = client
-            .request(
-                reqwest::Method::from_bytes(b"MKCOL").expect("MKCOL is a valid HTTP method"),
-                format!("{base_url}/{phase_a_bucket}"),
-            )
-            .header("Authorization", &auth_header)
-            .send()
-            .await?;
-        assert!(
-            resp.status().is_success(),
-            "MKCOL '{phase_a_bucket}' should succeed, got: {}",
-            resp.status()
-        );
-
-        // Storage info may briefly report zero capacity right after startup
-        // (disks still initializing), which omits the quota properties; poll
-        // until they appear.
-        let phase_a_deadline = Instant::now() + Duration::from_secs(30);
-        let (available, _used) = loop {
-            match propfind_root_quota(&client, &base_url, &auth_header).await {
-                Ok(quota) => break quota,
-                Err(e) if Instant::now() < phase_a_deadline => {
-                    info!("quota properties not reported yet, retrying: {e}");
-                    sleep(Duration::from_secs(1)).await;
-                }
-                Err(e) => return Err(e),
-            }
-        };
-        assert!(
-            available > 0,
-            "physical-capacity fallback should report positive quota-available-bytes, got: {available}"
-        );
-        info!("PASS: quota fallback reports physical capacity (available={available})");
-
-        let resp = client
-            .delete(format!("{base_url}/{phase_a_bucket}"))
-            .header("Authorization", &auth_header)
-            .send()
-            .await?;
-        assert!(
-            resp.status().is_success() || resp.status().as_u16() == 204,
-            "DELETE bucket '{phase_a_bucket}' should succeed, got: {}",
-            resp.status()
-        );
-
-        // Phase B: every visible bucket has a HARD quota -> summed usage/quota
-        info!("Testing WebDAV quota: summed bucket quota reporting");
-        let bucket = "quota-probe";
-        let object = "hello.txt";
-        let resp = client
-            .request(
-                reqwest::Method::from_bytes(b"MKCOL").expect("MKCOL is a valid HTTP method"),
-                format!("{base_url}/{bucket}"),
-            )
-            .header("Authorization", &auth_header)
-            .send()
-            .await?;
-        assert!(resp.status().is_success(), "MKCOL '{bucket}' should succeed, got: {}", resp.status());
-
-        let resp = client
-            .put(format!("{base_url}/{bucket}/{object}"))
-            .header("Authorization", &auth_header)
-            .body(OBJECT_CONTENT)
-            .send()
-            .await?;
-        assert!(
-            resp.status().is_success() || resp.status().as_u16() == 201,
-            "PUT '{bucket}/{object}' should succeed, got: {}",
-            resp.status()
-        );
-
-        set_bucket_quota_with_retry(&admin_base_url, bucket, QUOTA_LIMIT).await?;
-
-        // The usage cache trails the scanner; poll PROPFIND until the uploaded
-        // object is reflected (before convergence the missing usage counts as 0).
-        let expected_used = OBJECT_CONTENT.len() as u64;
-        let deadline = Instant::now() + Duration::from_secs(60);
-        let (available, used) = loop {
-            let (available, used) = propfind_root_quota(&client, &base_url, &auth_header).await?;
-            if used == expected_used {
-                break (available, used);
-            }
-            if Instant::now() >= deadline {
-                anyhow::bail!(
-                    "quota-used-bytes did not converge to {expected_used} within 60 seconds (last: used={used} available={available})"
-                );
-            }
-            sleep(Duration::from_secs(2)).await;
-        };
-        assert_eq!(
-            available,
-            QUOTA_LIMIT - expected_used,
-            "quota-available-bytes should be the remaining quota"
-        );
-        info!("PASS: summed quota reporting converged (used={used}, available={available})");
-
-        // Cleanup
-        let resp = client
-            .delete(format!("{base_url}/{bucket}/{object}"))
-            .header("Authorization", &auth_header)
-            .send()
-            .await?;
-        assert!(
-            resp.status().is_success() || resp.status().as_u16() == 204,
-            "DELETE '{bucket}/{object}' should succeed, got: {}",
-            resp.status()
-        );
-        let resp = client
-            .delete(format!("{base_url}/{bucket}"))
-            .header("Authorization", &auth_header)
-            .send()
-            .await?;
-        assert!(
-            resp.status().is_success() || resp.status().as_u16() == 204,
-            "DELETE bucket '{bucket}' should succeed, got: {}",
-            resp.status()
-        );
-
-        info!("WebDAV quota reporting tests passed");
-        Ok(())
-    }
-    .await;
-
-    // Always cleanup server process
-    let _ = server_process.kill().await;
-    let _ = server_process.wait().await;
-
-    result
-}
-
-#[tokio::test]
-async fn test_webdav_quota_reporting_direct() -> Result<()> {
-    test_webdav_quota_reporting().await
-}

crates/e2e_test/src/storage_api.rs

@@ -15,7 +15,7 @@
 #[cfg(test)]
 pub(crate) use rustfs_ecstore::api::bucket::bucket_target_sys::BucketTargetSys;
 #[cfg(test)]
-pub(crate) use rustfs_ecstore::api::disk::{Endpoint, RUSTFS_META_BUCKET, VolumeInfo, WalkDirOptions};
+pub(crate) use rustfs_ecstore::api::disk::{RUSTFS_META_BUCKET, VolumeInfo, WalkDirOptions};
 pub(crate) use rustfs_ecstore::api::rpc::{AuthenticatedChannel, TonicInterceptor, node_service_time_out_client_no_auth};
 #[cfg(test)]
 pub(crate) use rustfs_ecstore::api::rpc::{

crates/e2e_test/src/sts_query_compat_test.rs

@@ -35,7 +35,7 @@ use tokio::time::{Duration, timeout};
 
 type BoxError = Box<dyn Error + Send + Sync>;
 type TestResult = Result<(), BoxError>;
-pub(crate) const OPA_AUTH_TOKEN: &str = "sts-opa-token";
+const OPA_AUTH_TOKEN: &str = "sts-opa-token";
 
 fn sts_client(url: &str, access_key: &str, secret_key: &str, session_token: Option<&str>) -> Client {
     build_test_sts_client(url, access_key, secret_key, session_token, "e2e-sts-query-compat")
@@ -103,25 +103,6 @@ async fn create_user(env: &RustFSTestEnvironment, user: &str, secret: &str) -> T
     Ok(())
 }
 
-pub(crate) async fn set_department(client: &aws_sdk_s3::Client, bucket: &str, department: &str) -> TestResult {
-    client
-        .put_bucket_tagging()
-        .bucket(bucket)
-        .tagging(
-            aws_sdk_s3::types::Tagging::builder()
-                .tag_set(
-                    aws_sdk_s3::types::Tag::builder()
-                        .key("department")
-                        .value(department)
-                        .build()?,
-                )
-                .build()?,
-        )
-        .send()
-        .await?;
-    Ok(())
-}
-
 async fn assert_access_denied(client: &Client, context: &str) -> TestResult {
     let error = client
         .assume_role()
@@ -259,19 +240,15 @@ async fn handle_opa_request(
                 .as_ref()
                 .and_then(|value| value.pointer("/input/action"))
                 .and_then(Value::as_str);
-            let department = payload
+            let bucket = payload
                 .as_ref()
-                .and_then(|value| value.pointer("/input/context/conditions/ExistingBucketTag~1department/0"))
+                .and_then(|value| value.pointer("/input/resource/bucket"))
                 .and_then(Value::as_str);
             matches!(
-                (action, department),
-                (Some("s3:ListBucket"), Some("finance")) | (Some("s3:GetBucketLocation"), Some("legal"))
+                (action, bucket),
+                (Some("s3:ListBucket"), Some("opa-list-visible")) | (Some("s3:GetBucketLocation"), Some("opa-list-location"))
             )
         }
-        Some(Value::String(account)) if account == "opabuckettags" => payload.as_ref().is_some_and(|value| {
-            value["input"]["action"] == "s3:CreateBucket"
-                || value["input"]["context"]["conditions"]["ExistingBucketTag/department"] == serde_json::json!(["finance"])
-        }),
         None => true,
         _ => false,
     };
@@ -293,15 +270,15 @@ enum OpaValidationMode {
     Unavailable,
 }
 
-pub(crate) struct OpaMock {
-    pub(crate) url: String,
+struct OpaMock {
+    url: String,
     requests: mpsc::UnboundedReceiver<Value>,
     validation_started: mpsc::UnboundedReceiver<()>,
     task: JoinHandle<()>,
 }
 
 impl OpaMock {
-    pub(crate) async fn start() -> Result<Self, BoxError> {
+    async fn start() -> Result<Self, BoxError> {
         Self::start_with_mode(OpaValidationMode::Ready, Some(OPA_AUTH_TOKEN)).await
     }
 
@@ -358,16 +335,6 @@ impl OpaMock {
             .ok_or_else(|| "OPA request channel closed".into())
     }
 
-    pub(crate) async fn expect_bucket_tags(&mut self, action: &str, bucket: &str, department: Option<&str>) -> TestResult {
-        let payload = self.next_request().await?;
-        let input = &payload["input"];
-        assert_eq!(input["action"], action);
-        assert_eq!(input["resource"]["bucket"], bucket);
-        let expected = department.map(|value| serde_json::json!([value]));
-        assert_eq!(input["context"]["conditions"].get("ExistingBucketTag/department"), expected.as_ref());
-        Ok(())
-    }
-
     async fn wait_for_validation(&mut self) -> TestResult {
         timeout(Duration::from_secs(5), self.validation_started.recv())
             .await?
@@ -604,13 +571,8 @@ async fn test_list_buckets_opa_contract() -> TestResult {
     .await?;
 
     let admin_client = env.create_s3_client();
-    for (bucket, department) in [
-        ("opa-list-hidden", "engineering"),
-        ("opa-list-location", "legal"),
-        ("opa-list-visible", "finance"),
-    ] {
+    for bucket in ["opa-list-hidden", "opa-list-location", "opa-list-visible"] {
         admin_client.create_bucket().bucket(bucket).send().await?;
-        set_department(&admin_client, bucket, department).await?;
     }
 
     let user = "opalistbuckets";
@@ -678,240 +640,6 @@ async fn test_list_buckets_opa_contract() -> TestResult {
     Ok(())
 }
 
-#[tokio::test]
-async fn test_bucket_tags_opa_contract() -> TestResult {
-    use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::{
-        BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, Tag, Tagging, VersioningConfiguration,
-    };
-
-    init_logging();
-    let mut opa = OpaMock::start().await?;
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server_without_cleanup_with_env(&[
-        ("RUSTFS_POLICY_PLUGIN_URL", opa.url.as_str()),
-        ("RUSTFS_POLICY_PLUGIN_AUTH_TOKEN", OPA_AUTH_TOKEN),
-        ("NO_PROXY", "127.0.0.1,localhost"),
-    ])
-    .await?;
-    let secret = uuid::Uuid::new_v4().to_string();
-    create_user(&env, "opabuckettags", &secret).await?;
-    let client = aws_sdk_s3::Client::from_conf(build_test_s3_config(&env.url, "opabuckettags", &secret, None, "e2e-bucket-tags"));
-    let admin = env.create_s3_client();
-    let source = "opa-tags-source";
-    let destination = "opa-tags-destination";
-
-    client.create_bucket().bucket(source).send().await?;
-    opa.expect_bucket_tags("s3:CreateBucket", source, None).await?;
-    set_department(&admin, source, "finance").await?;
-    admin
-        .put_bucket_versioning()
-        .bucket(source)
-        .versioning_configuration(
-            VersioningConfiguration::builder()
-                .status(BucketVersioningStatus::Enabled)
-                .build(),
-        )
-        .send()
-        .await?;
-    let written = client
-        .put_object()
-        .bucket(source)
-        .key("report")
-        .tagging("department=engineering")
-        .body(ByteStream::from_static(b"report"))
-        .send()
-        .await?;
-    opa.expect_bucket_tags("s3:PutObject", source, Some("finance")).await?;
-    let version = written.version_id().ok_or("versioned PUT must return a version ID")?;
-    let read = client
-        .get_object()
-        .bucket(source)
-        .key("report")
-        .version_id(version)
-        .send()
-        .await?;
-    assert_eq!(read.body.collect().await?.into_bytes().as_ref(), b"report");
-    opa.expect_bucket_tags("s3:GetObjectVersion", source, Some("finance")).await?;
-    client
-        .head_object()
-        .bucket(source)
-        .key("report")
-        .version_id(version)
-        .send()
-        .await?;
-    opa.expect_bucket_tags("s3:GetObjectVersion", source, Some("finance")).await?;
-    client.list_objects_v2().bucket(source).send().await?;
-    opa.expect_bucket_tags("s3:ListBucket", source, Some("finance")).await?;
-    client.list_object_versions().bucket(source).send().await?;
-    opa.expect_bucket_tags("s3:ListBucketVersions", source, Some("finance"))
-        .await?;
-
-    admin.create_bucket().bucket(destination).send().await?;
-    set_department(&admin, destination, "engineering").await?;
-    let copy_source = format!("{source}/report?versionId={version}");
-    let error = client
-        .copy_object()
-        .bucket(destination)
-        .key("copied")
-        .copy_source(&copy_source)
-        .send()
-        .await
-        .expect_err("source tags must not authorize a different destination");
-    assert_eq!(error.as_service_error().and_then(ProvideErrorMetadata::code), Some("AccessDenied"));
-    opa.expect_bucket_tags("s3:GetObjectVersion", source, Some("finance")).await?;
-    opa.expect_bucket_tags("s3:PutObject", destination, Some("engineering"))
-        .await?;
-    set_department(&admin, destination, "finance").await?;
-    client
-        .copy_object()
-        .bucket(destination)
-        .key("copied")
-        .copy_source(&copy_source)
-        .send()
-        .await?;
-    opa.expect_bucket_tags("s3:GetObjectVersion", source, Some("finance")).await?;
-    opa.expect_bucket_tags("s3:PutObject", destination, Some("finance")).await?;
-
-    let upload = client
-        .create_multipart_upload()
-        .bucket(destination)
-        .key("multipart")
-        .send()
-        .await?;
-    opa.expect_bucket_tags("s3:PutObject", destination, Some("finance")).await?;
-    let upload_id = upload.upload_id().ok_or("multipart upload ID")?;
-    client
-        .upload_part()
-        .bucket(destination)
-        .key("multipart")
-        .upload_id(upload_id)
-        .part_number(1)
-        .body(ByteStream::from_static(b"part"))
-        .send()
-        .await?;
-    opa.expect_bucket_tags("s3:PutObject", destination, Some("finance")).await?;
-    let copied_part = client
-        .upload_part_copy()
-        .bucket(destination)
-        .key("multipart")
-        .upload_id(upload_id)
-        .part_number(1)
-        .copy_source(&copy_source)
-        .send()
-        .await?;
-    opa.expect_bucket_tags("s3:GetObjectVersion", source, Some("finance")).await?;
-    opa.expect_bucket_tags("s3:PutObject", destination, Some("finance")).await?;
-    let part = copied_part.copy_part_result().ok_or("copied part result")?;
-    client
-        .complete_multipart_upload()
-        .bucket(destination)
-        .key("multipart")
-        .upload_id(upload_id)
-        .multipart_upload(
-            CompletedMultipartUpload::builder()
-                .parts(
-                    CompletedPart::builder()
-                        .part_number(1)
-                        .e_tag(part.e_tag().ok_or("part ETag")?)
-                        .build(),
-                )
-                .build(),
-        )
-        .send()
-        .await?;
-    opa.expect_bucket_tags("s3:PutObject", destination, Some("finance")).await?;
-    let read = client.get_object().bucket(destination).key("multipart").send().await?;
-    assert_eq!(read.body.collect().await?.into_bytes().as_ref(), b"report");
-    opa.expect_bucket_tags("s3:GetObject", destination, Some("finance")).await?;
-
-    // Mutation authorization uses the old tags, not the proposed replacement.
-    set_department(&client, source, "engineering").await?;
-    opa.expect_bucket_tags("s3:PutBucketTagging", source, Some("finance")).await?;
-    let error = client
-        .list_objects_v2()
-        .bucket(source)
-        .send()
-        .await
-        .expect_err("updated tags revoke access");
-    assert_eq!(error.as_service_error().and_then(ProvideErrorMetadata::code), Some("AccessDenied"));
-    opa.expect_bucket_tags("s3:ListBucket", source, Some("engineering")).await?;
-    let error = client
-        .copy_object()
-        .bucket(destination)
-        .key("denied-source")
-        .copy_source(&copy_source)
-        .send()
-        .await
-        .expect_err("destination tags must not authorize a denied source");
-    assert_eq!(error.as_service_error().and_then(ProvideErrorMetadata::code), Some("AccessDenied"));
-    opa.expect_bucket_tags("s3:GetObjectVersion", source, Some("engineering"))
-        .await?;
-    set_department(&client, source, "finance")
-        .await
-        .expect_err("requested tags must not authorize their own mutation");
-    opa.expect_bucket_tags("s3:PutBucketTagging", source, Some("engineering"))
-        .await?;
-    set_department(&admin, source, "finance").await?;
-    client.delete_bucket_tagging().bucket(source).send().await?;
-    opa.expect_bucket_tags("s3:PutBucketTagging", source, Some("finance")).await?;
-    let error = client
-        .list_objects_v2()
-        .bucket(source)
-        .send()
-        .await
-        .expect_err("untagged bucket is denied by this policy");
-    assert_eq!(error.as_service_error().and_then(ProvideErrorMetadata::code), Some("AccessDenied"));
-    opa.expect_bucket_tags("s3:ListBucket", source, None).await?;
-
-    // Ambiguous stored tags must not turn into an implicit IAM denial that a
-    // separate bucket-policy Allow can override.
-    admin
-        .put_bucket_policy()
-        .bucket(destination)
-        .policy(
-            serde_json::json!({
-                "Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": {"AWS": "*"},
-                    "Action": "s3:GetObject", "Resource": format!("arn:aws:s3:::{destination}/*")}]
-            })
-            .to_string(),
-        )
-        .send()
-        .await?;
-    // A normal OPA denial retains the existing bucket-policy Allow fallback;
-    // a metadata lookup error must abort that same authorization path.
-    set_department(&admin, destination, "engineering").await?;
-    let read = client.get_object().bucket(destination).key("multipart").send().await?;
-    assert_eq!(read.body.collect().await?.into_bytes().as_ref(), b"report");
-    opa.expect_bucket_tags("s3:GetObject", destination, Some("engineering"))
-        .await?;
-    admin
-        .put_bucket_tagging()
-        .bucket(destination)
-        .tagging(
-            Tagging::builder()
-                .tag_set(Tag::builder().key("department").value("finance").build()?)
-                .tag_set(Tag::builder().key("department").value("engineering").build()?)
-                .build()?,
-        )
-        .send()
-        .await?;
-    let error = client
-        .get_object()
-        .bucket(destination)
-        .key("multipart")
-        .send()
-        .await
-        .expect_err("metadata failure must not fall back to a bucket-policy Allow");
-    assert_eq!(error.raw_response().map(|response| response.status().as_u16()), Some(500));
-    assert!(
-        matches!(opa.requests.try_recv(), Err(mpsc::error::TryRecvError::Empty)),
-        "invalid tags must not be sent to OPA as absent"
-    );
-    env.stop_server();
-    Ok(())
-}
-
 #[tokio::test]
 async fn test_sts_and_list_buckets_fail_closed_while_opa_is_initializing() -> TestResult {
     init_logging();

crates/e2e_test/src/tier_transition_regression_test.rs

@@ -165,210 +165,4 @@ mod tests {
         info!("RT-13c PASS: scanner/config persists across restart");
         Ok(())
     }
-
-    /// RT-14: a transition PUT must not carry reserved `x-minio-internal-*` headers.
-    ///
-    /// Regression pattern: transition forwarded the object's internal metadata as raw
-    /// request headers, so MinIO-derived remotes (Storj) refused every transition with
-    /// `400 InvalidArgument` while `tier add` still succeeded (rustfs#8362). The fake
-    /// target refuses any PutObject carrying such a header, like MinIO and Storj do.
-    #[tokio::test]
-    async fn test_transition_put_omits_reserved_internal_headers() -> TestResult {
-        use crate::fake_s3_target::{BucketMode, FAKE_ACCESS_KEY, FAKE_SECRET_KEY, FakeS3Target, Operation};
-        use aws_sdk_s3::primitives::ByteStream;
-        use aws_sdk_s3::types::{
-            BucketLifecycleConfiguration, ExpirationStatus, LifecycleRule, LifecycleRuleFilter, Transition,
-            TransitionStorageClass,
-        };
-        use std::time::{Duration, Instant};
-
-        init_logging();
-        info!("RT-14: transition PUT omits reserved internal headers");
-
-        const TIER: &str = "RT14COLD";
-        const TARGET_BUCKET: &str = "rt14-cold";
-        const SOURCE_BUCKET: &str = "rt14-hot";
-
-        let target = FakeS3Target::start().await.expect("start fake target");
-        target.create_bucket_with_mode(TARGET_BUCKET, BucketMode::Unversioned);
-        target.reject_reserved_internal_headers(true);
-
-        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
-        env.start_rustfs_server_with_env(
-            vec![],
-            &[
-                ("RUSTFS_CONSOLE_ENABLE", "false"),
-                ("RUSTFS_TIER_RUSTFS_ALLOW_LOOPBACK_ENDPOINT", "true"),
-            ],
-        )
-        .await
-        .expect("start RustFS");
-
-        let tier_body = serde_json::json!({
-            "type": "rustfs",
-            "rustfs": {
-                "name": TIER,
-                "endpoint": target.endpoint(),
-                "accessKey": FAKE_ACCESS_KEY,
-                "secretKey": FAKE_SECRET_KEY,
-                "bucket": TARGET_BUCKET,
-                "prefix": "cold/",
-                "region": "us-east-1",
-                "storageClass": ""
-            }
-        })
-        .to_string();
-        let deadline = Instant::now() + Duration::from_secs(30);
-        loop {
-            match admin_ok(&env, http::Method::PUT, "/rustfs/admin/v3/tier", Some(tier_body.clone())).await {
-                Ok(_) => break,
-                Err(err) if Instant::now() < deadline => {
-                    info!("  add tier not ready yet: {err}");
-                    tokio::time::sleep(Duration::from_millis(500)).await;
-                }
-                Err(err) => panic!("RT-14 FAIL: add tier: {err}"),
-            }
-        }
-
-        let client = env.create_s3_client();
-        client
-            .create_bucket()
-            .bucket(SOURCE_BUCKET)
-            .send()
-            .await
-            .expect("create bucket");
-
-        let objects: Vec<(&str, Vec<u8>)> = vec![
-            ("small.bin", (0..1024u32).map(|i| (i % 251) as u8).collect()),
-            ("medium.bin", (0..200_000u32).map(|i| (i.wrapping_mul(31) % 253) as u8).collect()),
-        ];
-        for (key, body) in &objects {
-            client
-                .put_object()
-                .bucket(SOURCE_BUCKET)
-                .key(*key)
-                .body(ByteStream::from(body.clone()))
-                .send()
-                .await
-                .expect("put source object");
-        }
-
-        let rule = LifecycleRule::builder()
-            .id("to-cold")
-            .status(ExpirationStatus::Enabled)
-            .filter(LifecycleRuleFilter::builder().prefix("").build())
-            .transitions(
-                Transition::builder()
-                    .days(0)
-                    .storage_class(TransitionStorageClass::from(TIER))
-                    .build(),
-            )
-            .build()
-            .expect("build rule");
-        client
-            .put_bucket_lifecycle_configuration()
-            .bucket(SOURCE_BUCKET)
-            .lifecycle_configuration(
-                BucketLifecycleConfiguration::builder()
-                    .rules(rule)
-                    .build()
-                    .expect("build config"),
-            )
-            .send()
-            .await
-            .expect("put lifecycle");
-
-        admin_ok(
-            &env,
-            http::Method::POST,
-            &format!("/rustfs/admin/v3/ilm/transition/run?bucket={SOURCE_BUCKET}&prefix=&tier={TIER}&dryRun=false"),
-            None,
-        )
-        .await
-        .expect("run transition");
-
-        let deadline = Instant::now() + Duration::from_secs(60);
-        while target.stored_keys(TARGET_BUCKET).len() < objects.len() {
-            assert!(
-                Instant::now() < deadline,
-                "RT-14 FAIL: transition did not reach the target; stored keys: {:?}",
-                target.stored_keys(TARGET_BUCKET)
-            );
-            tokio::time::sleep(Duration::from_millis(500)).await;
-        }
-
-        let keys = target.stored_keys(TARGET_BUCKET);
-        assert_eq!(keys.len(), objects.len(), "RT-14 FAIL: unexpected remote objects: {keys:?}");
-
-        let mut stored_bodies = Vec::new();
-        for key in &keys {
-            let (body, metadata) = target.stored_object(TARGET_BUCKET, key).expect("remote object");
-            for name in [
-                "x-rustfs-internal-transition-transaction-id",
-                "x-minio-internal-transition-transaction-id",
-                "x-rustfs-internal-transition-tier-destination-id",
-                "x-minio-internal-transition-tier-destination-id",
-            ] {
-                assert!(
-                    metadata.contains_key(name),
-                    "RT-14 FAIL: remote object {key} lost transition identity {name}: {:?}",
-                    metadata.keys().collect::<Vec<_>>()
-                );
-            }
-            stored_bodies.push(body.to_vec());
-        }
-        let mut expected_bodies: Vec<Vec<u8>> = objects.iter().map(|(_, body)| body.clone()).collect();
-        expected_bodies.sort();
-        stored_bodies.sort();
-        assert_eq!(stored_bodies, expected_bodies, "RT-14 FAIL: remote bytes differ from the source objects");
-
-        let transition_puts = target
-            .requests()
-            .iter()
-            .filter(|record| {
-                record.operation == Operation::PutObject
-                    && record
-                        .key
-                        .as_deref()
-                        .is_some_and(|key| key.contains("transition-transactions"))
-            })
-            .count();
-        assert_eq!(
-            transition_puts,
-            objects.len(),
-            "RT-14 FAIL: transition PUTs were retried or refused by the target"
-        );
-
-        for (key, body) in &objects {
-            let head = client
-                .head_object()
-                .bucket(SOURCE_BUCKET)
-                .key(*key)
-                .send()
-                .await
-                .expect("head transitioned");
-            assert_eq!(
-                head.storage_class().map(|class| class.as_str()),
-                Some(TIER),
-                "RT-14 FAIL: {key} is not reported as transitioned"
-            );
-            let got = client
-                .get_object()
-                .bucket(SOURCE_BUCKET)
-                .key(*key)
-                .send()
-                .await
-                .expect("get transitioned")
-                .body
-                .collect()
-                .await
-                .expect("read body")
-                .into_bytes();
-            assert_eq!(got.as_ref(), body.as_slice(), "RT-14 FAIL: read-back of {key} differs");
-        }
-
-        target.shutdown().await;
-        info!("RT-14 PASS: transition PUT omits reserved internal headers");
-        Ok(())
-    }
 }

crates/e2e_test/src/upgrade_compatibility_test.rs

@@ -33,7 +33,6 @@ use aws_sdk_s3::types::{
 };
 use http::{Method, StatusCode};
 use serde_json::Value;
-use std::future::Future;
 use std::io::Write;
 use std::path::{Path, PathBuf};
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
@@ -58,10 +57,6 @@ const UPGRADE_READINESS_BODY: &[u8] = b"upgrade write readiness";
 const PREVIOUS_RELEASE_SEED_KEY: &str = ".upgrade-readiness/previous-seed/node-0";
 const MULTIPART_WORKERS: usize = 16;
 const MULTIPART_UPLOADS_PER_WORKER: usize = 16;
-// Bound each 64 KiB upload, including completion acknowledgement. A peer
-// that accepts the request but never responds must fail the compatibility
-// check with the writer and object, rather than consume the whole CI job.
-const MIXED_MULTIPART_UPLOAD_TIMEOUT: Duration = Duration::from_secs(30);
 // Peers keep a restarted node's drive in Suspect/Returning for roughly
 // probe_interval (2s) x success_threshold (3) after it comes back; 30s
 // comfortably covers that window plus CI scheduling jitter.
@@ -340,21 +335,14 @@ fn configure_cluster_logs(cluster: &mut RustFSTestClusterEnvironment) -> TestRes
 async fn write_multipart_load(clients: &[Client], phase: &str) -> Result<Vec<String>, Box<dyn std::error::Error + Send + Sync>> {
     let mut tasks = JoinSet::new();
     for worker in 0..MULTIPART_WORKERS {
-        let node = worker % clients.len();
-        let client = clients[node].clone();
+        let client = clients[worker % clients.len()].clone();
         let phase = phase.to_string();
         tasks.spawn(async move {
             let mut keys = Vec::with_capacity(MULTIPART_UPLOADS_PER_WORKER);
             for upload in 0..MULTIPART_UPLOADS_PER_WORKER {
                 let key = format!("{phase}/multipart/{worker:02}/{upload:02}");
                 let part = vec![u8::try_from(worker)?; 64 * 1024];
-                mixed_multipart_before(
-                    Instant::now() + MIXED_MULTIPART_UPLOAD_TIMEOUT,
-                    node,
-                    &key,
-                    write_multipart(&client, MIXED_BUCKET, &key, &[part]),
-                )
-                .await?;
+                write_multipart(&client, MIXED_BUCKET, &key, &[part]).await?;
                 keys.push(key);
             }
             Ok::<_, Box<dyn std::error::Error + Send + Sync>>(keys)
@@ -368,172 +356,6 @@ async fn write_multipart_load(clients: &[Client], phase: &str) -> Result<Vec<Str
     Ok(keys)
 }
 
-async fn mixed_multipart_before(
-    deadline: Instant,
-    node: usize,
-    key: &str,
-    upload: impl Future<Output = TestResult>,
-) -> TestResult {
-    tokio::time::timeout_at(deadline, upload)
-        .await
-        .map_err(|_| MultipartAcknowledgementDeadline {
-            node,
-            key: key.to_owned(),
-        })?
-}
-
-#[derive(Debug)]
-struct MultipartAcknowledgementDeadline {
-    node: usize,
-    key: String,
-}
-
-impl std::fmt::Display for MultipartAcknowledgementDeadline {
-    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(
-            formatter,
-            "node {}: multipart upload {MIXED_BUCKET}/{} acknowledgement deadline exceeded",
-            self.node, self.key
-        )
-    }
-}
-
-impl std::error::Error for MultipartAcknowledgementDeadline {}
-
-// Decode only the public lock snapshot fields. Unknown fields, including
-// credential/configuration payloads, never enter the failure artifact.
-#[derive(serde::Deserialize, serde::Serialize)]
-struct MixedLockSnapshot {
-    total: Option<u64>,
-    truncated: Option<bool>,
-    capability_note: Option<String>,
-    locks: Vec<MixedLockEntry>,
-}
-
-#[derive(serde::Deserialize, serde::Serialize)]
-struct MixedLockEntry {
-    resource: Option<String>,
-    bucket: Option<String>,
-    object: Option<String>,
-    version: Option<String>,
-    owner: Option<String>,
-    #[serde(rename = "type")]
-    lock_type: Option<String>,
-    priority: Option<String>,
-    since: Option<String>,
-    elapsed_secs: Option<u64>,
-    ttl_secs: Option<u64>,
-}
-
-async fn read_mixed_lock_snapshot(response: &mut reqwest::Response) -> Result<MixedLockSnapshot, &'static str> {
-    const MAX_BODY_BYTES: usize = 1024 * 1024;
-    let mut body = Vec::new();
-    while let Some(chunk) = response.chunk().await.map_err(|_| "body_read_error")? {
-        if chunk.len() > MAX_BODY_BYTES - body.len() {
-            return Err("body_limit_exceeded");
-        }
-        body.extend_from_slice(&chunk);
-    }
-    serde_json::from_slice(&body).map_err(|_| "invalid_lock_snapshot")
-}
-
-async fn probe_mixed_multipart_failure(
-    cluster: &RustFSTestClusterEnvironment,
-    node: usize,
-    path: &str,
-    head: bool,
-    deadline: Instant,
-) -> Value {
-    let started = Instant::now();
-    let method = if head { Method::HEAD } else { Method::GET };
-    let mut observation = serde_json::json!({
-        "node": node, "method": method.as_str(), "path": path,
-        "status": null, "observation": "unknown", "timeout": false,
-    });
-    // The shared absolute deadline bounds both headers and a slow/infinite
-    // response body; a send-only timeout would leave the cluster alive forever.
-    let result = tokio::time::timeout_at(deadline, async {
-        let mut response = signed_request(
-            method,
-            &format!("{}{path}", cluster.nodes[node].url.trim_end_matches('/')),
-            &cluster.access_key,
-            &cluster.secret_key,
-            None,
-            None,
-        )
-        .await
-        .map_err(|_| "request_error")?;
-        let status = response.status();
-        observation["status"] = serde_json::json!(status.as_u16());
-        if head {
-            observation["observation"] = serde_json::json!(match status {
-                StatusCode::OK => "visible",
-                StatusCode::NOT_FOUND => "not_visible",
-                _ => "unknown",
-            });
-            for (field, header) in [
-                ("content_length", "content-length"),
-                ("etag", "etag"),
-                ("version", "x-amz-version-id"),
-            ] {
-                observation[field] = serde_json::json!(response.headers().get(header).and_then(|value| value.to_str().ok()));
-            }
-        } else if status == StatusCode::OK {
-            observation["snapshot"] =
-                serde_json::to_value(read_mixed_lock_snapshot(&mut response).await?).map_err(|_| "snapshot_encode_error")?;
-            observation["observation"] = serde_json::json!("captured");
-        }
-        Ok::<_, &'static str>(())
-    })
-    .await;
-    match result {
-        Ok(Ok(())) => {}
-        Ok(Err(reason)) => observation["error"] = serde_json::json!(reason),
-        Err(_) => observation["timeout"] = serde_json::json!(true),
-    }
-    observation["elapsed_secs"] = serde_json::json!(started.elapsed().as_secs_f64());
-    observation
-}
-
-async fn observe_mixed_multipart_failure(
-    cluster: &RustFSTestClusterEnvironment,
-    phase: &str,
-    error: BoxError,
-    log_dir: Option<&Path>,
-) -> TestResult {
-    if let (Some(log_dir), Some(failure)) = (log_dir, error.downcast_ref::<MultipartAcknowledgementDeadline>()) {
-        let started = Instant::now();
-        let deadline = started + Duration::from_secs(5);
-        // Reserve the last second for serialization and bounded artifact I/O.
-        // All probes run directly in this future; no diagnostic task is spawned.
-        let network_deadline = started + Duration::from_secs(4);
-        let path = format!("/{MIXED_BUCKET}/{}", failure.key);
-        let _ = tokio::time::timeout_at(deadline, async {
-            let (heads, locks) = tokio::join!(
-                futures::future::join_all((0..cluster.nodes.len()).map(|node| probe_mixed_multipart_failure(
-                    cluster,
-                    node,
-                    &path,
-                    true,
-                    network_deadline
-                ))),
-                probe_mixed_multipart_failure(cluster, 0, "/rustfs/admin/v3/top/locks?count=1000", false, network_deadline),
-            );
-            let snapshot = serde_json::json!({
-                "phase": phase, "bucket": MIXED_BUCKET, "key": failure.key,
-                "writer_node": failure.node, "heads": heads, "top_locks": locks,
-            });
-            let body = serde_json::to_vec_pretty(&snapshot).map_err(|_| ())?;
-            tokio::fs::write(log_dir.join("mixed-multipart-failure.json"), body)
-                .await
-                .map_err(|_| ())
-        })
-        .await;
-    }
-    // Visibility and diagnostic failures cannot acknowledge the original MPU.
-    Err(error)
-}
-
 /// Assert that `client` eventually lists exactly `expected` objects under
 /// `{phase}/`, polling until [`LISTING_CONVERGENCE_TIMEOUT`].
 ///
@@ -578,7 +400,7 @@ async fn exercise_mixed_cluster(
     previous_node: usize,
 ) -> TestResult {
     let clients = cluster.create_all_clients()?;
-    wait_for_upgrade_write_readiness(&clients, MIXED_BUCKET, phase, LISTING_CONVERGENCE_TIMEOUT).await?;
+    wait_for_upgrade_write_readiness(&clients, phase, LISTING_CONVERGENCE_TIMEOUT).await?;
     let current_client = &clients[current_node];
     let previous_client = &clients[previous_node];
 
@@ -604,13 +426,7 @@ async fn exercise_mixed_cluster(
         .await?;
     assert_eq!(read_object(current_client, MIXED_BUCKET, &previous_key, None).await?.1, previous_body);
 
-    let multipart_keys = match write_multipart_load(&clients, phase).await {
-        Ok(keys) => keys,
-        Err(error) => {
-            let log_dir = std::env::var_os("RUSTFS_E2E_LOG_DIR");
-            return observe_mixed_multipart_failure(cluster, phase, error, log_dir.as_deref().map(Path::new)).await;
-        }
-    };
+    let multipart_keys = write_multipart_load(&clients, phase).await?;
     let expected_count = multipart_keys.len() + 2;
     for (label, client) in [("current", current_client), ("previous", previous_client)] {
         assert_eq!(
@@ -646,12 +462,7 @@ fn upgrade_probe_client(client: &Client) -> Client {
     )
 }
 
-pub(crate) async fn wait_for_upgrade_write_readiness(
-    clients: &[Client],
-    bucket: &str,
-    phase: &str,
-    budget: Duration,
-) -> TestResult {
+async fn wait_for_upgrade_write_readiness(clients: &[Client], phase: &str, budget: Duration) -> TestResult {
     // ListBuckets can succeed before peers recover a restarted disk. Cluster
     // health also accepts Returning disks whose write health is still FAULTY.
     // Probe every writer outside the asserted phase prefix; compatibility
@@ -671,7 +482,7 @@ pub(crate) async fn wait_for_upgrade_write_readiness(
                 deadline,
                 client
                     .put_object()
-                    .bucket(bucket)
+                    .bucket(MIXED_BUCKET)
                     .key(&key)
                     .body(ByteStream::from_static(UPGRADE_READINESS_BODY))
                     .send(),
@@ -706,20 +517,19 @@ async fn prepare_previous_release_baseline(cluster: &mut RustFSTestClusterEnviro
     // waits for pool metadata (#7473). First prove the elected writer can
     // persist data, then restart each old process once with three peers still
     // readable. This preparation ends before any current binary is started.
-    wait_for_upgrade_write_readiness(&clients[..1], MIXED_BUCKET, "previous-seed", LISTING_CONVERGENCE_TIMEOUT).await?;
+    wait_for_upgrade_write_readiness(&clients[..1], "previous-seed", LISTING_CONVERGENCE_TIMEOUT).await?;
     for node in [1, 2, 3, 0] {
         cluster.stop_node(node)?;
         cluster.start_node_from_binary(node, previous_binary).await?;
         wait_for_upgrade_write_readiness(
             std::slice::from_ref(&clients[node]),
-            MIXED_BUCKET,
             &format!("previous-restart-{node}"),
             LISTING_CONVERGENCE_TIMEOUT,
         )
         .await?;
     }
 
-    wait_for_upgrade_write_readiness(&clients, MIXED_BUCKET, "previous-baseline", LISTING_CONVERGENCE_TIMEOUT).await?;
+    wait_for_upgrade_write_readiness(&clients, "previous-baseline", LISTING_CONVERGENCE_TIMEOUT).await?;
     for (reader, client) in clients.iter().enumerate() {
         assert_eq!(
             read_object(client, MIXED_BUCKET, PREVIOUS_RELEASE_SEED_KEY, None).await?.1,
@@ -746,10 +556,9 @@ mod upgrade_write_readiness_tests {
     #[tokio::test]
     async fn waits_for_each_writer_after_metadata_is_ready() -> TestResult {
         let target = FakeS3Target::start().await?;
-        let bucket = "distributed-upgrade-history";
-        target.create_bucket(bucket);
+        target.create_bucket(MIXED_BUCKET);
         let client = fake_source_client(&target);
-        client.head_bucket().bucket(bucket).send().await?;
+        client.head_bucket().bucket(MIXED_BUCKET).send().await?;
 
         let phase = "one-previous-node";
         let first_key = format!(".upgrade-readiness/{phase}/node-0");
@@ -769,7 +578,7 @@ mod upgrade_write_readiness_tests {
         // Metadata readiness does not prove that a data write can succeed.
         let premature = client
             .put_object()
-            .bucket(bucket)
+            .bucket(MIXED_BUCKET)
             .key(&first_key)
             .body(ByteStream::from_static(b"upgrade write readiness"))
             .send()
@@ -777,15 +586,15 @@ mod upgrade_write_readiness_tests {
             .expect_err("metadata readiness does not prove write readiness");
         assert_eq!(premature.raw_response().map(|response| response.status().as_u16()), Some(503));
 
-        wait_for_upgrade_write_readiness(&[client.clone(), client.clone()], bucket, phase, Duration::from_secs(5)).await?;
+        wait_for_upgrade_write_readiness(&[client.clone(), client.clone()], phase, Duration::from_secs(5)).await?;
         assert_eq!(target.count_requests(FakeTargetOperation::PutObject, &first_key), 3);
         assert_eq!(target.count_requests(FakeTargetOperation::PutObject, &second_key), 2);
-        assert!(target.has_object(bucket, &first_key));
-        assert!(target.has_object(bucket, &second_key));
+        assert!(target.has_object(MIXED_BUCKET, &first_key));
+        assert!(target.has_object(MIXED_BUCKET, &second_key));
         assert!(
             client
                 .list_objects_v2()
-                .bucket(bucket)
+                .bucket(MIXED_BUCKET)
                 .prefix(format!("{phase}/"))
                 .send()
                 .await?
@@ -815,10 +624,9 @@ mod upgrade_write_readiness_tests {
             let phase = format!("permanent-{}", status.as_u16());
             let key = format!(".upgrade-readiness/{phase}/node-0");
             target.inject_for_key(FakeTargetOperation::PutObject, &key, FaultAction::Status(status), 1);
-            let error =
-                wait_for_upgrade_write_readiness(std::slice::from_ref(&client), MIXED_BUCKET, &phase, Duration::from_secs(5))
-                    .await
-                    .expect_err("a permanent error must not be retried into success");
+            let error = wait_for_upgrade_write_readiness(std::slice::from_ref(&client), &phase, Duration::from_secs(5))
+                .await
+                .expect_err("a permanent error must not be retried into success");
             assert!(error.to_string().contains("node 0 write readiness failed"), "{error}");
             assert_eq!(target.count_requests(FakeTargetOperation::PutObject, &key), 1);
             assert!(!target.has_object(MIXED_BUCKET, &key));
@@ -841,7 +649,7 @@ mod upgrade_write_readiness_tests {
             FaultAction::Status(StatusCode::SERVICE_UNAVAILABLE),
             10,
         );
-        let error = wait_for_upgrade_write_readiness(&[client], MIXED_BUCKET, phase, Duration::from_secs(1))
+        let error = wait_for_upgrade_write_readiness(&[client], phase, Duration::from_secs(1))
             .await
             .expect_err("persistent unavailability must exhaust the shared deadline");
         // Transport scheduling consumes the same budget; do not require a
@@ -860,134 +668,10 @@ mod upgrade_write_readiness_tests {
         let phase = "stalled";
         let key = format!(".upgrade-readiness/{phase}/node-0");
         target.inject_for_key(FakeTargetOperation::PutObject, &key, FaultAction::Stall(Duration::from_secs(30)), 1);
-        let error = wait_for_upgrade_write_readiness(std::slice::from_ref(&client), MIXED_BUCKET, phase, Duration::from_secs(1))
+        let error = wait_for_upgrade_write_readiness(&[client], phase, Duration::from_secs(1))
             .await
             .expect_err("a stalled request must not outlive the readiness deadline");
         assert!(error.to_string().contains("deadline exceeded during PutObject"), "{error}");
-
-        let part = vec![2_u8; 64 * 1024];
-        let successful_key = "stalled/multipart/02/00";
-        mixed_multipart_before(
-            Instant::now() + MIXED_MULTIPART_UPLOAD_TIMEOUT,
-            2,
-            successful_key,
-            write_multipart(&client, MIXED_BUCKET, successful_key, std::slice::from_ref(&part)),
-        )
-        .await?;
-        assert_eq!(read_object(&client, MIXED_BUCKET, successful_key, None).await?.1, part);
-
-        let stalled_key = "stalled/multipart/02/01";
-        target.inject_for_key(
-            FakeTargetOperation::CompleteMultipartUpload,
-            stalled_key,
-            FaultAction::Stall(Duration::from_secs(30)),
-            1,
-        );
-        let error = {
-            let upload = write_multipart(&client, MIXED_BUCKET, stalled_key, std::slice::from_ref(&part));
-            tokio::pin!(upload);
-            tokio::select! {
-                result = &mut upload => panic!("stalled completion unexpectedly returned: {result:?}"),
-                observed = tokio::time::timeout(Duration::from_secs(10), async {
-                    while target.count_requests(FakeTargetOperation::CompleteMultipartUpload, stalled_key) == 0
-                        || !target.has_object(MIXED_BUCKET, stalled_key)
-                    {
-                        sleep(Duration::from_millis(10)).await;
-                    }
-                }) => observed.expect("multipart completion must reach and commit on the fake peer"),
-            }
-            // An already committed object is not an acknowledged client success.
-            // Expire only after observing the real completion request, so host
-            // scheduling cannot turn this into a timeout before admission.
-            tokio::time::timeout(Duration::from_secs(1), mixed_multipart_before(Instant::now(), 2, stalled_key, upload))
-                .await
-                .expect("expired deadline must stop the in-flight completion")
-                .expect_err("unacknowledged completion must fail even if the peer committed")
-        };
-        assert!(error.to_string().contains("node 2"), "{error}");
-        assert!(error.to_string().contains(stalled_key), "{error}");
-        assert!(error.to_string().contains("acknowledgement deadline exceeded"), "{error}");
-        assert_eq!(target.count_requests(FakeTargetOperation::CompleteMultipartUpload, stalled_key), 1);
-
-        let failure = error
-            .downcast_ref::<MultipartAcknowledgementDeadline>()
-            .expect("the timeout must retain typed writer/object context");
-        assert_eq!(failure.node, 2);
-        assert_eq!(failure.key, stalled_key);
-        let original_message = error.to_string();
-        // These four probe addresses share an in-process peer. This verifies
-        // bounded diagnostic fan-out, not a four-node RustFS cluster.
-        let mut probes = RustFSTestClusterEnvironment::new(MIXED_NODE_COUNT).await?;
-        probes.access_key = FAKE_ACCESS_KEY.to_owned();
-        probes.secret_key = FAKE_SECRET_KEY.to_owned();
-        for node in &mut probes.nodes {
-            node.url = target.endpoint().to_owned();
-        }
-        let log_dir = tempfile::tempdir()?;
-        target.inject_for_key(
-            FakeTargetOperation::HeadObject,
-            stalled_key,
-            FaultAction::Stall(Duration::from_secs(30)),
-            1,
-        );
-        let error = tokio::time::timeout(
-            Duration::from_secs(7),
-            observe_mixed_multipart_failure(&probes, phase, error, Some(log_dir.path())),
-        )
-        .await
-        .expect("the shared diagnostic budget must include artifact writing")
-        .expect_err("observing committed data cannot acknowledge the stalled upload");
-        assert_eq!(error.to_string(), original_message);
-        assert!(error.downcast_ref::<MultipartAcknowledgementDeadline>().is_some());
-        let snapshot: Value =
-            serde_json::from_slice(&tokio::fs::read(log_dir.path().join("mixed-multipart-failure.json")).await?)?;
-        assert_eq!(snapshot["key"], stalled_key);
-        assert_eq!(snapshot["writer_node"], 2);
-        let heads = snapshot["heads"]
-            .as_array()
-            .expect("failure artifact must retain every probe");
-        assert_eq!(heads.len(), MIXED_NODE_COUNT);
-        assert_eq!(
-            heads
-                .iter()
-                .filter(|head| head["timeout"] == true && head["observation"] == "unknown")
-                .count(),
-            1
-        );
-        assert_eq!(
-            heads
-                .iter()
-                .filter(|head| head["status"] == 200 && head["observation"] == "visible")
-                .count(),
-            3
-        );
-        assert_eq!(target.count_requests(FakeTargetOperation::HeadObject, stalled_key), MIXED_NODE_COUNT);
-        assert_eq!(target.count_requests(FakeTargetOperation::CompleteMultipartUpload, stalled_key), 1);
-        assert_eq!(snapshot["top_locks"]["observation"], "unknown", "the fake peer has no admin lock API");
-
-        let locks: MixedLockSnapshot = serde_json::from_value(serde_json::json!({
-            "total": 1, "truncated": true, "capability_note": "partial snapshot",
-            "credentials": { "secret_key": "must not persist" },
-            "locks": [{
-                "resource": format!("{MIXED_BUCKET}/{stalled_key}"), "owner": "writer", "type": "WRITE",
-                "elapsed_secs": 30, "ttl_secs": 1, "merged_config": { "secret_key": "must not persist" },
-            }],
-        }))?;
-        let safe_locks = serde_json::to_value(locks)?;
-        assert_eq!(safe_locks["total"], 1);
-        assert_eq!(safe_locks["truncated"], true);
-        assert_eq!(safe_locks["locks"][0]["owner"], "writer");
-        assert_eq!(safe_locks["locks"][0]["elapsed_secs"], 30);
-        assert!(safe_locks.get("credentials").is_none());
-        assert!(safe_locks["locks"][0].get("merged_config").is_none());
-
-        let mut body = br#"{"locks":[]}"#.to_vec();
-        body.resize(1024 * 1024, b' ');
-        let mut at_limit = reqwest::Response::from(http::Response::new(body.clone()));
-        assert!(read_mixed_lock_snapshot(&mut at_limit).await?.locks.is_empty());
-        body.push(b' ');
-        let mut oversized = reqwest::Response::from(http::Response::new(body));
-        assert_eq!(read_mixed_lock_snapshot(&mut oversized).await.err(), Some("body_limit_exceeded"));
         target.shutdown().await;
         Ok(())
     }
@@ -2497,9 +2181,9 @@ struct LayoutTransport {
     uploaded_parts: Vec<i32>,
     single_puts: usize,
     completes: usize,
-    /// Allowlisted request identity and prepared response metadata. A prepared
-    /// response does not prove that the client received it.
-    journal: Vec<Value>,
+    /// Raw per-key journal in target order: (sequence, operation, part number,
+    /// upload id), so duplicate drives can be told apart from retries.
+    journal: Vec<(u64, String, Option<i32>, Option<String>)>,
 }
 
 /// Configure every layout bucket to replicate its existing objects to a fresh
@@ -2561,28 +2245,12 @@ async fn replicate_layouts(
             journal: key_requests
                 .iter()
                 .map(|record| {
-                    serde_json::json!({
-                        "sequence": record.sequence,
-                        "operation": format!("{:?}", record.operation),
-                        "part_number": record.part_number,
-                        "upload_id": record.upload_id,
-                        "requested_version_id": record.version_id,
-                        "source_version_id": record.source_version_id,
-                        "source_mtime": record.source_mtime,
-                        "source_etag": record.source_etag,
-                        "source_replication_request": record.source_replication_request,
-                        "request_content_length": record.content_length,
-                        "journaled_at_unix_millis": record.journaled_at_unix_millis,
-                        "prepared_response": record.prepared_response.as_ref().map(|response| serde_json::json!({
-                            "status": response.status,
-                            "version_id": response.version_id,
-                            "etag": response.etag,
-                            "last_modified": response.last_modified,
-                            "content_length": response.content_length,
-                            "prepared_at_unix_millis": response.prepared_at_unix_millis,
-                            "elapsed_secs": response.elapsed.as_secs_f64(),
-                        })),
-                    })
+                    (
+                        record.sequence,
+                        format!("{:?}", record.operation),
+                        record.part_number,
+                        record.upload_id.as_ref().map(|id| id.chars().take(12).collect()),
+                    )
                 })
                 .collect(),
         };

crates/ecstore/Cargo.toml

@@ -176,7 +176,7 @@ regex = { workspace = true }
 path-absolutize = { workspace = true }
 rmp.workspace = true
 rmp-serde.workspace = true
-tokio-util = { workspace = true, features = ["io", "compat", "rt"] }
+tokio-util = { workspace = true, features = ["io", "compat"] }
 tokio-stream = { workspace = true, features = ["sync"] }
 hmac = { workspace = true }
 sha2 = { workspace = true }

crates/ecstore/benches/erasure_benchmark.rs

@@ -307,32 +307,6 @@ fn bench_memory_patterns(c: &mut Criterion) {
     group.sample_size(10);
     group.measurement_time(Duration::from_secs(5));
 
-    // The reader owns an EC-sized buffer before encoding. Keep ingest outside
-    // the timed region to isolate the borrowed-copy versus ownership transfer.
-    let erasure = Erasure::new(data_shards, parity_shards, block_size);
-    let payload = generate_test_data(block_size);
-    for owned in [false, true] {
-        group.bench_function(if owned { "owned_ingest" } else { "borrowed_ingest" }, |b| {
-            b.iter_batched(
-                || {
-                    let mut buffer = bytes::BytesMut::with_capacity(erasure.shard_size() * (data_shards + parity_shards));
-                    buffer.extend_from_slice(&payload);
-                    buffer
-                },
-                |buffer| {
-                    let shards = if owned {
-                        erasure.encode_data_bytes_mut(buffer, block_size)
-                    } else {
-                        erasure.encode_data(&buffer)
-                    }
-                    .expect("encode benchmark block");
-                    black_box(shards)
-                },
-                criterion::BatchSize::PerIteration,
-            );
-        });
-    }
-
     // Test reusing the same Erasure instance
     group.bench_function("reuse_erasure_instance", |b| {
         let erasure = Erasure::new(data_shards, parity_shards, block_size);

crates/ecstore/src/api/mod.rs

@@ -240,10 +240,7 @@ pub mod bucket {
     }
 
     pub mod quota {
-        pub use crate::bucket::quota::{
-            BucketQuota, QUOTA_RESERVATION_PROTOCOL_V1, QUOTA_RESERVATION_PROTOCOL_V2, QuotaCheckResult, QuotaError,
-            QuotaOperation,
-        };
+        pub use crate::bucket::quota::{BucketQuota, QuotaCheckResult, QuotaError, QuotaOperation};
 
         pub mod checker {
             pub use crate::bucket::quota::checker::QuotaChecker;
@@ -365,11 +362,10 @@ pub mod config {
             ServerConfigCorruptError, ServerConfigSaveResult, ServerConfigSnapshot, delete_config, delete_config_no_lock,
             is_server_config_corrupt_error, lookup_configs, read_config, read_config_no_lock, read_config_with_metadata,
             read_config_without_migrate, read_config_without_migrate_no_lock, read_existing_server_config_no_lock,
-            read_server_config_snapshot, save_config, save_config_no_lock, save_config_with_opts, save_config_with_opts_quiet,
-            save_server_config, save_server_config_no_lock, save_server_config_snapshot,
-            save_server_config_snapshot_with_generation, server_config_path, try_migrate_server_config,
-            with_config_object_read_lock, with_config_object_write_lock, with_server_config_read_lock,
-            with_server_config_write_lock,
+            read_server_config_snapshot, save_config, save_config_no_lock, save_config_with_opts, save_server_config,
+            save_server_config_no_lock, save_server_config_snapshot, save_server_config_snapshot_with_generation,
+            server_config_path, try_migrate_server_config, with_config_object_read_lock, with_config_object_write_lock,
+            with_server_config_read_lock, with_server_config_write_lock,
         };
     }
 
@@ -399,8 +395,6 @@ pub mod data_usage {
         ScannerPauseBacklogRetirementPlanner, ScannerPauseBacklogRetirementReplica,
         register_scanner_pause_backlog_retirement_planner,
     };
-    #[cfg(feature = "test-util")]
-    pub use crate::data_usage::seed_bucket_usage_memory_for_test;
     pub use crate::data_usage::{
         DATA_USAGE_CACHE_NAME, apply_bucket_usage_memory_overlay, compute_bucket_usage,
         init_compression_total_memory_from_backend, invalidate_admin_data_usage_snapshot_cache,
@@ -412,7 +406,8 @@ pub mod data_usage {
         remove_bucket_usage_from_backend, replace_bucket_usage_memory_from_info, store_compression_total_in_backend,
         store_data_usage_in_backend,
     };
-    pub use crate::data_usage::{get_bucket_usage_memory, lookup_degraded_bucket_usage_baseline};
+    #[cfg(feature = "test-util")]
+    pub use crate::data_usage::{get_bucket_usage_memory, seed_bucket_usage_memory_for_test};
 }
 
 pub mod disk {
@@ -472,7 +467,7 @@ pub mod event {
 pub mod global {
     pub use crate::runtime::global::{
         set_global_endpoints, set_global_region, set_global_rustfs_port, set_object_store_resolver, shutdown_background_services,
-        update_erasure_type, wait_for_detached_mutations,
+        update_erasure_type,
     };
 }
 
@@ -523,7 +518,7 @@ pub mod object {
         ObjectInfo, ObjectLockConfigSnapshot, ObjectMutationHook, ObjectOptions, PutObjReader, QuotaAdmission,
         RangedDecompressReader, ReadEncryptionMaterial, ReadEncryptionMode, ReadEncryptionRequest,
         SCANNER_PUBLICATION_LEASE_FENCE_METADATA_KEY, ScannerPublicationCommitScope, ScannerPublicationCommitStartError,
-        ScannerPublicationCommitState, ShardIntegrityWriteMode, StreamConsumer, WriteCommitGuard, WriteCompletion,
+        ScannerPublicationCommitState, ShardIntegrityWriteMode, StreamConsumer, WriteCompletion,
         get_object_body_cache_plaintext_len, lookup_get_object_body_cache_hook, register_get_object_body_cache_hook,
         register_object_mutation_hook, unregister_get_object_body_cache_hook, unregister_object_mutation_hook,
     };

crates/ecstore/src/bucket/lifecycle/bucket_lifecycle_ops.rs

@@ -87,7 +87,6 @@ use rustfs_filemeta::{
     FileInfo, FileInfoOpts, NULL_VERSION_ID, RestoreStatus, RestoreStatusOps, TRANSITION_COMPLETE, get_file_info,
     is_restored_object_on_disk,
 };
-use rustfs_lock::{NamespaceLockGuard, error::LockError};
 use rustfs_scanner_metrics::metrics::{
     IlmAction, Metrics, ScannerLifecycleExpiryStateUpdate, ScannerLifecycleTransitionStateUpdate, global_metrics,
 };
@@ -191,8 +190,6 @@ const TIER_FREE_VERSION_RECOVERY_BASE_INTERVAL: StdDuration = StdDuration::from_
 // before another full sweep can discover work persisted by another node.
 const TIER_FREE_VERSION_RECOVERY_MAX_IDLE_INTERVAL: StdDuration = StdDuration::from_secs(10 * 60);
 const TIER_FREE_VERSION_RECOVERY_JITTER_PERCENT: u64 = 10;
-const TIER_FREE_VERSION_RECOVERY_LEADER_LOCK: &str = "tier-free-version-recovery/leader.lock";
-const TIER_FREE_VERSION_RECOVERY_LOCK_TIMEOUT: StdDuration = StdDuration::from_secs(1);
 const DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS: i64 = 5;
 const EXPIRY_WORKER_QUEUE_CAPACITY: usize = 1000;
 const DEFAULT_MANUAL_TRANSITION_JOB_RECOVERY_LIMIT: usize = 100;
@@ -1444,24 +1441,13 @@ pub(crate) async fn enqueue_committed_free_versions(api: &ECStore, free_versions
     queued
 }
 
-async fn enqueue_recovered_free_version_with_state(
-    state: &Arc<RwLock<ExpiryState>>,
-    oi: ObjectInfo,
-    cancel: &CancellationToken,
-) -> bool {
+async fn enqueue_recovered_free_version_with_state(state: &Arc<RwLock<ExpiryState>>, oi: ObjectInfo) -> bool {
     let task = FreeVersionTask(oi);
     let hash = task.op_hash();
     let (wrkr, stats) = {
-        let state = select! {
-            biased;
-            _ = cancel.cancelled() => return false,
-            state = state.read() => state,
-        };
+        let state = state.read().await;
         (state.get_worker_ch(hash), Arc::clone(&state.stats))
     };
-    if cancel.is_cancelled() {
-        return false;
-    }
     let Some(wrkr) = wrkr else {
         stats.increment_missed_freevers_tasks();
         stats.record_scanner_expiry_state();
@@ -1511,13 +1497,9 @@ fn set_recovered_free_version_enqueue_observer(
     RecoveredFreeVersionEnqueueObserverGuard
 }
 
-pub(super) async fn enqueue_recovered_free_version_with_cancel(
-    api: &ECStore,
-    oi: ObjectInfo,
-    cancel: &CancellationToken,
-) -> bool {
+pub async fn enqueue_recovered_free_version(api: &ECStore, oi: ObjectInfo) -> bool {
     let expiry_state = api.ctx.expiry_state();
-    let queued = enqueue_recovered_free_version_with_state(&expiry_state, oi, cancel).await;
+    let queued = enqueue_recovered_free_version_with_state(&expiry_state, oi).await;
 
     #[cfg(test)]
     if let Some(observer) = RECOVERED_FREE_VERSION_ENQUEUE_OBSERVER
@@ -2939,20 +2921,6 @@ fn resolve_tier_free_version_recovery_enabled(value: Result<String, env::VarErro
 }
 
 fn spawn_tier_free_version_recovery_once(api: Arc<ECStore>, started: &OnceLock<()>) -> Option<JoinHandle<()>> {
-    spawn_tier_free_version_recovery_once_with_options(
-        api,
-        started,
-        TIER_FREE_VERSION_RECOVERY_LEADER_LOCK.to_string(),
-        tier_free_version_recovery_leader_retry_delay,
-    )
-}
-
-fn spawn_tier_free_version_recovery_once_with_options(
-    api: Arc<ECStore>,
-    started: &OnceLock<()>,
-    leader_lock_name: String,
-    retry_delay: fn() -> StdDuration,
-) -> Option<JoinHandle<()>> {
     if !tier_free_version_recovery_enabled() {
         warn!(
             event = EVENT_LIFECYCLE_WORKER_STATE,
@@ -2969,43 +2937,20 @@ fn spawn_tier_free_version_recovery_once_with_options(
 
     Some(tokio::spawn(async move {
         let cancel_token = api.ctx.background_cancel_token().unwrap_or_default();
-        let acquire_api = Arc::clone(&api);
-        let acquire_lock_name = Arc::<str>::from(leader_lock_name);
-        run_tier_free_version_recovery_coordinator(
+        let expiry_state = api.ctx.expiry_state();
+        run_tier_free_version_recovery_loop(
             cancel_token,
-            retry_delay,
-            move || {
-                let api = Arc::clone(&acquire_api);
-                let lock_name = Arc::clone(&acquire_lock_name);
-                async move {
-                    let lock = api.new_ns_lock(RUSTFS_META_BUCKET, &lock_name).await?;
-                    match lock.get_write_lock_quiet(TIER_FREE_VERSION_RECOVERY_LOCK_TIMEOUT).await {
-                        Ok(guard) => Ok(Some(guard)),
-                        Err(LockError::Timeout { .. }) => Ok(None),
-                        Err(err) => Err(err.into()),
-                    }
-                }
-            },
-            move |leader_cancel| {
+            expiry_state,
+            jitter_tier_free_version_recovery_delay,
+            move |bucket_marker, object_marker, recovery_cancel| {
                 let api = Arc::clone(&api);
                 async move {
-                    run_tier_free_version_recovery_loop(
-                        leader_cancel,
-                        api.ctx.expiry_state(),
-                        jitter_tier_free_version_recovery_delay,
-                        move |bucket_marker, object_marker, recovery_cancel| {
-                            let api = Arc::clone(&api);
-                            async move {
-                                recover_tier_free_versions_with_cancel(
-                                    api,
-                                    DEFAULT_FREE_VERSION_RECOVERY_LIMIT,
-                                    bucket_marker,
-                                    object_marker,
-                                    recovery_cancel,
-                                )
-                                .await
-                            }
-                        },
+                    recover_tier_free_versions_with_cancel(
+                        api,
+                        DEFAULT_FREE_VERSION_RECOVERY_LIMIT,
+                        bucket_marker,
+                        object_marker,
+                        recovery_cancel,
                     )
                     .await
                 }
@@ -3015,86 +2960,6 @@ fn spawn_tier_free_version_recovery_once_with_options(
     }))
 }
 
-fn tier_free_version_recovery_leader_retry_delay() -> StdDuration {
-    StdDuration::from_secs(rand::rng().random_range(15..=30))
-}
-
-async fn run_tier_free_version_recovery_coordinator<A, AF, R, RF>(
-    cancel: CancellationToken,
-    retry_delay: fn() -> StdDuration,
-    mut acquire: A,
-    mut recover: R,
-) where
-    A: FnMut() -> AF,
-    AF: Future<Output = crate::error::Result<Option<NamespaceLockGuard>>>,
-    R: FnMut(CancellationToken) -> RF,
-    RF: Future<Output = ()>,
-{
-    loop {
-        let acquired = select! {
-            biased;
-            _ = cancel.cancelled() => return,
-            result = acquire() => result,
-        };
-        match acquired {
-            Ok(Some(mut guard)) => {
-                let leader_cancel = cancel.child_token();
-                // Hold ownership across every page, cooldown and idle wait. A
-                // follower taking over starts a fresh sweep of persisted markers.
-                let recovery = recover(leader_cancel.clone());
-                tokio::pin!(recovery);
-                debug!(
-                    event = EVENT_LIFECYCLE_WORKER_STATE,
-                    component = LOG_COMPONENT_ECSTORE,
-                    subsystem = LOG_SUBSYSTEM_LIFECYCLE,
-                    state = "free_version_recovery_leader_acquired",
-                    lock_name = TIER_FREE_VERSION_RECOVERY_LEADER_LOCK,
-                    "Tier free-version recovery leader acquired"
-                );
-                select! {
-                    biased;
-                    _ = cancel.cancelled() => {
-                        leader_cancel.cancel();
-                        recovery.await;
-                    }
-                    _ = guard.lock_lost_notified() => {
-                        debug!(
-                            event = EVENT_LIFECYCLE_WORKER_STATE,
-                            component = LOG_COMPONENT_ECSTORE,
-                            subsystem = LOG_SUBSYSTEM_LIFECYCLE,
-                            state = "free_version_recovery_leader_lost",
-                            lock_name = TIER_FREE_VERSION_RECOVERY_LEADER_LOCK,
-                            "Tier free-version recovery leader lost"
-                        );
-                        // Dropping the recovery future would detach its active
-                        // walk. Cancel it and poll the same future through cleanup.
-                        leader_cancel.cancel();
-                        recovery.await;
-                    }
-                    _ = &mut recovery => {}
-                }
-                leader_cancel.cancel();
-                guard.release();
-            }
-            Ok(None) => {}
-            Err(err) => warn!(
-                event = EVENT_LIFECYCLE_WORKER_STATE,
-                component = LOG_COMPONENT_ECSTORE,
-                subsystem = LOG_SUBSYSTEM_LIFECYCLE,
-                state = "free_version_recovery_leader_acquire_failed",
-                lock_name = TIER_FREE_VERSION_RECOVERY_LEADER_LOCK,
-                error = %err,
-                "Tier free-version recovery leader acquisition failed"
-            ),
-        }
-        select! {
-            biased;
-            _ = cancel.cancelled() => return,
-            _ = tokio::time::sleep(retry_delay()) => {}
-        }
-    }
-}
-
 async fn run_tier_free_version_recovery_loop<F, Fut>(
     cancel_token: CancellationToken,
     expiry_state: Arc<RwLock<ExpiryState>>,
@@ -3104,11 +2969,7 @@ async fn run_tier_free_version_recovery_loop<F, Fut>(
     F: FnMut(Option<String>, Option<String>, CancellationToken) -> Fut,
     Fut: Future<Output = crate::error::Result<FreeVersionRecoveryStats>>,
 {
-    let recovery_notify = select! {
-        biased;
-        _ = cancel_token.cancelled() => return,
-        state = expiry_state.read() => Arc::clone(&state.recovery_notify),
-    };
+    let recovery_notify = Arc::clone(&expiry_state.read().await.recovery_notify);
     let mut schedule = TierFreeVersionRecoverySchedule::default();
 
     loop {
@@ -3131,11 +2992,7 @@ async fn run_tier_free_version_recovery_loop<F, Fut>(
                 schedule.record_success(&stats);
                 rustfs_io_metrics::record_stage_duration("lifecycle_free_version_recovery", elapsed.as_secs_f64() * 1000.0);
                 let (pending_tasks, active_tasks) = {
-                    let state = select! {
-                        biased;
-                        _ = cancel_token.cancelled() => return,
-                        state = expiry_state.read() => state,
-                    };
+                    let state = expiry_state.read().await;
                     (state.pending_tasks(), state.stats.active_tasks())
                 };
                 debug!(
@@ -4891,7 +4748,7 @@ async fn expire_transitioned_object_with_lock_lost_signal(
     bucket_incarnation_id: Uuid,
     lock_lost_signal: Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>>,
 ) -> Result<ObjectInfo, std::io::Error> {
-    let publication_guard = lifecycle_expiry_publication_guard(&api, &oi.bucket, &oi.name, bucket_incarnation_id)
+    let publication_guard = lifecycle_expiry_publication_guard(&api, oi, bucket_incarnation_id)
         .await
         .ok_or_else(|| std::io::Error::other("lifecycle expiry is not allowed for this bucket"))?;
     let snapshot = lifecycle_delete_config_snapshot(&api, oi)
@@ -4981,14 +4838,10 @@ pub fn gen_transition_objname(bucket: &str) -> Result<String, Error> {
 pub async fn transition_object(api: Arc<ECStore>, oi: &ObjectInfo, lae: LcAuditEvent) -> Result<(), Error> {
     let time_ilm = Metrics::time_ilm(lae.event.action);
 
-    let (publication_guard, bucket_incarnation_id) = lifecycle_transition_publication_guard(&api, oi)
-        .await
-        .ok_or_else(|| Error::other("lifecycle transition is not allowed for this bucket"))?;
-
     let etag = if let Some(etag) = &oi.etag { etag } else { "" };
     let etag = etag.to_string();
 
-    let mut opts = ObjectOptions {
+    let opts = ObjectOptions {
         transition: TransitionOptions {
             status: lifecycle::TRANSITION_PENDING.to_string(),
             tier: lae.event.storage_class,
@@ -5000,10 +4853,8 @@ pub async fn transition_object(api: Arc<ECStore>, oi: &ObjectInfo, lae: LcAuditE
         versioned: BucketVersioningSys::prefix_enabled(&oi.bucket, &oi.name).await,
         version_suspended: BucketVersioningSys::prefix_suspended(&oi.bucket, &oi.name).await,
         mod_time: oi.mod_time,
-        expected_bucket_incarnation_id: Some(bucket_incarnation_id),
         ..Default::default()
     };
-    opts.add_namespace_lock_guard(&publication_guard);
     let result = api.transition_object(&oi.bucket, &oi.name, &opts).await;
     time_ilm(1)();
     result
@@ -5607,26 +5458,20 @@ pub async fn apply_transition_rule(event: &lifecycle::Event, src: &LcEventSrc, o
         .await
 }
 
-async fn acquire_lifecycle_publication_guard(api: &ECStore, bucket: &str) -> Result<rustfs_lock::NamespaceLockGuard, Error> {
-    let lock = api
-        .new_ns_lock(bucket, rustfs_common::table_catalog::TABLE_BUCKET_PUBLICATION_LOCK_PATH)
-        .await?;
-    let guard = lock.get_read_lock(get_lock_acquire_timeout()).await.map_err(Error::other)?;
-    if guard.is_lock_lost() {
-        return Err(Error::other("table-bucket publication lock was lost before lifecycle admission"));
-    }
-    Ok(guard)
-}
-
-pub(crate) async fn lifecycle_expiry_publication_guard(
+async fn lifecycle_expiry_publication_guard(
     api: &ECStore,
-    bucket: &str,
-    object: &str,
+    oi: &ObjectInfo,
     bucket_incarnation_id: Uuid,
 ) -> Option<rustfs_lock::NamespaceLockGuard> {
-    let result: std::result::Result<Option<rustfs_lock::NamespaceLockGuard>, Error> = async {
-        let guard = acquire_lifecycle_publication_guard(api, bucket).await?;
-        if !metadata_boundary::lifecycle_expiry_allowed(api, bucket, bucket_incarnation_id).await? {
+    let result = async {
+        let lock = api
+            .new_ns_lock(&oi.bucket, rustfs_common::table_catalog::TABLE_BUCKET_PUBLICATION_LOCK_PATH)
+            .await?;
+        let guard = lock.get_read_lock(get_lock_acquire_timeout()).await.map_err(Error::other)?;
+        if guard.is_lock_lost() {
+            return Err(Error::other("table-bucket publication lock was lost before lifecycle delete admission"));
+        }
+        if !metadata_boundary::lifecycle_expiry_allowed(api, &oi.bucket, bucket_incarnation_id).await? {
             return Ok(None);
         }
         Ok(Some(guard))
@@ -5639,8 +5484,8 @@ pub(crate) async fn lifecycle_expiry_publication_guard(
                 event = EVENT_LIFECYCLE_DELETE_FAILED,
                 component = LOG_COMPONENT_ECSTORE,
                 subsystem = LOG_SUBSYSTEM_LIFECYCLE,
-                bucket,
-                object,
+                bucket = %oi.bucket,
+                object = %oi.name,
                 operation = "authorize_lifecycle_expiry",
                 error = %err,
                 "Lifecycle delete admission failed"
@@ -5650,34 +5495,6 @@ pub(crate) async fn lifecycle_expiry_publication_guard(
     }
 }
 
-async fn lifecycle_transition_publication_guard(
-    api: &ECStore,
-    oi: &ObjectInfo,
-) -> Option<(rustfs_lock::NamespaceLockGuard, Uuid)> {
-    let result: std::result::Result<(rustfs_lock::NamespaceLockGuard, Uuid), Error> = async {
-        let guard = acquire_lifecycle_publication_guard(api, &oi.bucket).await?;
-        let configs = metadata_boundary::get_expiry_configs(api, &oi.bucket).await?;
-        Ok((guard, configs.bucket_incarnation_id))
-    }
-    .await;
-    match result {
-        Ok(state) => Some(state),
-        Err(err) => {
-            warn!(
-                event = EVENT_LIFECYCLE_TIER_OPERATION_FAILED,
-                component = LOG_COMPONENT_ECSTORE,
-                subsystem = LOG_SUBSYSTEM_LIFECYCLE,
-                bucket = %oi.bucket,
-                object = %oi.name,
-                operation = "authorize_lifecycle_transition",
-                error = %err,
-                "Lifecycle transition admission failed"
-            );
-            None
-        }
-    }
-}
-
 pub async fn apply_expiry_on_transitioned_object(
     api: Arc<ECStore>,
     oi: &ObjectInfo,
@@ -5734,8 +5551,7 @@ async fn apply_expiry_on_non_transitioned_objects_with_lock_lost_signal(
     bucket_incarnation_id: Uuid,
     lock_lost_signal: Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>>,
 ) -> bool {
-    let Some(publication_guard) = lifecycle_expiry_publication_guard(&api, &oi.bucket, &oi.name, bucket_incarnation_id).await
-    else {
+    let Some(publication_guard) = lifecycle_expiry_publication_guard(&api, oi, bucket_incarnation_id).await else {
         return false;
     };
     let snapshot = match lifecycle_delete_config_snapshot(&api, oi).await {
@@ -5795,10 +5611,8 @@ async fn apply_expiry_on_non_transitioned_objects_with_lock_lost_signal(
     } else {
         None
     };
-    // The delete owns the publication guard from here on, so a cancelled
-    // expiry worker cannot let table-bucket publication overtake it.
     let mut dobj = match api
-        .delete_object_with_tier_delete_journal_and_guards(&oi.bucket, &encode_dir_object(&oi.name), opts, [publication_guard])
+        .delete_object_with_tier_delete_journal(&oi.bucket, &encode_dir_object(&oi.name), opts)
         .await
     {
         Ok(dobj) => dobj,
@@ -6030,7 +5844,6 @@ pub async fn apply_lifecycle_action(event: &lifecycle::Event, src: &LcEventSrc,
 #[cfg(test)]
 mod tests {
     use super::expiry_worker_count;
-    use super::lifecycle_transition_publication_guard;
     use super::{
         DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS, DEFAULT_TRANSITION_QUEUE_CAPACITY, DEFAULT_TRANSITION_WORKERS_ABSOLUTE_MAX,
         DEFAULT_TRANSITION_WORKERS_CAP, EVENT_LIFECYCLE_EVALUATION_FAILED, EVENT_LIFECYCLE_EXPIRED_DETECTED,
@@ -6049,10 +5862,10 @@ mod tests {
         merge_stale_multipart_candidate, persist_manual_transition_job_progress_if_owned,
         persist_manual_transition_page_checkpoint, recover_manual_transition_job, recover_manual_transition_jobs,
         resolve_tier_free_version_recovery_enabled, resolve_transition_queue_capacity, resolve_transition_queue_send_timeout,
-        resolve_transition_worker_count, resolve_transition_workers_absolute_max, run_tier_free_version_recovery_coordinator,
-        run_tier_free_version_recovery_loop, select_restore_s3_location, set_lifecycle_observability_observer,
-        set_recovered_free_version_enqueue_observer, should_defer_date_expiry_for_recent_config_update,
-        transitioned_cleanup_tuple, transitioned_object_delete_opts, wait_for_tier_free_version_recovery,
+        resolve_transition_worker_count, resolve_transition_workers_absolute_max, run_tier_free_version_recovery_loop,
+        select_restore_s3_location, set_lifecycle_observability_observer, set_recovered_free_version_enqueue_observer,
+        should_defer_date_expiry_for_recent_config_update, transitioned_cleanup_tuple, transitioned_object_delete_opts,
+        wait_for_tier_free_version_recovery,
     };
     #[cfg(feature = "test-util")]
     use super::{delete_free_version_remote_object_then, encode_dir_object, get_transitioned_object_reader_with_tier_manager};
@@ -6146,231 +5959,6 @@ mod tests {
     use tokio_util::sync::CancellationToken;
     use uuid::Uuid;
 
-    fn recovery_test_lock() -> (Arc<rustfs_lock::NamespaceLock>, Vec<Arc<dyn rustfs_lock::LockClient>>) {
-        let clients: Vec<Arc<dyn rustfs_lock::LockClient>> = (0..3)
-            .map(|_| {
-                Arc::new(rustfs_lock::LocalClient::with_manager(Arc::new(rustfs_lock::GlobalLockManager::new())))
-                    as Arc<dyn rustfs_lock::LockClient>
-            })
-            .collect();
-        let lock =
-            rustfs_lock::NamespaceLock::with_clients_and_quorum(format!("recovery-test-{}", Uuid::new_v4()), clients.clone(), 2);
-        (Arc::new(lock), clients)
-    }
-
-    async fn acquire_recovery_test_lock(
-        lock: Arc<rustfs_lock::NamespaceLock>,
-        owner: String,
-    ) -> crate::error::Result<Option<rustfs_lock::NamespaceLockGuard>> {
-        // Keep this lease longer than the virtual-time cooldown/idle advances;
-        // production uses the namespace wrapper's renewable 30-second lease.
-        lock.lock_guard(
-            rustfs_lock::ObjectKey::new(crate::disk::RUSTFS_META_BUCKET, super::TIER_FREE_VERSION_RECOVERY_LEADER_LOCK),
-            &owner,
-            StdDuration::from_millis(5),
-            StdDuration::from_secs(3600),
-        )
-        .await
-        .map_err(Into::into)
-    }
-
-    fn recovery_test_retry_delay() -> StdDuration {
-        StdDuration::from_secs(15)
-    }
-
-    #[tokio::test(start_paused = true)]
-    #[serial]
-    async fn tier_free_version_recovery_eight_coordinators_hold_one_leader_and_take_over() {
-        let (lock, _clients) = recovery_test_lock();
-        let (pages_tx, mut pages_rx) = tokio::sync::mpsc::unbounded_channel();
-        let mut tasks = Vec::new();
-        let mut cancels = Vec::new();
-        for node in 0..8 {
-            let cancel = CancellationToken::new();
-            cancels.push(cancel.clone());
-            let lock = Arc::clone(&lock);
-            let pages_tx = pages_tx.clone();
-            tasks.push(tokio::spawn(async move {
-                run_tier_free_version_recovery_coordinator(
-                    cancel,
-                    recovery_test_retry_delay,
-                    move || acquire_recovery_test_lock(Arc::clone(&lock), format!("node-{node}")),
-                    move |leader_cancel| {
-                        let pages_tx = pages_tx.clone();
-                        async move {
-                            let mut pages = 0;
-                            run_tier_free_version_recovery_loop(
-                                leader_cancel,
-                                ExpiryState::new(),
-                                std::convert::identity,
-                                move |bucket, object, _| {
-                                    pages += 1;
-                                    pages_tx.send((node, bucket, object)).expect("page observer should be open");
-                                    std::future::ready(Ok(free_version_recovery_stats(0, 0, pages == 1)))
-                                },
-                            )
-                            .await;
-                        }
-                    },
-                )
-                .await;
-            }));
-        }
-        let (leader, bucket, object) = pages_rx.recv().await.expect("one coordinator should start recovery");
-        assert!(bucket.is_none() && object.is_none());
-        // The same leader must survive both a truncated page's cooldown and
-        // complete idle sweeps. All other coordinators keep probing the lock.
-        let mut observed_pages = 1;
-        for _ in 0..27 {
-            tokio::time::advance(StdDuration::from_secs(60)).await;
-            for _ in 0..100 {
-                tokio::task::yield_now().await;
-            }
-            while let Ok((node, bucket, object)) = pages_rx.try_recv() {
-                assert_eq!(node, leader, "followers must not repeat a namespace sweep");
-                if observed_pages == 1 {
-                    assert_eq!(bucket.as_deref(), Some("bucket"));
-                    assert_eq!(object.as_deref(), Some("object"));
-                } else {
-                    assert!(bucket.is_none() && object.is_none(), "complete sweeps should reset their cursors");
-                }
-                observed_pages += 1;
-            }
-        }
-        assert!(observed_pages >= 7, "the leader should finish a full ten-minute idle wait");
-        cancels[leader].cancel();
-        let (successor, bucket, object) = tokio::time::timeout(StdDuration::from_secs(60), pages_rx.recv())
-            .await
-            .expect("a follower should take over after leader shutdown")
-            .expect("page observer should remain open");
-        assert_ne!(successor, leader);
-        assert!(bucket.is_none() && object.is_none(), "a new leader must restart discovery safely");
-        for cancel in cancels {
-            cancel.cancel();
-        }
-        for task in tasks {
-            task.await.expect("all coordinators should shut down cleanly");
-        }
-    }
-
-    #[tokio::test(start_paused = true)]
-    #[serial]
-    async fn tier_free_version_recovery_lock_loss_waits_for_active_page_cleanup() {
-        let (lock, _clients) = recovery_test_lock();
-        let cancel = CancellationToken::new();
-        let loop_cancel = cancel.clone();
-        let (page_tx, mut page_rx) = tokio::sync::mpsc::unbounded_channel();
-        let cleanup_started = Arc::new(tokio::sync::Notify::new());
-        let finish_cleanup = Arc::new(tokio::sync::Notify::new());
-        let observed_cleanup = Arc::clone(&cleanup_started);
-        let release_cleanup = Arc::clone(&finish_cleanup);
-        let task = tokio::spawn(async move {
-            run_tier_free_version_recovery_coordinator(
-                loop_cancel,
-                recovery_test_retry_delay,
-                move || acquire_recovery_test_lock(Arc::clone(&lock), "old-leader".to_string()),
-                move |leader_cancel| {
-                    let page_tx = page_tx.clone();
-                    let cleanup_started = Arc::clone(&cleanup_started);
-                    let finish_cleanup = Arc::clone(&finish_cleanup);
-                    async move {
-                        run_tier_free_version_recovery_loop(
-                            leader_cancel,
-                            ExpiryState::new(),
-                            std::convert::identity,
-                            move |_, _, page_cancel| {
-                                let cleanup_started = Arc::clone(&cleanup_started);
-                                let finish_cleanup = Arc::clone(&finish_cleanup);
-                                page_tx.send(()).expect("page observer should remain open");
-                                async move {
-                                    page_cancel.cancelled().await;
-                                    cleanup_started.notify_one();
-                                    finish_cleanup.notified().await;
-                                    Err(std::io::Error::new(std::io::ErrorKind::Interrupted, "cancelled page").into())
-                                }
-                            },
-                        )
-                        .await;
-                    }
-                },
-            )
-            .await;
-        });
-        page_rx.recv().await.expect("leader should start an active page");
-        // Let authoritative backend leases expire before the next heartbeat
-        // can renew them. A failed refresh must cancel the active page.
-        tokio::time::advance(StdDuration::from_secs(3600)).await;
-        tokio::time::timeout(StdDuration::from_secs(1), observed_cleanup.notified())
-            .await
-            .expect("expired backend leases must trigger recovery cancellation");
-        assert!(!task.is_finished(), "lock loss must wait for the active page's cleanup");
-        assert!(page_rx.try_recv().is_err(), "the old leader must not start another page");
-        cancel.cancel();
-        release_cleanup.notify_one();
-        task.await.expect("coordinator should finish cleanup before exiting");
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn tier_free_version_recovery_coordinator_retries_without_scanning_after_lock_error() {
-        let cancel = CancellationToken::new();
-        let loop_cancel = cancel.clone();
-        let attempts = Arc::new(AtomicUsize::new(0));
-        let observed_attempts = Arc::clone(&attempts);
-        let task = tokio::spawn(async move {
-            run_tier_free_version_recovery_coordinator(
-                loop_cancel,
-                recovery_test_retry_delay,
-                move || {
-                    observed_attempts.fetch_add(1, Ordering::SeqCst);
-                    std::future::ready(Err(rustfs_lock::LockError::InsufficientNodes {
-                        required: 2,
-                        available: 1,
-                    }
-                    .into()))
-                },
-                |_| async { panic!("a node without ownership must never start discovery") },
-            )
-            .await;
-        });
-        tokio::task::yield_now().await;
-        assert_eq!(attempts.load(Ordering::SeqCst), 1);
-        tokio::time::advance(StdDuration::from_secs(14)).await;
-        assert_eq!(attempts.load(Ordering::SeqCst), 1, "lock errors must not cause a tight retry loop");
-        tokio::time::advance(StdDuration::from_secs(1)).await;
-        tokio::task::yield_now().await;
-        assert_eq!(attempts.load(Ordering::SeqCst), 2);
-        cancel.cancel();
-        task.await.expect("a follower should respond to shutdown during retry wait");
-    }
-
-    #[tokio::test]
-    async fn tier_free_version_recovery_enqueue_cancels_while_waiting_for_state_lock() {
-        let state = ExpiryState::new();
-        let (tx, mut rx) = tokio::sync::mpsc::channel(1);
-        let mut held = state.write().await;
-        held.tasks_tx.push(tx);
-        let cancel = CancellationToken::new();
-        let enqueue_cancel = cancel.clone();
-        let enqueue_state = Arc::clone(&state);
-        let enqueue = tokio::spawn(async move {
-            enqueue_recovered_free_version_with_state(&enqueue_state, ObjectInfo::default(), &enqueue_cancel).await
-        });
-        tokio::task::yield_now().await;
-        assert!(!enqueue.is_finished(), "enqueue should be blocked on the state lock");
-        cancel.cancel();
-        let queued = tokio::time::timeout(StdDuration::from_secs(1), enqueue)
-            .await
-            .expect("cancellation must not wait for the state write guard")
-            .expect("enqueue should return cleanly");
-        assert!(!queued);
-        assert_eq!(held.pending_tasks(), 0);
-        assert_eq!(held.stats.missed_free_vers_tasks(), 0);
-        assert!(rx.try_recv().is_err(), "a cancelled recovery must not enqueue a task");
-        drop(held);
-        assert!(!enqueue_recovered_free_version_with_state(&state, ObjectInfo::default(), &cancel).await);
-        assert!(rx.try_recv().is_err(), "cancellation must win even when the lock is available");
-    }
-
     fn free_version_recovery_stats(enqueued: usize, failed: usize, truncated: bool) -> FreeVersionRecoveryStats {
         FreeVersionRecoveryStats {
             scanned: enqueued.saturating_add(failed),
@@ -8050,7 +7638,7 @@ mod tests {
         assert_eq!(state.read().await.stats.pending_tasks(), 1);
 
         // The single-slot queue is full for both enqueue paths.
-        assert!(!enqueue_recovered_free_version_with_state(&state, oi.clone(), &CancellationToken::new()).await);
+        assert!(!enqueue_recovered_free_version_with_state(&state, oi.clone()).await);
         assert_eq!(state.read().await.stats.pending_tasks(), 1);
         assert_eq!(state.read().await.stats.missed_free_vers_tasks(), 1);
 
@@ -8082,7 +7670,7 @@ mod tests {
             ..Default::default()
         };
 
-        let queued = enqueue_recovered_free_version_with_state(&state, oi, &CancellationToken::new()).await;
+        let queued = enqueue_recovered_free_version_with_state(&state, oi).await;
         let state = state.read().await;
 
         assert!(!queued);
@@ -8211,8 +7799,8 @@ mod tests {
             ..Default::default()
         };
 
-        let first = enqueue_recovered_free_version_with_state(&state, oi.clone(), &CancellationToken::new()).await;
-        let second = enqueue_recovered_free_version_with_state(&state, oi, &CancellationToken::new()).await;
+        let first = enqueue_recovered_free_version_with_state(&state, oi.clone()).await;
+        let second = enqueue_recovered_free_version_with_state(&state, oi).await;
         let state = state.read().await;
 
         assert!(first);
@@ -8313,7 +7901,7 @@ mod tests {
         };
 
         assert!(
-            super::enqueue_recovered_free_version_with_cancel(&ecstore, oi, &CancellationToken::new()).await,
+            super::enqueue_recovered_free_version(&ecstore, oi).await,
             "the resized production worker queue should accept the task"
         );
         stop_tx.send(None).await.expect("worker stop signal should be delivered");
@@ -13440,171 +13028,6 @@ mod tests {
         }
     }
 
-    #[tokio::test]
-    #[serial]
-    async fn queued_noncurrent_batch_expiry_does_not_delete_from_table_bucket() {
-        let (_disk_paths, ecstore) = setup_test_env().await;
-        let bucket = format!("table-noncurrent-lifecycle-{}", Uuid::new_v4().simple());
-        let object = "tables/table-id/data/part-00001.parquet";
-        create_test_bucket(&ecstore, &bucket).await;
-        metadata_sys::update_in(
-            &ecstore.ctx,
-            &bucket,
-            BUCKET_VERSIONING_CONFIG,
-            b"<VersioningConfiguration><Status>Enabled</Status></VersioningConfiguration>".to_vec(),
-        )
-        .await
-        .expect("bucket versioning should be enabled");
-
-        let mut old_reader = PutObjReader::from_vec(b"old table data".to_vec());
-        let old = ecstore
-            .put_object(
-                &bucket,
-                object,
-                &mut old_reader,
-                &ObjectOptions {
-                    versioned: true,
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("the historical table version should be created");
-        let old_version_id = old.version_id.expect("the historical version should have an identity");
-        let mut current_reader = PutObjReader::from_vec(b"current table data".to_vec());
-        ecstore
-            .put_object(
-                &bucket,
-                object,
-                &mut current_reader,
-                &ObjectOptions {
-                    versioned: true,
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("the current table version should be created");
-
-        let incarnation = ecstore
-            .bucket_incarnation_id_from_disk(&bucket)
-            .await
-            .expect("bucket incarnation should be available");
-        let publication_lock = ecstore
-            .new_ns_lock(&bucket, rustfs_common::table_catalog::TABLE_BUCKET_PUBLICATION_LOCK_PATH)
-            .await
-            .expect("table-bucket publication lock should be created");
-        let enable_guard = publication_lock
-            .get_write_lock(get_lock_acquire_timeout())
-            .await
-            .expect("table-bucket enablement should acquire the publication lock");
-
-        let delete_store = ecstore.clone();
-        let delete_bucket = bucket.clone();
-        let delete_object = object.to_string();
-        let mut delete = tokio::spawn(async move {
-            let target = ObjectToDelete {
-                object_name: delete_object,
-                version_id: Some(old_version_id),
-                ..Default::default()
-            };
-            crate::bucket::lifecycle::object_handlers_common::delete_object_versions(
-                &delete_store,
-                &delete_bucket,
-                std::slice::from_ref(&target),
-                lifecycle::Event::default(),
-                incarnation,
-            )
-            .await
-        });
-        tokio::task::yield_now().await;
-        assert!(
-            tokio::time::timeout(StdDuration::from_millis(100), &mut delete)
-                .await
-                .is_err(),
-            "noncurrent lifecycle cleanup must wait for the table-bucket publication fence"
-        );
-
-        let sys = metadata_sys::bucket_metadata_sys_of(&ecstore.ctx).expect("metadata system should be initialized");
-        let sys = sys.read().await.clone();
-        let mut metadata = (*sys.get(&bucket).await.expect("bucket metadata should exist")).clone();
-        metadata.table_bucket_config_json = br#"{"enabled":true}"#.to_vec();
-        sys.persist_and_set(metadata)
-            .await
-            .expect("table bucket marker should be persisted");
-        sys.reload_from_store(&bucket)
-            .await
-            .expect("table bucket marker should become authoritative");
-        drop(enable_guard);
-
-        let failed = tokio::time::timeout(StdDuration::from_secs(2), delete)
-            .await
-            .expect("noncurrent lifecycle cleanup should resume after the fence is released")
-            .expect("noncurrent lifecycle cleanup task should join");
-        assert_eq!(failed, 1, "table-bucket noncurrent cleanup must be rejected");
-        assert!(
-            ecstore
-                .get_object_info(
-                    &bucket,
-                    object,
-                    &ObjectOptions {
-                        version_id: Some(old_version_id.to_string()),
-                        versioned: true,
-                        ..Default::default()
-                    },
-                )
-                .await
-                .is_ok(),
-            "table data must remain after queued noncurrent cleanup is rejected"
-        );
-    }
-
-    #[tokio::test]
-    #[serial]
-    async fn lifecycle_transition_admission_holds_publication_reader() {
-        let (_disk_paths, ecstore) = setup_test_env().await;
-        let bucket = format!("lifecycle-transition-{}", Uuid::new_v4().simple());
-        let object = "tables/table-id/data/part-00001.parquet";
-        create_test_bucket(&ecstore, &bucket).await;
-        let object_info = ObjectInfo {
-            bucket: bucket.clone(),
-            name: object.to_string(),
-            ..Default::default()
-        };
-
-        let publication_lock = ecstore
-            .new_ns_lock(&bucket, rustfs_common::table_catalog::TABLE_BUCKET_PUBLICATION_LOCK_PATH)
-            .await
-            .expect("table-bucket publication lock should be created");
-        let enable_guard = publication_lock
-            .get_write_lock(get_lock_acquire_timeout())
-            .await
-            .expect("publication writer should be acquired");
-        let admission_store = ecstore.clone();
-        let admission_object = object_info.clone();
-        let mut admission =
-            tokio::spawn(async move { lifecycle_transition_publication_guard(&admission_store, &admission_object).await });
-        assert!(
-            tokio::time::timeout(StdDuration::from_millis(100), &mut admission)
-                .await
-                .is_err(),
-            "transition admission must wait for an in-progress table publication"
-        );
-        drop(enable_guard);
-
-        let (transition_guard, incarnation) = tokio::time::timeout(StdDuration::from_secs(2), admission)
-            .await
-            .expect("transition admission should resume after publication")
-            .expect("transition admission task should join")
-            .expect("transition admission should succeed");
-        assert_ne!(incarnation, Uuid::nil(), "transition admission must bind a bucket incarnation");
-        let blocked_writer = publication_lock.get_write_lock(StdDuration::from_millis(100)).await;
-        assert!(blocked_writer.is_err(), "transition admission must retain the publication read lock");
-        drop(transition_guard);
-        publication_lock
-            .get_write_lock(get_lock_acquire_timeout())
-            .await
-            .expect("publication writer should proceed after transition admission releases its guard");
-    }
-
     #[tokio::test]
     #[serial]
     async fn queued_delete_all_rechecks_a_same_id_rule_moved_into_the_future() {
@@ -14207,10 +13630,6 @@ mod tests {
         .await;
     }
 
-    fn fast_tier_free_version_recovery_leader_retry_delay() -> StdDuration {
-        StdDuration::from_millis(10)
-    }
-
     #[tokio::test]
     #[serial]
     async fn tier_free_version_recovery_production_entrypoint_enqueues_seeded_item() {
@@ -14226,13 +13645,8 @@ mod tests {
         seed_recoverable_free_version(&disk_paths, &bucket, object, None, None).await;
 
         let started = OnceLock::new();
-        let recovery = super::spawn_tier_free_version_recovery_once_with_options(
-            Arc::clone(&ecstore),
-            &started,
-            format!("tier-free-version-recovery/test/{}", Uuid::new_v4()),
-            fast_tier_free_version_recovery_leader_retry_delay,
-        )
-        .expect("production recovery entrypoint should start once");
+        let recovery = super::spawn_tier_free_version_recovery_once(Arc::clone(&ecstore), &started)
+            .expect("production recovery entrypoint should start once");
         let task = tokio::time::timeout(StdDuration::from_secs(30), async { recovery_rx.lock().await.recv().await })
             .await
             .expect("production recovery entrypoint should enqueue the seeded item")
@@ -14275,14 +13689,13 @@ mod tests {
         };
         let mut recovery_rx = recovery_rx.lock().await;
         assert!(
-            super::enqueue_recovered_free_version_with_cancel(
+            super::enqueue_recovered_free_version(
                 &ecstore,
                 ObjectInfo {
                     bucket: "prefill".to_string(),
                     name: "prefill".to_string(),
                     ..Default::default()
                 },
-                &CancellationToken::new(),
             )
             .await,
             "the production recovery queue should accept its first task"

crates/ecstore/src/bucket/lifecycle/object_handlers_common.rs

@@ -36,10 +36,6 @@ pub async fn delete_object_versions(
     _lc_event: lifecycle::Event,
     bucket_incarnation_id: Uuid,
 ) -> usize {
-    if to_del.is_empty() {
-        return 0;
-    }
-
     if to_del.iter().any(|target| {
         target.version_id.is_none()
             || (target.version_id.is_some_and(|version_id| version_id.is_nil()) && target.expected_identity.is_none())
@@ -56,25 +52,6 @@ pub async fn delete_object_versions(
         return to_del.len();
     }
 
-    let Some(publication_guard) = super::bucket_lifecycle_ops::lifecycle_expiry_publication_guard(
-        api,
-        bucket,
-        to_del[0].object_name.as_str(),
-        bucket_incarnation_id,
-    )
-    .await
-    else {
-        debug!(
-            event = EVENT_LIFECYCLE_CLEANUP_SKIPPED,
-            component = LOG_COMPONENT_ECSTORE,
-            subsystem = LOG_SUBSYSTEM_LIFECYCLE,
-            bucket,
-            target_count = to_del.len(),
-            reason = "publication_admission_rejected",
-            "Skipped lifecycle noncurrent version cleanup"
-        );
-        return to_del.len();
-    };
     let delete_config_snapshot = match ReplicationObjectBridge::delete_request_config(api, bucket).await {
         Ok(snapshot) => Arc::new(snapshot),
         Err(err) => {
@@ -101,13 +78,17 @@ pub async fn delete_object_versions(
             remaining = &[];
         }
 
-        let mut delete_options = ObjectOptions {
-            delete_replication_config_snapshot: Some(Arc::clone(&delete_config_snapshot)),
-            expected_bucket_incarnation_id: Some(bucket_incarnation_id),
-            ..Default::default()
-        };
-        delete_options.add_namespace_lock_guard(&publication_guard);
-        let (mut deleted_objs, errors) = api.delete_objects(bucket, to_del.to_vec(), delete_options).await;
+        let (mut deleted_objs, errors) = api
+            .delete_objects(
+                bucket,
+                to_del.to_vec(),
+                ObjectOptions {
+                    delete_replication_config_snapshot: Some(Arc::clone(&delete_config_snapshot)),
+                    expected_bucket_incarnation_id: Some(bucket_incarnation_id),
+                    ..Default::default()
+                },
+            )
+            .await;
         failed += errors.iter().filter(|err| err.is_some()).count();
 
         for (i, deleted_obj) in deleted_objs.iter_mut().enumerate() {

crates/ecstore/src/bucket/lifecycle/recovery_disposition.rs

@@ -1122,11 +1122,9 @@ pub(crate) async fn resume_recovery_disposition(
     // Lock order is control record, then legacy source. Disposition revisions
     // use ETag CAS and never acquire either namespace lock internally.
     let control_lock = api.new_ns_lock(RUSTFS_META_BUCKET, &control_object).await?;
-    let control_guard = Arc::new(
-        control_lock
-            .get_read_lock(crate::set_disk::get_lock_acquire_timeout())
-            .await?,
-    );
+    let control_guard = control_lock
+        .get_read_lock(crate::set_disk::get_lock_acquire_timeout())
+        .await?;
     let source_lock = api
         .new_ns_lock(RUSTFS_META_BUCKET, &initial.disposition.identity.canonical_source_path)
         .await?;
@@ -1506,7 +1504,7 @@ fn control_is_abandoned_successor(disposition: &IlmRecoveryDisposition, control:
 async fn abandon_recovery_control_fenced(
     api: Arc<ECStore>,
     disposition: &IlmRecoveryDisposition,
-    control_guard: &Arc<rustfs_lock::NamespaceLockGuard>,
+    control_guard: &rustfs_lock::NamespaceLockGuard,
     source_guard: &rustfs_lock::NamespaceLockGuard,
     proof: &IlmRecoveryExportFleetProofToken,
 ) -> EcstoreResult<()> {
@@ -1559,7 +1557,7 @@ async fn abandon_recovery_control_fenced(
         }),
         ..Default::default()
     };
-    options.add_owned_write_lock(Arc::clone(control_guard), RUSTFS_META_BUCKET, &object);
+    options.add_namespace_lock_guard(control_guard);
     options.add_namespace_lock_guard(source_guard);
     let write_result = config_boundary::save_config_with_opts(api.clone(), &object, encoded, &options).await;
     let observed = match load_recovery_control_no_lock(api.clone(), disposition).await {
@@ -1632,7 +1630,7 @@ async fn delete_exact_local_recovery_copy(
     api: Arc<ECStore>,
     copy: &IlmRecoverySourceCopy,
     source_schema: &str,
-    control_guard: &Arc<rustfs_lock::NamespaceLockGuard>,
+    control_guard: &rustfs_lock::NamespaceLockGuard,
     source_guard: &rustfs_lock::NamespaceLockGuard,
 ) -> EcstoreResult<()> {
     let set = recovery_copy_set(&api, &copy.authority)?;
@@ -1706,7 +1704,7 @@ async fn save_recovery_disposition_step_fenced(
     api: Arc<ECStore>,
     current: &ObservedIlmRecoveryDisposition,
     next: &IlmRecoveryDisposition,
-    control_guard: &Arc<rustfs_lock::NamespaceLockGuard>,
+    control_guard: &rustfs_lock::NamespaceLockGuard,
     source_guard: &rustfs_lock::NamespaceLockGuard,
     proof: &IlmRecoveryExportFleetProofToken,
 ) -> EcstoreResult<ObservedIlmRecoveryDisposition> {

crates/ecstore/src/bucket/lifecycle/tier_free_version_recovery.rs

@@ -20,7 +20,7 @@ use std::time::Duration;
 use tokio::sync::mpsc;
 use tokio_util::sync::CancellationToken;
 
-use crate::bucket::lifecycle::bucket_lifecycle_ops::enqueue_recovered_free_version_with_cancel;
+use crate::bucket::lifecycle::bucket_lifecycle_ops::enqueue_recovered_free_version;
 use crate::disk::RUSTFS_META_BUCKET;
 use crate::error::Result;
 use crate::object_api::ObjectInfo;
@@ -201,11 +201,7 @@ pub(super) async fn recover_tier_free_versions_with_cancel(
             return Err(tier_free_version_recovery_cancelled());
         }
         retry_cursor.visit(&oi);
-        let queued = enqueue_recovered_free_version_with_cancel(&api, oi, &cancel_token).await;
-        if cancel_token.is_cancelled() {
-            return Err(tier_free_version_recovery_cancelled());
-        }
-        if !record_recovered_free_version_enqueue(&mut stats, queued) {
+        if !record_recovered_free_version_enqueue(&mut stats, enqueue_recovered_free_version(&api, oi).await) {
             let (bucket_marker, object_marker) = retry_cursor.retry_markers();
             stats.truncated = true;
             stats.next_bucket_marker = bucket_marker;

crates/ecstore/src/bucket/metadata.rs

@@ -1210,7 +1210,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.notification_config = None;
         if !self.notification_config_xml.is_empty()
             && let Err(e) = deserialize::<NotificationConfiguration>(&self.notification_config_xml)
                 .map(|c| self.notification_config = Some(c))
@@ -1225,7 +1224,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.lifecycle_config = None;
         if !self.lifecycle_config_xml.is_empty()
             && let Err(e) =
                 deserialize::<BucketLifecycleConfiguration>(&self.lifecycle_config_xml).map(|c| self.lifecycle_config = Some(c))
@@ -1240,7 +1238,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.object_lock_config = None;
         if !self.object_lock_config_xml.is_empty()
             && let Err(e) =
                 deserialize::<ObjectLockConfiguration>(&self.object_lock_config_xml).map(|c| self.object_lock_config = Some(c))
@@ -1270,7 +1267,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.sse_config = None;
         if !self.encryption_config_xml.is_empty()
             && let Err(e) =
                 deserialize::<ServerSideEncryptionConfiguration>(&self.encryption_config_xml).map(|c| self.sse_config = Some(c))
@@ -1285,7 +1281,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.tagging_config = None;
         if !self.tagging_config_xml.is_empty()
             && let Err(e) = deserialize::<Tagging>(&self.tagging_config_xml).map(|c| self.tagging_config = Some(c))
         {
@@ -1351,7 +1346,6 @@ impl BucketMetadata {
         } else {
             self.bucket_target_config = Some(BucketTargets::default());
         }
-        self.cors_config = None;
         if !self.cors_config_xml.is_empty()
             && let Err(e) = deserialize::<CORSConfiguration>(&self.cors_config_xml).map(|c| self.cors_config = Some(c))
         {
@@ -1365,7 +1359,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.logging_config = None;
         if !self.logging_config_xml.is_empty()
             && let Err(e) = deserialize::<BucketLoggingStatus>(&self.logging_config_xml).map(|c| self.logging_config = Some(c))
         {
@@ -1379,7 +1372,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.website_config = None;
         if !self.website_config_xml.is_empty()
             && let Err(e) = deserialize::<WebsiteConfiguration>(&self.website_config_xml).map(|c| self.website_config = Some(c))
         {
@@ -1393,7 +1385,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.accelerate_config = None;
         if !self.accelerate_config_xml.is_empty()
             && let Err(e) =
                 deserialize::<AccelerateConfiguration>(&self.accelerate_config_xml).map(|c| self.accelerate_config = Some(c))
@@ -1408,7 +1399,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.request_payment_config = None;
         if !self.request_payment_config_xml.is_empty()
             && let Err(e) = deserialize::<RequestPaymentConfiguration>(&self.request_payment_config_xml)
                 .map(|c| self.request_payment_config = Some(c))
@@ -1423,7 +1413,6 @@ impl BucketMetadata {
                 "Failed to parse bucket metadata config"
             );
         }
-        self.public_access_block_config = None;
         if !self.public_access_block_config_xml.is_empty()
             && let Err(e) = deserialize::<PublicAccessBlockConfiguration>(&self.public_access_block_config_xml)
                 .map(|c| self.public_access_block_config = Some(c))
@@ -1984,156 +1973,6 @@ mod test {
         assert_eq!(bm.lifecycle_config_xml, malformed_xml, "raw bytes are retained");
     }
 
-    const REPARSE_XML_FIXTURES: [(&str, &[u8]); 13] = [
-        (BUCKET_NOTIFICATION_CONFIG, br#"<NotificationConfiguration/>"#),
-        (
-            BUCKET_LIFECYCLE_CONFIG,
-            br#"<LifecycleConfiguration><Rule><ID>keep</ID><Status>Enabled</Status><Expiration><Days>30</Days></Expiration></Rule></LifecycleConfiguration>"#,
-        ),
-        (
-            OBJECT_LOCK_CONFIG,
-            br#"<ObjectLockConfiguration><ObjectLockEnabled>Enabled</ObjectLockEnabled><Rule><DefaultRetention><Mode>GOVERNANCE</Mode><Days>7</Days></DefaultRetention></Rule></ObjectLockConfiguration>"#,
-        ),
-        (BUCKET_VERSIONING_CONFIG, br#"<VersioningConfiguration><Status>Enabled</Status></VersioningConfiguration>"#),
-        (
-            BUCKET_SSECONFIG,
-            br#"<ServerSideEncryptionConfiguration><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>"#,
-        ),
-        (BUCKET_TAGGING_CONFIG, br#"<Tagging><TagSet><Tag><Key>team</Key><Value>blue</Value></Tag></TagSet></Tagging>"#),
-        (
-            BUCKET_REPLICATION_CONFIG,
-            br#"<ReplicationConfiguration><Role>arn:aws:iam::123456789012:role/replication-role</Role><Rule><ID>copy</ID><Status>Enabled</Status><Prefix>documents/</Prefix><Destination><Bucket>arn:aws:s3:::destination-bucket</Bucket></Destination></Rule></ReplicationConfiguration>"#,
-        ),
-        (
-            BUCKET_CORS_CONFIG,
-            br#"<CORSConfiguration><CORSRule><AllowedOrigin>https://example.test</AllowedOrigin><AllowedMethod>GET</AllowedMethod></CORSRule></CORSConfiguration>"#,
-        ),
-        (BUCKET_LOGGING_CONFIG, br#"<BucketLoggingStatus/>"#),
-        (BUCKET_WEBSITE_CONFIG, br#"<WebsiteConfiguration><IndexDocument><Suffix>index.html</Suffix></IndexDocument></WebsiteConfiguration>"#),
-        (BUCKET_ACCELERATE_CONFIG, br#"<AccelerateConfiguration><Status>Enabled</Status></AccelerateConfiguration>"#),
-        (BUCKET_REQUEST_PAYMENT_CONFIG, br#"<RequestPaymentConfiguration><Payer>BucketOwner</Payer></RequestPaymentConfiguration>"#),
-        (
-            BUCKET_PUBLIC_ACCESS_BLOCK_CONFIG,
-            br#"<PublicAccessBlockConfiguration><BlockPublicAcls>true</BlockPublicAcls><IgnorePublicAcls>true</IgnorePublicAcls><BlockPublicPolicy>true</BlockPublicPolicy><RestrictPublicBuckets>true</RestrictPublicBuckets></PublicAccessBlockConfiguration>"#,
-        ),
-    ];
-
-    fn reparse_xml_state(bm: &BucketMetadata, config: &str) -> &'static str {
-        fn state<T>(raw: &[u8], parsed: &Option<T>) -> &'static str {
-            match ConfigState::of(raw, parsed) {
-                ConfigState::Absent => "absent",
-                ConfigState::Valid(_) => "valid",
-                ConfigState::Unreadable { .. } => "unreadable",
-            }
-        }
-        match config {
-            BUCKET_NOTIFICATION_CONFIG => state(&bm.notification_config_xml, &bm.notification_config),
-            BUCKET_LIFECYCLE_CONFIG => state(&bm.lifecycle_config_xml, &bm.lifecycle_config),
-            OBJECT_LOCK_CONFIG => state(&bm.object_lock_config_xml, &bm.object_lock_config),
-            BUCKET_VERSIONING_CONFIG => state(&bm.versioning_config_xml, &bm.versioning_config),
-            BUCKET_SSECONFIG => state(&bm.encryption_config_xml, &bm.sse_config),
-            BUCKET_TAGGING_CONFIG => state(&bm.tagging_config_xml, &bm.tagging_config),
-            BUCKET_REPLICATION_CONFIG => state(&bm.replication_config_xml, &bm.replication_config),
-            BUCKET_CORS_CONFIG => state(&bm.cors_config_xml, &bm.cors_config),
-            BUCKET_LOGGING_CONFIG => state(&bm.logging_config_xml, &bm.logging_config),
-            BUCKET_WEBSITE_CONFIG => state(&bm.website_config_xml, &bm.website_config),
-            BUCKET_ACCELERATE_CONFIG => state(&bm.accelerate_config_xml, &bm.accelerate_config),
-            BUCKET_REQUEST_PAYMENT_CONFIG => state(&bm.request_payment_config_xml, &bm.request_payment_config),
-            BUCKET_PUBLIC_ACCESS_BLOCK_CONFIG => state(&bm.public_access_block_config_xml, &bm.public_access_block_config),
-            _ => panic!("unknown XML config: {config}"),
-        }
-    }
-
-    // A persisted payload can change without going through the request decoder.
-    fn replace_xml_raw(bm: &mut BucketMetadata, config: &str, raw: Vec<u8>) {
-        match config {
-            BUCKET_NOTIFICATION_CONFIG => bm.notification_config_xml = raw,
-            BUCKET_LIFECYCLE_CONFIG => bm.lifecycle_config_xml = raw,
-            OBJECT_LOCK_CONFIG => bm.object_lock_config_xml = raw,
-            BUCKET_VERSIONING_CONFIG => bm.versioning_config_xml = raw,
-            BUCKET_SSECONFIG => bm.encryption_config_xml = raw,
-            BUCKET_TAGGING_CONFIG => bm.tagging_config_xml = raw,
-            BUCKET_REPLICATION_CONFIG => bm.replication_config_xml = raw,
-            BUCKET_CORS_CONFIG => bm.cors_config_xml = raw,
-            BUCKET_LOGGING_CONFIG => bm.logging_config_xml = raw,
-            BUCKET_WEBSITE_CONFIG => bm.website_config_xml = raw,
-            BUCKET_ACCELERATE_CONFIG => bm.accelerate_config_xml = raw,
-            BUCKET_REQUEST_PAYMENT_CONFIG => bm.request_payment_config_xml = raw,
-            BUCKET_PUBLIC_ACCESS_BLOCK_CONFIG => bm.public_access_block_config_xml = raw,
-            _ => panic!("unknown XML config: {config}"),
-        }
-    }
-
-    #[test]
-    fn reparse_xml_rejects_stale_views_after_corruption() {
-        let corrupt = b"<not-a-valid-document";
-        for (config, valid) in REPARSE_XML_FIXTURES {
-            let mut bm = BucketMetadata::new("reparse-corrupt");
-            bm.update_config(config, valid.to_vec()).expect("store valid XML");
-            bm.parse_all_configs().expect("parse valid XML");
-            assert_eq!(reparse_xml_state(&bm, config), "valid", "{config}: valid setup");
-
-            replace_xml_raw(&mut bm, config, corrupt.to_vec());
-            let before = bm.marshal_msg().expect("marshal corrupt raw metadata");
-            bm.parse_all_configs()
-                .expect("one corrupt config must not fail the metadata load");
-
-            assert_eq!(reparse_xml_state(&bm, config), "unreadable", "{config}: stale view accepted");
-            assert_eq!(bm.xml_config_unreadable_len(config), Some(corrupt.len()), "{config}: missing refusal");
-            assert_eq!(
-                bm.marshal_msg().expect("marshal reparsed metadata"),
-                before,
-                "{config}: persisted bytes changed"
-            );
-        }
-    }
-
-    #[test]
-    fn reparse_xml_clears_stale_views_after_raw_is_removed() {
-        for (config, valid) in REPARSE_XML_FIXTURES {
-            let mut bm = BucketMetadata::new("reparse-removed");
-            bm.update_config(config, valid.to_vec()).expect("store valid XML");
-            bm.parse_all_configs().expect("parse valid XML");
-            assert_eq!(reparse_xml_state(&bm, config), "valid", "{config}: valid setup");
-
-            replace_xml_raw(&mut bm, config, Vec::new());
-            let before = bm.marshal_msg().expect("marshal absent raw metadata");
-            bm.parse_all_configs().expect("parse removed XML");
-
-            assert_eq!(reparse_xml_state(&bm, config), "absent", "{config}: stale view survived removal");
-            assert!(!bm.xml_config_unreadable(config), "{config}: absence is not corruption");
-            assert_eq!(
-                bm.marshal_msg().expect("marshal reparsed metadata"),
-                before,
-                "{config}: persisted bytes changed"
-            );
-        }
-    }
-
-    #[test]
-    fn reparse_xml_recovers_after_corrupt_raw_is_repaired() {
-        for (config, valid) in REPARSE_XML_FIXTURES {
-            let mut bm = BucketMetadata::new("reparse-repaired");
-            bm.update_config(config, valid.to_vec()).expect("store valid XML");
-            bm.parse_all_configs().expect("parse valid XML");
-            replace_xml_raw(&mut bm, config, b"<not-a-valid-document".to_vec());
-            bm.parse_all_configs().expect("parse corrupt XML");
-            assert_eq!(reparse_xml_state(&bm, config), "unreadable", "{config}: corrupt setup");
-
-            replace_xml_raw(&mut bm, config, valid.to_vec());
-            let before = bm.marshal_msg().expect("marshal repaired raw metadata");
-            bm.parse_all_configs().expect("parse repaired XML");
-
-            assert_eq!(reparse_xml_state(&bm, config), "valid", "{config}: repaired config must become readable");
-            assert!(!bm.xml_config_unreadable(config), "{config}: repaired config is not corrupt");
-            assert_eq!(
-                bm.marshal_msg().expect("marshal reparsed metadata"),
-                before,
-                "{config}: persisted bytes changed"
-            );
-        }
-    }
-
     #[test]
     fn lifecycle_update_config_clears_parsed_config_on_delete() {
         let mut bm = BucketMetadata::new("test-bucket");

crates/ecstore/src/bucket/metadata_sys.rs

@@ -576,27 +576,6 @@ pub(crate) async fn update_in(
     Box::pin(update_with_sys(require_bucket_metadata_sys_in(ctx)?, bucket, config_file, data)).await
 }
 
-/// Validate a caller's fence after acquiring the lifecycle and metadata
-/// transaction locks, before changing the configuration.
-pub(crate) async fn update_validated_in<F>(
-    ctx: &crate::runtime::instance::InstanceContext,
-    bucket: &str,
-    config_file: &str,
-    data: Vec<u8>,
-    validate: F,
-) -> Result<OffsetDateTime>
-where
-    F: FnOnce() -> Result<()> + Send,
-{
-    Box::pin(async {
-        let sys = require_bucket_metadata_sys_in(ctx)?;
-        let guard = acquire_config_write_guard(sys.clone(), bucket).await?;
-        validate()?;
-        update_under_config_write_guard(sys, &guard, config_file, data, None).await
-    })
-    .await
-}
-
 pub async fn delete(bucket: &str, config_file: &str) -> Result<OffsetDateTime> {
     delete_with_sys(get_bucket_metadata_sys()?, bucket, config_file).await
 }
@@ -1153,7 +1132,7 @@ async fn acquire_transaction_lock_with_sys(
 /// agree on, so renaming it would leave a mixed-version cluster with two
 /// disjoint keys — and old and new nodes would stop excluding each other on
 /// the very writes that are serialized today.
-pub(crate) fn bucket_metadata_transaction_lock_key(bucket: &str) -> String {
+fn bucket_metadata_transaction_lock_key(bucket: &str) -> String {
     format!("bucket-targets/{bucket}/transaction.lock")
 }
 
@@ -1292,34 +1271,14 @@ pub(crate) async fn get_object_lock_config_state_in(
 pub(crate) async fn get_object_lock_config_and_incarnation_from_disk_in(
     ctx: &crate::runtime::instance::InstanceContext,
     bucket: &str,
-) -> Result<(ObjectLockConfigState, Uuid, OffsetDateTime)> {
-    get_object_lock_config_and_incarnation_from_disk_with_guard_in(ctx, bucket, None).await
-}
-
-/// Bucket deletion already owns the namespace/lifecycle fences. Reuse its
-/// live guard rather than recursively acquiring the bucket namespace lock.
-/// The caller must also hold the metadata transaction read lock.
-pub(crate) async fn get_object_lock_config_and_incarnation_from_disk_with_guard_in(
-    ctx: &crate::runtime::instance::InstanceContext,
-    bucket: &str,
-    guard: Option<&rustfs_lock::NamespaceLockGuard>,
 ) -> Result<(ObjectLockConfigState, Uuid, OffsetDateTime)> {
     let bucket_meta_sys_lock = bucket_metadata_sys_of(ctx)?;
     let bucket_meta_sys = bucket_meta_sys_lock.read().await.clone();
 
-    let authority = match guard {
-        Some(guard) => {
-            bucket_meta_sys
-                .read_authoritative_metadata_from_disk_under_guard(bucket, guard)
-                .await?
-        }
-        None => {
-            bucket_meta_sys
-                .read_authoritative_metadata_from_disk_under_transaction_lock(bucket)
-                .await?
-        }
-    };
-    match authority {
+    match bucket_meta_sys
+        .read_authoritative_metadata_from_disk_under_transaction_lock(bucket)
+        .await?
+    {
         BucketMetadataAuthority::Authoritative(metadata)
             if metadata.bucket_incarnation_sidecar && !metadata.bucket_incarnation_id.is_nil() =>
         {
@@ -1372,54 +1331,10 @@ pub(crate) async fn get_quota_config_and_incarnation_from_disk_in(
     let bucket_meta_sys_lock = bucket_metadata_sys_of(ctx)?;
     let bucket_meta_sys = bucket_meta_sys_lock.read().await.clone();
 
-    quota_config_and_incarnation_from_authority(
-        bucket,
-        bucket_meta_sys
-            .read_authoritative_metadata_from_disk_under_transaction_lock(bucket)
-            .await?,
-    )
-}
-
-pub(crate) async fn get_quota_config_and_incarnation_from_disk_for_options_in(
-    ctx: &crate::runtime::instance::InstanceContext,
-    bucket: &str,
-    opts: &ObjectOptions,
-    transaction_guard: &Arc<rustfs_lock::NamespaceLockGuard>,
-) -> Result<(Option<BucketQuota>, Uuid, OffsetDateTime)> {
-    let Some(snapshot) = opts.object_lock_config_snapshot.as_ref() else {
-        return get_quota_config_and_incarnation_from_disk_in(ctx, bucket).await;
-    };
-    let sys = bucket_metadata_sys_of(ctx)?.read().await.clone();
-    let store = sys.object_store();
-    let snapshot_guard = snapshot
-        .metadata_transaction_guard_for(store.id, bucket, opts.expected_bucket_incarnation_id)
-        .filter(|guard| Arc::ptr_eq(guard, transaction_guard))
-        .ok_or_else(|| Error::other("quota snapshot does not hold this bucket's metadata transaction fence"))?;
-    if snapshot_guard.is_released() {
-        return Err(Error::other("quota snapshot metadata transaction fence was released"));
-    }
-
-    // The snapshot carries the caller's lifecycle fence, excluding deletion.
-    // Its transaction guard excludes config writes, so a same-name object
-    // owner need not recursively acquire the bucket namespace here.
-    let authority = sys
-        .read_authoritative_metadata_from_disk_under_guard(bucket, transaction_guard)
-        .await?;
-    if snapshot_guard.is_lock_lost()
-        || snapshot_guard.is_released()
-        || matches!(&authority, BucketMetadataAuthority::Authoritative(metadata)
-            if !snapshot.is_valid_for_destructive_put(store.id, bucket, metadata.bucket_incarnation_id))
+    match bucket_meta_sys
+        .read_authoritative_metadata_from_disk_under_transaction_lock(bucket)
+        .await?
     {
-        return Err(Error::other("quota snapshot fence or bucket incarnation changed during the disk read"));
-    }
-    quota_config_and_incarnation_from_authority(bucket, authority)
-}
-
-fn quota_config_and_incarnation_from_authority(
-    bucket: &str,
-    authority: BucketMetadataAuthority,
-) -> Result<(Option<BucketQuota>, Uuid, OffsetDateTime)> {
-    match authority {
         BucketMetadataAuthority::Authoritative(metadata)
             if metadata.bucket_incarnation_sidecar && !metadata.bucket_incarnation_id.is_nil() =>
         {
@@ -2788,30 +2703,29 @@ impl BucketMetadataSys {
     async fn read_authoritative_metadata_from_disk_under_transaction_lock(
         &self,
         bucket: &str,
-    ) -> Result<BucketMetadataAuthority> {
-        let namespace_lock = self.object_store().new_ns_lock(bucket, bucket).await?;
-        let namespace_guard = namespace_lock
-            .get_read_lock(crate::set_disk::get_lock_acquire_timeout())
-            .await?;
-        self.read_authoritative_metadata_from_disk_under_guard(bucket, &namespace_guard)
-            .await
-    }
-
-    async fn read_authoritative_metadata_from_disk_under_guard(
-        &self,
-        bucket: &str,
-        guard: &rustfs_lock::NamespaceLockGuard,
     ) -> Result<BucketMetadataAuthority> {
         #[cfg(test)]
         if self.object_lock_disk_read_errors.write().await.remove(bucket) {
             return Err(Error::other(format!("injected Object Lock metadata disk read failure: {bucket}")));
         }
 
-        match await_bucket_namespace_operation(Some(guard), bucket, "bucket metadata snapshot existence check", async {
-            self.object_store()
-                .get_bucket_info_from_sets_at_read_quorum(bucket, &crate::storage_api_contracts::bucket::BucketOptions::default())
-                .await
-        })
+        let namespace_lock = self.object_store().new_ns_lock(bucket, bucket).await?;
+        let namespace_guard = namespace_lock
+            .get_read_lock(crate::set_disk::get_lock_acquire_timeout())
+            .await?;
+        match await_bucket_namespace_operation(
+            Some(&namespace_guard),
+            bucket,
+            "bucket metadata snapshot existence check",
+            async {
+                self.object_store()
+                    .get_bucket_info_from_sets_at_read_quorum(
+                        bucket,
+                        &crate::storage_api_contracts::bucket::BucketOptions::default(),
+                    )
+                    .await
+            },
+        )
         .await
         {
             Ok(_) => {}
@@ -2820,7 +2734,7 @@ impl BucketMetadataSys {
         }
 
         let (metadata, persisted) = await_bucket_namespace_operation(
-            Some(guard),
+            Some(&namespace_guard),
             bucket,
             "bucket metadata authoritative snapshot",
             load_bucket_metadata_parse_with_presence(self.object_store(), bucket, true),
@@ -4207,114 +4121,6 @@ mod tests {
         sys.persist_new_and_set(bm).await.expect("initial metadata should persist");
     }
 
-    #[tokio::test]
-    async fn reparse_xml_rmw_corruption_refuses_cached_and_reloaded_encryption() {
-        use crate::bucket::metadata::{BUCKET_SSECONFIG, is_unreadable_config_error};
-        use std::sync::atomic::{AtomicUsize, Ordering};
-
-        let (dirs, ecstore) = isolated_store_over_temp_disks().await;
-        let sys = BucketMetadataSys::new(ecstore);
-        let bucket = "reparse-encryption-corrupt";
-        let valid = br#"<ServerSideEncryptionConfiguration><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>"#;
-        let corrupt = b"<ServerSideEncryptionConfiguration";
-        persist_bucket_with_raw_config(&sys, &dirs, bucket, BUCKET_SSECONFIG, valid).await;
-        sys.get_sse_config(bucket).await.expect("valid encryption must be readable");
-
-        let updated = sys
-            .update_config_with(bucket, BUCKET_SSECONFIG, |bm| {
-                assert!(bm.sse_config.is_some(), "rewrite must start with parsed encryption");
-                Ok(corrupt.to_vec())
-            })
-            .await
-            .expect("persist future or corrupt raw encryption without failing the whole bucket");
-
-        let err = sys
-            .get_sse_config(bucket)
-            .await
-            .expect_err("cached old encryption must not hide corrupt raw");
-        assert!(is_unreadable_config_error(&err), "cached refusal must retain its type: {err}");
-        let (cached, _) = sys.get_config(bucket).await.expect("bucket remains readable");
-        assert_eq!(cached.encryption_config_xml, corrupt);
-        assert_eq!(cached.encryption_config_updated_at, updated);
-
-        sys.metadata_map.write().await.clear();
-        let err = sys
-            .get_sse_config(bucket)
-            .await
-            .expect_err("reloaded encryption must still refuse corrupt raw");
-        assert!(is_unreadable_config_error(&err), "reloaded refusal must retain its type: {err}");
-
-        let calls = AtomicUsize::new(0);
-        let err = sys
-            .update_config_with(bucket, BUCKET_SSECONFIG, |_| {
-                calls.fetch_add(1, Ordering::SeqCst);
-                Ok(Vec::new())
-            })
-            .await
-            .expect_err("another rewrite must refuse before it consumes corrupt encryption");
-        assert!(is_unreadable_config_error(&err));
-        assert_eq!(calls.load(Ordering::SeqCst), 0, "refused rewrite must not erase the original raw");
-        let disk = sys
-            .get_config_from_disk(bucket)
-            .await
-            .expect("read unchanged metadata from disk");
-        assert_eq!(disk.encryption_config_xml, corrupt);
-        assert_eq!(disk.encryption_config_updated_at, updated);
-
-        sys.update(bucket, BUCKET_SSECONFIG, valid.to_vec())
-            .await
-            .expect("explicit repair must remain possible");
-        sys.get_sse_config(bucket)
-            .await
-            .expect("repaired cached encryption must be readable");
-        sys.metadata_map.write().await.clear();
-        sys.get_sse_config(bucket).await.expect("repair must survive a disk reload");
-    }
-
-    #[tokio::test]
-    async fn reparse_xml_rmw_removal_clears_cached_and_reloaded_encryption() {
-        use crate::bucket::metadata::BUCKET_SSECONFIG;
-
-        let (dirs, ecstore) = isolated_store_over_temp_disks().await;
-        let sys = BucketMetadataSys::new(ecstore);
-        let bucket = "reparse-encryption-removed";
-        let valid = br#"<ServerSideEncryptionConfiguration><Rule><ApplyServerSideEncryptionByDefault><SSEAlgorithm>AES256</SSEAlgorithm></ApplyServerSideEncryptionByDefault></Rule></ServerSideEncryptionConfiguration>"#;
-        persist_bucket_with_raw_config(&sys, &dirs, bucket, BUCKET_SSECONFIG, valid).await;
-        sys.get_sse_config(bucket).await.expect("valid encryption must be readable");
-
-        let updated = sys
-            .update_config_with(bucket, BUCKET_SSECONFIG, |bm| {
-                assert!(bm.sse_config.is_some(), "rewrite must start with parsed encryption");
-                Ok(Vec::new())
-            })
-            .await
-            .expect("removing encryption must persist");
-
-        assert_eq!(
-            sys.get_sse_config(bucket)
-                .await
-                .expect_err("old cached encryption must be gone"),
-            Error::ConfigNotFound
-        );
-        let (cached, _) = sys.get_config(bucket).await.expect("bucket remains readable");
-        assert!(cached.encryption_config_xml.is_empty());
-        assert_eq!(cached.encryption_config_updated_at, updated);
-
-        sys.metadata_map.write().await.clear();
-        assert_eq!(
-            sys.get_sse_config(bucket)
-                .await
-                .expect_err("removed encryption must stay absent after reload"),
-            Error::ConfigNotFound
-        );
-        let disk = sys
-            .get_config_from_disk(bucket)
-            .await
-            .expect("read removed encryption from disk");
-        assert!(disk.encryption_config_xml.is_empty());
-        assert_eq!(disk.encryption_config_updated_at, updated);
-    }
-
     /// rustfs/backlog#1734: a read-modify-write of a stored config that cannot
     /// be parsed must be refused before `mutate` runs. Otherwise `mutate` sees
     /// the unreadable config as absent, rebuilds it from nothing, and the
@@ -4930,231 +4736,6 @@ mod tests {
             .expect("DeleteBucket should succeed");
     }
 
-    #[tokio::test]
-    #[serial]
-    async fn quota_snapshot_reuses_same_name_owner_and_rereads_disk_authority() {
-        let (_dirs, store) = isolated_store_over_temp_disks().await;
-        init_bucket_metadata_sys(store.clone(), Vec::new()).await;
-        let bucket = "quota-same-name-owner";
-        store
-            .make_bucket(bucket, &MakeBucketOptions::default())
-            .await
-            .expect("quota fixture bucket");
-        let snapshot = store
-            .object_lock_config_snapshot(bucket)
-            .await
-            .expect("guarded Object Lock snapshot");
-        let incarnation = store.bucket_incarnation_id(bucket).await.expect("fixture incarnation");
-        let transaction_guard = snapshot
-            .metadata_transaction_guard_for(store.id, bucket, Some(incarnation))
-            .expect("snapshot's actual transaction guard");
-        let expected = get_quota_config_and_incarnation_from_disk_for_options_in(
-            &store.ctx,
-            bucket,
-            &ObjectOptions::default(),
-            &transaction_guard,
-        )
-        .await
-        .expect("a reader without a snapshot must retain the ordinary namespace path");
-
-        let sys = bucket_metadata_sys_of(&store.ctx).expect("fixture metadata system");
-        let sys = sys.read().await.clone();
-        let mut stale = (*sys.get(bucket).await.expect("cached fixture metadata")).clone();
-        let metadata_path = stale.save_file_path();
-        stale.quota_config = Some(BucketQuota {
-            quota: Some(123),
-            ..Default::default()
-        });
-        sys.set(bucket.to_string(), Arc::new(stale)).await;
-        let namespace = store.new_ns_lock(bucket, bucket).await.expect("same-name object namespace");
-        let _owner = namespace
-            .get_write_lock(crate::set_disk::get_lock_acquire_timeout())
-            .await
-            .expect("same-name object write owner");
-        let opts = ObjectOptions {
-            object_lock_config_snapshot: Some(snapshot),
-            expected_bucket_incarnation_id: Some(incarnation),
-            ..Default::default()
-        };
-        assert_eq!(
-            get_quota_config_and_incarnation_from_disk_for_options_in(&store.ctx, bucket, &opts, &transaction_guard)
-                .await
-                .expect("quota disk read must reuse the held lifecycle and transaction fences"),
-            expected,
-            "the cached quota must not replace disk authority"
-        );
-
-        crate::config::com::save_config_with_opts(
-            store.clone(),
-            &metadata_path,
-            b"corrupt bucket metadata".to_vec(),
-            &ObjectOptions {
-                write_completion: crate::object_api::WriteCompletion::TailDrained,
-                ..Default::default()
-            },
-        )
-        .await
-        .expect("inject committed metadata corruption");
-        assert!(
-            get_quota_config_and_incarnation_from_disk_for_options_in(&store.ctx, bucket, &opts, &transaction_guard)
-                .await
-                .is_err(),
-            "a valid snapshot must not hide corrupt disk metadata"
-        );
-        crate::config::com::delete_config(store.clone(), &metadata_path)
-            .await
-            .expect("remove the persisted metadata while retaining its sidecar");
-        assert!(
-            get_quota_config_and_incarnation_from_disk_for_options_in(&store.ctx, bucket, &opts, &transaction_guard)
-                .await
-                .is_err(),
-            "a valid snapshot must not promote fabricated metadata to authority"
-        );
-    }
-
-    #[tokio::test]
-    #[serial]
-    async fn quota_snapshot_rejects_wrong_scope_incarnation_and_transaction_guard() {
-        let (_dirs, store) = isolated_store_over_temp_disks().await;
-        init_bucket_metadata_sys(store.clone(), Vec::new()).await;
-        let bucket = "quota-snapshot-scope";
-        store
-            .make_bucket(bucket, &MakeBucketOptions::default())
-            .await
-            .expect("quota fixture bucket");
-        let incarnation = store.bucket_incarnation_id(bucket).await.expect("fixture incarnation");
-        let snapshot = store
-            .object_lock_config_snapshot(bucket)
-            .await
-            .expect("guarded Object Lock snapshot");
-        let transaction_guard = snapshot
-            .metadata_transaction_guard_for(store.id, bucket, Some(incarnation))
-            .expect("snapshot's actual transaction guard");
-        let mut opts = ObjectOptions {
-            object_lock_config_snapshot: Some(snapshot),
-            expected_bucket_incarnation_id: Some(incarnation),
-            ..Default::default()
-        };
-        assert!(
-            get_quota_config_and_incarnation_from_disk_for_options_in(&store.ctx, "another-bucket", &opts, &transaction_guard)
-                .await
-                .is_err()
-        );
-        opts.expected_bucket_incarnation_id = Some(Uuid::new_v4());
-        assert!(
-            get_quota_config_and_incarnation_from_disk_for_options_in(&store.ctx, bucket, &opts, &transaction_guard)
-                .await
-                .is_err()
-        );
-        opts.expected_bucket_incarnation_id = Some(incarnation);
-        let other_guard = Arc::new(
-            acquire_bucket_metadata_transaction_read_lock_in(&store.ctx, bucket)
-                .await
-                .expect("distinct real transaction read guard"),
-        );
-        assert!(
-            get_quota_config_and_incarnation_from_disk_for_options_in(&store.ctx, bucket, &opts, &other_guard)
-                .await
-                .is_err(),
-            "the same namespace key does not prove that this is the snapshot's actual guard"
-        );
-        let (_other_dirs, other_store) = isolated_store_over_temp_disks().await;
-        init_bucket_metadata_sys(other_store.clone(), Vec::new()).await;
-        assert!(
-            get_quota_config_and_incarnation_from_disk_for_options_in(&other_store.ctx, bucket, &opts, &transaction_guard)
-                .await
-                .is_err()
-        );
-        opts.object_lock_config_snapshot = Some(Arc::new(crate::object_api::ObjectLockConfigSnapshot::new(
-            ObjectLockConfigState::ConfirmedAbsent,
-        )));
-        assert!(
-            get_quota_config_and_incarnation_from_disk_for_options_in(&store.ctx, bucket, &opts, &transaction_guard)
-                .await
-                .is_err(),
-            "an unguarded snapshot must not authorize namespace reuse"
-        );
-    }
-
-    #[tokio::test]
-    #[serial]
-    async fn quota_snapshot_rejects_lifecycle_loss_during_read_and_changed_disk_incarnation() {
-        let (_dirs, store) = isolated_store_over_temp_disks().await;
-        init_bucket_metadata_sys(store.clone(), Vec::new()).await;
-        let bucket = "quota-snapshot-loss";
-        store
-            .make_bucket(bucket, &MakeBucketOptions::default())
-            .await
-            .expect("quota fixture bucket");
-        let sys = bucket_metadata_sys_of(&store.ctx).expect("fixture metadata system");
-        let sys = sys.read().await.clone();
-        let mut metadata = (*sys.get(bucket).await.expect("fixture metadata")).clone();
-        let incarnation = metadata.bucket_incarnation_id;
-        let _lifecycle_guard = store
-            .acquire_bucket_lifecycle_read_lock(bucket)
-            .await
-            .expect("real lifecycle owner");
-        let transaction_guard = Arc::new(
-            acquire_bucket_metadata_transaction_read_lock_in(&store.ctx, bucket)
-                .await
-                .expect("real metadata transaction owner"),
-        );
-        let (lifecycle_fence, lost) = crate::object_api::NamespaceLockFence::loss_handle_for_test();
-        let snapshot = crate::object_api::ObjectLockConfigSnapshot::for_store_bucket_under_lifecycle_fence(
-            store.id,
-            bucket,
-            incarnation,
-            metadata.object_lock_config_updated_at,
-            ObjectLockConfigState::ConfirmedAbsent,
-            lifecycle_fence,
-            Arc::clone(&transaction_guard),
-        );
-        let opts = ObjectOptions {
-            object_lock_config_snapshot: Some(Arc::new(snapshot)),
-            expected_bucket_incarnation_id: Some(incarnation),
-            ..Default::default()
-        };
-        let mut read = Box::pin(get_quota_config_and_incarnation_from_disk_for_options_in(
-            &store.ctx,
-            bucket,
-            &opts,
-            &transaction_guard,
-        ));
-        assert!(
-            futures::poll!(read.as_mut()).is_pending(),
-            "the authoritative disk read must be in flight"
-        );
-        lost.store(true, std::sync::atomic::Ordering::Release);
-        assert!(read.await.is_err(), "a lifecycle fence lost during the disk read must reject its result");
-
-        let snapshot = store
-            .object_lock_config_snapshot(bucket)
-            .await
-            .expect("fresh guarded snapshot");
-        let transaction_guard = snapshot
-            .metadata_transaction_guard_for(store.id, bucket, Some(incarnation))
-            .expect("snapshot's actual transaction guard");
-        let opts = ObjectOptions {
-            object_lock_config_snapshot: Some(snapshot),
-            expected_bucket_incarnation_id: Some(incarnation),
-            ..Default::default()
-        };
-        metadata.bucket_incarnation_id = Uuid::new_v4();
-        save_bucket_incarnation(store.clone(), bucket, metadata.bucket_incarnation_id)
-            .await
-            .expect("inject a new disk incarnation");
-        metadata
-            .save_with_store_committed(store.clone())
-            .await
-            .expect("persist its matching metadata blob");
-        assert!(
-            get_quota_config_and_incarnation_from_disk_for_options_in(&store.ctx, bucket, &opts, &transaction_guard)
-                .await
-                .is_err(),
-            "a matching sidecar and blob from another incarnation must not reuse the old snapshot"
-        );
-    }
-
     /// Writers on different nodes updating *different* config files of one
     /// bucket must both survive. Each rewrites the whole metadata blob, so
     /// without a lock spanning the read-modify-write the later save carries

crates/ecstore/src/bucket/migration.rs

@@ -280,11 +280,11 @@ where
 
     debug!("Found {} migrating bucket metadata, migrating...", buckets.len());
 
-    let mut opts = ObjectOptions {
+    let opts = ObjectOptions {
         max_parity: true,
+        no_lock: true,
         ..Default::default()
     };
-    opts.use_offline_recovery_write();
     let h = HeaderMap::new();
 
     for bucket in buckets {
@@ -397,11 +397,11 @@ where
         return Ok(());
     }
 
-    let mut opts = ObjectOptions {
+    let opts = ObjectOptions {
         max_parity: true,
+        no_lock: true,
         ..Default::default()
     };
-    opts.use_offline_recovery_write();
     let h = HeaderMap::new();
     let prefix = format!("{IAM_CONFIG_PREFIX}/");
     let mut continuation: Option<String> = None;

crates/ecstore/src/bucket/quota/mod.rs

@@ -32,10 +32,7 @@ pub enum QuotaType {
     Hard,
 }
 
-pub const QUOTA_RESERVATION_PROTOCOL_V1: u32 = 1;
-/// Sharded durable reservations. Older nodes reject this protocol instead of
-/// silently falling back to the single-ledger protocol.
-pub const QUOTA_RESERVATION_PROTOCOL_V2: u32 = 2;
+pub(crate) const QUOTA_RESERVATION_PROTOCOL_V1: u32 = 1;
 
 /// Bucket quota configuration. quota_type defaults to Hard when omitted.
 #[derive(Debug, Default, Clone, PartialEq)]
@@ -92,10 +89,7 @@ impl<'de> Deserialize<'de> for BucketQuota {
         D: Deserializer<'de>,
     {
         let wire = BucketQuotaWire::deserialize(deserializer)?;
-        let quota = if matches!(
-            wire.reservation_protocol,
-            Some(QUOTA_RESERVATION_PROTOCOL_V1) | Some(QUOTA_RESERVATION_PROTOCOL_V2)
-        ) {
+        let quota = if wire.reservation_protocol == Some(QUOTA_RESERVATION_PROTOCOL_V1) {
             Some(
                 wire.reservation_quota
                     .ok_or_else(|| D::Error::custom("reservation_quota is required for reservation protocol v1"))?,
@@ -135,33 +129,17 @@ impl BucketQuota {
         }
     }
 
-    /// Creates a quota using the sharded durable reservation protocol.
-    /// Deployment must complete the mixed-version rollout before enabling it;
-    /// older nodes fail closed when they see protocol v2.
-    pub fn new_sharded(quota: u64) -> Self {
-        let mut config = Self::new(Some(quota));
-        config.reservation_protocol = Some(QUOTA_RESERVATION_PROTOCOL_V2);
-        config
-    }
-
     pub fn get_quota_limit(&self) -> Option<u64> {
         self.quota
     }
 
     pub fn uses_durable_reservations(&self) -> bool {
-        matches!(
-            self.reservation_protocol,
-            Some(QUOTA_RESERVATION_PROTOCOL_V1) | Some(QUOTA_RESERVATION_PROTOCOL_V2)
-        )
-    }
-
-    pub fn uses_sharded_reservations(&self) -> bool {
-        self.reservation_protocol == Some(QUOTA_RESERVATION_PROTOCOL_V2)
+        self.reservation_protocol == Some(QUOTA_RESERVATION_PROTOCOL_V1)
     }
 
     pub fn has_unsupported_reservation_protocol(&self) -> bool {
         self.reservation_protocol
-            .is_some_and(|version| !matches!(version, QUOTA_RESERVATION_PROTOCOL_V1 | QUOTA_RESERVATION_PROTOCOL_V2))
+            .is_some_and(|version| version != QUOTA_RESERVATION_PROTOCOL_V1)
     }
 
     pub fn check_operation_allowed(&self, current_usage: u64, operation_size: u64) -> bool {
@@ -344,21 +322,9 @@ mod tests {
     }
 
     #[test]
-    fn sharded_quota_roundtrips_with_authoritative_reservation_quota() {
-        let quota = BucketQuota::new_sharded(4096);
-        let json = serde_json::to_value(&quota).expect("sharded quota should serialize");
-        assert_eq!(json["quota"], 0);
-        assert_eq!(json["reservation_protocol"], QUOTA_RESERVATION_PROTOCOL_V2);
-        assert_eq!(json["reservation_quota"], 4096);
-        let restored: BucketQuota = serde_json::from_value(json).expect("sharded quota should parse");
-        assert_eq!(restored.quota, Some(4096));
-        assert!(restored.uses_sharded_reservations());
-    }
-
-    #[test]
-    fn unknown_reservation_protocol_does_not_activate_any_known_protocol() {
+    fn unknown_reservation_protocol_does_not_activate_v1() {
         let quota: BucketQuota =
-            serde_json::from_str(r#"{"quota":0,"quota_type":"Hard","reservation_protocol":3,"reservation_quota":2048}"#)
+            serde_json::from_str(r#"{"quota":0,"quota_type":"Hard","reservation_protocol":2,"reservation_quota":2048}"#)
                 .expect("future protocol should remain parseable");
 
         assert!(!quota.uses_durable_reservations());

crates/ecstore/src/bucket/replication/replication_config_store.rs

@@ -13,9 +13,7 @@
 // limitations under the License.
 
 use super::replication_error_boundary::Result;
-use super::replication_storage_boundary::{
-    HTTPPreconditions, ObjectInfo, ObjectOptions, ReplicationObjectIO, WriteCommitGuard, WriteCompletion,
-};
+use super::replication_storage_boundary::{HTTPPreconditions, ObjectInfo, ObjectOptions, ReplicationObjectIO};
 use crate::config::{com, storageclass};
 use std::sync::Arc;
 
@@ -79,6 +77,13 @@ impl ReplicationConfigStore {
         com::save_config(api, file, data).await
     }
 
+    pub(crate) async fn save_no_lock<S>(api: Arc<S>, file: &str, data: Vec<u8>) -> Result<()>
+    where
+        S: ReplicationObjectIO,
+    {
+        com::save_config_no_lock(api, file, data).await
+    }
+
     pub(crate) async fn save_conditional<S>(
         api: Arc<S>,
         file: &str,
@@ -106,18 +111,21 @@ impl ReplicationConfigStore {
         file: &str,
         data: Vec<u8>,
         http_preconditions: HTTPPreconditions,
-        guard: &WriteCommitGuard,
     ) -> Result<()>
     where
         S: ReplicationObjectIO,
     {
-        let mut opts = ObjectOptions {
-            max_parity: true,
-            http_preconditions: Some(http_preconditions),
-            write_completion: WriteCompletion::TailDrained,
-            ..Default::default()
-        };
-        opts.add_write_commit_guard(guard);
-        com::save_config_with_opts_quiet(api, file, data, &opts).await
+        com::save_config_with_opts_quiet(
+            api,
+            file,
+            data,
+            &ObjectOptions {
+                max_parity: true,
+                no_lock: true,
+                http_preconditions: Some(http_preconditions),
+                ..Default::default()
+            },
+        )
+        .await
     }
 }

crates/ecstore/src/bucket/replication/replication_pool.rs

@@ -44,7 +44,7 @@ use super::replication_resyncer::{
 use super::replication_state::ReplicationStats;
 use super::replication_storage_boundary::{
     HTTPPreconditions, ObjectInfo, ObjectOptions, ObjectToDelete, ReplicationDeletedObject, ReplicationObjectIO,
-    ReplicationStorage, WriteCommitGuard,
+    ReplicationStorage,
 };
 use super::replication_target_boundary::{BucketTargetError, ReplicationTargetStore, replication_object_is_ssec_encrypted};
 use super::replication_versioning_boundary::ReplicationVersioningStore;
@@ -513,7 +513,7 @@ where
             // Lock order is transaction namespace lock -> force-delete journal object lock.
             // Keep the transaction guard alive through the conditional write so legacy
             // writers cannot interleave a read-modify-write transition within this process.
-            let guard = WriteCommitGuard::acquire(&lock, ReplicationLockTiming::acquire_timeout()).await?;
+            let guard = lock.get_write_lock(ReplicationLockTiming::acquire_timeout()).await?;
             let (mut entries, preconditions, exists) = read_force_delete_intents(storage.clone(), file).await?;
             if !update(&mut entries, exists)? {
                 return Ok(());
@@ -565,7 +565,7 @@ async fn read_force_delete_intents<S: ReplicationObjectIO>(
 async fn save_force_delete_intents<S: ReplicationStorage>(
     storage: Arc<S>,
     file: &str,
-    guard: &WriteCommitGuard,
+    guard: &rustfs_lock::NamespaceLockGuard,
     entries: Vec<MrfReplicateEntry>,
     preconditions: HTTPPreconditions,
 ) -> Result<(), EcstoreError> {
@@ -628,7 +628,7 @@ async fn acknowledge_mrf_recovery<S: ReplicationStorage>(
         let lock = storage
             .new_ns_lock(ReplicationMetadataStore::rustfs_meta_bucket(), file)
             .await?;
-        let guard = WriteCommitGuard::acquire(&lock, ReplicationLockTiming::acquire_timeout()).await?;
+        let guard = lock.get_write_lock(ReplicationLockTiming::acquire_timeout()).await?;
         let current = ReplicationConfigStore::read_no_lock_with_metadata_preserve_empty(storage.clone(), file).await;
         let (current_data, current_etag, current_exists) = match current {
             Ok((data, object_info)) => (data, object_info.etag, true),
@@ -658,7 +658,7 @@ async fn acknowledge_mrf_recovery<S: ReplicationStorage>(
         } else {
             encode_mrf_file(&retained)?
         };
-        match ReplicationConfigStore::save_conditional_no_lock(storage.clone(), file, data, preconditions, &guard).await {
+        match ReplicationConfigStore::save_conditional_no_lock(storage.clone(), file, data, preconditions).await {
             Ok(()) => return Ok(retained),
             Err(EcstoreError::PreconditionFailed) => continue,
             Err(error) => return Err(error),
@@ -2522,7 +2522,7 @@ async fn quarantine_mrf_file<S: ReplicationStorage>(storage: &Arc<S>, data: &[u8
                 continue;
             }
         };
-        let guard = match WriteCommitGuard::acquire(&lock, ReplicationLockTiming::acquire_timeout()).await {
+        let guard = match lock.get_write_lock(ReplicationLockTiming::acquire_timeout()).await {
             Ok(guard) => guard,
             Err(error) => {
                 warn!(
@@ -2573,7 +2573,6 @@ async fn quarantine_mrf_file<S: ReplicationStorage>(storage: &Arc<S>, data: &[u8
                     ReplicationMetadataStore::MRF_REPLICATION_FILE,
                     Vec::new(),
                     preconditions,
-                    &guard,
                 )
                 .await
                 {
@@ -2628,12 +2627,13 @@ async fn recover_corrupt_mrf_generation<S: ReplicationStorage>(
     entries: &[MrfReplicateEntry],
     preconditions: Option<HTTPPreconditions>,
     storage: &Arc<S>,
-    guard: &WriteCommitGuard,
+    guard: &rustfs_lock::NamespaceLockGuard,
     pending_payload: &mut Option<PendingMrfAppend>,
     started: Instant,
 ) -> Option<MrfAppendResult> {
     let quarantine_file = format!("{MRF_CORRUPT_FILE_PREFIX}.{}.bin", OffsetDateTime::now_utc().unix_timestamp_nanos());
-    if let Err(error) = ReplicationConfigStore::save(storage.clone(), &quarantine_file, corrupt_generation.to_vec()).await {
+    if let Err(error) = ReplicationConfigStore::save_no_lock(storage.clone(), &quarantine_file, corrupt_generation.to_vec()).await
+    {
         warn!(
             component = LOG_COMPONENT_ECSTORE,
             subsystem = LOG_SUBSYSTEM_REPLICATION,
@@ -2688,7 +2688,6 @@ async fn recover_corrupt_mrf_generation<S: ReplicationStorage>(
         ReplicationMetadataStore::MRF_REPLICATION_FILE,
         data,
         preconditions,
-        guard,
     )
     .await
     {
@@ -2736,7 +2735,7 @@ async fn append_mrf_entries_to_disk<S: ReplicationStorage>(
             return None;
         }
     };
-    let guard = match WriteCommitGuard::acquire(&lock, ReplicationLockTiming::acquire_timeout()).await {
+    let guard = match lock.get_write_lock(ReplicationLockTiming::acquire_timeout()).await {
         Ok(guard) => guard,
         Err(error) => {
             warn!(
@@ -2863,7 +2862,6 @@ async fn append_mrf_entries_to_disk<S: ReplicationStorage>(
         ReplicationMetadataStore::MRF_REPLICATION_FILE,
         data,
         preconditions,
-        &guard,
     )
     .await
     {

crates/ecstore/src/bucket/replication/replication_storage_boundary.rs

@@ -19,8 +19,7 @@ use super::replication_error_boundary::Error;
 use super::replication_filemeta_boundary::{replication_state_from_filemeta, version_purge_status_from_filemeta};
 pub(crate) type ReplicationObjectStore = crate::store::ECStore;
 pub(crate) use crate::object_api::{
-    GetObjectReader, ObjectInfo, ObjectOptions, PutObjReader, ReplicationStatusWritebackCondition,
-    ReplicationStatusWritebackMode, WriteCommitGuard, WriteCompletion,
+    GetObjectReader, ObjectInfo, ObjectOptions, PutObjReader, ReplicationStatusWritebackCondition, ReplicationStatusWritebackMode,
 };
 #[cfg(test)]
 pub(crate) use crate::object_api::{NamespaceLockFence, NamespaceLockSignalTestFence};

crates/ecstore/src/cache_value/metacache_set.rs

@@ -12,11 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#[cfg(test)]
-use crate::disk::DiskIoClass;
 use crate::disk::disk_store::{get_drive_walkdir_peek_timeout, get_drive_walkdir_stall_timeout};
 use crate::disk::error::DiskError;
-use crate::disk::{self, DiskAPI, DiskStore, WalkDirOptions, current_disk_io_context, with_optional_disk_io_context};
+use crate::disk::{self, DiskAPI, DiskStore, WalkDirOptions};
 use futures::future::join_all;
 use metrics::counter;
 use rustfs_filemeta::{MetaCacheEntries, MetaCacheEntry, MetacacheReader, is_io_eof};
@@ -247,8 +245,6 @@ pub struct ListPathRawOptions {
     pub(crate) test_fallback_reader_behaviors: Vec<TestReaderBehavior>,
     #[cfg(test)]
     pub(crate) peek_timeout: Option<Duration>,
-    #[cfg(test)]
-    pub(crate) test_disk_io_context_observed: Option<Arc<AtomicBool>>,
     // pub agreed: Option<Arc<dyn Fn(MetaCacheEntry) + Send + Sync>>,
     // pub partial: Option<Arc<dyn Fn(MetaCacheEntries, &[Option<Error>]) + Send + Sync>>,
     // pub finished: Option<Arc<dyn Fn(&[Option<Error>]) + Send + Sync>>,
@@ -280,8 +276,6 @@ impl Clone for ListPathRawOptions {
             test_fallback_reader_behaviors: self.test_fallback_reader_behaviors.clone(),
             #[cfg(test)]
             peek_timeout: self.peek_timeout,
-            #[cfg(test)]
-            test_disk_io_context_observed: self.test_disk_io_context_observed.clone(),
             ..Default::default()
         }
     }
@@ -350,7 +344,6 @@ async fn list_path_raw_inner(
     let log_path = opts.path.clone();
 
     let mut jobs = JoinSet::new();
-    let disk_io_context = current_disk_io_context();
     let mut readers = Vec::with_capacity(opts.disks.len());
     let fds = Arc::new(TokioMutex::new(opts.fallback_disks.iter().flatten().cloned().collect::<VecDeque<_>>()));
     #[cfg(test)]
@@ -371,19 +364,11 @@ async fn list_path_raw_inner(
         let test_fallbacks_clone = test_fallbacks.clone();
         let cancel_rx_clone = cancel_rx.clone();
         let producer_errs_clone = producer_errs.clone();
-        let disk_io_context_clone = disk_io_context.clone();
         let (rd, wr) = tokio::io::duplex(64);
         readers.push(MetacacheReader::new(rd));
-        jobs.spawn(with_optional_disk_io_context(disk_io_context_clone, async move {
+        jobs.spawn(async move {
             let mut wr = PublishedBytesWriter::new(wr);
             #[cfg(test)]
-            if let Some(observer) = &opts_clone.test_disk_io_context_observed {
-                observer.store(
-                    crate::disk::current_disk_io_context().is_some_and(|context| context.class == DiskIoClass::Background),
-                    std::sync::atomic::Ordering::Release,
-                );
-            }
-            #[cfg(test)]
             let test_primary_error = if let Some(behavior) = opts_clone.test_reader_behaviors.get(disk_idx).cloned() {
                 match behavior {
                     TestReaderBehavior::Eof => return Ok(()),
@@ -667,7 +652,7 @@ async fn list_path_raw_inner(
 
             // warn!("list_path_raw: while need_fallback done");
             Ok(())
-        }));
+        });
     }
 
     let revjob_rx = rx.clone();
@@ -1183,68 +1168,6 @@ mod tests {
         assert_eq!(err, DiskError::ErasureReadQuorum);
     }
 
-    #[tokio::test]
-    async fn list_path_raw_joinset_producers_inherit_scanner_disk_io_class() {
-        let observed = Arc::new(AtomicBool::new(false));
-        crate::disk::with_background_disk_io(
-            CancellationToken::new(),
-            list_path_raw(
-                CancellationToken::new(),
-                ListPathRawOptions {
-                    disks: vec![None],
-                    min_disks: 1,
-                    test_reader_behaviors: vec![TestReaderBehavior::Eof],
-                    test_disk_io_context_observed: Some(observed.clone()),
-                    ..Default::default()
-                },
-            ),
-        )
-        .await
-        .expect("empty test producer should complete the listing");
-
-        assert!(
-            observed.load(std::sync::atomic::Ordering::Acquire),
-            "the per-disk JoinSet producer must retain the scanner background class"
-        );
-    }
-
-    #[tokio::test]
-    async fn scanner_joinset_walk_uses_the_local_disk_background_gate() {
-        let root = tempfile::tempdir().expect("local disk root should be created");
-        let endpoint = crate::disk::endpoint::Endpoint::try_from(root.path().to_str().expect("disk path should be UTF-8"))
-            .expect("endpoint should parse");
-        let local = Arc::new(
-            crate::disk::local::LocalDisk::new(&endpoint, false)
-                .await
-                .expect("local disk should open"),
-        );
-        let wrapper = crate::disk::disk_store::LocalDiskWrapper::new(local, false);
-        wrapper.make_volume("bucket").await.expect("bucket volume should be created");
-        let disk = Arc::new(crate::disk::Disk::Local(Box::new(wrapper.clone())));
-        let cancellation = CancellationToken::new();
-
-        crate::disk::with_background_disk_io(
-            cancellation.clone(),
-            list_path_raw(
-                cancellation,
-                ListPathRawOptions {
-                    disks: vec![Some(disk)],
-                    bucket: "bucket".to_string(),
-                    min_disks: 1,
-                    recursive: true,
-                    ..Default::default()
-                },
-            ),
-        )
-        .await
-        .expect("scanner metacache walk should complete");
-
-        assert!(
-            wrapper.background_io_admissions_for_tests() > 0,
-            "the LocalDiskWrapper walk should acquire background admission inside its JoinSet producer"
-        );
-    }
-
     #[tokio::test]
     async fn list_path_raw_returns_typed_quorum_error_for_multiple_drive_failures() {
         let err = list_path_raw(

crates/ecstore/src/cluster/rpc/peer_rest_client.rs

@@ -640,7 +640,6 @@ pub struct PeerLiveEventsBatch {
 pub struct ScannerPublicationLease {
     pub token: Uuid,
     pub movement_generation: u64,
-    pub observational_only: bool,
     /// Stable storage owner identity. This is distinct from the activity
     /// session and is bound into both acquire and release proofs.
     pub owner_id: String,
@@ -659,7 +658,6 @@ fn validate_scanner_publication_lease_response_fields(
     response: &ScannerPublicationLeaseResponse,
     expected_session_id: &str,
     expected_generation: u64,
-    expected_observational_only: bool,
 ) -> Result<(Uuid, String)> {
     if !response.success {
         return Err(Error::other(
@@ -676,9 +674,6 @@ fn validate_scanner_publication_lease_response_fields(
     if response.session_id != expected_session_id {
         return Err(Error::other("peer returned a different scanner publication lease session"));
     }
-    if response.observational_only != expected_observational_only {
-        return Err(Error::other("peer returned a different scanner publication lease purpose"));
-    }
     let owner_id = Uuid::parse_str(&response.owner_id)
         .ok()
         .filter(|owner_id| !owner_id.is_nil())
@@ -2423,7 +2418,6 @@ impl PeerRestClient {
         &self,
         expected_session_id: &str,
         expected_generation: u64,
-        observational_only: bool,
     ) -> Result<ScannerPublicationLease> {
         let request_started = std::time::Instant::now();
         self.finalize_result(
@@ -2440,7 +2434,6 @@ impl PeerRestClient {
                     ttl_ms: crate::store::SCANNER_PUBLICATION_LEASE_TTL_MS,
                     expected_session_id: expected_session_id.to_string(),
                     token: Bytes::new(),
-                    observational_only,
                 });
                 let canonical = rustfs_protos::canonical_scanner_publication_lease_request_body(request.get_ref())
                     .map_err(|_| Error::other("scanner publication lease request is too large to authenticate"))?;
@@ -2451,16 +2444,11 @@ impl PeerRestClient {
                         .map_err(|_| Error::other("scanner publication lease response is too large to authenticate"))?;
                 verify_tonic_rpc_response_proof(&response_body, &response.response_proof)
                     .map_err(|_| Error::other("peer returned an invalid scanner publication lease proof"))?;
-                let (token, owner_id) = validate_scanner_publication_lease_response_fields(
-                    &response,
-                    expected_session_id,
-                    expected_generation,
-                    observational_only,
-                )?;
+                let (token, owner_id) =
+                    validate_scanner_publication_lease_response_fields(&response, expected_session_id, expected_generation)?;
                 Ok(ScannerPublicationLease {
                     token,
                     movement_generation: response.movement_generation,
-                    observational_only,
                     owner_id,
                     session_id: response.session_id,
                     expires_at: scanner_publication_lease_deadline(
@@ -2495,7 +2483,6 @@ impl PeerRestClient {
                     ttl_ms: crate::store::SCANNER_PUBLICATION_LEASE_TTL_MS,
                     expected_session_id: lease.session_id.clone(),
                     token: lease.token.as_bytes().to_vec().into(),
-                    observational_only: lease.observational_only,
                 });
                 let canonical = rustfs_protos::canonical_scanner_publication_lease_request_body(request.get_ref())
                     .map_err(|_| Error::other("scanner publication lease validation request is too large to authenticate"))?;
@@ -2507,12 +2494,8 @@ impl PeerRestClient {
                     )?;
                 verify_tonic_rpc_response_proof(&response_body, &response.response_proof)
                     .map_err(|_| Error::other("peer returned an invalid scanner publication lease validation proof"))?;
-                let (token, owner_id) = validate_scanner_publication_lease_response_fields(
-                    &response,
-                    &lease.session_id,
-                    lease.movement_generation,
-                    lease.observational_only,
-                )?;
+                let (token, owner_id) =
+                    validate_scanner_publication_lease_response_fields(&response, &lease.session_id, lease.movement_generation)?;
                 if token != lease.token {
                     return Err(Error::other("peer returned a different scanner publication lease token"));
                 }
@@ -3018,16 +3001,15 @@ mod tests {
             response_proof: Bytes::new(),
             owner_id: Uuid::new_v4().to_string(),
             session_id: "session-a".to_string(),
-            observational_only: false,
         };
 
-        assert!(validate_scanner_publication_lease_response_fields(&response, "session-a", 7, false).is_ok());
+        assert!(validate_scanner_publication_lease_response_fields(&response, "session-a", 7).is_ok());
 
         let stale_generation = ScannerPublicationLeaseResponse {
             movement_generation: 6,
             ..response.clone()
         };
-        let error = validate_scanner_publication_lease_response_fields(&stale_generation, "session-a", 7, false)
+        let error = validate_scanner_publication_lease_response_fields(&stale_generation, "session-a", 7)
             .expect_err("a response from an older movement generation must be rejected");
         assert!(error.to_string().contains("different scanner publication lease generation"));
 
@@ -3035,21 +3017,9 @@ mod tests {
             session_id: "session-b".to_string(),
             ..response
         };
-        let error = validate_scanner_publication_lease_response_fields(&stale_session, "session-a", 7, false)
+        let error = validate_scanner_publication_lease_response_fields(&stale_session, "session-a", 7)
             .expect_err("a response from an older scanner session must be rejected");
         assert!(error.to_string().contains("different scanner publication lease session"));
-
-        let observational = ScannerPublicationLeaseResponse {
-            observational_only: true,
-            ..stale_session
-        };
-        assert!(
-            validate_scanner_publication_lease_response_fields(&observational, "session-b", 7, true).is_ok(),
-            "the signed purpose echo should validate an observation lease"
-        );
-        let error = validate_scanner_publication_lease_response_fields(&observational, "session-b", 7, false)
-            .expect_err("a peer must not upgrade an observational lease to authoritative");
-        assert!(error.to_string().contains("different scanner publication lease purpose"));
     }
 
     #[test]

crates/ecstore/src/config/com.rs

@@ -74,7 +74,7 @@ fn config_task_join_error(operation: &'static str, error: tokio::task::JoinError
 /// The operation must use the corresponding no-lock read/save functions.
 pub async fn with_server_config_write_lock<F, Fut, T>(store: Arc<ECStore>, operation: F) -> Result<T>
 where
-    F: FnOnce(crate::object_api::WriteCommitGuard) -> Fut + Send + 'static,
+    F: FnOnce() -> Fut + Send + 'static,
     Fut: std::future::Future<Output = T> + Send + 'static,
     T: Send + 'static,
 {
@@ -85,8 +85,8 @@ where
         let transaction_lock = store.new_ns_lock(RUSTFS_META_BUCKET, &transaction_lock).await?;
         let _transaction_guard = transaction_lock.get_write_lock(get_lock_acquire_timeout()).await?;
         let namespace_lock = store.new_ns_lock(RUSTFS_META_BUCKET, SERVER_CONFIG_OBJECT).await?;
-        let write_guard = crate::object_api::WriteCommitGuard::acquire(&namespace_lock, get_lock_acquire_timeout()).await?;
-        Ok(operation(write_guard.clone()).await)
+        let _write_guard = namespace_lock.get_write_lock(get_lock_acquire_timeout()).await?;
+        Ok(operation().await)
     })
     .await
     .map_err(|error| config_task_join_error("server config write", error))?
@@ -119,14 +119,14 @@ where
 /// one metadata config object. The operation must use no-lock object I/O.
 pub async fn with_config_object_write_lock<F, Fut, T>(store: Arc<ECStore>, object: String, operation: F) -> Result<T>
 where
-    F: FnOnce(crate::object_api::WriteCommitGuard) -> Fut + Send + 'static,
+    F: FnOnce() -> Fut + Send + 'static,
     Fut: std::future::Future<Output = T> + Send + 'static,
     T: Send + 'static,
 {
     tokio::spawn(async move {
         let namespace_lock = store.new_ns_lock(RUSTFS_META_BUCKET, &object).await?;
-        let write_guard = crate::object_api::WriteCommitGuard::acquire(&namespace_lock, get_lock_acquire_timeout()).await?;
-        Ok(operation(write_guard.clone()).await)
+        let _write_guard = namespace_lock.get_write_lock(get_lock_acquire_timeout()).await?;
+        Ok(operation().await)
     })
     .await
     .map_err(|error| config_task_join_error("config object write", error))?
@@ -638,12 +638,7 @@ where
     .await
 }
 
-pub async fn save_config_no_lock<S>(
-    api: Arc<S>,
-    file: &str,
-    data: Vec<u8>,
-    guard: &crate::object_api::WriteCommitGuard,
-) -> Result<()>
+pub async fn save_config_no_lock<S>(api: Arc<S>, file: &str, data: Vec<u8>) -> Result<()>
 where
     S: ObjectIO<
             Error = Error,
@@ -655,13 +650,17 @@ where
             PutObjectReader = PutObjReader,
         >,
 {
-    let mut opts = ObjectOptions {
-        max_parity: true,
-        write_completion: crate::object_api::WriteCompletion::TailDrained,
-        ..Default::default()
-    };
-    opts.add_write_commit_guard(guard);
-    save_config_with_opts(api, file, data, &opts).await
+    save_config_with_opts(
+        api,
+        file,
+        data,
+        &ObjectOptions {
+            max_parity: true,
+            no_lock: true,
+            ..Default::default()
+        },
+    )
+    .await
 }
 
 /// `delete_config` with `no_lock` set — for callers already holding the
@@ -847,12 +846,12 @@ where
     Ok(cfg)
 }
 
-async fn new_and_save_server_config_no_lock<S>(api: Arc<S>, guard: &crate::object_api::WriteCommitGuard) -> Result<Config>
+async fn new_and_save_server_config_no_lock<S>(api: Arc<S>) -> Result<Config>
 where
     S: EcstoreObjectIO + StorageAdminApi,
 {
     let cfg = new_server_config();
-    save_server_config_no_lock(api, &cfg, guard).await?;
+    save_server_config_no_lock(api, &cfg).await?;
     Ok(cfg)
 }
 
@@ -2139,18 +2138,14 @@ where
 }
 
 /// Handle the situation where the configuration file does not exist, create and save a new configuration
-async fn handle_missing_config<S>(
-    api: Arc<S>,
-    context: &str,
-    write_guard: Option<&crate::object_api::WriteCommitGuard>,
-) -> Result<Config>
+async fn handle_missing_config<S>(api: Arc<S>, context: &str, namespace_lock_held: bool) -> Result<Config>
 where
     S: EcstoreObjectIO + StorageAdminApi + NamespaceLocking<Error = Error, NamespaceLock = rustfs_lock::NamespaceLockWrapper>,
 {
     warn!("Configuration not found ({}): Start initializing new configuration", context);
     let cfg = if runtime_sources::first_cluster_node_is_local().await {
-        if let Some(guard) = write_guard {
-            new_and_save_server_config_no_lock(api.clone(), guard).await?
+        if namespace_lock_held {
+            new_and_save_server_config_no_lock(api.clone()).await?
         } else {
             new_and_save_server_config(api.clone()).await?
         }
@@ -2180,13 +2175,13 @@ where
         > + StorageAdminApi,
     S: NamespaceLocking<Error = Error, NamespaceLock = rustfs_lock::NamespaceLockWrapper>,
 {
-    read_config_without_migrate_inner(api, None).await
+    read_config_without_migrate_inner(api, false).await
 }
 
 /// Reads the server config while an upper layer holds the namespace write lock
 /// for [`SERVER_CONFIG_OBJECT`]. Missing-config initialization uses the matching
 /// no-lock save path and therefore cannot recursively acquire the same lock.
-pub async fn read_config_without_migrate_no_lock<S>(api: Arc<S>, guard: &crate::object_api::WriteCommitGuard) -> Result<Config>
+pub async fn read_config_without_migrate_no_lock<S>(api: Arc<S>) -> Result<Config>
 where
     S: ObjectIO<
             Error = Error,
@@ -2199,7 +2194,7 @@ where
         > + StorageAdminApi
         + NamespaceLocking<Error = Error, NamespaceLock = rustfs_lock::NamespaceLockWrapper>,
 {
-    read_config_without_migrate_inner(api, Some(guard)).await
+    read_config_without_migrate_inner(api, true).await
 }
 
 /// Reads an already-initialized server config while a caller owns a namespace
@@ -2209,10 +2204,7 @@ pub async fn read_existing_server_config_no_lock(api: Arc<ECStore>) -> Result<Co
     Ok(decode_persisted_server_config(&data)?.merge())
 }
 
-async fn read_config_without_migrate_inner<S>(
-    api: Arc<S>,
-    write_guard: Option<&crate::object_api::WriteCommitGuard>,
-) -> Result<Config>
+async fn read_config_without_migrate_inner<S>(api: Arc<S>, namespace_lock_held: bool) -> Result<Config>
 where
     S: ObjectIO<
             Error = Error,
@@ -2228,23 +2220,19 @@ where
     let config_file = server_config_path();
 
     // Try to read the configuration file.
-    let data = if write_guard.is_some() {
+    let data = if namespace_lock_held {
         read_config_no_lock(api.clone(), &config_file).await
     } else {
         read_config(api.clone(), &config_file).await
     };
     match data {
-        Ok(data) => read_server_config(api, &data, write_guard).await,
-        Err(Error::ConfigNotFound) => handle_missing_config(api, "Read the main configuration", write_guard).await,
+        Ok(data) => read_server_config(api, &data, namespace_lock_held).await,
+        Err(Error::ConfigNotFound) => handle_missing_config(api, "Read the main configuration", namespace_lock_held).await,
         Err(err) => handle_config_read_error(err, &config_file),
     }
 }
 
-async fn read_server_config<S>(
-    api: Arc<S>,
-    data: &[u8],
-    write_guard: Option<&crate::object_api::WriteCommitGuard>,
-) -> Result<Config>
+async fn read_server_config<S>(api: Arc<S>, data: &[u8], namespace_lock_held: bool) -> Result<Config>
 where
     S: EcstoreObjectIO + StorageAdminApi + NamespaceLocking<Error = Error, NamespaceLock = rustfs_lock::NamespaceLockWrapper>,
 {
@@ -2254,7 +2242,7 @@ where
         warn!("Received empty configuration data, try to reread from '{}'", config_file);
 
         // Try to read the configuration again
-        let data = if write_guard.is_some() {
+        let data = if namespace_lock_held {
             read_config_no_lock(api.clone(), &config_file).await
         } else {
             read_config(api.clone(), &config_file).await
@@ -2265,7 +2253,7 @@ where
                 return Ok(cfg.merge());
             }
             Err(Error::ConfigNotFound) => {
-                return handle_missing_config(api, "Read alternate configuration", write_guard).await;
+                return handle_missing_config(api, "Read alternate configuration", namespace_lock_held).await;
             }
             Err(err) => return handle_config_read_error(err, &config_file),
         }
@@ -2699,7 +2687,7 @@ where
 
 /// Saves the server config while an upper layer holds the namespace write
 /// lock for [`SERVER_CONFIG_OBJECT`].
-pub async fn save_server_config_no_lock<S>(api: Arc<S>, cfg: &Config, guard: &crate::object_api::WriteCommitGuard) -> Result<()>
+pub async fn save_server_config_no_lock<S>(api: Arc<S>, cfg: &Config) -> Result<()>
 where
     S: ObjectIO<
             Error = Error,
@@ -2711,10 +2699,10 @@ where
             PutObjectReader = PutObjReader,
         >,
 {
-    save_server_config_inner(api, cfg, guard).await
+    save_server_config_inner(api, cfg, true).await
 }
 
-async fn save_server_config_inner<S>(api: Arc<S>, cfg: &Config, guard: &crate::object_api::WriteCommitGuard) -> Result<()>
+async fn save_server_config_inner<S>(api: Arc<S>, cfg: &Config, no_lock: bool) -> Result<()>
 where
     S: ObjectIO<
             Error = Error,
@@ -2727,7 +2715,11 @@ where
         >,
 {
     let config_file = get_config_file();
-    let existing = match read_config_no_lock(api.clone(), &config_file).await {
+    let existing = match if no_lock {
+        read_config_no_lock(api.clone(), &config_file).await
+    } else {
+        read_config(api.clone(), &config_file).await
+    } {
         Ok(v) => Some(v),
         Err(Error::ConfigNotFound) => None,
         Err(err) => {
@@ -2751,7 +2743,21 @@ where
         return Ok(());
     }
 
-    save_config_no_lock(api, &config_file, data, guard).await
+    if no_lock {
+        save_config_with_opts(
+            api,
+            &config_file,
+            data,
+            &ObjectOptions {
+                max_parity: true,
+                no_lock: true,
+                ..Default::default()
+            },
+        )
+        .await
+    } else {
+        save_config(api, &config_file, data).await
+    }
 }
 
 pub async fn lookup_configs<S>(cfg: &mut Config, api: Arc<S>) -> Result<()>

crates/ecstore/src/core/pools.rs

@@ -3692,8 +3692,8 @@ fn activation_pool_meta_lock_error(err: rustfs_lock::LockError) -> Error {
 }
 
 pub(crate) struct PoolRebalanceActivationFence {
-    pool_meta_guard: Arc<rustfs_lock::NamespaceLockGuard>,
-    rebalance_meta_guard: Arc<rustfs_lock::NamespaceLockGuard>,
+    pool_meta_guard: rustfs_lock::NamespaceLockGuard,
+    rebalance_meta_guard: rustfs_lock::NamespaceLockGuard,
     fleet_proof: Option<crate::services::notification_sys::CrossPoolFenceFleetProofToken>,
     decommission_target_fence_proof: Option<crate::services::notification_sys::DecommissionTargetFenceFleetProofToken>,
     #[cfg(test)]
@@ -3720,12 +3720,7 @@ impl PoolRebalanceActivationFence {
         let forced_lost = self.forced_lost.load(Ordering::Acquire);
         #[cfg(not(test))]
         let forced_lost = false;
-        if forced_lost
-            || self.pool_meta_guard.is_lock_lost()
-            || self.pool_meta_guard.is_released()
-            || self.rebalance_meta_guard.is_lock_lost()
-            || self.rebalance_meta_guard.is_released()
-        {
+        if forced_lost || self.pool_meta_guard.is_lock_lost() || self.rebalance_meta_guard.is_lock_lost() {
             return Err(Error::other("activation lock lost before metadata commit or worker admission"));
         }
         if self
@@ -3747,8 +3742,8 @@ impl PoolRebalanceActivationFence {
     }
 
     pub(crate) fn add_namespace_lock_fence(&self, opts: &mut ObjectOptions) {
-        opts.add_owned_write_lock(Arc::clone(&self.pool_meta_guard), RUSTFS_META_BUCKET, POOL_META_NAME);
-        opts.add_owned_write_lock(Arc::clone(&self.rebalance_meta_guard), RUSTFS_META_BUCKET, REBAL_META_NAME);
+        opts.add_namespace_lock_guard(&self.pool_meta_guard);
+        opts.add_namespace_lock_guard(&self.rebalance_meta_guard);
     }
 
     #[cfg(test)]
@@ -3789,8 +3784,8 @@ where
         .map_err(activation_pool_meta_lock_error)?;
 
     Ok(PoolRebalanceActivationFence {
-        pool_meta_guard: Arc::new(pool_meta_guard),
-        rebalance_meta_guard: Arc::new(rebalance_meta_guard),
+        pool_meta_guard,
+        rebalance_meta_guard,
         fleet_proof,
         decommission_target_fence_proof: None,
         #[cfg(test)]
@@ -4072,7 +4067,7 @@ fn rollback_start_decommission_pool_meta(pool_meta: &mut PoolMeta, previous_pool
 }
 
 fn ensure_pool_meta_write_fence(guard: &rustfs_lock::NamespaceLockGuard, operation: &str) -> Result<()> {
-    if guard.is_lock_lost() || guard.is_released() {
+    if guard.is_lock_lost() {
         return Err(Error::other(format!("{operation}: pool metadata distributed fence was lost")));
     }
     Ok(())
@@ -6344,9 +6339,6 @@ fn encode_pool_meta_v3_envelope(
 }
 
 enum PoolMetaPersistenceFence<'a> {
-    Owned(Arc<rustfs_lock::NamespaceLockGuard>),
-    OfflineRecovery,
-    #[cfg(test)]
     Distributed(Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>>),
     Activation(&'a PoolRebalanceActivationFence),
 }
@@ -6354,10 +6346,6 @@ enum PoolMetaPersistenceFence<'a> {
 impl PoolMetaPersistenceFence<'_> {
     fn ensure_held(&self) -> Result<()> {
         match self {
-            Self::Owned(guard) if guard.is_lock_lost() || guard.is_released() => {
-                Err(Error::other("pool metadata distributed fence was lost before a replica write"))
-            }
-            #[cfg(test)]
             Self::Distributed(Some(signal)) if signal.is_lost() => {
                 Err(Error::other("pool metadata distributed fence was lost before a replica write"))
             }
@@ -6366,30 +6354,14 @@ impl PoolMetaPersistenceFence<'_> {
         }
     }
 
-    fn add_to_options(&self, opts: &mut ObjectOptions, object: &str) {
+    fn add_to_options(&self, opts: &mut ObjectOptions) {
         match self {
-            Self::Owned(guard) => opts.add_owned_write_lock(Arc::clone(guard), RUSTFS_META_BUCKET, object),
-            Self::OfflineRecovery => opts.use_offline_recovery_write(),
-            #[cfg(test)]
             Self::Distributed(Some(signal)) => opts.add_namespace_lock_lost_signal(Arc::clone(signal)),
-            Self::Activation(fence) => {
-                fence.add_namespace_lock_fence(opts);
-                opts.add_owned_write_lock(Arc::clone(&fence.pool_meta_guard), RUSTFS_META_BUCKET, object);
-            }
-            #[cfg(test)]
+            Self::Activation(fence) => fence.add_namespace_lock_fence(opts),
             Self::Distributed(None) => {}
         }
     }
 
-    fn allows_concurrent_phases(&self) -> bool {
-        match self {
-            Self::Owned(guard) => guard.lock_lost_signal().is_some(),
-            #[cfg(test)]
-            Self::Distributed(signal) => signal.is_some(),
-            _ => false,
-        }
-    }
-
     fn is_activation(&self) -> bool {
         matches!(self, Self::Activation(_))
     }
@@ -6690,7 +6662,7 @@ fn pool_meta_cas_options(object: &str, token: &PoolMetaCasToken, fence: &PoolMet
         http_preconditions: Some(pool_meta_cas_preconditions(token, object)?),
         ..Default::default()
     };
-    fence.add_to_options(&mut opts, object);
+    fence.add_to_options(&mut opts);
     Ok(opts)
 }
 
@@ -7077,7 +7049,7 @@ where
         write_state,
         initialized,
         PoolMetaIdentityWriteScope::All,
-        &PoolMetaPersistenceFence::OfflineRecovery,
+        &PoolMetaPersistenceFence::Distributed(None),
         &mut transaction_arm,
     )
     .await?;
@@ -7104,7 +7076,7 @@ where
         write_state,
         false,
         PoolMetaIdentityWriteScope::Pools(pool_indices),
-        &PoolMetaPersistenceFence::OfflineRecovery,
+        &PoolMetaPersistenceFence::Distributed(None),
         &mut transaction_arm,
     )
     .await?;
@@ -8182,16 +8154,11 @@ impl PoolMeta {
             .cloned()
             .ok_or_else(|| Error::other("pool metadata save failed: no storage pools available"))?;
         let pool_meta_lock = pool.new_ns_lock(RUSTFS_META_BUCKET, POOL_META_NAME).await?;
-        let pool_meta_guard = Arc::new(pool_meta_lock.get_write_lock(get_lock_acquire_timeout()).await?);
+        let pool_meta_guard = pool_meta_lock.get_write_lock(get_lock_acquire_timeout()).await?;
         let mut write_state = PoolMetaWriteState::default();
         let indices = (0..self.pools.len()).collect::<Vec<_>>();
         let outcome = self
-            .save_no_lock_armed_scoped(
-                pools,
-                &mut write_state,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&pool_meta_guard)),
-                Some(&indices),
-            )
+            .save_no_lock_armed_scoped(pools, &mut write_state, pool_meta_guard.lock_lost_signal(), Some(&indices))
             .await?;
         outcome.disarm();
         Ok(())
@@ -8215,16 +8182,14 @@ impl PoolMeta {
     where
         S: EcstoreObjectIO,
     {
-        let outcome = self
-            .save_no_lock_armed_scoped(pools, write_state, PoolMetaPersistenceFence::OfflineRecovery, None)
-            .await?;
+        let outcome = self.save_no_lock_armed_scoped(pools, write_state, None, None).await?;
         Ok(outcome.into_committed())
     }
 
     async fn save_no_lock_with_fence<S>(
         &self,
         pools: Vec<Arc<S>>,
-        fence: PoolMetaPersistenceFence<'_>,
+        lock_lost: Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>>,
         indices: &[usize],
     ) -> Result<()>
     where
@@ -8232,7 +8197,7 @@ impl PoolMeta {
     {
         let mut write_state = PoolMetaWriteState::default();
         let outcome = self
-            .save_no_lock_armed_scoped(pools, &mut write_state, fence, Some(indices))
+            .save_no_lock_armed_scoped(pools, &mut write_state, lock_lost, Some(indices))
             .await?;
         outcome.disarm();
         Ok(())
@@ -8268,20 +8233,21 @@ impl PoolMeta {
         &self,
         pools: Vec<Arc<S>>,
         write_state: &mut PoolMetaWriteState,
-        fence: PoolMetaPersistenceFence<'_>,
+        lock_lost: Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>>,
         indices: &[usize],
     ) -> Result<PoolMetaSaveOutcome>
     where
         S: EcstoreObjectIO,
     {
-        self.save_no_lock_armed_scoped(pools, write_state, fence, Some(indices)).await
+        self.save_no_lock_armed_scoped(pools, write_state, lock_lost, Some(indices))
+            .await
     }
 
     async fn save_no_lock_armed_scoped<S>(
         &self,
         pools: Vec<Arc<S>>,
         write_state: &mut PoolMetaWriteState,
-        fence: PoolMetaPersistenceFence<'_>,
+        lock_lost: Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>>,
         indices: Option<&[usize]>,
     ) -> Result<PoolMetaSaveOutcome>
     where
@@ -8292,6 +8258,7 @@ impl PoolMeta {
         // returned outcome is dropped before publication, Drop latches the
         // sticky recovery gate.
         let mut transaction_arm = write_state.arm_transaction();
+        let fence = PoolMetaPersistenceFence::Distributed(lock_lost);
         let committed = self
             .save_no_lock_transaction(pools, write_state, &fence, indices, &mut transaction_arm)
             .await
@@ -8522,7 +8489,7 @@ impl PoolMeta {
             && selection.revision.is_generation_protocol()
             && !selection.replica_state.needs_repair
             && !bootstrap_generation_required
-            && fence.allows_concurrent_phases();
+            && matches!(fence, PoolMetaPersistenceFence::Distributed(Some(_)));
         #[cfg(feature = "e2e-test-hooks")]
         let phase_barrier = if concurrent_phases && pools.len() == 4 {
             PoolMetaPhaseBarrier::bind(&previous, &committed, revision, &durable).await?
@@ -8668,9 +8635,7 @@ impl PoolMeta {
         S: EcstoreObjectIO,
     {
         let indices = (0..self.pools.len()).collect::<Vec<_>>();
-        let outcome = self
-            .save_no_lock_armed(pools, write_state, PoolMetaPersistenceFence::OfflineRecovery, &indices)
-            .await?;
+        let outcome = self.save_no_lock_armed(pools, write_state, None, &indices).await?;
         outcome.disarm();
         Ok(())
     }
@@ -10866,7 +10831,7 @@ impl ECStore {
         &self,
         write_state: &mut PoolMetaWriteState,
         operation: &str,
-    ) -> Result<(Arc<rustfs_lock::NamespaceLockGuard>, PoolMeta)> {
+    ) -> Result<(rustfs_lock::NamespaceLockGuard, PoolMeta)> {
         self.acquire_pool_meta_write_guard_with_lock_error(write_state, operation, activation_pool_meta_lock_error)
             .await
     }
@@ -10876,7 +10841,7 @@ impl ECStore {
         write_state: &mut PoolMetaWriteState,
         operation: &str,
         map_lock_error: F,
-    ) -> Result<(Arc<rustfs_lock::NamespaceLockGuard>, PoolMeta)>
+    ) -> Result<(rustfs_lock::NamespaceLockGuard, PoolMeta)>
     where
         F: FnOnce(rustfs_lock::LockError) -> Error,
     {
@@ -10897,7 +10862,7 @@ impl ECStore {
         let selection = load_pool_meta_replicas_observing(self.pools.clone(), true, write_state).await?;
         write_state.observe_replicas(selection.replica_state);
         write_state.ensure_write_safe(operation)?;
-        Ok((Arc::new(pool_meta_guard), selection.meta))
+        Ok((pool_meta_guard, selection.meta))
     }
 
     async fn acquire_pool_meta_read_guard(
@@ -11167,7 +11132,7 @@ impl ECStore {
     pub(crate) async fn acquire_pool_meta_object_heal_fence(
         &self,
         target_pool_indices: &[usize],
-    ) -> Result<(Arc<rustfs_lock::NamespaceLockGuard>, Vec<Result<()>>)> {
+    ) -> Result<(rustfs_lock::NamespaceLockGuard, Vec<Result<()>>)> {
         let mut save_guard = self.pool_meta_save_gate.lock().await;
         let (pool_meta_guard, snapshot) = self
             .acquire_pool_meta_write_guard_with_lock_error(&mut save_guard, "pool metadata heal admission failed", Error::from)
@@ -11396,12 +11361,7 @@ impl ECStore {
         ensure_exact_delete_capacity_namespace_fences(opts, bucket, object)?;
 
         let outcome = snapshot
-            .save_no_lock_armed(
-                self.pools.clone(),
-                &mut save_guard,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&write_guard)),
-                &source_pool_indices,
-            )
+            .save_no_lock_armed(self.pools.clone(), &mut save_guard, write_guard.lock_lost_signal(), &source_pool_indices)
             .await?;
         ensure_pool_meta_write_fence(&write_guard, "exact delete capacity reconciliation save failed")?;
         for (target_pool_index, target_guard) in &target_guards {
@@ -11510,7 +11470,7 @@ impl ECStore {
             .save_no_lock_armed(
                 self.pools.clone(),
                 &mut save_guard,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&pool_meta_guard)),
+                pool_meta_guard.lock_lost_signal(),
                 &[source_pool_index],
             )
             .await?;
@@ -11699,7 +11659,7 @@ impl ECStore {
             .save_no_lock_armed(
                 self.pools.clone(),
                 &mut save_guard,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&pool_meta_guard)),
+                pool_meta_guard.lock_lost_signal(),
                 &[source_pool_index],
             )
             .await?;
@@ -12005,12 +11965,7 @@ impl ECStore {
         };
         if reservation_grew || pending_added > 0 {
             let outcome = snapshot
-                .save_no_lock_armed(
-                    self.pools.clone(),
-                    &mut save_guard,
-                    PoolMetaPersistenceFence::Owned(Arc::clone(&write_guard)),
-                    &[source_pool_index],
-                )
+                .save_no_lock_armed(self.pools.clone(), &mut save_guard, write_guard.lock_lost_signal(), &[source_pool_index])
                 .await?;
             ensure_pool_meta_write_fence(&write_guard, "decommission target capacity intent save failed")?;
             snapshot = outcome.committed.clone();
@@ -12182,12 +12137,7 @@ impl ECStore {
             return result;
         }
         let outcome = snapshot
-            .save_no_lock_armed(
-                self.pools.clone(),
-                save_guard,
-                PoolMetaPersistenceFence::Owned(Arc::clone(write_guard)),
-                &[source_pool_index],
-            )
+            .save_no_lock_armed(self.pools.clone(), save_guard, write_guard.lock_lost_signal(), &[source_pool_index])
             .await?;
         ensure_pool_meta_write_fence(write_guard, "decommission target capacity progress save failed")?;
         if let Some(target_guard) = target_guard.as_ref() {
@@ -12322,8 +12272,8 @@ impl ECStore {
             .first()
             .ok_or_else(|| Error::other("pool metadata recovery has no storage pools"))?;
         let lock = pool.new_ns_lock(RUSTFS_META_BUCKET, POOL_META_NAME).await?;
-        let guard = Arc::new(lock.get_write_lock(get_lock_acquire_timeout()).await?);
-        let fence = PoolMetaPersistenceFence::Owned(Arc::clone(&guard));
+        let guard = lock.get_write_lock(get_lock_acquire_timeout()).await?;
+        let fence = PoolMetaPersistenceFence::Distributed(guard.lock_lost_signal());
         let mut candidate = PoolMetaWriteState {
             aborted_transaction: Arc::new(AtomicBool::new(false)),
             transaction_failure: Arc::default(),
@@ -12499,12 +12449,7 @@ impl ECStore {
             merge_pool_meta_updates_for_save(&mut snapshot, &pool_meta, indices, "pool metadata save failed")?;
         }
         let outcome = snapshot
-            .save_no_lock_armed(
-                self.pools.clone(),
-                &mut save_guard,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&pool_meta_guard)),
-                indices,
-            )
+            .save_no_lock_armed(self.pools.clone(), &mut save_guard, pool_meta_guard.lock_lost_signal(), indices)
             .await?;
         let mut pool_meta = self.pool_meta.write().await;
         ensure_pool_meta_write_fence(&pool_meta_guard, "pool metadata save failed")?;
@@ -12599,12 +12544,7 @@ impl ECStore {
         };
 
         let outcome = match snapshot
-            .save_no_lock_armed(
-                self.pools.clone(),
-                &mut save_guard,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&pool_meta_guard)),
-                &[idx],
-            )
+            .save_no_lock_armed(self.pools.clone(), &mut save_guard, pool_meta_guard.lock_lost_signal(), &[idx])
             .await
         {
             Ok(outcome) => outcome,
@@ -12670,12 +12610,7 @@ impl ECStore {
         #[cfg(test)]
         decommission_test_wrap_result("bucket_completion_before_save", &bucket.name, &bucket.prefix, 0, Ok(()))?;
         let outcome = snapshot
-            .save_no_lock_armed(
-                self.pools.clone(),
-                &mut save_guard,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&pool_meta_guard)),
-                &[idx],
-            )
+            .save_no_lock_armed(self.pools.clone(), &mut save_guard, pool_meta_guard.lock_lost_signal(), &[idx])
             .await?;
         #[cfg(test)]
         decommission_test_wrap_result("bucket_completion_after_save", &bucket.name, &bucket.prefix, 0, Ok(()))?;
@@ -12809,12 +12744,7 @@ impl ECStore {
             .await?;
         rollback_start_decommission_pool_meta(&mut snapshot, previous_pool_meta, indices);
         let outcome = snapshot
-            .save_no_lock_armed(
-                self.pools.clone(),
-                &mut save_guard,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&pool_meta_guard)),
-                indices,
-            )
+            .save_no_lock_armed(self.pools.clone(), &mut save_guard, pool_meta_guard.lock_lost_signal(), indices)
             .await?;
         let mut pool_meta = self.pool_meta.write().await;
         ensure_pool_meta_write_fence(&pool_meta_guard, "decommission start rollback failed")?;
@@ -13114,7 +13044,7 @@ impl ECStore {
         save_pool_meta: Save,
     ) -> Result<()>
     where
-        Save: FnOnce(PoolMeta, PoolMetaPersistenceFence<'static>) -> SaveFuture + Send + 'static,
+        Save: FnOnce(PoolMeta, Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>>) -> SaveFuture + Send + 'static,
         SaveFuture: Future<Output = Result<()>> + Send + 'static,
     {
         let store = self.clone();
@@ -13134,7 +13064,7 @@ impl ECStore {
         save_pool_meta: Save,
     ) -> Result<()>
     where
-        Save: FnOnce(PoolMeta, PoolMetaPersistenceFence<'static>) -> SaveFuture,
+        Save: FnOnce(PoolMeta, Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>>) -> SaveFuture,
         SaveFuture: Future<Output = Result<()>>,
     {
         let owner = owner.as_ref();
@@ -13183,17 +13113,9 @@ impl ECStore {
                 ));
             }
         }
-        let pool_meta_fence = match _pool_meta_guard.as_ref() {
-            Some(guard) => PoolMetaPersistenceFence::Owned(Arc::clone(guard)),
-            None => {
-                #[cfg(test)]
-                {
-                    PoolMetaPersistenceFence::OfflineRecovery
-                }
-                #[cfg(not(test))]
-                return Err(Error::other("runtime pool metadata cancellation requires its write-lock owner"));
-            }
-        };
+        let pool_meta_fence = _pool_meta_guard
+            .as_ref()
+            .and_then(rustfs_lock::NamespaceLockGuard::lock_lost_signal);
 
         // Lock order: start gate, target gates, save gate, distributed pool
         // metadata fence, rebalance_meta, decommission_cancelers, then
@@ -13632,12 +13554,7 @@ impl ECStore {
             let (save_outcome, save_error) = if changed {
                 ensure_decommission_target_fence_fleet_proof(target_fence_proof.as_ref(), target_fence_proof_required)?;
                 match snapshot
-                    .save_no_lock_armed(
-                        self.pools.clone(),
-                        &mut save_guard,
-                        PoolMetaPersistenceFence::Owned(Arc::clone(&pool_meta_guard)),
-                        &changed_indices,
-                    )
+                    .save_no_lock_armed(self.pools.clone(), &mut save_guard, pool_meta_guard.lock_lost_signal(), &changed_indices)
                     .await
                 {
                     Ok(outcome) => (Some(outcome), None),
@@ -13729,12 +13646,7 @@ impl ECStore {
             .await?;
         snapshot.mark_decommission_capacity_blocked(idx, err.to_string(), OffsetDateTime::now_utc())?;
         let outcome = snapshot
-            .save_no_lock_armed(
-                self.pools.clone(),
-                &mut save_guard,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&pool_meta_guard)),
-                &[idx],
-            )
+            .save_no_lock_armed(self.pools.clone(), &mut save_guard, pool_meta_guard.lock_lost_signal(), &[idx])
             .await?;
         ensure_pool_meta_write_fence(&pool_meta_guard, "decommission capacity pause failed")?;
         {
@@ -22111,7 +22023,7 @@ mod tests {
             let mut state = store.pool_meta_save_gate.lock().await;
             let (fence, _) = store.acquire_pool_meta_write_guard(&mut state, "test save").await.unwrap();
             let outcome = requested
-                .save_no_lock_armed(store.pools.clone(), &mut state, PoolMetaPersistenceFence::Owned(Arc::clone(&fence)), &[0])
+                .save_no_lock_armed(store.pools.clone(), &mut state, fence.lock_lost_signal(), &[0])
                 .await
                 .unwrap();
             assert_eq!(outcome.committed.pools[0].last_update, requested.pools[0].last_update);
@@ -24913,12 +24825,11 @@ mod pools_tests {
             config[3][0].gate = Some(gate.clone());
             let fixture = Fixture::new(config);
             let mut state = fixture.state();
-            let mut save = Box::pin(fixture.desired.save_no_lock_armed(
-                fixture.pools.clone(),
-                &mut state,
-                PoolMetaPersistenceFence::Distributed(signal()),
-                &[0],
-            ));
+            let mut save = Box::pin(
+                fixture
+                    .desired
+                    .save_no_lock_armed(fixture.pools.clone(), &mut state, signal(), &[0]),
+            );
             tokio::select! { _ = fixture.trace.wait_for(4, 3) => {}, _ = &mut save => panic!("commit crossed the last prepare") }
             assert_eq!(fixture.trace.commit_count(), 0);
             gate.add_permits(1);
@@ -24938,7 +24849,7 @@ mod pools_tests {
             let mut state = fixture.state();
             let err = fixture
                 .desired
-                .save_no_lock_armed(fixture.pools.clone(), &mut state, PoolMetaPersistenceFence::Distributed(signal()), &[0])
+                .save_no_lock_armed(fixture.pools.clone(), &mut state, signal(), &[0])
                 .await
                 .expect_err("a missing conditional-write revision must fail");
             assert!(err.to_string().contains("without a conditional-write revision"));
@@ -24955,12 +24866,11 @@ mod pools_tests {
             config[3][0].gate = Some(gate.clone());
             let fixture = Fixture::new(config);
             let mut state = fixture.state();
-            let mut save = Box::pin(fixture.desired.save_no_lock_armed(
-                fixture.pools.clone(),
-                &mut state,
-                PoolMetaPersistenceFence::Distributed(signal()),
-                &[0],
-            ));
+            let mut save = Box::pin(
+                fixture
+                    .desired
+                    .save_no_lock_armed(fixture.pools.clone(), &mut state, signal(), &[0]),
+            );
             tokio::select! { _ = fixture.trace.wait_for(4, 3) => {}, _ = &mut save => panic!("phase returned with a live replica") }
             assert_eq!(fixture.trace.commit_count(), 0);
             gate.add_permits(1);
@@ -25135,12 +25045,11 @@ mod pools_tests {
                 }
                 let fixture = Fixture::new(config);
                 let mut state = fixture.state();
-                let mut save = Box::pin(fixture.desired.save_no_lock_armed(
-                    fixture.pools.clone(),
-                    &mut state,
-                    PoolMetaPersistenceFence::Distributed(signal()),
-                    &[0],
-                ));
+                let mut save = Box::pin(
+                    fixture
+                        .desired
+                        .save_no_lock_armed(fixture.pools.clone(), &mut state, signal(), &[0]),
+                );
                 tokio::select! { _ = fixture.trace.wait_for(4 * (phase + 1), 4 * phase) => {}, _ = &mut save => panic!("blocked phase finished") }
                 drop(save);
                 assert!(state.ensure_write_safe("cancelled phase").is_err());
@@ -25151,7 +25060,7 @@ mod pools_tests {
             let mut state = fixture.state();
             let outcome = fixture
                 .desired
-                .save_no_lock_armed(fixture.pools.clone(), &mut state, PoolMetaPersistenceFence::Distributed(signal()), &[0])
+                .save_no_lock_armed(fixture.pools.clone(), &mut state, signal(), &[0])
                 .await
                 .expect("durable save before publication");
             drop(outcome);
@@ -25179,7 +25088,6 @@ mod pools_tests {
                 .await
                 .expect("lease request")
                 .expect("lease acquired");
-            let guard = Arc::new(guard);
             let gate = Arc::new(tokio::sync::Semaphore::new(0));
             let mut config = steps(6);
             for step in &mut config {
@@ -25188,7 +25096,7 @@ mod pools_tests {
             let fixture = Fixture::new(config);
             let state = fixture.state();
             let mut arm = state.arm_transaction();
-            let fence = PoolMetaPersistenceFence::Owned(Arc::clone(&guard));
+            let fence = PoolMetaPersistenceFence::Distributed(guard.lock_lost_signal());
             let mut pending = Box::pin(prepare(&fixture, &fence, &mut arm));
             tokio::select! { _ = fixture.trace.wait_for(4, 0) => {}, _ = &mut pending => panic!("gate ignored") }
             tokio::time::timeout(StdDuration::from_secs(3), guard.lock_lost_notified())
@@ -25214,7 +25122,7 @@ mod pools_tests {
                 let mut state = fixture.state();
                 let result = fixture
                     .desired
-                    .save_no_lock_armed(fixture.pools.clone(), &mut state, PoolMetaPersistenceFence::Distributed(signal()), &[0])
+                    .save_no_lock_armed(fixture.pools.clone(), &mut state, signal(), &[0])
                     .await;
                 assert_eq!(fixture.trace.commit_count(), 4);
                 if matches!(fault, WriteFault::TimeoutAfterWrite) {
@@ -25264,7 +25172,7 @@ mod pools_tests {
                 let mut save = Box::pin(fixture.desired.save_no_lock_armed(
                     fixture.pools.clone(),
                     &mut state,
-                    PoolMetaPersistenceFence::Distributed(if legacy || needs_repair { signal() } else { None }),
+                    if legacy || needs_repair { signal() } else { None },
                     &[0],
                 ));
                 tokio::select! { _ = fixture.trace.wait_for(1, 0) => {}, _ = &mut save => panic!("serial write gate ignored") }
@@ -25824,7 +25732,7 @@ mod pools_tests {
         let save_task = tokio::spawn(async move {
             let mut save_guard = save_store.pool_meta_save_gate.lock().await;
             let outcome = snapshot
-                .save_no_lock_armed(vec![save_committed], &mut save_guard, PoolMetaPersistenceFence::OfflineRecovery, &[0])
+                .save_no_lock_armed(vec![save_committed], &mut save_guard, None, &[0])
                 .await?;
             task_publish_started.notify_one();
             task_publish_release.notified().await;
@@ -25851,73 +25759,6 @@ mod pools_tests {
             .expect_err("cancellation after replica save but before publication must keep writes blocked");
     }
 
-    #[tokio::test]
-    async fn pool_meta_cas_context_retains_actual_owner_for_exact_target() {
-        use crate::object_api::write_commit_context::WriteCommitContext;
-
-        let lock = NamespaceLock::with_local_manager("pool-meta-cas-owner".to_string(), Arc::new(GlobalLockManager::new()));
-        let request = LockRequest::new(
-            ObjectKey::new(super::RUSTFS_META_BUCKET, POOL_META_NAME),
-            LockType::Exclusive,
-            "cas-writer",
-        )
-        .with_acquire_timeout(StdDuration::from_secs(1));
-        let owner = Arc::new(
-            lock.acquire_guard(&request)
-                .await
-                .expect("pool metadata lock acquisition should succeed")
-                .expect("pool metadata lock should be available"),
-        );
-        let weak_owner = Arc::downgrade(&owner);
-        let fence = PoolMetaPersistenceFence::Owned(Arc::clone(&owner));
-        let mut contexts = Vec::new();
-        for object in [POOL_META_NAME, POOL_META_IDENTITY_NAME] {
-            let options = super::pool_meta_cas_options(object, &PoolMetaCasToken::Missing, &fence)
-                .expect("a held pool metadata lock should authorize its CAS target");
-            let cloned_options = options.clone();
-            let context = WriteCommitContext::from_options(&cloned_options, super::RUSTFS_META_BUCKET, object, false)
-                .expect("the actual CAS target should retain its borrowed namespace owner");
-            assert!(context.has_borrowed_owner(), "CAS must borrow the real protocol lock owner");
-            assert!(
-                WriteCommitContext::from_options(&cloned_options, super::RUSTFS_META_BUCKET, "unrelated-object", false).is_err(),
-                "a pool metadata CAS capability must not authorize an unrelated object"
-            );
-            drop(options);
-            drop(cloned_options);
-            contexts.push(context);
-        }
-        drop(fence);
-        drop(owner);
-        assert!(
-            weak_owner.upgrade().is_some(),
-            "queued commit contexts must keep the actual lock guard alive"
-        );
-        drop(contexts);
-        assert!(weak_owner.upgrade().is_none(), "the last commit context must release its lock owner");
-    }
-
-    #[tokio::test]
-    async fn pool_meta_cas_rejects_released_owner() {
-        let lock = NamespaceLock::with_local_manager("pool-meta-released-owner".to_string(), Arc::new(GlobalLockManager::new()));
-        let request = LockRequest::new(
-            ObjectKey::new(super::RUSTFS_META_BUCKET, POOL_META_NAME),
-            LockType::Exclusive,
-            "released-cas-writer",
-        )
-        .with_acquire_timeout(StdDuration::from_secs(1));
-        let mut owner = lock
-            .acquire_guard(&request)
-            .await
-            .expect("pool metadata lock acquisition should succeed")
-            .expect("pool metadata lock should be available");
-        assert!(owner.release(), "the test must release a real namespace owner");
-        let fence = PoolMetaPersistenceFence::Owned(Arc::new(owner));
-        assert!(
-            super::pool_meta_cas_options(POOL_META_NAME, &PoolMetaCasToken::Missing, &fence).is_err(),
-            "a released namespace owner must not dispatch another CAS"
-        );
-    }
-
     #[tokio::test]
     async fn test_lost_pool_meta_fence_rejects_replica_write() {
         let client = Arc::new(LocalClient::with_manager(Arc::new(GlobalLockManager::new())));
@@ -25935,7 +25776,6 @@ mod pools_tests {
             .await
             .expect("pool metadata fence acquisition should not error")
             .expect("the stale writer should acquire the pool metadata fence");
-        let guard = Arc::new(guard);
         tokio::time::timeout(StdDuration::from_secs(2), guard.lock_lost_notified())
             .await
             .expect("the stale writer lease should expire");
@@ -25957,12 +25797,7 @@ mod pools_tests {
         };
         let mut write_state = super::PoolMetaWriteState::default();
         let err = snapshot
-            .save_no_lock_armed(
-                vec![storage.clone()],
-                &mut write_state,
-                PoolMetaPersistenceFence::Owned(Arc::clone(&guard)),
-                &[0],
-            )
+            .save_no_lock_armed(vec![storage.clone()], &mut write_state, guard.lock_lost_signal(), &[0])
             .await
             .expect_err("a writer must not persist after losing the distributed pool metadata fence");
 
@@ -25990,7 +25825,6 @@ mod pools_tests {
             .await
             .expect("pool metadata fence acquisition should not error")
             .expect("the publishing writer should acquire the pool metadata fence");
-        let guard = Arc::new(guard);
         let storage = Arc::new(PartialPoolMetaWriteStorage {
             fail_write: false,
             fail_after_first_write: false,
@@ -26011,7 +25845,7 @@ mod pools_tests {
         current.pools[0].last_update = OffsetDateTime::UNIX_EPOCH;
         let mut write_state = super::PoolMetaWriteState::for_test_bootstrap();
         let outcome = saved
-            .save_no_lock_armed(vec![storage], &mut write_state, PoolMetaPersistenceFence::Owned(Arc::clone(&guard)), &[0])
+            .save_no_lock_armed(vec![storage], &mut write_state, guard.lock_lost_signal(), &[0])
             .await
             .expect("the replica save should finish while the fence is valid");
 

crates/ecstore/src/data_usage/mod.rs

@@ -738,12 +738,7 @@ where
         .filter(|etag| !etag.is_empty())
         .map(str::to_owned)
         .ok_or_else(|| Error::other("data usage snapshot has no ETag"))?;
-    let mut data_usage_info = parse_usage_snapshot(
-        &reader
-            .read_all()
-            .await
-            .map_err(|err| map_data_usage_metadata_read_error(err, object))?,
-    )?;
+    let mut data_usage_info = parse_usage_snapshot(&reader.read_all().await?)?;
     populate_backward_compatible_usage_maps(&mut data_usage_info);
     validate_complete_usage_snapshot(&mut data_usage_info);
     Ok(Some((data_usage_info, revision)))
@@ -3002,61 +2997,6 @@ mod tests {
         }
     }
 
-    #[derive(Debug)]
-    struct UsageSnapshotReadFailureStore;
-
-    struct UsageSnapshotFailureReader;
-
-    impl tokio::io::AsyncRead for UsageSnapshotFailureReader {
-        fn poll_read(
-            self: std::pin::Pin<&mut Self>,
-            _cx: &mut std::task::Context<'_>,
-            _buf: &mut tokio::io::ReadBuf<'_>,
-        ) -> std::task::Poll<std::io::Result<()>> {
-            std::task::Poll::Ready(Err(std::io::Error::other(Error::VolumeNotFound)))
-        }
-    }
-
-    #[async_trait::async_trait]
-    impl crate::storage_api_contracts::object::ObjectIO for UsageSnapshotReadFailureStore {
-        type Error = Error;
-        type RangeSpec = crate::storage_api_contracts::range::HTTPRangeSpec;
-        type HeaderMap = http::HeaderMap;
-        type ObjectOptions = ObjectOptions;
-        type ObjectInfo = ObjectInfo;
-        type GetObjectReader = crate::object_api::GetObjectReader;
-        type PutObjectReader = PutObjReader;
-
-        async fn get_object_reader(
-            &self,
-            _bucket: &str,
-            _object: &str,
-            _range: Option<Self::RangeSpec>,
-            _headers: Self::HeaderMap,
-            _opts: &Self::ObjectOptions,
-        ) -> Result<Self::GetObjectReader, Self::Error> {
-            Ok(crate::object_api::GetObjectReader {
-                stream: Box::new(UsageSnapshotFailureReader),
-                object_info: ObjectInfo {
-                    etag: Some("usage-revision".to_string()),
-                    ..Default::default()
-                },
-                buffered_body: None,
-                body_source: Default::default(),
-            })
-        }
-
-        async fn put_object(
-            &self,
-            _bucket: &str,
-            _object: &str,
-            _data: &mut Self::PutObjectReader,
-            _opts: &Self::ObjectOptions,
-        ) -> Result<Self::ObjectInfo, Self::Error> {
-            unimplemented!("the read-failure fixture does not write")
-        }
-    }
-
     /// Minimal ObjectIO backing `load_data_usage_cache` tests: records the keys
     /// read and fails the first N reads with a transient (non-absence) error.
     #[derive(Debug, Default)]
@@ -3221,20 +3161,6 @@ mod tests {
         }
     }
 
-    #[tokio::test]
-    async fn data_usage_removal_maps_missing_system_volume_during_snapshot_stream_read() {
-        let store = UsageSnapshotReadFailureStore;
-
-        let error = load_data_usage_for_bucket_removal(&store, "bucket-metadata/.usage.json")
-            .await
-            .expect_err("a system volume disappearing during body read must remain a retryable storage error");
-
-        assert_eq!(
-            error,
-            Error::InsufficientReadQuorum(RUSTFS_META_BUCKET.to_string(), "bucket-metadata/.usage.json".to_string())
-        );
-    }
-
     #[tokio::test]
     async fn load_data_usage_cache_retries_a_transient_failure() {
         let name = "usage-cache";

crates/ecstore/src/diagnostics/object_lock.rs

@@ -12,7 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use rustfs_io_metrics::record_object_lock_acquire_failure;
 use rustfs_lock::{LockError, NamespaceLockGuard, NamespaceLockWrapper};
 use std::time::{Duration, Instant};
 use tracing::Span;
@@ -22,26 +21,6 @@ const EVENT_OBJECT_NAMESPACE_LOCK: &str = "object_namespace_lock";
 const LOG_COMPONENT_ECSTORE: &str = "ecstore";
 const LOG_SUBSYSTEM_OBJECT_LOCK: &str = "object_lock";
 
-pub(crate) fn record_lock_acquire_failure(op: &'static str, bucket: &str, object: &str, mode: &'static str, error: &LockError) {
-    let resource_class = if bucket == crate::disk::RUSTFS_META_MULTIPART_BUCKET {
-        "multipart_metadata"
-    } else if bucket == crate::disk::RUSTFS_META_BUCKET || bucket == ".minio.sys" {
-        "system_metadata"
-    } else if object.is_empty() || object == bucket {
-        "bucket_namespace"
-    } else {
-        "object_namespace"
-    };
-    let reason = match error {
-        LockError::Timeout { .. } => "timeout",
-        LockError::AlreadyLocked { .. } => "contention",
-        LockError::QuorumNotReached { .. } | LockError::InsufficientNodes { .. } => "quorum",
-        LockError::Network { .. } | LockError::Internal { .. } => "transport",
-        _ => "other",
-    };
-    record_object_lock_acquire_failure(op, mode, resource_class, reason);
-}
-
 /// Diagnostic lifetime only; it never owns or changes a namespace lock.
 /// Keep it alongside the real guard when ownership moves to a commit tail.
 #[derive(Default)]

crates/ecstore/src/disk/disk_store.rs

@@ -12,10 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::disk::io_admission::{
-    AdmissionReader, BoxedChunkReader, DiskIoAdmission, DiskIoClass, DiskIoContext, current_disk_io_context,
-    with_disk_io_context, with_disk_io_permit,
-};
 use crate::disk::{
     CheckPartsResp, DataDirDeleteStatus, DeleteOptions, DiskAPI, DiskError, DiskInfo, DiskInfoOptions, DiskLocation, Endpoint,
     Error, FileInfoVersions, MmapCopyStageMetrics, ReadMultipleReq, ReadMultipleResp, ReadOptions, RenameDataResp, Result,
@@ -39,15 +35,13 @@ use std::sync::atomic::AtomicBool;
 use std::{
     collections::HashMap,
     path::PathBuf,
-    pin::Pin,
     sync::{
         Arc, LazyLock, RwLock as StdRwLock,
         atomic::{AtomicI64, AtomicU32, AtomicU64, Ordering},
     },
-    task::{Context, Poll},
     time::{Duration, Instant, SystemTime, UNIX_EPOCH},
 };
-use tokio::{io::AsyncWrite, sync::RwLock, time};
+use tokio::{sync::RwLock, time};
 use tokio_util::sync::CancellationToken;
 use tracing::{info, warn};
 use uuid::Uuid;
@@ -60,121 +54,6 @@ const LOG_SUBSYSTEM_DISK: &str = "disk";
 const EVENT_DISK_HEALTH_CHECK_FAILED: &str = "disk_health_check_failed";
 const EVENT_DISK_RECOVERY_PROBE_STATE: &str = "disk_recovery_probe_state";
 const EVENT_DISK_TIMEOUT_POLICY_FALLBACK: &str = "disk_timeout_policy_fallback";
-const EVENT_DISK_OPERATION_SLOW: &str = "disk_operation_slow";
-const SLOW_DISK_OPERATION_THRESHOLD: Duration = Duration::from_secs(5);
-
-fn warn_slow_disk_operation(endpoint: &Endpoint, op: &'static str, elapsed: Duration) {
-    warn!(
-        event = EVENT_DISK_OPERATION_SLOW,
-        component = LOG_COMPONENT_ECSTORE,
-        subsystem = LOG_SUBSYSTEM_DISK,
-        state = "pending",
-        endpoint = %endpoint,
-        op,
-        elapsed_ms = elapsed.as_millis(),
-        threshold_ms = SLOW_DISK_OPERATION_THRESHOLD.as_millis(),
-        "Disk operation is still pending"
-    );
-}
-
-async fn observe_disk_operation<F: std::future::Future>(
-    endpoint: impl FnOnce() -> Endpoint,
-    op: &'static str,
-    operation: F,
-) -> F::Output {
-    if !tracing::enabled!(tracing::Level::WARN) {
-        return operation.await;
-    }
-    let started = time::Instant::now();
-    tokio::pin!(operation);
-    tokio::select! {
-        biased;
-        result = &mut operation => result,
-        _ = time::sleep(SLOW_DISK_OPERATION_THRESHOLD) => {
-            warn_slow_disk_operation(&endpoint(), op, started.elapsed());
-            operation.await
-        }
-    }
-}
-
-struct SlowDiskWriter {
-    inner: crate::disk::FileWriter,
-    endpoint: Endpoint,
-    pending: Option<(&'static str, time::Instant)>,
-    timer: Option<Pin<Box<time::Sleep>>>,
-    warned: bool,
-}
-
-impl SlowDiskWriter {
-    fn new(inner: crate::disk::FileWriter, endpoint: Endpoint) -> Self {
-        Self {
-            inner,
-            endpoint,
-            pending: None,
-            timer: None,
-            warned: false,
-        }
-    }
-
-    fn observe<T>(&mut self, cx: &mut Context<'_>, op: &'static str, result: Poll<T>) -> Poll<T> {
-        if result.is_ready() {
-            self.pending = None;
-            self.warned = false;
-        } else if tracing::enabled!(tracing::Level::WARN) {
-            if self.pending.is_none_or(|(pending_op, _)| pending_op != op) {
-                let started = time::Instant::now();
-                self.pending = Some((op, started));
-                self.warned = false;
-                let deadline = started + SLOW_DISK_OPERATION_THRESHOLD;
-                // Reuse one timer per stream; ready writes need no timer allocation.
-                if let Some(timer) = &mut self.timer {
-                    timer.as_mut().reset(deadline);
-                } else {
-                    self.timer = Some(Box::pin(time::sleep_until(deadline)));
-                }
-            }
-            if !self.warned
-                && let Some(timer) = &mut self.timer
-                && std::future::Future::poll(timer.as_mut(), cx).is_ready()
-                && let Some((_, started)) = self.pending
-            {
-                warn_slow_disk_operation(&self.endpoint, op, started.elapsed());
-                self.warned = true;
-            }
-        }
-        result
-    }
-}
-
-impl AsyncWrite for SlowDiskWriter {
-    fn poll_write(mut self: Pin<&mut Self>, cx: &mut Context<'_>, buf: &[u8]) -> Poll<std::io::Result<usize>> {
-        let result = Pin::new(&mut self.inner).poll_write(cx, buf);
-        self.observe(cx, "write", result)
-    }
-
-    fn poll_write_vectored(
-        mut self: Pin<&mut Self>,
-        cx: &mut Context<'_>,
-        bufs: &[std::io::IoSlice<'_>],
-    ) -> Poll<std::io::Result<usize>> {
-        let result = Pin::new(&mut self.inner).poll_write_vectored(cx, bufs);
-        self.observe(cx, "write_vectored", result)
-    }
-
-    fn is_write_vectored(&self) -> bool {
-        self.inner.is_write_vectored()
-    }
-
-    fn poll_flush(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<std::io::Result<()>> {
-        let result = Pin::new(&mut self.inner).poll_flush(cx);
-        self.observe(cx, "flush", result)
-    }
-
-    fn poll_shutdown(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<std::io::Result<()>> {
-        let result = Pin::new(&mut self.inner).poll_shutdown(cx);
-        self.observe(cx, "shutdown", result)
-    }
-}
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 enum TimeoutHealthAction {
@@ -934,7 +813,6 @@ impl Drop for DiskMetricWaitingGuard<'_> {
 pub(crate) struct ReconnectDiskHealthState {
     pub(crate) health: Arc<DiskHealthTracker>,
     pub(crate) metrics: Arc<DiskHealthMetricEpoch>,
-    pub(crate) io_admission: Arc<DiskIoAdmission>,
 }
 
 #[derive(Debug)]
@@ -1451,8 +1329,6 @@ pub struct LocalDiskWrapper {
     health: Arc<DiskHealthTracker>,
     /// Internal metrics epoch preserved across local disk reconnects.
     metrics: Arc<DiskHealthMetricEpoch>,
-    /// Per-drive foreground/background admission shared across wrapper reconnects.
-    io_admission: Arc<DiskIoAdmission>,
     /// Whether health checking is enabled
     health_check: bool,
     /// Cancellation token for monitoring tasks
@@ -1466,13 +1342,11 @@ pub struct LocalDiskWrapper {
 impl LocalDiskWrapper {
     /// Create a new LocalDiskWrapper
     pub fn new(disk: Arc<LocalDisk>, health_check: bool) -> Self {
-        let admission = DiskIoAdmission::new(disk.endpoint().to_string());
         Self::new_with_health_and_metrics(
             disk,
             health_check,
             Arc::new(DiskHealthTracker::new()),
             Arc::new(DiskHealthMetricEpoch::default()),
-            admission,
         )
     }
 
@@ -1512,13 +1386,11 @@ impl LocalDiskWrapper {
         health_check: bool,
         reconnect: Option<ReconnectDiskHealthState>,
     ) -> Self {
-        let endpoint = disk.endpoint().to_string();
         let reconnect = reconnect.unwrap_or_else(|| ReconnectDiskHealthState {
             health: Arc::new(DiskHealthTracker::new()),
             metrics: Arc::new(DiskHealthMetricEpoch::default()),
-            io_admission: DiskIoAdmission::new(endpoint),
         });
-        Self::new_with_health_and_metrics(disk, health_check, reconnect.health, reconnect.metrics, reconnect.io_admission)
+        Self::new_with_health_and_metrics(disk, health_check, reconnect.health, reconnect.metrics)
     }
 
     fn new_with_health_and_metrics(
@@ -1526,7 +1398,6 @@ impl LocalDiskWrapper {
         health_check: bool,
         health: Arc<DiskHealthTracker>,
         metrics: Arc<DiskHealthMetricEpoch>,
-        io_admission: Arc<DiskIoAdmission>,
     ) -> Self {
         // Check environment variable for health check override.
         // Only enable if both param and env are true.
@@ -1537,7 +1408,6 @@ impl LocalDiskWrapper {
             disk,
             health,
             metrics,
-            io_admission,
             health_check: health_check && env_health_check,
             cancel_token: CancellationToken::new(),
             disk_id: Arc::new(RwLock::new(None)),
@@ -1551,7 +1421,6 @@ impl LocalDiskWrapper {
         ReconnectDiskHealthState {
             health: Arc::new(self.health.metric_epoch_for_reconnect()),
             metrics: self.metrics.clone(),
-            io_admission: self.io_admission.clone(),
         }
     }
 
@@ -1559,58 +1428,6 @@ impl LocalDiskWrapper {
         self.disk.clone()
     }
 
-    #[cfg(test)]
-    pub(crate) fn background_io_admissions_for_tests(&self) -> usize {
-        self.io_admission.background_admissions_for_tests()
-    }
-
-    #[cfg(test)]
-    pub(crate) fn background_io_active_for_tests(&self) -> bool {
-        self.io_admission.background_active_for_tests()
-    }
-
-    fn disk_io_context(&self) -> DiskIoContext {
-        current_disk_io_context().unwrap_or_else(|| DiskIoContext {
-            class: DiskIoClass::Foreground,
-            cancellation: CancellationToken::new(),
-            admission: None,
-            permit: None,
-        })
-    }
-
-    fn disk_walk_io_context(&self) -> DiskIoContext {
-        let mut context = self.disk_io_context();
-        context.admission = Some(self.io_admission.clone());
-        context.permit = None;
-        context
-    }
-
-    async fn acquire_disk_io_permit(&self) -> Result<Option<crate::disk::io_admission::DiskIoPermit>> {
-        if let Some(context) = current_disk_io_context() {
-            if let Some(permit) = context.permit
-                && permit.is_for(&self.io_admission)
-            {
-                return Ok(Some(permit));
-            }
-            if context
-                .admission
-                .as_ref()
-                .is_some_and(|admission| Arc::ptr_eq(admission, &self.io_admission))
-            {
-                return Ok(None);
-            }
-            if context.class == DiskIoClass::Background {
-                return self
-                    .io_admission
-                    .background(&context.cancellation)
-                    .await
-                    .map(Some)
-                    .map_err(DiskError::Io);
-            }
-        }
-        Ok(Some(self.io_admission.foreground()))
-    }
-
     pub fn get_object_path_if_local(&self, volume: &str, path: &str) -> crate::disk::error::Result<std::path::PathBuf> {
         self.disk.get_object_path(volume, path)
     }
@@ -2082,31 +1899,6 @@ impl LocalDiskWrapper {
     where
         F: FnOnce() -> Fut,
         Fut: std::future::Future<Output = Result<T>>,
-    {
-        self.track_disk_health_with_op_timeout_action_and_mutation_with_io_permit(
-            op,
-            move |io_permit| async move {
-                let _io_permit = io_permit;
-                operation().await
-            },
-            timeout_duration,
-            timeout_health_action,
-            mutation,
-        )
-        .await
-    }
-
-    async fn track_disk_health_with_op_timeout_action_and_mutation_with_io_permit<T, F, Fut>(
-        &self,
-        op: &'static str,
-        operation: F,
-        timeout_duration: Duration,
-        timeout_health_action: TimeoutHealthAction,
-        mutation: DiskMetricMutation,
-    ) -> Result<T>
-    where
-        F: FnOnce(Option<crate::disk::io_admission::DiskIoPermit>) -> Fut,
-        Fut: std::future::Future<Output = Result<T>>,
     {
         self.metrics.record_operation_call(op);
         // Check if disk is faulty
@@ -2129,17 +1921,14 @@ impl LocalDiskWrapper {
             return Err(err);
         }
 
-        let io_permit = self.acquire_disk_io_permit().await?;
-
         // Record operation start
         self.health.last_started.store(current_unix_nanos(), Ordering::Relaxed);
         let _waiting_guard = self.health.waiting_guard();
         let _metric_waiting_guard = self.metrics.waiting_guard();
         let started = Instant::now();
-        let operation = observe_disk_operation(|| self.endpoint(), op, operation(io_permit));
 
         if timeout_duration == Duration::ZERO {
-            let result = operation.await;
+            let result = operation().await;
             self.metrics.record_operation_latency(op, started.elapsed());
             self.record_result_error_metrics(&result);
             if result.is_ok() {
@@ -2149,7 +1938,7 @@ impl LocalDiskWrapper {
             return result;
         }
         // Execute the operation with timeout
-        let result = tokio::time::timeout(timeout_duration, operation).await;
+        let result = tokio::time::timeout(timeout_duration, operation()).await;
 
         match result {
             Ok(operation_result) => {
@@ -2200,12 +1989,11 @@ impl DiskAPI for LocalDiskWrapper {
     }
 
     async fn read_metadata(&self, volume: &str, path: &str) -> Result<Bytes> {
-        self.track_disk_health_with_op_timeout_action_and_mutation_with_io_permit(
+        self.track_disk_health_with_op_and_timeout_action(
             "read_metadata",
-            |io_permit| async { self.disk.read_metadata_with_permit(volume, path, io_permit).await },
+            || async { self.disk.read_metadata(volume, path).await },
             get_drive_metadata_timeout(),
             self.scanner_timeout_health_action(),
-            DiskMetricMutation::None,
         )
         .await
     }
@@ -2377,15 +2165,12 @@ impl DiskAPI for LocalDiskWrapper {
             opts.timeout_duration().unwrap_or_else(get_drive_walkdir_timeout)
         };
 
-        with_disk_io_context(
-            self.disk_walk_io_context(),
-            self.track_disk_health_with_op_and_timeout_action(
-                "walk_dir",
-                || async { self.disk.walk_dir(opts, wr).await },
-                timeout_duration,
-                // Listing/scanner backpressure should fail only the current walk, not poison drive health.
-                TimeoutHealthAction::IgnoreFailure,
-            ),
+        self.track_disk_health_with_op_and_timeout_action(
+            "walk_dir",
+            || async { self.disk.walk_dir(opts, wr).await },
+            timeout_duration,
+            // Listing/scanner backpressure should fail only the current walk, not poison drive health.
+            TimeoutHealthAction::IgnoreFailure,
         )
         .await
     }
@@ -2408,7 +2193,6 @@ impl DiskAPI for LocalDiskWrapper {
     }
 
     async fn delete_versions(&self, volume: &str, versions: Vec<FileInfoVersions>, opts: DeleteOptions) -> Vec<Option<Error>> {
-        let version_count = versions.len();
         self.metrics.record_operation_call("delete_versions");
         // Check if disk is faulty before proceeding
         if self.health.is_faulty() {
@@ -2422,14 +2206,9 @@ impl DiskAPI for LocalDiskWrapper {
             return vec![Some(e); versions.len()];
         }
 
-        let _io_permit = match self.acquire_disk_io_permit().await {
-            Ok(permit) => permit,
-            Err(error) => return vec![Some(error); version_count],
-        };
-
         // Record operation start
         self.health.last_started.store(current_unix_nanos(), Ordering::Relaxed);
-        let waiting_guard = self.health.waiting_guard();
+        self.health.increment_waiting();
         let metric_waiting_guard = self.metrics.waiting_guard();
         let started = Instant::now();
 
@@ -2438,7 +2217,7 @@ impl DiskAPI for LocalDiskWrapper {
         self.metrics.record_operation_latency("delete_versions", started.elapsed());
         self.record_batch_delete_error_metrics(&result);
 
-        drop(waiting_guard);
+        self.health.decrement_waiting();
         drop(metric_waiting_guard);
         let has_err = result.iter().any(|e| e.is_some());
         if !has_err {
@@ -2543,25 +2322,19 @@ impl DiskAPI for LocalDiskWrapper {
         version_id: &str,
         opts: &ReadOptions,
     ) -> Result<FileInfo> {
-        self.track_disk_health_with_op_timeout_action_and_mutation_with_io_permit(
+        self.track_disk_health_with_op(
             "read_version",
-            |io_permit| async move {
-                with_disk_io_permit(io_permit, self.disk.read_version(org_volume, volume, path, version_id, opts)).await
-            },
+            || async { self.disk.read_version(org_volume, volume, path, version_id, opts).await },
             get_max_timeout_duration(),
-            TimeoutHealthAction::MarkFailure,
-            DiskMetricMutation::None,
         )
         .await
     }
 
     async fn read_xl(&self, volume: &str, path: &str, read_data: bool) -> Result<RawFileInfo> {
-        self.track_disk_health_with_op_timeout_action_and_mutation_with_io_permit(
+        self.track_disk_health_with_op(
             "read_xl",
-            |io_permit| async move { with_disk_io_permit(io_permit, self.disk.read_xl(volume, path, read_data)).await },
+            || async { self.disk.read_xl(volume, path, read_data).await },
             get_max_timeout_duration(),
-            TimeoutHealthAction::MarkFailure,
-            DiskMetricMutation::None,
         )
         .await
     }
@@ -2589,25 +2362,21 @@ impl DiskAPI for LocalDiskWrapper {
     }
 
     async fn read_file(&self, volume: &str, path: &str) -> Result<crate::disk::FileReader> {
-        let reader = self
-            .track_disk_health_with_op(
-                "read_file",
-                || async { self.disk.read_file(volume, path).await },
-                get_max_timeout_duration(),
-            )
-            .await?;
-        Ok(Box::new(AdmissionReader::new(reader, self.io_admission.clone(), self.disk_io_context())))
+        self.track_disk_health_with_op(
+            "read_file",
+            || async { self.disk.read_file(volume, path).await },
+            get_max_timeout_duration(),
+        )
+        .await
     }
 
     async fn read_file_stream(&self, volume: &str, path: &str, offset: usize, length: usize) -> Result<crate::disk::FileReader> {
-        let reader = self
-            .track_disk_health_with_op(
-                "read_file_stream",
-                || async { self.disk.read_file_stream(volume, path, offset, length).await },
-                get_max_timeout_duration(),
-            )
-            .await?;
-        Ok(Box::new(AdmissionReader::new(reader, self.io_admission.clone(), self.disk_io_context())))
+        self.track_disk_health_with_op(
+            "read_file_stream",
+            || async { self.disk.read_file_stream(volume, path, offset, length).await },
+            get_max_timeout_duration(),
+        )
+        .await
     }
 
     async fn read_file_stream_chunks(
@@ -2617,20 +2386,12 @@ impl DiskAPI for LocalDiskWrapper {
         offset: usize,
         length: usize,
     ) -> Result<Option<rustfs_rio::ChunkReaderBox>> {
-        let reader = self
-            .track_disk_health_with_op(
-                "read_file_stream_chunks",
-                || async { self.disk.read_file_stream_chunks(volume, path, offset, length).await },
-                get_max_timeout_duration(),
-            )
-            .await?;
-        Ok(reader.map(|reader| {
-            Box::new(AdmissionReader::new(
-                BoxedChunkReader(reader),
-                self.io_admission.clone(),
-                self.disk_io_context(),
-            )) as rustfs_rio::ChunkReaderBox
-        }))
+        self.track_disk_health_with_op(
+            "read_file_stream_chunks",
+            || async { self.disk.read_file_stream_chunks(volume, path, offset, length).await },
+            get_max_timeout_duration(),
+        )
+        .await
     }
 
     async fn read_file_mmap_copy(&self, volume: &str, path: &str, offset: usize, length: usize) -> Result<bytes::Bytes> {
@@ -2663,22 +2424,18 @@ impl DiskAPI for LocalDiskWrapper {
     }
 
     async fn append_file(&self, volume: &str, path: &str) -> Result<crate::disk::FileWriter> {
-        let writer = self
-            .track_disk_health_with_op("append_file", || async { self.disk.append_file(volume, path).await }, Duration::ZERO)
-            .await?;
-        Ok(Box::new(SlowDiskWriter::new(writer, self.endpoint())))
+        self.track_disk_health_with_op("append_file", || async { self.disk.append_file(volume, path).await }, Duration::ZERO)
+            .await
     }
 
     async fn create_file(&self, origvolume: &str, volume: &str, path: &str, file_size: i64) -> Result<crate::disk::FileWriter> {
-        let writer = self
-            .track_disk_health_mutation(
-                "create_file",
-                DiskMetricMutation::Write,
-                || async { self.disk.create_file(origvolume, volume, path, file_size).await },
-                Duration::ZERO,
-            )
-            .await?;
-        Ok(Box::new(SlowDiskWriter::new(writer, self.endpoint())))
+        self.track_disk_health_mutation(
+            "create_file",
+            DiskMetricMutation::Write,
+            || async { self.disk.create_file(origvolume, volume, path, file_size).await },
+            Duration::ZERO,
+        )
+        .await
     }
 
     async fn rename_file(&self, src_volume: &str, src_path: &str, dst_volume: &str, dst_path: &str) -> Result<()> {
@@ -2767,14 +2524,8 @@ impl DiskAPI for LocalDiskWrapper {
     }
 
     async fn read_parts(&self, bucket: &str, paths: &[String]) -> Result<Vec<ObjectPartInfo>> {
-        self.track_disk_health_with_op_timeout_action_and_mutation_with_io_permit(
-            "read_parts",
-            |io_permit| async move { with_disk_io_permit(io_permit, self.disk.read_parts(bucket, paths)).await },
-            Duration::ZERO,
-            TimeoutHealthAction::MarkFailure,
-            DiskMetricMutation::None,
-        )
-        .await
+        self.track_disk_health_with_op("read_parts", || async { self.disk.read_parts(bucket, paths).await }, Duration::ZERO)
+            .await
     }
 
     async fn read_multiple(&self, req: ReadMultipleReq) -> Result<Vec<ReadMultipleResp>> {
@@ -2831,268 +2582,7 @@ mod tests {
         pin::Pin,
         task::{Context, Poll},
     };
-    use tokio::io::AsyncWriteExt;
-    use tracing_subscriber::fmt::MakeWriter;
-
-    #[derive(Clone, Default)]
-    struct SlowOperationLogs(Arc<std::sync::Mutex<Vec<u8>>>);
-
-    impl SlowOperationLogs {
-        fn contents(&self) -> String {
-            String::from_utf8(self.0.lock().expect("log buffer should not be poisoned").clone()).expect("logs should be UTF-8")
-        }
-    }
-
-    impl io::Write for SlowOperationLogs {
-        fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
-            self.0
-                .lock()
-                .expect("log buffer should not be poisoned")
-                .extend_from_slice(buf);
-            Ok(buf.len())
-        }
-
-        fn flush(&mut self) -> io::Result<()> {
-            Ok(())
-        }
-    }
-
-    impl<'a> MakeWriter<'a> for SlowOperationLogs {
-        type Writer = Self;
-
-        fn make_writer(&'a self) -> Self::Writer {
-            self.clone()
-        }
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn slow_disk_operation_warns_once_while_pending_and_preserves_result() {
-        let dir = tempfile::tempdir().expect("temp dir should be created");
-        let endpoint = Endpoint::try_from(dir.path().to_str().expect("path should be UTF-8")).expect("endpoint should parse");
-        let disk = Arc::new(LocalDisk::new(&endpoint, false).await.expect("local disk should be created"));
-        let wrapper = LocalDiskWrapper::new(disk, false);
-        let logs = SlowOperationLogs::default();
-        let subscriber = tracing_subscriber::fmt()
-            .with_writer(logs.clone())
-            .with_ansi(false)
-            .without_time()
-            .finish();
-        let _subscriber = tracing::subscriber::set_default(subscriber);
-        let _interest = crate::test_tracing::pin_callsite_interest_for_test();
-        let (release, wait) = tokio::sync::oneshot::channel();
-        let operation = wrapper.track_disk_health_with_op(
-            "rename_data",
-            || async { wait.await.expect("operation should be released") },
-            Duration::ZERO,
-        );
-        tokio::pin!(operation);
-        assert!(futures::poll!(&mut operation).is_pending());
-        time::advance(SLOW_DISK_OPERATION_THRESHOLD - Duration::from_millis(1)).await;
-        assert!(futures::poll!(&mut operation).is_pending());
-        assert!(logs.contents().is_empty(), "normal disk latency should not warn");
-        time::advance(Duration::from_millis(1)).await;
-        assert!(futures::poll!(&mut operation).is_pending());
-        let warning = logs.contents();
-        assert!(warning.contains("WARN"));
-        assert!(warning.contains("event=\"disk_operation_slow\""));
-        assert!(warning.contains("state=\"pending\""));
-        assert!(warning.contains(&format!("endpoint={endpoint}")));
-        assert!(warning.contains("op=\"rename_data\""));
-        assert!(warning.contains("elapsed_ms=5000"));
-        time::advance(Duration::from_secs(120)).await;
-        assert!(futures::poll!(&mut operation).is_pending(), "warning must not cancel the disk operation");
-        assert_eq!(logs.contents(), warning, "a pending operation should warn only once");
-        release
-            .send(Err::<(), _>(DiskError::FileAccessDenied))
-            .expect("operation should still be alive");
-        assert_eq!(operation.await, Err(DiskError::FileAccessDenied));
-        assert_eq!(wrapper.runtime_state(), RuntimeDriveHealthState::Online);
-        assert_eq!(wrapper.metrics_snapshot().total_waiting, 0);
-
-        let timed = wrapper.track_disk_health_with_op(
-            "write_all",
-            std::future::pending::<Result<()>>,
-            SLOW_DISK_OPERATION_THRESHOLD + Duration::from_secs(1),
-        );
-        tokio::pin!(timed);
-        assert!(futures::poll!(&mut timed).is_pending());
-        time::advance(SLOW_DISK_OPERATION_THRESHOLD).await;
-        assert!(futures::poll!(&mut timed).is_pending());
-        assert_eq!(logs.contents().matches(EVENT_DISK_OPERATION_SLOW).count(), 2);
-        assert_eq!(wrapper.runtime_state(), RuntimeDriveHealthState::Online);
-        time::advance(Duration::from_secs(1)).await;
-        assert_eq!(
-            timed.await,
-            Err(DiskError::Timeout),
-            "existing timeout must still apply after the warning"
-        );
-        assert_eq!(wrapper.metrics_snapshot().total_errors_timeout, 1);
-        assert_eq!(wrapper.metrics_snapshot().total_waiting, 0);
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn slow_disk_operation_fast_path_is_silent_and_does_not_resolve_endpoint() {
-        let logs = SlowOperationLogs::default();
-        let subscriber = tracing_subscriber::fmt()
-            .with_writer(logs.clone())
-            .with_ansi(false)
-            .without_time()
-            .finish();
-        let _subscriber = tracing::subscriber::set_default(subscriber);
-        let _interest = crate::test_tracing::pin_callsite_interest_for_test();
-        for delay in [Duration::ZERO, SLOW_DISK_OPERATION_THRESHOLD] {
-            let result =
-                observe_disk_operation(|| panic!("completed operation should not clone its endpoint"), "write_all", async {
-                    if !delay.is_zero() {
-                        time::sleep(delay).await;
-                    }
-                    Ok::<_, DiskError>(17)
-                })
-                .await;
-            assert_eq!(result, Ok(17));
-        }
-        assert!(logs.contents().is_empty());
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn slow_disk_diagnostics_are_bypassed_when_warnings_are_disabled() {
-        let _subscriber = tracing::subscriber::set_default(tracing::subscriber::NoSubscriber::default());
-        let endpoint = Endpoint::try_from("/slow-disk").expect("endpoint should parse");
-        let mut writer = SlowDiskWriter::new(Box::new(PendingWriter), endpoint);
-        {
-            let write = writer.write(b"bytes");
-            tokio::pin!(write);
-            assert!(futures::poll!(&mut write).is_pending());
-        }
-        assert!(writer.timer.is_none(), "disabled warnings should not allocate a stream timer");
-        let result = observe_disk_operation(|| panic!("disabled warnings should not resolve endpoints"), "write_all", async {
-            time::sleep(SLOW_DISK_OPERATION_THRESHOLD * 2).await;
-            17
-        })
-        .await;
-        assert_eq!(result, 17);
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn slow_disk_writer_preserves_vectored_bytes_and_warns_once_while_blocked() {
-        let endpoint = Endpoint::try_from("/slow-disk").expect("endpoint should parse");
-        let logs = SlowOperationLogs::default();
-        let subscriber = tracing_subscriber::fmt()
-            .with_writer(logs.clone())
-            .with_ansi(false)
-            .without_time()
-            .finish();
-        let _subscriber = tracing::subscriber::set_default(subscriber);
-        let _interest = crate::test_tracing::pin_callsite_interest_for_test();
-        let (stream, mut receiver) = tokio::io::duplex(1);
-        let mut writer = SlowDiskWriter::new(Box::new(stream), endpoint.clone());
-        writer.write_all(b"a").await.expect("first byte should fit in the buffer");
-        assert!(writer.timer.is_none(), "ready writes should not allocate a timer");
-        assert!(logs.contents().is_empty());
-        let mut received = [0; 1];
-        {
-            let bufs = [io::IoSlice::new(b"b"), io::IoSlice::new(b"c")];
-            let write = writer.write_vectored(&bufs);
-            tokio::pin!(write);
-            assert!(futures::poll!(&mut write).is_pending());
-            time::advance(SLOW_DISK_OPERATION_THRESHOLD).await;
-            assert!(futures::poll!(&mut write).is_pending());
-            assert!(logs.contents().contains("op=\"write_vectored\""));
-            time::advance(SLOW_DISK_OPERATION_THRESHOLD).await;
-            assert!(futures::poll!(&mut write).is_pending());
-            assert_eq!(logs.contents().matches(EVENT_DISK_OPERATION_SLOW).count(), 1);
-            tokio::io::AsyncReadExt::read_exact(&mut receiver, &mut received)
-                .await
-                .expect("buffered byte should be readable");
-            assert_eq!(received, *b"a");
-            assert_eq!(write.await.expect("blocked write should finish when capacity returns"), 1);
-        }
-        tokio::io::AsyncReadExt::read_exact(&mut receiver, &mut received)
-            .await
-            .expect("written byte should be readable");
-        assert_eq!(received, *b"b");
-
-        drop(receiver);
-        let err = writer.write_all(b"d").await.expect_err("closed receiver should fail writes");
-        assert_eq!(err.kind(), io::ErrorKind::BrokenPipe);
-    }
-
-    #[tokio::test]
-    async fn slow_disk_writer_preserves_full_vectored_write_and_capability() {
-        let endpoint = Endpoint::try_from("/slow-disk").expect("endpoint should parse");
-        let (stream, mut receiver) = tokio::io::duplex(64);
-        let vectored = stream.is_write_vectored();
-        let mut writer = SlowDiskWriter::new(Box::new(stream), endpoint);
-        assert_eq!(writer.is_write_vectored(), vectored);
-        let bufs = [io::IoSlice::new(b"hash"), io::IoSlice::new(b"data")];
-        assert_eq!(writer.write_vectored(&bufs).await.expect("vectored write should succeed"), 8);
-        writer.shutdown().await.expect("shutdown should succeed");
-        let mut received = Vec::new();
-        tokio::io::AsyncReadExt::read_to_end(&mut receiver, &mut received)
-            .await
-            .expect("all bytes should be readable");
-        assert_eq!(received, b"hashdata");
-        assert!(writer.timer.is_none());
-    }
-
-    struct StalledWriter(Arc<AtomicBool>);
-
-    impl AsyncWrite for StalledWriter {
-        fn poll_write(self: Pin<&mut Self>, _cx: &mut Context<'_>, buf: &[u8]) -> Poll<io::Result<usize>> {
-            if self.0.load(Ordering::Relaxed) {
-                Poll::Ready(Ok(buf.len()))
-            } else {
-                Poll::Pending
-            }
-        }
-
-        fn poll_flush(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<()>> {
-            if self.0.load(Ordering::Relaxed) {
-                Poll::Ready(Ok(()))
-            } else {
-                Poll::Pending
-            }
-        }
-
-        fn poll_shutdown(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
-            self.poll_flush(cx)
-        }
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn slow_disk_writer_warns_for_write_flush_and_shutdown_and_rearms_after_progress() {
-        let endpoint = Endpoint::try_from("/slow-disk").expect("endpoint should parse");
-        let logs = SlowOperationLogs::default();
-        let subscriber = tracing_subscriber::fmt()
-            .with_writer(logs.clone())
-            .with_ansi(false)
-            .without_time()
-            .finish();
-        let _subscriber = tracing::subscriber::set_default(subscriber);
-        let _interest = crate::test_tracing::pin_callsite_interest_for_test();
-        let ready = Arc::new(AtomicBool::new(false));
-        let mut writer = SlowDiskWriter::new(Box::new(StalledWriter(Arc::clone(&ready))), endpoint);
-        for (index, op) in ["write", "flush", "shutdown"].into_iter().enumerate() {
-            ready.store(false, Ordering::Relaxed);
-            let operation = async {
-                match op {
-                    "write" => writer.write_all(b"bytes").await,
-                    "flush" => writer.flush().await,
-                    "shutdown" => writer.shutdown().await,
-                    _ => unreachable!("only write operations are tested"),
-                }
-            };
-            tokio::pin!(operation);
-            assert!(futures::poll!(&mut operation).is_pending());
-            time::advance(SLOW_DISK_OPERATION_THRESHOLD).await;
-            assert!(futures::poll!(&mut operation).is_pending());
-            assert!(logs.contents().contains(&format!("op=\"{op}\"")));
-            assert_eq!(logs.contents().matches(EVENT_DISK_OPERATION_SLOW).count(), index + 1);
-            ready.store(true, Ordering::Relaxed);
-            operation.await.expect("warning should not prevent operation completion");
-        }
-        assert!(writer.pending.is_none());
-    }
+    use tokio::io::AsyncWrite;
 
     struct DropProbe(Arc<std::sync::atomic::AtomicUsize>);
 
@@ -3102,84 +2592,6 @@ mod tests {
         }
     }
 
-    struct StalledMetacacheWriter {
-        entered: Arc<tokio::sync::Notify>,
-    }
-
-    impl AsyncWrite for StalledMetacacheWriter {
-        fn poll_write(self: Pin<&mut Self>, _cx: &mut Context<'_>, _buf: &[u8]) -> Poll<io::Result<usize>> {
-            self.entered.notify_one();
-            Poll::Pending
-        }
-
-        fn poll_flush(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<()>> {
-            Poll::Ready(Ok(()))
-        }
-
-        fn poll_shutdown(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<()>> {
-            Poll::Ready(Ok(()))
-        }
-    }
-
-    #[tokio::test]
-    async fn scanner_walk_releases_disk_admission_while_output_is_backpressured() {
-        let root = tempfile::tempdir().expect("disk root should be created");
-        let endpoint =
-            Endpoint::try_from(root.path().to_str().expect("disk root should be UTF-8")).expect("endpoint should parse");
-        let disk = Arc::new(LocalDisk::new(&endpoint, false).await.expect("local disk should open"));
-        let wrapper = Arc::new(LocalDiskWrapper::new(disk, false));
-        wrapper.make_volume("bucket").await.expect("bucket should be created");
-        let object_path = root.path().join("bucket/object");
-        tokio::fs::create_dir_all(&object_path)
-            .await
-            .expect("object directory should be created");
-        tokio::fs::write(object_path.join("xl.meta"), b"scanner metadata")
-            .await
-            .expect("object metadata should be created");
-
-        let entered = Arc::new(tokio::sync::Notify::new());
-        let writer = StalledMetacacheWriter {
-            entered: entered.clone(),
-        };
-        let walk_wrapper = wrapper.clone();
-        let walk = tokio::spawn(async move {
-            crate::disk::with_background_disk_io(CancellationToken::new(), async move {
-                let mut writer = writer;
-                walk_wrapper
-                    .walk_dir(
-                        WalkDirOptions {
-                            bucket: "bucket".to_string(),
-                            recursive: true,
-                            skip_total_timeout: true,
-                            ..Default::default()
-                        },
-                        &mut writer,
-                    )
-                    .await
-            })
-            .await
-        });
-
-        tokio::time::timeout(Duration::from_secs(2), entered.notified())
-            .await
-            .expect("walk should reach the blocked output writer");
-        assert!(
-            !wrapper.background_io_active_for_tests(),
-            "filesystem read permits must be released before metacache output backpressure"
-        );
-
-        let checkpoint_permit = tokio::time::timeout(
-            Duration::from_secs(1),
-            crate::disk::with_background_disk_io(CancellationToken::new(), wrapper.acquire_disk_io_permit()),
-        )
-        .await
-        .expect("checkpoint admission should progress while the scanner consumer is paused")
-        .expect("checkpoint should acquire the disk gate");
-        drop(checkpoint_permit);
-        walk.abort();
-        let _ = walk.await;
-    }
-
     #[tokio::test]
     async fn owned_mutation_keeps_publication_guard_after_waiter_cancellation() {
         let drops = Arc::new(std::sync::atomic::AtomicUsize::new(0));
@@ -3330,7 +2742,6 @@ mod tests {
         let reconnect = ReconnectDiskHealthState {
             health: Arc::new(health.metric_epoch_for_reconnect()),
             metrics: metrics.clone(),
-            io_admission: DiskIoAdmission::new("test-disk"),
         };
         metrics.record_operation_call("read_all");
         reconnect.metrics.record_timeout_error();
@@ -3612,40 +3023,6 @@ mod tests {
         assert_eq!(snapshot.total_deletes, 1);
     }
 
-    // A batch delete dropped while the disk call is in flight (for example by a
-    // cancelled caller) must not leave the drive looking busy forever.
-    #[tokio::test]
-    async fn delete_versions_releases_waiting_slot_when_dropped() {
-        let dir = tempfile::tempdir().expect("temp dir should be created");
-        let endpoint =
-            Endpoint::try_from(dir.path().to_str().expect("temp dir should be valid UTF-8")).expect("endpoint should parse");
-        let disk = Arc::new(LocalDisk::new(&endpoint, false).await.expect("local disk should be created"));
-        let wrapper = LocalDiskWrapper::new(Arc::clone(&disk), false);
-        wrapper.make_volume("bucket").await.expect("volume should be created");
-        let object_path = disk.get_object_path("bucket", "object").expect("object path");
-        // Holding the object's metadata lease parks the disk call before it mutates anything.
-        let metadata_lease = crate::disk::os::acquire_metadata_mutation_lease(&object_path, None).await;
-
-        let mut delete = Box::pin(wrapper.delete_versions(
-            "bucket",
-            vec![FileInfoVersions {
-                name: "object".to_string(),
-                versions: vec![FileInfo::default()],
-                ..Default::default()
-            }],
-            DeleteOptions::default(),
-        ));
-        assert!(
-            futures::poll!(delete.as_mut()).is_pending(),
-            "the disk call should wait for the metadata lease"
-        );
-        assert_eq!(wrapper.health.waiting_count(), 1);
-
-        drop(delete);
-        assert_eq!(wrapper.health.waiting_count(), 0, "a dropped delete must release its waiting slot");
-        drop(metadata_lease);
-    }
-
     #[tokio::test]
     async fn delete_versions_counts_faulty_drive_availability_rejection() {
         let dir = tempfile::tempdir().expect("temp dir should be created");

crates/ecstore/src/disk/io_admission.rs

@@ -1,706 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Per-local-disk foreground-priority admission for scanner I/O.
-
-use std::collections::VecDeque;
-use std::future::Future;
-use std::io;
-use std::pin::Pin;
-use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
-use std::sync::{Arc, Mutex};
-use std::task::{Context, Poll};
-use std::time::Duration;
-
-use metrics::{counter, gauge, histogram};
-use rustfs_rio::ChunkReader;
-use tokio::io::{AsyncRead, ReadBuf};
-use tokio::sync::Notify;
-use tokio::time::Instant;
-use tokio_util::sync::CancellationToken;
-
-const BACKGROUND_FOREGROUND_BURST: u32 = 8;
-const BACKGROUND_MAX_WAIT: Duration = Duration::from_millis(100);
-
-tokio::task_local! {
-    static DISK_IO_CONTEXT: DiskIoContext;
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub(crate) enum DiskIoClass {
-    Foreground,
-    Background,
-}
-
-#[derive(Clone, Debug)]
-pub(crate) struct DiskIoContext {
-    pub(crate) class: DiskIoClass,
-    pub(crate) cancellation: CancellationToken,
-    pub(crate) admission: Option<Arc<DiskIoAdmission>>,
-    pub(crate) permit: Option<DiskIoPermit>,
-}
-
-/// Mark disk I/O issued by `future` as background work for local-disk admission.
-#[doc(hidden)]
-pub async fn with_background_disk_io<F: Future>(cancellation: CancellationToken, future: F) -> F::Output {
-    with_disk_io_context(
-        DiskIoContext {
-            class: DiskIoClass::Background,
-            cancellation,
-            admission: None,
-            permit: None,
-        },
-        future,
-    )
-    .await
-}
-
-pub(crate) async fn with_disk_io_context<F: Future>(context: DiskIoContext, future: F) -> F::Output {
-    DISK_IO_CONTEXT.scope(context, future).await
-}
-
-pub(crate) async fn with_disk_io_permit<F: Future>(permit: Option<DiskIoPermit>, future: F) -> F::Output {
-    let Some(permit) = permit else {
-        return future.await;
-    };
-    let mut context = current_disk_io_context().unwrap_or_else(|| DiskIoContext {
-        class: DiskIoClass::Foreground,
-        cancellation: CancellationToken::new(),
-        admission: None,
-        permit: None,
-    });
-    context.admission = Some(permit.admission());
-    with_disk_io_context(
-        DiskIoContext {
-            permit: Some(permit),
-            ..context
-        },
-        future,
-    )
-    .await
-}
-
-pub(crate) async fn with_optional_disk_io_context<F: Future>(context: Option<DiskIoContext>, future: F) -> F::Output {
-    match context {
-        Some(context) => with_disk_io_context(context, future).await,
-        None => future.await,
-    }
-}
-
-pub(crate) fn current_disk_io_context() -> Option<DiskIoContext> {
-    DISK_IO_CONTEXT.try_with(Clone::clone).ok()
-}
-
-/// Acquire one low-level permit only when the current walker explicitly owns a gate.
-/// Ordinary wrapper calls use their outer operation permit instead.
-pub(crate) async fn acquire_context_disk_io_permit() -> io::Result<Option<DiskIoPermit>> {
-    let Some(context) = current_disk_io_context() else {
-        return Ok(None);
-    };
-    let Some(admission) = context.admission else {
-        return Ok(None);
-    };
-    if let Some(permit) = context.permit
-        && permit.is_for(&admission)
-    {
-        return Ok(Some(permit));
-    }
-    match context.class {
-        DiskIoClass::Foreground => Ok(Some(admission.foreground())),
-        DiskIoClass::Background => Ok(Some(admission.background(&context.cancellation).await?)),
-    }
-}
-
-#[derive(Debug, Default)]
-struct AdmissionState {
-    foreground_completions: u32,
-    next_background_ticket: u64,
-    background_queue: VecDeque<u64>,
-    background_front_since: Option<Instant>,
-}
-
-/// One gate is shared by all handles to a local disk, including reconnects.
-/// Foreground I/O never waits on this gate. Background I/O runs exclusively
-/// while the disk is idle, or after a bounded foreground burst/wait.
-#[derive(Debug)]
-pub(crate) struct DiskIoAdmission {
-    state: Mutex<AdmissionState>,
-    changed: Notify,
-    disk: String,
-    foreground_active: AtomicUsize,
-    background_active: AtomicBool,
-    background_waiters: AtomicUsize,
-    #[cfg(test)]
-    background_admissions: AtomicUsize,
-}
-
-impl DiskIoAdmission {
-    pub(crate) fn new(disk: impl Into<String>) -> Arc<Self> {
-        Arc::new(Self {
-            state: Mutex::new(AdmissionState::default()),
-            changed: Notify::new(),
-            disk: disk.into(),
-            foreground_active: AtomicUsize::new(0),
-            background_active: AtomicBool::new(false),
-            background_waiters: AtomicUsize::new(0),
-            #[cfg(test)]
-            background_admissions: AtomicUsize::new(0),
-        })
-    }
-
-    #[cfg(test)]
-    pub(crate) fn background_admissions_for_tests(&self) -> usize {
-        self.background_admissions.load(Ordering::Relaxed)
-    }
-
-    #[cfg(test)]
-    pub(crate) fn background_active_for_tests(&self) -> bool {
-        self.background_active.load(Ordering::Acquire)
-    }
-
-    #[cfg(test)]
-    fn foreground_active_for_tests(&self) -> usize {
-        self.foreground_active.load(Ordering::Acquire)
-    }
-
-    pub(crate) fn foreground(self: &Arc<Self>) -> DiskIoPermit {
-        self.foreground_active.fetch_add(1, Ordering::AcqRel);
-        if self.background_waiters.load(Ordering::Acquire) > 0 {
-            self.record_state();
-        }
-        DiskIoPermit {
-            lease: Arc::new(DiskIoPermitLease {
-                admission: self.clone(),
-                class: DiskIoClass::Foreground,
-            }),
-        }
-    }
-
-    pub(crate) async fn background(self: &Arc<Self>, cancellation: &CancellationToken) -> std::io::Result<DiskIoPermit> {
-        let started_at = Instant::now();
-        let ticket = {
-            let mut state = self.state.lock().unwrap_or_else(|error| error.into_inner());
-            let ticket = state.next_background_ticket;
-            state.next_background_ticket = state.next_background_ticket.wrapping_add(1);
-            if state.background_queue.is_empty() && !self.background_active.load(Ordering::Acquire) {
-                state.background_front_since = Some(Instant::now());
-            }
-            state.background_queue.push_back(ticket);
-            self.background_waiters.fetch_add(1, Ordering::Release);
-            ticket
-        };
-        self.record_state();
-
-        let mut waiter = BackgroundWaiter {
-            admission: self.clone(),
-            ticket,
-            waiting: true,
-        };
-        loop {
-            let notified = self.changed.notified();
-            tokio::pin!(notified);
-            notified.as_mut().enable();
-
-            let granted = {
-                let mut state = self.state.lock().unwrap_or_else(|error| error.into_inner());
-                let is_front = state.background_queue.front() == Some(&ticket);
-                let bounded_wait_elapsed = is_front
-                    && state
-                        .background_front_since
-                        .is_some_and(|front_since| front_since.elapsed() >= BACKGROUND_MAX_WAIT);
-                if is_front
-                    && !self.background_active.load(Ordering::Acquire)
-                    && (self.foreground_active.load(Ordering::Acquire) == 0
-                        || state.foreground_completions >= BACKGROUND_FOREGROUND_BURST
-                        || bounded_wait_elapsed)
-                {
-                    self.background_active.store(true, Ordering::Release);
-                    state.background_queue.pop_front();
-                    state.background_front_since = None;
-                    self.background_waiters.fetch_sub(1, Ordering::AcqRel);
-                    state.foreground_completions = 0;
-                    true
-                } else {
-                    false
-                }
-            };
-
-            if granted {
-                waiter.waiting = false;
-                #[cfg(test)]
-                self.background_admissions.fetch_add(1, Ordering::Relaxed);
-                histogram!("rustfs_disk_io_admission_wait_seconds", "disk" => self.disk.clone(), "class" => "background")
-                    .record(started_at.elapsed().as_secs_f64());
-                counter!("rustfs_disk_io_admission_total", "disk" => self.disk.clone(), "class" => "background").increment(1);
-                self.record_state();
-                return Ok(DiskIoPermit {
-                    lease: Arc::new(DiskIoPermitLease {
-                        admission: self.clone(),
-                        class: DiskIoClass::Background,
-                    }),
-                });
-            }
-
-            let remaining = {
-                let state = self.state.lock().unwrap_or_else(|error| error.into_inner());
-                if state.background_queue.front() == Some(&ticket) {
-                    state
-                        .background_front_since
-                        .map(|front_since| BACKGROUND_MAX_WAIT.saturating_sub(front_since.elapsed()))
-                } else {
-                    None
-                }
-            };
-            if let Some(remaining) = remaining.filter(|remaining| !remaining.is_zero()) {
-                tokio::select! {
-                    _ = cancellation.cancelled() => {
-                        return Err(std::io::Error::new(std::io::ErrorKind::Interrupted, "background disk I/O admission cancelled"));
-                    }
-                    _ = tokio::time::sleep(remaining) => {
-                        self.changed.notify_waiters();
-                    }
-                    _ = &mut notified => {}
-                }
-            } else {
-                tokio::select! {
-                    _ = cancellation.cancelled() => {
-                        return Err(std::io::Error::new(std::io::ErrorKind::Interrupted, "background disk I/O admission cancelled"));
-                    }
-                    _ = &mut notified => {}
-                }
-            }
-        }
-    }
-
-    fn record_state(&self) {
-        let (foreground_active, background_waiters) = {
-            let state = self.state.lock().unwrap_or_else(|error| error.into_inner());
-            (
-                if state.background_queue.is_empty() {
-                    0
-                } else {
-                    self.foreground_active.load(Ordering::Acquire)
-                },
-                state.background_queue.len(),
-            )
-        };
-        let foreground_active = u32::try_from(foreground_active).unwrap_or(u32::MAX);
-        let background_waiters = u32::try_from(background_waiters).unwrap_or(u32::MAX);
-        gauge!("rustfs_disk_io_admission_active", "disk" => self.disk.clone(), "class" => "foreground")
-            .set(f64::from(foreground_active));
-        gauge!("rustfs_disk_io_admission_active", "disk" => self.disk.clone(), "class" => "background").set(
-            if self.background_active.load(Ordering::Acquire) {
-                1.0
-            } else {
-                0.0
-            },
-        );
-        gauge!("rustfs_disk_io_admission_waiters", "disk" => self.disk.clone(), "class" => "background")
-            .set(f64::from(background_waiters));
-    }
-}
-
-struct BackgroundWaiter {
-    admission: Arc<DiskIoAdmission>,
-    ticket: u64,
-    waiting: bool,
-}
-
-impl Drop for BackgroundWaiter {
-    fn drop(&mut self) {
-        if !self.waiting {
-            return;
-        }
-        let mut state = self.admission.state.lock().unwrap_or_else(|error| error.into_inner());
-        if let Some(index) = state.background_queue.iter().position(|ticket| *ticket == self.ticket) {
-            state.background_queue.remove(index);
-            if index == 0 {
-                state.background_front_since =
-                    if state.background_queue.is_empty() || self.admission.background_active.load(Ordering::Acquire) {
-                        None
-                    } else {
-                        Some(Instant::now())
-                    };
-            }
-            self.admission.background_waiters.fetch_sub(1, Ordering::AcqRel);
-        }
-        drop(state);
-        self.admission.record_state();
-        self.admission.changed.notify_waiters();
-    }
-}
-
-#[derive(Debug, Clone)]
-pub(crate) struct DiskIoPermit {
-    lease: Arc<DiskIoPermitLease>,
-}
-
-impl DiskIoPermit {
-    pub(crate) fn is_for(&self, admission: &Arc<DiskIoAdmission>) -> bool {
-        Arc::ptr_eq(&self.lease.admission, admission)
-    }
-
-    fn admission(&self) -> Arc<DiskIoAdmission> {
-        self.lease.admission.clone()
-    }
-}
-
-#[derive(Debug)]
-struct DiskIoPermitLease {
-    admission: Arc<DiskIoAdmission>,
-    class: DiskIoClass,
-}
-
-pub(crate) fn spawn_blocking_with_disk_io_permit<T, F>(
-    io_permit: Option<DiskIoPermit>,
-    operation: F,
-) -> tokio::task::JoinHandle<T>
-where
-    T: Send + 'static,
-    F: FnOnce() -> T + Send + 'static,
-{
-    tokio::task::spawn_blocking(move || {
-        let _io_permit = io_permit;
-        operation()
-    })
-}
-
-type AdmissionWait = Pin<Box<dyn Future<Output = io::Result<DiskIoPermit>> + Send>>;
-
-impl Drop for DiskIoPermitLease {
-    fn drop(&mut self) {
-        match self.class {
-            DiskIoClass::Foreground => {
-                self.admission.foreground_active.fetch_sub(1, Ordering::AcqRel);
-                let record_state = self.admission.background_waiters.load(Ordering::Acquire) > 0;
-                if record_state {
-                    let mut state = self.admission.state.lock().unwrap_or_else(|error| error.into_inner());
-                    if !state.background_queue.is_empty() {
-                        state.foreground_completions = state.foreground_completions.saturating_add(1);
-                    }
-                }
-                if record_state {
-                    self.admission.record_state();
-                    self.admission.changed.notify_waiters();
-                }
-            }
-            DiskIoClass::Background => {
-                let mut state = self.admission.state.lock().unwrap_or_else(|error| error.into_inner());
-                self.admission.background_active.store(false, Ordering::Release);
-                state.background_front_since = if state.background_queue.is_empty() {
-                    None
-                } else {
-                    Some(Instant::now())
-                };
-                drop(state);
-                self.admission.record_state();
-                self.admission.changed.notify_waiters();
-            }
-        }
-    }
-}
-
-pub(crate) struct AdmissionReader<R> {
-    inner: R,
-    admission: Arc<DiskIoAdmission>,
-    context: DiskIoContext,
-    wait: Mutex<Option<AdmissionWait>>,
-    permit: Option<DiskIoPermit>,
-}
-
-impl<R> AdmissionReader<R> {
-    pub(crate) fn new(inner: R, admission: Arc<DiskIoAdmission>, context: DiskIoContext) -> Self {
-        Self {
-            inner,
-            admission,
-            context,
-            wait: Mutex::new(None),
-            permit: None,
-        }
-    }
-
-    fn poll_permit(&mut self, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
-        if self.permit.is_some() {
-            return Poll::Ready(Ok(()));
-        }
-
-        if self.context.class == DiskIoClass::Foreground {
-            self.permit = Some(self.admission.foreground());
-            return Poll::Ready(Ok(()));
-        }
-
-        let mut wait = self.wait.lock().unwrap_or_else(|error| error.into_inner());
-        if wait.is_none() {
-            let admission = self.admission.clone();
-            let cancellation = self.context.cancellation.clone();
-            *wait = Some(Box::pin(async move { admission.background(&cancellation).await }));
-        }
-        let Some(wait_future) = wait.as_mut() else {
-            return Poll::Ready(Err(io::Error::other("background disk I/O admission waiter is missing")));
-        };
-        let result = wait_future.as_mut().poll(cx);
-        match result {
-            Poll::Ready(Ok(permit)) => {
-                wait.take();
-                drop(wait);
-                self.permit = Some(permit);
-                Poll::Ready(Ok(()))
-            }
-            Poll::Ready(Err(error)) => {
-                wait.take();
-                Poll::Ready(Err(error))
-            }
-            Poll::Pending => Poll::Pending,
-        }
-    }
-
-    fn finish_poll<T>(&mut self, result: Poll<io::Result<T>>) -> Poll<io::Result<T>> {
-        if result.is_ready() {
-            self.permit = None;
-        }
-        result
-    }
-}
-
-impl<R: AsyncRead + Unpin> AsyncRead for AdmissionReader<R> {
-    fn poll_read(mut self: Pin<&mut Self>, cx: &mut Context<'_>, buf: &mut ReadBuf<'_>) -> Poll<io::Result<()>> {
-        match self.poll_permit(cx) {
-            Poll::Ready(Ok(())) => {}
-            Poll::Ready(Err(error)) => return Poll::Ready(Err(error)),
-            Poll::Pending => return Poll::Pending,
-        }
-        let result = Pin::new(&mut self.inner).poll_read(cx, buf);
-        self.finish_poll(result)
-    }
-}
-
-impl<R: ChunkReader + Unpin> ChunkReader for AdmissionReader<R> {
-    fn poll_read_chunk(mut self: Pin<&mut Self>, cx: &mut Context<'_>, max: usize) -> Poll<io::Result<Option<bytes::Bytes>>> {
-        match self.poll_permit(cx) {
-            Poll::Ready(Ok(())) => {}
-            Poll::Ready(Err(error)) => return Poll::Ready(Err(error)),
-            Poll::Pending => return Poll::Pending,
-        }
-        let result = Pin::new(&mut self.inner).poll_read_chunk(cx, max);
-        self.finish_poll(result)
-    }
-}
-
-pub(crate) struct BoxedChunkReader(pub(crate) rustfs_rio::ChunkReaderBox);
-
-impl AsyncRead for BoxedChunkReader {
-    fn poll_read(mut self: Pin<&mut Self>, cx: &mut Context<'_>, buf: &mut ReadBuf<'_>) -> Poll<io::Result<()>> {
-        Pin::new(&mut self.0).poll_read(cx, buf)
-    }
-}
-
-impl ChunkReader for BoxedChunkReader {
-    fn poll_read_chunk(self: Pin<&mut Self>, cx: &mut Context<'_>, max: usize) -> Poll<io::Result<Option<bytes::Bytes>>> {
-        Pin::new(self.get_mut().0.as_mut()).poll_read_chunk(cx, max)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::io::{AsyncReadExt, AsyncWriteExt};
-
-    struct BlockingWorker(tokio::task::JoinHandle<()>);
-
-    async fn wait_for_background_waiters(admission: &DiskIoAdmission, expected: usize) {
-        tokio::time::timeout(Duration::from_secs(1), async {
-            loop {
-                let waiters = admission
-                    .state
-                    .lock()
-                    .unwrap_or_else(|error| error.into_inner())
-                    .background_queue
-                    .len();
-                if waiters == expected {
-                    return;
-                }
-                tokio::task::yield_now().await;
-            }
-        })
-        .await
-        .expect("background admission waiter should reach expected count");
-    }
-
-    async fn wait_for_foreground_active(admission: &DiskIoAdmission, expected: usize) {
-        tokio::time::timeout(Duration::from_secs(1), async {
-            loop {
-                let active = admission.foreground_active.load(Ordering::Acquire);
-                if active == expected {
-                    return;
-                }
-                tokio::task::yield_now().await;
-            }
-        })
-        .await
-        .expect("foreground disk read should retain its permit while pending");
-    }
-
-    #[tokio::test]
-    async fn foreground_bypasses_background_and_background_progress_is_bounded() {
-        let admission = DiskIoAdmission::new("disk-a");
-        let foreground = admission.foreground();
-        let background_admission = admission.clone();
-        let cancellation = CancellationToken::new();
-        let background = tokio::spawn(async move { background_admission.background(&cancellation).await });
-
-        wait_for_background_waiters(&admission, 1).await;
-        for _ in 0..BACKGROUND_FOREGROUND_BURST {
-            drop(admission.foreground());
-        }
-
-        let background_permit = tokio::time::timeout(Duration::from_secs(1), background)
-            .await
-            .expect("background admission should progress after the foreground burst")
-            .expect("background waiter task should complete")
-            .expect("background admission should not be cancelled");
-        assert_eq!(
-            admission.foreground_active.load(Ordering::Acquire),
-            1,
-            "foreground operations remain admitted while one background operation runs"
-        );
-        drop(background_permit);
-        drop(foreground);
-    }
-
-    #[tokio::test]
-    async fn cancellation_removes_a_queued_background_waiter() {
-        let admission = DiskIoAdmission::new("disk-a");
-        let background = admission
-            .background(&CancellationToken::new())
-            .await
-            .expect("first background operation should be admitted");
-        let cancellation = CancellationToken::new();
-        let waiter_admission = admission.clone();
-        let waiter_cancellation = cancellation.clone();
-        let waiter = tokio::spawn(async move { waiter_admission.background(&waiter_cancellation).await });
-        wait_for_background_waiters(&admission, 1).await;
-
-        cancellation.cancel();
-        let error = tokio::time::timeout(Duration::from_secs(1), waiter)
-            .await
-            .expect("cancelled background waiter should stop")
-            .expect("background waiter task should complete")
-            .expect_err("cancelled admission must not start disk I/O");
-        assert_eq!(error.kind(), io::ErrorKind::Interrupted);
-        assert_eq!(
-            admission
-                .state
-                .lock()
-                .unwrap_or_else(|error| error.into_inner())
-                .background_queue
-                .len(),
-            0
-        );
-        drop(background);
-    }
-
-    #[tokio::test]
-    async fn background_admission_is_isolated_per_disk() {
-        let disk_a = DiskIoAdmission::new("disk-a");
-        let disk_b = DiskIoAdmission::new("disk-b");
-        let _disk_a_permit = disk_a
-            .background(&CancellationToken::new())
-            .await
-            .expect("disk A background operation should be admitted");
-        let _disk_b_permit = tokio::time::timeout(Duration::from_secs(1), disk_b.background(&CancellationToken::new()))
-            .await
-            .expect("disk A must not block disk B")
-            .expect("disk B background operation should be admitted");
-    }
-
-    #[tokio::test]
-    async fn streamed_read_holds_admission_until_disk_read_resolves() {
-        let admission = DiskIoAdmission::new("disk-a");
-        let (mut writer, reader) = tokio::io::duplex(8);
-        let mut reader = AdmissionReader::new(
-            reader,
-            admission.clone(),
-            DiskIoContext {
-                class: DiskIoClass::Foreground,
-                cancellation: CancellationToken::new(),
-                admission: None,
-                permit: None,
-            },
-        );
-        let read = tokio::spawn(async move {
-            let mut bytes = [0; 4];
-            reader
-                .read_exact(&mut bytes)
-                .await
-                .expect("streamed disk read should complete");
-            bytes
-        });
-
-        wait_for_foreground_active(&admission, 1).await;
-        writer.write_all(b"rust").await.expect("test bytes should be written");
-        assert_eq!(read.await.expect("reader task should finish"), *b"rust");
-        wait_for_foreground_active(&admission, 0).await;
-    }
-
-    #[tokio::test]
-    async fn blocking_worker_keeps_permit_after_caller_timeout() {
-        let admission = DiskIoAdmission::new("disk-a");
-        let (started_tx, started_rx) = tokio::sync::oneshot::channel();
-        let worker = spawn_blocking_with_disk_io_permit(Some(admission.foreground()), move || {
-            started_tx.send(()).expect("worker start should be observed");
-            std::thread::sleep(Duration::from_millis(100));
-        });
-
-        started_rx.await.expect("blocking worker should start");
-        assert!(tokio::time::timeout(Duration::from_millis(10), worker).await.is_err());
-        assert_eq!(admission.foreground_active_for_tests(), 1);
-        wait_for_foreground_active(&admission, 0).await;
-    }
-
-    #[tokio::test]
-    async fn cloned_permit_remains_active_until_all_workers_finish() {
-        let admission = DiskIoAdmission::new("disk-a");
-        let permit = admission.foreground();
-        let worker_permit = permit.clone();
-        drop(permit);
-        assert_eq!(admission.foreground_active_for_tests(), 1);
-
-        drop(worker_permit);
-        assert_eq!(admission.foreground_active_for_tests(), 0);
-    }
-
-    #[tokio::test]
-    async fn scoped_foreground_permit_is_inherited_by_blocking_worker() {
-        let admission = DiskIoAdmission::new("disk-a");
-        let permit = admission.foreground();
-        let worker = with_disk_io_permit(Some(permit), async {
-            let worker_permit = acquire_context_disk_io_permit()
-                .await
-                .expect("context permit should be available")
-                .expect("scoped permit should be inherited");
-            let (started_tx, started_rx) = tokio::sync::oneshot::channel();
-            let worker = spawn_blocking_with_disk_io_permit(Some(worker_permit), move || {
-                started_tx.send(()).expect("worker start should be observed");
-                std::thread::sleep(Duration::from_millis(100));
-            });
-            started_rx.await.expect("blocking worker should start");
-            BlockingWorker(worker)
-        })
-        .await;
-
-        assert_eq!(admission.foreground_active_for_tests(), 1);
-        assert!(tokio::time::timeout(Duration::from_millis(10), worker.0).await.is_err());
-        wait_for_foreground_active(&admission, 0).await;
-    }
-}

crates/ecstore/src/disk/local/commit.rs

@@ -84,107 +84,46 @@ async fn wait_for_heal_commit_test_barrier(root: &Path, bucket: &str, object: &s
     }
 }
 
-struct RenameCommitContext<'a> {
-    // Drop the directory identity guard before releasing mutation ownership.
-    directory_guard: os::RenameCommitGuard,
-    publication_root: &'a os::PublicationRoot,
-    mutation_lease: Arc<os::NamespaceMutationLease>,
-    source_metadata: &'a Path,
-    destination_metadata: &'a Path,
-    source_volume_dir: &'a Path,
-    data_paths: Option<&'a (PathBuf, PathBuf)>,
-}
-
-struct StagedRollbackBackup(PathBuf);
-
-impl StagedRollbackBackup {
-    fn path(&self) -> &Path {
-        &self.0
-    }
-}
-
-impl RenameCommitContext<'_> {
-    fn rollback_metadata_std(&self, rollback_data_dir: Option<Uuid>) -> std::io::Result<()> {
-        if let Some(old_data_dir) = rollback_data_dir {
-            let Some(dst_parent) = self.destination_metadata.parent() else {
-                return Err(std::io::Error::new(ErrorKind::InvalidInput, "missing object metadata parent"));
-            };
-            let backup_path = dst_parent.join(old_data_dir.to_string()).join(STORAGE_FORMAT_FILE_BACKUP);
-            std::fs::rename(backup_path, self.destination_metadata)?;
-        } else {
-            remove_file_if_exists(self.destination_metadata)?;
-        }
-        Ok(())
-    }
-
-    fn rollback_non_inline_std(&self, rollback_data_dir: Option<Uuid>) -> std::io::Result<()> {
-        self.rollback_metadata_std(rollback_data_dir)?;
-        if let Some((_, new_data_path)) = self.data_paths {
-            remove_dir_all_if_exists(new_data_path)?;
-        }
-        Ok(())
-    }
-
-    fn rollback_inline_std(
-        &self,
-        rollback_data_dir: Option<Uuid>,
-        local_backup: Option<&StagedRollbackBackup>,
-    ) -> std::io::Result<()> {
-        #[cfg(all(test, not(windows)))]
-        os::prepared_publication_test_hooks::run(os::prepared_publication_test_hooks::Stage::Rollback, self.destination_metadata);
-        if let Some(backup) = local_backup {
-            // The preceding commit used this staged directory on the same
-            // filesystem. Never unlink xl.meta before its atomic replacement.
-            std::fs::rename(backup.path(), self.destination_metadata)?;
-        } else {
-            self.rollback_metadata_std(rollback_data_dir)?;
-        }
-        Ok(())
-    }
-
-    async fn restore_published_data_source(&self) -> Result<()> {
-        let Some((src_data_path, dst_data_path)) = self.data_paths else {
-            return Ok(());
+fn rollback_committed_rename_std(
+    dst_file_path: &Path,
+    new_data_path: Option<&Path>,
+    rollback_data_dir: Option<Uuid>,
+) -> std::io::Result<()> {
+    if let Some(old_data_dir) = rollback_data_dir {
+        let Some(dst_parent) = dst_file_path.parent() else {
+            return Err(std::io::Error::new(ErrorKind::InvalidInput, "missing object metadata parent"));
         };
-        let src_volume_dir = self.source_volume_dir;
-        let publication_root = self.publication_root;
-        let mutation_lease = self.mutation_lease.clone();
-        if fs::symlink_metadata(src_data_path).await.is_ok() {
-            return Ok(());
-        }
-        let result =
-            match os::rename_all_with_lease(dst_data_path, src_data_path, src_volume_dir, publication_root, mutation_lease).await
-            {
-                Ok(()) => Ok(()),
-                Err(DiskError::FileNotFound) => {
-                    let source_exists = fs::symlink_metadata(src_data_path).await.is_ok();
-                    let destination_missing = matches!(
-                        fs::symlink_metadata(dst_data_path).await,
-                        Err(err) if err.kind() == ErrorKind::NotFound
-                    );
-                    if source_exists && destination_missing {
-                        Ok(())
-                    } else {
-                        Err(DiskError::FileNotFound)
-                    }
-                }
-                Err(err) => Err(err),
-            };
-        if let Err(err) = &result {
-            warn!(
-                target: "rustfs_ecstore::disk::local",
-                event = EVENT_DISK_LOCAL_RENAME_REJECTED,
-                component = LOG_COMPONENT_ECSTORE,
-                subsystem = LOG_SUBSYSTEM_DISK_LOCAL,
-                reason = "restore_staged_data_source_failed",
-                src_path = ?src_data_path,
-                dst_path = ?dst_data_path,
-                error = ?err,
-                "Failed to restore staged data after a metadata commit was rejected"
-            );
-        }
-        result
+        let backup_path = dst_parent.join(old_data_dir.to_string()).join(STORAGE_FORMAT_FILE_BACKUP);
+        std::fs::rename(backup_path, dst_file_path)?;
+    } else {
+        remove_file_if_exists(dst_file_path)?;
     }
+
+    if let Some(new_data_path) = new_data_path {
+        remove_dir_all_if_exists(new_data_path)?;
+    }
+
+    Ok(())
+}
+
+fn rollback_inline_metadata_commit_std(
+    dst_file_path: &Path,
+    rollback_data_dir: Option<Uuid>,
+    local_rollback_path: Option<&Path>,
+) -> std::io::Result<()> {
+    #[cfg(all(test, not(windows)))]
+    os::prepared_publication_test_hooks::run(os::prepared_publication_test_hooks::Stage::Rollback, dst_file_path);
+    if let Some(backup_path) = local_rollback_path {
+        // The commit immediately before this rollback renamed the staged
+        // xl.meta from the same directory as `backup_path` onto
+        // `dst_file_path`, proving both paths are on the same filesystem.
+        // Unix rename atomically replaces the committed destination; never
+        // unlink it first or an interrupted rollback could lose xl.meta.
+        std::fs::rename(backup_path, dst_file_path)?;
+    } else {
+        rollback_committed_rename_std(dst_file_path, None, rollback_data_dir)?;
+    }
+    Ok(())
 }
 
 #[cfg(any(not(windows), test))]
@@ -273,6 +212,61 @@ async fn read_rename_destination_metadata(
         .map_err(DiskError::from)
 }
 
+async fn restore_renamed_data_source(
+    src_volume_dir: &Path,
+    src_data_path: &Path,
+    dst_data_path: &Path,
+    publication_root: &os::PublicationRoot,
+    mutation_lease: Arc<os::NamespaceMutationLease>,
+) -> Result<()> {
+    if fs::symlink_metadata(src_data_path).await.is_ok() {
+        return Ok(());
+    }
+    let result =
+        match os::rename_all_with_lease(dst_data_path, src_data_path, src_volume_dir, publication_root, mutation_lease).await {
+            Ok(()) => Ok(()),
+            Err(DiskError::FileNotFound) => {
+                let source_exists = fs::symlink_metadata(src_data_path).await.is_ok();
+                let destination_missing = matches!(
+                    fs::symlink_metadata(dst_data_path).await,
+                    Err(err) if err.kind() == ErrorKind::NotFound
+                );
+                if source_exists && destination_missing {
+                    Ok(())
+                } else {
+                    Err(DiskError::FileNotFound)
+                }
+            }
+            Err(err) => Err(err),
+        };
+    if let Err(err) = &result {
+        warn!(
+            target: "rustfs_ecstore::disk::local",
+            event = EVENT_DISK_LOCAL_RENAME_REJECTED,
+            component = LOG_COMPONENT_ECSTORE,
+            subsystem = LOG_SUBSYSTEM_DISK_LOCAL,
+            reason = "restore_staged_data_source_failed",
+            src_path = ?src_data_path,
+            dst_path = ?dst_data_path,
+            error = ?err,
+            "Failed to restore staged data after a metadata commit was rejected"
+        );
+    }
+    result
+}
+
+async fn restore_published_data_source(
+    data_paths: Option<&(PathBuf, PathBuf)>,
+    src_volume_dir: &Path,
+    publication_root: &os::PublicationRoot,
+    mutation_lease: Arc<os::NamespaceMutationLease>,
+) -> Result<()> {
+    let Some((src_data_path, dst_data_path)) = data_paths else {
+        return Ok(());
+    };
+    restore_renamed_data_source(src_volume_dir, src_data_path, dst_data_path, publication_root, mutation_lease).await
+}
+
 /// Proof produced only when the local rename returns at an existing access
 /// preflight, before metadata, backups, or object data can be published.
 #[derive(Debug)]
@@ -463,18 +457,7 @@ impl LocalDisk {
             mutation_lease.clone(),
         )
         .await?;
-        let mut commit = RenameCommitContext {
-            directory_guard: rename_commit_guard,
-            publication_root: &self.publication_root,
-            mutation_lease,
-            source_metadata: &src_file_path,
-            destination_metadata: &dst_file_path,
-            source_volume_dir: &src_volume_dir,
-            data_paths: has_data_dir_path.as_ref(),
-        };
-        let has_dst_buf =
-            read_rename_destination_metadata(commit.destination_metadata, &commit.directory_guard, commit.mutation_lease.clone())
-                .await?;
+        let has_dst_buf = read_rename_destination_metadata(&dst_file_path, &rename_commit_guard, mutation_lease.clone()).await?;
 
         if no_inline {
             // Non-inline: read xl.meta, parse, write, rename data dir, rename xl.meta
@@ -550,18 +533,18 @@ impl LocalDisk {
             // rename below to report through the existing rollback path. Payload
             // durability is kept by both strict and relaxed.
             let tmp_meta_write = {
-                let src_file_path = commit.source_metadata.to_path_buf();
+                let src_file_path = src_file_path.clone();
                 let dst_file_path = dst_file_path.clone();
-                let owned_directory_guard = commit.directory_guard.clone();
-                let owned_mutation_lease = commit.mutation_lease.clone();
+                let rename_commit_guard = rename_commit_guard.clone();
+                let mutation_lease = mutation_lease.clone();
                 async move {
-                    os::run_blocking_namespace_operation(owned_mutation_lease, move || {
+                    os::run_blocking_namespace_operation(mutation_lease, move || {
                         #[cfg(test)]
                         run_owned_file_write_before_open(&src_file_path);
                         let mut prepared_metadata_source = os::create_prepared_rename_source_with_commit_guard(
                             &src_file_path,
                             &dst_file_path,
-                            &owned_directory_guard,
+                            &rename_commit_guard,
                         )?;
                         prepared_metadata_source.write_all(&new_dst_buf, tmp_meta_sync != SyncMode::None)?;
                         Ok(prepared_metadata_source)
@@ -587,14 +570,14 @@ impl LocalDisk {
             // sequential version did.
             let prepared_metadata_source = tmp_meta_res?;
             shard_sync_res?;
-            commit.directory_guard = remove_dst_base_before_commit(
+            let rename_commit_guard = remove_dst_base_before_commit(
                 dst_path,
-                commit.directory_guard,
+                rename_commit_guard,
                 src_file_parent,
                 dst_file_parent,
                 &dst_volume_dir,
-                commit.publication_root,
-                commit.mutation_lease.clone(),
+                &self.publication_root,
+                mutation_lease.clone(),
             )
             .await?;
             if should_remove_staged_meta_before_commit(dst_path) {
@@ -612,7 +595,7 @@ impl LocalDisk {
             if fi_healing
                 && let Some((_, dst_data_path)) = has_data_dir_path.as_ref()
                 && let Err(err) = self
-                    .move_to_trash_with_namespace_owner(dst_data_path, true, false, Some(commit.mutation_lease.clone()))
+                    .move_to_trash_with_namespace_owner(dst_data_path, true, false, Some(mutation_lease.clone()))
                     .await
             {
                 warn!(
@@ -630,9 +613,9 @@ impl LocalDisk {
                     src_data_path,
                     dst_data_path,
                     &skip_parent,
-                    commit.publication_root,
-                    &commit.directory_guard,
-                    commit.mutation_lease.clone(),
+                    &self.publication_root,
+                    &rename_commit_guard,
+                    mutation_lease.clone(),
                 )
                 .await
             {
@@ -647,7 +630,13 @@ impl LocalDisk {
                     error = ?err,
                     "Disk local rename flow failed"
                 );
-                commit.restore_published_data_source().await?;
+                restore_published_data_source(
+                    has_data_dir_path.as_ref(),
+                    &src_volume_dir,
+                    &self.publication_root,
+                    mutation_lease.clone(),
+                )
+                .await?;
                 return Err(err);
             }
             #[cfg(test)]
@@ -672,7 +661,13 @@ impl LocalDisk {
                     reason = "test_fail_before_old_metadata_backup",
                     "Disk local rename flow failed before metadata commit"
                 );
-                commit.restore_published_data_source().await?;
+                restore_published_data_source(
+                    has_data_dir_path.as_ref(),
+                    &src_volume_dir,
+                    &self.publication_root,
+                    mutation_lease.clone(),
+                )
+                .await?;
                 return Err(DiskError::Unexpected);
             }
 
@@ -690,16 +685,25 @@ impl LocalDisk {
                 let backup_parent = dst_file_parent.join(old_data_dir.to_string());
                 #[cfg(not(windows))]
                 if let Err(err) = os::make_dir_all(&backup_parent, &skip_parent).await {
-                    commit.restore_published_data_source().await?;
+                    restore_published_data_source(
+                        has_data_dir_path.as_ref(),
+                        &src_volume_dir,
+                        &self.publication_root,
+                        mutation_lease.clone(),
+                    )
+                    .await?;
                     return Err(err);
                 }
-                let backup_path_guard = match commit
-                    .directory_guard
-                    .create_destination_directory_for_path_access(&backup_parent)
-                {
+                let backup_path_guard = match rename_commit_guard.create_destination_directory_for_path_access(&backup_parent) {
                     Ok(guard) => guard,
                     Err(err) => {
-                        commit.restore_published_data_source().await?;
+                        restore_published_data_source(
+                            has_data_dir_path.as_ref(),
+                            &src_volume_dir,
+                            &self.publication_root,
+                            mutation_lease.clone(),
+                        )
+                        .await?;
                         return Err(DiskError::from(to_file_error(err)));
                     }
                 };
@@ -707,7 +711,13 @@ impl LocalDisk {
                 if let Err(err) = check_path_length(backup_path.to_string_lossy().as_ref()) {
                     #[cfg(windows)]
                     drop(backup_path_guard);
-                    commit.restore_published_data_source().await?;
+                    restore_published_data_source(
+                        has_data_dir_path.as_ref(),
+                        &src_volume_dir,
+                        &self.publication_root,
+                        mutation_lease.clone(),
+                    )
+                    .await?;
                     return Err(err);
                 }
                 let backup_bytes = dst_buf.clone();
@@ -716,7 +726,7 @@ impl LocalDisk {
                 // sync finish. A detached spawn_blocking writer could survive
                 // cancellation and later truncate a newer transaction's
                 // deterministic rollback backup.
-                let write_result = os::run_blocking_namespace_operation(commit.mutation_lease.clone(), move || {
+                let write_result = os::run_blocking_namespace_operation(mutation_lease.clone(), move || {
                     #[cfg(test)]
                     run_owned_file_write_before_open(&backup_path);
                     backup_path_guard.write_file_for_path_access(
@@ -739,7 +749,13 @@ impl LocalDisk {
                         error = ?err,
                         "Disk local rename flow failed"
                     );
-                    commit.restore_published_data_source().await?;
+                    restore_published_data_source(
+                        has_data_dir_path.as_ref(),
+                        &src_volume_dir,
+                        &self.publication_root,
+                        mutation_lease.clone(),
+                    )
+                    .await?;
                     return Err(err);
                 }
             }
@@ -757,9 +773,9 @@ impl LocalDisk {
                 &src_file_path,
                 &dst_file_path,
                 &skip_parent,
-                commit.publication_root,
-                &commit.directory_guard,
-                commit.mutation_lease.clone(),
+                &self.publication_root,
+                &rename_commit_guard,
+                mutation_lease.clone(),
             )
             .await
             {
@@ -774,11 +790,20 @@ impl LocalDisk {
                     error = ?err,
                     "Disk local rename flow failed"
                 );
-                commit.restore_published_data_source().await?;
+                restore_published_data_source(
+                    has_data_dir_path.as_ref(),
+                    &src_volume_dir,
+                    &self.publication_root,
+                    mutation_lease.clone(),
+                )
+                .await?;
                 return Err(err);
             }
+
+            let committed_new_data_path = has_data_dir_path.as_ref().map(|(_, dst_data_path)| dst_data_path.as_path());
             if should_fail_after_metadata_commit(dst_path) {
-                commit.rollback_non_inline_std(rollback_data_dir).map_err(to_file_error)?;
+                rollback_committed_rename_std(&dst_file_path, committed_new_data_path, rollback_data_dir)
+                    .map_err(to_file_error)?;
                 return Err(DiskError::Unexpected);
             }
 
@@ -798,12 +823,13 @@ impl LocalDisk {
                 && let Some(parent) = dst_file_path.parent()
             {
                 let fsync_started = rustfs_io_metrics::put_stage_timer();
-                if let Err(err) = os::fsync_dst_dir_group_commit(parent, Some(commit.mutation_lease.clone())).await {
+                if let Err(err) = os::fsync_dst_dir_group_commit(parent, Some(mutation_lease.clone())).await {
                     rustfs_io_metrics::record_put_object_stage_duration_from(
                         rustfs_io_metrics::PUT_STAGE_SET_DISK_RENAME_DST_DIR_FSYNC,
                         fsync_started,
                     );
-                    commit.rollback_non_inline_std(rollback_data_dir).map_err(to_file_error)?;
+                    rollback_committed_rename_std(&dst_file_path, committed_new_data_path, rollback_data_dir)
+                        .map_err(to_file_error)?;
                     // The commit rename changed the dst part inodes before this fsync
                     // failed and rolled them back; drop any fd cached during that
                     // window so readers re-open the restored inode (rustfs/backlog#1177).
@@ -835,12 +861,13 @@ impl LocalDisk {
                         break;
                     }
                     let fsync_started = rustfs_io_metrics::put_stage_timer();
-                    if let Err(err) = os::fsync_dir_with_owner(dir, Some(commit.mutation_lease.clone())).await {
+                    if let Err(err) = os::fsync_dir_with_owner(dir, Some(mutation_lease.clone())).await {
                         rustfs_io_metrics::record_put_object_stage_duration_from(
                             rustfs_io_metrics::PUT_STAGE_SET_DISK_RENAME_ANCESTOR_DIR_FSYNC,
                             fsync_started,
                         );
-                        commit.rollback_non_inline_std(rollback_data_dir).map_err(to_file_error)?;
+                        rollback_committed_rename_std(&dst_file_path, committed_new_data_path, rollback_data_dir)
+                            .map_err(to_file_error)?;
                         // Same post-commit rollback window as above — drop cached
                         // dst part fds so readers re-open the restored inode
                         // (rustfs/backlog#1177).
@@ -864,7 +891,7 @@ impl LocalDisk {
             // complete. Do not retain the Windows object identity guard while
             // cleaning staging paths or invalidating cached descriptors.
             #[cfg(windows)]
-            drop(commit.directory_guard);
+            drop(rename_commit_guard);
 
             if let Some(src_file_path_parent) = src_file_path.parent() {
                 if src_volume != super::super::RUSTFS_META_MULTIPART_BUCKET {
@@ -912,7 +939,7 @@ impl LocalDisk {
             let dst_path_for_failpoint = dst_path.to_string();
             #[cfg(windows)]
             let source_parent = src_file_parent.to_path_buf();
-            let rename_commit_guard_for_preparation = commit.directory_guard.clone();
+            let rename_commit_guard_for_preparation = rename_commit_guard.clone();
             let sync = durability.syncs_commit_metadata();
             #[cfg(test)]
             run_inline_before_file_sync_admission(dst_path);
@@ -995,7 +1022,7 @@ impl LocalDisk {
                     if sync {
                         std::fs::File::open(&backup_path)?.sync_data()?;
                     }
-                    staged_rollback_path = Some(StagedRollbackBackup(backup_path));
+                    staged_rollback_path = Some(backup_path);
                 }
 
                 Ok::<_, std::io::Error>((
@@ -1009,10 +1036,9 @@ impl LocalDisk {
                 ))
             };
             let inline_preparation = if let Some(admission) = file_sync_admission.as_ref() {
-                os::run_blocking_namespace_file_sync_operation(commit.mutation_lease.clone(), admission, prepare_inline_metadata)
-                    .await
+                os::run_blocking_namespace_file_sync_operation(mutation_lease.clone(), admission, prepare_inline_metadata).await
             } else {
-                os::run_blocking_namespace_operation(commit.mutation_lease.clone(), prepare_inline_metadata).await
+                os::run_blocking_namespace_operation(mutation_lease.clone(), prepare_inline_metadata).await
             }
             .map_err(to_file_error)
             .map_err(DiskError::from);
@@ -1035,30 +1061,28 @@ impl LocalDisk {
                 }
             };
 
-            commit.directory_guard = remove_dst_base_before_commit(
+            let rename_commit_guard = remove_dst_base_before_commit(
                 dst_path,
-                commit.directory_guard,
+                rename_commit_guard,
                 src_file_parent,
                 dst_file_parent,
                 &dst_volume_dir,
-                commit.publication_root,
-                commit.mutation_lease.clone(),
+                &self.publication_root,
+                mutation_lease.clone(),
             )
             .await?;
 
             if should_remove_staged_meta_before_commit(dst_path) {
                 drop(prepared_metadata_source);
                 let remove_result = std::fs::remove_file(&src_file_path);
-                if let Some(backup_path) = local_rollback_path.as_ref().map(StagedRollbackBackup::path) {
+                if let Some(backup_path) = local_rollback_path.as_deref() {
                     let _ = remove_file_if_exists(backup_path);
                 }
                 remove_result.map_err(to_file_error)?;
                 return Err(DiskError::FileNotFound);
             }
 
-            if let (Some(rollback_data_dir), Some(staged_backup)) =
-                (rollback_data_dir, local_rollback_path.as_ref().map(StagedRollbackBackup::path))
-            {
+            if let (Some(rollback_data_dir), Some(staged_backup)) = (rollback_data_dir, local_rollback_path.as_deref()) {
                 let Some(dst_parent) = dst_file_path.parent() else {
                     return Err(DiskError::other("missing object metadata parent"));
                 };
@@ -1072,8 +1096,8 @@ impl LocalDisk {
                     staged_backup,
                     &backup_path,
                     &dst_volume_dir,
-                    commit.publication_root,
-                    Some(commit.mutation_lease.clone()),
+                    &self.publication_root,
+                    Some(mutation_lease.clone()),
                 )
                 .await
                 {
@@ -1095,8 +1119,7 @@ impl LocalDisk {
                 {
                     let fsync_started = rustfs_io_metrics::put_stage_timer();
                     if let Err(err) =
-                        os::fsync_dir_with_namespace_file_sync_limit(backup_parent, commit.mutation_lease.clone(), admission)
-                            .await
+                        os::fsync_dir_with_namespace_file_sync_limit(backup_parent, mutation_lease.clone(), admission).await
                     {
                         rustfs_io_metrics::record_put_object_stage_duration_from(
                             rustfs_io_metrics::PUT_STAGE_SET_DISK_RENAME_BACKUP_DIR_FSYNC,
@@ -1120,14 +1143,14 @@ impl LocalDisk {
                     &src_file_path,
                     &dst_file_path,
                     &dst_volume_dir,
-                    commit.publication_root,
-                    &commit.directory_guard,
-                    commit.mutation_lease.clone(),
+                    &self.publication_root,
+                    &rename_commit_guard,
+                    mutation_lease.clone(),
                 )
                 .await
             };
             if let Err(err) = commit_result {
-                if let Some(backup_path) = local_rollback_path.as_ref().map(StagedRollbackBackup::path) {
+                if let Some(backup_path) = local_rollback_path.as_deref() {
                     let _ = remove_file_if_exists(backup_path);
                 }
                 for part_path in &invalidate_part_paths {
@@ -1138,7 +1161,7 @@ impl LocalDisk {
 
             let post_commit = async {
                 if should_fail_after_metadata_commit(dst_path) {
-                    commit.rollback_inline_std(rollback_data_dir, local_rollback_path.as_ref())?;
+                    rollback_inline_metadata_commit_std(&dst_file_path, rollback_data_dir, local_rollback_path.as_deref())?;
                     return Err(std::io::Error::other("test fail after metadata commit"));
                 }
 
@@ -1147,18 +1170,15 @@ impl LocalDisk {
                     && let Some(dst_parent) = dst_file_path.parent()
                 {
                     let fsync_started = rustfs_io_metrics::put_stage_timer();
-                    if let Err(err) = os::fsync_dst_dir_group_commit_or_namespace_file_sync_limit(
-                        dst_parent,
-                        commit.mutation_lease.clone(),
-                        admission,
-                    )
-                    .await
+                    if let Err(err) =
+                        os::fsync_dst_dir_group_commit_or_namespace_file_sync_limit(dst_parent, mutation_lease.clone(), admission)
+                            .await
                     {
                         rustfs_io_metrics::record_put_object_stage_duration_from(
                             rustfs_io_metrics::PUT_STAGE_SET_DISK_RENAME_DST_DIR_FSYNC,
                             fsync_started,
                         );
-                        commit.rollback_inline_std(rollback_data_dir, local_rollback_path.as_ref())?;
+                        rollback_inline_metadata_commit_std(&dst_file_path, rollback_data_dir, local_rollback_path.as_deref())?;
                         return Err(err);
                     }
                     rustfs_io_metrics::record_put_object_stage_duration_from(
@@ -1184,14 +1204,17 @@ impl LocalDisk {
                         }
                         let fsync_started = rustfs_io_metrics::put_stage_timer();
                         if let Err(err) =
-                            os::fsync_dir_with_namespace_file_sync_limit(ancestor_dir, commit.mutation_lease.clone(), admission)
-                                .await
+                            os::fsync_dir_with_namespace_file_sync_limit(ancestor_dir, mutation_lease.clone(), admission).await
                         {
                             rustfs_io_metrics::record_put_object_stage_duration_from(
                                 rustfs_io_metrics::PUT_STAGE_SET_DISK_RENAME_ANCESTOR_DIR_FSYNC,
                                 fsync_started,
                             );
-                            commit.rollback_inline_std(rollback_data_dir, local_rollback_path.as_ref())?;
+                            rollback_inline_metadata_commit_std(
+                                &dst_file_path,
+                                rollback_data_dir,
+                                local_rollback_path.as_deref(),
+                            )?;
                             return Err(err);
                         }
                         rustfs_io_metrics::record_put_object_stage_duration_from(
@@ -1228,9 +1251,9 @@ impl LocalDisk {
             // The commit no longer has a rollback path. Release the Windows
             // object identity guard before best-effort staging cleanup.
             #[cfg(windows)]
-            drop(commit.directory_guard);
+            drop(rename_commit_guard);
 
-            if let Some(backup_path) = local_rollback_path.as_ref().map(StagedRollbackBackup::path) {
+            if let Some(backup_path) = local_rollback_path.as_deref() {
                 let _ = remove_file_if_exists(backup_path);
             }
 

crates/ecstore/src/disk/mod.rs

@@ -22,15 +22,9 @@ pub mod error_reduce;
 pub mod format;
 pub mod fs;
 pub mod health_state;
-mod io_admission;
 pub mod local;
 pub mod os;
 
-#[cfg(test)]
-pub(crate) use io_admission::DiskIoClass;
-pub use io_admission::with_background_disk_io;
-pub(crate) use io_admission::{acquire_context_disk_io_permit, current_disk_io_context, with_optional_disk_io_context};
-
 pub const RUSTFS_META_BUCKET: &str = ".rustfs.sys";
 pub const MIGRATING_META_BUCKET: &str = ".minio.sys";
 pub const RUSTFS_META_MULTIPART_BUCKET: &str = ".rustfs.sys/multipart";

crates/ecstore/src/ecstore_validation_blackbox.rs

@@ -259,7 +259,7 @@ async fn blackbox_put_unknown_actual_size_restores_body_and_records_written_size
         .map(|idx| ((idx * 17) % 251) as u8)
         .collect::<Vec<_>>();
     let opts = ObjectOptions {
-        write_completion: crate::object_api::WriteCompletion::TailDrained,
+        no_lock: true,
         ..Default::default()
     };
 
@@ -300,7 +300,7 @@ async fn blackbox_get_restores_body_after_one_shard_file_is_removed() {
         .map(|idx| ((idx * 19) % 251) as u8)
         .collect::<Vec<_>>();
     let opts = ObjectOptions {
-        write_completion: crate::object_api::WriteCompletion::TailDrained,
+        no_lock: true,
         ..Default::default()
     };
 
@@ -406,7 +406,7 @@ async fn blackbox_heal_requests_preserve_repair_scope() {
                         put_object,
                         &mut put_reader,
                         &ObjectOptions {
-                            write_completion: crate::object_api::WriteCompletion::TailDrained,
+                            no_lock: true,
                             versioned: true,
                             expected_bucket_incarnation_id: Some(put_incarnation),
                             ..Default::default()
@@ -469,7 +469,7 @@ async fn blackbox_heal_requests_preserve_repair_scope() {
             put_object,
             &mut healthy_reader,
             &ObjectOptions {
-                write_completion: crate::object_api::WriteCompletion::TailDrained,
+                no_lock: true,
                 ..Default::default()
             },
         )
@@ -509,7 +509,7 @@ async fn blackbox_heal_requests_preserve_repair_scope() {
             .map(|idx| ((idx * 29) % 251) as u8)
             .collect::<Vec<_>>();
         let opts = ObjectOptions {
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
+            no_lock: true,
             ..Default::default()
         };
 
@@ -567,7 +567,7 @@ async fn blackbox_heal_requests_preserve_repair_scope() {
         let suspended_object = "suspended.bin";
         let payload = vec![0x5a; 1 << 20];
         let mpu_opts = ObjectOptions {
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
+            no_lock: true,
             versioned: true,
             ..Default::default()
         };
@@ -675,7 +675,7 @@ async fn blackbox_heal_requests_preserve_repair_scope() {
                 .expect("fourth disk should be online before suspended completion")
         };
         let suspended_opts = ObjectOptions {
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
+            no_lock: true,
             version_suspended: true,
             ..Default::default()
         };
@@ -712,7 +712,7 @@ async fn blackbox_range_read_restores_exact_slice_with_one_offline_disk() {
     let range_start = 513usize;
     let range_len = 8192usize;
     let opts = ObjectOptions {
-        write_completion: crate::object_api::WriteCompletion::TailDrained,
+        no_lock: true,
         ..Default::default()
     };
 
@@ -756,7 +756,7 @@ async fn blackbox_delete_marker_hides_object_body_without_erasing_prior_version_
     let bucket = "bb-delete-marker-read-negative";
     let object = "object.bin";
     let opts = ObjectOptions {
-        write_completion: crate::object_api::WriteCompletion::TailDrained,
+        no_lock: true,
         version_suspended: true,
         object_lock_config_snapshot: Some(Arc::new(ObjectLockConfigSnapshot::new(ObjectLockConfigState::ConfirmedAbsent))),
         ..Default::default()
@@ -853,7 +853,7 @@ async fn blackbox_issue3031_diag_covers_put_success_cleanup_and_error_summary()
         let first_payload = b"first diagnostic body".to_vec();
         let second_payload = b"second diagnostic body that replaces the first".to_vec();
         let opts = ObjectOptions {
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
+            no_lock: true,
             ..Default::default()
         };
 
@@ -959,7 +959,7 @@ mod old_current_size_backfill {
             .await
             .expect("bucket should be created");
         let opts = ObjectOptions {
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
+            no_lock: true,
             ..Default::default()
         };
 
@@ -993,7 +993,7 @@ mod old_current_size_backfill {
         // latest's size, not the incoming version's.
         let versioned = "versioned.bin";
         let first_version_opts = ObjectOptions {
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
+            no_lock: true,
             versioned: true,
             version_id: Some(uuid::Uuid::new_v4().to_string()),
             ..Default::default()
@@ -1005,7 +1005,7 @@ mod old_current_size_backfill {
         let expected = prelookup_expectation(&set_disks, bucket, versioned).await;
         assert_eq!(expected, OldCurrentSize::Present(111));
         let second_version_opts = ObjectOptions {
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
+            no_lock: true,
             versioned: true,
             version_id: Some(uuid::Uuid::new_v4().to_string()),
             ..Default::default()
@@ -1037,7 +1037,7 @@ mod old_current_size_backfill {
         let expected = prelookup_expectation(&set_disks, bucket, versioned).await;
         assert_eq!(expected, OldCurrentSize::Present(0));
         let third_version_opts = ObjectOptions {
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
+            no_lock: true,
             versioned: true,
             version_id: Some(uuid::Uuid::new_v4().to_string()),
             ..Default::default()
@@ -1061,7 +1061,7 @@ mod old_current_size_backfill {
             .await
             .expect("bucket should be created");
         let opts = ObjectOptions {
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
+            no_lock: true,
             ..Default::default()
         };