chore(gateway): merge main into integration

Source: main 0f24511535
Target: gateway/integration 8cf6187ff4

Resolve the e2e-full selection digest conflict by recomputing both
platform digests over the merged nextest listing (685 darwin / 693
linux): main adds two rpc_fault_proxy unit tests, integration keeps its
dual-stack differential and anonymous-access additions. Raise the rustfs
test-count baseline row to the merged count (5932).

.config/e2e-distributed-selection.txt

@@ -1,2 +1,2 @@
-sha256-linux=74a1d6975e2d6dfe01363585cb9bfa3232d79556a154d4f599653fe2ed1ce696
-sha256-darwin=74a1d6975e2d6dfe01363585cb9bfa3232d79556a154d4f599653fe2ed1ce696
+sha256-linux=cf31ed27e4e6bf42da5bf81f248d9d2619ac8e8615186cdacb30bd63996d7607
+sha256-darwin=cf31ed27e4e6bf42da5bf81f248d9d2619ac8e8615186cdacb30bd63996d7607

.config/e2e-full-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=b53fe6d46cdffedfad6a83da0dfffa9aec10cd7c8ace53469f129587bc9f4d50
-sha256-linux=6be90f5c3886e9852ac27d51f2d47e6d2fa8bb424e0d03ee931268dcd0020db8
+sha256-darwin=7893834728e2dadb98110c2aa018e6aa150c882c8a39c753e8095c3aef94cf0e
+sha256-linux=fb95ac8ba4b68aec9182fe32a59923e6b0d37b45a62ce87ea7db0dc3c40375e6

.config/e2e-repl-nightly-selection.txt

@@ -1 +1 @@
-sha256=e4ee3898b840a8374cb02c64342cc15f8d7ecd1becaf4b4a2a4657290f9e7ff1
+sha256=4eac269f9a59b2f9be4e7a87ea6aa38454f5ebe10ede35c9b8d4218137d2cd35

.config/e2e-smoke-selection.txt

@@ -1 +1 @@
-sha256=002ec5d973f82288e50a096a2c8b3b38749f62a7a3e169775566874d8ee98b4a
+sha256=aa603dbbae2e0dc0803489a88887a630c542a6949466c2b0e73b8a6b5e57fcaa

.config/make/lint-fmt.mak

@@ -70,6 +70,11 @@ s3s-footprint-check: ## Check the s3s dependency footprint ratchet stays frozen
 	@echo "📦 Checking s3s footprint ratchet..."
 	./scripts/check_s3s_footprint.sh
 
+.PHONY: test-count-ratchet-check
+test-count-ratchet-check: ## Check no workspace crate lost tests or gained #[ignore] against the committed baseline
+	@echo "🧪 Checking per-crate test-count ratchet..."
+	./scripts/check_test_count_ratchet.sh
+
 .PHONY: fips-wording-check
 fips-wording-check: ## Check docs and crates/kms do not over-claim crypto capabilities
 	@echo "📣 Checking cryptographic capability wording guard..."

.config/make/pre-commit.mak

@@ -20,11 +20,11 @@ planning-docs-check: ## Check that no planning-type documents are committed
 	./scripts/check_no_planning_docs.sh
 
 .PHONY: pre-commit
-pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
+pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check test-count-ratchet-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
 	@echo "✅ All pre-commit checks passed!"
 
 .PHONY: pre-pr
-pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check log-analyzer-rules-check offline-enrollment-e2e-check clippy-check test ## Run full pre-PR checks with clippy and tests
+pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check test-count-ratchet-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check log-analyzer-rules-check offline-enrollment-e2e-check clippy-check test ## Run full pre-PR checks with clippy and tests
 	@echo "✅ All pre-PR checks passed!"
 
 .PHONY: dev-check

.config/make/tests.mak

@@ -50,7 +50,9 @@ script-tests: ## Run shell script tests
 	./scripts/test_fuzz_runner.sh
 	./scripts/test_python_bin.sh
 	./scripts/check_embedded_secrets.sh --self-test
+	./scripts/check_s3s_footprint.sh --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_test_wiring.py --self-test
+	$(RUSTFS_PYTHON_BIN) ./scripts/codemods/s3_error_to_s3_types.py --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_e2e_binary.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_release_build_workflow.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_release_glibc.py

.config/nextest.toml

@@ -334,6 +334,12 @@ threads-required = "num-test-threads"
 filter = 'package(rustfs-ecstore) & test(=store::init::tests::dispatch_manifest_rollback_bounded_concurrency_reaches_tail_behind_slow_member)'
 threads-required = "num-test-threads"
 
+# These short-deadline real-disk progress probes need the test run's capacity
+# for scanner and object-lock handoffs; keep their assertions and deadlines.
+[[profile.default.overrides]]
+filter = '(package(rustfs-scanner) & (test(=scanner::tests::cycle_persist_failure::later_cycle_post_commit_failure_reloads_durable_state) | test(=scanner::tests::running_main_loop_catches_up_pause_cleared_after_startup_observe))) | (package(rustfs-ecstore) & test(=store::init::tests::restored_transitioned_delete_causally_enqueues_free_version))'
+threads-required = "num-test-threads"
+
 # ---------------------------------------------------------------------------
 # ci profile — the strict CI gate (ci.yml `cargo nextest run --profile ci`)
 # ---------------------------------------------------------------------------
@@ -391,6 +397,12 @@ threads-required = "num-test-threads"
 filter = 'package(rustfs-scanner) & (test(/^scanner::backlog::tests::native_/) | test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(/^scanner_io::tests::service_cohort::/))'
 threads-required = "num-test-threads"
 
+# Keep short-deadline real-disk progress probes from competing with unrelated
+# tests for scanner and object-lock capacity. Assertions and deadlines stay on.
+[[profile.ci.overrides]]
+filter = '(package(rustfs-scanner) & (test(=scanner::tests::cycle_persist_failure::later_cycle_post_commit_failure_reloads_durable_state) | test(=scanner::tests::running_main_loop_catches_up_pause_cleared_after_startup_observe))) | (package(rustfs-ecstore) & test(=store::init::tests::restored_transitioned_delete_causally_enqueues_free_version))'
+threads-required = "num-test-threads"
+
 [[profile.ci.scripts]]
 filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(batch_transitioned_delete_uses_free_version_per_item|decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|dispatched_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|force_tier_remove_blocks_on_physical_free_version_hidden_by_other_pool|legacy_unknown_transition_delete_falls_back_for_single_batch_and_blocks_prefix|multi_pool_(recursive_prefix_rejects_legacy_or_hidden_merge_loser_before_delete|same_remote_tuple_(batch|single)_delete_waits_for_all_sources|same_tuple_recursive_prefix_uses_one_journal_owner|transitioned_delete_persists_one_free_version_per_remote_tuple)|recursive_prefix_partial_(pool|set)_failure_keeps_prepared_cleanup_owners|restored_transitioned_delete_uses_free_version_as_cleanup_owner|stable_transitioned_recursive_prefix_delete_uses_journal_owners|suspended_null_transition_delete_uses_free_version_as_sole_owner|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)|transitioned_delete_(free_version_replays_after_store_restart|local_quorum_failure_rolls_back_without_cleanup_owner|uses_free_version_as_cleanup_owner)|versioned_delete_marker_keeps_transitioned_source_and_remote_object|versioned_explicit_transition_delete_preserves_other_version_then_allows_bucket_delete))$/)'
 setup = 'ecstore-large-stack'
@@ -650,6 +662,14 @@ test-group = 'ecstore-serial-flaky'
 # the PR-lane e2e coverage for scanner usage snapshots consumed by quota and
 # admin surfaces. It uses the same single-node, random-port, isolated-temp-dir
 # fixture as the existing smoke modules.
+#
+# Dual-stack differential (rustfs/backlog#2740): `dual_stack_differential::`
+# starts two single-node servers from the same binary, one per
+# RUSTFS_S3_STACK value, on random ports with isolated temp dirs, and runs one
+# SDK script covering every operation of `impl S3 for FS` against both. Its
+# comparator unit tests need no server. It meets the admission criteria
+# unchanged; the module clause admits a new differential test without another
+# filter edit.
 [profile.e2e-smoke]
 default-filter = """
     package(e2e_test) & (
@@ -658,6 +678,7 @@ default-filter = """
         | test(/^reliant::lifecycle::/)
         | test(/^conditional_delete_objects_test::/)
         | test(/^reliant::tiering::/)
+        | test(/^dual_stack_differential::/)
         | test(/^upgrade_compatibility_test::upgrade_write_readiness_tests::/)
         | test(/^on_demand_migration::(get_basic_test::(get_miss_pulls_inline_and_serves_locally_afterwards|head_miss_answers_from_the_source_without_persisting)|interaction_test::test_odm_admin_config_is_redacted_and_status_counts_match_the_source)$/)
     )

.config/s3s-edge-allowlist.txt

@@ -0,0 +1,37 @@
+# Files that may still reference s3s (`s3s::` or `s3s_sigv4`) when Phase 1 of
+# the gateway migration ends (rustfs/backlog#2734 task T0.6, rustfs/backlog#2741).
+# Consumed only by `scripts/check_s3s_footprint.sh --mode allowlist`.
+#
+# One entry per line: a repository-relative file path or a git `:(glob)`
+# pathspec. `**` matches across directories, `*` stays within one path
+# component, and a directory entry matches everything under it. Blank lines
+# and lines starting with `#` are ignored; an entry may not contain whitespace,
+# so a note belongs on its own comment line.
+#
+# Every Rust file listed by `git grep -l '\bs3s\(::\|_sigv4\)' -- '*.rs'` that
+# no entry matches fails the allowlist mode. Task T1.9 switches CI to that
+# mode; until then `--dry-run` prints the files still outside this list, which
+# is the Phase 1 tracking list.
+#
+# Never add crates/** other than crates/e2e_test: the engine crates leave s3s
+# entirely, and the script rejects such an entry. Only the s3s-facing edge of
+# the rustfs binary and the e2e oracle keep it.
+
+# rustfs binary: the s3s-facing edge that survives Phase 1
+rustfs/src/storage/ecfs.rs
+rustfs/src/storage/s3_compat/**
+rustfs/src/storage/access.rs
+rustfs/src/auth.rs
+rustfs/src/error.rs
+rustfs/src/storage_api.rs
+rustfs/src/app/storage_api.rs
+rustfs/src/admin/router.rs
+rustfs/src/app/metadata_route.rs
+rustfs/src/server/http.rs
+rustfs/src/server/layer.rs
+rustfs/src/server/hybrid.rs
+rustfs/src/protocols/client.rs
+
+# e2e oracle: the test target that verifies S3 behaviour against s3s
+crates/e2e_test/src/fake_s3_target/**
+crates/e2e_test/src/**

.config/s3s-footprint-baseline.txt

@@ -0,0 +1,17 @@
+# Exact baseline for the direct s3s footprint, consumed only by
+# scripts/check_s3s_footprint.sh (rustfs/backlog#1677; rustfs/backlog#2734 T0.4).
+#
+# Each value is the exact measurement of the tree, not a ceiling. CI fails when a
+# measured counter differs from its line here in either direction:
+#   - a larger measurement means new code widened the s3s surface: route it
+#     through the gateway abstractions instead; never raise a value here;
+#   - a smaller measurement means the PR shrank the surface: lower the matching
+#     value to the measured number in the same PR.
+#
+# files           Rust files referencing s3s paths, repo-wide minus crates/e2e_test
+# s3_error_lines  lines holding s3_error!, same scope, minus those the script
+#                 header's rule clears (rustfs_s3_types's macro); fails closed
+# ecstore_files   Rust files referencing s3s paths under crates/ecstore/src
+files=107
+s3_error_lines=289
+ecstore_files=0

.config/test-count-baseline.txt

@@ -0,0 +1,63 @@
+# Per-crate test-count baseline consumed by scripts/check_test_count_ratchet.sh
+# (rustfs/backlog#2734 section 1 rule 3; T0.3 in rustfs/backlog#2738).
+#
+# One row per workspace member: <package>, tests, ignored, tab-separated.
+# tests counts #[test], #[tokio::test], #[tokio::test(...)] and #[test_case(...)]
+# attribute lines under the package directory; ignored counts #[ignore] and
+# #[ignore = "..."]. Both columns are exact: CI fails when a crate's tests fall
+# below or rise above its row, or when its ignored count changes. Raise a row in
+# the PR that adds tests; lowering one is a reviewed statement that tests were
+# intentionally removed. Regenerate with:
+#   scripts/check_test_count_ratchet.sh --update
+e2e_test	956	20
+rustfs	5932	64
+rustfs-audit	70	0
+rustfs-checksums	26	0
+rustfs-common	36	0
+rustfs-concurrency	53	0
+rustfs-config	43	0
+rustfs-connect-symbol-catalog	6	0
+rustfs-credentials	24	0
+rustfs-crypto	67	0
+rustfs-data-usage	55	0
+rustfs-ecstore	7081	1
+rustfs-extension-schema	23	0
+rustfs-filemeta	364	0
+rustfs-heal	984	3
+rustfs-heal-contracts	7	0
+rustfs-iam	394	0
+rustfs-io-core	49	0
+rustfs-io-metrics	153	0
+rustfs-keystone	29	0
+rustfs-kms	715	25
+rustfs-license	2	0
+rustfs-lifecycle	155	0
+rustfs-lock	138	0
+rustfs-log-analyzer	90	0
+rustfs-madmin	210	0
+rustfs-notify	137	0
+rustfs-object-capacity	92	0
+rustfs-object-data-cache	140	0
+rustfs-obs	379	0
+rustfs-policy	725	0
+rustfs-protocols	738	1
+rustfs-protos	66	0
+rustfs-replication	209	0
+rustfs-rio	206	0
+rustfs-rio-v2	34	6
+rustfs-s3-client	69	0
+rustfs-s3-ops	8	0
+rustfs-s3-types	99	0
+rustfs-s3select-api	207	0
+rustfs-s3select-query	189	2
+rustfs-scanner	1205	20
+rustfs-scanner-metrics	87	0
+rustfs-security-governance	20	0
+rustfs-signer	31	0
+rustfs-storage-api	34	0
+rustfs-targets	603	26
+rustfs-test-utils	1	0
+rustfs-tls-runtime	43	0
+rustfs-trusted-proxies	68	0
+rustfs-utils	247	0
+rustfs-zip	30	0

.github/actions/quick-checks/action.yml

@@ -86,6 +86,10 @@ runs:
       shell: bash
       run: ./scripts/check_s3s_footprint.sh
 
+    - name: Check per-crate test-count ratchet
+      shell: bash
+      run: ./scripts/check_test_count_ratchet.sh
+
     - name: Check cryptographic capability wording
       shell: bash
       run: ./scripts/check_fips_wording.sh

.github/workflows/ci.yml

@@ -16,7 +16,9 @@ name: Continuous Integration
 
 on:
   push:
-    branches: [ main ]
+    # gateway/integration receives the daily merge of main as a direct push
+    # (rustfs/backlog#2734), so its pushes must prove the result like main's.
+    branches: [ main, gateway/integration ]
     paths-ignore:
       - "**.md"
       - "docs/**"
@@ -737,6 +739,8 @@ jobs:
     needs: [ build-rustfs-debug-binary ]
     runs-on: sm-standard-2
     timeout-minutes: 30
+    env:
+      RUSTFS_S3_STACK: legacy
     steps:
       - name: Checkout repository
         uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
@@ -855,18 +859,105 @@ jobs:
           path: ${{ runner.temp }}/rustfs-e2e-*/rustfs.log
           retention-days: 3
 
+  # The same e2e-smoke suite against the same debug binary with the gateway
+  # S3 stack selected (rustfs/backlog#2734). Report-only: it is outside the
+  # Test and Lint aggregate and becomes required at T2.10. The archive and run
+  # steps must stay identical to e2e-tests; scripts/ci_gate.py enforces that.
+  e2e-tests-gateway:
+    name: e2e-smoke (gateway, report-only until T2.10)
+    needs: [ build-rustfs-debug-binary ]
+    runs-on: sm-standard-2
+    timeout-minutes: 30
+    continue-on-error: true
+    env:
+      RUSTFS_S3_STACK: gateway
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install awscurl
+        run: |
+          python3 -m pip install --user --upgrade pip "awscurl==0.44"
+          echo "AWSCURL_PATH=$HOME/.local/bin/awscurl" >> "$GITHUB_ENV"
+
+      - name: Verify awscurl
+        run: test -x "$AWSCURL_PATH"
+
+      - name: Download debug binary
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rustfs-debug-binary
+          path: target/debug
+
+      - name: Make binary executable
+        run: chmod +x ./target/debug/rustfs
+
+      - name: Archive e2e smoke test binaries
+        env:
+          NEXTEST_ARCHIVE: ${{ runner.temp }}/rustfs-e2e-smoke.tar.zst
+          NEXTEST_LISTING: ${{ runner.temp }}/rustfs-e2e-smoke-list.json
+        run: |
+          cargo nextest archive --profile e2e-smoke -p e2e_test --archive-file "${NEXTEST_ARCHIVE}"
+          cargo nextest list --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" --message-format json > "${NEXTEST_LISTING}"
+          python3 ./scripts/check_test_wiring.py --check-profile e2e-smoke "${NEXTEST_LISTING}"
+          ./scripts/check_security_smoke_count.sh check "${NEXTEST_LISTING}"
+
+      - name: Run e2e smoke suite
+        env:
+          NEXTEST_ARCHIVE: ${{ runner.temp }}/rustfs-e2e-smoke.tar.zst
+          RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-smoke-logs
+          SAMPLER_INTERVAL_SECS: "15"
+        run: |
+          ./scripts/ci/resource_sampler.sh start e2e-smoke
+          trap './scripts/ci/resource_sampler.sh stop' EXIT
+          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" \
+            --status-level all --final-status-level all --failure-output final
+
+      - name: Upload e2e smoke diagnostics
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: e2e-smoke-gateway-diagnostics-${{ github.run_number }}
+          path: |
+            ${{ runner.temp }}/rustfs-e2e-smoke-logs/
+            ${{ runner.temp }}/rustfs-e2e-smoke-list.json
+          if-no-files-found: warn
+
+      - name: Upload e2e smoke JUnit report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: e2e-smoke-gateway-junit-${{ github.run_number }}
+          path: target/nextest/e2e-smoke/junit.xml
+          if-no-files-found: warn
+
   e2e-full:
     name: End-to-End Tests (full merge gate)
     # Merge gate only (backlog#1149 ci-5): the never-automated user-visible
     # suites — KMS, object_lock, multipart_auth, quota, checksum, encryption,
     # security-boundary, ... — via the e2e-full nextest profile. Too heavy for
-    # every PR, so it is gated to main pushes, the merge queue, and manual
-    # dispatch. protocols / the 7 cluster suites / replication / #[ignore] are
-    # owned by other lanes (see .config/nextest.toml profile.e2e-full).
+    # every PR, so it is gated to main and gateway/integration pushes, the merge
+    # queue, and manual dispatch. protocols / the 7 cluster suites / replication
+    # / #[ignore] are owned by other lanes (see .config/nextest.toml profile.e2e-full).
     if: >-
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'merge_group' ||
-      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+      (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/gateway/integration'))
     needs: [ build-rustfs-debug-binary ]
     runs-on: sm-standard-2
     timeout-minutes: 55

.github/workflows/windows-filesystem.yml

@@ -25,8 +25,6 @@ on:
       - "crates/ecstore/src/object_api/write_commit_context.rs"
       - "crates/ecstore/src/bucket/utils.rs"
       - "crates/ecstore/Cargo.toml"
-      - "crates/storage-api/src/bucket.rs"
-      - "crates/storage-api/Cargo.toml"
       - "crates/utils/src/dunce.rs"
       - "crates/utils/src/os/**"
       - "crates/utils/Cargo.toml"
@@ -50,8 +48,6 @@ on:
       - "crates/ecstore/src/object_api/write_commit_context.rs"
       - "crates/ecstore/src/bucket/utils.rs"
       - "crates/ecstore/Cargo.toml"
-      - "crates/storage-api/src/bucket.rs"
-      - "crates/storage-api/Cargo.toml"
       - "crates/utils/src/dunce.rs"
       - "crates/utils/src/os/**"
       - "crates/utils/Cargo.toml"
@@ -144,17 +140,6 @@ jobs:
         shell: pwsh
         run: "cargo test -p rustfs-ecstore --lib bucket::utils:: -- --nocapture"
 
-      - name: Test artifact prefix Windows file-name rules
-        shell: pwsh
-        run: |
-          $testName = 'bucket::tests::artifact_prefix_preserves_host_file_name_rules'
-          cargo test --locked -p rustfs-storage-api --lib $testName -- --exact --nocapture --color never 2>&1 |
-            Tee-Object -Variable testOutput
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-          if (($testOutput -join "`n") -notmatch 'test result: ok\. 1 passed; 0 failed; 0 ignored;') {
-            throw 'Expected exactly one passing artifact prefix test on Windows'
-          }
-
       - name: Test Windows file-name rules
         shell: pwsh
         run: "cargo test -p rustfs-utils --no-default-features --features path --lib dunce:: -- --nocapture"

ARCHITECTURE.md

@@ -155,7 +155,7 @@ default build (lifecycle:
    - ⚠️ PARTIALLY VIOLATED: serving-side `s3s` references remain in ecstore
      (bucket metadata/replication/lifecycle DTOs and error mapping). The
      count is ratcheted shrink-only by `scripts/check_s3s_footprint.sh`
-     (`S3S_ECSTORE_FILES_BASELINE`; the `object_lock` module was converted to
+     (the `ecstore_files` line of `.config/s3s-footprint-baseline.txt`; the `object_lock` module was converted to
      storage-level types as the first ratchet step). Target state: the
      baseline reaches zero and ecstore's `Cargo.toml` drops `s3s`.
 

Cargo.lock

@@ -8507,6 +8507,15 @@ version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
+[[package]]
+name = "quick-xml"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.42.0"
@@ -9371,7 +9380,7 @@ dependencies = [
  "proptest",
  "prost 0.14.4",
  "pyroscope",
- "quick-xml",
+ "quick-xml 0.42.0",
  "quinn",
  "rand 0.10.3",
  "rcgen",
@@ -9390,6 +9399,7 @@ dependencies = [
  "rustfs-ecstore",
  "rustfs-extension-schema",
  "rustfs-filemeta",
+ "rustfs-gateway-types",
  "rustfs-heal",
  "rustfs-heal-contracts",
  "rustfs-iam",
@@ -9668,6 +9678,7 @@ dependencies = [
  "rustfs-data-usage",
  "rustfs-erasure-codec",
  "rustfs-filemeta",
+ "rustfs-gateway-types",
  "rustfs-heal-contracts",
  "rustfs-io-metrics",
  "rustfs-lifecycle",
@@ -9773,6 +9784,48 @@ dependencies = [
  "xxhash-rust",
 ]
 
+[[package]]
+name = "rustfs-gateway-stream"
+version = "0.2.0"
+source = "git+https://github.com/rustfs/gateway.git?rev=21283e874c2381bab611e9347acbc5b92e9e2b3c#21283e874c2381bab611e9347acbc5b92e9e2b3c"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytes",
+ "http 1.5.0",
+ "http-body",
+]
+
+[[package]]
+name = "rustfs-gateway-types"
+version = "0.32.0+aws.2026-10-02"
+source = "git+https://github.com/rustfs/gateway.git?rev=21283e874c2381bab611e9347acbc5b92e9e2b3c#21283e874c2381bab611e9347acbc5b92e9e2b3c"
+dependencies = [
+ "bytes",
+ "crc-fast",
+ "futures-core",
+ "hex",
+ "http 1.5.0",
+ "md-5 0.11.0",
+ "percent-encoding",
+ "rustfs-gateway-stream",
+ "rustfs-gateway-xml",
+ "s3s",
+ "sha1 0.11.0",
+ "sha2 0.11.1",
+ "time",
+ "twox-hash",
+ "unicode-normalization",
+ "zeroize",
+]
+
+[[package]]
+name = "rustfs-gateway-xml"
+version = "0.4.0"
+source = "git+https://github.com/rustfs/gateway.git?rev=21283e874c2381bab611e9347acbc5b92e9e2b3c#21283e874c2381bab611e9347acbc5b92e9e2b3c"
+dependencies = [
+ "quick-xml 0.41.0",
+]
+
 [[package]]
 name = "rustfs-heal"
 version = "1.0.2"
@@ -10043,10 +10096,10 @@ dependencies = [
  "metrics-util",
  "proptest",
  "rustfs-config",
+ "rustfs-gateway-types",
  "rustfs-replication",
  "rustfs-scanner-metrics",
  "rustfs-storage-api",
- "s3s",
  "serial_test",
  "temp-env",
  "time",
@@ -10109,7 +10162,6 @@ dependencies = [
  "reqwest",
  "rmp-serde",
  "rustfs-signer",
- "s3s",
  "serde",
  "serde_json",
  "sysinfo",
@@ -10149,7 +10201,7 @@ dependencies = [
  "jiff",
  "metrics",
  "percent-encoding",
- "quick-xml",
+ "quick-xml 0.42.0",
  "rayon",
  "rustc-hash",
  "rustfs-config",
@@ -10298,7 +10350,6 @@ dependencies = [
  "tokio",
  "tracing",
  "tracing-subscriber",
- "uuid",
 ]
 
 [[package]]
@@ -10331,10 +10382,13 @@ dependencies = [
  "rustfs-config",
  "rustfs-credentials",
  "rustfs-ecstore",
+ "rustfs-gateway-stream",
+ "rustfs-gateway-types",
  "rustfs-iam",
  "rustfs-keystone",
  "rustfs-policy",
  "rustfs-rio",
+ "rustfs-s3-types",
  "rustfs-storage-api",
  "rustfs-test-utils",
  "rustfs-tls-runtime",
@@ -10342,13 +10396,13 @@ dependencies = [
  "rustfs-trusted-proxies",
  "rustfs-utils",
  "rustls",
- "s3s",
  "serde",
  "serde_json",
  "sha1 0.11.0",
  "sha2 0.11.1",
  "socket2",
  "subtle",
+ "sync_wrapper",
  "tempfile",
  "thiserror 2.0.21",
  "time",
@@ -10398,7 +10452,7 @@ dependencies = [
  "regex",
  "rmp",
  "rmp-serde",
- "s3s",
+ "rustfs-gateway-types",
  "serde",
  "time",
  "tokio",
@@ -10493,11 +10547,13 @@ dependencies = [
  "hyper-util",
  "lazy_static",
  "md-5 0.11.0",
- "quick-xml",
+ "quick-xml 0.42.0",
  "rand 0.10.3",
  "rustfs-checksums",
  "rustfs-config",
+ "rustfs-gateway-types",
  "rustfs-rio",
+ "rustfs-s3-types",
  "rustfs-signer",
  "rustfs-storage-api",
  "rustfs-tls-runtime",
@@ -10531,9 +10587,19 @@ dependencies = [
 name = "rustfs-s3-types"
 version = "1.0.2"
 dependencies = [
+ "bytes",
+ "futures-core",
  "hotpath",
+ "http 1.5.0",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "s3s",
  "serde",
  "serde_json",
+ "tokio",
 ]
 
 [[package]]
@@ -10557,9 +10623,10 @@ dependencies = [
  "parking_lot 0.13.0",
  "rustfs-common",
  "rustfs-ecstore",
+ "rustfs-gateway-types",
+ "rustfs-s3-types",
  "rustfs-storage-api",
  "rustfs-test-utils",
- "s3s",
  "serde_json",
  "serial_test",
  "thiserror 2.0.21",
@@ -10585,7 +10652,6 @@ dependencies = [
  "parking_lot 0.13.0",
  "rustfs-s3select-api",
  "rustfs-test-utils",
- "s3s",
  "serde",
  "serde_json",
  "tokio",
@@ -10614,6 +10680,7 @@ dependencies = [
  "rustfs-data-usage",
  "rustfs-ecstore",
  "rustfs-filemeta",
+ "rustfs-gateway-types",
  "rustfs-heal",
  "rustfs-heal-contracts",
  "rustfs-lifecycle",
@@ -10670,9 +10737,10 @@ dependencies = [
  "bytes",
  "hotpath",
  "http 1.5.0",
+ "http-body",
  "hyper",
+ "rustfs-s3-types",
  "rustfs-utils",
- "s3s",
  "serde_urlencoded",
  "thiserror 2.0.21",
  "time",
@@ -10688,7 +10756,6 @@ dependencies = [
  "hotpath",
  "insta",
  "rustfs-filemeta",
- "rustfs-utils",
  "serde",
  "serde_json",
  "time",
@@ -10731,7 +10798,6 @@ dependencies = [
  "rustfs-utils",
  "rustls",
  "rustls-native-certs",
- "s3s",
  "serde",
  "serde_json",
  "sha2 0.11.1",
@@ -11123,7 +11189,7 @@ dependencies = [
  "numeric_cast",
  "phf 0.14.0",
  "pin-project-lite",
- "quick-xml",
+ "quick-xml 0.42.0",
  "regex",
  "s3s-multipart",
  "s3s-rfc2047",

Cargo.toml

@@ -48,7 +48,7 @@ members = [
     "crates/replication", # Replication contracts and wire formats
     "crates/concurrency", # Concurrency management for RustFS - timeout, locking, backpressure, and I/O scheduling
     "crates/s3-client", # S3 client for engine-side consumption of remote S3 endpoints (tiering, transition targets)
-    "crates/s3-types", # S3 event type definitions
+    "crates/s3-types", # S3 event and error type definitions
     "crates/s3-ops", # S3 operation definitions and mapping
     "crates/s3select-api", # S3 Select API interface
     "crates/s3select-query", # S3 Select query engine
@@ -142,6 +142,13 @@ rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.2" }
 rustfs-utils = { path = "crates/utils", version = "1.0.2" }
 rustfs-zip = { path = "./crates/zip", version = "1.0.2" }
 
+# The gateway's S3 types: the DTOs and persisted bucket-configuration codecs the
+# engine crates move onto from s3s (rustfs/backlog#2745). The one pin of the
+# gateway in this workspace; no crate may enable a `compat-s3s*` feature except
+# the s3s-facing edge of the rustfs binary.
+rustfs-gateway-types = { git = "https://github.com/rustfs/gateway.git", rev = "21283e874c2381bab611e9347acbc5b92e9e2b3c", version = "0.32.0", default-features = false }
+rustfs-gateway-stream = { git = "https://github.com/rustfs/gateway.git", rev = "21283e874c2381bab611e9347acbc5b92e9e2b3c", version = "0.2.0", default-features = false }
+
 # Async Runtime and Networking
 async-channel = "2.5.0"
 async_zip = { default-features = false, version = "0.0.19" }
@@ -324,6 +331,10 @@ rust-embed = { version = "8.13.0" }
 rustc-hash = { version = "2.1.3" }
 s3s = { git = "https://github.com/s3s-project/s3s", rev = "5761ddfe4c509fcac87e3b99fd5bd9e176b442c0", features = ["minio"] }
 s3s-sigv4 = { git = "https://github.com/s3s-project/s3s", rev = "5761ddfe4c509fcac87e3b99fd5bd9e176b442c0" }
+# The same s3s pin under the name the legacy edge of the gateway migration uses
+# (crates/s3-types, feature `compat-s3s`). Keep `rev` identical to `s3s` above.
+# DELETE BY T4.2 (rustfs/backlog#2784).
+legacy-s3s = { package = "s3s", git = "https://github.com/s3s-project/s3s", rev = "5761ddfe4c509fcac87e3b99fd5bd9e176b442c0", features = ["minio"] }
 serial_test = "4.0.1"
 shadow-rs = { default-features = false, version = "2.0.0" }
 siphasher = "1.0.4"
@@ -332,6 +343,7 @@ compact_str = "0.10.0"
 snap = "1.1.2"
 starshard = { version = "2.4.0" }
 strum = { version = "0.28.0" }
+sync_wrapper = "1.0.2"
 sysinfo = "0.39.6"
 temp-env = "0.3.6"
 tempfile = "3.27.0"

crates/concurrency/src/workers.rs

@@ -49,28 +49,12 @@ impl Workers {
 
     /// Acquire a worker slot, waiting until one becomes available.
     pub async fn take(&self) {
-        struct AcquireCancelGuard<'a> {
-            workers: &'a Workers,
-            completed: bool,
-        }
-        impl Drop for AcquireCancelGuard<'_> {
-            fn drop(&mut self) {
-                if !self.completed {
-                    self.workers.in_use.send_modify(|_| {});
-                }
-            }
-        }
-        let mut guard = AcquireCancelGuard {
-            workers: self,
-            completed: false,
-        };
         let permit = match self.semaphore.acquire().await {
             Ok(permit) => permit,
             // The semaphore is owned by `self` and never closed.
             Err(_) => unreachable!("worker semaphore is never closed"),
         };
         permit.forget(); // returned manually via give()
-        guard.completed = true;
         self.in_use.send_modify(|held| *held += 1);
         trace!(
             event = "worker_slot.acquire",
@@ -98,7 +82,6 @@ impl Workers {
         });
         if released {
             self.semaphore.add_permits(1);
-            self.in_use.send_modify(|_| {});
         }
         trace!(
             event = "worker_slot.release",
@@ -116,9 +99,7 @@ impl Workers {
     pub async fn wait(&self) {
         let mut rx = self.in_use.subscribe();
         // The sender is owned by `self`, so it outlives this borrow.
-        let _ = rx
-            .wait_for(|&held| held == 0 && self.semaphore.available_permits() == self.limit)
-            .await;
+        let _ = rx.wait_for(|&held| held == 0).await;
         debug!(
             event = "worker_slot.wait",
             component = "concurrency",
@@ -133,9 +114,7 @@ impl Workers {
 
     /// Return the current number of available worker slots.
     pub async fn available(&self) -> usize {
-        self.limit
-            .saturating_sub(*self.in_use.borrow())
-            .min(self.semaphore.available_permits())
+        self.limit.saturating_sub(*self.in_use.borrow())
     }
 }
 
@@ -238,36 +217,4 @@ mod tests {
         }
         assert_eq!(workers.available().await, 0);
     }
-
-    #[tokio::test]
-    async fn test_wait_does_not_complete_while_permit_is_in_transit_to_queued_taker() {
-        use std::future::Future;
-        use std::pin::pin;
-        use std::task::{Context, Poll, Waker};
-
-        let workers = Workers::new(1).unwrap();
-        workers.take().await;
-
-        let mut taker = pin!(workers.take());
-        let mut cx = Context::from_waker(Waker::noop());
-        assert!(matches!(taker.as_mut().poll(&mut cx), Poll::Pending));
-
-        let mut waiter = pin!(workers.wait());
-        assert!(matches!(waiter.as_mut().poll(&mut cx), Poll::Pending));
-
-        // Hand off the slot to the queued taker before `taker` is polled again.
-        workers.give().await;
-        assert_eq!(workers.available().await, 0);
-        assert!(
-            matches!(waiter.as_mut().poll(&mut cx), Poll::Pending),
-            "wait() must not complete while a permit is in transit to a woken taker"
-        );
-
-        assert!(matches!(taker.as_mut().poll(&mut cx), Poll::Ready(())));
-        assert!(matches!(waiter.as_mut().poll(&mut cx), Poll::Pending));
-
-        workers.give().await;
-        assert!(matches!(waiter.as_mut().poll(&mut cx), Poll::Ready(())));
-        assert_eq!(workers.available().await, 1);
-    }
 }

crates/e2e_test/README.md

@@ -200,8 +200,8 @@ python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run
 python3 scripts/e2e_binary.py run --binary "$RUSTFS_E2E_STARTUP_CAS_BINARY" --features e2e-test-hooks -- cargo nextest run --profile e2e-full -p e2e_test
 python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-nightly -p e2e_test
 
-# Distributed 4-node 4-disk lane includes physical-worker fault injection and
-# scanner_heal_topology_ cases; both require the fault-test hooks server.
+# Distributed 4-node 4-disk lane uses the fault-test hooks server; the
+# scanner_heal_topology_ fault cases fail closed without it.
 # Upgrade cases require RUSTFS_UPGRADE_SOURCE_BINARY and fail closed without it.
 python3 scripts/e2e_binary.py build --bins --features e2e-test-hooks
 python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-distributed -p e2e_test

crates/e2e_test/src/anonymous_access_test.rs

@@ -17,7 +17,8 @@
 //! when PublicAccessBlock configuration is missing or explicitly set.
 
 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
-use aws_sdk_s3::types::PublicAccessBlockConfiguration;
+use crate::sts_query_compat_test::{OPA_AUTH_TOKEN, OpaMock};
+use aws_sdk_s3::types::{PublicAccessBlockConfiguration, Tag, Tagging};
 use tracing::info;
 
 async fn setup_public_bucket(
@@ -69,6 +70,98 @@ async fn anonymous_get_object(
     local_http_client().get(&url).send().await
 }
 
+#[tokio::test]
+async fn test_plain_http_matches_secure_transport_false_bucket_policy() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+    assert!(env.url.starts_with("http://"), "fixture must exercise plaintext HTTP: {}", env.url);
+
+    let bucket = "secure-transport-policy";
+    let key = "plain-http.txt";
+    let admin = env.create_s3_client();
+    admin.create_bucket().bucket(bucket).send().await?;
+    admin
+        .put_object()
+        .bucket(bucket)
+        .key(key)
+        .body(aws_sdk_s3::primitives::ByteStream::from_static(b"plain http"))
+        .send()
+        .await?;
+    admin
+        .put_bucket_policy()
+        .bucket(bucket)
+        .policy(
+            serde_json::json!({
+                "Version": "2012-10-17",
+                "Statement": [{
+                    "Effect": "Allow",
+                    "Principal": "*",
+                    "Action": "s3:GetObject",
+                    "Resource": format!("arn:aws:s3:::{bucket}/*"),
+                    "Condition": {"Bool": {"aws:SecureTransport": "false"}}
+                }]
+            })
+            .to_string(),
+        )
+        .send()
+        .await?;
+
+    let response = anonymous_get_object(&env, bucket, key).await?;
+    assert_eq!(response.status().as_u16(), 200);
+    assert_eq!(response.bytes().await?.as_ref(), b"plain http");
+    Ok(())
+}
+
+/// Root credentials have no attached IAM policy, so these requests depend on
+/// the owner flag reaching policy evaluation unchanged.
+#[tokio::test]
+async fn test_root_requests_keep_policy_owner_flag() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let opa = OpaMock::start().await?;
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server_with_env(
+        vec![],
+        &[
+            ("RUSTFS_POLICY_PLUGIN_URL", opa.url.as_str()),
+            ("RUSTFS_POLICY_PLUGIN_AUTH_TOKEN", OPA_AUTH_TOKEN),
+        ],
+    )
+    .await?;
+
+    let bucket = "root-owner-flag";
+    let key = "owner.txt";
+    let client = env.create_s3_client();
+    client.create_bucket().bucket(bucket).send().await?;
+    client
+        .put_object()
+        .bucket(bucket)
+        .key(key)
+        .body(aws_sdk_s3::primitives::ByteStream::from_static(b"owner access"))
+        .send()
+        .await?;
+
+    // Duplicate stored tags are ambiguous. An owner request must not enter the
+    // OPA tag-loading path, which rejects this metadata before evaluation.
+    client
+        .put_bucket_tagging()
+        .bucket(bucket)
+        .tagging(
+            Tagging::builder()
+                .tag_set(Tag::builder().key("department").value("finance").build()?)
+                .tag_set(Tag::builder().key("department").value("engineering").build()?)
+                .build()?,
+        )
+        .send()
+        .await?;
+    let object = client.get_object().bucket(bucket).key(key).send().await?;
+
+    assert_eq!(object.body.collect().await?.into_bytes().as_ref(), b"owner access");
+    Ok(())
+}
+
 /// Issue #2036: Anonymous GetObject should succeed when bucket policy allows it
 /// and no PublicAccessBlock configuration exists (ConfigNotFound).
 #[tokio::test]

crates/e2e_test/src/distributed/artifact_delete_test.rs

@@ -1,378 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-#![cfg(unix)]
-
-use super::artifact_seal_test::{assert_exact_version, confirm_seal, create_artifact_attempt};
-use super::harness::{
-    DistCluster, DistLayout, TestResult, enable_versioning, payload_for, s3_probe_client, unique_bucket, wait_for_ready,
-};
-use crate::chaos::{VersionShardCensus, census_object_version_on_disk};
-use crate::common::init_logging;
-use aws_sdk_s3::error::ProvideErrorMetadata;
-use aws_sdk_s3::types::{Delete, ObjectIdentifier};
-use serde_json::json;
-use std::collections::{BTreeMap, BTreeSet};
-use std::os::unix::fs::MetadataExt;
-use std::path::{Path, PathBuf};
-use std::time::Duration;
-use tokio::time::timeout;
-
-const PUBLIC_INTERNAL_ERROR: &str = "We encountered an internal error, please try again.";
-
-#[derive(Debug, PartialEq, Eq)]
-pub(super) struct PhysicalEntry {
-    identity: (u64, u64),
-    changed: (i64, i64),
-    modified: (i64, i64),
-    bytes: Option<Vec<u8>>,
-}
-
-// Include directory identity/ctime as well as file bytes. Creating and removing
-// a temporary marker/rollback file cannot hide behind a restored final xl.meta.
-// Reads change atime, which is deliberately excluded.
-pub(super) fn physical_snapshot(dist: &DistCluster, bucket: &str) -> TestResult<BTreeMap<(usize, PathBuf), PhysicalEntry>> {
-    let mut snapshot = BTreeMap::new();
-    for (node, instance) in dist.cluster.nodes.iter().enumerate() {
-        let root = Path::new(&instance.data_dirs[0]).join(bucket);
-        for entry in walkdir::WalkDir::new(&root) {
-            let entry = entry?;
-            let metadata = std::fs::symlink_metadata(entry.path())?;
-            assert!(!metadata.file_type().is_symlink(), "unexpected fixture symlink");
-            snapshot.insert(
-                (node, entry.path().strip_prefix(&root)?.to_path_buf()),
-                PhysicalEntry {
-                    identity: (metadata.dev(), metadata.ino()),
-                    changed: (metadata.ctime(), metadata.ctime_nsec()),
-                    modified: (metadata.mtime(), metadata.mtime_nsec()),
-                    bytes: if metadata.is_dir() {
-                        None
-                    } else {
-                        Some(std::fs::read(entry.path())?)
-                    },
-                },
-            );
-        }
-    }
-    Ok(snapshot)
-}
-
-struct Version {
-    key: String,
-    id: String,
-    body: Vec<u8>,
-    manifests: Vec<VersionShardCensus>,
-}
-
-impl Version {
-    async fn put(dist: &DistCluster, bucket: &str, key: &str, seed: &str) -> TestResult<Self> {
-        let body = payload_for(seed, 2 * 1024 * 1024);
-        let output = timeout(
-            Duration::from_secs(30),
-            dist.client(1)?
-                .put_object()
-                .bucket(bucket)
-                .key(key)
-                .body(body.clone().into())
-                .send(),
-        )
-        .await??;
-        let id = output.version_id().ok_or("fixture PUT omitted version ID")?.to_owned();
-        let manifests = dist
-            .cluster
-            .nodes
-            .iter()
-            .map(|node| census_object_version_on_disk(Path::new(&node.data_dirs[0]), bucket, key, Some(&id)))
-            .collect::<TestResult<Vec<_>>>()?;
-        assert!(
-            manifests
-                .iter()
-                .all(|manifest| manifest.is_complete() && !manifest.expected_part_numbers.is_empty())
-        );
-        Ok(Self {
-            key: key.to_owned(),
-            id,
-            body,
-            manifests,
-        })
-    }
-}
-
-fn target(key: &str, version: Option<&str>) -> TestResult<ObjectIdentifier> {
-    Ok(ObjectIdentifier::builder()
-        .key(key)
-        .set_version_id(version.map(str::to_owned))
-        .build()?)
-}
-
-async fn assert_fixture(
-    dist: &DistCluster,
-    bucket: &str,
-    prefix: &str,
-    versions: &[Version],
-    marker: (&str, &str),
-) -> TestResult {
-    let expected: BTreeSet<_> = versions
-        .iter()
-        .map(|version| (version.key.clone(), version.id.clone()))
-        .collect();
-    for node in 0..dist.cluster.nodes.len() {
-        let client = dist.client(node)?;
-        let listed = timeout(
-            Duration::from_secs(30),
-            client.list_object_versions().bucket(bucket).prefix(prefix).send(),
-        )
-        .await??;
-        let actual: BTreeSet<_> = listed
-            .versions()
-            .iter()
-            .map(|version| {
-                (
-                    version.key().unwrap_or_default().to_owned(),
-                    version.version_id().unwrap_or_default().to_owned(),
-                )
-            })
-            .collect();
-        assert_eq!(listed.versions().len(), versions.len());
-        assert_eq!(actual, expected, "delete changed exact data versions on node {node}");
-        assert_eq!(listed.delete_markers().len(), 1);
-        assert_eq!(listed.delete_markers()[0].key(), Some(marker.0));
-        assert_eq!(listed.delete_markers()[0].version_id(), Some(marker.1));
-        assert_eq!(listed.delete_markers()[0].is_latest(), Some(true));
-        for version in versions {
-            assert_exact_version(&client, bucket, &version.key, &version.id, &version.body).await?;
-            let disk = Path::new(&dist.cluster.nodes[node].data_dirs[0]);
-            assert!(
-                census_object_version_on_disk(disk, bucket, &version.key, Some(&version.id))?
-                    .matches_manifest(&version.manifests[node])
-            );
-        }
-    }
-    Ok(())
-}
-
-async fn assert_single_denied(dist: &DistCluster, node: usize, bucket: &str, key: &str, version: Option<&str>) -> TestResult {
-    let before = physical_snapshot(dist, bucket)?;
-    // One attempt: a later retry must not conceal a first local mutation.
-    let client = s3_probe_client(&dist.client(node)?);
-    let error = timeout(
-        Duration::from_secs(30),
-        client
-            .delete_object()
-            .bucket(bucket)
-            .key(key)
-            .set_version_id(version.map(str::to_owned))
-            .send(),
-    )
-    .await?
-    .expect_err("ordinary deletion succeeded in a managed bucket");
-    let service = error
-        .as_service_error()
-        .ok_or("delete failed without an S3 service rejection")?;
-    assert_eq!(error.raw_response().map(|response| response.status().as_u16()), Some(500));
-    assert_eq!(service.code(), Some("InternalError"));
-    assert_eq!(service.message(), Some(PUBLIC_INTERNAL_ERROR));
-    assert!(
-        physical_snapshot(dist, bucket)? == before,
-        "first delete through node {node} wrote or rolled back managed data"
-    );
-    Ok(())
-}
-
-async fn assert_batch_denied(dist: &DistCluster, node: usize, bucket: &str, objects: &[ObjectIdentifier]) -> TestResult {
-    let before = physical_snapshot(dist, bucket)?;
-    let client = s3_probe_client(&dist.client(node)?);
-    let response = timeout(
-        Duration::from_secs(30),
-        client
-            .delete_objects()
-            .bucket(bucket)
-            .delete(Delete::builder().set_objects(Some(objects.to_vec())).quiet(false).build()?)
-            .send(),
-    )
-    .await??;
-    assert!(response.deleted().is_empty(), "managed batch reported a successful delete");
-    assert_eq!(response.errors().len(), objects.len(), "batch must reject every requested occurrence");
-    for (error, requested) in response.errors().iter().zip(objects) {
-        assert_eq!(error.key(), Some(requested.key()));
-        assert_eq!(error.version_id(), requested.version_id());
-        assert_eq!(error.code(), Some("InternalError"));
-        assert_eq!(error.message(), Some(PUBLIC_INTERNAL_ERROR));
-    }
-    assert!(
-        physical_snapshot(dist, bucket)? == before,
-        "first batch through node {node} wrote or rolled back managed data"
-    );
-    Ok(())
-}
-
-fn copy_existing_object(source: &Path, destination: &Path) -> TestResult {
-    assert!(!destination.exists());
-    for entry in walkdir::WalkDir::new(source) {
-        let entry = entry?;
-        let target = destination.join(entry.path().strip_prefix(source)?);
-        if entry.file_type().is_dir() {
-            std::fs::create_dir_all(&target)?;
-        } else {
-            assert!(entry.file_type().is_file());
-            std::fs::copy(entry.path(), target)?;
-        }
-    }
-    Ok(())
-}
-
-async fn ordinary_delete_control(dist: &DistCluster, bucket: &str) -> TestResult {
-    let client = s3_probe_client(&dist.client(0)?);
-    let key = "ordinary-observer-control.bin";
-    let version = Version::put(dist, bucket, key, key).await?;
-    let before = physical_snapshot(dist, bucket)?;
-    let deleted = client.delete_object().bucket(bucket).key(key).send().await?;
-    assert_eq!(deleted.delete_marker(), Some(true));
-    let marker = deleted.version_id().ok_or("ordinary delete omitted marker ID")?;
-    assert!(
-        physical_snapshot(dist, bucket)? != before,
-        "physical observer missed real marker creation"
-    );
-    client
-        .delete_object()
-        .bucket(bucket)
-        .key(key)
-        .version_id(marker)
-        .send()
-        .await?;
-    // The logical version inventory is restored, but ctime/identity still
-    // expose the two writes. This checks the observer used by managed negatives.
-    let listed = client.list_object_versions().bucket(bucket).prefix(key).send().await?;
-    assert_eq!(listed.versions().len(), 1);
-    assert_eq!(listed.versions()[0].version_id(), Some(version.id.as_str()));
-    assert!(listed.delete_markers().is_empty());
-    assert!(
-        physical_snapshot(dist, bucket)? != before,
-        "marker round-trip hid transient physical writes"
-    );
-    assert_exact_version(&client, bucket, key, &version.id, &version.body).await?;
-    client
-        .delete_object()
-        .bucket(bucket)
-        .key(key)
-        .version_id(&version.id)
-        .send()
-        .await?;
-    assert!(
-        client
-            .list_object_versions()
-            .bucket(bucket)
-            .prefix(key)
-            .send()
-            .await?
-            .versions()
-            .is_empty()
-    );
-
-    let current = Version::put(dist, bucket, "ordinary-batch-current.bin", "current").await?;
-    let exact = Version::put(dist, bucket, "ordinary-batch-exact.bin", "exact").await?;
-    let response = client
-        .delete_objects()
-        .bucket(bucket)
-        .delete(
-            Delete::builder()
-                .objects(target(&current.key, None)?)
-                .objects(target(&exact.key, Some(&exact.id))?)
-                .objects(target(&exact.key, Some(&exact.id))?)
-                .build()?,
-        )
-        .send()
-        .await?;
-    assert!(response.errors().is_empty());
-    assert_eq!(response.deleted().len(), 3);
-    let listed = client
-        .list_object_versions()
-        .bucket(bucket)
-        .prefix(&current.key)
-        .send()
-        .await?;
-    assert_eq!(listed.versions().len(), 1);
-    assert_eq!(listed.delete_markers().len(), 1);
-    assert!(
-        client
-            .list_object_versions()
-            .bucket(bucket)
-            .prefix(&exact.key)
-            .send()
-            .await?
-            .versions()
-            .is_empty()
-    );
-    Ok(())
-}
-
-#[tokio::test]
-async fn four_node_artifact_delete_entrypoints_preserve_versions_and_physical_state() -> TestResult {
-    init_logging();
-    let mut dist = DistCluster::start(DistLayout::FourNodeFourDisk).await?;
-    let (identity, admin) = create_artifact_attempt(&dist).await?;
-    let bucket = identity["bucket"]
-        .as_str()
-        .ok_or("managed receipt omitted bucket")?
-        .to_owned();
-    let prefix = identity["attempt_prefix"]
-        .as_str()
-        .ok_or("managed receipt omitted prefix")?
-        .to_owned();
-    let key = format!("{prefix}native.bin");
-    let mut versions = vec![
-        Version::put(&dist, &bucket, &key, "native-old").await?,
-        Version::put(&dist, &bucket, &key, "native-new").await?,
-    ];
-    let ordinary = unique_bucket("delete-control");
-    dist.create_bucket(&ordinary).await?;
-    enable_versioning(&dist.client(0)?, &ordinary).await?;
-
-    // A new managed bucket cannot legitimately create a marker. Model existing
-    // persisted state from before adoption/upgrade using a real S3-generated
-    // ordinary object+marker, copied disk-for-disk in the same erasure set.
-    // Only this object's files move; bucket authority/configuration is untouched.
-    let marker_key = format!("{prefix}existing-marker.bin");
-    versions.push(Version::put(&dist, &ordinary, &marker_key, "existing-data").await?);
-    let output = dist
-        .client(2)?
-        .delete_object()
-        .bucket(&ordinary)
-        .key(&marker_key)
-        .send()
-        .await?;
-    assert_eq!(output.delete_marker(), Some(true));
-    let marker = output.version_id().ok_or("ordinary fixture omitted marker ID")?.to_owned();
-    dist.cluster.stop();
-    for node in &dist.cluster.nodes {
-        let disk = Path::new(&node.data_dirs[0]);
-        copy_existing_object(&disk.join(&ordinary).join(&marker_key), &disk.join(&bucket).join(&marker_key))?;
-    }
-    dist.cluster.start().await?;
-    wait_for_ready(&dist.cluster).await?;
-    assert_fixture(&dist, &bucket, &prefix, &versions, (&marker_key, &marker)).await?;
-    ordinary_delete_control(&dist, &ordinary).await?;
-    let batch = vec![
-        target(&key, None)?,
-        target(&key, Some(&versions[0].id))?,
-        target(&key, Some(&versions[1].id))?,
-        target(&marker_key, Some(&marker))?,
-        target(&key, Some(&versions[0].id))?,
-        target(&marker_key, Some(&versions[2].id))?,
-    ];
-    for phase in ["open", "sealed", "restarted"] {
-        if phase == "sealed" {
-            confirm_seal(&dist, &admin, &json!({"version": 1, "target": identity}).to_string(), &identity).await?;
-        } else if phase == "restarted" {
-            dist.restart_with_current_binary().await?;
-        }
-        for node in 0..dist.cluster.nodes.len() {
-            assert_single_denied(&dist, node, &bucket, &key, None).await?;
-            assert_single_denied(&dist, node, &bucket, &key, Some(&versions[0].id)).await?;
-            assert_single_denied(&dist, node, &bucket, &marker_key, Some(&marker)).await?;
-            assert_batch_denied(&dist, node, &bucket, &batch).await?;
-        }
-        assert_fixture(&dist, &bucket, &prefix, &versions, (&marker_key, &marker)).await?;
-    }
-    Ok(())
-}

crates/e2e_test/src/distributed/artifact_inventory_test.rs

@@ -1,434 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-#![cfg(unix)]
-
-use super::artifact_delete_test::physical_snapshot;
-use super::artifact_seal_test::{ArtifactAdmin, create_artifact_attempt};
-use super::harness::{DistCluster, DistLayout, TestResult, wait_for_ready};
-use crate::common::{
-    AdminTransport, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via, init_logging,
-    signed_s3_request,
-};
-use futures::{StreamExt as _, TryStreamExt as _};
-use http::{Method, StatusCode};
-use serde::Deserialize;
-use serde_json::{Value, json};
-use std::{collections::BTreeSet, time::Duration};
-use tokio::time::timeout;
-use uuid::Uuid;
-
-const ROUTE: &str = "/rustfs/admin/v3/plugin-artifacts/inventory";
-const BUDGET: Duration = Duration::from_secs(45);
-
-struct Reader {
-    access: String,
-    secret: String,
-}
-
-impl Reader {
-    async fn create(dist: &DistCluster, target: &Value, action: &str) -> TestResult<Self> {
-        let reader = Self {
-            access: format!("inventory{}", &Uuid::new_v4().simple().to_string()[..12]),
-            secret: Uuid::new_v4().simple().to_string(),
-        };
-        let policy_name = format!("inventory{}", &Uuid::new_v4().simple().to_string()[..12]);
-        let bucket = target["bucket"].as_str().ok_or("target bucket")?;
-        let prefix = target["attempt_prefix"]
-            .as_str()
-            .ok_or("target prefix")?
-            .trim_end_matches('/');
-        let resource = if action == "s3:ListBucket" {
-            format!("arn:aws:s3:::{bucket}")
-        } else {
-            format!("arn:aws:s3:::{bucket}/{prefix}")
-        };
-        let policy =
-            json!({"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":action,"Resource":resource}]}).to_string();
-        let url = &dist.cluster.nodes[0].url;
-        let access = &dist.cluster.access_key;
-        let secret = &dist.cluster.secret_key;
-        admin_create_user_via(AdminTransport::Signed, url, access, secret, &reader.access, &reader.secret).await?;
-        admin_add_canned_policy_via(AdminTransport::Signed, url, access, secret, &policy_name, &policy).await?;
-        admin_attach_user_policy_via(AdminTransport::Signed, url, access, secret, &policy_name, &reader.access).await?;
-        Ok(reader)
-    }
-
-    async fn request(&self, dist: &DistCluster, target: &Value, invocation: Uuid) -> TestResult<reqwest::Response> {
-        timeout(
-            BUDGET,
-            signed_s3_request(
-                Method::POST,
-                &format!("{}{ROUTE}", dist.cluster.nodes[0].url),
-                Some(json!({"version":1,"invocation_id":invocation,"target":target}).to_string()),
-                Some("application/json"),
-                &self.access,
-                &self.secret,
-            ),
-        )
-        .await?
-    }
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Frame {
-    version: u32,
-    invocation_id: Uuid,
-    target: Value,
-    sequence: u64,
-    payload: Payload,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
-enum Payload {
-    Observation {
-        disk_id: Uuid,
-        key: String,
-        version_id: Uuid,
-        delete_marker: bool,
-    },
-    Complete {
-        members: usize,
-        observations: u64,
-    },
-}
-
-async fn read_frames(mut response: reqwest::Response) -> TestResult<(Vec<Frame>, bool)> {
-    let mut pending = Vec::new();
-    let mut frames = Vec::new();
-    let mut clean = true;
-    loop {
-        match timeout(BUDGET, response.chunk()).await? {
-            Ok(Some(chunk)) => {
-                pending.extend_from_slice(&chunk);
-                while let Some(end) = pending.iter().position(|byte| *byte == b'\n') {
-                    assert!(end < 1024 * 1024, "HTTP inventory line exceeds encoded bound");
-                    let line: Vec<_> = pending.drain(..=end).collect();
-                    frames.push(serde_json::from_slice(&line[..end])?);
-                }
-                assert!(pending.len() < 1024 * 1024, "unbounded incomplete HTTP line");
-            }
-            Ok(None) => break,
-            Err(_) => {
-                clean = false;
-                break;
-            }
-        }
-    }
-    Ok((frames, clean && pending.is_empty()))
-}
-
-async fn seal(dist: &DistCluster, user: &ArtifactAdmin, target: &Value) -> TestResult {
-    let (status, body) = user
-        .request(
-            dist,
-            0,
-            "/rustfs/admin/v3/plugin-artifacts/seal-writes",
-            json!({"version":1,"target":target}).to_string(),
-        )
-        .await?;
-    assert_eq!(status, StatusCode::OK, "actual all-member closure: {body}");
-    assert_eq!(serde_json::from_str::<Value>(&body)?["all_writes_sealed"], true);
-    Ok(())
-}
-
-fn exact_inventory(frames: &[Frame], target: &Value, invocation: Uuid, versions: &BTreeSet<(String, Uuid, bool)>) {
-    let mut observed = BTreeSet::new();
-    let mut disks = BTreeSet::new();
-    let mut count = 0u64;
-    for (sequence, frame) in frames.iter().enumerate() {
-        assert_eq!(frame.version, 1);
-        assert_eq!(frame.invocation_id, invocation);
-        assert_eq!(&frame.target, target);
-        assert_eq!(frame.sequence, u64::try_from(sequence).expect("bounded fixture sequence"));
-        match &frame.payload {
-            Payload::Observation {
-                disk_id,
-                key,
-                version_id,
-                delete_marker,
-            } => {
-                assert!(!disk_id.is_nil() && !version_id.is_nil());
-                assert!(
-                    observed.insert((*disk_id, key.clone(), *version_id, *delete_marker)),
-                    "duplicate physical observation"
-                );
-                disks.insert(*disk_id);
-                count += 1;
-            }
-            Payload::Complete { members, observations } => {
-                assert_eq!(sequence + 1, frames.len(), "Complete must be the last HTTP frame");
-                assert_eq!(*members, 4);
-                assert_eq!(*observations, count);
-            }
-        }
-    }
-    assert!(
-        matches!(frames.last().map(|frame| &frame.payload), Some(Payload::Complete { .. })),
-        "A03I3A_HTTP_COMPLETE"
-    );
-    if !versions.is_empty() {
-        assert_eq!(disks.len(), 4);
-    }
-    for disk in disks {
-        let actual: BTreeSet<_> = observed
-            .iter()
-            .filter(|(id, ..)| *id == disk)
-            .map(|(_, key, version, marker)| (key.clone(), *version, *marker))
-            .collect();
-        assert_eq!(&actual, versions, "A03I3A_EXACT_VERSIONS");
-    }
-    assert_eq!(observed.len(), versions.len() * 4);
-}
-
-#[tokio::test]
-async fn artifact_inventory_http_exact_versions() -> TestResult {
-    crate::common::rustfs_binary_path_with_features(Some("e2e-test-hooks"));
-    init_logging();
-    let dist = DistCluster::start(DistLayout::FourNodeFourDisk).await?;
-    let (target, admin) = create_artifact_attempt(&dist).await?;
-    let bucket = target["bucket"].as_str().ok_or("bucket")?;
-    let prefix = target["attempt_prefix"].as_str().ok_or("prefix")?;
-    let mut versions = BTreeSet::new();
-    for (name, body) in [
-        ("same", b"first".to_vec()),
-        ("same", b"second".to_vec()),
-        ("zero", Vec::new()),
-    ] {
-        let key = format!("{prefix}{name}");
-        let output = timeout(BUDGET, dist.client(1)?.put_object().bucket(bucket).key(&key).body(body.into()).send()).await??;
-        let version = Uuid::parse_str(output.version_id().ok_or("actual PUT version")?)?;
-        versions.insert((key, version, false));
-    }
-    seal(&dist, &admin, &target).await?;
-    // A wildcard action is still restricted to this exact attempt resource.
-    // The separate authority case exercises the dedicated action alone.
-    let reader = Reader::create(&dist, &target, "admin:*").await?;
-    let before = physical_snapshot(&dist, bucket)?;
-    let invocation = Uuid::new_v4();
-    let response = reader.request(&dist, &target, invocation).await?;
-    assert_eq!(response.status(), StatusCode::OK, "A03I3A_HTTP_ROUTE");
-    assert_eq!(
-        response.headers().get("content-type").and_then(|value| value.to_str().ok()),
-        Some("application/x-ndjson")
-    );
-    let (frames, clean) = read_frames(response).await?;
-    assert!(clean, "Complete requires clean HTTP EOF");
-    assert!(frames.len() > 2, "real multi-frame HTTP body");
-    exact_inventory(&frames, &target, invocation, &versions);
-    assert!(
-        before == physical_snapshot(&dist, bucket)?,
-        "inventory mutated physical artifact namespace"
-    );
-    let (empty, empty_admin) = create_artifact_attempt(&dist).await?;
-    seal(&dist, &empty_admin, &empty).await?;
-    let empty_reader = Reader::create(&dist, &empty, "admin:*").await?;
-    let invocation = Uuid::new_v4();
-    let response = empty_reader.request(&dist, &empty, invocation).await?;
-    assert_eq!(response.status(), StatusCode::OK);
-    let (frames, clean) = read_frames(response).await?;
-    assert!(clean);
-    exact_inventory(&frames, &empty, invocation, &BTreeSet::new());
-    Ok(())
-}
-
-#[tokio::test]
-async fn artifact_inventory_http_scoped_authority() -> TestResult {
-    crate::common::rustfs_binary_path_with_features(Some("e2e-test-hooks"));
-    init_logging();
-    let dist = DistCluster::start(DistLayout::FourNodeFourDisk).await?;
-    let (target, admin) = create_artifact_attempt(&dist).await?;
-    seal(&dist, &admin, &target).await?;
-    let reader = Reader::create(&dist, &target, "admin:InventoryPluginArtifactAttempt").await?;
-    let invocation = Uuid::new_v4();
-    let response = reader.request(&dist, &target, invocation).await?;
-    assert_eq!(response.status(), StatusCode::OK, "dedicated inventory authority");
-    let (frames, clean) = read_frames(response).await?;
-    assert!(clean);
-    exact_inventory(&frames, &target, invocation, &BTreeSet::new());
-    let mut other_prefix = target.clone();
-    other_prefix["attempt_prefix"] = json!(format!("outputs/6169/{}/{}/", Uuid::new_v4(), Uuid::new_v4()));
-    let mut other_bucket = target.clone();
-    other_bucket["bucket"] = json!("another-artifact-bucket");
-    for denied in [&other_prefix, &other_bucket] {
-        assert_eq!(
-            reader.request(&dist, denied, Uuid::new_v4()).await?.status(),
-            StatusCode::FORBIDDEN,
-            "A03I3A_SCOPED_AUTHORITY"
-        );
-    }
-    let (status, _) = admin
-        .request(
-            &dist,
-            0,
-            ROUTE,
-            json!({"version":1,"invocation_id":Uuid::new_v4(),"target":target}).to_string(),
-        )
-        .await?;
-    assert_eq!(status, StatusCode::FORBIDDEN, "A03I3A_SCOPED_AUTHORITY seal-only user");
-    let listed = Reader::create(&dist, &target, "s3:ListBucket").await?;
-    dist.client_with_credentials(0, &listed.access, &listed.secret)?
-        .list_objects_v2()
-        .bucket(target["bucket"].as_str().ok_or("bucket")?)
-        .send()
-        .await?;
-    assert_eq!(
-        listed.request(&dist, &target, Uuid::new_v4()).await?.status(),
-        StatusCode::FORBIDDEN,
-        "A03I3A_SCOPED_AUTHORITY S3 list-only user"
-    );
-    let root_response = signed_s3_request(
-        Method::POST,
-        &format!("{}{ROUTE}", dist.cluster.nodes[0].url),
-        Some(json!({"version":1,"invocation_id":Uuid::new_v4(),"target":target}).to_string()),
-        Some("application/json"),
-        &dist.cluster.access_key,
-        &dist.cluster.secret_key,
-    )
-    .await?;
-    assert_eq!(root_response.status(), StatusCode::FORBIDDEN, "original scoped user required");
-    for body in [
-        json!({"version":1,"invocation_id":Uuid::nil(),"target":target}),
-        json!({"version":1,"invocation_id":Uuid::new_v4(),"target":target,"extra":true}),
-    ] {
-        let response = signed_s3_request(
-            Method::POST,
-            &format!("{}{ROUTE}", dist.cluster.nodes[0].url),
-            Some(body.to_string()),
-            Some("application/json"),
-            &reader.access,
-            &reader.secret,
-        )
-        .await?;
-        assert_eq!(response.status(), StatusCode::BAD_REQUEST, "strict inventory request");
-    }
-    Ok(())
-}
-
-async fn assert_incomplete(response: reqwest::Response) -> TestResult<Vec<Frame>> {
-    assert_eq!(
-        response.status(),
-        StatusCode::OK,
-        "valid request must exercise the streaming failure boundary"
-    );
-    let (frames, _) = read_frames(response).await?;
-    assert!(
-        !frames.iter().any(|frame| matches!(frame.payload, Payload::Complete { .. })),
-        "A03I3A_NO_FALSE_COMPLETE"
-    );
-    Ok(frames)
-}
-
-#[tokio::test]
-async fn artifact_inventory_http_incomplete_has_no_terminal() -> TestResult {
-    crate::common::rustfs_binary_path_with_features(Some("e2e-test-hooks"));
-    init_logging();
-    let mut dist = DistCluster::start(DistLayout::FourNodeFourDisk).await?;
-    let (target, admin) = create_artifact_attempt(&dist).await?;
-    let bucket = target["bucket"].as_str().ok_or("bucket")?;
-    let prefix = target["attempt_prefix"].as_str().ok_or("prefix")?;
-    // Real PUTs produce more data than a stalled HTTP/2 flow-control window.
-    futures::stream::iter(0..256)
-        .map(|index| {
-            let client = dist.client(1);
-            let key = format!("{prefix}slow/{index:04}/{}/{}", "a".repeat(190), "b".repeat(190));
-            async move {
-                let output = client?
-                    .put_object()
-                    .bucket(bucket)
-                    .key(key)
-                    .body(vec![1].into())
-                    .send()
-                    .await?;
-                assert!(!Uuid::parse_str(output.version_id().ok_or("actual PUT version")?)?.is_nil());
-                Ok::<_, Box<dyn std::error::Error + Send + Sync>>(())
-            }
-        })
-        .buffer_unordered(8)
-        .try_collect::<Vec<_>>()
-        .await?;
-    seal(&dist, &admin, &target).await?;
-    let reader = Reader::create(&dist, &target, "admin:InventoryPluginArtifactAttempt").await?;
-    dist.cluster.stop_node(3)?;
-    assert_incomplete(reader.request(&dist, &target, Uuid::new_v4()).await?).await?;
-    dist.cluster.start_node(3).await?;
-    wait_for_ready(&dist.cluster).await?;
-    let mut wrong = target.clone();
-    wrong["bucket_incarnation"] = json!(Uuid::new_v4());
-    assert_incomplete(reader.request(&dist, &wrong, Uuid::new_v4()).await?).await?;
-    // The configured endpoint map is ordered. Damage its final receiver, so
-    // earlier real observations are emitted before the physical scan fails.
-    let node = dist
-        .cluster
-        .nodes
-        .iter()
-        .max_by_key(|node| format!("{}{}", node.url, node.data_dirs[0]))
-        .ok_or("configured members")?;
-    let metadata = std::path::Path::new(&node.data_dirs[0])
-        .join(bucket)
-        .join(format!("{prefix}slow/0000/{}/{}", "a".repeat(190), "b".repeat(190)))
-        .join("xl.meta");
-    let original = std::fs::read(&metadata)?;
-    std::fs::write(&metadata, b"corrupt inventory metadata")?;
-    let before = physical_snapshot(&dist, bucket)?;
-    let outcome = assert_incomplete(reader.request(&dist, &target, Uuid::new_v4()).await?).await;
-    let after = physical_snapshot(&dist, bucket)?;
-    std::fs::write(&metadata, original)?;
-    let frames = outcome?;
-    assert!(before == after, "failed inventory repaired or mutated a physical object");
-    assert!(
-        frames
-            .iter()
-            .any(|frame| matches!(frame.payload, Payload::Observation { .. })),
-        "late physical failure must follow real HTTP observations"
-    );
-    let client = reqwest::Client::builder()
-        .no_proxy()
-        .http2_prior_knowledge()
-        .http2_initial_stream_window_size(1)
-        .http2_initial_connection_window_size(1)
-        .http2_adaptive_window(false)
-        .build()?;
-    let url = format!("{}{ROUTE}", dist.cluster.nodes[0].url);
-    let request = |invocation| {
-        json!({"version":1,"invocation_id":invocation,"target":target})
-            .to_string()
-            .into_bytes()
-    };
-    let response = crate::common::signed_request_with_client(
-        &client,
-        Method::POST,
-        &url,
-        &reader.access,
-        &reader.secret,
-        Some(request(Uuid::new_v4())),
-        Some("application/json"),
-    )
-    .await?;
-    assert_eq!(response.status(), StatusCode::OK);
-    // Do not poll the body: its one-byte HTTP/2 receive window stalls transport.
-    // This waits beyond the fixed30s service budget, not for readiness.
-    tokio::time::sleep(Duration::from_secs(35)).await;
-    assert_incomplete(response).await?;
-    let response = crate::common::signed_request_with_client(
-        &client,
-        Method::POST,
-        &url,
-        &reader.access,
-        &reader.secret,
-        Some(request(Uuid::new_v4())),
-        Some("application/json"),
-    )
-    .await?;
-    assert_eq!(response.status(), StatusCode::OK);
-    drop(response);
-    let response = timeout(Duration::from_secs(10), reader.request(&dist, &target, Uuid::new_v4())).await??;
-    let (frames, clean) = timeout(Duration::from_secs(10), read_frames(response)).await??;
-    assert!(
-        clean && matches!(frames.last().map(|frame| &frame.payload), Some(Payload::Complete { .. })),
-        "fresh scan must succeed promptly after an actual disconnected HTTP body"
-    );
-    Ok(())
-}

crates/e2e_test/src/distributed/artifact_put_tail_test.rs

@@ -1,269 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-use super::artifact_repair_tail_test::PhysicalBarrier;
-use super::artifact_seal_test::{assert_exact_version, confirm_seal, create_artifact_attempt};
-use super::harness::{DistCluster, DistLayout, TestResult, payload_for, wait_until};
-use crate::chaos::census_object_version_on_disk;
-use crate::common::init_logging;
-use crate::storage_api::artifact_rpc::{
-    DiskError, TONIC_RPC_PREFIX, gen_tonic_signature_headers, set_tonic_canonical_body_digest,
-};
-use http::StatusCode;
-use rustfs_filemeta::FileMeta;
-use rustfs_protos::proto_gen::node_service::{RenameDataRequest, node_service_client::NodeServiceClient};
-use serde_json::{Value, json};
-use std::collections::BTreeMap;
-use std::path::{Path, PathBuf};
-use std::time::Duration;
-use tokio::time::timeout;
-use tonic::Request;
-use uuid::Uuid;
-
-const PUT_SEAL_ROUTE: &str = "/rustfs/admin/v3/plugin-artifacts/seal-attempt";
-
-fn signed_put_request(body: RenameDataRequest, audience: &str) -> TestResult<Request<RenameDataRequest>> {
-    let canonical = rustfs_protos::canonical_artifact_rename_data_request_body(&body)?;
-    let mut request = Request::new(body);
-    request.set_timeout(Duration::from_secs(15));
-    set_tonic_canonical_body_digest(&mut request, &canonical)?;
-    let digest = request
-        .metadata()
-        .get("x-rustfs-content-sha256")
-        .ok_or("missing canonical digest")?
-        .to_str()?
-        .to_owned();
-    request.metadata_mut().as_mut().extend(gen_tonic_signature_headers(
-        audience,
-        TONIC_RPC_PREFIX.trim_start_matches('/'),
-        "ArtifactRenameData",
-        Some(&digest),
-    )?);
-    Ok(request)
-}
-
-fn publication_snapshot(paths: &[&Path]) -> TestResult<BTreeMap<PathBuf, Option<Vec<u8>>>> {
-    let mut snapshot = BTreeMap::new();
-    for root in paths {
-        for entry in walkdir::WalkDir::new(root) {
-            let entry = entry?;
-            let contents = if entry.file_type().is_dir() {
-                None
-            } else {
-                Some(std::fs::read(entry.path())?)
-            };
-            snapshot.insert(entry.path().to_path_buf(), contents);
-        }
-    }
-    Ok(snapshot)
-}
-
-async fn assert_raw_put_closed(body: &RenameDataRequest, url: &str, audience: &str, paths: &[&Path]) -> TestResult {
-    let before = publication_snapshot(paths)?;
-    // Re-sign the exact original request; replay protection is not the rejection.
-    let request = signed_put_request(body.clone(), audience)?;
-    let response = timeout(Duration::from_secs(20), async {
-        let mut client = NodeServiceClient::connect(url.to_owned()).await?;
-        Ok::<_, Box<dyn std::error::Error + Send + Sync>>(client.artifact_rename_data(request).await?.into_inner())
-    })
-    .await??;
-    assert!(!response.success, "sealed attempt admitted another ordinary PUT");
-    let error = response.error.ok_or("rejected raw PUT omitted error")?;
-    assert_eq!(error.code, DiskError::Io(std::io::ErrorKind::PermissionDenied.into()).to_u32());
-    assert_eq!(error.error_info, "io error artifact attempt mutation domain is closed");
-    assert_eq!(publication_snapshot(paths)?, before, "rejected raw PUT mutated staged or published files");
-    Ok(())
-}
-
-#[tokio::test]
-async fn four_node_artifact_put_seal_waits_for_disconnected_physical_tail() -> TestResult {
-    crate::common::rustfs_binary_path_with_features(Some("e2e-test-hooks"));
-    init_logging();
-    let _ = rustfs_credentials::set_global_rpc_secret("rustfs-internode-signature-e2e-secret".to_owned());
-    let rpc_secret = rustfs_credentials::try_get_rpc_token()?;
-    let dist = DistCluster::start_with_env(DistLayout::FourNodeFourDisk, &[("RUSTFS_RPC_SECRET", &rpc_secret)]).await?;
-    let (target, user) = create_artifact_attempt(&dist).await?;
-    let bucket = target["bucket"].as_str().ok_or("target omitted bucket")?;
-    let prefix = target["attempt_prefix"].as_str().ok_or("target omitted prefix")?;
-    let key = format!("{prefix}detached-put.bin");
-    let payload = payload_for(&key, 2 * 1024 * 1024);
-    let output = timeout(
-        Duration::from_secs(30),
-        dist.client(1)?
-            .put_object()
-            .bucket(bucket)
-            .key(&key)
-            .body(payload.clone().into())
-            .send(),
-    )
-    .await??;
-    let version = output.version_id().ok_or("managed PUT omitted version ID")?;
-    let request_body = json!({"version": 1, "target": target}).to_string();
-    let baselines = dist
-        .cluster
-        .nodes
-        .iter()
-        .map(|node| census_object_version_on_disk(Path::new(&node.data_dirs[0]), bucket, &key, Some(version)))
-        .collect::<TestResult<Vec<_>>>()?;
-    assert!(
-        baselines
-            .iter()
-            .all(|baseline| baseline.is_complete() && !baseline.expected_part_numbers.is_empty())
-    );
-
-    let node = &dist.cluster.nodes[3];
-    let disk = PathBuf::from(&node.data_dirs[0]).canonicalize()?;
-    let object = disk.join(bucket).join(&key);
-    let metadata_bytes = std::fs::read(object.join("xl.meta"))?;
-    let fi = FileMeta::load(&metadata_bytes)?.into_fileinfo(bucket, &key, version, true, false, true)?;
-    let admitted_file_info = serde_json::to_value(&fi)?;
-    assert!(!fi.is_healing(), "ordinary publication must not carry the repair marker");
-    let data_dir = fi
-        .data_dir
-        .ok_or("physical-tail fixture requires external shards")?
-        .to_string();
-    let source = Uuid::new_v4().to_string();
-    let staging = disk.join(".rustfs.sys/tmp").join(&source);
-    std::fs::create_dir_all(&staging)?;
-    let destination = object.join(&data_dir);
-    // Replay the receiver publication of a real ordinary PUT while its attempt
-    // remains open. Preserve its referenced version metadata. The admitted
-    // owned operation may still finish metadata publication after RPC detach.
-    std::fs::rename(&destination, staging.join(&data_dir))?;
-    let barrier = PhysicalBarrier::arm(&disk, &destination)?;
-    let format: Value = serde_json::from_slice(&std::fs::read(disk.join(".rustfs.sys/format.json"))?)?;
-    let disk_id = Uuid::parse_str(format["xl"]["this"].as_str().ok_or("disk format omitted xl.this")?)?;
-    let incarnation = Uuid::parse_str(target["bucket_incarnation"].as_str().ok_or("target omitted incarnation")?)?;
-    let put = RenameDataRequest {
-        disk: disk_id.to_string(),
-        src_volume: ".rustfs.sys/tmp".to_owned(),
-        src_path: source,
-        dst_volume: bucket.to_owned(),
-        dst_path: key.clone(),
-        file_info: serde_json::to_string(&fi)?,
-        file_info_bin: Default::default(),
-        scanner_publication_lease_token: Default::default(),
-        bucket_incarnation_id: incarnation.as_bytes().to_vec().into(),
-    };
-    let request = signed_put_request(put.clone(), &node.address)?;
-    // Direct RPC takes no coordinator attempt lock and owns its own connection.
-    let url = node.url.clone();
-    let mut rpc = tokio::spawn(async move {
-        timeout(Duration::from_secs(30), async move {
-            let mut client = NodeServiceClient::connect(url).await?;
-            Ok::<_, Box<dyn std::error::Error + Send + Sync>>(client.artifact_rename_data(request).await?)
-        })
-        .await
-    });
-    tokio::select! {
-        result = &mut rpc => {
-            let response = result???.into_inner();
-            panic!(
-                "ordinary PUT receiver completed before the physical barrier: success={}, error={:?}",
-                response.success, response.error
-            );
-        }
-        arrived = barrier.observed("arrived") => arrived?,
-    }
-    assert!(!destination.exists(), "physical PUT escaped its barrier");
-    rpc.abort();
-    assert!(rpc.await.expect_err("disconnect the ordinary PUT waiter").is_cancelled());
-    // The ordinary PUT wrapper retains an owned task. Observe its RPC-facing
-    // waiter dropping, rather than cancellation of the continuing disk task.
-    barrier.observed("rpc-waiter-dropped").await?;
-
-    let seal = user.request(&dist, 0, PUT_SEAL_ROUTE, request_body.clone());
-    tokio::pin!(seal);
-    let closed = wait_until(
-        Duration::from_secs(15),
-        || async {
-            Ok(walkdir::WalkDir::new(disk.join(".rustfs-artifact-put-seals"))
-                .min_depth(2)
-                .max_depth(2)
-                .into_iter()
-                .filter_map(Result::ok)
-                .any(|entry| entry.file_name() == "closed"))
-        },
-        "PUT receiver persisted closing before physical drain",
-    );
-    tokio::pin!(closed);
-    tokio::select! {
-        result = &mut seal => {
-            let (status, response) = result?;
-            panic!("PUT seal returned before its blocked receiver closed admission: {status} {response}");
-        }
-        result = &mut closed => result?,
-    }
-    let (status, response) = timeout(Duration::from_secs(40), &mut seal).await??;
-    assert_eq!(
-        status,
-        StatusCode::SERVICE_UNAVAILABLE,
-        "PUT seal confirmed an unfinished physical tail: {response}"
-    );
-    assert!(response.contains("artifact operation unconfirmed"));
-    assert!(!destination.exists());
-    assert_raw_put_closed(&put, &node.url, &node.address, &[&staging, &object]).await?;
-    assert!(!destination.exists(), "a second admission published while the worker was paused");
-
-    barrier.release()?;
-    wait_until(
-        Duration::from_secs(15),
-        || async { Ok(destination.join("part.1").is_file()) },
-        "detached ordinary PUT worker finished",
-    )
-    .await?;
-    confirm_seal(&dist, &user, &request_body, &target).await?;
-    // Seal confirmation is the boundary: already admitted work may re-encode
-    // metadata before this point, but the complete FileInfo must be unchanged.
-    let published_objects: Vec<_> = dist
-        .cluster
-        .nodes
-        .iter()
-        .map(|node| PathBuf::from(&node.data_dirs[0]).join(bucket).join(&key))
-        .collect();
-    let published_paths: Vec<_> = published_objects.iter().map(PathBuf::as_path).collect();
-    let sealed_snapshot = publication_snapshot(&published_paths)?;
-    let sealed_file_info =
-        FileMeta::load(&std::fs::read(object.join("xl.meta"))?)?.into_fileinfo(bucket, &key, version, true, false, true)?;
-    assert_eq!(
-        serde_json::to_value(sealed_file_info)?,
-        admitted_file_info,
-        "admitted PUT changed FileInfo semantics"
-    );
-    for (index, baseline) in baselines.iter().enumerate() {
-        assert!(
-            census_object_version_on_disk(Path::new(&dist.cluster.nodes[index].data_dirs[0]), bucket, &key, Some(version))?
-                .matches_manifest(baseline)
-        );
-        assert_exact_version(&dist.client(index)?, bucket, &key, version, &payload).await?;
-    }
-
-    // Stage the exact request again. A source metadata sentinel makes a missing
-    // admission check observable even if the existing destination later causes
-    // ENOTEMPTY: ordinary rename rewrites source metadata before that syscall.
-    let staged_data = staging.join(&data_dir);
-    std::fs::create_dir_all(&staged_data)?;
-    for entry in std::fs::read_dir(&destination)? {
-        let entry = entry?;
-        assert!(entry.file_type()?.is_file(), "unexpected nested shard fixture");
-        std::fs::copy(entry.path(), staged_data.join(entry.file_name()))?;
-    }
-    std::fs::write(staging.join("xl.meta"), b"closed-admission-must-preserve-this-staged-metadata")?;
-    assert_raw_put_closed(&put, &node.url, &node.address, &[&staging, &object]).await?;
-    let listed = dist
-        .client(0)?
-        .list_object_versions()
-        .bucket(bucket)
-        .prefix(&key)
-        .send()
-        .await?;
-    assert_eq!(listed.versions().len(), 1, "raw PUT retries created another version");
-    assert_eq!(listed.versions()[0].version_id(), Some(version));
-    assert!(listed.delete_markers().is_empty());
-    confirm_seal(&dist, &user, &request_body, &target).await?;
-    assert!(
-        publication_snapshot(&published_paths)? == sealed_snapshot,
-        "published files changed after the first successful physical-drain confirmation"
-    );
-    Ok(())
-}

crates/e2e_test/src/distributed/artifact_repair_tail_test.rs

@@ -1,218 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-use super::artifact_seal_test::{assert_exact_version, confirm_seal, create_artifact_attempt};
-use super::harness::{DistCluster, DistLayout, TestResult, payload_for, wait_until};
-use crate::chaos::census_object_version_on_disk;
-use crate::common::init_logging;
-use crate::storage_api::artifact_rpc::{TONIC_RPC_PREFIX, gen_tonic_signature_headers, set_tonic_canonical_body_digest};
-use http::StatusCode;
-use rustfs_filemeta::FileMeta;
-use rustfs_protos::proto_gen::node_service::{
-    ArtifactRepairRenameDataRequest, RenameDataRequest, node_service_client::NodeServiceClient,
-};
-use serde_json::{Value, json};
-use std::path::{Path, PathBuf};
-use std::time::Duration;
-use tokio::time::timeout;
-use tonic::Request;
-use uuid::Uuid;
-
-const REPAIR_SEAL_ROUTE: &str = "/rustfs/admin/v3/plugin-artifacts/seal-repairs";
-
-pub(super) struct PhysicalBarrier(PathBuf);
-
-impl PhysicalBarrier {
-    pub(super) fn arm(disk: &Path, destination: &Path) -> TestResult<Self> {
-        let path = disk.join(".rustfs.sys/e2e-physical-rename-barrier");
-        std::fs::write(&path, destination.to_str().ok_or("non-UTF8 fixture destination")?)?;
-        Ok(Self(path))
-    }
-
-    pub(super) async fn observed(&self, stage: &str) -> TestResult {
-        wait_until(Duration::from_secs(15), || async { Ok(self.0.with_extension(stage).is_file()) }, stage).await
-    }
-
-    pub(super) fn release(&self) -> TestResult {
-        std::fs::write(self.0.with_extension("release"), b"release physical worker")?;
-        Ok(())
-    }
-}
-
-impl Drop for PhysicalBarrier {
-    fn drop(&mut self) {
-        // Release even on assertion failure; the worker also has its own deadline.
-        let _ = self.release();
-        let _ = std::fs::remove_file(&self.0);
-    }
-}
-
-#[tokio::test]
-async fn four_node_artifact_repair_seal_waits_for_disconnected_physical_tail() -> TestResult {
-    crate::common::rustfs_binary_path_with_features(Some("e2e-test-hooks"));
-    init_logging();
-    // Match the other raw internode signature tests sharing the OnceLock.
-    let _ = rustfs_credentials::set_global_rpc_secret("rustfs-internode-signature-e2e-secret".to_owned());
-    let rpc_secret = rustfs_credentials::try_get_rpc_token()?;
-    let dist = DistCluster::start_with_env(DistLayout::FourNodeFourDisk, &[("RUSTFS_RPC_SECRET", &rpc_secret)]).await?;
-    let (target, user) = create_artifact_attempt(&dist).await?;
-    let bucket = target["bucket"].as_str().ok_or("target omitted bucket")?;
-    let prefix = target["attempt_prefix"].as_str().ok_or("target omitted prefix")?;
-    let key = format!("{prefix}detached-rename.bin");
-    let body = payload_for(&key, 2 * 1024 * 1024);
-    let output = timeout(
-        Duration::from_secs(30),
-        dist.client(1)?
-            .put_object()
-            .bucket(bucket)
-            .key(&key)
-            .body(body.clone().into())
-            .send(),
-    )
-    .await??;
-    let version = output.version_id().ok_or("managed PUT omitted version ID")?;
-    let request_body = json!({"version": 1, "target": target}).to_string();
-    confirm_seal(&dist, &user, &request_body, &target).await?;
-
-    let node = &dist.cluster.nodes[3];
-    let disk = PathBuf::from(&node.data_dirs[0]).canonicalize()?;
-    let object = disk.join(bucket).join(&key);
-    let metadata = FileMeta::load(&std::fs::read(object.join("xl.meta"))?)?;
-    let mut fi = metadata.into_fileinfo(bucket, &key, version, true, false, true)?;
-    fi.set_healing();
-    let data_dir = fi
-        .data_dir
-        .ok_or("physical-tail fixture requires external shard files")?
-        .to_string();
-    let baseline = census_object_version_on_disk(&disk, bucket, &key, Some(version))?;
-    assert!(baseline.is_complete() && !baseline.expected_part_numbers.is_empty());
-    let source = Uuid::new_v4().to_string();
-    let staging = disk.join(".rustfs.sys/tmp").join(&source);
-    std::fs::create_dir_all(&staging)?;
-    let destination = object.join(&data_dir);
-    std::fs::rename(&destination, staging.join(&data_dir))?;
-    let barrier = PhysicalBarrier::arm(&disk, &destination)?;
-    let format: Value = serde_json::from_slice(&std::fs::read(disk.join(".rustfs.sys/format.json"))?)?;
-    let disk_id = Uuid::parse_str(format["xl"]["this"].as_str().ok_or("disk format omitted xl.this")?)?;
-    let incarnation = Uuid::parse_str(target["bucket_incarnation"].as_str().ok_or("target omitted incarnation")?)?;
-    let repair = ArtifactRepairRenameDataRequest {
-        rename: Some(RenameDataRequest {
-            disk: disk_id.to_string(),
-            src_volume: ".rustfs.sys/tmp".to_owned(),
-            src_path: source,
-            dst_volume: bucket.to_owned(),
-            dst_path: key.clone(),
-            file_info: serde_json::to_string(&fi)?,
-            file_info_bin: Default::default(),
-            scanner_publication_lease_token: Default::default(),
-            bucket_incarnation_id: incarnation.as_bytes().to_vec().into(),
-        }),
-        expected_disk_id: disk_id.as_bytes().to_vec().into(),
-    };
-    let canonical = rustfs_protos::canonical_artifact_repair_rename_data_request_body(&repair)?;
-    let mut request = Request::new(repair);
-    request.set_timeout(Duration::from_secs(15));
-    set_tonic_canonical_body_digest(&mut request, &canonical)?;
-    let digest = request
-        .metadata()
-        .get("x-rustfs-content-sha256")
-        .ok_or("missing canonical digest")?
-        .to_str()?
-        .to_owned();
-    let headers = gen_tonic_signature_headers(
-        &node.address,
-        TONIC_RPC_PREFIX.trim_start_matches('/'),
-        "ArtifactRepairRenameData",
-        Some(&digest),
-    )?;
-    request.metadata_mut().as_mut().extend(headers);
-    // An independent channel and direct receiver RPC take no coordinator attempt
-    // lock. Dropping this task closes the client stream while rename is paused.
-    let url = node.url.clone();
-    let mut rpc = tokio::spawn(async move {
-        timeout(Duration::from_secs(30), async move {
-            let mut client = NodeServiceClient::connect(url).await?;
-            client
-                .artifact_repair_rename_data(request)
-                .await
-                .map_err(|error| -> Box<dyn std::error::Error + Send + Sync> { Box::new(error) })
-        })
-        .await
-    });
-    tokio::select! {
-        result = &mut rpc => {
-            let response = result???.into_inner();
-            panic!(
-                "repair receiver completed before the physical barrier: success={}, error={:?}",
-                response.success, response.error
-            );
-        }
-        arrived = barrier.observed("arrived") => arrived?,
-    }
-    assert!(!destination.exists(), "physical publication ran before its barrier");
-    rpc.abort();
-    assert!(rpc.await.expect_err("cancel the disconnected RPC waiter").is_cancelled());
-    // This acknowledgement is emitted by the receiver's dropped async waiter,
-    // not by the client and not by a delayed response.
-    barrier.observed("waiter-dropped").await?;
-
-    let seal = user.request(&dist, 0, REPAIR_SEAL_ROUTE, request_body.clone());
-    tokio::pin!(seal);
-    let closed = wait_until(
-        Duration::from_secs(15),
-        || async {
-            Ok(walkdir::WalkDir::new(disk.join(".rustfs-artifact-repair-seals"))
-                .min_depth(2)
-                .max_depth(2)
-                .into_iter()
-                .filter_map(Result::ok)
-                .any(|entry| entry.file_name() == "closed"))
-        },
-        "receiver persisted repair closure while its physical worker remains paused",
-    );
-    tokio::pin!(closed);
-    tokio::select! {
-        result = &mut seal => {
-            let (status, response) = result?;
-            panic!("repair seal returned before the blocked receiver closed admission: {status} {response}");
-        }
-        result = &mut closed => result?,
-    }
-    // Cover a complete receiver drain timeout, so early physical-owner release
-    // causes a successful response here and fails this runtime assertion.
-    let (status, response) = timeout(Duration::from_secs(40), &mut seal).await??;
-    assert_eq!(
-        status,
-        StatusCode::SERVICE_UNAVAILABLE,
-        "seal confirmed an unfinished physical tail: {response}"
-    );
-    assert!(response.contains("artifact operation unconfirmed"));
-    assert!(!destination.exists(), "worker escaped the physical barrier");
-    barrier.release()?;
-    wait_until(
-        Duration::from_secs(15),
-        || async { Ok(destination.join("part.1").is_file()) },
-        "detached physical rename completes after release",
-    )
-    .await?;
-    wait_until(
-        Duration::from_secs(45),
-        || async {
-            let (status, response) = user.request(&dist, 0, REPAIR_SEAL_ROUTE, request_body.clone()).await?;
-            if status == StatusCode::SERVICE_UNAVAILABLE && response.contains("artifact operation unconfirmed") {
-                return Ok(false);
-            }
-            assert_eq!(status, StatusCode::OK, "repair seal did not confirm after physical drain: {response}");
-            assert_eq!(
-                serde_json::from_str::<Value>(&response)?,
-                json!({"version": 1, "target": target, "attempt_repairs_sealed": true})
-            );
-            Ok(true)
-        },
-        "exact retry confirms all four receivers after physical drain",
-    )
-    .await?;
-    assert!(census_object_version_on_disk(&disk, bucket, &key, Some(version))?.matches_manifest(&baseline));
-    assert_exact_version(&dist.client(0)?, bucket, &key, version, &body).await?;
-    Ok(())
-}

crates/e2e_test/src/distributed/artifact_repair_test.rs

@@ -1,327 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-use super::artifact_seal_test::{ArtifactAdmin, assert_exact_version, confirm_seal, create_artifact_attempt};
-use super::harness::{
-    DistCluster, DistLayout, TestResult, enable_versioning, payload_for, unique_bucket, wait_for_ready, wait_until,
-};
-use crate::chaos::{VersionShardCensus, census_object_version_on_disk, signed_admin_post, start_root_heal_when_control_ready};
-use crate::common::init_logging;
-use http::StatusCode;
-use serde_json::{Value, json};
-use std::path::{Path, PathBuf};
-use std::time::Duration;
-use tokio::time::timeout;
-
-const REPAIR_SEAL_ROUTE: &str = "/rustfs/admin/v3/plugin-artifacts/seal-repairs";
-const HEAL_BODY: &str =
-    r#"{"recursive":true,"dryRun":false,"remove":false,"recreate":true,"scanMode":2,"updateParity":false,"nolock":false}"#;
-const HEAL_BUDGET: Duration = Duration::from_secs(120);
-
-pub(super) struct RepairObject {
-    pub(super) key: String,
-    pub(super) version: String,
-    pub(super) body: Vec<u8>,
-    manifests: Vec<VersionShardCensus>,
-}
-
-fn roots(dist: &DistCluster) -> Vec<PathBuf> {
-    dist.cluster
-        .nodes
-        .iter()
-        .map(|node| PathBuf::from(&node.data_dirs[0]))
-        .collect()
-}
-
-impl RepairObject {
-    pub(super) async fn put(dist: &DistCluster, bucket: &str, key: String) -> TestResult<Self> {
-        let body = payload_for(&key, 2 * 1024 * 1024);
-        let output = timeout(
-            Duration::from_secs(30),
-            dist.client(1)?
-                .put_object()
-                .bucket(bucket)
-                .key(&key)
-                .body(body.clone().into())
-                .send(),
-        )
-        .await??;
-        let version = output.version_id().ok_or("managed PUT omitted version ID")?.to_owned();
-        let manifests = roots(dist)
-            .iter()
-            .map(|disk| census_object_version_on_disk(disk, bucket, &key, Some(&version)))
-            .collect::<TestResult<Vec<_>>>()?;
-        for manifest in &manifests {
-            assert!(manifest.is_complete(), "repair needs a complete baseline: {manifest:?}");
-            assert!(!manifest.expected_part_numbers.is_empty(), "repair must use actual shard files");
-        }
-        Ok(Self {
-            key,
-            version,
-            body,
-            manifests,
-        })
-    }
-
-    pub(super) fn part(&self, disk: &Path, bucket: &str, node: usize) -> TestResult<PathBuf> {
-        let data_dir = self.manifests[node]
-            .data_dir
-            .as_ref()
-            .ok_or("external shard omitted data directory")?;
-        Ok(disk.join(bucket).join(&self.key).join(data_dir).join("part.1"))
-    }
-
-    pub(super) async fn assert_repaired(&self, dist: &DistCluster, bucket: &str) -> TestResult {
-        wait_until(
-            HEAL_BUDGET,
-            || async {
-                for (disk, baseline) in roots(dist).iter().zip(&self.manifests) {
-                    if !census_object_version_on_disk(disk, bucket, &self.key, Some(&self.version))?.matches_manifest(baseline) {
-                        return Ok(false);
-                    }
-                }
-                Ok(true)
-            },
-            "every configured receiver restored the exact version and original shard fingerprints",
-        )
-        .await?;
-        for node in 0..dist.cluster.nodes.len() {
-            assert_exact_version(&dist.client(node)?, bucket, &self.key, &self.version, &self.body).await?;
-        }
-        Ok(())
-    }
-}
-
-pub(super) async fn start_heal(dist: &DistCluster, bucket: &str, prefix: &str, remove: bool) -> TestResult<String> {
-    let url = format!("{}/rustfs/admin/v3/heal/{bucket}/{prefix}?forceStart=true", dist.cluster.nodes[0].url);
-    let body = if remove {
-        HEAL_BODY.replace("\"remove\":false", "\"remove\":true")
-    } else {
-        HEAL_BODY.to_owned()
-    };
-    let response = timeout(
-        HEAL_BUDGET,
-        start_root_heal_when_control_ready(&url, &body, &dist.cluster.access_key, &dist.cluster.secret_key),
-    )
-    .await??;
-    let response: Value = serde_json::from_str(&response)?;
-    Ok(response["clientToken"]
-        .as_str()
-        .ok_or("heal omitted its task token")?
-        .to_owned())
-}
-
-pub(super) async fn finish_heal(dist: &DistCluster, token: &str, rejected_key: Option<&str>) -> TestResult {
-    let url = format!("{}/rustfs/admin/v3/heal/?clientToken={token}", dist.cluster.nodes[0].url);
-    wait_until(
-        HEAL_BUDGET,
-        || async {
-            let response = signed_admin_post(&url, None, &dist.cluster.access_key, &dist.cluster.secret_key).await?;
-            let status: Value = serde_json::from_str(&response)?;
-            if status["summary"] == "running" {
-                return Ok(false);
-            }
-            if let Some(key) = rejected_key {
-                assert_eq!(status["summary"], "stopped", "closed repair must report failure: {status}");
-                assert!(
-                    status["outcome"]["counters"]["failed"]
-                        .as_u64()
-                        .is_some_and(|count| count > 0)
-                );
-                assert!(
-                    status["outcome"]["objects"].as_array().is_some_and(|objects| objects
-                        .iter()
-                        .any(|object| { object["identity"]["object"] == key && object["disposition"]["state"] == "failed" })),
-                    "heal must actually attempt the rejected object: {status}"
-                );
-            } else {
-                assert_eq!(status["summary"], "finished", "heal did not complete: {status}");
-            }
-            Ok(true)
-        },
-        "exact admin heal task reached its expected terminal outcome",
-    )
-    .await
-}
-
-async fn repair_seal(dist: &DistCluster, user: &ArtifactAdmin, target: &Value, confirmed: bool) -> TestResult {
-    wait_until(
-        Duration::from_secs(45),
-        || async {
-            let request = json!({"version": 1, "target": target}).to_string();
-            let (status, body) = user.request(dist, 0, REPAIR_SEAL_ROUTE, request).await?;
-            if !confirmed {
-                assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE, "offline receiver repair seal: {body}");
-                assert!(body.contains("<Code>ServiceUnavailable</Code>"));
-                assert!(body.contains("artifact operation unconfirmed"));
-                return Ok(true);
-            }
-            if status == StatusCode::SERVICE_UNAVAILABLE
-                && body.contains("<Code>ServiceUnavailable</Code>")
-                && body.contains("<Message>artifact operation unconfirmed; retry the same identity</Message>")
-            {
-                return Ok(false);
-            }
-            assert_eq!(status, StatusCode::OK, "repair seal failed: {body}");
-            assert_eq!(
-                serde_json::from_str::<Value>(&body)?,
-                json!({"version": 1, "target": target, "attempt_repairs_sealed": true})
-            );
-            Ok(true)
-        },
-        "repair seal confirms every configured receiver",
-    )
-    .await
-}
-
-#[tokio::test]
-async fn four_node_artifact_shard_and_minority_metadata_repair_after_put_seal() -> TestResult {
-    init_logging();
-    // Sub-quorum metadata recovery supports genuine legacy shards only.
-    let mut dist =
-        DistCluster::start_with_env(DistLayout::FourNodeFourDisk, &[("RUSTFS_SHARD_INTEGRITY_WRITE", "false")]).await?;
-    let (target, user) = create_artifact_attempt(&dist).await?;
-    let bucket = target["bucket"].as_str().ok_or("target omitted bucket")?;
-    let prefix = target["attempt_prefix"].as_str().ok_or("target omitted prefix")?;
-    let shard = RepairObject::put(&dist, bucket, format!("{prefix}shard.bin")).await?;
-    let metadata = RepairObject::put(&dist, bucket, format!("{prefix}metadata.bin")).await?;
-    let later = dist
-        .client(2)?
-        .put_object()
-        .bucket(bucket)
-        .key(&shard.key)
-        .body(b"newer-version".to_vec().into())
-        .send()
-        .await?;
-    let later_version = later.version_id().ok_or("second PUT omitted version ID")?.to_owned();
-    assert_ne!(shard.version, later_version);
-    confirm_seal(&dist, &user, &json!({"version": 1, "target": target}).to_string(), &target).await?;
-
-    dist.cluster.stop();
-    let disks = roots(&dist);
-    std::fs::remove_file(shard.part(&disks[3], bucket, 3)?)?;
-    for disk in &disks[1..] {
-        std::fs::remove_file(disk.join(bucket).join(&metadata.key).join("xl.meta"))?;
-    }
-    assert!(!census_object_version_on_disk(&disks[3], bucket, &shard.key, Some(&shard.version))?.is_complete());
-    assert!(disks[0].join(bucket).join(&metadata.key).join("xl.meta").is_file());
-    assert!(
-        disks[1..]
-            .iter()
-            .all(|disk| !disk.join(bucket).join(&metadata.key).join("xl.meta").exists())
-    );
-    dist.cluster.start().await?;
-    wait_for_ready(&dist.cluster).await?;
-    let token = start_heal(&dist, bucket, prefix, false).await?;
-    shard.assert_repaired(&dist, bucket).await?;
-    metadata.assert_repaired(&dist, bucket).await?;
-    finish_heal(&dist, &token, None).await?;
-    assert_exact_version(&dist.client(3)?, bucket, &shard.key, &later_version, b"newer-version").await?;
-    let listed = dist
-        .client(0)?
-        .list_object_versions()
-        .bucket(bucket)
-        .prefix(prefix)
-        .send()
-        .await?;
-    assert_eq!(listed.versions().len(), 3, "repair must not publish replacement versions");
-    assert!(listed.delete_markers().is_empty());
-    Ok(())
-}
-
-#[tokio::test]
-async fn four_node_artifact_repair_seal_denies_shard_and_metadata_repair_after_restart() -> TestResult {
-    init_logging();
-    let mut dist =
-        DistCluster::start_with_env(DistLayout::FourNodeFourDisk, &[("RUSTFS_SHARD_INTEGRITY_WRITE", "false")]).await?;
-    let (target, user) = create_artifact_attempt(&dist).await?;
-    let bucket = target["bucket"].as_str().ok_or("target omitted bucket")?;
-    let prefix = target["attempt_prefix"].as_str().ok_or("target omitted prefix")?;
-    let shard = RepairObject::put(&dist, bucket, format!("{prefix}shard.bin")).await?;
-    let metadata = RepairObject::put(&dist, bucket, format!("{prefix}metadata.bin")).await?;
-    confirm_seal(&dist, &user, &json!({"version": 1, "target": target}).to_string(), &target).await?;
-    repair_seal(&dist, &user, &target, true).await?;
-    let ordinary_bucket = unique_bucket("repair-control");
-    dist.create_bucket(&ordinary_bucket).await?;
-    enable_versioning(&dist.client(0)?, &ordinary_bucket).await?;
-    let ordinary = RepairObject::put(&dist, &ordinary_bucket, "ordinary.bin".to_owned()).await?;
-    let disks = roots(&dist);
-    let part = shard.part(&disks[3], bucket, 3)?;
-    std::fs::remove_file(&part)?;
-    for disk in &disks[1..] {
-        std::fs::remove_file(disk.join(bucket).join(&metadata.key).join("xl.meta"))?;
-    }
-    for restarted in [false, true] {
-        if restarted {
-            dist.restart_with_current_binary().await?;
-        }
-        // The same receivers must still execute an ordinary bucket repair.
-        std::fs::remove_file(ordinary.part(&disks[3], &ordinary_bucket, 3)?)?;
-        let control = start_heal(&dist, &ordinary_bucket, &ordinary.key, false).await?;
-        ordinary.assert_repaired(&dist, &ordinary_bucket).await?;
-        finish_heal(&dist, &control, None).await?;
-        for object in [&shard, &metadata] {
-            let token = start_heal(&dist, bucket, &object.key, false).await?;
-            finish_heal(&dist, &token, Some(&object.key)).await?;
-        }
-        assert!(!part.exists(), "sealed repair recreated the missing shard");
-        assert!(
-            disks[1..]
-                .iter()
-                .all(|disk| !disk.join(bucket).join(&metadata.key).join("xl.meta").exists())
-        );
-        assert_exact_version(&dist.client(2)?, bucket, &shard.key, &shard.version, &shard.body).await?;
-    }
-    Ok(())
-}
-
-#[tokio::test]
-async fn four_node_artifact_repair_seal_requires_every_receiver_on_exact_retry() -> TestResult {
-    init_logging();
-    let mut dist = DistCluster::start(DistLayout::FourNodeFourDisk).await?;
-    let (target, user) = create_artifact_attempt(&dist).await?;
-    let request = json!({"version": 1, "target": target}).to_string();
-    confirm_seal(&dist, &user, &request, &target).await?;
-    // Repeat after global confirmation: its persisted receipt cannot replace a
-    // fresh acknowledgement from an offline configured receiver.
-    for _ in 0..2 {
-        dist.cluster.stop_node(3)?;
-        repair_seal(&dist, &user, &target, false).await?;
-        dist.cluster.start_node(3).await?;
-        wait_for_ready(&dist.cluster).await?;
-        repair_seal(&dist, &user, &target, true).await?;
-    }
-    Ok(())
-}
-
-#[tokio::test]
-async fn four_node_artifact_dangling_repair_preserves_surviving_metadata() -> TestResult {
-    init_logging();
-    let mut dist =
-        DistCluster::start_with_env(DistLayout::FourNodeFourDisk, &[("RUSTFS_SHARD_INTEGRITY_WRITE", "false")]).await?;
-    let (target, user) = create_artifact_attempt(&dist).await?;
-    let bucket = target["bucket"].as_str().ok_or("target omitted bucket")?;
-    let prefix = target["attempt_prefix"].as_str().ok_or("target omitted prefix")?;
-    let object = RepairObject::put(&dist, bucket, format!("{prefix}dangling.bin")).await?;
-    confirm_seal(&dist, &user, &json!({"version": 1, "target": target}).to_string(), &target).await?;
-    dist.cluster.stop();
-    let disks = roots(&dist);
-    let survivor = disks[0].join(bucket).join(&object.key).join("xl.meta");
-    let before = std::fs::read(&survivor)?;
-    for (node, disk) in disks.iter().enumerate() {
-        std::fs::remove_file(object.part(disk, bucket, node)?)?;
-        if node != 0 {
-            std::fs::remove_file(disk.join(bucket).join(&object.key).join("xl.meta"))?;
-        }
-    }
-    dist.cluster.start().await?;
-    wait_for_ready(&dist.cluster).await?;
-    let token = start_heal(&dist, bucket, &object.key, true).await?;
-    finish_heal(&dist, &token, Some(&object.key)).await?;
-    assert_eq!(
-        std::fs::read(survivor)?,
-        before,
-        "distributed repair must not authorize managed dangling deletion"
-    );
-    Ok(())
-}

crates/e2e_test/src/distributed/artifact_seal_test.rs

@@ -1,347 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-use super::harness::{
-    DistCluster, DistLayout, TestResult, assert_object_bytes, put_object, s3_probe_client, unique_bucket, wait_for_ready,
-    wait_until,
-};
-use crate::common::{
-    AdminTransport, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via, admin_request, init_logging,
-};
-use aws_sdk_s3::Client;
-use aws_sdk_s3::error::ProvideErrorMetadata;
-use http::{Method, StatusCode};
-use serde_json::{Value, json};
-use std::time::Duration;
-use tokio::time::timeout;
-use uuid::Uuid;
-
-const BUCKET_ROUTE: &str = "/rustfs/admin/v3/plugin-artifacts/buckets";
-const INSPECT_ROUTE: &str = "/rustfs/admin/v3/plugin-artifacts/buckets/inspect";
-const SEAL_ROUTE: &str = "/rustfs/admin/v3/plugin-artifacts/seal-attempt";
-const ADMIN_BUDGET: Duration = Duration::from_secs(45);
-
-pub(super) struct ArtifactAdmin {
-    access_key: String,
-    secret_key: String,
-}
-
-impl ArtifactAdmin {
-    pub(super) async fn request(
-        &self,
-        dist: &DistCluster,
-        node: usize,
-        route: &str,
-        body: String,
-    ) -> TestResult<(StatusCode, String)> {
-        timeout(
-            ADMIN_BUDGET,
-            admin_request(
-                &dist.cluster.nodes[node].url,
-                Method::POST,
-                route,
-                Some(body),
-                &self.access_key,
-                &self.secret_key,
-            ),
-        )
-        .await?
-    }
-}
-
-async fn create_artifact_admin(dist: &DistCluster, bucket: &str, prefix: &str) -> TestResult<ArtifactAdmin> {
-    let user = ArtifactAdmin {
-        access_key: format!("artifact{}", &Uuid::new_v4().simple().to_string()[..12]),
-        secret_key: Uuid::new_v4().simple().to_string(),
-    };
-    let policy_name = format!("artifact{}", &Uuid::new_v4().simple().to_string()[..12]);
-    let policy = json!({
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Effect": "Allow",
-                "Action": ["admin:CreatePluginArtifactBucket", "admin:GetPluginArtifactBucket"],
-                "Resource": format!("arn:aws:s3:::{bucket}"),
-            },
-            {
-                "Effect": "Allow",
-                "Action": ["admin:SealPluginArtifactAttempt", "admin:SealPluginArtifactRepairs", "admin:SealPluginArtifactWrites"],
-                "Resource": format!("arn:aws:s3:::{bucket}/{}", prefix.trim_end_matches('/')),
-            },
-        ],
-    })
-    .to_string();
-    let url = &dist.cluster.nodes[0].url;
-    let access = &dist.cluster.access_key;
-    let secret = &dist.cluster.secret_key;
-    admin_create_user_via(AdminTransport::Signed, url, access, secret, &user.access_key, &user.secret_key).await?;
-    admin_add_canned_policy_via(AdminTransport::Signed, url, access, secret, &policy_name, &policy).await?;
-    admin_attach_user_policy_via(AdminTransport::Signed, url, access, secret, &policy_name, &user.access_key).await?;
-    Ok(user)
-}
-
-pub(super) async fn create_artifact_attempt(dist: &DistCluster) -> TestResult<(Value, ArtifactAdmin)> {
-    let bucket = unique_bucket("artifact");
-    let prefix = format!("outputs/6169/{}/{}/", Uuid::new_v4(), Uuid::new_v4());
-    let user = create_artifact_admin(dist, &bucket, &prefix).await?;
-    let body = json!({"version": 1, "bucket": bucket, "base_prefix": "outputs/"}).to_string();
-    let (status, response) = user.request(dist, 0, BUCKET_ROUTE, body).await?;
-    assert_eq!(status, StatusCode::OK, "artifact bucket creation failed: {response}");
-    let receipt: Value = serde_json::from_str(&response)?;
-    assert_eq!(receipt["version"], 1);
-    assert_eq!(receipt["bucket"], bucket);
-    assert_eq!(receipt["base_prefix"], "outputs/");
-    assert_eq!(receipt["versioning_enabled"], true);
-    let incarnation = receipt["bucket_incarnation"]
-        .as_str()
-        .ok_or("artifact receipt omitted incarnation")?;
-    assert!(!Uuid::parse_str(incarnation)?.is_nil());
-    let target = json!({
-        "bucket": bucket,
-        "bucket_incarnation": incarnation,
-        "attempt_prefix": prefix,
-    });
-    assert_bucket_identity(dist, &user, 1, &target).await?;
-    Ok((target, user))
-}
-
-async fn assert_bucket_identity(dist: &DistCluster, user: &ArtifactAdmin, node: usize, target: &Value) -> TestResult {
-    let body = json!({"version": 1, "bucket": target["bucket"], "base_prefix": "outputs/"}).to_string();
-    wait_until(
-        ADMIN_BUDGET,
-        || async {
-            let (status, response) = user.request(dist, node, INSPECT_ROUTE, body.clone()).await?;
-            // IAM peers may not have received the new user and policy yet.
-            // Storage failures must fail immediately, including the old gate's 503.
-            if matches!(status, StatusCode::FORBIDDEN | StatusCode::UNAUTHORIZED)
-                && (response.contains("<Code>AccessDenied</Code>") || response.contains("<Code>InvalidAccessKeyId</Code>"))
-            {
-                return Ok(false);
-            }
-            assert_eq!(status, StatusCode::OK, "cross-node artifact inspect failed: {response}");
-            assert_eq!(
-                serde_json::from_str::<Value>(&response)?,
-                json!({
-                    "version": 1,
-                    "bucket": target["bucket"],
-                    "base_prefix": "outputs/",
-                    "bucket_incarnation": target["bucket_incarnation"],
-                    "versioning_enabled": true,
-                }),
-                "inspect must return the created managed bucket identity"
-            );
-            Ok(true)
-        },
-        "artifact IAM user and policy propagation",
-    )
-    .await
-}
-
-pub(super) async fn confirm_seal(dist: &DistCluster, user: &ArtifactAdmin, request: &str, target: &Value) -> TestResult {
-    wait_until(
-        ADMIN_BUDGET,
-        || async {
-            let (status, response) = user.request(dist, 0, SEAL_ROUTE, request.to_owned()).await?;
-            // HTTP readiness does not confirm that remote disk handles have
-            // recovered. Retry only the API's explicit same-identity response.
-            if status == StatusCode::SERVICE_UNAVAILABLE
-                && response.contains("<Code>ServiceUnavailable</Code>")
-                && response.contains("<Message>artifact operation unconfirmed; retry the same identity</Message>")
-            {
-                return Ok(false);
-            }
-            assert_eq!(status, StatusCode::OK, "artifact seal failed: {response}");
-            let receipt: Value = serde_json::from_str(&response)?;
-            assert_eq!(receipt, json!({"version": 1, "target": target, "ordinary_put_sealed": true}));
-            Ok(true)
-        },
-        "exact artifact seal confirmation after receiver recovery",
-    )
-    .await
-}
-
-async fn assert_seal_unconfirmed(dist: &DistCluster, user: &ArtifactAdmin, request: &str) -> TestResult {
-    let (status, body) = user.request(dist, 0, SEAL_ROUTE, request.to_owned()).await?;
-    assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE, "offline receiver seal response: {body}");
-    assert!(
-        body.contains("<Code>ServiceUnavailable</Code>"),
-        "seal failure lost its service code: {body}"
-    );
-    assert!(
-        body.contains("artifact operation unconfirmed"),
-        "seal failure lost its retry contract: {body}"
-    );
-    Ok(())
-}
-
-pub(super) async fn assert_exact_version(client: &Client, bucket: &str, key: &str, version: &str, body: &[u8]) -> TestResult {
-    let output = timeout(
-        Duration::from_secs(30),
-        client.get_object().bucket(bucket).key(key).version_id(version).send(),
-    )
-    .await??;
-    assert_eq!(output.version_id(), Some(version));
-    let actual = timeout(Duration::from_secs(30), output.body.collect()).await??.into_bytes();
-    assert_eq!(actual.as_ref(), body);
-    Ok(())
-}
-
-async fn assert_put_denied(client: &Client, ordinary_bucket: &str, bucket: &str, key: &str) -> TestResult {
-    // The same receiver must still accept a normal write before its sealed probe.
-    put_object(client, ordinary_bucket, key, b"ordinary-control".to_vec()).await?;
-    assert_object_bytes(client, ordinary_bucket, key, b"ordinary-control").await?;
-    let client = s3_probe_client(client);
-    let result = timeout(
-        Duration::from_secs(30),
-        client
-            .put_object()
-            .bucket(bucket)
-            .key(key)
-            .body(b"must-not-publish".to_vec().into())
-            .send(),
-    )
-    .await?;
-    let error = result.expect_err("sealed artifact attempt accepted a new PUT");
-    let service = error
-        .as_service_error()
-        .ok_or("sealed PUT failed without a service rejection")?;
-    assert_eq!(
-        error.raw_response().map(|response| response.status().as_u16()),
-        Some(500),
-        "sealed PUT must return its current HTTP status"
-    );
-    assert_eq!(service.code(), Some("InternalError"), "sealed PUT must return its current service code");
-    // StorageError::Io is redacted at the API boundary; the sealed reason is
-    // not exposed. Success controls and exact inventory checks prove the effect.
-    assert_eq!(
-        service.message(),
-        Some("We encountered an internal error, please try again."),
-        "sealed PUT must retain the public redacted message"
-    );
-    Ok(())
-}
-
-#[tokio::test]
-async fn four_node_artifact_put_seal_survives_full_restart() -> TestResult {
-    init_logging();
-    let mut dist = DistCluster::start(DistLayout::FourNodeFourDisk).await?;
-    let (target, user) = create_artifact_attempt(&dist).await?;
-    let bucket = target["bucket"].as_str().ok_or("target omitted bucket")?;
-    let prefix = target["attempt_prefix"].as_str().ok_or("target omitted attempt prefix")?;
-    let key = format!("{prefix}result.bin");
-    let mut versions = Vec::new();
-    for (node, body) in [(1, b"first-version".as_slice()), (2, b"second-version".as_slice())] {
-        let client = dist.client(node)?;
-        let output = timeout(
-            Duration::from_secs(30),
-            client.put_object().bucket(bucket).key(&key).body(body.to_vec().into()).send(),
-        )
-        .await??;
-        let version = output.version_id().ok_or("artifact PUT omitted version ID")?.to_owned();
-        assert!(!Uuid::parse_str(&version)?.is_nil());
-        assert_exact_version(&dist.client(3)?, bucket, &key, &version, body).await?;
-        versions.push((version, body.to_vec()));
-    }
-    assert_ne!(versions[0].0, versions[1].0);
-    let ordinary = unique_bucket("ordinary");
-    dist.create_bucket(&ordinary).await?;
-    put_object(&dist.client(2)?, &ordinary, "normal.bin", b"before-seal".to_vec()).await?;
-    assert_object_bytes(&dist.client(3)?, &ordinary, "normal.bin", b"before-seal").await?;
-
-    let request = json!({"version": 1, "target": target}).to_string();
-    confirm_seal(&dist, &user, &request, &target).await?;
-    let other_prefix = format!("outputs/6169/{}/{}/", Uuid::new_v4(), Uuid::new_v4());
-    for phase in ["sealed", "restarted"] {
-        if phase == "restarted" {
-            dist.cluster.stop();
-            dist.cluster.start().await?;
-            wait_for_ready(&dist.cluster).await?;
-        }
-        assert_bucket_identity(&dist, &user, 2, &target).await?;
-        for node in 0..dist.cluster.nodes.len() {
-            // A second attempt in the managed bucket must remain writable;
-            // a broken bucket-wide write path cannot stand in for sealing.
-            let client = dist.client(node)?;
-            let other_key = format!("{other_prefix}{phase}-{node}.bin");
-            let output = timeout(
-                Duration::from_secs(30),
-                client
-                    .put_object()
-                    .bucket(bucket)
-                    .key(&other_key)
-                    .body(b"other-attempt".to_vec().into())
-                    .send(),
-            )
-            .await??;
-            let version = output.version_id().ok_or("other attempt PUT omitted version ID")?;
-            assert!(!Uuid::parse_str(version)?.is_nil());
-            assert_exact_version(
-                &dist.client((node + 1) % dist.cluster.nodes.len())?,
-                bucket,
-                &other_key,
-                version,
-                b"other-attempt",
-            )
-            .await?;
-            assert_put_denied(&dist.client(node)?, &ordinary, bucket, &format!("{prefix}{phase}-{node}.bin")).await?;
-            for (version, body) in &versions {
-                assert_exact_version(&dist.client(node)?, bucket, &key, version, body).await?;
-            }
-        }
-        let listed = dist
-            .client(0)?
-            .list_object_versions()
-            .bucket(bucket)
-            .prefix(prefix)
-            .send()
-            .await?;
-        assert_eq!(listed.versions().len(), 2, "denied PUT left an artifact version: {listed:?}");
-        assert!(listed.delete_markers().is_empty(), "artifact seal created a delete marker");
-        put_object(&dist.client(1)?, &ordinary, "normal.bin", phase.as_bytes().to_vec()).await?;
-        assert_object_bytes(&dist.client(2)?, &ordinary, "normal.bin", phase.as_bytes()).await?;
-    }
-    Ok(())
-}
-
-#[tokio::test]
-async fn four_node_artifact_seal_requires_every_configured_receiver_on_exact_retry() -> TestResult {
-    init_logging();
-    let mut dist = DistCluster::start(DistLayout::FourNodeFourDisk).await?;
-    let (target, user) = create_artifact_attempt(&dist).await?;
-    let bucket = target["bucket"].as_str().ok_or("target omitted bucket")?;
-    let prefix = target["attempt_prefix"].as_str().ok_or("target omitted attempt prefix")?;
-    let key = format!("{prefix}existing.bin");
-    let output = dist
-        .client(1)?
-        .put_object()
-        .bucket(bucket)
-        .key(&key)
-        .body(b"existing".to_vec().into())
-        .send()
-        .await?;
-    let version = output.version_id().ok_or("artifact PUT omitted version ID")?.to_owned();
-    assert_exact_version(&dist.client(3)?, bucket, &key, &version, b"existing").await?;
-    let ordinary = unique_bucket("ordinary");
-    dist.create_bucket(&ordinary).await?;
-    let request = json!({"version": 1, "target": target}).to_string();
-
-    // The second iteration starts from a fully acknowledged global seal. Its
-    // persisted record cannot replace a fresh acknowledgement from every disk.
-    for _ in 0..2 {
-        dist.cluster.stop_node(3)?;
-        assert_seal_unconfirmed(&dist, &user, &request).await?;
-        dist.cluster.start_node(3).await?;
-        wait_for_ready(&dist.cluster).await?;
-        confirm_seal(&dist, &user, &request, &target).await?;
-    }
-    assert_put_denied(&dist.client(3)?, &ordinary, bucket, &format!("{prefix}late.bin")).await?;
-    assert_exact_version(&dist.client(2)?, bucket, &key, &version, b"existing").await?;
-    let listed = timeout(
-        Duration::from_secs(30),
-        dist.client(0)?.list_object_versions().bucket(bucket).prefix(prefix).send(),
-    )
-    .await??;
-    assert_eq!(listed.versions().len(), 1, "rejected PUT added a version");
-    assert!(listed.delete_markers().is_empty(), "seal added a delete marker");
-    Ok(())
-}

crates/e2e_test/src/distributed/artifact_writes_test.rs

@@ -1,235 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-#![cfg(unix)]
-
-use super::artifact_delete_test::physical_snapshot;
-use super::artifact_repair_test::{RepairObject, finish_heal, start_heal};
-use super::artifact_seal_test::{ArtifactAdmin, assert_exact_version, confirm_seal, create_artifact_attempt};
-use super::harness::{
-    DistCluster, DistLayout, TestResult, enable_versioning, s3_probe_client, unique_bucket, wait_for_ready, wait_until,
-};
-use crate::common::init_logging;
-use aws_sdk_s3::error::ProvideErrorMetadata;
-use aws_sdk_s3::types::{
-    ObjectLockConfiguration, ObjectLockEnabled, ObjectLockLegalHold, ObjectLockLegalHoldStatus, ObjectLockRetention,
-    ObjectLockRetentionMode,
-};
-use http::StatusCode;
-use serde_json::{Value, json};
-use std::path::Path;
-use std::time::Duration;
-
-const WRITES_ROUTE: &str = "/rustfs/admin/v3/plugin-artifacts/seal-writes";
-const INTERNAL_MESSAGE: &str = "We encountered an internal error, please try again.";
-
-async fn seal_writes(dist: &DistCluster, user: &ArtifactAdmin, target: &Value, confirmed: bool) -> TestResult {
-    wait_until(Duration::from_secs(45), || async {
-        let (status, response) = user.request(dist, 0, WRITES_ROUTE, json!({"version":1,"target":target}).to_string()).await?;
-        if status == StatusCode::SERVICE_UNAVAILABLE && response.contains("artifact operation unconfirmed; retry the same identity") {
-            return Ok(!confirmed);
-        }
-        assert!(confirmed, "offline configured receiver produced a complete receipt: {status} {response}");
-        assert_eq!(status, StatusCode::OK, "combined writes seal: {response}");
-        assert_eq!(serde_json::from_str::<Value>(&response)?, json!({"version":1,"target":target,"ordinary_put_sealed":true,"attempt_repairs_sealed":true,"all_writes_sealed":true}));
-        Ok(true)
-    }, "combined seal acknowledges both domains on every receiver").await
-}
-
-async fn assert_put_closed(dist: &DistCluster, bucket: &str, key: &str) -> TestResult {
-    let before = physical_snapshot(dist, bucket)?;
-    let client = s3_probe_client(&dist.client(2)?);
-    let error = client
-        .put_object()
-        .bucket(bucket)
-        .key(key)
-        .body(b"must-not-publish".to_vec().into())
-        .send()
-        .await
-        .expect_err("combined seal admitted a new ordinary PUT");
-    let service = error.as_service_error().ok_or("PUT was not a service rejection")?;
-    assert_eq!(service.code(), Some("InternalError"));
-    assert_eq!(service.message(), Some(INTERNAL_MESSAGE));
-    assert!(
-        physical_snapshot(dist, bucket)? == before,
-        "rejected PUT changed the managed physical namespace"
-    );
-    Ok(())
-}
-
-async fn lock_metadata_entrypoints(dist: &DistCluster, managed: &Value, object: &RepairObject, ordinary: &str) -> TestResult {
-    let bucket = managed["bucket"].as_str().ok_or("bucket identity")?;
-    let client = s3_probe_client(&dist.client(0)?);
-    for bucket in [bucket, ordinary] {
-        client
-            .put_object_lock_configuration()
-            .bucket(bucket)
-            .object_lock_configuration(
-                ObjectLockConfiguration::builder()
-                    .object_lock_enabled(ObjectLockEnabled::Enabled)
-                    .build(),
-            )
-            .send()
-            .await?;
-        wait_until(
-            Duration::from_secs(30),
-            || async {
-                for node in 0..4 {
-                    let output = match dist.client(node)?.get_object_lock_configuration().bucket(bucket).send().await {
-                        Ok(output) => output,
-                        Err(error)
-                            if error.as_service_error().and_then(ProvideErrorMetadata::code)
-                                == Some("ObjectLockConfigurationNotFoundError") =>
-                        {
-                            return Ok(false);
-                        }
-                        Err(error) => return Err(error.into()),
-                    };
-                    if output
-                        .object_lock_configuration()
-                        .and_then(|configuration| configuration.object_lock_enabled())
-                        != Some(&ObjectLockEnabled::Enabled)
-                    {
-                        return Ok(false);
-                    }
-                }
-                Ok(true)
-            },
-            "actual Object Lock configuration is enabled on all request nodes",
-        )
-        .await?;
-    }
-    let control = RepairObject::put(dist, ordinary, "lock-control.bin".to_owned()).await?;
-    let retention = ObjectLockRetention::builder()
-        .mode(ObjectLockRetentionMode::Governance)
-        .retain_until_date(aws_sdk_s3::primitives::DateTime::from_secs(chrono::Utc::now().timestamp() + 86400))
-        .build();
-    let hold = ObjectLockLegalHold::builder().status(ObjectLockLegalHoldStatus::On).build();
-    client
-        .put_object_retention()
-        .bucket(ordinary)
-        .key(&control.key)
-        .version_id(&control.version)
-        .retention(retention.clone())
-        .send()
-        .await?;
-    assert_eq!(
-        client
-            .get_object_retention()
-            .bucket(ordinary)
-            .key(&control.key)
-            .version_id(&control.version)
-            .send()
-            .await?
-            .retention()
-            .and_then(|value| value.mode()),
-        Some(&ObjectLockRetentionMode::Governance)
-    );
-    client
-        .put_object_legal_hold()
-        .bucket(ordinary)
-        .key(&control.key)
-        .version_id(&control.version)
-        .legal_hold(hold.clone())
-        .send()
-        .await?;
-    assert_eq!(
-        client
-            .get_object_legal_hold()
-            .bucket(ordinary)
-            .key(&control.key)
-            .version_id(&control.version)
-            .send()
-            .await?
-            .legal_hold()
-            .and_then(|value| value.status()),
-        Some(&ObjectLockLegalHoldStatus::On)
-    );
-    let before = physical_snapshot(dist, bucket)?;
-    let error = client
-        .put_object_retention()
-        .bucket(bucket)
-        .key(&object.key)
-        .version_id(&object.version)
-        .retention(retention)
-        .send()
-        .await
-        .expect_err("managed Retention must reach and fail its unsupported metadata write");
-    let service = error.as_service_error().ok_or("retention was not a service rejection")?;
-    assert_eq!(service.code(), Some("InternalError"));
-    assert_eq!(service.message(), Some(INTERNAL_MESSAGE));
-    assert!(physical_snapshot(dist, bucket)? == before, "retention changed managed metadata");
-    let error = client
-        .put_object_legal_hold()
-        .bucket(bucket)
-        .key(&object.key)
-        .version_id(&object.version)
-        .legal_hold(hold)
-        .send()
-        .await
-        .expect_err("managed LegalHold must reach and fail its unsupported metadata write");
-    let service = error.as_service_error().ok_or("legal hold was not a service rejection")?;
-    assert_eq!(service.code(), Some("InternalError"));
-    assert_eq!(service.message(), Some("Io error: artifact bucket does not support this write operation"));
-    assert!(physical_snapshot(dist, bucket)? == before, "legal hold changed managed metadata");
-    Ok(())
-}
-
-#[tokio::test]
-async fn four_node_artifact_writes_seal_first_partial_retry_offline_and_restart() -> TestResult {
-    init_logging();
-    let mut dist = DistCluster::start(DistLayout::FourNodeFourDisk).await?;
-    let ordinary = unique_bucket("writes-control");
-    dist.create_bucket(&ordinary).await?;
-    enable_versioning(&dist.client(0)?, &ordinary).await?;
-    let (fresh, fresh_user) = create_artifact_attempt(&dist).await?;
-    let fresh_bucket = fresh["bucket"].as_str().ok_or("fresh bucket")?;
-    let fresh_prefix = fresh["attempt_prefix"].as_str().ok_or("fresh prefix")?;
-    let first = RepairObject::put(&dist, fresh_bucket, format!("{fresh_prefix}existing.bin")).await?;
-    lock_metadata_entrypoints(&dist, &fresh, &first, &ordinary).await?;
-    seal_writes(&dist, &fresh_user, &fresh, true).await?;
-    seal_writes(&dist, &fresh_user, &fresh, true).await?;
-    assert_put_closed(&dist, fresh_bucket, &format!("{fresh_prefix}closed.bin")).await?;
-
-    let (partial, partial_user) = create_artifact_attempt(&dist).await?;
-    let bucket = partial["bucket"].as_str().ok_or("partial bucket")?;
-    let prefix = partial["attempt_prefix"].as_str().ok_or("partial prefix")?;
-    let repaired = RepairObject::put(&dist, bucket, format!("{prefix}repair.bin")).await?;
-    // Enter the combined operation with only its ordinary domain closed.
-    confirm_seal(&dist, &partial_user, &json!({"version":1,"target":partial}).to_string(), &partial).await?;
-    let part = repaired.part(Path::new(&dist.cluster.nodes[3].data_dirs[0]), bucket, 3)?;
-    std::fs::remove_file(&part)?;
-    let token = start_heal(&dist, bucket, &repaired.key, false).await?;
-    repaired.assert_repaired(&dist, bucket).await?;
-    finish_heal(&dist, &token, None).await?;
-    for _ in 0..2 {
-        dist.cluster.stop_node(3)?;
-        seal_writes(&dist, &partial_user, &partial, false).await?;
-        dist.cluster.start_node(3).await?;
-        wait_for_ready(&dist.cluster).await?;
-        seal_writes(&dist, &partial_user, &partial, true).await?;
-    }
-    let ordinary_object = RepairObject::put(&dist, &ordinary, "repair-control.bin".to_owned()).await?;
-    for restarted in [false, true] {
-        if restarted {
-            dist.restart_with_current_binary().await?;
-        }
-        seal_writes(&dist, &partial_user, &partial, true).await?;
-        assert_put_closed(&dist, bucket, &format!("{prefix}closed-{restarted}.bin")).await?;
-        if part.exists() {
-            std::fs::remove_file(&part)?;
-        }
-        let before = physical_snapshot(&dist, bucket)?;
-        let token = start_heal(&dist, bucket, &repaired.key, false).await?;
-        finish_heal(&dist, &token, Some(&repaired.key)).await?;
-        assert!(!part.exists(), "combined seal admitted a remote repair publication");
-        assert!(physical_snapshot(&dist, bucket)? == before, "rejected repair changed metadata or shards");
-        assert_exact_version(&dist.client(2)?, bucket, &repaired.key, &repaired.version, &repaired.body).await?;
-        let ordinary_part = ordinary_object.part(Path::new(&dist.cluster.nodes[3].data_dirs[0]), &ordinary, 3)?;
-        std::fs::remove_file(ordinary_part)?;
-        let token = start_heal(&dist, &ordinary, &ordinary_object.key, false).await?;
-        ordinary_object.assert_repaired(&dist, &ordinary).await?;
-        finish_heal(&dist, &token, None).await?;
-    }
-    Ok(())
-}

crates/e2e_test/src/distributed/mod.rs

@@ -18,13 +18,6 @@
 //! `.github/workflows/e2e-distributed.yml`. Excluded from `e2e-full` because
 //! each case starts four real `rustfs` processes.
 
-mod artifact_delete_test;
-mod artifact_inventory_test;
-mod artifact_put_tail_test;
-mod artifact_repair_tail_test;
-mod artifact_repair_test;
-mod artifact_seal_test;
-mod artifact_writes_test;
 mod chaos_test;
 mod concurrency_stability_test;
 mod concurrent_data_movement_test;

crates/e2e_test/src/distributed/multipart_fence_acceptance_test.rs

@@ -162,12 +162,7 @@ where
                     || error.as_service_error()?.meta().code() != Some("ServiceUnavailable")
                     || !matches!(
                         response.headers().get("x-rustfs-error-cause"),
-                        Some(
-                            "namespace_lock_timeout"
-                                | "namespace_lock_unavailable"
-                                | "storage_write_quorum"
-                                | "storage_read_quorum"
-                        )
+                        Some("namespace_lock_timeout" | "namespace_lock_unavailable" | "storage_write_quorum")
                     )
                 {
                     return None;
@@ -382,42 +377,6 @@ async fn wait_for_lock_peer_recovery(proxies: &[RpcFaultProxy], client: &Client,
     .await
 }
 
-async fn wait_for_storage_peer_recovery(
-    proxies: &[RpcFaultProxy],
-    client: &Client,
-    bucket: &str,
-    upload: &str,
-    drives_per_node: usize,
-) -> TestResult {
-    let scope = upload_scope(upload)?;
-    tokio::time::timeout(
-        DEADLINE,
-        wait_until(
-            DEADLINE,
-            || async {
-                let observers = proxies[1..]
-                    .iter()
-                    .map(|proxy| proxy.pause(&["ReadVersion"], usize::MAX, Some(&scope)))
-                    .collect::<Result<Vec<_>, _>>()?;
-                for observer in &observers {
-                    observer.release();
-                }
-                // A fresh absent key forces a full metadata read without mutating
-                // this upload. Count distinct configured disk routes, not retries
-                // from the same healthy disk or just lock-RPC reachability.
-                let key = format!("storage-ready-{}", uuid::Uuid::new_v4());
-                let _ = client.list_parts().bucket(bucket).key(key).upload_id(upload).send().await;
-                Ok(observers
-                    .iter()
-                    .all(|observer| observer.forwarded_routes() >= drives_per_node))
-            },
-            "all storage disk routes recover after fault retirement",
-        ),
-    )
-    .await
-    .map_err(|_| "storage route recovery deadline exceeded".to_string())?
-}
-
 async fn phase_quorum_matrix(
     proxies: &[RpcFaultProxy],
     clients: &[Client],
@@ -458,9 +417,7 @@ async fn phase_quorum_matrix(
                 let request = clients[0].create_multipart_upload().bucket(bucket).key(&key);
                 let result = with_paused_peers(proxies, methods, &limits, bucket, async move { request.send().await }).await?;
                 if let Some(upload) = quorum_outcome(result, unavailable == unavailable_at_quorum, locks)? {
-                    let upload_id = upload.upload_id().ok_or("missing upload ID")?;
-                    wait_for_storage_peer_recovery(proxies, &clients[0], bucket, upload_id, drives_per_node).await?;
-                    abort_after_fault(&clients[0], bucket, &key, upload_id, false).await?;
+                    abort_after_fault(&clients[0], bucket, &key, upload.upload_id().ok_or("missing upload ID")?, false).await?;
                 }
             } else {
                 let upload = clients[0]
@@ -563,11 +520,9 @@ async fn phase_quorum_matrix(
                     }
                     _ => unreachable!(),
                 }
-                wait_for_storage_peer_recovery(proxies, &clients[0], bucket, upload_id, drives_per_node).await?;
-                // A rejected Complete must retain authority for ordinary
-                // Abort. NoSuchUpload must not hide partial staging loss.
-                let allow_missing = phase != "complete" || unavailable == unavailable_at_quorum;
-                abort_after_fault(&clients[0], bucket, &key, upload_id, allow_missing).await?;
+                // Cleanup must recover even after a below-quorum mutation;
+                // only an already retired session may return NoSuchUpload.
+                abort_after_fault(&clients[0], bucket, &key, upload_id, true).await?;
                 recover_after_fault(&format!("DeleteObject {key} after {phase}"), || {
                     clients[0].delete_object().bucket(bucket).key(&key).send()
                 })

crates/e2e_test/src/dual_stack_differential/compare.rs

@@ -0,0 +1,512 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! What one stack answered, and how two answers are compared.
+//!
+//! An [`Observation`] keeps only what a client acts on: the HTTP status, the S3 error code, the
+//! allowlisted response headers and a few typed fields decoded from the response. The error
+//! message is kept for diagnostics and never compared: message wording is judged by the wire
+//! corpus, not here. The comparator is pure so it can be tested without a server.
+
+use serde::Serialize;
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Path, PathBuf};
+
+/// Response headers compared exactly (after [`normalized_header_value`]).
+const HEADER_ALLOWLIST: [&str; 7] = [
+    "content-type",
+    "x-amz-version-id",
+    "etag",
+    "x-amz-delete-marker",
+    "content-range",
+    "accept-ranges",
+    "x-amz-request-charged",
+];
+
+/// Every response header with this prefix is compared as well.
+const HEADER_ALLOWLIST_PREFIX: &str = "x-amz-server-side-encryption";
+
+/// Placeholder for a field one side did not send.
+const ABSENT: &str = "<absent>";
+
+/// The lowercase header name if the comparator looks at this header.
+pub(crate) fn compared_header(name: &str) -> Option<String> {
+    let name = name.to_ascii_lowercase();
+    (HEADER_ALLOWLIST.contains(&name.as_str()) || name.starts_with(HEADER_ALLOWLIST_PREFIX)).then_some(name)
+}
+
+/// A version ID is minted per process, so its value never matches across two servers; only
+/// whether it is the literal `null` (an unversioned write) carries meaning.
+fn normalized_header_value(name: &str, value: &str) -> String {
+    if name == "x-amz-version-id" && value != "null" {
+        "<version-id>".to_owned()
+    } else {
+        value.to_owned()
+    }
+}
+
+/// One request's outcome as a client sees it.
+#[derive(Clone, Debug, Serialize)]
+pub(crate) struct Observation {
+    /// The S3 operation, named as in the `s3s::S3` trait (`GetObject`).
+    pub op: &'static str,
+    /// Which request of the script this was (`normal`, `negative`, or a setup label).
+    pub case: &'static str,
+    /// HTTP status; 0 when no response arrived.
+    pub status: u16,
+    /// The S3 error code, or the SDK's error kind when there was no service error.
+    pub error_code: Option<String>,
+    /// Allowlisted headers only, lowercase names, normalized values.
+    pub headers: BTreeMap<String, String>,
+    /// Typed values decoded from the response body, never free text.
+    pub fields: BTreeMap<String, String>,
+    /// Diagnostic only; never compared.
+    #[serde(skip)]
+    pub message: Option<String>,
+}
+
+impl Observation {
+    /// Builds an observation, keeping only the allowlisted headers.
+    pub(crate) fn new<'h>(
+        op: &'static str,
+        case: &'static str,
+        status: u16,
+        error_code: Option<String>,
+        headers: impl IntoIterator<Item = (&'h str, &'h str)>,
+    ) -> Self {
+        let headers = headers
+            .into_iter()
+            .filter_map(|(name, value)| compared_header(name).map(|name| (name, value)))
+            .map(|(name, value)| {
+                let value = normalized_header_value(&name, value);
+                (name, value)
+            })
+            .collect();
+        Self {
+            op,
+            case,
+            status,
+            error_code,
+            headers,
+            fields: BTreeMap::new(),
+            message: None,
+        }
+    }
+
+    pub(crate) fn with_field(mut self, name: &str, value: impl Into<String>) -> Self {
+        self.fields.insert(name.to_owned(), value.into());
+        self
+    }
+
+    pub(crate) fn is_success(&self) -> bool {
+        (200..300).contains(&self.status)
+    }
+}
+
+/// One field on which the two stacks answered differently.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+pub(crate) struct Difference {
+    pub op: String,
+    pub case: String,
+    pub field: String,
+    pub a: String,
+    pub b: String,
+}
+
+/// Every difference between two transcripts of the same script, matched by `(op, case)`.
+pub(crate) fn compare(a: &[Observation], b: &[Observation]) -> Vec<Difference> {
+    let mut differences = Vec::new();
+    let (index_a, duplicates_a) = index(a);
+    let (index_b, duplicates_b) = index(b);
+    for (op, case) in duplicates_a.union(&duplicates_b) {
+        let count = |side: &[Observation]| {
+            side.iter()
+                .filter(|observation| (observation.op, observation.case) == (*op, *case))
+                .count()
+                .to_string()
+        };
+        differences.push(difference(op, case, "duplicate_case", count(a), count(b)));
+    }
+    let keys: BTreeSet<_> = index_a.keys().chain(index_b.keys()).copied().collect();
+    for key @ (op, case) in keys {
+        match (index_a.get(&key), index_b.get(&key)) {
+            (Some(a), Some(b)) => compare_one(a, b, &mut differences),
+            (a, b) => {
+                let presence = |side: Option<&&Observation>| if side.is_some() { "present" } else { ABSENT }.to_owned();
+                differences.push(difference(op, case, "observation", presence(a), presence(b)));
+            }
+        }
+    }
+    differences
+}
+
+type Key = (&'static str, &'static str);
+
+fn index(side: &[Observation]) -> (BTreeMap<Key, &Observation>, BTreeSet<Key>) {
+    let mut index = BTreeMap::new();
+    let mut duplicates = BTreeSet::new();
+    for observation in side {
+        let key = (observation.op, observation.case);
+        if index.insert(key, observation).is_some() {
+            duplicates.insert(key);
+        }
+    }
+    (index, duplicates)
+}
+
+fn difference(op: &str, case: &str, field: &str, a: String, b: String) -> Difference {
+    Difference {
+        op: op.to_owned(),
+        case: case.to_owned(),
+        field: field.to_owned(),
+        a,
+        b,
+    }
+}
+
+fn compare_one(a: &Observation, b: &Observation, differences: &mut Vec<Difference>) {
+    let mut field = |name: String, value_a: Option<&str>, value_b: Option<&str>| {
+        if value_a != value_b {
+            let show = |value: Option<&str>| value.unwrap_or(ABSENT).to_owned();
+            differences.push(difference(a.op, a.case, &name, show(value_a), show(value_b)));
+        }
+    };
+    field(
+        "status".to_owned(),
+        Some(a.status.to_string().as_str()),
+        Some(b.status.to_string().as_str()),
+    );
+    field("error_code".to_owned(), a.error_code.as_deref(), b.error_code.as_deref());
+    let headers: BTreeSet<_> = a.headers.keys().chain(b.headers.keys()).collect();
+    for name in headers {
+        field(
+            format!("header.{name}"),
+            a.headers.get(name).map(String::as_str),
+            b.headers.get(name).map(String::as_str),
+        );
+    }
+    let fields: BTreeSet<_> = a.fields.keys().chain(b.fields.keys()).collect();
+    for name in fields {
+        field(
+            format!("body.{name}"),
+            a.fields.get(name).map(String::as_str),
+            b.fields.get(name).map(String::as_str),
+        );
+    }
+}
+
+/// Operations observed on both sides.
+pub(crate) fn compared_ops(a: &[Observation], b: &[Observation]) -> BTreeSet<&'static str> {
+    let ops_b: BTreeSet<_> = b.iter().map(|observation| observation.op).collect();
+    a.iter()
+        .map(|observation| observation.op)
+        .filter(|op| ops_b.contains(op))
+        .collect()
+}
+
+/// `(op, case)` pairs observed on both sides.
+pub(crate) fn compared_cases(a: &[Observation], b: &[Observation]) -> usize {
+    let cases_b: BTreeSet<_> = b.iter().map(|observation| (observation.op, observation.case)).collect();
+    a.iter()
+        .map(|observation| (observation.op, observation.case))
+        .collect::<BTreeSet<_>>()
+        .intersection(&cases_b)
+        .count()
+}
+
+/// The JSON report written for every run.
+#[derive(Debug, Serialize)]
+pub(crate) struct Report {
+    pub schema: u32,
+    pub run: String,
+    pub stack_a: String,
+    pub stack_b: String,
+    pub region_a: Option<String>,
+    pub region_b: Option<String>,
+    pub compared_ops: usize,
+    pub compared_cases: usize,
+    pub differences: Vec<Difference>,
+}
+
+impl Report {
+    /// Writes the report as `<directory>/<run>.json` and returns its path.
+    pub(crate) fn write_to(&self, directory: &Path) -> std::io::Result<PathBuf> {
+        std::fs::create_dir_all(directory)?;
+        let path = directory.join(format!("{}.json", self.run));
+        let json = serde_json::to_vec_pretty(self).map_err(std::io::Error::other)?;
+        std::fs::write(&path, json)?;
+        Ok(path)
+    }
+}
+
+/// One line per difference, for a failing assertion.
+pub(crate) fn render(differences: &[Difference]) -> String {
+    differences
+        .iter()
+        .map(|d| format!("({}, {}, {}, a={:?}, b={:?})", d.op, d.case, d.field, d.a, d.b))
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn ok(op: &'static str) -> Observation {
+        Observation::new(op, "normal", 200, None, [("content-type", "application/xml")])
+    }
+
+    fn fields(differences: &[Difference]) -> Vec<&str> {
+        differences.iter().map(|d| d.field.as_str()).collect()
+    }
+
+    #[test]
+    fn identical_transcripts_have_no_difference() {
+        let a = vec![
+            ok("HeadBucket"),
+            ok("GetBucketLocation").with_field("location_constraint", "us-east-1"),
+        ];
+        let b = a.clone();
+        assert_eq!(compare(&a, &b), Vec::new());
+        assert_eq!(compared_ops(&a, &b).len(), 2);
+    }
+
+    #[test]
+    fn a_status_difference_is_reported() {
+        let a = vec![ok("PutBucketAcl")];
+        let b = vec![Observation::new(
+            "PutBucketAcl",
+            "normal",
+            403,
+            None,
+            [("content-type", "application/xml")],
+        )];
+        assert_eq!(
+            compare(&a, &b),
+            vec![Difference {
+                op: "PutBucketAcl".into(),
+                case: "normal".into(),
+                field: "status".into(),
+                a: "200".into(),
+                b: "403".into(),
+            }]
+        );
+    }
+
+    #[test]
+    fn an_error_code_difference_is_reported() {
+        let a = vec![Observation::new("GetObject", "negative", 404, Some("NoSuchKey".into()), [])];
+        let b = vec![Observation::new(
+            "GetObject",
+            "negative",
+            404,
+            Some("NoSuchBucket".into()),
+            [],
+        )];
+        let differences = compare(&a, &b);
+        assert_eq!(fields(&differences), ["error_code"]);
+        assert_eq!((differences[0].a.as_str(), differences[0].b.as_str()), ("NoSuchKey", "NoSuchBucket"));
+    }
+
+    #[test]
+    fn an_error_code_on_one_side_only_is_reported() {
+        let a = vec![Observation::new("HeadBucket", "negative", 404, Some("NotFound".into()), [])];
+        let b = vec![Observation::new("HeadBucket", "negative", 404, None, [])];
+        let differences = compare(&a, &b);
+        assert_eq!(fields(&differences), ["error_code"]);
+        assert_eq!(differences[0].b, ABSENT);
+    }
+
+    #[test]
+    fn an_allowlisted_header_difference_is_reported() {
+        let a = vec![Observation::new("HeadObject", "normal", 200, None, [("ETag", "\"aa\"")])];
+        let b = vec![Observation::new("HeadObject", "normal", 200, None, [("etag", "\"bb\"")])];
+        assert_eq!(fields(&compare(&a, &b)), ["header.etag"]);
+    }
+
+    #[test]
+    fn a_header_sent_by_one_side_only_is_reported() {
+        let a = vec![Observation::new(
+            "DeleteObject",
+            "normal",
+            204,
+            None,
+            [("x-amz-delete-marker", "true")],
+        )];
+        let b = vec![Observation::new("DeleteObject", "normal", 204, None, [])];
+        let differences = compare(&a, &b);
+        assert_eq!(fields(&differences), ["header.x-amz-delete-marker"]);
+        assert_eq!((differences[0].a.as_str(), differences[0].b.as_str()), ("true", ABSENT));
+    }
+
+    #[test]
+    fn every_server_side_encryption_header_is_compared() {
+        let header = "x-amz-server-side-encryption-customer-key-md5";
+        let a = vec![Observation::new("PutObject", "sse-c", 200, None, [(header, "one")])];
+        let b = vec![Observation::new("PutObject", "sse-c", 200, None, [(header, "two")])];
+        assert_eq!(fields(&compare(&a, &b)), [format!("header.{header}")]);
+    }
+
+    #[test]
+    fn headers_outside_the_allowlist_are_not_compared() {
+        let a = vec![Observation::new(
+            "ListBuckets",
+            "normal",
+            200,
+            None,
+            [
+                ("date", "Mon"),
+                ("x-amz-request-id", "1"),
+                ("server", "a"),
+                ("content-length", "10"),
+            ],
+        )];
+        let b = vec![Observation::new(
+            "ListBuckets",
+            "normal",
+            200,
+            None,
+            [
+                ("date", "Tue"),
+                ("x-amz-request-id", "2"),
+                ("server", "b"),
+                ("content-length", "11"),
+            ],
+        )];
+        assert_eq!(compare(&a, &b), Vec::new());
+        assert!(a[0].headers.is_empty(), "non-allowlisted headers were kept: {:?}", a[0].headers);
+    }
+
+    #[test]
+    fn distinct_version_ids_are_not_a_difference() {
+        let a = vec![Observation::new(
+            "PutObject",
+            "normal",
+            200,
+            None,
+            [("x-amz-version-id", "0b1c")],
+        )];
+        let b = vec![Observation::new(
+            "PutObject",
+            "normal",
+            200,
+            None,
+            [("x-amz-version-id", "9f8e")],
+        )];
+        assert_eq!(compare(&a, &b), Vec::new());
+    }
+
+    #[test]
+    fn a_null_version_id_against_a_real_one_is_reported() {
+        let a = vec![Observation::new(
+            "PutObject",
+            "normal",
+            200,
+            None,
+            [("x-amz-version-id", "null")],
+        )];
+        let b = vec![Observation::new(
+            "PutObject",
+            "normal",
+            200,
+            None,
+            [("x-amz-version-id", "9f8e")],
+        )];
+        assert_eq!(fields(&compare(&a, &b)), ["header.x-amz-version-id"]);
+    }
+
+    #[test]
+    fn a_body_field_difference_is_reported() {
+        let a = vec![ok("GetBucketLocation").with_field("location_constraint", "us-east-1")];
+        let b = vec![ok("GetBucketLocation").with_field("location_constraint", "eu-west-1")];
+        let differences = compare(&a, &b);
+        assert_eq!(fields(&differences), ["body.location_constraint"]);
+        assert_eq!((differences[0].a.as_str(), differences[0].b.as_str()), ("us-east-1", "eu-west-1"));
+    }
+
+    #[test]
+    fn a_body_field_on_one_side_only_is_reported() {
+        let a = vec![ok("ListObjectsV2").with_field("keys", "[]")];
+        let b = vec![ok("ListObjectsV2")];
+        assert_eq!(fields(&compare(&a, &b)), ["body.keys"]);
+    }
+
+    #[test]
+    fn error_messages_are_never_compared() {
+        let mut a = Observation::new("GetObject", "negative", 404, Some("NoSuchKey".into()), []);
+        let mut b = a.clone();
+        a.message = Some("The specified key does not exist.".into());
+        b.message = Some("Object not found".into());
+        assert_eq!(compare(&[a], &[b]), Vec::new());
+    }
+
+    #[test]
+    fn a_case_observed_on_one_side_only_is_reported() {
+        let a = vec![ok("HeadBucket"), ok("ListBuckets")];
+        let b = vec![ok("HeadBucket")];
+        let differences = compare(&a, &b);
+        assert_eq!(fields(&differences), ["observation"]);
+        assert_eq!(differences[0].op, "ListBuckets");
+        assert_eq!(compared_ops(&a, &b).into_iter().collect::<Vec<_>>(), ["HeadBucket"]);
+    }
+
+    #[test]
+    fn a_case_recorded_twice_is_reported() {
+        let a = vec![ok("HeadBucket"), ok("HeadBucket")];
+        let b = vec![ok("HeadBucket")];
+        assert_eq!(fields(&compare(&a, &b)), ["duplicate_case"]);
+    }
+
+    #[test]
+    fn compared_ops_counts_operations_not_cases() {
+        let negative = Observation::new("HeadBucket", "negative", 404, Some("NotFound".into()), []);
+        let a = vec![ok("HeadBucket"), negative, ok("ListBuckets")];
+        let b = a.clone();
+        assert_eq!(compared_ops(&a, &b).len(), 2);
+    }
+
+    #[test]
+    fn the_report_lists_each_difference_as_op_field_a_b() {
+        let directory = std::env::temp_dir().join(format!("dual-stack-report-{}", uuid::Uuid::new_v4()));
+        let report = Report {
+            schema: 1,
+            run: "unit".into(),
+            stack_a: "legacy".into(),
+            stack_b: "legacy".into(),
+            region_a: None,
+            region_b: Some("eu-west-1".into()),
+            compared_ops: 1,
+            compared_cases: 1,
+            differences: compare(
+                &[ok("GetBucketLocation").with_field("location_constraint", "us-east-1")],
+                &[ok("GetBucketLocation").with_field("location_constraint", "eu-west-1")],
+            ),
+        };
+        let path = report.write_to(&directory).expect("write the report");
+        let json: serde_json::Value = serde_json::from_slice(&std::fs::read(&path).expect("read the report")).expect("parse");
+        let _ = std::fs::remove_dir_all(&directory);
+        assert_eq!(path.file_name().and_then(|name| name.to_str()), Some("unit.json"));
+        assert_eq!(json["compared_ops"], 1);
+        assert_eq!(
+            json["differences"],
+            serde_json::json!([{
+                "op": "GetBucketLocation",
+                "case": "normal",
+                "field": "body.location_constraint",
+                "a": "us-east-1",
+                "b": "eu-west-1",
+            }])
+        );
+    }
+}

crates/e2e_test/src/dual_stack_differential/mod.rs

@@ -0,0 +1,199 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Dual-stack differential: one `rustfs` binary, two processes, one SDK script (rustfs/backlog#2740).
+//!
+//! Stack A always runs `RUSTFS_S3_STACK=legacy`. Stack B runs the value of `RUSTFS_E2E_STACK_B`
+//! (default `legacy` until the gateway stack is assembled), and `RUSTFS_E2E_STACK_B_REGION`, when
+//! set, starts B in another region so that a difference can be injected by hand. Both servers
+//! answer the script in `scenarios`, which covers every operation of `impl S3 for FS`; `compare`
+//! reports each `(op, field, a, b)` on which the answers differ, and every run writes its report
+//! to `<target>/dual-stack/<run>.json`. Two processes, not two embedded servers: bucket metadata
+//! is process-global, so two stacks in one process would read each other's buckets.
+
+mod compare;
+mod scenarios;
+
+use crate::common::{RustFSTestEnvironment, init_logging, workspace_root};
+use compare::{Difference, Observation, Report, compare, compared_cases, compared_ops, render};
+use std::path::PathBuf;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+type BoxError = Box<dyn std::error::Error + Send + Sync>;
+
+const STACK_A: &str = "legacy";
+const ENV_STACK_B: &str = "RUSTFS_E2E_STACK_B";
+const ENV_STACK_B_REGION: &str = "RUSTFS_E2E_STACK_B_REGION";
+/// Becomes `gateway` once rustfs/backlog#2734 T2.5 assembles the gateway stack.
+const DEFAULT_STACK_B: &str = "legacy";
+/// The region the negative control gives stack A explicitly, so an inherited `RUSTFS_REGION`
+/// cannot erase the injected difference. Not `us-east-1`: that region answers GetBucketLocation
+/// with an empty LocationConstraint and re-creating an owned bucket with 200, so it would not
+/// report its own name and would add CreateBucket differences to the control.
+const CONTROL_REGION_A: &str = "us-west-2";
+const CONTROL_REGION_B: &str = "eu-west-1";
+/// `normal` cases the legacy stack must answer with a 2xx. The comparison alone cannot tell a
+/// script that exercises real behavior from one in which both stacks fail the same way. Five of
+/// the 73 fail on legacy by design of this script: PutBucketReplication (no registered remote
+/// target), GetBucketReplication (so no configuration), PutBucketNotificationConfiguration (no
+/// notification target configured), RestoreObject (the object is not archived) and
+/// GetObjectTorrent (legacy answers `NoSuchKey`).
+const MIN_NORMAL_SUCCESSES: usize = 68;
+
+struct PairConfig {
+    stack_b: String,
+    region_a: Option<String>,
+    region_b: Option<String>,
+}
+
+impl PairConfig {
+    fn from_env() -> Self {
+        Self {
+            stack_b: std::env::var(ENV_STACK_B).unwrap_or_else(|_| DEFAULT_STACK_B.to_owned()),
+            region_a: None,
+            region_b: std::env::var(ENV_STACK_B_REGION).ok(),
+        }
+    }
+}
+
+/// Starts one server on `stack`, overriding its region only when asked.
+async fn start_stack(stack: &str, region: Option<&str>) -> Result<RustFSTestEnvironment, BoxError> {
+    let mut env = RustFSTestEnvironment::new().await?;
+    let mut vars = vec![("RUSTFS_S3_STACK", stack)];
+    if let Some(region) = region {
+        vars.push(("RUSTFS_REGION", region));
+    }
+    env.start_rustfs_server_without_cleanup_with_env(&vars).await?;
+    Ok(env)
+}
+
+/// Starts stack A and stack B side by side, each with its own port and data directory.
+async fn spawn_pair(config: &PairConfig) -> Result<(RustFSTestEnvironment, RustFSTestEnvironment), BoxError> {
+    tokio::try_join!(
+        start_stack(STACK_A, config.region_a.as_deref()),
+        start_stack(&config.stack_b, config.region_b.as_deref())
+    )
+}
+
+fn report_directory() -> PathBuf {
+    let target = std::env::var_os("CARGO_TARGET_DIR").map_or_else(|| PathBuf::from("target"), PathBuf::from);
+    let target = if target.is_absolute() {
+        target
+    } else {
+        workspace_root().join(target)
+    };
+    target.join("dual-stack")
+}
+
+struct Run {
+    report: Report,
+    path: PathBuf,
+    a: Vec<Observation>,
+}
+
+/// Runs the script against both stacks concurrently and writes the report.
+async fn run_differential(label: &str, config: &PairConfig) -> Run {
+    let (server_a, server_b) = spawn_pair(config).await.expect("start stack A and stack B");
+    let (a, b) = tokio::join!(Box::pin(scenarios::run(&server_a)), Box::pin(scenarios::run(&server_b)));
+    let millis = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |elapsed| elapsed.as_millis());
+    let report = Report {
+        schema: 1,
+        run: format!("{label}-{millis}-{}", std::process::id()),
+        stack_a: STACK_A.to_owned(),
+        stack_b: config.stack_b.clone(),
+        region_a: config.region_a.clone(),
+        region_b: config.region_b.clone(),
+        compared_ops: compared_ops(&a, &b).len(),
+        compared_cases: compared_cases(&a, &b),
+        differences: compare(&a, &b),
+    };
+    let path = report.write_to(&report_directory()).expect("write the dual-stack report");
+    Run { report, path, a }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn both_stacks_answer_every_operation_identically() {
+        init_logging();
+        let config = PairConfig::from_env();
+        let run = run_differential("self-comparison", &config).await;
+        let report = &run.report;
+
+        let mut observed: Vec<_> = run.a.iter().map(|observation| observation.op).collect();
+        observed.sort_unstable();
+        observed.dedup();
+        assert_eq!(
+            observed,
+            scenarios::OPERATIONS,
+            "the script must drive exactly the operations of impl S3 for FS"
+        );
+        assert_eq!(report.compared_ops, scenarios::OPERATIONS.len(), "report: {}", run.path.display());
+        assert!(
+            report.differences.is_empty(),
+            "stack {} and stack {} differ on {} of {} cases (report: {}):\n{}",
+            report.stack_a,
+            report.stack_b,
+            report.differences.len(),
+            report.compared_cases,
+            run.path.display(),
+            render(&report.differences)
+        );
+
+        let not_4xx: Vec<_> = run
+            .a
+            .iter()
+            .filter(|observation| observation.case == "negative" && !(400..500).contains(&observation.status))
+            .collect();
+        assert!(not_4xx.is_empty(), "negative cases must fail with a 4xx on {STACK_A}: {not_4xx:#?}");
+        let successes = run
+            .a
+            .iter()
+            .filter(|observation| observation.case == "normal" && observation.is_success())
+            .count();
+        assert!(
+            successes >= MIN_NORMAL_SUCCESSES,
+            "only {successes} normal cases succeeded on {STACK_A}: {:#?}",
+            run.a
+        );
+    }
+
+    #[tokio::test]
+    async fn differential_detects_an_injected_difference() {
+        init_logging();
+        let config = PairConfig {
+            stack_b: STACK_A.to_owned(),
+            region_a: Some(CONTROL_REGION_A.to_owned()),
+            region_b: Some(CONTROL_REGION_B.to_owned()),
+        };
+        let run = run_differential("injected-region", &config).await;
+        let expected = Difference {
+            op: "GetBucketLocation".to_owned(),
+            case: "normal".to_owned(),
+            field: "body.location_constraint".to_owned(),
+            a: CONTROL_REGION_A.to_owned(),
+            b: CONTROL_REGION_B.to_owned(),
+        };
+        assert!(
+            run.report.differences.contains(&expected),
+            "B started in {CONTROL_REGION_B} but GetBucketLocation was not reported (report: {}):\n{}",
+            run.path.display(),
+            render(&run.report.differences)
+        );
+    }
+}

crates/e2e_test/src/heal_erasure_disk_rebuild_test.rs

@@ -1206,9 +1206,7 @@ mod tests {
         let interval = interval
             .filter(|interval| *interval != 0)
             .ok_or("scanner schedule has no positive interval")?;
-        // A new leader may already be sleeping before completing its first cycle.
-        let schedule_start = if cycle_end == 0 { now } else { cycle_end };
-        let next_cycle = schedule_start
+        let next_cycle = cycle_end
             .checked_add(interval)
             .ok_or("scanner schedule timestamp overflows")?;
         let budget = next_cycle
@@ -1225,11 +1223,6 @@ mod tests {
             Ok(Duration::from_secs(259)),
         );
         assert_eq!(scanner_cycle_completion_budget(100, Some(1), 110, false), Ok(Duration::from_secs(60)));
-        // A newly elected leader can advertise a sleep before its first completed cycle.
-        assert_eq!(
-            scanner_cycle_completion_budget(0, Some(289), 1_792_913_211, false),
-            Ok(Duration::from_secs(349)),
-        );
     }
 
     #[test]
@@ -1250,7 +1243,7 @@ mod tests {
         previous_cycle_end: u64,
     ) -> Result<u64, Box<dyn Error + Send + Sync>> {
         let mut deadline = Instant::now() + Duration::from_secs(60);
-        let mut accounted_schedules = HashSet::new();
+        let mut schedule_accounted = false;
         loop {
             let mut latest_cycle_end = 0;
             let mut versions_observed = false;
@@ -1297,27 +1290,15 @@ mod tests {
                     return Err("scanner cycle timestamp is in the future".into());
                 }
                 let schedule = &status["cycle_schedule"];
-                if schedule["execution_role"].as_str() == Some("leader") {
+                if !schedule_accounted && schedule["execution_role"].as_str() == Some("leader") {
                     let active = metrics["current_cycle_active"]
                         .as_bool()
                         .ok_or("scanner status is missing its active-cycle flag")?;
-                    if active || schedule["effective_interval_available"].as_bool() == Some(true) {
-                        let interval = if active {
-                            None
-                        } else {
-                            Some(
-                                schedule["effective_interval_seconds"]
-                                    .as_u64()
-                                    .ok_or("scanner schedule is missing its effective interval")?,
-                            )
-                        };
-                        // Reconsider a changed leader or retry plan, but never renew
-                        // the deadline on repeated observations of the same sleep.
-                        if accounted_schedules.insert((node_index, cycle_end, interval)) {
-                            let budget = scanner_cycle_completion_budget(cycle_end, interval, now, active)?;
-                            let scheduled_deadline = Instant::now().checked_add(budget).ok_or("scanner deadline overflows")?;
-                            deadline = deadline.max(scheduled_deadline);
-                        }
+                    if active || (cycle_end != 0 && schedule["effective_interval_available"].as_bool() == Some(true)) {
+                        let interval = schedule["effective_interval_seconds"].as_u64();
+                        let budget = scanner_cycle_completion_budget(cycle_end, interval, now, active)?;
+                        deadline = Instant::now().checked_add(budget).ok_or("scanner deadline overflows")?;
+                        schedule_accounted = true;
                     }
                 }
                 // Superseded walks complete all sets while withholding quota authority.

crates/e2e_test/src/lib.rs

@@ -31,6 +31,12 @@ pub mod chaos;
 #[cfg(test)]
 pub mod fake_s3_target;
 
+// Dual-stack differential (rustfs/backlog#2740): one binary, two processes on
+// different RUSTFS_S3_STACK values, the same SDK script for every S3 operation,
+// compared on status, error code, allowlisted headers and typed body fields.
+#[cfg(test)]
+mod dual_stack_differential;
+
 // On-demand migration (backlog#2147): shared two-server environment, admin
 // wrappers, and the harness self-test (backlog#2151). Behavior scenarios are
 // added by later ODM tasks.

crates/e2e_test/src/protocols/webdav_core.rs

@@ -32,7 +32,9 @@
 //! Advisory: <https://github.com/rustfs/rustfs/security/advisories/GHSA-3p3x-734c-h5vx>
 
 use crate::common::rustfs_binary_path_with_features;
-use crate::common::{AdminTransport, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via};
+use crate::common::{
+    AdminTransport, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via, signed_s3_request,
+};
 use crate::common::{FAST_DATA_USAGE_SCANNER_ENV, admin_request};
 use crate::protocols::test_env::{DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY, ProtocolTestEnvironment};
 use anyhow::Result;
@@ -774,6 +776,81 @@ async fn test_webdav_core_operations_direct() -> Result<()> {
     test_webdav_core_operations().await
 }
 
+#[tokio::test]
+async fn test_webdav_content_type_directory_marker() -> Result<()> {
+    let env = ProtocolTestEnvironment::new().map_err(|e| anyhow::anyhow!("{}", e))?;
+    let admin_base_url = format!("http://{}", S3_TEST_ADDRESS);
+    let binary_path = rustfs_binary_path_with_features(Some("webdav"));
+    let mut server_process = Command::new(&binary_path)
+        .arg("--address")
+        .arg(S3_TEST_ADDRESS)
+        .env("RUSTFS_CONSOLE_ENABLE", "false")
+        .env("RUSTFS_WEBDAV_ENABLE", "true")
+        .env("RUSTFS_WEBDAV_ADDRESS", WEBDAV_ADDRESS)
+        .env("RUSTFS_WEBDAV_TLS_ENABLED", "false")
+        .arg(&env.temp_dir)
+        .spawn()?;
+
+    let result = async {
+        ProtocolTestEnvironment::wait_for_port_ready(WEBDAV_PORT, 30)
+            .await
+            .map_err(|e| anyhow::anyhow!("{}", e))?;
+
+        let client = create_client();
+        let bucket_name = "webdav-content-type-bucket";
+        let directory_name = "content-type-directory";
+        let webdav_base_url = format!("http://{}", WEBDAV_ADDRESS);
+        let mkcol_bucket = client
+            .request(
+                reqwest::Method::from_bytes(b"MKCOL").expect("MKCOL is a valid HTTP method"),
+                format!("{}/{}", webdav_base_url, bucket_name),
+            )
+            .header("Authorization", basic_auth_header())
+            .send()
+            .await?;
+        anyhow::ensure!(
+            mkcol_bucket.status().is_success() || mkcol_bucket.status().as_u16() == 201,
+            "MKCOL bucket should succeed, got: {}",
+            mkcol_bucket.status()
+        );
+
+        let mkcol_directory = client
+            .request(
+                reqwest::Method::from_bytes(b"MKCOL").expect("MKCOL is a valid HTTP method"),
+                format!("{}/{}/{}", webdav_base_url, bucket_name, directory_name),
+            )
+            .header("Authorization", basic_auth_header())
+            .send()
+            .await?;
+        anyhow::ensure!(
+            mkcol_directory.status().is_success() || mkcol_directory.status().as_u16() == 201,
+            "MKCOL directory should succeed, got: {}",
+            mkcol_directory.status()
+        );
+
+        let head_url = format!("{}/{}/{}/", admin_base_url, bucket_name, directory_name);
+        let head = signed_s3_request(http::Method::HEAD, &head_url, None, None, DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY)
+            .await
+            .map_err(|error| anyhow::anyhow!("{error}"))?;
+        anyhow::ensure!(head.status().is_success(), "HEAD directory marker should succeed, got: {}", head.status());
+        let content_type = head
+            .headers()
+            .get("content-type")
+            .and_then(|value| value.to_str().ok())
+            .unwrap_or_default();
+        anyhow::ensure!(
+            content_type == "application/x-directory",
+            "WebDAV directory marker must preserve its content type, got: {content_type}"
+        );
+        Ok(())
+    }
+    .await;
+
+    let _ = server_process.kill().await;
+    let _ = server_process.wait().await;
+    result
+}
+
 /// Extract the numeric value of the first occurrence of a DAV property in a
 /// PROPFIND multistatus body. Namespace-prefix agnostic; a self-closing
 /// (unreported) property yields None.

crates/e2e_test/src/reliant/grpc_lock_server.rs

@@ -541,50 +541,6 @@ impl NodeService for MinimalLockNodeService {
         Err(Status::unimplemented("lock-only test server"))
     }
 
-    async fn artifact_rename_data(
-        &self,
-        _request: Request<rustfs_protos::proto_gen::node_service::RenameDataRequest>,
-    ) -> Result<Response<rustfs_protos::proto_gen::node_service::RenameDataResponse>, Status> {
-        Err(Status::unimplemented("lock-only test server"))
-    }
-
-    async fn artifact_repair_rename_data(
-        &self,
-        _request: Request<rustfs_protos::proto_gen::node_service::ArtifactRepairRenameDataRequest>,
-    ) -> Result<Response<rustfs_protos::proto_gen::node_service::RenameDataResponse>, Status> {
-        Err(Status::unimplemented("lock-only test server"))
-    }
-
-    async fn artifact_repair_write_metadata(
-        &self,
-        _request: Request<rustfs_protos::proto_gen::node_service::ArtifactRepairWriteMetadataRequest>,
-    ) -> Result<Response<rustfs_protos::proto_gen::node_service::WriteMetadataResponse>, Status> {
-        Err(Status::unimplemented("lock-only test server"))
-    }
-
-    type InventoryArtifactAttemptStream =
-        Pin<Box<dyn Stream<Item = Result<rustfs_protos::proto_gen::node_service::ArtifactInventoryFrame, Status>> + Send>>;
-    async fn inventory_artifact_attempt(
-        &self,
-        _request: Request<rustfs_protos::proto_gen::node_service::ArtifactInventoryRequest>,
-    ) -> Result<Response<Self::InventoryArtifactAttemptStream>, Status> {
-        Err(Status::unimplemented("lock-only test server"))
-    }
-
-    async fn seal_artifact_attempt_repairs(
-        &self,
-        _request: Request<rustfs_protos::proto_gen::node_service::SealArtifactAttemptPutsRequest>,
-    ) -> Result<Response<rustfs_protos::proto_gen::node_service::SealArtifactAttemptPutsResponse>, Status> {
-        Err(Status::unimplemented("lock-only test server"))
-    }
-
-    async fn seal_artifact_attempt_puts(
-        &self,
-        _request: Request<rustfs_protos::proto_gen::node_service::SealArtifactAttemptPutsRequest>,
-    ) -> Result<Response<rustfs_protos::proto_gen::node_service::SealArtifactAttemptPutsResponse>, Status> {
-        Err(Status::unimplemented("lock-only test server"))
-    }
-
     async fn rename_data(
         &self,
         _request: Request<rustfs_protos::proto_gen::node_service::RenameDataRequest>,

crates/e2e_test/src/rpc_fault_proxy.rs

@@ -23,9 +23,8 @@ use hyper_util::{
     server::conn::auto,
 };
 use prost::Message as _;
-use rustfs_protos::proto_gen::node_service::{DeleteRequest, ReadVersionRequest};
+use rustfs_protos::proto_gen::node_service::DeleteRequest;
 use std::{
-    collections::HashSet,
     io,
     net::SocketAddr,
     sync::{
@@ -57,7 +56,6 @@ struct PauseState {
     matched: AtomicUsize,
     blocked: AtomicUsize,
     forwarded: AtomicUsize,
-    forwarded_routes: Mutex<HashSet<String>>,
     reached: Notify,
     release: watch::Sender<Disposition>,
 }
@@ -79,10 +77,6 @@ impl RpcPause {
         self.state.forwarded.load(Ordering::SeqCst)
     }
 
-    pub(crate) fn forwarded_routes(&self) -> usize {
-        self.state.forwarded_routes.lock().expect("RPC route observations").len()
-    }
-
     pub(crate) async fn wait_for_hits(&self, count: usize) -> io::Result<()> {
         tokio::time::timeout(Duration::from_secs(20), async {
             loop {
@@ -192,7 +186,6 @@ impl RpcFaultProxy {
             matched: AtomicUsize::new(0),
             blocked: AtomicUsize::new(0),
             forwarded: AtomicUsize::new(0),
-            forwarded_routes: Mutex::new(HashSet::new()),
             reached: Notify::new(),
             release,
         });
@@ -204,23 +197,24 @@ impl RpcFaultProxy {
     }
 }
 
-fn unary_payload(body: &[u8]) -> io::Result<&[u8]> {
-    if body.len() < 5 || body[0] != 0 {
-        return Err(io::Error::new(io::ErrorKind::InvalidData, "scoped RPC needs an uncompressed unary frame"));
-    }
-    let mut encoded_length = [0; 4];
-    encoded_length.copy_from_slice(&body[1..5]);
-    if u32::try_from(body.len() - 5).ok() != Some(u32::from_be_bytes(encoded_length)) {
-        return Err(io::Error::new(io::ErrorKind::InvalidData, "scoped RPC frame length mismatch"));
-    }
-    Ok(&body[5..])
-}
-
 fn scope_matches(method: &str, body: &[u8], scope: &[u8]) -> io::Result<bool> {
     if method != "Delete" {
         return Ok(body.windows(scope.len()).any(|window| window == scope));
     }
-    let request = DeleteRequest::decode(unary_payload(body)?).map_err(io::Error::other)?;
+    // Abort's recursive root delete must not be confused with transaction or
+    // part cleanup below that root. This is a unary, uncompressed gRPC frame.
+    if body.len() < 5 || body[0] != 0 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            "scoped Delete needs an uncompressed unary frame",
+        ));
+    }
+    let mut encoded_length = [0; 4];
+    encoded_length.copy_from_slice(&body[1..5]);
+    if u32::try_from(body.len() - 5).ok() != Some(u32::from_be_bytes(encoded_length)) {
+        return Err(io::Error::new(io::ErrorKind::InvalidData, "scoped Delete frame length mismatch"));
+    }
+    let request = DeleteRequest::decode(&body[5..]).map_err(io::Error::other)?;
     let options: serde_json::Value = serde_json::from_str(&request.options).map_err(io::Error::other)?;
     Ok(request.volume == ".rustfs.sys/multipart"
         && request.path.trim_end_matches('/').as_bytes() == scope
@@ -239,22 +233,13 @@ async fn forward_request(
     if let Some(pause) = pause {
         let method = parts.uri.path().strip_prefix("/node_service.NodeService/");
         if let Some(method) = method.filter(|name| pause.methods.contains(name)) {
-            let mut route = None;
             let matches = if let Some(scope) = pause.scope.as_deref() {
-                // Inspect bounded control routing while preserving the exact
-                // signed bytes and trailers forwarded to the backend.
+                // Inspect bounded routing data while retaining the exact
+                // original bytes covered by the RPC signature.
                 let collected = Limited::new(body, 1024 * 1024).collect().await.map_err(io::Error::other)?;
                 let trailers = collected.trailers().cloned();
                 let bytes = collected.to_bytes();
                 let matches = scope_matches(method, &bytes, scope)?;
-                if matches && method == "ReadVersion" {
-                    let disk = ReadVersionRequest::decode(unary_payload(&bytes)?)
-                        .map_err(io::Error::other)?
-                        .disk;
-                    if !disk.is_empty() {
-                        route = Some(disk);
-                    }
-                }
                 body = Full::new(bytes)
                     .map_err(|never| match never {})
                     .with_trailers(async move { trailers.map(Ok::<_, io::Error>) })
@@ -279,7 +264,7 @@ async fn forward_request(
                 if disposition == Disposition::Discard {
                     return Err(io::Error::new(io::ErrorKind::ConnectionAborted, "injected RPC packet loss"));
                 }
-                observed = Some((pause, route));
+                observed = Some(pause);
             }
         }
     }
@@ -301,14 +286,11 @@ async fn forward_request(
         .request(Request::from_parts(parts, body))
         .await
         .map_err(io::Error::other)?;
-    if let Some((pause, route)) = observed
+    if let Some(pause) = observed
         && response.status().is_success()
         && response.headers().get("grpc-status").is_none_or(|status| status == "0")
     {
         pause.forwarded.fetch_add(1, Ordering::SeqCst);
-        if let Some(route) = route {
-            pause.forwarded_routes.lock().expect("RPC route observations").insert(route);
-        }
     }
     Ok(response)
 }
@@ -505,30 +487,6 @@ mod tests {
                 .expect("observer forwards without pausing");
             another.into_body().collect().await.expect("second body");
             assert_eq!(observer.forwarded(), 2);
-            drop(observer);
-            let routes = proxy
-                .pause(&["ReadVersion"], usize::MAX, Some("recovery-route"))
-                .expect("disk-route observer");
-            routes.release();
-            for (disk, expected) in [("drive-a", 1), ("drive-a", 1), ("drive-b", 2)] {
-                let request = ReadVersionRequest {
-                    disk: disk.to_owned(),
-                    path: "recovery-route".to_owned(),
-                    ..Default::default()
-                }
-                .encode_to_vec();
-                let mut frame = vec![0];
-                frame.extend_from_slice(&u32::try_from(request.len()).expect("small frame").to_be_bytes());
-                frame.extend_from_slice(&request);
-                call_body(&client, address, "ReadVersion", Bytes::from(frame))
-                    .await
-                    .expect("routed read")
-                    .into_body()
-                    .collect()
-                    .await
-                    .expect("routed response");
-                assert_eq!(routes.forwarded_routes(), expected, "repeated traffic from one disk is only one voter");
-            }
         })
         .await
         .expect("passive observer deadline");
@@ -591,7 +549,7 @@ mod tests {
         let root = b"hash/upload";
         assert!(scope_matches("Delete", &frame(".rustfs.sys/multipart", "hash/upload"), root).expect("root frame"));
         assert!(scope_matches("Delete", &frame(".rustfs.sys/multipart", "hash/upload/"), root).expect("directory frame"));
-        for path in ["hash/upload/part.1", "hash/upload/.abort-authority", "hash/upload-other"] {
+        for path in ["hash/upload/part.1", "hash/upload-other"] {
             assert!(!scope_matches("Delete", &frame(".rustfs.sys/multipart", path), root).expect("other path"));
         }
         assert!(!scope_matches("Delete", &frame(".rustfs.sys/tmp", "hash/upload"), root).expect("other volume"));

crates/e2e_test/src/storage_api.rs

@@ -15,14 +15,12 @@
 #[cfg(test)]
 pub(crate) use rustfs_ecstore::api::bucket::bucket_target_sys::BucketTargetSys;
 #[cfg(test)]
-pub(crate) use rustfs_ecstore::api::disk::{
-    DiskError, DiskOption, Endpoint, RUSTFS_META_BUCKET, VolumeInfo, WalkDirOptions, new_disk,
-};
+pub(crate) use rustfs_ecstore::api::disk::{DiskOption, Endpoint, RUSTFS_META_BUCKET, VolumeInfo, WalkDirOptions, new_disk};
 pub(crate) use rustfs_ecstore::api::rpc::{AuthenticatedChannel, TonicInterceptor, node_service_time_out_client_no_auth};
 #[cfg(test)]
 pub(crate) use rustfs_ecstore::api::rpc::{
     TONIC_RPC_PREFIX, gen_signature_headers, gen_tonic_replay_scope_headers, gen_tonic_signature_headers,
-    set_tonic_canonical_body_digest, verify_tonic_boot_epoch_response,
+    verify_tonic_boot_epoch_response,
 };
 #[cfg(test)]
 pub(crate) use rustfs_ecstore::api::rpc::{gen_tonic_signature_interceptor, node_service_time_out_client};
@@ -38,11 +36,6 @@ pub(crate) mod grpc_lock {
     pub(crate) use super::{AuthenticatedChannel, TonicInterceptor, node_service_time_out_client_no_auth};
 }
 
-#[cfg(test)]
-pub(crate) mod artifact_rpc {
-    pub(crate) use super::{DiskError, TONIC_RPC_PREFIX, gen_tonic_signature_headers, set_tonic_canonical_body_digest};
-}
-
 /// Signing/transport surface used by the cross-process internode RPC signature
 /// acceptance tests (backlog#1327). The signing helpers are what let a test mint
 /// the one legitimately signed request an on-path attacker is assumed to have

crates/ecstore/Cargo.toml

@@ -142,6 +142,7 @@ rustfs-lifecycle.workspace = true
 rustfs-s3-client = { workspace = true }
 rustfs-s3-types = { workspace = true }
 rustfs-data-usage.workspace = true
+rustfs-gateway-types.workspace = true
 rustfs-object-capacity.workspace = true
 rustfs-object-data-cache = { workspace = true, features = ["runtime-memory"] }
 arc-swap.workspace = true
@@ -160,7 +161,6 @@ serde = { workspace = true, features = ["derive"] }
 time = { workspace = true, features = ["parsing", "formatting", "macros", "serde"] }
 bytesize.workspace = true
 serde_json = { workspace = true, features = ["raw_value"] }
-s3s = { workspace = true, features = ["minio"] }
 http.workspace = true
 opentelemetry.workspace = true
 http-body = { workspace = true }
@@ -249,6 +249,7 @@ windows-sys = { workspace = true, features = [
 windows-sys = { workspace = true, features = ["Win32_System_Ioctl"] }
 
 [dev-dependencies]
+s3s = { workspace = true, features = ["minio"] }
 aws-smithy-async.workspace = true
 rustfs-s3-ops.workspace = true
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "test-util", "fs"] }

crates/ecstore/src/api/mod.rs

@@ -62,6 +62,8 @@ pub mod bucket {
         }
 
         pub mod bucket_lifecycle_ops {
+            pub use rustfs_lifecycle::{RestoreOutputLocation, RestoreRequest, RestoreS3Location, RestoreTag, RestoreTagging};
+
             pub use crate::bucket::lifecycle::bucket_lifecycle_ops::{
                 ExpiryState, LifecycleOps, ManualTransitionCancelCheck, ManualTransitionProgressSink,
                 ManualTransitionQueueSnapshot, ManualTransitionRunExecution, ManualTransitionRunOptions,
@@ -133,7 +135,7 @@ pub mod bucket {
             pub use crate::bucket::lifecycle::lifecycle::{
                 Event, ExpirationOptions, IlmAction, LIFECYCLE_MALFORMED_XML_ERROR_KIND, Lifecycle, LifecycleCalculate,
                 ObjectOpts, RuleValidate, TRANSITION_COMPLETE, TRANSITION_PENDING, TransitionOptions, expected_expiry_time,
-                object_opts_from_object_info,
+                format_lifecycle_date, object_opts_from_object_info, parse_lifecycle_date,
             };
         }
 
@@ -225,7 +227,7 @@ pub mod bucket {
     }
 
     pub mod object_lock {
-        pub use crate::bucket::object_lock::{ObjectLockApi, ObjectLockStatusExt};
+        pub use crate::bucket::object_lock::ObjectLockApi;
 
         pub mod types {
             pub use crate::bucket::object_lock::types::{
@@ -320,9 +322,9 @@ pub mod bucket {
 
     pub mod utils {
         pub use crate::bucket::utils::{
-            check_bucket_and_object_names, check_list_objs_args, check_object_name_for_length_and_slash,
-            check_valid_bucket_name_strict, deserialize, has_bad_path_component, is_meta_bucketname, is_valid_object_prefix,
-            serialize,
+            BucketConfigXml, BucketConfigXmlError, check_bucket_and_object_names, check_list_objs_args,
+            check_object_name_for_length_and_slash, check_valid_bucket_name_strict, deserialize, has_bad_path_component,
+            is_meta_bucketname, is_valid_object_prefix, serialize,
         };
     }
 
@@ -349,7 +351,7 @@ pub mod capacity {
 }
 
 pub mod object_api_utils {
-    pub use crate::object_api::object_api_utils::{ObjReaderFn, PutObjReader, get_raw_etag, new_getobjectreader, to_s3s_etag};
+    pub use crate::object_api::object_api_utils::{ObjReaderFn, PutObjReader, get_raw_etag, new_getobjectreader};
 }
 
 pub mod cluster {
@@ -382,43 +384,6 @@ pub mod config {
             with_config_object_read_lock, with_config_object_write_lock, with_server_config_read_lock,
             with_server_config_write_lock,
         };
-
-        /// Observe persisted config bytes and their reader-associated metadata within a byte limit.
-        pub async fn read_config_observation(
-            api: std::sync::Arc<crate::store::ECStore>,
-            file: &str,
-            max_bytes: usize,
-        ) -> crate::error::Result<(Vec<u8>, crate::object_api::ObjectInfo)> {
-            crate::config::com::read_config_observation(api, file, max_bytes).await
-        }
-
-        /// Observe bounded config bytes while the caller retains the object's write owner.
-        pub async fn read_config_observation_no_lock(
-            api: std::sync::Arc<crate::store::ECStore>,
-            file: &str,
-            max_bytes: usize,
-            guard: &crate::object_api::WriteCommitGuard,
-        ) -> crate::error::Result<(Vec<u8>, crate::object_api::ObjectInfo)> {
-            crate::config::com::read_config_observation_no_lock(api, file, max_bytes, guard).await
-        }
-
-        /// Read config bytes and metadata without treating an empty payload as absent.
-        pub async fn read_config_preserve_empty_with_metadata_opts(
-            api: std::sync::Arc<crate::store::ECStore>,
-            file: &str,
-            opts: &crate::object_api::ObjectOptions,
-        ) -> crate::error::Result<(Vec<u8>, crate::object_api::ObjectInfo)> {
-            crate::config::com::read_config_preserve_empty_with_metadata_opts(api, file, opts).await
-        }
-
-        pub async fn read_config_limited_preserve_empty_with_metadata_opts(
-            api: std::sync::Arc<crate::store::ECStore>,
-            file: &str,
-            opts: &crate::object_api::ObjectOptions,
-            max_bytes: usize,
-        ) -> crate::error::Result<(Vec<u8>, crate::object_api::ObjectInfo)> {
-            crate::config::com::read_config_limited_preserve_empty_with_metadata_opts(api, file, opts, max_bytes).await
-        }
     }
 
     pub mod storageclass {
@@ -468,19 +433,16 @@ pub mod disk {
     pub use crate::disk::local::{ReplacementExecutionLease, ScanGuard};
     #[cfg(all(feature = "test-util", not(windows)))]
     pub use crate::disk::os::{LocalPublicationPause, LocalPublicationStage};
-    pub use crate::disk::{ArtifactInventoryFrame, ArtifactInventoryVersion};
     pub use crate::disk::{
         BATCH_READ_VERSION_MAX_ITEMS, BUCKET_META_PREFIX, BatchReadVersionItem, BatchReadVersionReq, BatchReadVersionResp,
         CheckPartsResp, ConditionalFileUpdate, CurrentDeleteGeneration, CurrentDeleteTransition,
         DELETE_RECOVERY_PROTOCOL_VERSION, DeleteOptions, DeleteRecoveryAction, DeleteRecoveryCursor, DeleteRecoveryDigest,
         DeleteRecoveryInspection, DeleteRecoveryPage, DeleteRecoveryRpcOperation, DeleteRecoveryRpcReply, DeleteRecoveryState,
         Disk, DiskAPI, DiskInfo, DiskInfoOptions, DiskLocation, DiskOption, DiskStore, FileInfoVersions, FileReader, FileWriter,
-        GuardedDeleteVersionsPayload, GuardedFileInfoVersions, HEALING_MARKER_PATH, LegacyFileStream, LegacyFileWrite,
-        LegacyMetadataWrite, LegacyPartMutation, LegacyPartOperation, LegacyPathDelete, LegacyPathDeleteOperation,
-        LegacyRenameData, LegacyRenameFile, NsScannerOpenRequest, OldCurrentSize, PartTransactionAction,
-        QUOTA_MUTATION_FENCE_METADATA_SUFFIX, RUSTFS_META_BUCKET, ReadMultipleReq, ReadMultipleResp, ReadOptions, RenameDataResp,
-        STORAGE_FORMAT_FILE, SnapshotLeaseToken, UpdateMetadataOpts, VolumeInfo, WalkDirOptions, is_quota_mutation_fence_path,
-        new_disk, validate_batch_read_version_item_count,
+        GuardedDeleteVersionsPayload, GuardedFileInfoVersions, HEALING_MARKER_PATH, NsScannerOpenRequest, OldCurrentSize,
+        PartTransactionAction, QUOTA_MUTATION_FENCE_METADATA_SUFFIX, RUSTFS_META_BUCKET, ReadMultipleReq, ReadMultipleResp,
+        ReadOptions, RenameDataResp, STORAGE_FORMAT_FILE, SnapshotLeaseToken, UpdateMetadataOpts, VolumeInfo, WalkDirOptions,
+        is_quota_mutation_fence_path, new_disk, validate_batch_read_version_item_count,
     };
     pub use bytes::Bytes;
     pub use endpoint::Endpoint;
@@ -675,7 +637,6 @@ pub mod store_list {
 }
 
 pub mod storage {
-    pub use crate::bucket::artifact::inventory::ArtifactAttemptInventoryFrame;
     pub use crate::core::pools::{HealLifecycleExpiryContext, POOL_META_NAME};
     pub use crate::store::HealWalkVersion;
     pub use crate::store::{

crates/ecstore/src/bucket/artifact/backup_retention.rs

@@ -1,120 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-use crate::bucket::metadata::BUCKET_INCARNATION_FILE;
-use crate::config::com::read_config_observation;
-use crate::object_api::WriteCompletion;
-
-impl ECStore {
-    /// Permanently retain this managed bucket's versions for historical restores.
-    /// Lifecycle WRITE drains earlier exact deletes. The detached owner keeps
-    /// lifecycle -> metadata transaction locks until every metadata write drains.
-    pub async fn retain_artifact_backups(self: Arc<Self>, bucket: &str, incarnation: Uuid, base_prefix: &str) -> Result<()> {
-        let bucket = bucket.to_owned();
-        let base_prefix = base_prefix.to_owned();
-        let ctx = Arc::clone(&self.ctx);
-        ctx.run_detached_mutation(async move {
-            require_put_seal_topology(&self).await?;
-            if self.ctx.lock_manager().is_disabled() {
-                return Err(Error::other("artifact backup retention requires namespace locking"));
-            }
-            let lifecycle = self.acquire_bucket_lifecycle_write_lock(&bucket).await?;
-            let transaction = metadata_sys::acquire_bucket_metadata_transaction_lock_in(&self.ctx, &bucket).await?;
-            let mut metadata = self.backup_retention_metadata(&bucket, incarnation, &base_prefix).await?;
-            let check = || {
-                if lifecycle.is_lock_lost() || transaction.is_lock_lost() {
-                    Err(Error::other("artifact backup retention fence was lost"))
-                } else {
-                    Ok(())
-                }
-            };
-            check()?;
-            // Even an idempotent retry rewrites with TailDrained: an earlier
-            // interrupted call may have reached only some metadata replicas.
-            metadata.artifact_backup_retained = true;
-            let mut opts = ObjectOptions {
-                max_parity: true,
-                write_completion: WriteCompletion::TailDrained,
-                ..Default::default()
-            };
-            opts.add_bucket_lifecycle_lock_guard(&lifecycle);
-            opts.add_namespace_lock_guard(&transaction);
-            metadata.save_with_store_options(self.clone(), &opts).await?;
-            check()?;
-            let sys = metadata_sys::require_bucket_metadata_sys_in(&self.ctx)?;
-            let sys = sys.read().await.clone();
-            sys.set_validated(metadata).await?;
-            check()
-        })
-        .await
-        .map_err(|_| Error::other("artifact backup retention owner failed"))?
-    }
-
-    /// Observe the immutable bucket identity and retention in one locked read.
-    pub async fn inspect_artifact_backup_retention(&self, bucket: &str, incarnation: Uuid, base_prefix: &str) -> Result<bool> {
-        require_put_seal_topology(self).await?;
-        if self.ctx.lock_manager().is_disabled() {
-            return Err(Error::other("artifact backup retention requires namespace locking"));
-        }
-        let lifecycle = self.acquire_bucket_lifecycle_read_lock(bucket).await?;
-        let metadata = self.backup_retention_metadata(bucket, incarnation, base_prefix).await?;
-        if lifecycle.is_lock_lost() {
-            return Err(Error::other("artifact backup retention observation fence was lost"));
-        }
-        Ok(metadata.artifact_backup_retained)
-    }
-
-    async fn backup_retention_metadata(&self, bucket: &str, incarnation: Uuid, base_prefix: &str) -> Result<BucketMetadata> {
-        if incarnation.is_nil() || !crate::storage_api_contracts::bucket::valid_artifact_base_prefix(base_prefix) {
-            return Err(Error::other("artifact backup retention identity is invalid"));
-        }
-        let mut metadata = self.read_backup_retention_metadata(bucket).await?;
-        let store = metadata_sys::object_store_in(&self.ctx).await?;
-        let (sidecar, _) =
-            read_config_observation(store, &format!("{BUCKET_META_PREFIX}/{bucket}/{BUCKET_INCARNATION_FILE}"), 16).await?;
-        metadata.parse_all_configs()?;
-        if metadata.bucket_incarnation_id != incarnation
-            || Uuid::from_slice(&sidecar).ok() != Some(incarnation)
-            || metadata.artifact_base_prefix.as_deref() != Some(base_prefix)
-            || !metadata.bucket_creation_committed
-            || !metadata.versioning_config.as_ref().is_some_and(|versioning| {
-                versioning.enabled()
-                    && !versioning.exclude_folders.unwrap_or(false)
-                    && versioning.excluded_prefixes.as_ref().is_none_or(Vec::is_empty)
-            })
-        {
-            return Err(Error::other("artifact backup retention identity mismatch"));
-        }
-        metadata.bucket_incarnation_sidecar = true;
-        Ok(metadata)
-    }
-
-    /// Caller must hold the bucket lifecycle fence. An unreadable or missing
-    /// record cannot prove that historical backup protection was never enabled.
-    pub(crate) async fn require_no_artifact_backup_retention(&self, bucket: &str) -> Result<()> {
-        if self.read_backup_retention_metadata(bucket).await?.artifact_backup_retained {
-            return Err(Error::other("artifact versions are retained for backups"));
-        }
-        Ok(())
-    }
-
-    async fn read_backup_retention_metadata(&self, bucket: &str) -> Result<BucketMetadata> {
-        if bucket.is_empty()
-            || super::super::utils::has_bad_path_component(bucket)
-            || super::super::utils::is_meta_bucketname(bucket)
-        {
-            return Err(Error::other("artifact backup retention bucket is invalid"));
-        }
-        let store = metadata_sys::object_store_in(&self.ctx).await?;
-        if store.id != self.id {
-            return Err(Error::other("artifact backup retention belongs to another store"));
-        }
-        let (bytes, _) = read_config_observation(store, &BucketMetadata::new(bucket).save_file_path(), 64 * 1024 * 1024).await?;
-        let metadata = BucketMetadata::decode_file(&bytes)?;
-        if metadata.name != bucket {
-            return Err(Error::other("artifact backup retention bucket mismatch"));
-        }
-        Ok(metadata)
-    }
-}

crates/ecstore/src/bucket/artifact/delete.rs

@@ -1,154 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-use crate::storage_api_contracts::object::ObjectOperations as _;
-
-/// In-process authority for exactly one drained managed version. No caller can
-/// construct this capability or serialize it into a disk/RPC request.
-#[doc(hidden)]
-pub struct ArtifactDeleteTarget {
-    store: Uuid,
-    record: ArtifactVersionRetirementRecord,
-    lifecycle: Arc<rustfs_lock::NamespaceLockGuard>,
-    attempt: WriteCommitGuard,
-    repair: WriteCommitGuard,
-}
-
-impl ArtifactDeleteTarget {
-    fn check_live(&self) -> Result<()> {
-        if self.lifecycle.is_lock_lost() || self.attempt.is_lock_lost() || self.repair.is_lock_lost() {
-            return Err(Error::other("artifact exact delete owned fence was lost"));
-        }
-        Ok(())
-    }
-
-    pub(crate) fn lifecycle(&self) -> Arc<rustfs_lock::NamespaceLockGuard> {
-        Arc::clone(&self.lifecycle)
-    }
-
-    pub(crate) fn validate(&self, store: &ECStore, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()> {
-        if self.store != store.id
-            || bucket != self.record.bucket
-            || rustfs_utils::path::encode_dir_object(object) != self.record.object
-            || opts.expected_bucket_incarnation_id != Some(self.record.incarnation_id)
-            || opts.version_id.as_deref() != Some(self.record.version_id.to_string().as_str())
-            || !opts.versioned
-            || opts.version_suspended
-            || opts.delete_prefix
-            || opts.delete_marker
-            || opts.data_movement
-            || opts.lifecycle_delete_all.is_some()
-            || self.lifecycle.is_lock_lost()
-            || self.attempt.is_lock_lost()
-            || self.repair.is_lock_lost()
-        {
-            return Err(Error::other("artifact exact delete target or owned fence mismatch"));
-        }
-        Ok(())
-    }
-}
-
-impl ECStore {
-    /// Read-only capability observation; each mutation revalidates the topology.
-    pub async fn supports_artifact_exact_delete(&self) -> bool {
-        require_local_put_seal_topology(self).await.is_ok() && !self.ctx.lock_manager().is_disabled()
-    }
-
-    /// Delete an exact version in a fully sealed attempt. This authenticates the
-    /// storage identity and drains writers; the caller still owns GC eligibility
-    /// and cleanup IAM. Distributed receiver deletion is not yet supported.
-    pub async fn delete_artifact_object_version(
-        self: Arc<Self>,
-        bucket: &str,
-        expected_incarnation: Uuid,
-        attempt_prefix: &str,
-        object: &str,
-        version: Uuid,
-    ) -> Result<()> {
-        require_local_put_seal_topology(&self).await?;
-        if self.ctx.lock_manager().is_disabled() {
-            return Err(Error::other("artifact exact deletion requires namespace locking"));
-        }
-        let lifecycle = Arc::new(self.acquire_bucket_lifecycle_read_lock(bucket).await?);
-        self.require_no_artifact_backup_retention(bucket).await?;
-        let put = self
-            .inventory_artifact_record(bucket, expected_incarnation, attempt_prefix)
-            .await?;
-        let repair = ArtifactRepairSealRecord::new(&put);
-        let record = ArtifactVersionRetirementRecord::new(&put, object, version)?;
-        let object = object.to_owned();
-        let store = Arc::clone(&self);
-        // Lifecycle -> attempt -> repair seal -> metadata transaction -> object.
-        // The spawned owner, and the disk deletion tail's typed capability, keep
-        // these locks after cancellation of the HTTP caller.
-        with_config_object_write_lock(self, put.path(), move |attempt| async move {
-            if !put.exists(Arc::clone(&store), &attempt).await? {
-                return Err(Error::other("artifact exact deletion requires sealed PUTs"));
-            }
-            let lock = store.new_ns_lock(RUSTFS_META_BUCKET, &repair.path()).await?;
-            let repair_owner = WriteCommitGuard::acquire(&lock, get_lock_acquire_timeout()).await?;
-            if !repair.exists(Arc::clone(&store), &repair_owner).await? {
-                return Err(Error::other("artifact exact deletion requires sealed repairs"));
-            }
-            let receivers = store.capture_artifact_receivers().await?;
-            store
-                .close_artifact_receiver_snapshot(&put, crate::disk::local::ArtifactLeaseDomain::Put, &receivers)
-                .await?;
-            store
-                .close_artifact_receiver_snapshot(&put, crate::disk::local::ArtifactLeaseDomain::Repair, &receivers)
-                .await?;
-            store.verify_artifact_receiver_snapshot(&put, &receivers).await?;
-            let target = Arc::new(ArtifactDeleteTarget {
-                store: store.id,
-                record,
-                lifecycle,
-                attempt,
-                repair: repair_owner,
-            });
-            let mut opts = ObjectOptions {
-                versioned: true,
-                version_id: Some(version.to_string()),
-                expected_bucket_incarnation_id: Some(expected_incarnation),
-                artifact_delete_target: Some(Arc::clone(&target)),
-                delete_mutation_owner: Some(target.clone()),
-                ..Default::default()
-            };
-            opts.add_write_commit_guard(&target.attempt);
-            opts.add_write_commit_guard(&target.repair);
-            // These owners fence seal records, not the object. Ordinary DELETE
-            // must still acquire and retain its exact object WRITE owner.
-            opts.no_lock = false;
-            target.check_live()?;
-            // Preserve the normal exact DELETE's Object Lock, quorum, journal,
-            // cache and capacity behavior. Its success is logical deletion, not
-            // a claim that every offline shard has been physically erased.
-            match store.delete_object(&put.bucket, &object, opts).await {
-                Ok(info) => {
-                    // Match the S3 request layer's committed-generation quota
-                    // delta. A strict absence retry must not subtract twice.
-                    if !info.name.is_empty()
-                        && !info.delete_marker
-                        && let Ok(size) = crate::data_usage::quota_object_size(&info)
-                    {
-                        crate::data_usage::record_bucket_object_delete_memory(&put.bucket, size, false).await;
-                    }
-                }
-                Err(Error::VersionNotFound(bucket, object, version))
-                    if bucket == target.record.bucket
-                        && rustfs_utils::path::encode_dir_object(&object) == target.record.object
-                        && version == target.record.version_id.to_string() => {}
-                Err(Error::ObjectNotFound(bucket, object))
-                    if bucket == target.record.bucket
-                        && rustfs_utils::path::encode_dir_object(&object) == target.record.object => {}
-                Err(error) => return Err(error),
-            }
-            store.verify_artifact_receiver_snapshot(&put, &receivers).await?;
-            store
-                .inventory_artifact_record(&put.bucket, expected_incarnation, &put.attempt_prefix)
-                .await?;
-            target.check_live()
-        })
-        .await?
-    }
-}

crates/ecstore/src/bucket/artifact/inventory.rs

@@ -1,207 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-use super::*;
-use crate::disk::{ArtifactInventoryFrame, ArtifactInventoryVersion, Disk};
-use rustfs_protos::proto_gen::node_service::ArtifactInventoryPhase;
-use tokio::{sync::mpsc, time::Instant};
-
-/// Physical observations retain their member. Replicas are not extra business
-/// versions and this stream makes no quorum-readability or GC claim.
-#[derive(Debug)]
-pub enum ArtifactAttemptInventoryFrame {
-    Observations {
-        endpoint: String,
-        disk_id: Uuid,
-        versions: Vec<ArtifactInventoryVersion>,
-    },
-    Complete {
-        members: usize,
-        observations: u64,
-    },
-}
-
-impl ECStore {
-    /// Inventory one fully sealed attempt across every configured receiver.
-    /// Earlier output is staging only; only the final frame plus Ok is complete.
-    pub async fn inventory_artifact_attempt(
-        self: Arc<Self>,
-        bucket: &str,
-        incarnation: Uuid,
-        prefix: &str,
-        deadline: Instant,
-        output: mpsc::Sender<ArtifactAttemptInventoryFrame>,
-    ) -> Result<()> {
-        tokio::time::timeout_at(deadline, Box::pin(async move {
-            require_put_seal_topology(&self).await?;
-            if self.ctx.lock_manager().is_disabled() { return Err(Error::other("artifact inventory requires namespace locking")); }
-            let lifecycle = self.acquire_bucket_lifecycle_read_lock(bucket).await?;
-            let put = self.inventory_artifact_record(bucket, incarnation, prefix).await?;
-            let repair = ArtifactRepairSealRecord::new(&put);
-            // Lifecycle -> attempt -> repair record. Receivers do not reenter
-            // distributed locks; actual two-domain disk owners guard their reads.
-            let store = self.clone();
-            let bucket = bucket.to_owned();
-            let prefix = prefix.to_owned();
-            with_config_object_write_lock(self, put.path(), move |attempt| async move {
-                tokio::time::timeout_at(deadline, async {
-                    if !put.exists(store.clone(), &attempt).await? { return Err(Error::other("artifact inventory requires PUT seal record")); }
-                    let lock = store.new_ns_lock(RUSTFS_META_BUCKET, &repair.path()).await?;
-                    let repair_owner = WriteCommitGuard::acquire(&lock, get_lock_acquire_timeout()).await?;
-                    if !repair.exists(store.clone(), &repair_owner).await? { return Err(Error::other("artifact inventory requires repair seal record")); }
-                    let receivers = store.capture_artifact_receivers().await?;
-                    let mut observations = 0u64;
-                    for (endpoint, (disk, expected)) in &receivers {
-                        if lifecycle.is_lock_lost() || attempt.is_lock_lost() || repair_owner.is_lock_lost() {
-                            return Err(Error::other("artifact inventory fence was lost"));
-                        }
-                        let (sender, mut frames) = mpsc::channel(2);
-                        let scan = async {
-                            match disk.as_ref() {
-                                Disk::Local(local) => local.get_disk().inventory_artifact_attempt(*expected, &bucket, &prefix, put.identity(), deadline, sender).await,
-                                Disk::Remote(remote) => remote.inventory_artifact_attempt(*expected, (&bucket, incarnation), &prefix, ArtifactInventoryPhase::ArtifactInventoryScan, deadline, sender).await,
-                            }
-                        };
-                        tokio::pin!(scan);
-                        let mut sequence = 0;
-                        let mut count = 0u64;
-                        let mut terminal = false;
-                        let mut ended = false;
-                        let mut done = false;
-                        while !ended || !done {
-                            tokio::select! {
-                                result = &mut scan, if !done => { result.map_err(Error::other)?; done = true; },
-                                frame = frames.recv(), if !ended => match frame {
-                                    Some(ArtifactInventoryFrame::Entries { sequence: actual, versions }) if !terminal && actual == sequence => {
-                                        count = count.checked_add(u64::try_from(versions.len()).map_err(Error::other)?).ok_or_else(|| Error::other("artifact inventory count overflow"))?;
-                                        output.send(ArtifactAttemptInventoryFrame::Observations { endpoint: endpoint.clone(), disk_id: *expected, versions }).await
-                                            .map_err(|_| Error::other("artifact inventory consumer closed"))?;
-                                        sequence += 1;
-                                    }
-                                    Some(ArtifactInventoryFrame::Complete { disk_id, incarnation: actual, attempt_prefix, entries })
-                                        if !terminal && disk_id == *expected && actual == incarnation && attempt_prefix == prefix && entries == count => terminal = true,
-                                    Some(_) => return Err(Error::other("artifact inventory member stream is invalid")),
-                                    None => ended = true,
-                                },
-                            }
-                        }
-                        if !terminal { return Err(Error::other("artifact inventory member is incomplete")); }
-                        observations = observations.checked_add(count).ok_or_else(|| Error::other("artifact inventory count overflow"))?;
-                    }
-                    store.verify_inventory_members(&put, &receivers, deadline).await?;
-                    let current = store.artifact_inventory_receiver_identity(&bucket, incarnation, &prefix).await?;
-                    if current.receiver_key != put.identity().receiver_key || lifecycle.is_lock_lost() || attempt.is_lock_lost() || repair_owner.is_lock_lost() {
-                        return Err(Error::other("artifact inventory authority changed"));
-                    }
-                    output.send(ArtifactAttemptInventoryFrame::Complete { members: receivers.len(), observations }).await
-                        .map_err(|_| Error::other("artifact inventory consumer closed"))?;
-                    Ok(())
-                }).await.map_err(|_| Error::other("artifact inventory deadline exceeded"))?
-            }).await?
-        })).await.map_err(|_| Error::other("artifact inventory deadline exceeded"))?
-    }
-
-    pub(super) async fn inventory_artifact_record(&self, bucket: &str, expected: Uuid, prefix: &str) -> Result<PutSealRecord> {
-        use crate::bucket::metadata::BUCKET_INCARNATION_FILE;
-        use crate::config::com::read_config_observation;
-        if expected.is_nil()
-            || crate::bucket::utils::has_bad_path_component(bucket)
-            || bucket.is_empty()
-            || crate::bucket::utils::is_meta_bucketname(bucket)
-        {
-            return Err(Error::other("artifact inventory authority is invalid"));
-        }
-        let store = metadata_sys::object_store_in(&self.ctx).await?;
-        if store.id != self.id {
-            return Err(Error::other("artifact inventory authority belongs to another store"));
-        }
-        // Do not enter metadata_sys's lazy bucket READ/migration path: the
-        // coordinator already owns lifecycle READ and a writer may be queued.
-        // Observation reads bypass cache and suppress physical read repair.
-        let path = BucketMetadata::new(bucket).save_file_path();
-        let (bytes, _) = read_config_observation(store.clone(), &path, 64 * 1024 * 1024).await?;
-        let mut metadata = BucketMetadata::decode_file(&bytes)?;
-        let (sidecar, _) =
-            read_config_observation(store, &format!("{BUCKET_META_PREFIX}/{bucket}/{BUCKET_INCARNATION_FILE}"), 16).await?;
-        if metadata.name != bucket
-            || !metadata.bucket_creation_committed
-            || metadata.bucket_incarnation_id != expected
-            || Uuid::from_slice(&sidecar).ok() != Some(expected)
-        {
-            return Err(Error::other("artifact inventory incarnation mismatch"));
-        }
-        metadata.parse_all_configs()?;
-        if !metadata.versioning_config.as_ref().is_some_and(|config| {
-            config.enabled()
-                && !config.exclude_folders.unwrap_or(false)
-                && config.excluded_prefixes.as_ref().is_none_or(Vec::is_empty)
-        }) {
-            return Err(Error::other("artifact inventory requires managed versioning"));
-        }
-        PutSealRecord::new(&metadata, prefix)
-    }
-
-    pub(crate) async fn artifact_inventory_receiver_identity(
-        &self,
-        bucket: &str,
-        expected: Uuid,
-        prefix: &str,
-    ) -> Result<ArtifactPutIdentity> {
-        Ok(self.inventory_artifact_record(bucket, expected, prefix).await?.identity())
-    }
-
-    async fn verify_inventory_members(
-        &self,
-        record: &PutSealRecord,
-        captured: &ArtifactReceiverSnapshot,
-        deadline: Instant,
-    ) -> Result<()> {
-        for final_pass in [false, true] {
-            let current = self.artifact_receiver_inventory().await?;
-            if current.len() != captured.len()
-                || current
-                    .iter()
-                    .any(|(endpoint, disk)| !captured.get(endpoint).is_some_and(|(old, _)| Arc::ptr_eq(old, disk)))
-            {
-                return Err(Error::other("artifact inventory membership changed"));
-            }
-            if final_pass {
-                for (disk, expected) in captured.values() {
-                    if disk.cached_disk_id().await != Some(*expected) {
-                        return Err(Error::other("artifact inventory expected identity changed"));
-                    }
-                }
-                break;
-            }
-            for (disk, expected) in captured.values() {
-                if disk.cached_disk_id().await != Some(*expected) {
-                    return Err(Error::other("artifact inventory expected identity changed"));
-                }
-                match disk.as_ref() {
-                    Disk::Local(local) => {
-                        let _verification = local
-                            .get_disk()
-                            .verify_artifact_inventory_closed(*expected, record.identity(), deadline)
-                            .await
-                            .map_err(Error::other)?;
-                    }
-                    Disk::Remote(remote) => {
-                        let (output, _unused) = mpsc::channel(1);
-                        remote
-                            .inventory_artifact_attempt(
-                                *expected,
-                                (&record.bucket, record.incarnation_id),
-                                &record.attempt_prefix,
-                                ArtifactInventoryPhase::ArtifactInventoryVerify,
-                                deadline,
-                                output,
-                            )
-                            .await
-                            .map_err(Error::other)?;
-                    }
-                }
-            }
-        }
-        Ok(())
-    }
-}

crates/ecstore/src/bucket/artifact/ordinary_classification.rs

@@ -1,287 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use std::collections::HashMap;
-use std::future::Future;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::sync::{Arc, Mutex, Weak};
-
-/// Shares only reads started after a caller arrives; retains no idle results.
-#[derive(Default)]
-pub(crate) struct OrdinaryClassificationRegistry {
-    gates: Mutex<HashMap<String, Weak<Gate>>>,
-    #[cfg(test)]
-    after_unregister: Option<std::sync::Barrier>,
-}
-
-#[derive(Default)]
-struct Gate {
-    started_generation: AtomicU64,
-    completed: tokio::sync::Mutex<Option<CompletedRead>>,
-}
-
-struct CompletedRead {
-    generation: u64,
-    allowed: bool,
-}
-
-struct Registration<'a> {
-    registry: &'a OrdinaryClassificationRegistry,
-    bucket: &'a str,
-    gate: Option<Arc<Gate>>,
-    observed_generation: u64,
-}
-
-impl OrdinaryClassificationRegistry {
-    pub(crate) async fn classify(&self, bucket: &str, read: impl Future<Output = bool>) -> bool {
-        self.register(bucket).classify(read).await
-    }
-
-    fn register<'a>(&'a self, bucket: &'a str) -> Registration<'a> {
-        // Callers requiring physical admission must register after acquiring it.
-        // Release the registry lock before awaiting the gate, then acquire the
-        // existing metadata locks.
-        let mut gates = self.gates.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
-        let gate = gates.get(bucket).and_then(Weak::upgrade).unwrap_or_else(|| {
-            let gate = Arc::new(Gate::default());
-            gates.insert(bucket.to_owned(), Arc::downgrade(&gate));
-            gate
-        });
-        let observed_generation = gate.started_generation.load(Ordering::Acquire);
-        Registration {
-            registry: self,
-            bucket,
-            gate: Some(gate),
-            observed_generation,
-        }
-    }
-}
-
-impl Registration<'_> {
-    async fn classify(self, read: impl Future<Output = bool>) -> bool {
-        let Some(gate) = self.gate.as_ref() else {
-            return false;
-        };
-        let mut completed = gate.completed.lock().await;
-        // Only a read started after this caller registered can authorize it.
-        // Arrivals during a read therefore wait for the next fresh read.
-        if let Some(result) = completed
-            .as_ref()
-            .filter(|result| result.generation > self.observed_generation)
-        {
-            return result.allowed;
-        }
-        let Ok(previous) = gate
-            .started_generation
-            .try_update(Ordering::AcqRel, Ordering::Acquire, |generation| generation.checked_add(1))
-        else {
-            return false;
-        };
-        // Keep the gate through the original bounded metadata read. Cancellation
-        // releases it without publishing a result; another caller can read again.
-        let allowed = read.await;
-        *completed = Some(CompletedRead {
-            generation: previous + 1,
-            allowed,
-        });
-        allowed
-    }
-}
-
-impl Drop for Registration<'_> {
-    fn drop(&mut self) {
-        let Some(gate) = self.gate.take() else {
-            return;
-        };
-        let mut gates = self.registry.gates.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
-        // Strong references are acquired and released under this registry lock,
-        // so concurrent final callers cannot both miss the last reference.
-        if Arc::strong_count(&gate) == 1
-            && gates
-                .get(self.bucket)
-                .is_some_and(|registered| registered.ptr_eq(&Arc::downgrade(&gate)))
-        {
-            gates.remove(self.bucket);
-        }
-        drop(gate);
-        drop(gates);
-        #[cfg(test)]
-        if let Some(barrier) = &self.registry.after_unregister {
-            barrier.wait();
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use futures::poll;
-    use std::task::Poll;
-    use tokio::sync::oneshot;
-
-    fn assert_empty(registry: &OrdinaryClassificationRegistry) {
-        assert!(registry.gates.lock().expect("classification registry").is_empty());
-    }
-
-    #[tokio::test]
-    async fn late_arrivals_share_only_the_next_fail_closed_read() {
-        let registry = OrdinaryClassificationRegistry::default();
-        let reads = AtomicU64::new(0);
-        let (release, waiting) = oneshot::channel();
-        let mut first = Box::pin(registry.classify("bucket", async {
-            reads.fetch_add(1, Ordering::Relaxed);
-            waiting.await.expect("release first read");
-            true
-        }));
-        assert!(poll!(first.as_mut()).is_pending());
-        let mut followers = (0..16)
-            .map(|_| {
-                Box::pin(registry.classify("bucket", async {
-                    reads.fetch_add(1, Ordering::Relaxed);
-                    false
-                }))
-            })
-            .collect::<Vec<_>>();
-        for follower in &mut followers {
-            assert!(poll!(follower.as_mut()).is_pending());
-        }
-        release.send(()).expect("first reader still alive");
-        assert_eq!(poll!(first.as_mut()), Poll::Ready(true));
-        for follower in &mut followers {
-            assert_eq!(poll!(follower.as_mut()), Poll::Ready(false));
-        }
-        assert_eq!(reads.load(Ordering::Relaxed), 2);
-        assert_empty(&registry);
-    }
-
-    #[tokio::test]
-    async fn successive_waves_always_read_again() {
-        let registry = OrdinaryClassificationRegistry::default();
-        let reads = AtomicU64::new(0);
-        for expected in [true, false, true] {
-            assert_eq!(
-                registry
-                    .classify("bucket", async {
-                        reads.fetch_add(1, Ordering::Relaxed);
-                        expected
-                    })
-                    .await,
-                expected
-            );
-            assert_empty(&registry);
-        }
-        assert_eq!(reads.load(Ordering::Relaxed), 3);
-    }
-
-    #[tokio::test]
-    async fn canceled_leader_does_not_publish_or_strand_waiters() {
-        let registry = OrdinaryClassificationRegistry::default();
-        let reads = AtomicU64::new(0);
-        let old_registration = registry.register("bucket");
-        assert!(
-            registry
-                .classify("bucket", async {
-                    reads.fetch_add(1, Ordering::Relaxed);
-                    true
-                })
-                .await
-        );
-        let mut leader = Box::pin(registry.classify("bucket", async {
-            reads.fetch_add(1, Ordering::Relaxed);
-            std::future::pending::<bool>().await
-        }));
-        assert!(poll!(leader.as_mut()).is_pending());
-        let mut old_waiter =
-            Box::pin(old_registration.classify(async { panic!("old waiter must reuse the completed post-registration read") }));
-        assert!(poll!(old_waiter.as_mut()).is_pending());
-        let mut late_waiter = Box::pin(registry.classify("bucket", async {
-            reads.fetch_add(1, Ordering::Relaxed);
-            false
-        }));
-        assert!(poll!(late_waiter.as_mut()).is_pending());
-        drop(leader);
-        assert_eq!(poll!(old_waiter.as_mut()), Poll::Ready(true));
-        assert_eq!(poll!(late_waiter.as_mut()), Poll::Ready(false));
-        assert_eq!(reads.load(Ordering::Relaxed), 3);
-        assert_empty(&registry);
-    }
-
-    #[tokio::test]
-    async fn canceled_follower_does_not_retain_the_gate() {
-        let registry = OrdinaryClassificationRegistry::default();
-        let (release, waiting) = oneshot::channel();
-        let mut leader = Box::pin(registry.classify("bucket", async {
-            waiting.await.expect("release leader");
-            true
-        }));
-        assert!(poll!(leader.as_mut()).is_pending());
-        let mut follower = Box::pin(registry.classify("bucket", async { panic!("canceled follower must not read") }));
-        assert!(poll!(follower.as_mut()).is_pending());
-        drop(follower);
-        assert_eq!(registry.gates.lock().expect("classification registry").len(), 1);
-        release.send(()).expect("leader still alive");
-        assert_eq!(poll!(leader.as_mut()), Poll::Ready(true));
-        assert_empty(&registry);
-    }
-
-    #[test]
-    fn concurrent_final_registrations_remove_the_gate() {
-        let registry = OrdinaryClassificationRegistry {
-            after_unregister: Some(std::sync::Barrier::new(2)),
-            ..Default::default()
-        };
-        let first = registry.register("bucket");
-        let second = registry.register("bucket");
-        // Both destructors reach the unlocked barrier before either returns.
-        // Moving the Arc release after this barrier leaves a stale registry key.
-        std::thread::scope(|scope| {
-            scope.spawn(move || drop(first));
-            scope.spawn(move || drop(second));
-        });
-        assert_empty(&registry);
-    }
-
-    #[tokio::test]
-    async fn buckets_and_stores_do_not_share_gates() {
-        let first_store = OrdinaryClassificationRegistry::default();
-        let second_store = OrdinaryClassificationRegistry::default();
-        let mut blocked = Box::pin(first_store.classify("first", std::future::pending()));
-        assert!(poll!(blocked.as_mut()).is_pending());
-        assert_eq!(poll!(Box::pin(first_store.classify("second", async { true }))), Poll::Ready(true));
-        assert_eq!(poll!(Box::pin(second_store.classify("first", async { false }))), Poll::Ready(false));
-        assert_empty(&second_store);
-        drop(blocked);
-        assert_empty(&first_store);
-    }
-
-    #[tokio::test]
-    async fn generation_exhaustion_fails_closed_without_reading() {
-        let registry = OrdinaryClassificationRegistry::default();
-        let registration = registry.register("bucket");
-        let gate = registration.gate.as_ref().expect("registered gate");
-        gate.started_generation.store(u64::MAX, Ordering::Release);
-        *gate.completed.lock().await = Some(CompletedRead {
-            generation: u64::MAX,
-            allowed: true,
-        });
-        assert!(
-            !registry
-                .classify("bucket", async { panic!("exhausted generation must deny without reading") })
-                .await
-        );
-        assert_eq!(gate.started_generation.load(Ordering::Acquire), u64::MAX);
-        drop(registration);
-        assert_empty(&registry);
-    }
-}

crates/ecstore/src/bucket/lifecycle/bucket_lifecycle_ops.rs

@@ -87,12 +87,14 @@ use rustfs_filemeta::{
     FileInfo, FileInfoOpts, NULL_VERSION_ID, RestoreStatus, RestoreStatusOps, TRANSITION_COMPLETE, get_file_info,
     is_restored_object_on_disk,
 };
+use rustfs_gateway_types::persistence::PersistedLifecycleConfiguration;
+use rustfs_gateway_types::persistence::PersistedObjectLockConfiguration as ObjectLockConfiguration;
+use rustfs_lifecycle::{RestoreRequest, RestoreS3Location};
 use rustfs_lock::{NamespaceLockGuard, error::LockError};
 use rustfs_scanner_metrics::metrics::{
     IlmAction, Metrics, ScannerLifecycleExpiryStateUpdate, ScannerLifecycleTransitionStateUpdate, global_metrics,
 };
 use rustfs_utils::{get_env_i64, get_env_usize, path::encode_dir_object, string::parse_bool};
-use s3s::dto::{BucketLifecycleConfiguration, ExpirationStatus, ObjectLockConfiguration, RestoreRequest, RestoreRequestType};
 use sha2::{Digest, Sha256};
 use std::any::Any;
 use std::collections::{BTreeMap, HashMap, HashSet};
@@ -298,7 +300,7 @@ impl LifecycleSys {
         Arc::new(Self)
     }
 
-    pub async fn get(&self, bucket: &str) -> Option<BucketLifecycleConfiguration> {
+    pub async fn get(&self, bucket: &str) -> Option<PersistedLifecycleConfiguration> {
         match metadata_boundary::get_lifecycle_config(bucket).await {
             Ok((lc, _)) => Some(lc),
             Err(Error::ConfigNotFound) => None,
@@ -890,7 +892,6 @@ pub(crate) async fn cleanup_free_version_exact(
     let bucket_guard = api
         .acquire_bucket_lifecycle_read_lock(&oi.bucket)
         .await
-        .map(Arc::new)
         .map_err(std::io::Error::other)?;
     let (lease, delete_plan) = acquire_free_version_tier_lease(oi, &api.tier_config_mgr()).await?;
     let local_object = encode_dir_object(&oi.name);
@@ -959,7 +960,7 @@ pub(crate) async fn cleanup_free_version_exact(
         };
         delete_request.set_tier_free_version();
         if let Err(err) = set
-            .delete_object_version_with_lifecycle_owner(&oi.bucket, &local_object, &delete_request, Arc::clone(&bucket_guard))
+            .delete_object_version(&oi.bucket, &local_object, &delete_request, false)
             .await
             && first_error.is_none()
         {
@@ -3935,7 +3936,7 @@ pub fn init_background_stale_multipart_upload_cleanup(api: Arc<ECStore>) {
     });
 }
 
-pub async fn validate_transition_tier(lc: &BucketLifecycleConfiguration) -> Result<(), std::io::Error> {
+pub async fn validate_transition_tier(lc: &PersistedLifecycleConfiguration) -> Result<(), std::io::Error> {
     for rule in &lc.rules {
         if let Some(transitions) = &rule.transitions {
             for transition in transitions {
@@ -4052,8 +4053,9 @@ pub(crate) async fn enqueue_immediate_expiry(api: Arc<ECStore>, oi: &ObjectInfo,
         .map(lifecycle::object_opts_from_object_info)
         .collect::<Vec<ObjectOpts>>();
     let lock_config = configs.object_lock;
+    let evaluator_lock_config = lock_config.clone();
     let events = match Evaluator::new(lifecycle)
-        .with_lock_retention(lock_config.clone())
+        .with_lock_retention(evaluator_lock_config)
         .eval(&object_opts)
         .await
     {
@@ -4533,19 +4535,26 @@ pub async fn enqueue_transition_for_existing_objects_scoped(
     }
 }
 
-fn lifecycle_rule_has_date_expiration(lc: &BucketLifecycleConfiguration, rule_id: &str) -> bool {
+fn lifecycle_rule_has_date_expiration(lc: &PersistedLifecycleConfiguration, rule_id: &str) -> bool {
     lc.rules.iter().any(|rule| {
-        rule.status == ExpirationStatus::from_static(ExpirationStatus::ENABLED)
+        rule.status == "Enabled"
             && rule.id.as_deref() == Some(rule_id)
             && rule.expiration.as_ref().is_some_and(|expiration| expiration.date.is_some())
     })
 }
 
-fn should_defer_date_expiry_for_recent_config_update(lc: &BucketLifecycleConfiguration, now: OffsetDateTime) -> bool {
-    lc.expiry_updated_at.as_ref().is_some_and(|updated_at| {
-        let updated_at = OffsetDateTime::from(updated_at.clone());
-        now.unix_timestamp().saturating_sub(updated_at.unix_timestamp()) < DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS
-    })
+fn should_defer_date_expiry_for_recent_config_update(lc: &PersistedLifecycleConfiguration, now: OffsetDateTime) -> bool {
+    lc.expiry_updated_at
+        .as_ref()
+        .is_some_and(|updated_at| match rustfs_lifecycle::parse_lifecycle_date(updated_at) {
+            Ok(updated_at) => {
+                now.unix_timestamp().saturating_sub(updated_at.unix_timestamp()) < DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS
+            }
+            Err(error) => {
+                warn!(error = %error, "Deferring date expiry with an unreadable update timestamp");
+                true
+            }
+        })
 }
 
 async fn apply_existing_object_expiry(
@@ -4565,7 +4574,7 @@ async fn apply_existing_object_expiry(
 struct ExistingObjectExpiryContext<'a> {
     api: Arc<ECStore>,
     bucket: &'a str,
-    lc: Arc<BucketLifecycleConfiguration>,
+    lc: Arc<PersistedLifecycleConfiguration>,
     lock_config: Option<Arc<ObjectLockConfiguration>>,
     bucket_incarnation_id: Uuid,
     src: &'a LcEventSrc,
@@ -4585,8 +4594,9 @@ async fn enqueue_expiry_for_existing_object_group(
         .iter()
         .map(lifecycle::object_opts_from_object_info)
         .collect::<Vec<ObjectOpts>>();
+    let evaluator_lock_config = context.lock_config.clone();
     let events = match Evaluator::new(context.lc.clone())
-        .with_lock_retention(context.lock_config.clone())
+        .with_lock_retention(evaluator_lock_config)
         .eval(&object_opts)
         .await
     {
@@ -4780,7 +4790,7 @@ fn manual_transition_version_marker(oi: &ObjectInfo) -> String {
 async fn enqueue_transition_with_lifecycle_report(
     api: Option<Arc<ECStore>>,
     oi: &ObjectInfo,
-    lc: &BucketLifecycleConfiguration,
+    lc: &PersistedLifecycleConfiguration,
     src: &LcEventSrc,
     options: &ManualTransitionRunOptions,
     report: &mut ManualTransitionRunReport,
@@ -4846,7 +4856,7 @@ async fn enqueue_transition_with_lifecycle_report(
     false
 }
 
-async fn enqueue_transition_with_lifecycle(oi: &ObjectInfo, lc: &BucketLifecycleConfiguration, src: &LcEventSrc) -> bool {
+async fn enqueue_transition_with_lifecycle(oi: &ObjectInfo, lc: &PersistedLifecycleConfiguration, src: &LcEventSrc) -> bool {
     let event = lc.eval(&oi.to_lifecycle_opts()).await;
     match event.action {
         IlmAction::TransitionAction | IlmAction::TransitionVersionAction => {
@@ -5360,12 +5370,8 @@ pub async fn post_restore_opts(version_id: &str, bucket: &str, object: &str) ->
     })
 }
 
-fn select_restore_s3_location(rreq: &RestoreRequest) -> Result<Option<&s3s::dto::S3Location>, std::io::Error> {
-    if rreq
-        .type_
-        .as_ref()
-        .is_none_or(|type_| type_.as_str() != RestoreRequestType::SELECT)
-    {
+fn select_restore_s3_location(rreq: &RestoreRequest) -> Result<Option<&RestoreS3Location>, std::io::Error> {
+    if rreq.type_.as_ref().is_none_or(|type_| type_.as_str() != "SELECT") {
         return Ok(None);
     }
     let output_location = rreq
@@ -5407,27 +5413,25 @@ pub async fn put_restore_opts(
     // the OutputLocation metadata instead of a write to `OutputLocation.S3`
     // (backlog#1341). RestoreObject rejects SELECT at the API boundary; this
     // is the fail-closed backstop for any other caller.
-    if rreq
-        .type_
-        .as_ref()
-        .is_some_and(|type_| type_.as_str() == RestoreRequestType::SELECT)
-    {
+    if rreq.type_.as_ref().is_some_and(|type_| type_.as_str() == "SELECT") {
         return Err(std::io::Error::other("SELECT restore requests are not supported"));
     }
     for (k, v) in oi.user_defined.iter() {
         meta.insert(k.to_string(), v.clone());
     }
+    // The fleet capability gate guarantees physical copy-back support. Keep
+    // the completed transition identity for orphan recovery and remote cleanup.
     rustfs_utils::http::metadata_compat::remove_str(&mut meta, rustfs_utils::http::metadata_compat::SUFFIX_RESTORE_OPERATION_ID);
-    rustfs_utils::http::metadata_compat::remove_str(&mut meta, rustfs_utils::http::metadata_compat::SUFFIX_RESTORE_WORKER_LOCK);
     if !oi.user_tags.is_empty() {
         meta.insert(AMZ_OBJECT_TAGGING.to_string(), (*oi.user_tags).clone());
     }
-    let restore_expiry = lifecycle::expected_expiry_time(OffsetDateTime::now_utc(), rreq.days.unwrap_or(1));
+    // Finalization publishes completion and its expiry under the object lock.
+    // The local copy-back commit must not make unfinished work eligible for expiry.
     meta.insert(
         metadata_keys::RESTORE.to_string(),
         RestoreStatus {
-            is_restore_in_progress: Some(false),
-            restore_expiry_date: Some(restore_expiry),
+            is_restore_in_progress: Some(true),
+            restore_expiry_date: None,
         }
         .to_string(),
     );
@@ -5441,6 +5445,7 @@ pub async fn put_restore_opts(
         // computed MD5 is not the object's public plaintext ETag.
         preserve_etag: oi.etag.clone(),
         shard_integrity_write_mode: Some(oi.shard_integrity_write_mode()),
+        restore_copyback: true,
         //expires:           oi.expires,
         ..Default::default()
     })
@@ -5460,6 +5465,18 @@ impl LifecycleOps for ObjectInfo {
         if self.transitioned_object.status != lifecycle::TRANSITION_COMPLETE {
             return false;
         }
+        if rustfs_utils::http::metadata_compat::get_consistent_str(
+            &self.user_defined,
+            rustfs_utils::http::metadata_compat::SUFFIX_RESTORE_COPYBACK,
+        ) == Some(rustfs_utils::http::metadata_compat::RESTORE_COPYBACK_PROTOCOL_V1)
+            && self
+                .user_defined
+                .get(metadata_keys::RESTORE)
+                .and_then(|value| rustfs_filemeta::parse_restore_obj_status(value).ok())
+                .is_some_and(|status| status.is_restore_in_progress == Some(true))
+        {
+            return false;
+        }
         !is_restored_object_on_disk(&self.user_defined)
     }
 }
@@ -5471,25 +5488,25 @@ pub trait RestoreRequestOps {
 impl RestoreRequestOps for RestoreRequest {
     fn validate(&self, _api: Arc<ECStore>) -> Result<(), std::io::Error> {
         // SELECT type requires select_parameters, and vice versa
-        if self.type_.as_ref().is_none_or(|t| t.as_str() != RestoreRequestType::SELECT) && self.select_parameters.is_some() {
+        if self.type_.as_ref().is_none_or(|t| t.as_str() != "SELECT") && self.select_parameters.is_some() {
             return Err(std::io::Error::other("Select parameters can only be specified with SELECT request type"));
         }
         if let Some(type_) = &self.type_
-            && type_.as_str() == RestoreRequestType::SELECT
+            && type_.as_str() == "SELECT"
             && self.select_parameters.is_none()
         {
             return Err(std::io::Error::other("SELECT restore request requires select parameters to be specified"));
         }
 
         // OutputLocation is only valid for SELECT requests
-        if self.type_.as_ref().is_none_or(|t| t.as_str() != RestoreRequestType::SELECT) && self.output_location.is_some() {
+        if self.type_.as_ref().is_none_or(|t| t.as_str() != "SELECT") && self.output_location.is_some() {
             return Err(std::io::Error::other("OutputLocation can only be specified with SELECT request type"));
         }
         select_restore_s3_location(self)?;
 
         // Days must not be specified with SELECT requests
         if let Some(type_) = &self.type_
-            && type_.as_str() == RestoreRequestType::SELECT
+            && type_.as_str() == "SELECT"
             && self.days.is_some_and(|d| d > 0)
         {
             return Err(std::io::Error::other("Days cannot be specified with SELECT restore request"));
@@ -5531,7 +5548,7 @@ pub fn lifecycle_version_delete_target(oi: &ObjectInfo) -> Option<ObjectToDelete
 }
 
 pub async fn eval_action_from_lifecycle(
-    lc: &BucketLifecycleConfiguration,
+    lc: &PersistedLifecycleConfiguration,
     lock_config: Option<&ObjectLockConfiguration>,
     oi: &ObjectInfo,
 ) -> lifecycle::Event {
@@ -6236,14 +6253,19 @@ mod tests {
     use rustfs_data_usage::TierStats;
     use rustfs_filemeta::metadata_keys;
     use rustfs_filemeta::{FileInfo, FileMeta};
+    use rustfs_gateway_types::dto::MetadataEntry;
+    use rustfs_gateway_types::persistence::{
+        PersistedDefaultRetention as DefaultRetention, PersistedObjectLockConfiguration as ObjectLockConfiguration,
+        PersistedObjectLockRule as ObjectLockRule,
+    };
+    use rustfs_gateway_types::persistence::{
+        PersistedLifecycleConfiguration, PersistedLifecycleExpiration, PersistedLifecycleRule,
+        PersistedNoncurrentVersionExpiration, PersistedTransition,
+    };
+    use rustfs_lifecycle::{RestoreOutputLocation as OutputLocation, RestoreRequest, RestoreS3Location as S3Location};
     #[cfg(feature = "test-util")]
     use rustfs_s3_client::transition_api::ReaderImpl;
     use rustfs_scanner_metrics::metrics::{IlmAction, global_metrics};
-    use s3s::dto::{
-        BucketLifecycleConfiguration, DefaultRetention, ExpirationStatus, LifecycleExpiration, LifecycleRule, MetadataEntry,
-        NoncurrentVersionExpiration, ObjectLockConfiguration, ObjectLockEnabled, ObjectLockRetentionMode, ObjectLockRule,
-        OutputLocation, RestoreRequest, RestoreRequestType, S3Location, Timestamp, Transition, TransitionStorageClass,
-    };
     use serial_test::serial;
     use sha2::{Digest, Sha256};
     use std::collections::HashMap;
@@ -8497,104 +8519,6 @@ mod tests {
         }
     }
 
-    #[cfg(feature = "test-util")]
-    #[tokio::test]
-    #[serial]
-    async fn artifact_delete_entrypoints_free_version_cleaner_completes_with_queued_lifecycle_writer() {
-        let (disk_paths, ecstore) = setup_test_env().await;
-        let bucket = format!("free-version-queued-writer-{}", Uuid::new_v4());
-        let object = "free-version";
-        create_test_bucket(&ecstore, &bucket).await;
-        let (backend, identity) = register_recovery_mock_tier(&ecstore).await;
-        seed_recoverable_free_version(&disk_paths, &bucket, object, None, Some(identity)).await;
-        let oi = list_tier_free_versions(Arc::clone(&ecstore), 100, None, None, CancellationToken::new())
-            .await
-            .expect("list real persisted free version")
-            .items
-            .into_iter()
-            .find(|oi| oi.bucket == bucket)
-            .expect("free-version task must address this fixture");
-        assert!(oi.transitioned_object.free_version);
-        backend
-            .set_put_remote_version(Some(oi.transitioned_object.version_id.clone()))
-            .await;
-        let remote = TierConfigMgr::acquire_operation_lease(&ecstore.tier_config_mgr(), "WARM")
-            .await
-            .expect("remote fixture lease");
-        remote
-            .put(&oi.transitioned_object.name, ReaderImpl::Body(Bytes::from_static(b"body")), 4)
-            .await
-            .expect("seed exact remote object");
-        drop(remote);
-
-        let barrier = Arc::new(super::FreeVersionPostRemoteDeleteTestBarrier::default());
-        let cleanup_barrier = Arc::clone(&barrier);
-        let cleanup_store = Arc::clone(&ecstore);
-        let cleanup_oi = oi.clone();
-        let mut cleanup = tokio::spawn(async move {
-            super::FREE_VERSION_POST_REMOTE_DELETE_TEST_BARRIER
-                .scope(cleanup_barrier, async move {
-                    super::cleanup_free_version_exact(cleanup_store, &cleanup_oi, &CancellationToken::new()).await
-                })
-                .await
-        });
-        tokio::time::timeout(StdDuration::from_secs(10), barrier.arrived.notified())
-            .await
-            .expect("cleaner owns lifecycle READ and has completed remote DELETE");
-        assert!(!backend.contains(&oi.transitioned_object.name).await);
-        for disk in &disk_paths {
-            assert!(
-                disk.join(&bucket).join(object).join(STORAGE_FORMAT_FILE).is_file(),
-                "local exact cleanup must still be pending at the boundary"
-            );
-        }
-
-        // Resolve first so the pending poll is the actual local lock wait.
-        // A later READ would normally be admitted alongside the cleaner's READ;
-        // its pending state independently proves this WRITE is now queued.
-        let lifecycle = ecstore
-            .new_ns_lock(&bucket, crate::storage_api_contracts::bucket::BUCKET_LIFECYCLE_LOCK_OBJECT)
-            .await
-            .expect("lifecycle namespace");
-        let mut writer = Box::pin(lifecycle.get_write_lock(StdDuration::from_secs(30)));
-        let writer_queued = futures::poll!(&mut writer).is_pending();
-        let mut later_reader = Box::pin(lifecycle.get_read_lock(StdDuration::from_secs(30)));
-        let later_reader_blocked = futures::poll!(&mut later_reader).is_pending();
-        drop(later_reader);
-        barrier.release.notify_one();
-        assert!(writer_queued, "cleaner must retain the real lifecycle READ owner");
-        assert!(later_reader_blocked, "queued lifecycle WRITE must block a later READ");
-
-        // Keep the same WRITE future queued, without cancelling/retrying it.
-        // Re-entering READ here would deadlock behind this waiting writer.
-        let finished = tokio::time::timeout(StdDuration::from_secs(10), &mut cleanup).await;
-        if finished.is_err() {
-            cleanup.abort();
-            drop(writer);
-            let _ = tokio::time::timeout(StdDuration::from_secs(5), &mut cleanup).await;
-            panic!("exact local free-version cleanup re-entered lifecycle READ behind the queued writer");
-        }
-        assert!(
-            finished
-                .expect("bounded cleaner completion")
-                .expect("cleaner task")
-                .expect("exact local cleanup")
-        );
-        let writer = tokio::time::timeout(StdDuration::from_secs(10), writer)
-            .await
-            .expect("queued lifecycle WRITE proceeds after real cleanup drains")
-            .expect("lifecycle WRITE acquired");
-        for disk in &disk_paths {
-            assert!(!disk.join(&bucket).join(object).exists(), "free version remains on a real local disk");
-        }
-        assert_eq!(backend.remove_count().await, 1, "cleaner must delete the exact remote tuple once");
-        drop(writer);
-        ecstore
-            .delete_bucket(&bucket, &DeleteBucketOptions::default())
-            .await
-            .expect("remove empty fixture bucket");
-    }
-
     #[cfg(feature = "test-util")]
     #[tokio::test]
     #[serial]
@@ -9348,7 +9272,7 @@ mod tests {
             output_location,
             select_parameters: None,
             tier: None,
-            type_: Some(RestoreRequestType::from_static(RestoreRequestType::SELECT)),
+            type_: Some("SELECT".to_owned()),
         }
     }
 
@@ -9665,12 +9589,12 @@ mod tests {
 
     #[test]
     fn lifecycle_rule_has_date_expiration_detects_enabled_date_rule() {
-        let lc = BucketLifecycleConfiguration {
+        let lc = PersistedLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![LifecycleRule {
-                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
-                expiration: Some(LifecycleExpiration {
-                    date: Some(Timestamp::from(OffsetDateTime::now_utc())),
+            rules: vec![PersistedLifecycleRule {
+                status: "Enabled".to_owned(),
+                expiration: Some(PersistedLifecycleExpiration {
+                    date: Some(lifecycle::format_lifecycle_date(OffsetDateTime::now_utc()).unwrap()),
                     ..Default::default()
                 }),
                 id: Some("rule-date".to_string()),
@@ -10187,14 +10111,15 @@ mod tests {
     #[test]
     fn should_defer_date_expiry_for_recent_config_update_respects_grace_window() {
         let now = OffsetDateTime::now_utc();
-        let recent = BucketLifecycleConfiguration {
-            expiry_updated_at: Some(Timestamp::from(now - time::Duration::seconds(1))),
+        let recent = PersistedLifecycleConfiguration {
+            expiry_updated_at: Some(lifecycle::format_lifecycle_date(now - time::Duration::seconds(1)).unwrap()),
             rules: Vec::new(),
         };
-        let stale = BucketLifecycleConfiguration {
-            expiry_updated_at: Some(Timestamp::from(
-                now - time::Duration::seconds(DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS + 1),
-            )),
+        let stale = PersistedLifecycleConfiguration {
+            expiry_updated_at: Some(
+                lifecycle::format_lifecycle_date(now - time::Duration::seconds(DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS + 1))
+                    .unwrap(),
+            ),
             rules: Vec::new(),
         };
 
@@ -10322,12 +10247,12 @@ mod tests {
         assert_eq!(deleted.version_id, None);
     }
 
-    fn expired_delete_marker_lifecycle() -> BucketLifecycleConfiguration {
-        BucketLifecycleConfiguration {
+    fn expired_delete_marker_lifecycle() -> PersistedLifecycleConfiguration {
+        PersistedLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![LifecycleRule {
-                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
-                expiration: Some(LifecycleExpiration {
+            rules: vec![PersistedLifecycleRule {
+                status: "Enabled".to_owned(),
+                expiration: Some(PersistedLifecycleExpiration {
                     expired_object_delete_marker: Some(true),
                     ..Default::default()
                 }),
@@ -10343,12 +10268,12 @@ mod tests {
         }
     }
 
-    fn latest_expiration_lifecycle() -> BucketLifecycleConfiguration {
-        BucketLifecycleConfiguration {
+    fn latest_expiration_lifecycle() -> PersistedLifecycleConfiguration {
+        PersistedLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![LifecycleRule {
-                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
-                expiration: Some(LifecycleExpiration {
+            rules: vec![PersistedLifecycleRule {
+                status: "Enabled".to_owned(),
+                expiration: Some(PersistedLifecycleExpiration {
                     days: Some(1),
                     ..Default::default()
                 }),
@@ -10364,12 +10289,12 @@ mod tests {
         }
     }
 
-    fn current_and_noncurrent_expiration_lifecycle() -> BucketLifecycleConfiguration {
-        BucketLifecycleConfiguration {
+    fn current_and_noncurrent_expiration_lifecycle() -> PersistedLifecycleConfiguration {
+        PersistedLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![LifecycleRule {
-                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
-                expiration: Some(LifecycleExpiration {
+            rules: vec![PersistedLifecycleRule {
+                status: "Enabled".to_owned(),
+                expiration: Some(PersistedLifecycleExpiration {
                     days: Some(30),
                     ..Default::default()
                 }),
@@ -10377,7 +10302,7 @@ mod tests {
                 del_marker_expiration: None,
                 filter: None,
                 id: Some("expire-current-and-noncurrent".to_string()),
-                noncurrent_version_expiration: Some(NoncurrentVersionExpiration {
+                noncurrent_version_expiration: Some(PersistedNoncurrentVersionExpiration {
                     noncurrent_days: Some(1),
                     newer_noncurrent_versions: None,
                 }),
@@ -10388,12 +10313,12 @@ mod tests {
         }
     }
 
-    fn all_versions_expiration_lifecycle() -> BucketLifecycleConfiguration {
-        BucketLifecycleConfiguration {
+    fn all_versions_expiration_lifecycle() -> PersistedLifecycleConfiguration {
+        PersistedLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![LifecycleRule {
-                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
-                expiration: Some(LifecycleExpiration {
+            rules: vec![PersistedLifecycleRule {
+                status: "Enabled".to_owned(),
+                expiration: Some(PersistedLifecycleExpiration {
                     days: Some(1),
                     expired_object_all_versions: Some(true),
                     ..Default::default()
@@ -10412,29 +10337,29 @@ mod tests {
 
     fn lock_enabled_without_default_retention() -> ObjectLockConfiguration {
         ObjectLockConfiguration {
-            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+            object_lock_enabled: Some("Enabled".to_owned()),
             rule: None,
         }
     }
 
     fn lock_enabled_with_default_retention() -> ObjectLockConfiguration {
         ObjectLockConfiguration {
-            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+            object_lock_enabled: Some("Enabled".to_owned()),
             rule: Some(ObjectLockRule {
                 default_retention: Some(DefaultRetention {
                     days: Some(30),
-                    mode: Some(ObjectLockRetentionMode::from_static(ObjectLockRetentionMode::COMPLIANCE)),
+                    mode: Some("COMPLIANCE".to_owned()),
                     years: None,
                 }),
             }),
         }
     }
 
-    fn latest_transition_lifecycle() -> BucketLifecycleConfiguration {
-        BucketLifecycleConfiguration {
+    fn latest_transition_lifecycle() -> PersistedLifecycleConfiguration {
+        PersistedLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![LifecycleRule {
-                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
+            rules: vec![PersistedLifecycleRule {
+                status: "Enabled".to_owned(),
                 expiration: None,
                 abort_incomplete_multipart_upload: None,
                 del_marker_expiration: None,
@@ -10443,10 +10368,10 @@ mod tests {
                 noncurrent_version_expiration: None,
                 noncurrent_version_transitions: None,
                 prefix: None,
-                transitions: Some(vec![Transition {
+                transitions: Some(vec![PersistedTransition {
                     days: Some(1),
                     date: None,
-                    storage_class: Some(TransitionStorageClass::from_static("WARM")),
+                    storage_class: Some("WARM".to_owned()),
                 }]),
             }],
         }
@@ -12989,8 +12914,9 @@ mod tests {
 
         for (name, object, lock_config, expected) in cases {
             let object_opts = lifecycle::object_opts_from_object_info(&object);
+            let evaluator_lock_config = lock_config.clone().map(Arc::new);
             let batch_event = Evaluator::new(Arc::new(lifecycle.clone()))
-                .with_lock_retention(lock_config.clone().map(Arc::new))
+                .with_lock_retention(evaluator_lock_config)
                 .eval(&[object_opts])
                 .await
                 .expect("batch lifecycle evaluation should succeed")
@@ -14247,10 +14173,7 @@ mod tests {
         let object = current_object_with_metadata(
             ReplicationStatusType::Completed,
             HashMap::from([
-                (
-                    metadata_keys::OBJECT_LOCK_MODE.to_string(),
-                    s3s::dto::ObjectLockRetentionMode::COMPLIANCE.to_string(),
-                ),
+                (metadata_keys::OBJECT_LOCK_MODE.to_string(), "COMPLIANCE".to_string()),
                 (metadata_keys::OBJECT_LOCK_RETAIN_UNTIL_DATE.to_string(), retain_until),
             ]),
         );
@@ -14262,7 +14185,7 @@ mod tests {
 
     #[tokio::test]
     async fn restored_copy_expiry_is_not_blocked_by_retention() {
-        let lifecycle = BucketLifecycleConfiguration {
+        let lifecycle = PersistedLifecycleConfiguration {
             expiry_updated_at: None,
             rules: Vec::new(),
         };
@@ -14272,10 +14195,7 @@ mod tests {
         let mut object = current_object_with_metadata(
             ReplicationStatusType::Completed,
             HashMap::from([
-                (
-                    metadata_keys::OBJECT_LOCK_MODE.to_string(),
-                    ObjectLockRetentionMode::COMPLIANCE.to_string(),
-                ),
+                (metadata_keys::OBJECT_LOCK_MODE.to_string(), "COMPLIANCE".to_string()),
                 (metadata_keys::OBJECT_LOCK_RETAIN_UNTIL_DATE.to_string(), retain_until),
             ]),
         );
@@ -14492,7 +14412,7 @@ mod tests {
                 "removed" => {
                     metadata_sys::delete(&bucket, BUCKET_LIFECYCLE_CONFIG).await.unwrap();
                 }
-                "disabled" => changed.rules[0].status = ExpirationStatus::from_static(ExpirationStatus::DISABLED),
+                "disabled" => changed.rules[0].status = "Disabled".to_owned(),
                 "longer-days" => {
                     changed.rules[0]
                         .noncurrent_version_expiration
@@ -14608,7 +14528,7 @@ mod tests {
         );
     }
 
-    async fn install_test_expiry_policy(ecstore: &Arc<ECStore>, bucket: &str) -> Arc<BucketLifecycleConfiguration> {
+    async fn install_test_expiry_policy(ecstore: &Arc<ECStore>, bucket: &str) -> Arc<PersistedLifecycleConfiguration> {
         let xml = br#"<LifecycleConfiguration><Rule><ID>expire</ID><Status>Enabled</Status><Filter><Prefix></Prefix></Filter><Expiration><Days>0</Days></Expiration><NoncurrentVersionExpiration><NoncurrentDays>0</NoncurrentDays></NoncurrentVersionExpiration></Rule></LifecycleConfiguration>"#;
         metadata_sys::update_in(&ecstore.ctx, bucket, BUCKET_LIFECYCLE_CONFIG, xml.to_vec())
             .await
@@ -15081,7 +15001,11 @@ mod tests {
     #[tokio::test]
     #[serial]
     async fn tier_free_version_recovery_production_entrypoint_enqueues_seeded_item() {
-        let (disk_paths, ecstore) = setup_test_env().await;
+        let (disk_paths, ecstore) =
+            temp_env::async_with_vars([(super::ENV_TIER_FREE_VERSION_RECOVERY_ENABLED, Some("false"))], async {
+                setup_test_env().await
+            })
+            .await;
         let tier = format!("RECOVERY{}", Uuid::new_v4().simple()).to_uppercase();
         crate::services::tier::test_util::register_mock_tier(&ecstore.tier_config_mgr(), &tier).await;
         let runtime_state = install_unconsumed_runtime_expiry_worker(&ecstore, 1).await;

crates/ecstore/src/bucket/lifecycle/core.rs

@@ -17,7 +17,7 @@ use crate::object_api::ObjectInfo;
 pub use rustfs_lifecycle::{
     Event, ExpirationOptions, IlmAction, LIFECYCLE_MALFORMED_XML_ERROR_KIND, Lifecycle, LifecycleCalculate, ObjectOpts,
     RuleValidate, TRANSITION_COMPLETE, TRANSITION_PENDING, TransitionOptions, abort_incomplete_multipart_upload_due,
-    expected_expiry_time, expiration_action_has_valid_target,
+    expected_expiry_time, expiration_action_has_valid_target, format_lifecycle_date, parse_lifecycle_date,
 };
 
 pub fn object_opts_from_object_info(oi: &ObjectInfo) -> ObjectOpts {

crates/ecstore/src/bucket/lifecycle/metadata_boundary.rs

@@ -14,7 +14,8 @@
 
 use std::sync::Arc;
 
-use s3s::dto::{BucketLifecycleConfiguration, ObjectLockConfiguration};
+use rustfs_gateway_types::persistence::PersistedLifecycleConfiguration;
+use rustfs_gateway_types::persistence::PersistedObjectLockConfiguration as ObjectLockConfiguration;
 use time::OffsetDateTime;
 use uuid::Uuid;
 
@@ -24,7 +25,7 @@ use crate::error::{Error, Result};
 
 #[derive(Debug)]
 pub(crate) struct LifecycleExpiryConfigs {
-    pub(crate) lifecycle: Option<Arc<BucketLifecycleConfiguration>>,
+    pub(crate) lifecycle: Option<Arc<PersistedLifecycleConfiguration>>,
     pub(crate) object_lock: Option<Arc<ObjectLockConfiguration>>,
     pub(crate) bucket_incarnation_id: Uuid,
     pub(crate) table_bucket_enabled: bool,
@@ -107,7 +108,7 @@ pub(crate) async fn get_expiry_configs_for_options(
     })
 }
 
-pub(crate) async fn get_lifecycle_config(bucket: &str) -> Result<(BucketLifecycleConfiguration, OffsetDateTime)> {
+pub(crate) async fn get_lifecycle_config(bucket: &str) -> Result<(PersistedLifecycleConfiguration, OffsetDateTime)> {
     metadata_sys::get_lifecycle_config(bucket).await
 }
 
@@ -117,15 +118,15 @@ mod tests {
     use crate::bucket::metadata::BucketMetadata;
     use crate::bucket::metadata_sys::{self, test_support::isolated_store_over_temp_disks};
     use crate::storage_api_contracts::bucket::MakeBucketOptions;
-    use s3s::dto::{ExpirationStatus, LifecycleExpiration, LifecycleRule};
+    use rustfs_gateway_types::persistence::{PersistedLifecycleExpiration, PersistedLifecycleRule};
     use serial_test::serial;
 
-    fn lifecycle_config() -> BucketLifecycleConfiguration {
-        BucketLifecycleConfiguration {
+    fn lifecycle_config() -> PersistedLifecycleConfiguration {
+        PersistedLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![LifecycleRule {
-                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
-                expiration: Some(LifecycleExpiration {
+            rules: vec![PersistedLifecycleRule {
+                status: "Enabled".to_owned(),
+                expiration: Some(PersistedLifecycleExpiration {
                     days: Some(1),
                     ..Default::default()
                 }),

crates/ecstore/src/bucket/lifecycle/object_lock_boundary.rs

@@ -22,7 +22,7 @@ pub(crate) fn is_object_locked_by_metadata(user_defined: &HashMap<String, String
 }
 
 pub(crate) fn check_object_lock_for_deletion_with_config(
-    config: Option<&s3s::dto::ObjectLockConfiguration>,
+    config: Option<&rustfs_gateway_types::persistence::PersistedObjectLockConfiguration>,
     obj_info: &ObjectInfo,
     bypass_governance: bool,
 ) -> crate::error::Result<Option<ObjectLockBlockReason>> {

crates/ecstore/src/bucket/lifecycle/replication_sink.rs

@@ -82,12 +82,13 @@ mod tests {
     use crate::bucket::replication::{DeleteReplicationConfigSnapshot, ReplicationObjectBridge};
     use crate::object_api::{ObjectInfo, ObjectOptions};
     use crate::storage_api_contracts::object::ObjectToDelete;
-    use rustfs_scanner_metrics::metrics::IlmAction;
-    use s3s::dto::{
-        BucketVersioningStatus, DeleteMarkerReplication, DeleteMarkerReplicationStatus, DeleteReplication,
-        DeleteReplicationStatus, Destination, ReplicationConfiguration, ReplicationRule, ReplicationRuleStatus,
-        VersioningConfiguration,
+    use rustfs_gateway_types::dto::Status;
+    use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
+    use rustfs_gateway_types::persistence::{
+        PersistedOptionalReplicationStatus, PersistedReplicationConfiguration, PersistedReplicationDestination,
+        PersistedReplicationRule, PersistedReplicationStatus,
     };
+    use rustfs_scanner_metrics::metrics::IlmAction;
     use uuid::Uuid;
 
     use super::*;
@@ -160,27 +161,27 @@ mod tests {
             for purge_enabled in [false, true] {
                 let snapshot = DeleteReplicationConfigSnapshot::from_configs_for_test(
                     VersioningConfiguration {
-                        status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
+                        status: Some("Enabled".to_owned()),
                         ..Default::default()
                     },
-                    Some(ReplicationConfiguration {
+                    Some(PersistedReplicationConfiguration {
                         role: String::new(),
-                        rules: vec![ReplicationRule {
-                            delete_marker_replication: Some(DeleteMarkerReplication {
+                        rules: vec![PersistedReplicationRule {
+                            delete_marker_replication: Some(PersistedOptionalReplicationStatus {
                                 status: Some(if marker_enabled {
-                                    DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::ENABLED)
+                                    Status::ENABLED.to_string()
                                 } else {
-                                    DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::DISABLED)
+                                    Status::DISABLED.to_string()
                                 }),
                             }),
-                            delete_replication: Some(DeleteReplication {
+                            delete_replication: Some(PersistedReplicationStatus {
                                 status: if purge_enabled {
-                                    DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED)
+                                    Status::ENABLED.to_string()
                                 } else {
-                                    DeleteReplicationStatus::from_static(DeleteReplicationStatus::DISABLED)
+                                    Status::DISABLED.to_string()
                                 },
                             }),
-                            destination: Destination {
+                            destination: PersistedReplicationDestination {
                                 bucket: "arn:rustfs:replication:target".to_string(),
                                 ..Default::default()
                             },
@@ -190,7 +191,7 @@ mod tests {
                             prefix: Some(String::new()),
                             priority: Some(1),
                             source_selection_criteria: None,
-                            status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
+                            status: Status::ENABLED.to_string(),
                         }],
                     }),
                 );

crates/ecstore/src/bucket/lifecycle/runtime_boundary.rs

@@ -14,7 +14,7 @@
 
 use std::sync::Arc;
 
-use s3s::dto::BucketLifecycleConfiguration;
+use rustfs_gateway_types::persistence::PersistedLifecycleConfiguration;
 use tokio::sync::RwLock;
 use tokio_util::sync::CancellationToken;
 
@@ -52,7 +52,7 @@ pub(crate) fn deployment_id() -> Option<String> {
     sources::deployment_id()
 }
 
-pub(crate) async fn bucket_lifecycle_config(bucket: &str) -> Option<BucketLifecycleConfiguration> {
+pub(crate) async fn bucket_lifecycle_config(bucket: &str) -> Option<PersistedLifecycleConfiguration> {
     sources::bucket_lifecycle_config(bucket).await
 }
 

crates/ecstore/src/bucket/metadata.rs

@@ -13,7 +13,7 @@
 // limitations under the License.
 
 use super::msgp_decode::{read_msgp_ext8_time, skip_msgp_value, write_msgp_time};
-use super::object_lock::{ObjectLockApi, ObjectLockStatusExt};
+use super::object_lock::ObjectLockApi;
 use super::versioning::VersioningApi;
 use super::{quota::BucketQuota, target::BucketTargets};
 use crate::bucket::replication::invalid_replication_config_status_field;
@@ -25,12 +25,17 @@ use crate::object_api::WriteCompletion;
 use crate::runtime::sources as runtime_sources;
 use crate::store::ECStore;
 use byteorder::{BigEndian, ByteOrder, LittleEndian};
-use rustfs_policy::policy::BucketPolicy;
-use s3s::dto::{
-    AccelerateConfiguration, BucketLifecycleConfiguration, BucketLoggingStatus, BucketVersioningStatus, CORSConfiguration,
-    NotificationConfiguration, ObjectLockConfiguration, PublicAccessBlockConfiguration, ReplicationConfiguration,
-    RequestPaymentConfiguration, ServerSideEncryptionConfiguration, Tagging, VersioningConfiguration, WebsiteConfiguration,
+use rustfs_gateway_types::cors_tagging::{PersistedCorsConfiguration as CORSConfiguration, PersistedTagging as Tagging};
+use rustfs_gateway_types::persistence::{
+    PersistedAccelerateConfiguration as AccelerateConfiguration,
+    PersistedBucketEncryptionConfiguration as ServerSideEncryptionConfiguration,
+    PersistedBucketLoggingStatus as BucketLoggingStatus, PersistedLifecycleConfiguration,
+    PersistedNotificationConfiguration as NotificationConfiguration, PersistedObjectLockConfiguration as ObjectLockConfiguration,
+    PersistedPublicAccessBlockConfiguration as PublicAccessBlockConfiguration, PersistedReplicationConfiguration,
+    PersistedRequestPaymentConfiguration as RequestPaymentConfiguration,
+    PersistedVersioningConfiguration as VersioningConfiguration, PersistedWebsiteConfiguration as WebsiteConfiguration,
 };
+use rustfs_policy::policy::BucketPolicy;
 use serde::Serializer;
 use sha2::{Digest, Sha256};
 use std::collections::HashMap;
@@ -40,23 +45,11 @@ use time::{Date, OffsetDateTime, PrimitiveDateTime, Time as CivilTime, UtcOffset
 use tracing::error;
 use uuid::Uuid;
 
-// The serving-layer DTO impls for the storage-level Object Lock traits live
-// here because this module owns the persisted `ObjectLockConfiguration`
-// during the s3s ratchet migration (rustfs/backlog#1842).
+// The persisted Object Lock configuration answers the storage-level trait
+// here because this module owns the persisted `ObjectLockConfiguration`.
 impl ObjectLockApi for ObjectLockConfiguration {
     fn enabled(&self) -> bool {
-        self.object_lock_enabled
-            .as_ref()
-            .is_some_and(|v| v.as_str() == s3s::dto::ObjectLockEnabled::ENABLED)
-    }
-}
-
-impl ObjectLockStatusExt for s3s::dto::ObjectLockLegalHoldStatus {
-    fn valid(&self) -> bool {
-        matches!(
-            self.as_str(),
-            s3s::dto::ObjectLockLegalHoldStatus::ON | s3s::dto::ObjectLockLegalHoldStatus::OFF
-        )
+        self.object_lock_enabled.as_deref() == Some("Enabled")
     }
 }
 
@@ -437,10 +430,10 @@ pub struct BucketMetadata {
     pub created: OffsetDateTime,
     pub lock_enabled: bool, // While marked as unused, it may need to be retained
     pub bucket_incarnation_id: Uuid,
-    pub artifact_base_prefix: Option<String>,
-    pub artifact_backup_retained: bool,
     pub(crate) bucket_incarnation_sidecar: bool,
     pub(crate) bucket_creation_committed: bool,
+    // A legacy default is not proof of an interrupted creation.
+    pub(crate) bucket_creation_commit_record_present: bool,
     pub policy_config_json: Vec<u8>,
     pub notification_config_xml: Vec<u8>,
     pub lifecycle_config_xml: Vec<u8>,
@@ -489,13 +482,13 @@ pub struct BucketMetadata {
 
     pub policy_config: Option<BucketPolicy>,
     pub notification_config: Option<NotificationConfiguration>,
-    pub lifecycle_config: Option<BucketLifecycleConfiguration>,
+    pub lifecycle_config: Option<PersistedLifecycleConfiguration>,
     pub object_lock_config: Option<ObjectLockConfiguration>,
     pub versioning_config: Option<VersioningConfiguration>,
     pub sse_config: Option<ServerSideEncryptionConfiguration>,
     pub tagging_config: Option<Tagging>,
     pub quota_config: Option<BucketQuota>,
-    pub replication_config: Option<ReplicationConfiguration>,
+    pub replication_config: Option<PersistedReplicationConfiguration>,
     pub bucket_target_config: Option<BucketTargets>,
     pub bucket_target_config_meta: Option<HashMap<String, String>>,
     pub cors_config: Option<CORSConfiguration>,
@@ -514,10 +507,9 @@ impl Default for BucketMetadata {
             created: OffsetDateTime::UNIX_EPOCH,
             lock_enabled: Default::default(),
             bucket_incarnation_id: Uuid::nil(),
-            artifact_base_prefix: None,
-            artifact_backup_retained: false,
             bucket_incarnation_sidecar: false,
             bucket_creation_committed: false,
+            bucket_creation_commit_record_present: false,
             policy_config_json: Default::default(),
             notification_config_xml: Default::default(),
             lifecycle_config_xml: Default::default(),
@@ -611,7 +603,7 @@ impl BucketMetadata {
     /// legacy migration path, which mints the sidecar first; it must not be
     /// rewritten by this migration.
     pub(crate) fn needs_bucket_creation_commit(&self) -> bool {
-        (self.lock_enabled || self.artifact_base_prefix.is_some())
+        self.lock_enabled
             && !self.bucket_creation_committed
             && self.bucket_incarnation_sidecar
             && !self.bucket_incarnation_id.is_nil()
@@ -708,22 +700,6 @@ impl BucketMetadata {
                     self.bucket_incarnation_id =
                         Uuid::from_slice(&bytes).map_err(|err| Error::other(format!("invalid BucketIncarnationID: {err}")))?;
                 }
-                "ArtifactBackupRetained" => {
-                    if self.artifact_backup_retained || !rmp::decode::read_bool(rd)? {
-                        return Err(Error::other("invalid artifact backup retention marker"));
-                    }
-                    self.artifact_backup_retained = true;
-                }
-                "ArtifactBasePrefix" => {
-                    if self.artifact_base_prefix.is_some() {
-                        return Err(Error::other("duplicate artifact namespace"));
-                    }
-                    let prefix = read_msgp_str(rd)?;
-                    if !crate::storage_api_contracts::bucket::valid_artifact_base_prefix(&prefix) {
-                        return Err(Error::other("invalid artifact namespace"));
-                    }
-                    self.artifact_base_prefix = Some(prefix);
-                }
                 "PolicyConfigJSON" | "PolicyConfigJson" => self.policy_config_json = read_msgp_bin(rd)?,
                 "NotificationConfigXML" | "NotificationConfigXml" => self.notification_config_xml = read_msgp_bin(rd)?,
                 "LifecycleConfigXML" | "LifecycleConfigXml" => self.lifecycle_config_xml = read_msgp_bin(rd)?,
@@ -772,7 +748,10 @@ impl BucketMetadata {
                 "TableBucketConfigUpdatedAt" => self.table_bucket_config_updated_at = read_msgp_time_value(rd)?,
                 "DurabilityConfigUpdatedAt" => self.durability_config_updated_at = read_msgp_time_value(rd)?,
                 "OnDemandMigrationConfigUpdatedAt" => self.on_demand_migration_config_updated_at = read_msgp_time_value(rd)?,
-                "BucketCreationCommitted" => self.bucket_creation_committed = read_msgp_bool(rd)?,
+                "BucketCreationCommitted" => {
+                    self.bucket_creation_committed = read_msgp_bool(rd)?;
+                    self.bucket_creation_commit_record_present = true;
+                }
                 other => {
                     tracing::debug!(field = %other, "BucketMetadata decode_from: skipping unknown field");
                     skip_msgp_value(rd)?;
@@ -785,8 +764,10 @@ impl BucketMetadata {
 
     /// Encode to msgp bytes. Field order follows MinIO BucketMetadata for compatibility.
     pub fn encode_to<W: Write>(&self, wr: &mut W) -> Result<()> {
-        // Map size: MinIO fields (25) + RustFS extensions (22)
-        let map_len: u32 = 47 + u32::from(self.artifact_base_prefix.is_some()) + u32::from(self.artifact_backup_retained);
+        // Preserve the absence of a legacy commit record across config rewrites.
+        let commit_record_present = self.bucket_creation_commit_record_present || self.bucket_creation_committed;
+        // Map size: MinIO fields (25) + RustFS extensions (21) + optional commit record.
+        let map_len: u32 = 46 + u32::from(commit_record_present);
         rmp::encode::write_map_len(wr, map_len)?;
 
         // MinIO field order (same as Go struct)
@@ -800,15 +781,6 @@ impl BucketMetadata {
         rmp::encode::write_bool(wr, self.lock_enabled)?;
 
         write_bin_field(wr, "BucketIncarnationID", self.bucket_incarnation_id.as_bytes())?;
-        if let Some(prefix) = &self.artifact_base_prefix {
-            rmp::encode::write_str(wr, "ArtifactBasePrefix")?;
-            rmp::encode::write_str(wr, prefix)?;
-        }
-
-        if self.artifact_backup_retained {
-            rmp::encode::write_str(wr, "ArtifactBackupRetained")?;
-            rmp::encode::write_bool(wr, true)?;
-        }
 
         write_bin_field(wr, "PolicyConfigJSON", &self.policy_config_json)?;
         write_bin_field(wr, "NotificationConfigXML", &self.notification_config_xml)?;
@@ -876,8 +848,10 @@ impl BucketMetadata {
         write_msgp_time(wr, self.durability_config_updated_at)?;
         rmp::encode::write_str(wr, "OnDemandMigrationConfigUpdatedAt")?;
         write_msgp_time(wr, self.on_demand_migration_config_updated_at)?;
-        rmp::encode::write_str(wr, "BucketCreationCommitted")?;
-        rmp::encode::write_bool(wr, self.bucket_creation_committed)?;
+        if commit_record_present {
+            rmp::encode::write_str(wr, "BucketCreationCommitted")?;
+            rmp::encode::write_bool(wr, self.bucket_creation_committed)?;
+        }
 
         Ok(())
     }
@@ -909,28 +883,13 @@ impl BucketMetadata {
         }
 
         match version {
-            BUCKET_METADATA_VERSION | 2 => {}
+            BUCKET_METADATA_VERSION => {}
             _ => return Err(Error::other("read_bucket_metadata: version invalid")),
         }
 
         Ok(())
     }
 
-    /// Version two is reserved for permanent artifact backup retention. Older
-    /// readers reject its header instead of skipping the protection field.
-    pub(crate) fn decode_file(bytes: &[u8]) -> Result<Self> {
-        Self::check_header(bytes)?;
-        let metadata = Self::unmarshal(&bytes[4..])?;
-        let retained_header = LittleEndian::read_u16(&bytes[2..4]) == 2;
-        if retained_header != metadata.artifact_backup_retained {
-            return Err(Error::other("artifact backup retention header mismatch"));
-        }
-        if metadata.artifact_backup_retained {
-            metadata.validate_artifact_configuration()?;
-        }
-        Ok(metadata)
-    }
-
     pub(crate) fn default_timestamps(&mut self) {
         if self.policy_config_updated_at == OffsetDateTime::UNIX_EPOCH {
             self.policy_config_updated_at = self.created
@@ -1062,16 +1021,15 @@ impl BucketMetadata {
                     None
                 } else {
                     let config = deserialize::<VersioningConfiguration>(&data)?;
-                    if config.status.as_ref().is_some_and(|status| {
-                        !matches!(status.as_str(), BucketVersioningStatus::ENABLED | BucketVersioningStatus::SUSPENDED)
-                    }) {
+                    if config
+                        .status
+                        .as_ref()
+                        .is_some_and(|status| !matches!(status.as_str(), "Enabled" | "Suspended"))
+                    {
                         return Err(Error::other("bucket versioning configuration has an invalid status"));
                     }
                     Some(config)
                 };
-                if self.artifact_base_prefix.is_some() && !config.as_ref().is_some_and(artifact_versioning_enabled) {
-                    return Err(Error::other("artifact bucket versioning must remain enabled"));
-                }
                 self.versioning_config_xml = data;
                 self.versioning_config = config;
                 self.versioning_config_updated_at = updated;
@@ -1080,7 +1038,7 @@ impl BucketMetadata {
                 let config = if data.is_empty() {
                     None
                 } else {
-                    let config = deserialize::<ReplicationConfiguration>(&data)?;
+                    let config = deserialize::<PersistedReplicationConfiguration>(&data)?;
                     if let Some(field) = invalid_replication_config_status_field(&config) {
                         return Err(Error::other(format!("replication field {field} has an invalid status")));
                     }
@@ -1174,34 +1132,13 @@ impl BucketMetadata {
         &mut self,
         store: std::sync::Arc<crate::store::ECStore>,
         write_completion: WriteCompletion,
-    ) -> Result<()> {
-        let opts = crate::object_api::ObjectOptions {
-            max_parity: true,
-            write_completion,
-            ..Default::default()
-        };
-        self.save_with_store_options(store, &opts).await
-    }
-
-    pub(crate) async fn save_with_store_options(
-        &mut self,
-        store: Arc<ECStore>,
-        opts: &crate::object_api::ObjectOptions,
     ) -> Result<()> {
         self.parse_all_configs()?;
-        self.validate_artifact_update(store.clone()).await?;
         let mut buf: Vec<u8> = vec![0; 4];
 
         LittleEndian::write_u16(&mut buf[0..2], BUCKET_METADATA_FORMAT);
 
-        LittleEndian::write_u16(
-            &mut buf[2..4],
-            if self.artifact_backup_retained {
-                2
-            } else {
-                BUCKET_METADATA_VERSION
-            },
-        );
+        LittleEndian::write_u16(&mut buf[2..4], BUCKET_METADATA_VERSION);
 
         let data = self
             .marshal_msg()
@@ -1209,52 +1146,21 @@ impl BucketMetadata {
 
         buf.extend_from_slice(&data);
 
-        save_config_with_opts(store, self.save_file_path().as_str(), buf, opts).await?;
+        save_config_with_opts(
+            store,
+            self.save_file_path().as_str(),
+            buf,
+            &crate::object_api::ObjectOptions {
+                max_parity: true,
+                write_completion,
+                ..Default::default()
+            },
+        )
+        .await?;
 
         Ok(())
     }
 
-    fn validate_artifact_configuration(&self) -> Result<()> {
-        if self.artifact_backup_retained && (self.artifact_base_prefix.is_none() || !self.bucket_creation_committed) {
-            return Err(Error::other("artifact backup retention requires a committed managed bucket"));
-        }
-        if let Some(prefix) = &self.artifact_base_prefix {
-            if !crate::storage_api_contracts::bucket::valid_artifact_base_prefix(prefix) || self.bucket_incarnation_id.is_nil() {
-                return Err(Error::other("invalid artifact bucket identity"));
-            }
-            let versioning = deserialize::<VersioningConfiguration>(&self.versioning_config_xml)?;
-            if !artifact_versioning_enabled(&versioning) {
-                return Err(Error::other("artifact bucket versioning must remain enabled"));
-            }
-        }
-        Ok(())
-    }
-
-    /// Full metadata replacement must not change a generation's creation identity.
-    pub(crate) async fn validate_artifact_update(&self, store: Arc<ECStore>) -> Result<()> {
-        self.validate_artifact_configuration()?;
-        // An existing empty/corrupt metadata object is not permission to create an identity.
-        match read_config_preserve_empty(store, &self.save_file_path()).await {
-            Ok(data) => {
-                let previous = Self::decode_file(&data)?;
-                previous.validate_artifact_configuration()?;
-                if previous.artifact_backup_retained && !self.artifact_backup_retained {
-                    return Err(Error::other("artifact backup retention cannot be removed"));
-                }
-                // Deletion removes this record before recreation. A caller-supplied
-                // incarnation cannot turn an existing bucket into a new generation.
-                if previous.artifact_base_prefix != self.artifact_base_prefix
-                    || (previous.artifact_base_prefix.is_some() && previous.bucket_incarnation_id != self.bucket_incarnation_id)
-                {
-                    return Err(Error::other("artifact bucket identity is immutable"));
-                }
-            }
-            Err(Error::ConfigNotFound) => {}
-            Err(error) => return Err(error),
-        }
-        Ok(())
-    }
-
     fn parse_policy_config(&mut self) -> Result<()> {
         if !self.policy_config_json.is_empty() {
             self.policy_config = Some(serde_json::from_slice(&self.policy_config_json)?);
@@ -1298,7 +1204,6 @@ impl BucketMetadata {
     /// `rustfs_bucket_metadata_parse_failed_total`, reflected in
     /// `rustfs_bucket_metadata_unparsable_current`, and logged at error level.
     pub(super) fn parse_all_configs(&mut self) -> Result<()> {
-        self.validate_artifact_configuration()?;
         if let Err(e) = self.parse_policy_config() {
             tracing::warn!(
                 event = "bucket_metadata_parse_failed",
@@ -1327,8 +1232,8 @@ impl BucketMetadata {
         }
         self.lifecycle_config = None;
         if !self.lifecycle_config_xml.is_empty()
-            && let Err(e) =
-                deserialize::<BucketLifecycleConfiguration>(&self.lifecycle_config_xml).map(|c| self.lifecycle_config = Some(c))
+            && let Err(e) = deserialize::<PersistedLifecycleConfiguration>(&self.lifecycle_config_xml)
+                .map(|c| self.lifecycle_config = Some(c))
         {
             tracing::warn!(
                 event = "bucket_metadata_parse_failed",
@@ -1414,8 +1319,8 @@ impl BucketMetadata {
         }
         self.replication_config = None;
         if !self.replication_config_xml.is_empty()
-            && let Err(e) =
-                deserialize::<ReplicationConfiguration>(&self.replication_config_xml).map(|c| self.replication_config = Some(c))
+            && let Err(e) = deserialize::<PersistedReplicationConfiguration>(&self.replication_config_xml)
+                .map(|c| self.replication_config = Some(c))
         {
             tracing::warn!(
                 event = "bucket_metadata_parse_failed",
@@ -1564,10 +1469,6 @@ impl BucketMetadata {
     }
 }
 
-fn artifact_versioning_enabled(config: &VersioningConfiguration) -> bool {
-    config.enabled() && !config.exclude_folders.unwrap_or(false) && config.excluded_prefixes.as_ref().is_none_or(Vec::is_empty)
-}
-
 pub(crate) async fn load_bucket_incarnation(api: Arc<ECStore>, bucket: &str) -> Result<Option<Uuid>> {
     let path = format!("{BUCKET_META_PREFIX}/{bucket}/{BUCKET_INCARNATION_FILE}");
     let data = match read_config_preserve_empty(api, &path).await {
@@ -1664,7 +1565,9 @@ async fn read_bucket_metadata(api: Arc<ECStore>, bucket: &str) -> Result<BucketM
 
     let data = read_config(api, &file_path).await?;
 
-    let bm = BucketMetadata::decode_file(&data)?;
+    BucketMetadata::check_header(&data)?;
+
+    let bm = BucketMetadata::unmarshal(&data[4..])?;
 
     Ok(bm)
 }
@@ -1688,98 +1591,6 @@ where
 mod test {
     use super::*;
 
-    #[test]
-    fn artifact_metadata_roundtrip_and_corrupt_prefix_rejection() {
-        let mut metadata = BucketMetadata::new("artifacts");
-        metadata.artifact_base_prefix = Some("images/".to_owned());
-        let encoded = metadata.marshal_msg().expect("encode artifact metadata");
-        let decoded = BucketMetadata::unmarshal(&encoded).expect("decode artifact metadata");
-        assert_eq!(decoded.artifact_base_prefix, metadata.artifact_base_prefix, "ARTIFACT_METADATA_ROUNDTRIP");
-        assert_eq!(decoded.bucket_incarnation_id, metadata.bucket_incarnation_id);
-        let legacy = BucketMetadata::new("ordinary")
-            .marshal_msg()
-            .expect("encode ordinary metadata");
-        assert!(
-            BucketMetadata::unmarshal(&legacy)
-                .expect("decode ordinary metadata")
-                .artifact_base_prefix
-                .is_none()
-        );
-        for prefix in ["", "../", "outputs", "a b/"] {
-            let mut invalid = Vec::new();
-            rmp::encode::write_map_len(&mut invalid, 1).expect("encode map");
-            rmp::encode::write_str(&mut invalid, "ArtifactBasePrefix").expect("encode field");
-            rmp::encode::write_str(&mut invalid, prefix).expect("encode invalid prefix");
-            assert!(BucketMetadata::unmarshal(&invalid).is_err(), "ARTIFACT_CORRUPT_PREFIX");
-        }
-    }
-
-    #[test]
-    fn artifact_backup_retention_marker_rejects_false_and_duplicates() {
-        for count in [1, 2] {
-            let mut bytes = Vec::new();
-            rmp::encode::write_map_len(&mut bytes, count).unwrap();
-            for _ in 0..count {
-                rmp::encode::write_str(&mut bytes, "ArtifactBackupRetained").unwrap();
-                rmp::encode::write_bool(&mut bytes, count == 2).unwrap();
-            }
-            assert!(BucketMetadata::unmarshal(&bytes).is_err(), "O02P3_INVALID_RETENTION_MARKER");
-        }
-    }
-
-    #[test]
-    fn artifact_backup_retention_requires_matching_header_and_identity() {
-        let mut metadata = BucketMetadata::new("retained");
-        metadata.bucket_incarnation_id = Uuid::new_v4();
-        metadata.bucket_creation_committed = true;
-        metadata.artifact_base_prefix = Some("outputs/".to_owned());
-        metadata.versioning_config_xml = b"<VersioningConfiguration><Status>Enabled</Status></VersioningConfiguration>".to_vec();
-        let file = |metadata: &BucketMetadata, version: u16| {
-            let mut bytes = Vec::new();
-            bytes.extend_from_slice(&BUCKET_METADATA_FORMAT.to_le_bytes());
-            bytes.extend_from_slice(&version.to_le_bytes());
-            bytes.extend_from_slice(&metadata.marshal_msg().unwrap());
-            bytes
-        };
-        assert!(BucketMetadata::decode_file(&file(&metadata, 1)).is_ok(), "O02P3_ORDINARY_V1_COMPATIBLE");
-        assert!(BucketMetadata::decode_file(&file(&metadata, 2)).is_err(), "O02P3_MARKER_REQUIRED");
-        metadata.artifact_backup_retained = true;
-        assert!(
-            BucketMetadata::decode_file(&file(&metadata, 1)).is_err(),
-            "O02P3_PROTECTION_CANNOT_DOWNGRADE_HEADER"
-        );
-        assert!(
-            BucketMetadata::decode_file(&file(&metadata, 2))
-                .unwrap()
-                .artifact_backup_retained,
-            "O02P3_PROTECTED_V2_ROUNDTRIP"
-        );
-        metadata.artifact_base_prefix = None;
-        assert!(
-            BucketMetadata::decode_file(&file(&metadata, 2)).is_err(),
-            "O02P3_PROTECTION_REQUIRES_MANAGED_BUCKET"
-        );
-    }
-
-    #[test]
-    fn artifact_versioning_cannot_be_disabled_or_excluded() {
-        let mut metadata = BucketMetadata::new("artifacts");
-        metadata.artifact_base_prefix = Some("images/".to_owned());
-        for xml in [
-            "",
-            "<VersioningConfiguration><Status>Suspended</Status></VersioningConfiguration>",
-            "<VersioningConfiguration><Status>Enabled</Status><ExcludeFolders>true</ExcludeFolders></VersioningConfiguration>",
-            "<VersioningConfiguration><Status>Enabled</Status><ExcludedPrefixes><Prefix>images/</Prefix></ExcludedPrefixes></VersioningConfiguration>",
-        ] {
-            assert!(
-                metadata
-                    .update_config(BUCKET_VERSIONING_CONFIG, xml.as_bytes().to_vec())
-                    .is_err(),
-                "ARTIFACT_VERSIONING_REQUIRED"
-            );
-        }
-    }
-
     /// rustfs/backlog#1734: `StorageError::clone` rebuilds I/O errors from
     /// their text. The unreadable-config refusal must stay typed across that
     /// clone, or a cloned error stops mapping to its retryable S3 response.
@@ -1885,6 +1696,13 @@ mod test {
         let mut bm = BucketMetadata::unmarshal(&body[4..]).expect("unmarshal recovered blob");
         assert_eq!(bm.name, "interop");
         assert!(!bm.bucket_creation_committed, "legacy metadata must default to uncommitted");
+        assert!(!bm.bucket_creation_commit_record_present, "legacy metadata has no creation-commit record");
+        let rewritten = BucketMetadata::unmarshal(&bm.marshal_msg().expect("rewrite legacy metadata"))
+            .expect("read rewritten legacy metadata");
+        assert!(
+            !rewritten.bucket_creation_commit_record_present,
+            "rewriting legacy metadata must not fabricate a creation intent"
+        );
         bm.parse_all_configs().expect("parse recovered configs");
         assert!(bm.lifecycle_config.is_some());
     }
@@ -1902,6 +1720,7 @@ mod test {
 
         assert_eq!(bm.name, new.name);
         assert!(new.bucket_creation_committed);
+        assert!(new.bucket_creation_commit_record_present);
         assert!(!bm.bucket_incarnation_id.is_nil());
         assert_eq!(bm.bucket_incarnation_id, new.bucket_incarnation_id);
     }
@@ -2006,17 +1825,15 @@ mod test {
 
     #[test]
     fn object_locking_requires_lock_metadata_not_plain_versioning() {
-        use s3s::dto::ObjectLockEnabled;
-
         let mut bm = BucketMetadata::new("test-bucket");
         bm.versioning_config = Some(VersioningConfiguration {
-            status: Some(s3s::dto::BucketVersioningStatus::from_static("Enabled")),
+            status: Some("Enabled".to_owned()),
             ..Default::default()
         });
         assert!(!bm.object_locking());
 
         bm.object_lock_config = Some(ObjectLockConfiguration {
-            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+            object_lock_enabled: Some("Enabled".to_owned()),
             ..Default::default()
         });
         assert!(bm.object_locking());

crates/ecstore/src/bucket/metadata_sys.rs

@@ -30,14 +30,18 @@ use crate::storage_api_contracts::heal::HealOperations as _;
 use crate::storage_api_contracts::namespace::NamespaceLocking as _;
 use crate::store::{ECStore, await_bucket_namespace_operation};
 use futures::future::join_all;
+use rustfs_gateway_types::cors_tagging::{PersistedCorsConfiguration as CORSConfiguration, PersistedTagging as Tagging};
+use rustfs_gateway_types::persistence::{
+    PersistedAccelerateConfiguration as AccelerateConfiguration,
+    PersistedBucketEncryptionConfiguration as ServerSideEncryptionConfiguration,
+    PersistedBucketLoggingStatus as BucketLoggingStatus, PersistedLifecycleConfiguration,
+    PersistedNotificationConfiguration as NotificationConfiguration, PersistedObjectLockConfiguration as ObjectLockConfiguration,
+    PersistedPublicAccessBlockConfiguration as PublicAccessBlockConfiguration, PersistedReplicationConfiguration,
+    PersistedRequestPaymentConfiguration as RequestPaymentConfiguration,
+    PersistedVersioningConfiguration as VersioningConfiguration, PersistedWebsiteConfiguration as WebsiteConfiguration,
+};
 use rustfs_heal_contracts::heal_channel::HealOpts;
 use rustfs_policy::policy::BucketPolicy;
-use s3s::dto::ReplicationConfiguration;
-use s3s::dto::{
-    AccelerateConfiguration, BucketLifecycleConfiguration, BucketLoggingStatus, CORSConfiguration, NotificationConfiguration,
-    ObjectLockConfiguration, ObjectLockEnabled, ObjectLockRetentionMode, PublicAccessBlockConfiguration,
-    RequestPaymentConfiguration, ServerSideEncryptionConfiguration, Tagging, VersioningConfiguration, WebsiteConfiguration,
-};
 use std::collections::HashSet;
 use std::time::Duration;
 use std::{
@@ -168,7 +172,7 @@ pub(crate) fn object_lock_config_state_from_authoritative_metadata(bm: &BucketMe
     if bm.lock_enabled {
         return Ok(ObjectLockConfigState::Configured {
             config: ObjectLockConfiguration {
-                object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+                object_lock_enabled: Some("Enabled".to_owned()),
                 rule: None,
             },
             updated_at: bm.object_lock_config_updated_at,
@@ -212,17 +216,10 @@ pub(crate) fn configured_object_lock_state_for_tests(
 ) -> ObjectLockConfigState {
     ObjectLockConfigState::Configured {
         config: ObjectLockConfiguration {
-            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
-            rule: Some(s3s::dto::ObjectLockRule {
-                default_retention: Some(s3s::dto::DefaultRetention {
-                    mode: Some(s3s::dto::ObjectLockRetentionMode::from_static(match mode {
-                        crate::bucket::object_lock::types::RetentionMode::Governance => {
-                            s3s::dto::ObjectLockRetentionMode::GOVERNANCE
-                        }
-                        crate::bucket::object_lock::types::RetentionMode::Compliance => {
-                            s3s::dto::ObjectLockRetentionMode::COMPLIANCE
-                        }
-                    })),
+            object_lock_enabled: Some("Enabled".to_owned()),
+            rule: Some(rustfs_gateway_types::persistence::PersistedObjectLockRule {
+                default_retention: Some(rustfs_gateway_types::persistence::PersistedDefaultRetention {
+                    mode: Some(mode.as_str().to_owned()),
                     days: Some(days),
                     years: None,
                 }),
@@ -233,7 +230,7 @@ pub(crate) fn configured_object_lock_state_for_tests(
 }
 
 fn validate_authoritative_object_lock_config(config: &ObjectLockConfiguration) -> Result<()> {
-    if config.object_lock_enabled.as_ref().map(ObjectLockEnabled::as_str) != Some(ObjectLockEnabled::ENABLED) {
+    if config.object_lock_enabled.as_deref() != Some("Enabled") {
         return Err(Error::other("persisted bucket Object Lock enabled state is invalid"));
     }
 
@@ -246,7 +243,7 @@ fn validate_authoritative_object_lock_config(config: &ObjectLockConfiguration) -
     if !retention
         .mode
         .as_ref()
-        .is_some_and(|mode| matches!(mode.as_str(), ObjectLockRetentionMode::COMPLIANCE | ObjectLockRetentionMode::GOVERNANCE))
+        .is_some_and(|mode| matches!(mode.as_str(), "COMPLIANCE" | "GOVERNANCE"))
     {
         return Err(Error::other("persisted bucket Object Lock retention mode is invalid"));
     }
@@ -293,10 +290,8 @@ pub(super) fn get_bucket_metadata_sys() -> Result<Arc<RwLock<BucketMetadataSys>>
 pub async fn set_bucket_metadata(bucket: String, bm: BucketMetadata) -> Result<()> {
     let sys = get_bucket_metadata_sys()?;
     let lock = sys.write().await;
-    if bucket != bm.name {
-        return Err(Error::other("bucket metadata identity mismatch"));
-    }
-    lock.set_validated(bm).await
+    lock.set(bucket, Arc::new(bm)).await;
+    Ok(())
 }
 
 pub async fn reload_bucket_metadata(api: Arc<ECStore>, bucket: &str) -> Result<()> {
@@ -587,15 +582,6 @@ pub(crate) async fn get_cached_bucket_incarnation_id_in(
     sys.get_bucket_incarnation_id(bucket).await
 }
 
-pub(crate) async fn get_bucket_incarnation_metadata_in(
-    ctx: &crate::runtime::instance::InstanceContext,
-    bucket: &str,
-) -> Result<Arc<BucketMetadata>> {
-    let sys = bucket_metadata_sys_of(ctx)?;
-    let sys = sys.read().await.clone();
-    sys.get_bucket_incarnation_metadata(bucket).await
-}
-
 pub(crate) async fn set_bucket_metadata_in(ctx: &crate::runtime::instance::InstanceContext, bm: BucketMetadata) -> Result<()> {
     let sys = bucket_metadata_sys_of(ctx)?;
     let lock = sys.read().await;
@@ -1379,7 +1365,7 @@ pub async fn get_public_access_block_config(bucket: &str) -> Result<(PublicAcces
     bucket_meta_sys.get_public_access_block_config(bucket).await
 }
 
-pub async fn get_lifecycle_config(bucket: &str) -> Result<(BucketLifecycleConfiguration, OffsetDateTime)> {
+pub async fn get_lifecycle_config(bucket: &str) -> Result<(PersistedLifecycleConfiguration, OffsetDateTime)> {
     let bucket_meta_sys_lock = get_bucket_metadata_sys()?;
     let bucket_meta_sys = bucket_meta_sys_lock.read().await;
 
@@ -1598,7 +1584,7 @@ pub(crate) async fn get_cached_quota_config_and_incarnation_in(
     bucket_meta_sys.cached_quota_config_and_incarnation(bucket).await
 }
 
-pub async fn get_replication_config(bucket: &str) -> Result<(ReplicationConfiguration, OffsetDateTime)> {
+pub async fn get_replication_config(bucket: &str) -> Result<(PersistedReplicationConfiguration, OffsetDateTime)> {
     let bucket_meta_sys_lock = get_bucket_metadata_sys()?;
     let bucket_meta_sys = bucket_meta_sys_lock.read().await;
 
@@ -1608,7 +1594,7 @@ pub async fn get_replication_config(bucket: &str) -> Result<(ReplicationConfigur
 pub(crate) async fn get_replication_config_in(
     ctx: &crate::runtime::instance::InstanceContext,
     bucket: &str,
-) -> Result<(ReplicationConfiguration, OffsetDateTime)> {
+) -> Result<(PersistedReplicationConfiguration, OffsetDateTime)> {
     let bucket_meta_sys_lock = bucket_metadata_sys_of(ctx)?;
     let bucket_meta_sys = bucket_meta_sys_lock.read().await;
 
@@ -1734,9 +1720,27 @@ struct MetadataPublishGuard {
     _guard: tokio::sync::OwnedMutexGuard<MetadataPublishLockState>,
 }
 
+#[derive(Debug, Clone)]
+pub(crate) struct PendingBucketCreationProof {
+    pub(crate) generation: Uuid,
+    pub(crate) intent: Vec<u8>,
+    pub(crate) versioning_requested: bool,
+    pub(crate) witnesses: Vec<crate::disk::os::NativeBucketCreationWitness>,
+}
+
+impl PendingBucketCreationProof {
+    pub(crate) fn matches_metadata(&self, metadata: &BucketMetadata) -> Result<bool> {
+        Ok(!metadata.bucket_creation_committed
+            && metadata.bucket_incarnation_sidecar
+            && metadata.bucket_incarnation_id == self.generation
+            && metadata.marshal_msg()? == self.intent)
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct BucketMetadataSys {
     metadata_map: Arc<RwLock<HashMap<String, Arc<BucketMetadata>>>>,
+    pending_bucket_creations: Arc<RwLock<HashMap<String, PendingBucketCreationProof>>>,
     /// Serializes metadata-map commits and their derived cache updates for one
     /// bucket. Namespace locks, when present, are acquired before this lock.
     metadata_publish_locks: Arc<MetadataPublishLockRegistry>,
@@ -1780,6 +1784,7 @@ impl BucketMetadataSys {
     pub fn new(api: Arc<ECStore>) -> Self {
         Self {
             metadata_map: Arc::new(RwLock::new(HashMap::new())),
+            pending_bucket_creations: Arc::new(RwLock::new(HashMap::new())),
             metadata_publish_locks: Arc::new(MetadataPublishLockRegistry {
                 locks: StdMutex::new(HashMap::new()),
             }),
@@ -1810,6 +1815,81 @@ impl BucketMetadataSys {
             .expect("bucket metadata object store should still be live")
     }
 
+    pub(crate) async fn pending_bucket_creation(&self, bucket: &str) -> Option<PendingBucketCreationProof> {
+        self.pending_bucket_creations.read().await.get(bucket).cloned()
+    }
+
+    pub(crate) async fn grant_pending_bucket_creation(&self, bucket: &str, proof: PendingBucketCreationProof) {
+        self.pending_bucket_creations.write().await.insert(bucket.to_owned(), proof);
+    }
+
+    pub(crate) async fn revoke_pending_bucket_creation(&self, bucket: &str) {
+        self.pending_bucket_creations.write().await.remove(bucket);
+    }
+
+    pub(crate) async fn consume_pending_bucket_creation(
+        &self,
+        bucket: &str,
+        metadata: &BucketMetadata,
+        witnesses: &[crate::disk::os::NativeBucketCreationWitness],
+    ) -> Result<bool> {
+        let mut pending = self.pending_bucket_creations.write().await;
+        let Some(proof) = pending.get(bucket) else {
+            return Ok(false);
+        };
+        if !proof.matches_metadata(metadata)?
+            || proof.witnesses.len() != witnesses.len()
+            || !proof
+                .witnesses
+                .iter()
+                .zip(witnesses)
+                .all(|(old, current)| old.matches(current))
+            || !crate::disk::os::consume_native_creation_witnesses(witnesses)
+        {
+            return Ok(false);
+        }
+        pending.remove(bucket);
+        Ok(true)
+    }
+
+    #[cfg(test)]
+    pub(crate) async fn refresh_bucket_for_test(&self, bucket: &str) -> Result<()> {
+        let expected = self.metadata_map.read().await.get(bucket).cloned();
+        let lock = self.object_store().new_ns_lock(bucket, bucket).await?;
+        let guard = lock.get_read_lock(crate::set_disk::get_lock_acquire_timeout()).await?;
+        self.load_bucket_under_namespace(bucket, MetadataLoadMode::Refresh, expected.as_ref(), &guard)
+            .await
+    }
+
+    #[cfg(test)]
+    pub(crate) async fn publish_persisted_metadata_for_test(&self, bucket: &str) -> Result<()> {
+        let expected = self.metadata_map.read().await.get(bucket).cloned();
+        let lock = self.object_store().new_ns_lock(bucket, bucket).await?;
+        let guard = lock.get_read_lock(crate::set_disk::get_lock_acquire_timeout()).await?;
+        let (metadata, persisted) = await_bucket_namespace_operation(
+            Some(&guard),
+            bucket,
+            "test cached metadata load",
+            load_bucket_metadata_parse_with_presence(self.object_store(), bucket, true),
+        )
+        .await?;
+        self.publish_if_unchanged(bucket, expected.as_ref(), metadata, persisted, &guard)
+            .await
+    }
+
+    #[cfg(test)]
+    pub(crate) async fn migrate_bucket_creation_commit_for_test(&self, bucket: &str) -> Result<()> {
+        self.migrate_bucket_creation_commit(bucket).await.map(|_| ())
+    }
+
+    #[cfg(test)]
+    pub(crate) async fn legacy_migration_reports_missing_bucket_for_test(&self, bucket: &str) -> Result<bool> {
+        Ok(matches!(
+            self.migrate_legacy_metadata(bucket).await?,
+            BucketMetadataAuthority::MissingBucket
+        ))
+    }
+
     fn object_store_if_live(&self) -> Option<Arc<ECStore>> {
         self.api.upgrade()
     }
@@ -2000,6 +2080,7 @@ impl BucketMetadataSys {
         expected: Option<&Arc<BucketMetadata>>,
         namespace_guard: &rustfs_lock::NamespaceLockGuard,
     ) -> Result<()> {
+        self.revoke_pending_bucket_creation(bucket).await;
         if !await_bucket_namespace_operation(
             Some(namespace_guard),
             bucket,
@@ -2083,6 +2164,7 @@ impl BucketMetadataSys {
         persisted: bool,
         namespace_guard: &rustfs_lock::NamespaceLockGuard,
     ) -> Result<()> {
+        self.revoke_pending_bucket_creation(bucket).await;
         if !persisted {
             let _publish_guard = self
                 .lock_metadata_publish(bucket, namespace_guard, "refreshed bucket metadata absence publish")
@@ -2143,16 +2225,8 @@ impl BucketMetadataSys {
         }
     }
 
-    pub(crate) async fn set_validated(&self, mut bm: BucketMetadata) -> Result<()> {
-        if bm.artifact_base_prefix.is_some() {
-            bm.parse_all_configs()?;
-        }
-        bm.validate_artifact_update(self.object_store()).await?;
-        self.set(bm.name.clone(), Arc::new(bm)).await;
-        Ok(())
-    }
-
-    async fn set(&self, bucket: String, bm: Arc<BucketMetadata>) {
+    pub async fn set(&self, bucket: String, bm: Arc<BucketMetadata>) {
+        self.revoke_pending_bucket_creation(&bucket).await;
         if !is_meta_bucketname(&bucket) {
             let publish_lock = self.metadata_publish_lock(&bucket);
             let _publish_guard = publish_lock.lock().await;
@@ -2167,11 +2241,6 @@ impl BucketMetadataSys {
         }
     }
 
-    #[cfg(any(test, feature = "test-util"))]
-    pub async fn set_for_test(&self, bucket: String, bm: Arc<BucketMetadata>) {
-        self.set(bucket, bm).await;
-    }
-
     /// Remove a bucket's cached metadata from the in-memory map.
     ///
     /// Returns `true` if an entry was present. Reserved meta buckets are ignored.
@@ -2179,6 +2248,7 @@ impl BucketMetadataSys {
         if is_meta_bucketname(bucket) {
             return false;
         }
+        self.revoke_pending_bucket_creation(bucket).await;
         let publish_lock = self.metadata_publish_lock(bucket);
         let _publish_guard = publish_lock.lock().await;
         let mut map = self.metadata_map.write().await;
@@ -2196,6 +2266,7 @@ impl BucketMetadataSys {
     }
 
     async fn _reset(&mut self) {
+        self.pending_bucket_creations.write().await.clear();
         let mut map = self.metadata_map.write().await;
         map.clear();
         drop(map);
@@ -2334,6 +2405,7 @@ impl BucketMetadataSys {
     /// server's metadata never leaks into the ambient (first) instance.
     pub(crate) async fn persist_and_set(&self, bm: BucketMetadata) -> Result<()> {
         let mut bm = bm;
+        self.revoke_pending_bucket_creation(&bm.name).await;
         bm.save_with_store(self.object_store()).await?;
 
         self.set(bm.name.clone(), Arc::new(bm)).await;
@@ -2342,6 +2414,7 @@ impl BucketMetadataSys {
     }
 
     async fn persist_new_and_set(&self, mut bm: BucketMetadata) -> Result<()> {
+        self.revoke_pending_bucket_creation(&bm.name).await;
         bm.bucket_creation_committed = true;
         bm.save_with_store_committed(self.object_store()).await?;
         save_bucket_incarnation(self.object_store(), &bm.name, bm.bucket_incarnation_id).await?;
@@ -2351,7 +2424,9 @@ impl BucketMetadataSys {
     }
 
     async fn persist_new_bucket_metadata_intent(&self, mut bm: BucketMetadata) -> Result<()> {
+        self.revoke_pending_bucket_creation(&bm.name).await;
         bm.bucket_creation_committed = false;
+        bm.bucket_creation_commit_record_present = true;
         bm.save_with_store(self.object_store()).await?;
         save_bucket_incarnation(self.object_store(), &bm.name, bm.bucket_incarnation_id).await?;
         bm.bucket_incarnation_sidecar = true;
@@ -2361,6 +2436,7 @@ impl BucketMetadataSys {
     }
 
     async fn commit_bucket_metadata(&self, mut bm: BucketMetadata) -> Result<()> {
+        self.revoke_pending_bucket_creation(&bm.name).await;
         bm.parse_all_configs()?;
         bm.bucket_incarnation_sidecar = true;
         // The caller holds the full bucket creation fence (lifecycle, metadata
@@ -2409,6 +2485,7 @@ impl BucketMetadataSys {
         bucket: &str,
         namespace_guard: &rustfs_lock::NamespaceLockGuard,
     ) -> Result<()> {
+        self.revoke_pending_bucket_creation(bucket).await;
         let expected = self.metadata_map.read().await.get(bucket).cloned();
         if !self
             .bucket_exists(bucket, namespace_guard, "peer bucket metadata existence check")
@@ -2465,6 +2542,7 @@ impl BucketMetadataSys {
             #[cfg(test)]
             self.lazy_disk_loads.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
 
+            self.revoke_pending_bucket_creation(bucket).await;
             let lock = self.object_store().new_ns_lock(bucket, bucket).await?;
             let guard = lock.get_read_lock(crate::set_disk::get_lock_acquire_timeout()).await?;
             #[cfg(test)]
@@ -2676,16 +2754,12 @@ impl BucketMetadataSys {
     }
 
     async fn get_bucket_incarnation_id(&self, bucket: &str) -> Result<Uuid> {
-        Ok(self.get_bucket_incarnation_metadata(bucket).await?.bucket_incarnation_id)
-    }
-
-    async fn get_bucket_incarnation_metadata(&self, bucket: &str) -> Result<Arc<BucketMetadata>> {
         let authority = self.get_metadata_authority(bucket).await?;
         if let BucketMetadataAuthority::Authoritative(metadata) = &authority
             && metadata.bucket_incarnation_sidecar
             && !metadata.bucket_incarnation_id.is_nil()
         {
-            return Ok(Arc::clone(metadata));
+            return Ok(metadata.bucket_incarnation_id);
         }
 
         match authority {
@@ -2694,7 +2768,7 @@ impl BucketMetadataSys {
                     BucketMetadataAuthority::Authoritative(metadata)
                         if metadata.bucket_incarnation_sidecar && !metadata.bucket_incarnation_id.is_nil() =>
                     {
-                        Ok(metadata)
+                        Ok(metadata.bucket_incarnation_id)
                     }
                     BucketMetadataAuthority::Authoritative(_) | BucketMetadataAuthority::Fabricated => {
                         Err(Error::other(format!("bucket incarnation metadata is not authoritative: {bucket}")))
@@ -2794,6 +2868,7 @@ impl BucketMetadataSys {
     /// revalidated at write quorum, so a stale snapshot can neither revert an
     /// acknowledged configuration update nor outlive a delete/recreate.
     async fn migrate_bucket_creation_commit(&self, bucket: &str) -> Result<BucketMetadataAuthority> {
+        self.revoke_pending_bucket_creation(bucket).await;
         let transaction_lock = self
             .object_store()
             .new_ns_lock(RUSTFS_META_BUCKET, &bucket_metadata_transaction_lock_key(bucket))
@@ -2871,6 +2946,7 @@ impl BucketMetadataSys {
         &self,
         bucket: &str,
     ) -> Result<BucketMetadataAuthority> {
+        self.revoke_pending_bucket_creation(bucket).await;
         #[cfg(test)]
         if self.object_lock_disk_read_errors.write().await.remove(bucket) {
             return Err(Error::other(format!("injected Object Lock metadata disk read failure: {bucket}")));
@@ -3022,8 +3098,7 @@ impl BucketMetadataSys {
             load_bucket_metadata_parse_with_presence(self.object_store(), bucket, true),
         )
         .await?;
-        if persisted && (metadata.lock_enabled || metadata.artifact_base_prefix.is_some()) && !metadata.bucket_creation_committed
-        {
+        if persisted && metadata.lock_enabled && !metadata.bucket_creation_committed {
             return Err(Error::ErasureWriteQuorum);
         }
         if persisted {
@@ -3047,7 +3122,7 @@ impl BucketMetadataSys {
         }
     }
 
-    pub async fn get_lifecycle_config(&self, bucket: &str) -> Result<(BucketLifecycleConfiguration, OffsetDateTime)> {
+    pub async fn get_lifecycle_config(&self, bucket: &str) -> Result<(PersistedLifecycleConfiguration, OffsetDateTime)> {
         let (bm, _) = self.get_config(bucket).await?;
 
         match ConfigState::of(&bm.lifecycle_config_xml, &bm.lifecycle_config).require(bucket, BUCKET_LIFECYCLE_CONFIG)? {
@@ -3170,7 +3245,7 @@ impl BucketMetadataSys {
         }))
     }
 
-    pub async fn get_replication_config(&self, bucket: &str) -> Result<(ReplicationConfiguration, OffsetDateTime)> {
+    pub async fn get_replication_config(&self, bucket: &str) -> Result<(PersistedReplicationConfiguration, OffsetDateTime)> {
         let (bm, _) = self.get_config(bucket).await?;
 
         if !bm.replication_config_xml.is_empty() && bm.replication_config.is_none() {
@@ -3264,6 +3339,7 @@ mod tests {
     };
     use crate::bucket::target::{BucketTarget, BucketTargetType, Credentials};
     use crate::config::com::read_config;
+    use crate::disk::{DiskAPI as _, RUSTFS_META_TMP_BUCKET};
     use crate::storage_api_contracts::bucket::{BucketOperations as _, DeleteBucketOptions, MakeBucketOptions};
     use byteorder::{ByteOrder as _, LittleEndian};
     use serial_test::serial;
@@ -3318,6 +3394,180 @@ mod tests {
         ),
     ];
 
+    #[tokio::test]
+    #[serial(storage_class_env)]
+    async fn persistence_entry_failures_revoke_pending_creation_before_cache_publish() {
+        let (dirs, store) = isolated_store_over_temp_disks().await;
+        init_bucket_metadata_sys(store.clone(), Vec::new()).await;
+        let sys = bucket_metadata_sys_of(&store.ctx).expect("instance metadata system");
+        let sys = sys.read().await.clone();
+        let options = MakeBucketOptions {
+            lock_enabled: true,
+            ..Default::default()
+        };
+        for entry in ["save", "persist", "persist-new", "commit"] {
+            let bucket = format!("revoke-{entry}-{}", Uuid::new_v4());
+            store.fail_next_bucket_creation_after_intent_for_test(&bucket);
+            store
+                .make_bucket(&bucket, &options)
+                .await
+                .expect_err("stop the real producer before physical publication");
+            sys.pending_bucket_creation(&bucket)
+                .await
+                .expect("the producer must leave a real live creation permission");
+            let (intent, persisted) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
+                .await
+                .expect("read the original producer intent");
+            assert!(persisted, "{entry}: the complete original intent must be persisted");
+            let original_intent = intent.marshal_msg().expect("encode the original intent");
+
+            // Keep the creation fence order used by the real producer.
+            let lifecycle_guard = store
+                .acquire_bucket_lifecycle_write_lock(&bucket)
+                .await
+                .expect("hold the bucket lifecycle fence");
+            let transaction_guard = acquire_bucket_metadata_transaction_lock_in(&store.ctx, &bucket)
+                .await
+                .expect("hold the metadata transaction fence");
+            let namespace_lock = store
+                .new_ns_lock(&bucket, &bucket)
+                .await
+                .expect("create the exact bucket namespace lock");
+            let namespace_guard = namespace_lock
+                .get_write_lock(crate::set_disk::get_lock_acquire_timeout())
+                .await
+                .expect("hold the exact bucket namespace fence");
+
+            // A file at each native staging root causes actual IO to fail before
+            // metadata can reach the cache-publishing set call. Preserve the
+            // original staging directories so no fixture data is discarded.
+            for dir in &dirs {
+                let staging = dir.path().join(RUSTFS_META_TMP_BUCKET);
+                let saved = dir.path().join(".rustfs.sys/revocation-saved-tmp");
+                std::fs::rename(&staging, &saved).expect("preserve the native staging directory");
+                std::fs::write(&staging, b"block metadata staging with a non-directory")
+                    .expect("install an actual non-directory IO obstruction");
+            }
+            let result = match entry {
+                "save" => sys.save(intent).await,
+                "persist" => sys.persist_and_set(intent).await,
+                "persist-new" => sys.persist_new_and_set(intent).await,
+                "commit" => sys.commit_bucket_metadata(intent).await,
+                _ => unreachable!(),
+            };
+            for dir in &dirs {
+                let staging = dir.path().join(RUSTFS_META_TMP_BUCKET);
+                let saved = dir.path().join(".rustfs.sys/revocation-saved-tmp");
+                std::fs::remove_file(&staging).expect("remove only the fixture's staging obstruction");
+                std::fs::rename(&saved, &staging).expect("restore the complete original staging directory");
+            }
+            drop((namespace_guard, transaction_guard, lifecycle_guard));
+            result.expect_err("native persistence must fail before its downstream cache set");
+            assert!(
+                sys.pending_bucket_creation(&bucket).await.is_none(),
+                "{entry}: the entry revoker must retire live permission even when persistence fails"
+            );
+            let (after_failure, present) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
+                .await
+                .expect("read the intent after the failed persistence entry");
+            assert!(present, "{entry}: a failed persistence entry must retain the original metadata");
+            assert_eq!(
+                after_failure
+                    .marshal_msg()
+                    .expect("encode the original intent after persistence failure"),
+                original_intent,
+                "{entry}: native IO failure must not change the original generation or complete intent"
+            );
+            let error = store
+                .make_bucket(&bucket, &options)
+                .await
+                .expect_err("a failed ordinary persistence entry cannot preserve creation permission");
+            assert!(error.to_string().contains("administrator recovery"), "{entry}: {error}");
+            let (after_retry, _) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
+                .await
+                .expect("read the original intent after the rejected retry");
+            assert_eq!(
+                after_retry.marshal_msg().expect("encode the intent after the rejected retry"),
+                original_intent,
+                "{entry}: the rejected retry must preserve the complete original intent"
+            );
+            for disk in store.pools[0].disk_set[0].disks.read().await.iter() {
+                assert!(
+                    matches!(
+                        disk.as_ref().expect("native disk").stat_volume(&bucket).await,
+                        Err(crate::disk::error::DiskError::VolumeNotFound)
+                    ),
+                    "{entry}: failed persistence and the rejected retry must not publish a physical volume"
+                );
+            }
+        }
+    }
+
+    #[tokio::test]
+    #[serial(storage_class_env)]
+    async fn metadata_reset_revokes_real_pending_creation_without_changing_persisted_intent() {
+        let (_dirs, store) = isolated_store_over_temp_disks().await;
+        init_bucket_metadata_sys(store.clone(), Vec::new()).await;
+        let bucket = format!("revoke-reset-{}", Uuid::new_v4());
+        let options = MakeBucketOptions {
+            lock_enabled: true,
+            ..Default::default()
+        };
+        store.fail_next_bucket_creation_after_intent_for_test(&bucket);
+        store
+            .make_bucket(&bucket, &options)
+            .await
+            .expect_err("stop the real producer before physical publication");
+        let sys = bucket_metadata_sys_of(&store.ctx).expect("instance metadata system");
+        let mut sys = sys.read().await.clone();
+        sys.pending_bucket_creation(&bucket)
+            .await
+            .expect("the real producer must leave live creation permission before reset");
+        let (intent, persisted) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
+            .await
+            .expect("read the original intent before cache reset");
+        assert!(persisted, "cache reset starts from a complete real persisted intent");
+        let original_intent = intent.marshal_msg().expect("encode the original reset intent");
+        sys._reset().await;
+        assert!(
+            sys.pending_bucket_creation(&bucket).await.is_none(),
+            "reset must revoke the producer-issued permission shared with the instance metadata system"
+        );
+        let (after_reset, present) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
+            .await
+            .expect("read the original intent after cache reset");
+        assert!(present, "cache reset must retain the persisted intent");
+        assert_eq!(
+            after_reset.marshal_msg().expect("encode the intent after cache reset"),
+            original_intent,
+            "cache reset must leave the original generation and complete persisted intent unchanged"
+        );
+        let error = store
+            .make_bucket(&bucket, &options)
+            .await
+            .expect_err("reset cannot regrant the producer's old creation permission");
+        assert!(error.to_string().contains("administrator recovery"), "{error}");
+        let (after_retry, _) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
+            .await
+            .expect("read the intent after the reset-induced retry rejection");
+        assert_eq!(
+            after_retry
+                .marshal_msg()
+                .expect("encode the intent after the rejected reset retry"),
+            original_intent,
+            "the reset-induced rejection must preserve the original complete intent"
+        );
+        for disk in store.pools[0].disk_set[0].disks.read().await.iter() {
+            assert!(
+                matches!(
+                    disk.as_ref().expect("native disk").stat_volume(&bucket).await,
+                    Err(crate::disk::error::DiskError::VolumeNotFound)
+                ),
+                "cache reset and the rejected retry must not publish a physical volume"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn g_d3_003_new_writer_replication_loads_without_fail_closed_state() {
         let (dirs, store) = isolated_store_over_temp_disks().await;
@@ -3506,7 +3756,7 @@ mod tests {
         let mut versioned = BucketMetadata::new("authoritative-versioned");
         versioned.versioning_config_xml = b"<VersioningConfiguration><Status>Enabled</Status></VersioningConfiguration>".to_vec();
         versioned.versioning_config = Some(VersioningConfiguration {
-            status: Some(s3s::dto::BucketVersioningStatus::from_static(s3s::dto::BucketVersioningStatus::ENABLED)),
+            status: Some("Enabled".to_owned()),
             ..Default::default()
         });
         sys.set("authoritative-versioned".to_string(), Arc::new(versioned)).await;
@@ -3629,25 +3879,24 @@ mod tests {
         else {
             panic!("legacy lock-enabled metadata must remain configured");
         };
-        assert_eq!(
-            config.object_lock_enabled.as_ref().map(|value| value.as_str()),
-            Some(ObjectLockEnabled::ENABLED)
-        );
+        assert_eq!(config.object_lock_enabled.as_deref(), Some("Enabled"));
         assert!(config.rule.is_none());
     }
 
     #[test]
     fn authoritative_object_lock_state_rejects_invalid_retention_periods() {
-        use s3s::dto::{DefaultRetention, ObjectLockRule};
+        use rustfs_gateway_types::persistence::{
+            PersistedDefaultRetention as DefaultRetention, PersistedObjectLockRule as ObjectLockRule,
+        };
 
         for (days, years) in [(Some(0), None), (Some(-1), None), (Some(1), Some(1)), (None, None)] {
             let mut metadata = BucketMetadata::new("invalid-object-lock");
             metadata.object_lock_config = Some(ObjectLockConfiguration {
-                object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+                object_lock_enabled: Some("Enabled".to_owned()),
                 rule: Some(ObjectLockRule {
                     default_retention: Some(DefaultRetention {
                         days,
-                        mode: Some(ObjectLockRetentionMode::from_static(ObjectLockRetentionMode::COMPLIANCE)),
+                        mode: Some("COMPLIANCE".to_owned()),
                         years,
                     }),
                 }),
@@ -3662,9 +3911,11 @@ mod tests {
 
     #[test]
     fn authoritative_object_lock_state_rejects_invalid_enabled_mode_and_rule() {
-        use s3s::dto::{DefaultRetention, ObjectLockRule};
+        use rustfs_gateway_types::persistence::{
+            PersistedDefaultRetention as DefaultRetention, PersistedObjectLockRule as ObjectLockRule,
+        };
 
-        for enabled in [None, Some(ObjectLockEnabled::from("Disabled".to_string()))] {
+        for enabled in [None, Some("Disabled".to_string())] {
             let mut metadata = BucketMetadata::new("invalid-object-lock-enabled");
             metadata.lock_enabled = true;
             metadata.object_lock_config = Some(ObjectLockConfiguration {
@@ -3676,11 +3927,11 @@ mod tests {
 
         let mut invalid_mode = BucketMetadata::new("invalid-object-lock-mode");
         invalid_mode.object_lock_config = Some(ObjectLockConfiguration {
-            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+            object_lock_enabled: Some("Enabled".to_owned()),
             rule: Some(ObjectLockRule {
                 default_retention: Some(DefaultRetention {
                     days: Some(1),
-                    mode: Some(ObjectLockRetentionMode::from("invalid".to_string())),
+                    mode: Some("invalid".to_string()),
                     years: None,
                 }),
             }),
@@ -3689,7 +3940,7 @@ mod tests {
 
         let mut missing_retention = BucketMetadata::new("missing-object-lock-retention");
         missing_retention.object_lock_config = Some(ObjectLockConfiguration {
-            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+            object_lock_enabled: Some("Enabled".to_owned()),
             rule: Some(ObjectLockRule { default_retention: None }),
         });
         assert!(object_lock_config_state_from_authoritative_metadata(&missing_retention).is_err());
@@ -3699,7 +3950,7 @@ mod tests {
     fn object_lock_ever_enabled_marker_survives_config_removal() {
         let mut metadata = BucketMetadata::new("lock-config-removed");
         let config = ObjectLockConfiguration {
-            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+            object_lock_enabled: Some("Enabled".to_owned()),
             rule: None,
         };
         metadata
@@ -3717,10 +3968,7 @@ mod tests {
         else {
             panic!("an ever-enabled bucket must remain Object Lock configured");
         };
-        assert_eq!(
-            config.object_lock_enabled.as_ref().map(ObjectLockEnabled::as_str),
-            Some(ObjectLockEnabled::ENABLED)
-        );
+        assert_eq!(config.object_lock_enabled.as_deref(), Some("Enabled"));
     }
 
     #[tokio::test]
@@ -3736,7 +3984,7 @@ mod tests {
 
         let node = Arc::new(RwLock::new(BucketMetadataSys::new(ecstore.clone())));
         let config = ObjectLockConfiguration {
-            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+            object_lock_enabled: Some("Enabled".to_owned()),
             rule: None,
         };
         update_with_sys(
@@ -4717,7 +4965,7 @@ mod tests {
     #[tokio::test]
     async fn update_config_with_persists_tagging_rewrite_across_disk_reload() {
         use crate::bucket::metadata::BUCKET_TAGGING_CONFIG;
-        use s3s::dto::Tag;
+        use rustfs_gateway_types::cors_tagging::PersistedTag as Tag;
 
         let (dirs, ecstore) = isolated_store_over_temp_disks().await;
 
@@ -4881,7 +5129,7 @@ mod tests {
     #[tokio::test]
     async fn concurrent_update_config_with_calls_do_not_lose_writes() {
         use crate::bucket::metadata::BUCKET_TAGGING_CONFIG;
-        use s3s::dto::Tag;
+        use rustfs_gateway_types::cors_tagging::PersistedTag as Tag;
 
         let (dirs, ecstore) = isolated_store_over_temp_disks().await;
         let sys = Arc::new(RwLock::new(BucketMetadataSys::new(ecstore)));
@@ -4981,7 +5229,7 @@ mod tests {
         let mut persisted = BucketMetadata::new("reload-bucket");
         persisted.policy_config_json = b"persisted-marker".to_vec();
         let lock_config = ObjectLockConfiguration {
-            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+            object_lock_enabled: Some("Enabled".to_owned()),
             rule: None,
         };
         persisted
@@ -5260,7 +5508,7 @@ mod tests {
     #[serial]
     async fn bucket_delete_waits_for_config_mutation_fence() {
         use crate::bucket::metadata::BUCKET_TAGGING_CONFIG;
-        use s3s::dto::Tag;
+        use rustfs_gateway_types::cors_tagging::PersistedTag as Tag;
 
         let (_dirs, store) = isolated_store_over_temp_disks().await;
         init_bucket_metadata_sys(store.clone(), Vec::new()).await;

crates/ecstore/src/bucket/mod.rs

@@ -14,7 +14,6 @@
 
 // #730: bucket subsystems still contain staged ECStore migration code.
 
-pub mod artifact;
 pub mod bandwidth;
 pub mod bucket_target_sys;
 pub mod config_parse_mode;

crates/ecstore/src/bucket/object_lock/mod.rs

@@ -17,15 +17,8 @@ pub mod objectlock_sys;
 pub mod types;
 
 /// Whether a bucket Object Lock configuration has locking enabled. The
-/// serving-layer `ObjectLockConfiguration` DTO implements this in
-/// the bucket-metadata module, which owns the persisted configuration type
-/// during the s3s ratchet migration (rustfs/backlog#1842).
+/// persisted `ObjectLockConfiguration` implements this in the bucket-metadata
+/// module, which owns the persisted configuration type.
 pub trait ObjectLockApi {
     fn enabled(&self) -> bool;
 }
-
-/// Whether a legal-hold status value is one of the two valid wire values.
-/// Implemented for the serving-layer DTO in the bucket-metadata module.
-pub trait ObjectLockStatusExt {
-    fn valid(&self) -> bool;
-}

crates/ecstore/src/bucket/quota/checker.rs

@@ -235,8 +235,6 @@ impl QuotaChecker {
         Ok(updated_at)
     }
 
-    /// Return quota configuration with optional scanner usage, independently
-    /// of the usage requirements enforced by write admission.
     pub async fn get_quota_stats(&self, bucket: &str) -> Result<(BucketQuota, Option<u64>), QuotaError> {
         // If bucket doesn't exist, return ConfigNotFound error
         if !self.bucket_exists(bucket).await {
@@ -246,13 +244,18 @@ impl QuotaChecker {
         }
 
         let quota = self.get_quota_config(bucket).await?;
-        let current_usage = self.report_only_usage(bucket).await;
+        let current_usage = if quota.uses_durable_reservations() {
+            self.report_only_usage(bucket).await
+        } else {
+            Some(self.get_real_time_usage(bucket).await?)
+        };
 
         Ok((quota, current_usage))
     }
 
-    /// Best-effort usage for statistics and durable admission reports.
-    /// Missing scanner coverage is unknown, not an error or a zero-sized bucket.
+    /// Scanner usage for a bucket the reservation ledger admits is reporting
+    /// input only, so unavailable memory usage is reported as "unknown" and counted
+    /// instead of becoming an error the write path would fail on.
     async fn report_only_usage(&self, bucket: &str) -> Option<u64> {
         // The plain lookup: a report must not wait for an early snapshot reload.
         let usage = get_bucket_usage_memory(bucket).await;
@@ -264,7 +267,7 @@ impl QuotaChecker {
                 subsystem = LOG_SUBSYSTEM_QUOTA,
                 state = "usage_unknown",
                 bucket = %bucket,
-                "quota usage report degraded"
+                "durable quota usage report degraded"
             );
         }
         usage
@@ -739,12 +742,8 @@ mod tests {
             1,
             "fail-closed admission takes the early-reload lookup"
         );
-        let (_, usage) = checker
-            .get_quota_stats(&legacy)
-            .await
-            .expect("legacy quota statistics are reporting only");
-        assert_eq!(usage, None);
-        assert_eq!(crate::data_usage::reload_unknown_bucket_usage_calls_for_test(&legacy), 1);
+        assert!(matches!(checker.get_quota_stats(&legacy).await, Err(QuotaError::UsageUnavailable { .. })));
+        assert_eq!(crate::data_usage::reload_unknown_bucket_usage_calls_for_test(&legacy), 2);
         assert_eq!(
             crate::data_usage::reload_unknown_bucket_usage_calls_for_test(&bucket),
             0,
@@ -895,7 +894,7 @@ mod tests {
             .update_bucket_metadata_config(&bucket, QUOTA_CONFIG_FILE, legacy_quota_json(8192))
             .await
             .expect("newer quota save");
-        sys.read().await.set_for_test(bucket.clone(), stale).await;
+        sys.read().await.set(bucket.clone(), stale).await;
         assert_eq!(
             checker
                 .migrate_reservation_protocol(&bucket)

crates/ecstore/src/bucket/quota/checker/tests/reporting_retirement.rs

@@ -245,86 +245,3 @@ async fn quota_without_limit_keeps_the_zero_usage_io_fast_path() {
     assert_eq!(crate::data_usage::reload_unknown_bucket_usage_calls_for_test(&bucket), 0);
     stop_reporting_fixture(&store).await;
 }
-
-#[tokio::test]
-#[serial]
-async fn quota_statistics_remain_available_without_a_complete_scanner_snapshot() {
-    use crate::storage_api_contracts::bucket::{BucketOperations as _, MakeBucketOptions};
-
-    for configuration in ["unconfigured", "unlimited", "snapshot"] {
-        for source in ["missing", "legacy", "incomplete", "observed", "complete", "empty"] {
-            let (_dirs, store, _) = isolated_durable_quota_store().await;
-            let bucket = format!("quota-statistics-{}", Uuid::new_v4().simple());
-            match configuration {
-                "unconfigured" => store
-                    .make_bucket(&bucket, &MakeBucketOptions::default())
-                    .await
-                    .expect("create bucket without a quota configuration"),
-                "unlimited" => {
-                    create_bucket_with_quota_json(
-                        &store,
-                        &bucket,
-                        serde_json::to_vec(&BucketQuota::new(None)).expect("unlimited quota encoding"),
-                    )
-                    .await;
-                }
-                "snapshot" => create_bucket_with_quota_json(&store, &bucket, legacy_quota_json(4096)).await,
-                _ => unreachable!(),
-            }
-            // An unregistered checker keeps legacy migration out of the
-            // assertion: reporting must work before a protocol upgrade.
-            let metadata_sys = BucketMetadataSys::new(store.clone());
-            let (metadata, _) = metadata_sys.get_config(&bucket).await.expect("load existing bucket metadata");
-            metadata_sys.set_for_test(bucket.clone(), metadata).await;
-            let checker = QuotaChecker::new(Arc::new(RwLock::new(metadata_sys)));
-            let (snapshot_source, size) = if source == "empty" { ("complete", 0) } else { (source, 1000) };
-            install_reporting_snapshot(store.clone(), &bucket, snapshot_source, size).await;
-            crate::data_usage::invalidate_data_usage_snapshot_cache().await;
-
-            let statistics = checker.get_quota_stats(&bucket).await;
-            let early_reloads = crate::data_usage::reload_unknown_bucket_usage_calls_for_test(&bucket);
-            let missing_bucket = format!("missing-{}", Uuid::new_v4().simple());
-            let missing_statistics = checker.get_quota_stats(&missing_bucket).await;
-            crate::data_usage::prepare_bucket_usage_for_namespace_change(&bucket, None)
-                .await
-                .expect("fixture cache cleanup");
-            crate::data_usage::invalidate_data_usage_snapshot_cache().await;
-            stop_reporting_fixture(&store).await;
-
-            let (quota, usage) = statistics.unwrap_or_else(|error| {
-                panic!("configuration={configuration}, source={source}: quota statistics must remain available: {error}")
-            });
-            assert_eq!(quota.quota, (configuration == "snapshot").then_some(4096));
-            assert_eq!(
-                usage,
-                (snapshot_source == "complete").then_some(size),
-                "configuration={configuration}, source={source}: only known usage is numeric"
-            );
-            assert_eq!(early_reloads, 0, "read-only statistics must not force an early snapshot reload");
-            assert!(
-                matches!(missing_statistics, Err(QuotaError::ConfigNotFound { bucket }) if bucket == missing_bucket),
-                "reporting must still reject a missing bucket"
-            );
-        }
-    }
-}
-
-#[tokio::test]
-async fn quota_statistics_preserve_configuration_errors() {
-    let (_dirs, store, _) = isolated_durable_quota_store().await;
-    let bucket = format!("quota-invalid-{}", Uuid::new_v4().simple());
-    create_bucket_with_quota_json(&store, &bucket, legacy_quota_json(4096)).await;
-    let metadata_sys = BucketMetadataSys::new(store.clone());
-    let (mut metadata, _) = metadata_sys.get_config(&bucket).await.expect("load existing bucket metadata");
-    Arc::make_mut(&mut metadata).quota_config_json = b"{not-json".to_vec();
-    metadata_sys.set_for_test(bucket.clone(), metadata).await;
-    let checker = QuotaChecker::new(Arc::new(RwLock::new(metadata_sys)));
-
-    let statistics = checker.get_quota_stats(&bucket).await;
-    stop_reporting_fixture(&store).await;
-
-    assert!(
-        matches!(statistics, Err(QuotaError::InvalidConfig { .. })),
-        "unavailable reporting must not hide malformed quota configuration"
-    );
-}

crates/ecstore/src/bucket/replication/replication_config_boundary.rs

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+pub use rustfs_replication::config_cache_serde;
 pub use rustfs_replication::{
     ObjectOpts, OperatorRuleContract, REMOTE_TARGET_CAPABILITY_CONTRACT_VERSION, REMOTE_TARGET_READ_ONLY_HISTORICAL_FIELDS,
     REMOTE_TARGET_UNSUPPORTED_FIELDS, REMOTE_TARGET_WRITABLE_FIELDS, REPLICATION_CAPABILITY_CONTRACT_VERSION,

crates/ecstore/src/bucket/replication/replication_lifecycle_bridge.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use s3s::dto::ReplicationConfiguration;
+use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
 
 use super::replication_config_boundary::ReplicationConfigurationExt as _;
 use super::replication_filemeta_boundary::{
@@ -42,7 +42,7 @@ impl ReplicationLifecycleBridge {
         dead_code,
         reason = "declared boundary surface for the ECStore replication split plan; no caller in this port (backlog#1823)"
     )]
-    pub(crate) fn new_config(config: ReplicationConfiguration) -> ReplicationLifecycleConfig {
+    pub(crate) fn new_config(config: PersistedReplicationConfiguration) -> ReplicationLifecycleConfig {
         ReplicationConfig::new(Some(config), None)
     }
 
@@ -118,16 +118,17 @@ impl ReplicationLifecycleBridge {
 
 #[cfg(test)]
 mod tests {
-    use s3s::dto::{Destination, ReplicationRule, ReplicationRuleStatus};
+    use rustfs_gateway_types::dto::Status;
+    use rustfs_gateway_types::persistence::{PersistedReplicationDestination, PersistedReplicationRule};
 
     use super::super::replication_filemeta_boundary::{ReplicateTargetDecision, VersionPurgeStatusType};
     use super::*;
 
-    fn replication_rule() -> ReplicationRule {
-        ReplicationRule {
+    fn replication_rule() -> PersistedReplicationRule {
+        PersistedReplicationRule {
             delete_marker_replication: None,
             delete_replication: None,
-            destination: Destination {
+            destination: PersistedReplicationDestination {
                 bucket: "arn:aws:s3:::target-bucket".to_string(),
                 ..Default::default()
             },
@@ -137,13 +138,13 @@ mod tests {
             prefix: Some(String::new()),
             priority: Some(1),
             source_selection_criteria: None,
-            status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
+            status: Status::ENABLED.to_string(),
         }
     }
 
     #[test]
     fn has_pending_version_purge_preserves_replication_active_rule_behavior() {
-        let config = ReplicationLifecycleBridge::new_config(ReplicationConfiguration {
+        let config = ReplicationLifecycleBridge::new_config(PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![replication_rule()],
         });

crates/ecstore/src/bucket/replication/replication_metadata_boundary.rs

@@ -17,8 +17,8 @@ use std::sync::Arc;
 use crate::bucket::{metadata::BucketMetadata, metadata_sys};
 use crate::disk::{BUCKET_META_PREFIX, RUSTFS_META_BUCKET};
 use crate::runtime::instance::InstanceContext;
+use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
 use rustfs_utils::path::path_join_buf;
-use s3s::dto::ReplicationConfiguration;
 use time::OffsetDateTime;
 
 use super::replication_error_boundary::{Error, Result};
@@ -36,11 +36,11 @@ impl ReplicationMetadataStore {
     pub(crate) const FORCE_DELETE_REPLICATION_FILE: &'static str = "config/replication/force-delete.bin";
     pub(crate) const FORCE_DELETE_REPLICATION_TRANSACTION_LOCK: &'static str = "config/replication/force-delete.bin.transaction";
 
-    pub(crate) async fn replication_config(bucket: &str) -> Result<(ReplicationConfiguration, OffsetDateTime)> {
+    pub(crate) async fn replication_config(bucket: &str) -> Result<(PersistedReplicationConfiguration, OffsetDateTime)> {
         metadata_sys::get_replication_config(bucket).await
     }
 
-    pub(crate) async fn optional_replication_config(bucket: &str) -> Result<Option<ReplicationConfiguration>> {
+    pub(crate) async fn optional_replication_config(bucket: &str) -> Result<Option<PersistedReplicationConfiguration>> {
         let config = match Self::replication_config(bucket).await {
             Ok((config, _)) => Some(config),
             Err(err) => {

crates/ecstore/src/bucket/replication/replication_object_config.rs

@@ -16,7 +16,9 @@ use std::{collections::HashMap, fmt, sync::Arc};
 
 use super::replication_filemeta_boundary::metadata_keys;
 use crate::bucket::metadata::BucketMetadata;
-use s3s::dto::{BucketVersioningStatus, ReplicationConfiguration, ReplicationRuleStatus, VersioningConfiguration};
+use rustfs_gateway_types::dto::Status;
+use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
+use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
 use serde::{Deserialize, Serialize};
 use time::OffsetDateTime;
 use tracing::error;
@@ -39,7 +41,7 @@ use super::replication_target_boundary::{BucketTargets, ReplicationTargetStore};
 use super::replication_versioning_boundary::ReplicationVersioningStore;
 use super::runtime_boundary as runtime_sources;
 
-pub(crate) async fn get_replication_config(bucket: &str) -> Result<Option<ReplicationConfiguration>> {
+pub(crate) async fn get_replication_config(bucket: &str) -> Result<Option<PersistedReplicationConfiguration>> {
     let config = ReplicationMetadataStore::optional_replication_config(bucket).await?;
     validate_delete_replication_config(&VersioningConfiguration::default(), config.as_ref())?;
     Ok(config)
@@ -64,7 +66,7 @@ impl DeleteReplicationConfigSnapshot {
     #[cfg(test)]
     pub(crate) fn from_configs_for_test(
         versioning: VersioningConfiguration,
-        replication: Option<ReplicationConfiguration>,
+        replication: Option<PersistedReplicationConfiguration>,
     ) -> Self {
         let metadata = replication.map(|config| {
             let mut metadata = BucketMetadata::new("test-bucket");
@@ -78,7 +80,7 @@ impl DeleteReplicationConfigSnapshot {
         &self.versioning
     }
 
-    pub fn replication_config(&self) -> Option<&ReplicationConfiguration> {
+    pub fn replication_config(&self) -> Option<&PersistedReplicationConfiguration> {
         self.metadata
             .as_ref()
             .and_then(|metadata| metadata.replication_config.as_ref())
@@ -101,7 +103,7 @@ impl DeleteReplicationConfigSnapshot {
     pub(crate) fn active_delete_marker_rules_require_tags(&self, object: &str) -> bool {
         self.replication_config().is_some_and(|config| {
             config.rules.iter().any(|rule| {
-                if rule.status == ReplicationRuleStatus::from_static(ReplicationRuleStatus::DISABLED) {
+                if rule.status == Status::DISABLED.as_str() {
                     return false;
                 }
                 if !object.starts_with(rule.prefix()) {
@@ -122,12 +124,12 @@ impl DeleteReplicationConfigSnapshot {
 
 fn validate_delete_replication_config(
     versioning: &VersioningConfiguration,
-    config: Option<&ReplicationConfiguration>,
+    config: Option<&PersistedReplicationConfiguration>,
 ) -> Result<()> {
     if versioning
         .status
         .as_ref()
-        .is_some_and(|status| !matches!(status.as_str(), BucketVersioningStatus::ENABLED | BucketVersioningStatus::SUSPENDED))
+        .is_some_and(|status| !matches!(status.as_str(), "Enabled" | "Suspended"))
     {
         return Err(super::replication_error_boundary::Error::other(
             "bucket versioning configuration has an invalid status",
@@ -144,7 +146,7 @@ fn validate_delete_replication_config(
         let role = config.role.trim();
         let mut role_destination = None;
         for rule in &config.rules {
-            if rule.status.as_str() == ReplicationRuleStatus::ENABLED {
+            if rule.status.as_str() == Status::ENABLED.as_str() {
                 let destination = rule.destination.bucket.trim();
                 if role.is_empty() && destination.is_empty() {
                     return Err(super::replication_error_boundary::Error::other(
@@ -169,7 +171,7 @@ fn validate_delete_replication_config(
     Ok(())
 }
 
-fn replication_config_from_metadata(metadata: &BucketMetadata) -> Result<Option<&ReplicationConfiguration>> {
+fn replication_config_from_metadata(metadata: &BucketMetadata) -> Result<Option<&PersistedReplicationConfiguration>> {
     if !metadata.replication_config_xml.is_empty() && metadata.replication_config.is_none() {
         return Err(super::replication_error_boundary::Error::other(
             "persisted bucket replication configuration is invalid",
@@ -250,12 +252,15 @@ pub(crate) async fn load_delete_replication_config_in(
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct ReplicationConfig {
-    pub config: Option<ReplicationConfiguration>,
+    /// Carried in the scanner's persisted data usage cache, so its serde form
+    /// is the one the s3s DTO wrote there (see `config_cache_serde` in the replication crate).
+    #[serde(with = "super::replication_config_boundary::config_cache_serde")]
+    pub config: Option<PersistedReplicationConfiguration>,
     pub remotes: Option<BucketTargets>,
 }
 
 impl ReplicationConfig {
-    pub fn new(config: Option<ReplicationConfiguration>, remotes: Option<BucketTargets>) -> Self {
+    pub fn new(config: Option<PersistedReplicationConfiguration>, remotes: Option<BucketTargets>) -> Self {
         Self { config, remotes }
     }
 
@@ -468,7 +473,7 @@ fn check_replicate_delete_with_config(
     oi: &ObjectInfo,
     del_opts: &ObjectOptions,
     source_error: bool,
-    config: Option<&ReplicationConfiguration>,
+    config: Option<&PersistedReplicationConfiguration>,
     existing_delete_marker: bool,
     trust_persisted_replica_status: bool,
 ) -> ReplicateDecision {
@@ -587,7 +592,7 @@ pub(crate) async fn must_replicate(bucket: &str, object: &str, mopts: MustReplic
 }
 
 fn metadata_target_should_replicate(
-    cfg: &ReplicationConfiguration,
+    cfg: &PersistedReplicationConfiguration,
     opts: &ObjectOpts,
     mopts: &MustReplicateOptions,
     arn: &str,
@@ -597,20 +602,21 @@ fn metadata_target_should_replicate(
 
 #[cfg(test)]
 mod tests {
-    use s3s::dto::{
-        DeleteMarkerReplication, DeleteMarkerReplicationStatus, DeleteReplication, DeleteReplicationStatus, Destination,
-        ReplicaModifications, ReplicationRule, ReplicationRuleFilter, ReplicationRuleStatus, SourceSelectionCriteria, Tag,
+    use rustfs_gateway_types::dto::Status;
+    use rustfs_gateway_types::persistence::{
+        PersistedOptionalReplicationStatus, PersistedReplicationDestination, PersistedReplicationFilter,
+        PersistedReplicationRule, PersistedReplicationStatus, PersistedReplicationTag, PersistedSourceSelectionCriteria,
     };
 
     use super::super::replication_filemeta_boundary::VersionPurgeStatusType;
     use super::super::replication_target_boundary::BucketTarget;
     use super::*;
 
-    fn replication_rule() -> ReplicationRule {
-        ReplicationRule {
+    fn replication_rule() -> PersistedReplicationRule {
+        PersistedReplicationRule {
             delete_marker_replication: None,
             delete_replication: None,
-            destination: Destination {
+            destination: PersistedReplicationDestination {
                 bucket: "arn:aws:s3:::target-bucket".to_string(),
                 ..Default::default()
             },
@@ -620,7 +626,7 @@ mod tests {
             prefix: Some(String::new()),
             priority: Some(1),
             source_selection_criteria: None,
-            status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
+            status: Status::ENABLED.to_string(),
         }
     }
 
@@ -629,11 +635,11 @@ mod tests {
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
         let mut rule = replication_rule();
         rule.destination.bucket = arn.to_string();
-        rule.filter = Some(ReplicationRuleFilter {
+        rule.filter = Some(PersistedReplicationFilter {
             prefix: Some("admitted/".to_string()),
             ..Default::default()
         });
-        let cfg = ReplicationConfiguration {
+        let cfg = PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![rule],
         };
@@ -671,7 +677,7 @@ mod tests {
         assert!(!empty.replicate(&ObjectOpts::default()));
 
         let config = ReplicationConfig::new(
-            Some(ReplicationConfiguration {
+            Some(PersistedReplicationConfiguration {
                 role: String::new(),
                 rules: vec![replication_rule()],
             }),
@@ -725,7 +731,7 @@ mod tests {
     fn delete_snapshot_rejects_enabled_rules_without_a_destination() {
         let mut rule = replication_rule();
         rule.destination.bucket.clear();
-        let config = ReplicationConfiguration {
+        let config = PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![rule],
         };
@@ -741,7 +747,7 @@ mod tests {
         let first = replication_rule();
         let mut second = replication_rule();
         second.destination.bucket = "arn:aws:s3:::other-target".to_string();
-        let config = ReplicationConfiguration {
+        let config = PersistedReplicationConfiguration {
             role: "arn:aws:s3:::role-target".to_string(),
             rules: vec![first, second],
         };
@@ -752,47 +758,47 @@ mod tests {
     #[test]
     fn delete_snapshot_rejects_unknown_status_values() {
         let invalid_versioning = VersioningConfiguration {
-            status: Some("Enabld".to_string().into()),
+            status: Some("Enabld".to_string()),
             ..Default::default()
         };
         assert!(validate_delete_replication_config(&invalid_versioning, None).is_err());
 
         let mut invalid_rule = replication_rule();
-        invalid_rule.status = "Enabld".to_string().into();
-        let config = ReplicationConfiguration {
+        invalid_rule.status = "Enabld".to_string();
+        let config = PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![invalid_rule],
         };
         assert!(validate_delete_replication_config(&VersioningConfiguration::default(), Some(&config)).is_err());
 
         let mut invalid_delete = replication_rule();
-        invalid_delete.delete_replication = Some(DeleteReplication {
-            status: "Enabld".to_string().into(),
+        invalid_delete.delete_replication = Some(PersistedReplicationStatus {
+            status: "Enabld".to_string(),
         });
-        let config = ReplicationConfiguration {
+        let config = PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![invalid_delete],
         };
         assert!(validate_delete_replication_config(&VersioningConfiguration::default(), Some(&config)).is_err());
 
         let mut invalid_delete_marker = replication_rule();
-        invalid_delete_marker.delete_marker_replication = Some(DeleteMarkerReplication {
-            status: Some("Enabld".to_string().into()),
+        invalid_delete_marker.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
+            status: Some("Enabld".to_string()),
         });
-        let config = ReplicationConfiguration {
+        let config = PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![invalid_delete_marker],
         };
         assert!(validate_delete_replication_config(&VersioningConfiguration::default(), Some(&config)).is_err());
 
         let mut invalid_replica_modifications = replication_rule();
-        invalid_replica_modifications.source_selection_criteria = Some(SourceSelectionCriteria {
-            replica_modifications: Some(ReplicaModifications {
-                status: "Enabld".to_string().into(),
+        invalid_replica_modifications.source_selection_criteria = Some(PersistedSourceSelectionCriteria {
+            replica_modifications: Some(PersistedReplicationStatus {
+                status: "Enabld".to_string(),
             }),
             sse_kms_encrypted_objects: None,
         });
-        let config = ReplicationConfiguration {
+        let config = PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![invalid_replica_modifications],
         };
@@ -804,11 +810,11 @@ mod tests {
         let mut metadata = BucketMetadata::new("bucket");
         metadata.versioning_config_xml = b"configured".to_vec();
         metadata.versioning_config = Some(VersioningConfiguration {
-            status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
+            status: Some("Enabled".to_owned()),
             ..Default::default()
         });
         metadata.replication_config_xml = b"configured".to_vec();
-        metadata.replication_config = Some(ReplicationConfiguration {
+        metadata.replication_config = Some(PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![replication_rule()],
         });
@@ -848,7 +854,7 @@ mod tests {
         );
 
         let mut inconsistent = BucketMetadata::new("bucket");
-        inconsistent.replication_config = Some(ReplicationConfiguration {
+        inconsistent.replication_config = Some(PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![replication_rule()],
         });
@@ -863,11 +869,11 @@ mod tests {
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
         let mut rule = replication_rule();
         rule.destination.bucket = arn.to_string();
-        rule.delete_marker_replication = Some(DeleteMarkerReplication {
-            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::ENABLED)),
+        rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
+            status: Some(Status::ENABLED.to_string()),
         });
         let mut metadata = BucketMetadata::new("bucket");
-        metadata.replication_config = Some(ReplicationConfiguration {
+        metadata.replication_config = Some(PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![rule],
         });
@@ -898,27 +904,27 @@ mod tests {
     fn delete_marker_source_read_is_required_only_for_tag_filtered_rules() {
         let mut prefix_rule = replication_rule();
         prefix_rule.prefix = Some("logs/".to_string());
-        prefix_rule.delete_marker_replication = Some(DeleteMarkerReplication {
-            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::ENABLED)),
+        prefix_rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
+            status: Some(Status::ENABLED.to_string()),
         });
 
         let prefix_snapshot = DeleteReplicationConfigSnapshot::from_configs_for_test(
             VersioningConfiguration {
-                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
+                status: Some("Enabled".to_owned()),
                 ..Default::default()
             },
-            Some(ReplicationConfiguration {
+            Some(PersistedReplicationConfiguration {
                 role: String::new(),
                 rules: vec![prefix_rule],
             }),
         );
 
         let mut tag_rule = replication_rule();
-        tag_rule.delete_marker_replication = Some(DeleteMarkerReplication {
-            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::ENABLED)),
+        tag_rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
+            status: Some(Status::ENABLED.to_string()),
         });
-        tag_rule.filter = Some(ReplicationRuleFilter {
-            tag: Some(Tag {
+        tag_rule.filter = Some(PersistedReplicationFilter {
+            tag: Some(PersistedReplicationTag {
                 key: Some("class".to_string()),
                 value: Some("audit".to_string()),
             }),
@@ -926,10 +932,10 @@ mod tests {
         });
         let tag_snapshot = DeleteReplicationConfigSnapshot::from_configs_for_test(
             VersioningConfiguration {
-                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
+                status: Some("Enabled".to_owned()),
                 ..Default::default()
             },
-            Some(ReplicationConfiguration {
+            Some(PersistedReplicationConfiguration {
                 role: String::new(),
                 rules: vec![tag_rule],
             }),
@@ -944,14 +950,14 @@ mod tests {
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
         let mut rule = replication_rule();
         rule.destination.bucket = arn.to_string();
-        rule.delete_replication = Some(DeleteReplication {
-            status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
+        rule.delete_replication = Some(PersistedReplicationStatus {
+            status: Status::ENABLED.to_string(),
         });
-        rule.delete_marker_replication = Some(DeleteMarkerReplication {
-            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::DISABLED)),
+        rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
+            status: Some(Status::DISABLED.to_string()),
         });
         let config = ReplicationConfig::new(
-            Some(ReplicationConfiguration {
+            Some(PersistedReplicationConfiguration {
                 role: String::new(),
                 rules: vec![rule],
             }),
@@ -985,22 +991,22 @@ mod tests {
     #[test]
     fn live_delete_does_not_trust_persisted_replica_status() {
         let mut rule = replication_rule();
-        rule.delete_replication = Some(DeleteReplication {
-            status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
+        rule.delete_replication = Some(PersistedReplicationStatus {
+            status: Status::ENABLED.to_string(),
         });
-        rule.source_selection_criteria = Some(SourceSelectionCriteria {
-            replica_modifications: Some(ReplicaModifications {
-                status: s3s::dto::ReplicaModificationsStatus::from_static(s3s::dto::ReplicaModificationsStatus::DISABLED),
+        rule.source_selection_criteria = Some(PersistedSourceSelectionCriteria {
+            replica_modifications: Some(PersistedReplicationStatus {
+                status: Status::DISABLED.to_string(),
             }),
             sse_kms_encrypted_objects: None,
         });
-        let replication = ReplicationConfiguration {
+        let replication = PersistedReplicationConfiguration {
             role: String::new(),
             rules: vec![rule],
         };
         let snapshot = DeleteReplicationConfigSnapshot::from_configs_for_test(
             VersioningConfiguration {
-                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
+                status: Some("Enabled".to_owned()),
                 ..Default::default()
             },
             Some(replication.clone()),
@@ -1036,14 +1042,14 @@ mod tests {
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
         let mut rule = replication_rule();
         rule.destination.bucket = arn.to_string();
-        rule.delete_replication = Some(DeleteReplication {
-            status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
+        rule.delete_replication = Some(PersistedReplicationStatus {
+            status: Status::ENABLED.to_string(),
         });
-        rule.delete_marker_replication = Some(DeleteMarkerReplication {
-            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::DISABLED)),
+        rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
+            status: Some(Status::DISABLED.to_string()),
         });
         let config = ReplicationConfig::new(
-            Some(ReplicationConfiguration {
+            Some(PersistedReplicationConfiguration {
                 role: String::new(),
                 rules: vec![rule],
             }),

crates/ecstore/src/bucket/replication/replication_pool.rs

@@ -4794,9 +4794,10 @@ mod tests {
     #[tokio::test]
     async fn heal_queue_marks_missing_versioning_state_as_missed() {
         use super::super::replication_target_boundary::BucketTargets;
-        use s3s::dto::{
-            DeleteReplication, DeleteReplicationStatus, Destination, ReplicationConfiguration, ReplicationRule,
-            ReplicationRuleStatus,
+        use rustfs_gateway_types::dto::Status;
+        use rustfs_gateway_types::persistence::{
+            PersistedReplicationConfiguration, PersistedReplicationDestination, PersistedReplicationRule,
+            PersistedReplicationStatus,
         };
 
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
@@ -4811,14 +4812,14 @@ mod tests {
                 ..Default::default()
             },
             ReplicationConfig::new(
-                Some(ReplicationConfiguration {
+                Some(PersistedReplicationConfiguration {
                     role: String::new(),
-                    rules: vec![ReplicationRule {
+                    rules: vec![PersistedReplicationRule {
                         delete_marker_replication: None,
-                        delete_replication: Some(DeleteReplication {
-                            status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
+                        delete_replication: Some(PersistedReplicationStatus {
+                            status: Status::ENABLED.to_string(),
                         }),
-                        destination: Destination {
+                        destination: PersistedReplicationDestination {
                             bucket: arn.to_string(),
                             ..Default::default()
                         },
@@ -4828,7 +4829,7 @@ mod tests {
                         prefix: Some(String::new()),
                         priority: Some(1),
                         source_selection_criteria: None,
-                        status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
+                        status: Status::ENABLED.to_string(),
                     }],
                 }),
                 Some(BucketTargets::default()),

crates/ecstore/src/bucket/replication/replication_resyncer.rs

@@ -85,6 +85,8 @@ use http_body_util::StreamBody;
 use metrics::counter;
 #[cfg(test)]
 use rmp_serde;
+#[cfg(test)]
+use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
 use rustfs_s3_types::EventName;
 use rustfs_utils::http::{
     AMZ_OBJECT_LOCK_LEGAL_HOLD, AMZ_OBJECT_LOCK_MODE, AMZ_OBJECT_LOCK_RETAIN_UNTIL_DATE, AMZ_TAGGING_DIRECTIVE,
@@ -92,8 +94,6 @@ use rustfs_utils::http::{
     insert_str, replication_target_versions,
 };
 use rustfs_utils::{DEFAULT_SIP_HASH_KEY, get_env_usize, sip_hash};
-#[cfg(test)]
-use s3s::dto::ReplicationConfiguration;
 use std::collections::{HashMap, HashSet};
 use std::fmt::Display;
 use std::pin::Pin;
@@ -6500,9 +6500,10 @@ mod tests {
 
     use super::super::replication_target_boundary::{BucketTarget, BucketTargets};
     use super::*;
-    use s3s::dto::{
-        BucketVersioningStatus, DeleteReplication, DeleteReplicationStatus, Destination, ExcludedPrefix, ReplicationRule,
-        ReplicationRuleStatus, VersioningConfiguration,
+    use rustfs_gateway_types::dto::Status;
+    use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
+    use rustfs_gateway_types::persistence::{
+        PersistedReplicationDestination, PersistedReplicationRule, PersistedReplicationStatus,
     };
     use std::collections::HashMap;
     use time::OffsetDateTime;
@@ -8568,7 +8569,7 @@ mod tests {
             ..Default::default()
         };
         let rcfg = ReplicationConfig::new(
-            Some(ReplicationConfiguration {
+            Some(PersistedReplicationConfiguration {
                 role: role.to_string(),
                 rules: vec![],
             }),
@@ -8594,7 +8595,7 @@ mod tests {
         ReplicationVersioningStore::install_prefix_state_test_config(
             &bucket,
             VersioningConfiguration {
-                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
+                status: Some("Enabled".to_owned()),
                 ..Default::default()
             },
         );
@@ -8627,22 +8628,20 @@ mod tests {
         ReplicationVersioningStore::install_prefix_state_test_config(
             &bucket,
             VersioningConfiguration {
-                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
-                excluded_prefixes: Some(vec![ExcludedPrefix {
-                    prefix: Some("archive/".to_string()),
-                }]),
+                status: Some("Enabled".to_owned()),
+                excluded_prefixes: Some(vec![Some("archive/".to_string())]),
                 ..Default::default()
             },
         );
         let rcfg = ReplicationConfig::new(
-            Some(ReplicationConfiguration {
+            Some(PersistedReplicationConfiguration {
                 role: String::new(),
-                rules: vec![ReplicationRule {
+                rules: vec![PersistedReplicationRule {
                     delete_marker_replication: None,
-                    delete_replication: Some(DeleteReplication {
-                        status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
+                    delete_replication: Some(PersistedReplicationStatus {
+                        status: Status::ENABLED.to_string(),
                     }),
-                    destination: Destination {
+                    destination: PersistedReplicationDestination {
                         bucket: arn.to_string(),
                         ..Default::default()
                     },
@@ -8652,7 +8651,7 @@ mod tests {
                     prefix: Some(String::new()),
                     priority: Some(1),
                     source_selection_criteria: None,
-                    status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
+                    status: Status::ENABLED.to_string(),
                 }],
             }),
             Some(BucketTargets {
@@ -8688,14 +8687,14 @@ mod tests {
         let admitted_arn = "arn:rustfs:replication:us-east-1:target:admitted";
         let current_role = "arn:rustfs:replication:us-east-1:target:current";
         let rcfg = ReplicationConfig::new(
-            Some(ReplicationConfiguration {
+            Some(PersistedReplicationConfiguration {
                 role: current_role.to_string(),
-                rules: vec![ReplicationRule {
+                rules: vec![PersistedReplicationRule {
                     delete_marker_replication: None,
-                    delete_replication: Some(DeleteReplication {
-                        status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::DISABLED),
+                    delete_replication: Some(PersistedReplicationStatus {
+                        status: Status::DISABLED.to_string(),
                     }),
-                    destination: Destination {
+                    destination: PersistedReplicationDestination {
                         bucket: current_role.to_string(),
                         ..Default::default()
                     },
@@ -8705,7 +8704,7 @@ mod tests {
                     prefix: Some(String::new()),
                     priority: Some(1),
                     source_selection_criteria: None,
-                    status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
+                    status: Status::ENABLED.to_string(),
                 }],
             }),
             Some(BucketTargets {
@@ -8753,12 +8752,12 @@ mod tests {
     #[tokio::test]
     async fn heal_rejects_semantically_invalid_replication_config() {
         let rcfg = ReplicationConfig::new(
-            Some(ReplicationConfiguration {
+            Some(PersistedReplicationConfiguration {
                 role: String::new(),
-                rules: vec![ReplicationRule {
+                rules: vec![PersistedReplicationRule {
                     delete_marker_replication: None,
                     delete_replication: None,
-                    destination: Destination {
+                    destination: PersistedReplicationDestination {
                         bucket: "arn:rustfs:replication:us-east-1:target:bucket".to_string(),
                         ..Default::default()
                     },
@@ -8768,7 +8767,7 @@ mod tests {
                     prefix: Some(String::new()),
                     priority: Some(1),
                     source_selection_criteria: None,
-                    status: ReplicationRuleStatus::from_static("Enabld"),
+                    status: "Enabld".to_owned(),
                 }],
             }),
             Some(BucketTargets::default()),

crates/ecstore/src/bucket/replication/replication_target_config_bridge.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use s3s::dto::ReplicationConfiguration;
+use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
 
 use super::replication_config_boundary::{ObjectOpts, ReplicationConfigurationExt};
 use super::replication_filemeta_boundary::ReplicationType;
@@ -20,7 +20,7 @@ use super::replication_filemeta_boundary::ReplicationType;
 pub(crate) struct ReplicationTargetConfigBridge;
 
 impl ReplicationTargetConfigBridge {
-    pub(crate) fn target_is_used_by_rules(config: &ReplicationConfiguration, arn: &str) -> bool {
+    pub(crate) fn target_is_used_by_rules(config: &PersistedReplicationConfiguration, arn: &str) -> bool {
         config
             .filter_target_arns(&ObjectOpts {
                 op_type: ReplicationType::All,
@@ -37,7 +37,7 @@ mod tests {
 
     #[test]
     fn target_config_bridge_matches_role_target() {
-        let config = ReplicationConfiguration {
+        let config = PersistedReplicationConfiguration {
             role: " arn:target ".to_string(),
             rules: Vec::new(),
         };

crates/ecstore/src/bucket/replication/replication_versioning_boundary.rs

@@ -15,7 +15,7 @@
 use super::replication_error_boundary::Result;
 use crate::bucket::{versioning::VersioningApi as _, versioning_sys::BucketVersioningSys};
 #[cfg(test)]
-use s3s::dto::VersioningConfiguration;
+use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
 #[cfg(test)]
 use std::{collections::HashMap, sync::LazyLock, sync::Mutex};
 

crates/ecstore/src/bucket/tagging/mod.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use s3s::dto::Tag;
+use rustfs_gateway_types::cors_tagging::PersistedTag as Tag;
 use std::cmp::Ordering;
 use std::collections::HashMap;
 use url::form_urlencoded;

crates/ecstore/src/bucket/utils.rs

@@ -15,9 +15,23 @@
 use crate::disk::{MIGRATING_META_BUCKET, RUSTFS_META_BUCKET};
 use crate::error::{Error, Result, StorageError};
 use regex::Regex;
+use rustfs_gateway_types::cors_tagging::{
+    CorsTaggingCodecError, PersistedCorsConfiguration, PersistedTagging, parse_cors, parse_tagging, serialize_cors,
+    serialize_tagging,
+};
+use rustfs_gateway_types::persistence::{
+    PersistedAccelerateConfiguration, PersistedBucketEncryptionConfiguration, PersistedBucketLoggingStatus,
+    PersistedLifecycleConfiguration, PersistedNotificationConfiguration, PersistedObjectLockConfiguration,
+    PersistedPublicAccessBlockConfiguration, PersistedReplicationConfiguration, PersistedRequestPaymentConfiguration,
+    PersistedVersioningConfiguration, PersistedWebsiteConfiguration, PersistenceCodecError, parse_accelerate,
+    parse_bucket_encryption, parse_bucket_logging, parse_lifecycle_legacy_dates, parse_notification, parse_object_lock,
+    parse_public_access_block, parse_replication, parse_request_payment, parse_versioning, parse_website, serialize_accelerate,
+    serialize_bucket_encryption, serialize_bucket_logging, serialize_lifecycle_legacy_dates, serialize_notification,
+    serialize_object_lock, serialize_public_access_block, serialize_replication, serialize_request_payment, serialize_versioning,
+    serialize_website,
+};
 use rustfs_utils::WindowsFileNameError;
 use rustfs_utils::path::SLASH_SEPARATOR;
-use s3s::xml;
 use tracing::instrument;
 
 pub fn is_meta_bucketname(name: &str) -> bool {
@@ -74,37 +88,173 @@ pub fn check_valid_bucket_name_strict(bucket_name: &str) -> Result<()> {
     check_bucket_name_common(bucket_name, true)
 }
 
-// RUSTFS_COMPAT_TODO(s3gate-metadata-xml): the s3s codec reads persisted XML during migration. Remove after every supported writer uses the gateway codec and every retained metadata object and backup archive is verified or rewritten.
-pub fn deserialize<T>(input: &[u8]) -> xml::DeResult<T>
-where
-    T: for<'xml> xml::Deserialize<'xml>,
-{
-    let mut d = xml::Deserializer::new(input);
-    let ans = T::deserialize(&mut d)?;
-    d.expect_eof()?;
-    Ok(ans)
+/// A bucket configuration persisted as XML in the bucket metadata, together
+/// with the codec that reads and writes its stored bytes.
+///
+/// Every family reads and writes its stored bytes through the gateway
+/// persistence codecs (`rustfs_gateway_types::persistence` and
+/// `rustfs_gateway_types::cors_tagging`, rustfs/backlog#2745). The codecs keep
+/// the persisted bytes the `bucket_config_goldens` pin, so a document the old
+/// s3s codec wrote reads back and re-encodes unchanged.
+pub trait BucketConfigXml: Sized {
+    /// Decodes the stored bytes of one configuration document.
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError>;
+
+    /// Encodes the value as RustFS stores it.
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError>;
 }
 
-#[allow(
-    dead_code,
-    reason = "xml serialize helper with no caller in this port; the live sibling is deserialize (backlog#1823)"
-)]
-pub fn serialize_content<T: xml::SerializeContent>(val: &T) -> xml::SerResult<String> {
-    let mut buf = Vec::with_capacity(256);
-    {
-        let mut ser = xml::Serializer::new(&mut buf);
-        val.serialize_content(&mut ser)?;
-    }
-    Ok(String::from_utf8(buf).unwrap())
+/// Why a persisted bucket configuration could not be decoded or encoded.
+#[derive(Debug, thiserror::Error)]
+pub enum BucketConfigXmlError {
+    /// A gateway persistence codec refused the bytes or the value.
+    #[error(transparent)]
+    Persisted(#[from] PersistenceCodecError),
+    /// The gateway CORS or Tagging codec refused the bytes or the value.
+    #[error(transparent)]
+    CorsTagging(#[from] CorsTaggingCodecError),
 }
 
-pub fn serialize<T: xml::Serialize>(val: &T) -> xml::SerResult<Vec<u8>> {
-    let mut buf = Vec::with_capacity(256);
-    {
-        let mut ser = xml::Serializer::new(&mut buf);
-        val.serialize(&mut ser)?;
+/// Decodes one persisted bucket configuration document.
+pub fn deserialize<T: BucketConfigXml>(input: &[u8]) -> std::result::Result<T, BucketConfigXmlError> {
+    T::decode_config_xml(input)
+}
+
+/// Encodes one bucket configuration as RustFS persists it.
+pub fn serialize<T: BucketConfigXml>(val: &T) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+    val.encode_config_xml()
+}
+
+impl BucketConfigXml for PersistedReplicationConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_replication(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_replication(self)?)
+    }
+}
+
+impl BucketConfigXml for PersistedLifecycleConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_lifecycle_legacy_dates(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_lifecycle_legacy_dates(self)?)
+    }
+}
+
+// The gateway writers of these families are infallible: a value that exists is
+// always encodable, so only the readers can refuse bytes.
+impl BucketConfigXml for PersistedAccelerateConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_accelerate(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_accelerate(self))
+    }
+}
+
+impl BucketConfigXml for PersistedBucketLoggingStatus {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_bucket_logging(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_bucket_logging(self))
+    }
+}
+
+impl BucketConfigXml for PersistedCorsConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_cors(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_cors(self))
+    }
+}
+
+impl BucketConfigXml for PersistedNotificationConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_notification(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_notification(self))
+    }
+}
+
+impl BucketConfigXml for PersistedObjectLockConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_object_lock(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_object_lock(self))
+    }
+}
+
+impl BucketConfigXml for PersistedPublicAccessBlockConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_public_access_block(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_public_access_block(self))
+    }
+}
+
+impl BucketConfigXml for PersistedRequestPaymentConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_request_payment(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_request_payment(self))
+    }
+}
+
+impl BucketConfigXml for PersistedBucketEncryptionConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_bucket_encryption(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_bucket_encryption(self))
+    }
+}
+
+impl BucketConfigXml for PersistedTagging {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_tagging(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_tagging(self))
+    }
+}
+
+impl BucketConfigXml for PersistedVersioningConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_versioning(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_versioning(self))
+    }
+}
+
+impl BucketConfigXml for PersistedWebsiteConfiguration {
+    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
+        Ok(parse_website(input)?)
+    }
+
+    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
+        Ok(serialize_website(self))
     }
-    Ok(buf)
 }
 
 pub fn has_bad_path_component(path: &str) -> bool {
@@ -434,6 +584,40 @@ mod tests {
     use super::*;
     use proptest::prelude::*;
 
+    /// Every bucket-configuration family reads and writes through its own
+    /// gateway codec (rustfs/backlog#2745): the family's golden document
+    /// decodes and re-encodes to the same bytes, and a document of another
+    /// family is refused instead of decoding into an empty configuration.
+    #[test]
+    fn every_bucket_config_family_uses_its_own_gateway_codec() {
+        fn assert_family<T: BucketConfigXml>(family: &str, own: &[u8], foreign: &[u8]) {
+            let value = deserialize::<T>(own).unwrap_or_else(|err| panic!("{family}: own document must decode: {err}"));
+            let encoded = serialize(&value).unwrap_or_else(|err| panic!("{family}: value must encode: {err}"));
+            assert_eq!(encoded, own, "{family}: re-encoding must keep the persisted bytes");
+            assert!(deserialize::<T>(foreign).is_err(), "{family}: a foreign root element must be refused");
+        }
+
+        macro_rules! golden {
+            ($family:literal) => {
+                include_bytes!(concat!("../../tests/fixtures/bucket-config-goldens/", $family, "/minio.out.xml"))
+            };
+        }
+        let tagging = golden!("tagging");
+        let versioning = golden!("versioning");
+
+        assert_family::<PersistedAccelerateConfiguration>("accelerate", golden!("accelerate"), tagging);
+        assert_family::<PersistedBucketLoggingStatus>("logging", golden!("logging"), tagging);
+        assert_family::<PersistedCorsConfiguration>("cors", golden!("cors"), tagging);
+        assert_family::<PersistedNotificationConfiguration>("notification", golden!("notification"), tagging);
+        assert_family::<PersistedObjectLockConfiguration>("object_lock", golden!("object_lock"), tagging);
+        assert_family::<PersistedPublicAccessBlockConfiguration>("public_access_block", golden!("public_access_block"), tagging);
+        assert_family::<PersistedRequestPaymentConfiguration>("request_payment", golden!("request_payment"), tagging);
+        assert_family::<PersistedBucketEncryptionConfiguration>("encryption", golden!("encryption"), tagging);
+        assert_family::<PersistedTagging>("tagging", tagging, versioning);
+        assert_family::<PersistedVersioningConfiguration>("versioning", versioning, tagging);
+        assert_family::<PersistedWebsiteConfiguration>("website", golden!("website"), tagging);
+    }
+
     /// rustfs#5785: keys whose path segments exceed the on-disk NAME_MAX
     /// budget must be rejected up front as ObjectNameInvalid (4xx), not leak
     /// ENAMETOOLONG as InternalError 500 from the disk layer.

crates/ecstore/src/bucket/versioning/mod.rs

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
 use rustfs_utils::string::match_simple;
-use s3s::dto::{BucketVersioningStatus, VersioningConfiguration};
 
 pub trait VersioningApi {
     fn enabled(&self) -> bool;
@@ -28,10 +28,10 @@ pub trait VersioningApi {
 
 impl VersioningApi for VersioningConfiguration {
     fn enabled(&self) -> bool {
-        self.status == Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED))
+        self.status.as_deref() == Some("Enabled")
     }
     fn prefix_enabled(&self, prefix: &str) -> bool {
-        if self.status != Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)) {
+        if self.status.as_deref() != Some("Enabled") {
             return false;
         }
 
@@ -44,12 +44,10 @@ impl VersioningApi for VersioningConfiguration {
         }
 
         if let Some(ref excluded_prefixes) = self.excluded_prefixes {
-            for p in excluded_prefixes.iter() {
-                if let Some(ref sprefix) = p.prefix {
-                    let pattern = format!("{sprefix}*");
-                    if match_simple(&pattern, prefix) {
-                        return false;
-                    }
+            for sprefix in excluded_prefixes.iter().flatten() {
+                let pattern = format!("{sprefix}*");
+                if match_simple(&pattern, prefix) {
+                    return false;
                 }
             }
         }
@@ -58,11 +56,11 @@ impl VersioningApi for VersioningConfiguration {
     }
 
     fn prefix_suspended(&self, prefix: &str) -> bool {
-        if self.status == Some(BucketVersioningStatus::from_static(BucketVersioningStatus::SUSPENDED)) {
+        if self.status.as_deref() == Some("Suspended") {
             return true;
         }
 
-        if self.status == Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)) {
+        if self.status.as_deref() == Some("Enabled") {
             if prefix.is_empty() {
                 return false;
             }
@@ -75,12 +73,10 @@ impl VersioningApi for VersioningConfiguration {
             }
 
             if let Some(ref excluded_prefixes) = self.excluded_prefixes {
-                for p in excluded_prefixes.iter() {
-                    if let Some(ref sprefix) = p.prefix {
-                        let pattern = format!("{sprefix}*");
-                        if match_simple(&pattern, prefix) {
-                            return true;
-                        }
+                for sprefix in excluded_prefixes.iter().flatten() {
+                    let pattern = format!("{sprefix}*");
+                    if match_simple(&pattern, prefix) {
+                        return true;
                     }
                 }
             }
@@ -92,14 +88,12 @@ impl VersioningApi for VersioningConfiguration {
         self.prefix_enabled(prefix) || self.prefix_suspended(prefix)
     }
     fn suspended(&self) -> bool {
-        self.status == Some(BucketVersioningStatus::from_static(BucketVersioningStatus::SUSPENDED))
+        self.status.as_deref() == Some("Suspended")
     }
 }
 
 #[cfg(test)]
 mod tests {
-    use s3s::dto::{BucketVersioningStatus, ExcludedPrefix};
-
     use super::*;
 
     struct LegacyVersioning;
@@ -134,10 +128,8 @@ mod tests {
     #[test]
     fn delete_state_treats_excluded_prefixes_as_unversioned() {
         let config = VersioningConfiguration {
-            status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
-            excluded_prefixes: Some(vec![ExcludedPrefix {
-                prefix: Some("archive/".to_string()),
-            }]),
+            status: Some("Enabled".to_owned()),
+            excluded_prefixes: Some(vec![Some("archive/".to_string())]),
             ..Default::default()
         };
 
@@ -146,7 +138,7 @@ mod tests {
         assert_eq!(config.delete_state("live/object"), (true, false));
 
         let suspended = VersioningConfiguration {
-            status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::SUSPENDED)),
+            status: Some("Suspended".to_owned()),
             ..Default::default()
         };
         assert_eq!(suspended.delete_state("archive/object"), (false, true));

crates/ecstore/src/bucket/versioning_sys.rs

@@ -17,7 +17,7 @@ use super::metadata::unreadable_config_refusal;
 use super::{metadata_sys::get_bucket_metadata_sys, versioning::VersioningApi};
 use crate::disk::RUSTFS_META_BUCKET;
 use crate::error::Result;
-use s3s::dto::VersioningConfiguration;
+use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
 use tracing::{error, warn};
 
 pub struct BucketVersioningSys {}
@@ -163,7 +163,7 @@ mod tests {
 
     fn enabled() -> VersioningConfiguration {
         VersioningConfiguration {
-            status: Some(s3s::dto::BucketVersioningStatus::from_static(s3s::dto::BucketVersioningStatus::ENABLED)),
+            status: Some("Enabled".to_owned()),
             ..Default::default()
         }
     }

crates/ecstore/src/cache_value/metacache_set.rs

@@ -25,7 +25,7 @@ use std::{
     future::Future,
     io::ErrorKind,
     pin::Pin,
-    sync::{Arc, OnceLock},
+    sync::{Arc, OnceLock, atomic::AtomicBool},
     task::{Context, Poll},
     time::Duration,
 };
@@ -198,8 +198,6 @@ pub(crate) enum TestReaderBehavior {
         stopped: Arc<tokio::sync::Notify>,
     },
     IgnoreCancel,
-    /// Entries followed by a terminator trailer saying the producer stopped at its limit.
-    LimitReached(Vec<MetaCacheEntry>),
     ProducerError(DiskError),
     PrimaryErrorThenFallback(DiskError),
     PartialThenTimeout(Vec<MetaCacheEntry>),
@@ -238,6 +236,8 @@ pub struct ListPathRawOptions {
     pub skip_walkdir_total_timeout: bool,
     pub walkdir_timeout: Option<Duration>,
     pub walkdir_stall_timeout: Option<Duration>,
+    /// Shared terminal state for bounded producer walks.
+    pub producer_limit_reached: Option<Arc<AtomicBool>>,
     pub agreed: Option<AgreedFn>,
     pub partial: Option<PartialFn>,
     pub finished: Option<FinishedFn>,
@@ -248,7 +248,7 @@ pub struct ListPathRawOptions {
     #[cfg(test)]
     pub(crate) peek_timeout: Option<Duration>,
     #[cfg(test)]
-    pub(crate) test_disk_io_context_observed: Option<Arc<std::sync::atomic::AtomicBool>>,
+    pub(crate) test_disk_io_context_observed: Option<Arc<AtomicBool>>,
     // pub agreed: Option<Arc<dyn Fn(MetaCacheEntry) + Send + Sync>>,
     // pub partial: Option<Arc<dyn Fn(MetaCacheEntries, &[Option<Error>]) + Send + Sync>>,
     // pub finished: Option<Arc<dyn Fn(&[Option<Error>]) + Send + Sync>>,
@@ -273,6 +273,7 @@ impl Clone for ListPathRawOptions {
             skip_walkdir_total_timeout: self.skip_walkdir_total_timeout,
             walkdir_timeout: self.walkdir_timeout,
             walkdir_stall_timeout: self.walkdir_stall_timeout,
+            producer_limit_reached: self.producer_limit_reached.clone(),
             #[cfg(test)]
             test_reader_behaviors: self.test_reader_behaviors.clone(),
             #[cfg(test)]
@@ -300,31 +301,22 @@ fn walk_dir_options(opts: &ListPathRawOptions) -> WalkDirOptions {
         skip_total_timeout: opts.skip_walkdir_total_timeout,
         timeout_ms: opts.walkdir_timeout.map(duration_millis),
         stall_timeout_ms: opts.walkdir_stall_timeout.map(duration_millis),
+        producer_limit_reached: opts.producer_limit_reached.clone(),
         ..Default::default()
     }
 }
 
-/// How a merged raw listing stream ended.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub struct ListPathRawOutcome {
-    /// At least one producer stopped at its per-disk limit instead of at the
-    /// end of its namespace, so the closed stream is not proof of exhaustion.
-    /// Carried in-band by the metacache stream trailer, so remote producers
-    /// report it as well.
-    pub limit_reached: bool,
-}
-
 pub async fn list_path_raw(rx: CancellationToken, opts: ListPathRawOptions) -> disk::error::Result<()> {
     let rx = rx.child_token();
     let _cancel_guard = rx.clone().drop_guard();
-    list_path_raw_inner(rx, opts, None, None).await.map(|_| ())
+    list_path_raw_inner(rx, opts, None, None).await
 }
 
 pub(crate) async fn list_path_raw_with_claim_tracker(
     rx: CancellationToken,
     opts: ListPathRawOptions,
     claim_tracker: FallbackClaimTracker,
-) -> disk::error::Result<ListPathRawOutcome> {
+) -> disk::error::Result<()> {
     let rx = rx.child_token();
     let _cancel_guard = rx.clone().drop_guard();
     list_path_raw_inner(rx, opts, Some(claim_tracker), None).await
@@ -335,7 +327,7 @@ pub(crate) async fn list_path_raw_with_partial_result(
     opts: ListPathRawOptions,
     claim_tracker: FallbackClaimTracker,
     partial_result: PartialResultFn,
-) -> disk::error::Result<ListPathRawOutcome> {
+) -> disk::error::Result<()> {
     let rx = rx.child_token();
     let _cancel_guard = rx.clone().drop_guard();
     list_path_raw_inner(rx, opts, Some(claim_tracker), Some(partial_result)).await
@@ -346,7 +338,7 @@ async fn list_path_raw_inner(
     opts: ListPathRawOptions,
     fallback_claim_tracker: Option<FallbackClaimTracker>,
     partial_result: Option<PartialResultFn>,
-) -> disk::error::Result<ListPathRawOutcome> {
+) -> disk::error::Result<()> {
     if opts.disks.is_empty() {
         return Err(DiskError::ErasureReadQuorum);
     }
@@ -401,14 +393,6 @@ async fn list_path_raw_inner(
                         out.close().await.expect("test entries should close");
                         return Ok(());
                     }
-                    TestReaderBehavior::LimitReached(entries) => {
-                        let mut out = rustfs_filemeta::MetacacheWriter::new(&mut wr);
-                        out.write(&entries).await.expect("test entries should be written");
-                        out.close_with_limit_reached(true)
-                            .await
-                            .expect("test entries should close at the limit");
-                        return Ok(());
-                    }
                     TestReaderBehavior::Stall => {
                         let _held_writer = wr;
                         cancel_rx_clone.cancelled().await;
@@ -547,16 +531,6 @@ async fn list_path_raw_inner(
                             last_err = None;
                             continue;
                         }
-                        TestReaderBehavior::LimitReached(entries) => {
-                            let mut out = rustfs_filemeta::MetacacheWriter::new(&mut wr);
-                            out.write(&entries).await.expect("test fallback entries should be written");
-                            out.close_with_limit_reached(true)
-                                .await
-                                .expect("test fallback entries should close at the limit");
-                            need_fallback = false;
-                            last_err = None;
-                            continue;
-                        }
                         TestReaderBehavior::ProducerError(err) | TestReaderBehavior::PrimaryErrorThenFallback(err) => {
                             last_err = Some(err);
                             continue;
@@ -725,9 +699,6 @@ async fn list_path_raw_inner(
         }
         let mut pending_entries: Vec<Option<MetaCacheEntry>> = vec![None; readers.len()];
         let mut peek_outcomes: Vec<Option<PeekOutcome>> = std::iter::repeat_with(|| None).take(readers.len()).collect();
-        // Sticky across rounds: once any reader's trailer says its producer
-        // stopped at the per-disk limit, the merged stream may hide more keys.
-        let mut limit_reached = false;
 
         loop {
             let mut current = MetaCacheEntry::default();
@@ -739,7 +710,7 @@ async fn list_path_raw_inner(
             // );
 
             if revjob_rx.is_cancelled() {
-                return Ok(ListPathRawOutcome { limit_reached });
+                return Ok(());
             }
 
             let mut top_entries: Vec<Option<MetaCacheEntry>> = vec![None; readers.len()];
@@ -789,7 +760,6 @@ async fn list_path_raw_inner(
                                     continue;
                                 }
                                 // eof
-                                limit_reached |= r.limit_reached() == Some(true);
                                 at_eof += 1;
                                 // warn!("list_path_raw: peek eof, disk: {}", i);
                                 continue;
@@ -863,7 +833,7 @@ async fn list_path_raw_inner(
                             *r = MetacacheReader::new(detached_rd);
                             continue;
                         }
-                        PeekOutcome::Cancelled => return Ok(ListPathRawOutcome { limit_reached }),
+                        PeekOutcome::Cancelled => return Ok(()),
                     }
                 };
 
@@ -922,7 +892,7 @@ async fn list_path_raw_inner(
                 if let Some(finished_fn) = opts.finished.as_ref() {
                     tokio::select! {
                         biased;
-                        _ = revjob_rx.cancelled() => return Ok(ListPathRawOutcome { limit_reached }),
+                        _ = revjob_rx.cancelled() => return Ok(()),
                         _ = finished_fn(&errs) => {}
                     }
                 }
@@ -979,7 +949,7 @@ async fn list_path_raw_inner(
                 {
                     tokio::select! {
                         biased;
-                        _ = revjob_rx.cancelled() => return Ok(ListPathRawOutcome { limit_reached }),
+                        _ = revjob_rx.cancelled() => return Ok(()),
                         _ = finished_fn(&errs) => {}
                     }
                 }
@@ -999,7 +969,7 @@ async fn list_path_raw_inner(
                     // warn!("list_path_raw: agreed_fn start, current: {:?}", &current.name);
                     tokio::select! {
                         biased;
-                        _ = revjob_rx.cancelled() => return Ok(ListPathRawOutcome { limit_reached }),
+                        _ = revjob_rx.cancelled() => return Ok(()),
                         result = agreed_fn(current) => result?
                     }
                     // warn!("list_path_raw: agreed_fn done");
@@ -1023,61 +993,58 @@ async fn list_path_raw_inner(
             if let Some(partial_fn) = partial_result.as_ref() {
                 tokio::select! {
                     biased;
-                    _ = revjob_rx.cancelled() => return Ok(ListPathRawOutcome { limit_reached }),
+                    _ = revjob_rx.cancelled() => return Ok(()),
                     result = partial_fn(MetaCacheEntries(top_entries), &errs) => result?,
                 }
             } else if let Some(partial_fn) = opts.partial.as_ref() {
                 tokio::select! {
                     biased;
-                    _ = revjob_rx.cancelled() => return Ok(ListPathRawOutcome { limit_reached }),
+                    _ = revjob_rx.cancelled() => return Ok(()),
                     _ = partial_fn(MetaCacheEntries(top_entries), &errs) => {}
                 }
             }
         }
-        Ok(ListPathRawOutcome { limit_reached })
+        Ok(())
     });
 
     let merge_started = std::time::Instant::now();
     let Some(revjob) = revjobs.join_next().await else {
         return Err(DiskError::Unexpected);
     };
-    let outcome = match revjob.map_err(std::io::Error::other)? {
-        Ok(outcome) => outcome,
-        Err(err) => {
-            rustfs_io_metrics::record_stage_duration("metacache_merge_failed", merge_started.elapsed().as_secs_f64() * 1000.0);
-            if is_missing_path_error(&err) {
-                debug!(
-                    event = EVENT_METACACHE_LISTING,
-                    component = LOG_COMPONENT_ECSTORE,
-                    subsystem = LOG_SUBSYSTEM_METACACHE,
-                    bucket = %log_bucket,
-                    path = %log_path,
-                    state = "merge_job_missing_path",
-                    error = ?err,
-                    "Metacache merge job missing path skipped"
-                );
-            } else {
-                error!(
-                    event = EVENT_METACACHE_LISTING,
-                    component = LOG_COMPONENT_ECSTORE,
-                    subsystem = LOG_SUBSYSTEM_METACACHE,
-                    bucket = %log_bucket,
-                    path = %log_path,
-                    state = "merge_job_failed",
-                    error = ?err,
-                    "Metacache merge job failed"
-                );
-            }
-            cancel_rx.cancel();
-            jobs.abort_all();
-
-            return Err(err);
+    if let Err(err) = revjob.map_err(std::io::Error::other)? {
+        rustfs_io_metrics::record_stage_duration("metacache_merge_failed", merge_started.elapsed().as_secs_f64() * 1000.0);
+        if is_missing_path_error(&err) {
+            debug!(
+                event = EVENT_METACACHE_LISTING,
+                component = LOG_COMPONENT_ECSTORE,
+                subsystem = LOG_SUBSYSTEM_METACACHE,
+                bucket = %log_bucket,
+                path = %log_path,
+                state = "merge_job_missing_path",
+                error = ?err,
+                "Metacache merge job missing path skipped"
+            );
+        } else {
+            error!(
+                event = EVENT_METACACHE_LISTING,
+                component = LOG_COMPONENT_ECSTORE,
+                subsystem = LOG_SUBSYSTEM_METACACHE,
+                bucket = %log_bucket,
+                path = %log_path,
+                state = "merge_job_failed",
+                error = ?err,
+                "Metacache merge job failed"
+            );
         }
-    };
+        cancel_rx.cancel();
+        jobs.abort_all();
+
+        return Err(err);
+    }
     if rx.is_cancelled() {
         cancel_rx.cancel();
         jobs.abort_all();
-        return Ok(outcome);
+        return Ok(());
     }
     rustfs_io_metrics::record_stage_duration("metacache_merge", merge_started.elapsed().as_secs_f64() * 1000.0);
 
@@ -1146,7 +1113,7 @@ async fn list_path_raw_inner(
     }
 
     // warn!("list_path_raw: done");
-    Ok(outcome)
+    Ok(())
 }
 
 #[inline]
@@ -1165,7 +1132,6 @@ mod tests {
     use rustfs_filemeta::MetacacheWriter;
     use rustfs_filemeta::{FileInfo, FileMeta, MetadataResolutionParams};
     use std::sync::Mutex;
-    use std::sync::atomic::AtomicBool;
     use time::OffsetDateTime;
     use uuid::Uuid;
 
@@ -1286,61 +1252,6 @@ mod tests {
         );
     }
 
-    #[tokio::test]
-    async fn list_path_raw_reports_limit_reached_from_any_reader_trailer() {
-        let first = fallback_test_entry();
-        let second = MetaCacheEntry {
-            name: "bucket/object-2".to_string(),
-            ..fallback_test_entry()
-        };
-        // One bounded producer, one that ends naturally, one legacy empty
-        // stream without any trailer.
-        let outcome = list_path_raw_inner(
-            CancellationToken::new(),
-            ListPathRawOptions {
-                disks: vec![None, None, None],
-                min_disks: 1,
-                test_reader_behaviors: vec![
-                    TestReaderBehavior::LimitReached(vec![first.clone()]),
-                    TestReaderBehavior::Entries(vec![first, second]),
-                    TestReaderBehavior::Eof,
-                ],
-                ..Default::default()
-            },
-            None,
-            None,
-        )
-        .await
-        .expect("listing should complete");
-
-        assert!(
-            outcome.limit_reached,
-            "a reader whose trailer reports a limit stop must mark the merged stream as possibly incomplete"
-        );
-    }
-
-    #[tokio::test]
-    async fn list_path_raw_reports_natural_end_when_no_reader_trailer_says_limit() {
-        let outcome = list_path_raw_inner(
-            CancellationToken::new(),
-            ListPathRawOptions {
-                disks: vec![None, None],
-                min_disks: 1,
-                test_reader_behaviors: vec![
-                    TestReaderBehavior::Entries(vec![fallback_test_entry()]),
-                    TestReaderBehavior::Eof,
-                ],
-                ..Default::default()
-            },
-            None,
-            None,
-        )
-        .await
-        .expect("listing should complete");
-
-        assert!(!outcome.limit_reached, "natural and legacy stream ends must not claim a limit stop");
-    }
-
     #[tokio::test]
     async fn list_path_raw_returns_typed_quorum_error_for_multiple_drive_failures() {
         let err = list_path_raw(

crates/ecstore/src/cluster/rpc/peer_rest_client.rs

@@ -631,17 +631,6 @@ fn decode_cross_pool_fence_capability(expected_member: &str, result: &[u8]) -> R
     Ok((version, epoch))
 }
 
-fn decode_mrf_lifecycle_reader_capability(expected_member: &str, result: &[u8]) -> Result<(u8, Uuid)> {
-    let (&maximum_format_version, identity) = result
-        .split_first()
-        .ok_or_else(|| Error::other("peer returned a truncated MRF lifecycle reader capability"))?;
-    if maximum_format_version == 0 || expected_member.trim().is_empty() {
-        return Err(Error::other("peer returned an invalid MRF lifecycle reader capability"));
-    }
-    let epoch = decode_remote_version_state_capability(expected_member, identity)?;
-    Ok((maximum_format_version, epoch))
-}
-
 #[derive(Clone, Debug)]
 pub struct PeerLiveEventsBatch {
     pub events: Vec<u8>,
@@ -1965,6 +1954,15 @@ impl PeerRestClient {
         Ok((self.topology_member.clone(), epoch))
     }
 
+    pub async fn probe_restore_copyback_capability(&self, topology_fingerprint: String) -> Result<(String, Uuid)> {
+        let probe = rustfs_protos::restore_copyback_capability_probe(Uuid::new_v4().as_bytes());
+        let result = self
+            .heal_control(rustfs_protos::HEAL_CONTROL_PROTOCOL_VERSION, topology_fingerprint, probe)
+            .await?;
+        let epoch = decode_remote_version_state_capability(&self.topology_member, &result)?;
+        Ok((self.topology_member.clone(), epoch))
+    }
+
     pub async fn probe_cross_pool_fence(&self, topology_fingerprint: String) -> Result<(String, u32, Uuid)> {
         let mut probe = rustfs_protos::CROSS_POOL_FENCE_CAPABILITY_PROBE_PREFIX.to_vec();
         probe.extend_from_slice(Uuid::new_v4().as_bytes());
@@ -1975,16 +1973,6 @@ impl PeerRestClient {
         Ok((self.topology_member.clone(), supported_version, epoch))
     }
 
-    /// Reports one peer's reader support without authorizing a lifecycle writer or rollback.
-    pub async fn probe_mrf_lifecycle_reader(&self, topology_fingerprint: String) -> Result<(String, u8, Uuid)> {
-        let probe = rustfs_protos::mrf_lifecycle_reader_capability_probe(Uuid::new_v4().as_bytes());
-        let result = self
-            .heal_control(rustfs_protos::HEAL_CONTROL_PROTOCOL_VERSION, topology_fingerprint, probe)
-            .await?;
-        let (maximum_format_version, epoch) = decode_mrf_lifecycle_reader_capability(&self.topology_member, &result)?;
-        Ok((self.topology_member.clone(), maximum_format_version, epoch))
-    }
-
     pub async fn probe_ilm_recovery_export(&self, topology_fingerprint: String) -> Result<(String, Uuid)> {
         let probe = rustfs_protos::ilm_recovery_export_capability_probe(Uuid::new_v4().as_bytes());
         let result = self
@@ -4354,49 +4342,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn mrf_lifecycle_reader_capability_decoder_preserves_the_advertised_version() {
-        let epoch = Uuid::new_v4();
-        for version in [1, 2, u8::MAX] {
-            let result = rustfs_protos::encode_mrf_lifecycle_reader_capability(version, "node-a:9000", epoch.as_bytes())
-                .expect("capability frame");
-            assert_eq!(
-                decode_mrf_lifecycle_reader_capability("node-a:9000", &result).expect("reported capability"),
-                (version, epoch)
-            );
-        }
-    }
-
-    #[test]
-    fn mrf_lifecycle_reader_capability_decoder_rejects_unbound_or_malformed_identity() {
-        let epoch = Uuid::new_v4();
-        let valid =
-            rustfs_protos::encode_mrf_lifecycle_reader_capability(2, "node-a:9000", epoch.as_bytes()).expect("capability frame");
-        let mut invalid = vec![Vec::new(), vec![2], valid[..valid.len() - 1].to_vec()];
-        let mut zero = valid.clone();
-        zero[0] = 0;
-        invalid.push(zero);
-        let mut trailing = valid.clone();
-        trailing.push(0);
-        invalid.push(trailing);
-        let mut length_overflow = valid.clone();
-        length_overflow[1..9].copy_from_slice(&u64::MAX.to_be_bytes());
-        invalid.push(length_overflow);
-        let mut invalid_utf8 = valid.clone();
-        invalid_utf8[9] = 0xff;
-        invalid.push(invalid_utf8);
-        invalid.push(
-            rustfs_protos::encode_mrf_lifecycle_reader_capability(2, "node-a:9000", Uuid::nil().as_bytes())
-                .expect("nil epoch fixture"),
-        );
-        for result in invalid {
-            assert!(decode_mrf_lifecycle_reader_capability("node-a:9000", &result).is_err());
-        }
-        assert!(decode_mrf_lifecycle_reader_capability("node-b:9000", &valid).is_err());
-        let empty = rustfs_protos::encode_mrf_lifecycle_reader_capability(2, "", epoch.as_bytes()).expect("empty member fixture");
-        assert!(decode_mrf_lifecycle_reader_capability("", &empty).is_err());
-    }
-
     #[test]
     fn remote_version_state_capability_decoder_fails_closed() {
         let epoch = Uuid::new_v4();

crates/ecstore/src/cluster/rpc/remote_disk.rs

@@ -2375,300 +2375,7 @@ fn validate_decoded_file_info(file_info: &FileInfo) -> Result<()> {
     file_info.validate_for_metadata_read().map_err(Into::into)
 }
 
-fn validate_artifact_repair_seal_response(
-    request: &rustfs_protos::proto_gen::node_service::SealArtifactAttemptPutsRequest,
-    response: &rustfs_protos::proto_gen::node_service::SealArtifactAttemptPutsResponse,
-) -> Result<()> {
-    let canonical = rustfs_protos::canonical_seal_artifact_attempt_repairs_response_body(request, response)
-        .map_err(|_| Error::other("artifact repair seal response is too large"))?;
-    crate::cluster::rpc::verify_tonic_rpc_response_proof(&canonical, &response.response_proof)
-        .map_err(|_| Error::other("artifact repair seal response proof is invalid"))?;
-    if !response.success {
-        return Err(response.error.clone().unwrap_or_default().into());
-    }
-    let expected_disk = Uuid::from_slice(&request.expected_disk_id).ok().filter(|id| !id.is_nil());
-    if response.error.is_some() || expected_disk.is_none() || Uuid::from_slice(&response.disk_id).ok() != expected_disk {
-        return Err(Error::other("artifact repair seal response disk identity mismatch"));
-    }
-    Ok(())
-}
-
 impl RemoteDisk {
-    pub(crate) async fn rename_artifact_repair_data(
-        &self,
-        expected_disk: Uuid,
-        source: (&str, &str),
-        fi: &FileInfo,
-        destination: (&str, &str),
-        expected_incarnation: Uuid,
-    ) -> Result<RenameDataResp> {
-        use rustfs_protos::proto_gen::node_service::ArtifactRepairRenameDataRequest;
-        self.execute_with_timeout_for_op(
-            "artifact_repair_rename_data",
-            || async {
-                let body = ArtifactRepairRenameDataRequest {
-                    rename: Some(RenameDataRequest {
-                        disk: self.endpoint.to_string(),
-                        src_volume: source.0.to_owned(),
-                        src_path: source.1.to_owned(),
-                        dst_volume: destination.0.to_owned(),
-                        dst_path: destination.1.to_owned(),
-                        file_info: compat_json(fi)?,
-                        file_info_bin: encode_file_info_msgpack(fi)?.into(),
-                        scanner_publication_lease_token: Bytes::new(),
-                        bucket_incarnation_id: expected_incarnation.as_bytes().to_vec().into(),
-                    }),
-                    expected_disk_id: expected_disk.as_bytes().to_vec().into(),
-                };
-                let canonical = rustfs_protos::canonical_artifact_repair_rename_data_request_body(&body)
-                    .map_err(|_| Error::other("artifact repair rename request is too large"))?;
-                let mut request = Request::new(body);
-                crate::cluster::rpc::set_tonic_canonical_body_digest(&mut request, &canonical).map_err(Error::other)?;
-                // Unimplemented is terminal: never downgrade repair publication to PUT or legacy RPCs.
-                let response = self
-                    .get_client()
-                    .await?
-                    .artifact_repair_rename_data(request)
-                    .await?
-                    .into_inner();
-                if !response.success {
-                    return Err(response.error.unwrap_or_default().into());
-                }
-                decode_msgpack_or_json::<RenameDataResp>(
-                    &response.rename_data_resp_bin,
-                    &response.rename_data_resp,
-                    "RenameDataResp",
-                )
-            },
-            get_max_timeout_duration(),
-        )
-        .await
-    }
-
-    pub(crate) async fn write_artifact_repair_metadata(
-        &self,
-        expected_disk: Uuid,
-        target: (&str, &str),
-        fi: &FileInfo,
-        expected_incarnation: Uuid,
-    ) -> Result<()> {
-        use rustfs_protos::proto_gen::node_service::ArtifactRepairWriteMetadataRequest;
-        self.execute_with_timeout_for_op(
-            "artifact_repair_write_metadata",
-            || async {
-                let body = ArtifactRepairWriteMetadataRequest {
-                    metadata: Some(WriteMetadataRequest {
-                        disk: self.endpoint.to_string(),
-                        volume: target.0.to_owned(),
-                        path: target.1.to_owned(),
-                        file_info: compat_json(fi)?,
-                        file_info_bin: encode_file_info_msgpack(fi)?.into(),
-                        bucket_incarnation_id: expected_incarnation.as_bytes().to_vec().into(),
-                    }),
-                    expected_disk_id: expected_disk.as_bytes().to_vec().into(),
-                };
-                let canonical = rustfs_protos::canonical_artifact_repair_write_metadata_request_body(&body)
-                    .map_err(|_| Error::other("artifact repair metadata request is too large"))?;
-                let mut request = Request::new(body);
-                crate::cluster::rpc::set_tonic_canonical_body_digest(&mut request, &canonical).map_err(Error::other)?;
-                let response = self
-                    .get_client()
-                    .await?
-                    .artifact_repair_write_metadata(request)
-                    .await?
-                    .into_inner();
-                if !response.success {
-                    return Err(response.error.unwrap_or_default().into());
-                }
-                Ok(())
-            },
-            get_max_timeout_duration(),
-        )
-        .await
-    }
-
-    /// One authenticated scan (or explicitly distinct read-only identity probe).
-    /// Partial observations are never retried after output has begun.
-    pub async fn inventory_artifact_attempt(
-        &self,
-        expected_disk: Uuid,
-        target: (&str, Uuid),
-        prefix: &str,
-        phase: rustfs_protos::proto_gen::node_service::ArtifactInventoryPhase,
-        deadline: tokio::time::Instant,
-        output: tokio::sync::mpsc::Sender<crate::disk::ArtifactInventoryFrame>,
-    ) -> Result<()> {
-        use crate::disk::{ArtifactInventoryFrame, ArtifactInventoryVersion};
-        use rustfs_protos::{
-            artifact_inventory as protocol,
-            proto_gen::node_service::{ArtifactInventoryRequest, artifact_inventory_frame::Payload},
-        };
-        let (bucket, incarnation) = target;
-        let duration = deadline
-            .checked_duration_since(tokio::time::Instant::now())
-            .ok_or(Error::Timeout)?;
-        let body = ArtifactInventoryRequest {
-            protocol_version: protocol::VERSION,
-            invocation_id: Uuid::new_v4().as_bytes().to_vec().into(),
-            disk: self.endpoint.to_string(),
-            expected_disk_id: expected_disk.as_bytes().to_vec().into(),
-            bucket: bucket.to_owned(),
-            bucket_incarnation_id: incarnation.as_bytes().to_vec().into(),
-            attempt_prefix: prefix.to_owned(),
-            timeout_millis: u64::try_from(duration.as_millis().min(u128::from(protocol::MAX_TIMEOUT_MILLIS)))
-                .map_err(Error::other)?,
-            phase: phase.into(),
-        };
-        protocol::validate_request(&body).map_err(Error::other)?;
-        tokio::time::timeout_at(deadline, async {
-            let canonical = protocol::canonical_request(&body).map_err(Error::other)?;
-            let mut request = Request::new(body.clone());
-            request.set_timeout(duration);
-            crate::cluster::rpc::set_tonic_canonical_body_digest(&mut request, &canonical).map_err(Error::other)?;
-            let mut stream = self
-                .get_client()
-                .await?
-                .max_decoding_message_size(protocol::MAX_FRAME_BYTES)
-                .inventory_artifact_attempt(request)
-                .await?
-                .into_inner();
-            let mut state = protocol::StreamState::new();
-            let mut terminal = None;
-            while let Some(frame) = stream.message().await? {
-                state
-                    .accept(&body, &frame, |canonical, proof| {
-                        crate::cluster::rpc::verify_tonic_rpc_response_proof(canonical, proof).is_ok()
-                    })
-                    .map_err(Error::other)?;
-                match frame.payload {
-                    Some(Payload::Entries(entries)) => {
-                        let versions = entries
-                            .versions
-                            .into_iter()
-                            .map(|entry| {
-                                Ok(ArtifactInventoryVersion {
-                                    key: entry.key,
-                                    version_id: Uuid::from_slice(&entry.version_id).map_err(Error::other)?,
-                                    delete_marker: entry.delete_marker,
-                                })
-                            })
-                            .collect::<Result<Vec<_>>>()?;
-                        output
-                            .send(ArtifactInventoryFrame::Entries {
-                                sequence: frame.sequence,
-                                versions,
-                            })
-                            .await
-                            .map_err(|_| Error::other("artifact inventory consumer closed"))?;
-                    }
-                    Some(Payload::Complete(complete)) => terminal = Some(complete.entries),
-                    Some(Payload::Verified(_)) => {}
-                    None => return Err(Error::other("artifact inventory payload is absent")),
-                }
-            }
-            // A valid Complete followed by a transport failure or extra frame is
-            // still incomplete. Publish the local terminal only after clean EOF.
-            state.finish().map_err(Error::other)?;
-            if let Some(entries) = terminal {
-                output
-                    .send(ArtifactInventoryFrame::Complete {
-                        disk_id: expected_disk,
-                        incarnation,
-                        attempt_prefix: prefix.to_owned(),
-                        entries,
-                    })
-                    .await
-                    .map_err(|_| Error::other("artifact inventory consumer closed"))?;
-            }
-            Ok(())
-        })
-        .await
-        .map_err(|_| Error::Timeout)?
-    }
-
-    pub(crate) async fn seal_artifact_puts(
-        &self,
-        expected_disk: Uuid,
-        bucket: &str,
-        incarnation: Uuid,
-        attempt_prefix: &str,
-    ) -> Result<()> {
-        use rustfs_protos::proto_gen::node_service::SealArtifactAttemptPutsRequest;
-        self.execute_with_timeout_for_op(
-            "seal_artifact_puts",
-            || async {
-                let body = SealArtifactAttemptPutsRequest {
-                    disk: self.endpoint.to_string(),
-                    bucket: bucket.to_owned(),
-                    bucket_incarnation_id: incarnation.as_bytes().to_vec().into(),
-                    attempt_prefix: attempt_prefix.to_owned(),
-                    expected_disk_id: expected_disk.as_bytes().to_vec().into(),
-                };
-                let canonical = rustfs_protos::canonical_seal_artifact_attempt_puts_request_body(&body)
-                    .map_err(|_| Error::other("artifact seal request is too large"))?;
-                let mut request = Request::new(body.clone());
-                crate::cluster::rpc::set_tonic_canonical_body_digest(&mut request, &canonical).map_err(Error::other)?;
-                let response = self
-                    .get_client()
-                    .await?
-                    .seal_artifact_attempt_puts(request)
-                    .await?
-                    .into_inner();
-                let canonical = rustfs_protos::canonical_seal_artifact_attempt_puts_response_body(&body, &response)
-                    .map_err(|_| Error::other("artifact seal response is too large"))?;
-                crate::cluster::rpc::verify_tonic_rpc_response_proof(&canonical, &response.response_proof)
-                    .map_err(|_| Error::other("artifact seal response proof is invalid"))?;
-                if !response.success {
-                    return Err(response.error.unwrap_or_default().into());
-                }
-                if response.error.is_some() || Uuid::from_slice(&response.disk_id).ok() != Some(expected_disk) {
-                    return Err(Error::other("artifact seal response disk identity mismatch"));
-                }
-                Ok(())
-            },
-            get_max_timeout_duration(),
-        )
-        .await
-    }
-
-    pub(crate) async fn seal_artifact_repairs(
-        &self,
-        expected_disk: Uuid,
-        bucket: &str,
-        incarnation: Uuid,
-        attempt_prefix: &str,
-    ) -> Result<()> {
-        use rustfs_protos::proto_gen::node_service::SealArtifactAttemptPutsRequest;
-        if expected_disk.is_nil() || incarnation.is_nil() {
-            return Err(Error::other("artifact repair seal requires non-nil disk and incarnation identities"));
-        }
-        self.execute_with_timeout_for_op(
-            "seal_artifact_repairs",
-            || async {
-                let body = SealArtifactAttemptPutsRequest {
-                    disk: self.endpoint.to_string(),
-                    bucket: bucket.to_owned(),
-                    bucket_incarnation_id: incarnation.as_bytes().to_vec().into(),
-                    attempt_prefix: attempt_prefix.to_owned(),
-                    expected_disk_id: expected_disk.as_bytes().to_vec().into(),
-                };
-                let canonical = rustfs_protos::canonical_seal_artifact_attempt_repairs_request_body(&body)
-                    .map_err(|_| Error::other("artifact repair seal request is too large"))?;
-                let mut request = Request::new(body.clone());
-                crate::cluster::rpc::set_tonic_canonical_body_digest(&mut request, &canonical).map_err(Error::other)?;
-                let response = self
-                    .get_client()
-                    .await?
-                    .seal_artifact_attempt_repairs(request)
-                    .await?
-                    .into_inner();
-                validate_artifact_repair_seal_response(&body, &response)
-            },
-            get_max_timeout_duration(),
-        )
-        .await
-    }
-
     #[tracing::instrument(level = "trace", skip_all)]
     pub(crate) async fn rename_data_borrowed(
         &self,
@@ -2678,39 +2385,20 @@ impl RemoteDisk {
         dst_volume: &str,
         dst_path: &str,
     ) -> Result<RenameDataResp> {
-        self.rename_data_borrowed_with_fence((src_volume, src_path), fi, (dst_volume, dst_path), None, None)
+        self.rename_data_borrowed_with_fence(src_volume, src_path, fi, dst_volume, dst_path, None)
             .await
     }
 
     #[tracing::instrument(level = "trace", skip_all)]
     pub(crate) async fn rename_data_borrowed_with_fence(
         &self,
-        source: (&str, &str),
+        src_volume: &str,
+        src_path: &str,
         fi: &FileInfo,
-        target: (&str, &str),
+        dst_volume: &str,
+        dst_path: &str,
         scanner_publication_lease_token: Option<Uuid>,
-        artifact_incarnation: Option<Uuid>,
     ) -> Result<RenameDataResp> {
-        let (src_volume, src_path) = source;
-        let (dst_volume, dst_path) = target;
-        if let Some(scope) = crate::bucket::artifact::artifact_repair_scope(dst_volume, dst_path)
-            && let Some(identity) = scope.receiver_identity()
-        {
-            scope.check().map_err(Error::other)?;
-            if artifact_incarnation.is_some() || scanner_publication_lease_token.is_some() {
-                return Err(Error::other("artifact repair cannot use a publication lease"));
-            }
-            let expected = self
-                .get_disk_id()
-                .await?
-                .filter(|id| !id.is_nil())
-                .ok_or_else(|| Error::other("artifact repair disk identity is unavailable"))?;
-            let result = self
-                .rename_artifact_repair_data(expected, (src_volume, src_path), fi, (dst_volume, dst_path), identity.incarnation)
-                .await;
-            scope.check().map_err(Error::other)?;
-            return result;
-        }
         trace!(
             event = EVENT_REMOTE_DISK_RPC,
             component = LOG_COMPONENT_ECSTORE,
@@ -2733,11 +2421,8 @@ impl RemoteDisk {
                 let file_info_bin = encode_file_info_msgpack(fi)?;
                 let mut client = self.get_client().await?;
                 let mut request = Request::new(RenameDataRequest {
-                    bucket_incarnation_id: artifact_incarnation
-                        .or_else(|| {
-                            crate::store::bucket_heal_scope_for_object(dst_volume, dst_path).map(|scope| scope.incarnation)
-                        })
-                        .map(|incarnation| incarnation.as_bytes().to_vec().into())
+                    bucket_incarnation_id: crate::store::bucket_heal_scope_for_object(dst_volume, dst_path)
+                        .map(|scope| scope.incarnation.as_bytes().to_vec().into())
                         .unwrap_or_default(),
                     disk: self.endpoint.to_string(),
                     src_volume: src_volume.to_string(),
@@ -2750,11 +2435,7 @@ impl RemoteDisk {
                         .map(|token| token.as_bytes().to_vec().into())
                         .unwrap_or_default(),
                 });
-                let canonical_body = if artifact_incarnation.is_some() {
-                    rustfs_protos::canonical_artifact_rename_data_request_body(request.get_ref())
-                } else {
-                    rustfs_protos::canonical_rename_data_request_body(request.get_ref())
-                };
+                let canonical_body = rustfs_protos::canonical_rename_data_request_body(request.get_ref());
                 let incarnation_bound = !request.get_ref().bucket_incarnation_id.is_empty();
                 let quota_fenced = rustfs_utils::http::metadata_compat::contains_key_str(
                     &fi.metadata,
@@ -2777,9 +2458,7 @@ impl RemoteDisk {
                 let rpc_started = rustfs_io_metrics::put_stage_timer();
                 let response = rustfs_io_metrics::observe_put_stage_future(
                     async {
-                        if artifact_incarnation.is_some() {
-                            client.artifact_rename_data(request).await
-                        } else if quota_fenced {
+                        if quota_fenced {
                             // The method itself proves quota-token enforcement; an old peer must fail closed.
                             client.rename_data_with_quota_fence(request).await
                         } else if incarnation_bound {
@@ -3525,21 +3204,6 @@ impl DiskAPI for RemoteDisk {
 
     #[tracing::instrument(level = "trace", skip_all)]
     async fn write_metadata(&self, _org_volume: &str, volume: &str, path: &str, fi: FileInfo) -> Result<()> {
-        if let Some(scope) = crate::bucket::artifact::artifact_repair_scope(volume, path)
-            && let Some(identity) = scope.receiver_identity()
-        {
-            scope.check().map_err(Error::other)?;
-            let expected = self
-                .get_disk_id()
-                .await?
-                .filter(|id| !id.is_nil())
-                .ok_or_else(|| Error::other("artifact repair disk identity is unavailable"))?;
-            let result = self
-                .write_artifact_repair_metadata(expected, (volume, path), &fi, identity.incarnation)
-                .await;
-            scope.check().map_err(Error::other)?;
-            return result;
-        }
         trace!(
             event = EVENT_REMOTE_DISK_RPC,
             component = LOG_COMPONENT_ECSTORE,
@@ -4889,83 +4553,6 @@ mod tests {
 
     static INIT: Once = Once::new();
 
-    #[tokio::test]
-    async fn artifact_repair_old_peer_unimplemented_never_downgrades_mutations() {
-        runtime_sources::ensure_test_rpc_secret();
-        let peer = TestGrpcPeer::spawn(Bytes::new(), Bytes::new())
-            .await
-            .expect("loopback test peer");
-        let endpoint = Endpoint {
-            url: url::Url::parse(&format!("{}/data/rustfs0", peer.addr)).expect("test disk endpoint"),
-            is_local: false,
-            pool_idx: 0,
-            set_idx: 0,
-            disk_idx: 0,
-        };
-        let disk = RemoteDisk::new(
-            &endpoint,
-            &DiskOption {
-                cleanup: false,
-                health_check: false,
-            },
-            Arc::new(TcpHttpInternodeDataTransport),
-        )
-        .await
-        .expect("remote test disk");
-        let expected_disk = Uuid::new_v4();
-        let incarnation = Uuid::new_v4();
-        let info = FileInfo::default();
-        let rename = disk
-            .rename_artifact_repair_data(
-                expected_disk,
-                ("tmp", "staged"),
-                &info,
-                ("artifacts", "outputs/tenant/run/attempt/image"),
-                incarnation,
-            )
-            .await
-            .expect_err("old peer cannot publish repair data");
-        let metadata = disk
-            .write_artifact_repair_metadata(expected_disk, ("artifacts", "outputs/tenant/run/attempt/image"), &info, incarnation)
-            .await
-            .expect_err("old peer cannot publish repair metadata");
-        let seal = disk
-            .seal_artifact_repairs(expected_disk, "artifacts", incarnation, "outputs/tenant/run/attempt")
-            .await
-            .expect_err("old peer cannot confirm repair closure");
-        for error in [rename, metadata, seal] {
-            let DiskError::Io(error) = error else {
-                panic!("expected gRPC status error");
-            };
-            let status = error
-                .get_ref()
-                .and_then(|error| error.downcast_ref::<crate::disk::error::RpcStatusError>())
-                .expect("preserved gRPC status");
-            assert_eq!(status.status().code(), Code::Unimplemented);
-        }
-        let paths = peer.peer.rpc_paths.lock().expect("RPC inventory").clone();
-        for method in [
-            "ArtifactRepairRenameData",
-            "ArtifactRepairWriteMetadata",
-            "SealArtifactAttemptRepairs",
-        ] {
-            assert_eq!(
-                paths.iter().filter(|path| path.ends_with(&format!("/{method}"))).count(),
-                1,
-                "each repair method is sent once"
-            );
-        }
-        assert!(
-            paths.iter().all(|path| matches!(
-                path.rsplit('/').next(),
-                Some("ArtifactRepairRenameData" | "ArtifactRepairWriteMetadata" | "SealArtifactAttemptRepairs" | "Ping")
-            )),
-            "repair cannot downgrade to a legacy mutation: {paths:?}"
-        );
-        disk.cancel_token.cancel();
-        peer.stop().await;
-    }
-
     #[tokio::test]
     async fn quota_fence_old_peer_rejects_without_legacy_fallback() {
         runtime_sources::ensure_test_rpc_secret();
@@ -5061,93 +4648,6 @@ mod tests {
         peer.stop().await;
     }
 
-    #[test]
-    fn artifact_repair_seal_response_requires_proof_full_request_and_physical_identity() {
-        use rustfs_protos::proto_gen::node_service::{
-            Error as WireError, SealArtifactAttemptPutsRequest, SealArtifactAttemptPutsResponse,
-        };
-        runtime_sources::ensure_test_rpc_secret();
-        let request = SealArtifactAttemptPutsRequest {
-            disk: "disk-a".into(),
-            bucket: "artifacts".into(),
-            bucket_incarnation_id: vec![1; 16].into(),
-            attempt_prefix: "outputs/tenant/run/attempt".into(),
-            expected_disk_id: vec![2; 16].into(),
-        };
-        let mut response = SealArtifactAttemptPutsResponse {
-            success: true,
-            disk_id: request.expected_disk_id.clone(),
-            ..Default::default()
-        };
-        let sign = |request: &SealArtifactAttemptPutsRequest, response: &mut SealArtifactAttemptPutsResponse| {
-            let canonical = rustfs_protos::canonical_seal_artifact_attempt_repairs_response_body(request, response)
-                .expect("repair response canonical");
-            response.response_proof = crate::cluster::rpc::http_auth::sign_tonic_rpc_response_proof(&canonical)
-                .expect("repair response proof")
-                .into();
-        };
-        assert!(validate_artifact_repair_seal_response(&request, &response).is_err(), "proof is mandatory");
-        sign(&request, &mut response);
-        validate_artifact_repair_seal_response(&request, &response).expect("signed exact physical receiver");
-        for mutate in [
-            |r: &mut SealArtifactAttemptPutsRequest| r.disk = "other-disk".into(),
-            |r: &mut SealArtifactAttemptPutsRequest| r.bucket = "other-bucket".into(),
-            |r: &mut SealArtifactAttemptPutsRequest| r.bucket_incarnation_id = vec![3; 16].into(),
-            |r: &mut SealArtifactAttemptPutsRequest| r.attempt_prefix = "other-attempt".into(),
-            |r: &mut SealArtifactAttemptPutsRequest| r.expected_disk_id = vec![4; 16].into(),
-        ] {
-            let mut changed = request.clone();
-            mutate(&mut changed);
-            assert!(
-                validate_artifact_repair_seal_response(&changed, &response).is_err(),
-                "another request cannot reuse the proof"
-            );
-        }
-        let legacy = rustfs_protos::canonical_seal_artifact_attempt_puts_response_body(&request, &response).expect("PUT domain");
-        let mut legacy_response = response.clone();
-        legacy_response.response_proof = crate::cluster::rpc::http_auth::sign_tonic_rpc_response_proof(&legacy)
-            .expect("PUT proof")
-            .into();
-        assert!(
-            validate_artifact_repair_seal_response(&request, &legacy_response).is_err(),
-            "PUT proof cannot acknowledge repair seal"
-        );
-        for disk in [vec![], vec![0; 16], vec![3; 16], vec![1; 15]] {
-            let mut changed = response.clone();
-            changed.disk_id = disk.into();
-            sign(&request, &mut changed);
-            assert!(
-                validate_artifact_repair_seal_response(&request, &changed).is_err(),
-                "signed wrong or absent physical identity is invalid"
-            );
-        }
-        for mutate in [
-            |r: &mut SealArtifactAttemptPutsResponse| r.success = false,
-            |r: &mut SealArtifactAttemptPutsResponse| r.error = Some(WireError::default()),
-        ] {
-            let mut changed = response.clone();
-            mutate(&mut changed);
-            assert!(
-                validate_artifact_repair_seal_response(&request, &changed).is_err(),
-                "response fields are bound"
-            );
-            sign(&request, &mut changed);
-            assert!(
-                validate_artifact_repair_seal_response(&request, &changed).is_err(),
-                "signed failure or inconsistent success is invalid"
-            );
-        }
-        let mut nil_request = request;
-        nil_request.expected_disk_id = vec![0; 16].into();
-        let mut nil_response = response;
-        nil_response.disk_id = nil_request.expected_disk_id.clone();
-        sign(&nil_request, &mut nil_response);
-        assert!(
-            validate_artifact_repair_seal_response(&nil_request, &nil_response).is_err(),
-            "nil physical identity is never a receipt"
-        );
-    }
-
     #[test]
     fn recoverable_batch_delete_rejects_invalid_error_codes_and_length() {
         let errors = decode_delete_recovery_batch_errors(vec![None, Some(DiskError::FileNotFound.to_u32())], 2)
@@ -5538,7 +5038,6 @@ mod tests {
         format_data: Bytes,
         read_all_data: Bytes,
         next_format_read_gate: Arc<StdMutex<Option<Arc<TestFormatReadGate>>>>,
-        rpc_paths: Arc<StdMutex<Vec<String>>>,
         unsupported_methods: Arc<StdMutex<Vec<String>>>,
     }
 
@@ -5558,7 +5057,6 @@ mod tests {
                 format_data,
                 read_all_data,
                 next_format_read_gate: Arc::default(),
-                rpc_paths: Arc::default(),
                 unsupported_methods: Arc::default(),
             }
         }
@@ -5614,11 +5112,6 @@ mod tests {
         }
 
         fn call(&mut self, request: http::Request<B>) -> Self::Future {
-            self.peer
-                .rpc_paths
-                .lock()
-                .expect("RPC path inventory")
-                .push(request.uri().path().to_owned());
             match request.uri().path() {
                 "/node_service.NodeService/DiskInfo" => {
                     #[derive(Clone)]

crates/ecstore/src/config/com.rs

@@ -438,64 +438,6 @@ where
     Ok(data)
 }
 
-pub(crate) async fn read_config_observation<S>(api: Arc<S>, file: &str, max_bytes: usize) -> Result<(Vec<u8>, ObjectInfo)>
-where
-    S: EcstoreObjectIO,
-{
-    let opts = ObjectOptions {
-        suppress_read_repair: true,
-        no_lock: false,
-        skip_verify_bitrot: false,
-        ..Default::default()
-    };
-    crate::object_api::without_get_object_body_cache_hook(read_config_limited_preserve_empty_with_metadata_opts(
-        api, file, &opts, max_bytes,
-    ))
-    .await
-}
-
-pub(crate) async fn read_config_observation_no_lock<S>(
-    api: Arc<S>,
-    file: &str,
-    max_bytes: usize,
-    guard: &crate::object_api::WriteCommitGuard,
-) -> Result<(Vec<u8>, ObjectInfo)>
-where
-    S: EcstoreObjectIO,
-{
-    if !guard.matches(RUSTFS_META_BUCKET, file) {
-        return Err(Error::InvalidArgument(
-            RUSTFS_META_BUCKET.to_owned(),
-            file.to_owned(),
-            "locked observation requires a matching write owner".to_owned(),
-        ));
-    }
-    let lock_lost_error = || Error::NamespaceLockQuorumUnavailable {
-        mode: "locked_config_observation",
-        bucket: RUSTFS_META_BUCKET.to_owned(),
-        object: file.to_owned(),
-        required: 1,
-        achieved: 0,
-    };
-    if guard.is_lock_lost() {
-        return Err(lock_lost_error());
-    }
-    let opts = ObjectOptions {
-        suppress_read_repair: true,
-        no_lock: true,
-        skip_verify_bitrot: false,
-        ..Default::default()
-    };
-    let result = crate::object_api::without_get_object_body_cache_hook(read_config_limited_preserve_empty_with_metadata_opts(
-        api, file, &opts, max_bytes,
-    ))
-    .await;
-    if guard.is_lock_lost() {
-        return Err(lock_lost_error());
-    }
-    result
-}
-
 pub(crate) async fn read_config_limited_preserve_empty<S>(api: Arc<S>, file: &str, max_bytes: usize) -> Result<Vec<u8>>
 where
     S: EcstoreObjectIO,
@@ -542,22 +484,10 @@ pub(crate) async fn read_config_preserve_empty<S>(api: Arc<S>, file: &str) -> Re
 where
     S: EcstoreObjectIO,
 {
-    let (data, _obj) = read_config_preserve_empty_with_metadata_opts(api, file, &ObjectOptions::default()).await?;
+    let (data, _obj) = read_config_with_metadata_inner(api, file, &ObjectOptions::default(), true, None).await?;
     Ok(data)
 }
 
-/// Preserve an empty config payload, its metadata, and caller-supplied read options.
-pub(crate) async fn read_config_preserve_empty_with_metadata_opts<S>(
-    api: Arc<S>,
-    file: &str,
-    opts: &ObjectOptions,
-) -> Result<(Vec<u8>, ObjectInfo)>
-where
-    S: EcstoreObjectIO,
-{
-    read_config_with_metadata_inner(api, file, opts, true, None).await
-}
-
 pub async fn read_config_no_lock<S>(api: Arc<S>, file: &str) -> Result<Vec<u8>>
 where
     S: ObjectIO<
@@ -586,13 +516,15 @@ pub(crate) async fn read_config_no_lock_preserve_empty_with_metadata<S>(api: Arc
 where
     S: EcstoreObjectIO,
 {
-    read_config_preserve_empty_with_metadata_opts(
+    read_config_with_metadata_inner(
         api,
         file,
         &ObjectOptions {
             no_lock: true,
             ..Default::default()
         },
+        true,
+        None,
     )
     .await
 }
@@ -2987,9 +2919,9 @@ mod tests {
         config_task_join_error, configs_semantically_equal, decode_server_config_blob, encode_server_config_blob,
         heal_config_descriptor, is_standard_object_server_config, lookup_configs, map_system_metadata_write_error,
         new_and_save_server_config, read_config, read_config_no_lock_preserve_empty_with_metadata, read_config_preserve_empty,
-        read_config_preserve_empty_with_metadata_opts, read_config_with_metadata, read_config_without_migrate,
-        read_server_config_snapshot, save_config_with_opts_inner, save_server_config, save_server_config_snapshot,
-        save_server_config_snapshot_with_generation, server_config_transaction_lock_path, storage_class_kvs_mut,
+        read_config_with_metadata, read_config_without_migrate, read_server_config_snapshot, save_config_with_opts_inner,
+        save_server_config, save_server_config_snapshot, save_server_config_snapshot_with_generation,
+        server_config_transaction_lock_path, storage_class_kvs_mut,
     };
     use crate::config::{audit, heal, notify, oidc, scanner};
     use crate::disk::{RUSTFS_META_BUCKET, endpoint::Endpoint};
@@ -5464,7 +5396,6 @@ mod tests {
         heal_replacement: Option<Vec<u8>>,
         heal_calls: AtomicUsize,
         write_calls: AtomicUsize,
-        last_get_no_lock: AtomicBool,
         last_put_no_lock: AtomicBool,
         last_put_preconditions: Mutex<Option<HTTPPreconditions>>,
         revision: AtomicUsize,
@@ -5480,7 +5411,6 @@ mod tests {
                 heal_replacement,
                 heal_calls: AtomicUsize::new(0),
                 write_calls: AtomicUsize::new(0),
-                last_get_no_lock: AtomicBool::new(false),
                 last_put_no_lock: AtomicBool::new(false),
                 last_put_preconditions: Mutex::new(None),
                 revision: AtomicUsize::new(1),
@@ -5536,9 +5466,8 @@ mod tests {
             _object: &str,
             _range: Option<HTTPRangeSpec>,
             _h: HeaderMap,
-            opts: &ObjectOptions,
+            _opts: &ObjectOptions,
         ) -> Result<GetObjectReader> {
-            self.last_get_no_lock.store(opts.no_lock, Ordering::SeqCst);
             let data = match &*self.state.lock().expect("state lock poisoned") {
                 RecoveryReadState::Missing => return Err(Error::ConfigNotFound),
                 RecoveryReadState::Blob(data) => data.clone(),
@@ -5850,325 +5779,6 @@ mod tests {
         assert_eq!(store.write_calls.load(Ordering::SeqCst), 0);
     }
 
-    type ObservationEofGate = (Option<tokio::sync::oneshot::Sender<()>>, tokio::sync::oneshot::Receiver<()>);
-
-    struct ObservationStream {
-        inner: Cursor<Vec<u8>>,
-        consumed: Arc<AtomicUsize>,
-        fail: bool,
-        eof_gate: Option<ObservationEofGate>,
-    }
-
-    impl AsyncRead for ObservationStream {
-        fn poll_read(mut self: Pin<&mut Self>, cx: &mut Context<'_>, buf: &mut ReadBuf<'_>) -> Poll<std::io::Result<()>> {
-            if self.fail {
-                return Poll::Ready(Err(std::io::Error::other("observation stream failed")));
-            }
-            if self.inner.position() == u64::try_from(self.inner.get_ref().len()).expect("fixture length")
-                && let Some((ready, release)) = self.eof_gate.as_mut()
-            {
-                if let Some(ready) = ready.take() {
-                    ready.send(()).expect("EOF observer remains active");
-                }
-                match std::future::Future::poll(Pin::new(release), cx) {
-                    Poll::Pending => return Poll::Pending,
-                    Poll::Ready(result) => result.expect("EOF gate released"),
-                }
-                self.eof_gate = None;
-            }
-            let before = buf.filled().len();
-            let result = Pin::new(&mut self.inner).poll_read(cx, buf);
-            self.consumed.fetch_add(buf.filled().len() - before, Ordering::SeqCst);
-            result
-        }
-    }
-
-    struct ObservationStore {
-        body: Vec<u8>,
-        declared_size: i64,
-        error: Option<Error>,
-        stream_error: bool,
-        gets: AtomicUsize,
-        eof_gate: std::sync::Mutex<Option<ObservationEofGate>>,
-        consumed: Arc<AtomicUsize>,
-        options: std::sync::Mutex<Option<(bool, bool, bool)>>,
-        writes: AtomicUsize,
-    }
-
-    impl Debug for ObservationStore {
-        fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-            f.debug_struct("ObservationStore").finish()
-        }
-    }
-
-    impl ObservationStore {
-        fn new(body: Vec<u8>, declared_size: i64) -> Self {
-            Self {
-                body,
-                declared_size,
-                error: None,
-                stream_error: false,
-                gets: AtomicUsize::new(0),
-                eof_gate: std::sync::Mutex::new(None),
-                consumed: Arc::new(AtomicUsize::new(0)),
-                options: std::sync::Mutex::new(None),
-                writes: AtomicUsize::new(0),
-            }
-        }
-    }
-
-    #[async_trait::async_trait]
-    impl crate::storage_api_contracts::object::ObjectIO for ObservationStore {
-        type Error = Error;
-        type RangeSpec = HTTPRangeSpec;
-        type HeaderMap = HeaderMap;
-        type ObjectOptions = ObjectOptions;
-        type ObjectInfo = ObjectInfo;
-        type GetObjectReader = GetObjectReader;
-        type PutObjectReader = PutObjReader;
-
-        async fn get_object_reader(
-            &self,
-            bucket: &str,
-            object: &str,
-            range: Option<HTTPRangeSpec>,
-            _headers: HeaderMap,
-            opts: &ObjectOptions,
-        ) -> Result<GetObjectReader> {
-            assert_eq!(bucket, RUSTFS_META_BUCKET);
-            assert_eq!(object, "config/observation.bin");
-            self.gets.fetch_add(1, Ordering::SeqCst);
-            assert!(range.is_none());
-            *self.options.lock().expect("observation options") =
-                Some((opts.suppress_read_repair, opts.no_lock, opts.skip_verify_bitrot));
-            if let Some(error) = &self.error {
-                return Err(error.clone());
-            }
-            Ok(GetObjectReader {
-                stream: Box::new(ObservationStream {
-                    inner: Cursor::new(self.body.clone()),
-                    consumed: self.consumed.clone(),
-                    fail: self.stream_error,
-                    eof_gate: self.eof_gate.lock().expect("EOF gate").take(),
-                }),
-                object_info: ObjectInfo {
-                    size: self.declared_size,
-                    etag: Some("observation-etag".to_string()),
-                    ..Default::default()
-                },
-                buffered_body: None,
-                body_source: Default::default(),
-            })
-        }
-
-        async fn put_object(
-            &self,
-            _bucket: &str,
-            _object: &str,
-            _data: &mut PutObjReader,
-            _opts: &ObjectOptions,
-        ) -> Result<ObjectInfo> {
-            self.writes.fetch_add(1, Ordering::SeqCst);
-            Err(Error::other("observation must not write"))
-        }
-    }
-
-    #[tokio::test]
-    async fn locked_observation_preserves_options_and_typed_errors() {
-        let object = "config/observation.bin";
-        let manager = Arc::new(rustfs_lock::GlobalLockManager::new());
-        let wrapper = rustfs_lock::NamespaceLockWrapper::new(
-            rustfs_lock::NamespaceLock::with_local_manager("locked-observation-options".to_owned(), manager.clone()),
-            rustfs_lock::ObjectKey::new(RUSTFS_META_BUCKET, object),
-            "locked-observation-options".to_owned(),
-        );
-        let guard = crate::object_api::WriteCommitGuard::acquire(&wrapper, std::time::Duration::from_secs(5))
-            .await
-            .expect("matching real owner");
-        let store = Arc::new(ObservationStore::new(b"raw".to_vec(), 3));
-        let result = super::read_config_observation_no_lock(store.clone(), object, 3, &guard).await;
-        assert!(result.is_ok(), "I06L_READ_FLAGS: {result:?}");
-        assert!(*store.options.lock().expect("options") == Some((true, true, false)), "I06L_READ_FLAGS");
-        assert_eq!(result.expect("raw observation").0, b"raw");
-        assert_eq!(store.writes.load(Ordering::SeqCst), 0);
-        for (bucket, key) in [(RUSTFS_META_BUCKET, "config/other.bin"), ("wrong-bucket", object)] {
-            let wrapper = rustfs_lock::NamespaceLockWrapper::new(
-                rustfs_lock::NamespaceLock::with_local_manager("locked-observation-target".to_owned(), manager.clone()),
-                rustfs_lock::ObjectKey::new(bucket, key),
-                "locked-observation-target".to_owned(),
-            );
-            let wrong = crate::object_api::WriteCommitGuard::acquire(&wrapper, std::time::Duration::from_secs(5))
-                .await
-                .expect("wrong-target real owner");
-            let store = Arc::new(ObservationStore::new(Vec::new(), 0));
-            let result = super::read_config_observation_no_lock(store.clone(), object, 8, &wrong).await;
-            assert!(matches!(result, Err(Error::InvalidArgument(..))), "I06L_TARGET_REJECTED");
-            assert!(store.gets.load(Ordering::SeqCst) == 0, "I06L_TARGET_REJECTED");
-        }
-        for error in [
-            Error::FileNotFound,
-            Error::ObjectNotFound(RUSTFS_META_BUCKET.to_owned(), object.to_owned()),
-            Error::ErasureReadQuorum,
-        ] {
-            let expected = if error == Error::FileNotFound || matches!(error, Error::ObjectNotFound(..)) {
-                Error::ConfigNotFound
-            } else {
-                error.clone()
-            };
-            let mut fixture = ObservationStore::new(Vec::new(), 0);
-            fixture.error = Some(error);
-            let store = Arc::new(fixture);
-            assert_eq!(
-                super::read_config_observation_no_lock(store.clone(), object, 8, &guard)
-                    .await
-                    .expect_err("typed error"),
-                expected
-            );
-            assert_eq!(store.writes.load(Ordering::SeqCst), 0);
-        }
-        let mut fixture = ObservationStore::new(Vec::new(), 0);
-        fixture.stream_error = true;
-        let store = Arc::new(fixture);
-        let err = super::read_config_observation_no_lock(store.clone(), object, 8, &guard)
-            .await
-            .expect_err("stream failure");
-        assert!(err.to_string().contains("observation stream failed"), "I06L_TYPED_STREAM_ERROR");
-        assert_eq!(store.writes.load(Ordering::SeqCst), 0);
-        let store = Arc::new(ObservationStore::new(vec![7; 64], 0));
-        let result = super::read_config_observation_no_lock(store.clone(), object, 8, &guard).await;
-        assert!(matches!(result, Err(Error::CorruptedFormat)), "I06L_STREAM_BOUND");
-        assert!(store.consumed.load(Ordering::SeqCst) == 9, "I06L_STREAM_BOUND");
-        assert_eq!(store.writes.load(Ordering::SeqCst), 0);
-    }
-
-    #[tokio::test]
-    async fn locked_observation_rejects_actual_owner_loss_before_and_after_read() {
-        let object = "config/observation.bin";
-        for after_read in [false, true] {
-            let manager = Arc::new(rustfs_lock::GlobalLockManager::new());
-            let client = Arc::new(RefreshControlledClient::new(manager));
-            let wrapper = rustfs_lock::NamespaceLockWrapper::new(
-                rustfs_lock::NamespaceLock::new("locked-observation-loss".to_owned(), client.clone()),
-                rustfs_lock::ObjectKey::new(RUSTFS_META_BUCKET, object),
-                "locked-observation-loss".to_owned(),
-            );
-            let guard = crate::object_api::WriteCommitGuard::acquire(&wrapper, std::time::Duration::from_secs(5))
-                .await
-                .expect("real distributed owner");
-            let signal = guard.lock_lost_signal().expect("acquired distributed owner signal");
-            let store = Arc::new(ObservationStore::new(b"raw".to_vec(), 3));
-            if after_read {
-                let (ready_tx, ready_rx) = tokio::sync::oneshot::channel();
-                let (release_tx, release_rx) = tokio::sync::oneshot::channel();
-                *store.eof_gate.lock().expect("EOF gate") = Some((Some(ready_tx), release_rx));
-                let mut read = Box::pin(super::read_config_observation_no_lock(store.clone(), object, 3, &guard));
-                tokio::time::timeout(std::time::Duration::from_secs(60), async {
-                    tokio::select! {
-                        ready = ready_rx => ready.expect("read reached EOF"),
-                        result = &mut read => assert_eq!(false, true, "I06L_LOSS_AFTER_READ: returned before EOF gate: {result:?}"),
-                    }
-                }).await.expect("EOF watchdog");
-                client.reject_refreshes();
-                tokio::time::timeout(std::time::Duration::from_secs(60), signal.notified())
-                    .await
-                    .expect("actual owner loss watchdog");
-                assert!(guard.is_lock_lost(), "I06L_LOSS_AFTER_READ");
-                release_tx.send(()).expect("release EOF");
-                let result = tokio::time::timeout(std::time::Duration::from_secs(60), read)
-                    .await
-                    .expect("read watchdog");
-                assert!(
-                    matches!(
-                        result,
-                        Err(Error::NamespaceLockQuorumUnavailable {
-                            mode: "locked_config_observation",
-                            ..
-                        })
-                    ),
-                    "I06L_LOSS_AFTER_READ"
-                );
-                assert_eq!(store.gets.load(Ordering::SeqCst), 1);
-            } else {
-                client.reject_refreshes();
-                tokio::time::timeout(std::time::Duration::from_secs(60), signal.notified())
-                    .await
-                    .expect("actual owner loss watchdog");
-                assert!(guard.is_lock_lost(), "I06L_LOSS_BEFORE_GET");
-                let result = super::read_config_observation_no_lock(store.clone(), object, 3, &guard).await;
-                assert!(
-                    matches!(
-                        result,
-                        Err(Error::NamespaceLockQuorumUnavailable {
-                            mode: "locked_config_observation",
-                            ..
-                        })
-                    ),
-                    "I06L_LOSS_BEFORE_GET"
-                );
-                assert!(store.gets.load(Ordering::SeqCst) == 0, "I06L_LOSS_BEFORE_GET");
-            }
-            assert_eq!(store.writes.load(Ordering::SeqCst), 0);
-        }
-    }
-
-    #[tokio::test]
-    async fn observation_preserves_options_and_errors() {
-        for body in [Vec::new(), b"raw config".to_vec()] {
-            let store = Arc::new(ObservationStore::new(body.clone(), i64::try_from(body.len()).expect("fixture size")));
-            let result = super::read_config_observation(store.clone(), "config/observation.bin", 32).await;
-            assert!(result.is_ok(), "observation must preserve empty and nonempty objects: {result:?}");
-            let (observed, info) = result.expect("successful observation");
-            assert_eq!(observed, body);
-            assert_eq!(info.etag.as_deref(), Some("observation-etag"));
-            assert_eq!(
-                *store.options.lock().expect("options"),
-                Some((true, false, false)),
-                "I05_REPAIR_SUPPRESSED"
-            );
-            assert_eq!(store.writes.load(Ordering::SeqCst), 0);
-        }
-        for (source, expected) in [
-            (Error::FileNotFound, Error::ConfigNotFound),
-            (
-                Error::ObjectNotFound(RUSTFS_META_BUCKET.to_string(), "config/observation.bin".to_string()),
-                Error::ConfigNotFound,
-            ),
-            (Error::ErasureReadQuorum, Error::ErasureReadQuorum),
-        ] {
-            let mut fixture = ObservationStore::new(Vec::new(), 0);
-            fixture.error = Some(source);
-            let store = Arc::new(fixture);
-            let result = super::read_config_observation(store.clone(), "config/observation.bin", 32).await;
-            assert_eq!(result.expect_err("read error must propagate"), expected);
-            assert_eq!(store.writes.load(Ordering::SeqCst), 0);
-        }
-        let mut fixture = ObservationStore::new(Vec::new(), 0);
-        fixture.stream_error = true;
-        let store = Arc::new(fixture);
-        let result = super::read_config_observation(store.clone(), "config/observation.bin", 32).await;
-        let error = result.expect_err("stream error must propagate");
-        assert!(error.to_string().contains("observation stream failed"));
-        assert_eq!(store.writes.load(Ordering::SeqCst), 0);
-    }
-
-    #[tokio::test]
-    async fn observation_enforces_byte_limit() {
-        let store = Arc::new(ObservationStore::new(vec![7; 64], 0));
-        let result = super::read_config_observation(store.clone(), "config/observation.bin", 8).await;
-        assert!(result.is_err(), "I05_BOUND_ENFORCED");
-        assert_eq!(
-            result.expect_err("bounded observation error"),
-            Error::CorruptedFormat,
-            "I05_BOUND_ENFORCED"
-        );
-        assert_eq!(store.consumed.load(Ordering::SeqCst), 9, "I05_BOUND_ENFORCED: drain exactly limit + 1");
-        let store = Arc::new(ObservationStore::new(vec![7; 8], 8));
-        let result = super::read_config_observation(store.clone(), "config/observation.bin", 8).await;
-        assert!(result.is_ok(), "exact byte limit must succeed: {result:?}");
-        assert_eq!(result.expect("exact limit").0, vec![7; 8]);
-        assert_eq!(store.consumed.load(Ordering::SeqCst), 8);
-    }
-
     #[tokio::test]
     async fn read_config_preserve_empty_distinguishes_empty_object() {
         let store = Arc::new(RecoveryMockStore::new(RecoveryReadState::Blob(Vec::new()), None));
@@ -6189,60 +5799,6 @@ mod tests {
         assert!(data.is_empty());
     }
 
-    #[tokio::test]
-    async fn read_config_preserve_empty_metadata_keeps_empty_and_options() {
-        let store = Arc::new(RecoveryMockStore::new(RecoveryReadState::Blob(Vec::new()), None));
-        for no_lock in [false, true] {
-            let opts = ObjectOptions {
-                no_lock,
-                ..Default::default()
-            };
-            let (data, info) = read_config_preserve_empty_with_metadata_opts(store.clone(), "config/empty.json", &opts)
-                .await
-                .expect("an existing empty config must retain its payload and metadata");
-            assert!(data.is_empty());
-            assert_eq!(info.size, 0);
-            assert_eq!(info.actual_size, 0);
-            assert_eq!(info.etag.as_deref(), Some("config-1"));
-            assert_eq!(info.data_dir, Some(uuid::Uuid::from_u128(1)));
-            assert_eq!(store.last_get_no_lock.load(Ordering::SeqCst), no_lock);
-        }
-        let err = read_config(store, "config/empty.json")
-            .await
-            .expect_err("the existing reader must still treat empty configs as missing");
-        assert!(matches!(err, Error::ConfigNotFound));
-    }
-
-    #[tokio::test]
-    async fn read_config_preserve_empty_metadata_keeps_payload_and_metadata() {
-        let payload = b"original config bytes".to_vec();
-        let store = Arc::new(RecoveryMockStore::new(RecoveryReadState::Blob(payload.clone()), None));
-        let (data, info) =
-            read_config_preserve_empty_with_metadata_opts(store, "config/nonempty.json", &ObjectOptions::default())
-                .await
-                .expect("a nonempty config must retain its payload and metadata");
-        assert_eq!(data, payload);
-        let size = i64::try_from(payload.len()).expect("test payload size fits i64");
-        assert_eq!(info.size, size);
-        assert_eq!(info.actual_size, size);
-        assert_eq!(info.etag.as_deref(), Some("config-1"));
-        assert_eq!(info.data_dir, Some(uuid::Uuid::from_u128(1)));
-    }
-
-    #[tokio::test]
-    async fn read_config_preserve_empty_metadata_preserves_read_errors() {
-        let missing = Arc::new(RecoveryMockStore::new(RecoveryReadState::Missing, None));
-        let err = read_config_preserve_empty_with_metadata_opts(missing, "config/missing.json", &ObjectOptions::default())
-            .await
-            .expect_err("physical absence must remain ConfigNotFound");
-        assert!(matches!(err, Error::ConfigNotFound));
-        let quorum = Arc::new(RecoveryMockStore::new(RecoveryReadState::QuorumError, None));
-        let err = read_config_preserve_empty_with_metadata_opts(quorum, "config/quorum.json", &ObjectOptions::default())
-            .await
-            .expect_err("a quorum failure must retain its typed read error");
-        assert!(matches!(err, Error::ErasureReadQuorum));
-    }
-
     #[async_trait::async_trait]
     impl StorageAdminApi for RecoveryMockStore {
         type BackendInfo = rustfs_madmin::BackendInfo;

crates/ecstore/src/core/pools.rs

@@ -79,12 +79,13 @@ use rand::RngExt as _;
 use rmp_serde::Deserializer;
 use rmp_serde::Serializer;
 use rustfs_filemeta::{FileInfo, FileInfoVersions, MetaCacheEntries, MetaCacheEntry, MetadataResolutionParams};
+use rustfs_gateway_types::persistence::PersistedObjectLockConfiguration as ObjectLockConfiguration;
+use rustfs_gateway_types::persistence::{PersistedLifecycleConfiguration, PersistedReplicationConfiguration};
 use rustfs_heal_contracts::heal_channel::HealOpts;
 use rustfs_utils::crypto::{hex_sha256, is_sha256_checksum};
 use rustfs_utils::path::{
     decode_dir_object, encode_dir_object, path_join, path_to_bucket_object, path_to_bucket_object_with_base_path,
 };
-use s3s::dto::{BucketLifecycleConfiguration, ObjectLockConfiguration, ReplicationConfiguration};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::{HashMap, HashSet};
@@ -12431,28 +12432,12 @@ fn resolve_data_movement_lifecycle_expiry_result(action: IlmAction, apply_action
     )))
 }
 
-const DATA_MOVEMENT_DELETE_ALL_DEFERRED_REASON: &str = "delete_all_needs_bucket_write_lock";
-
-fn log_data_movement_lifecycle_expiry_deferred(bucket: &str, object: &str, action: IlmAction, reason: &str) {
-    warn!(
-        event = EVENT_DECOMMISSION_ENTRY,
-        component = LOG_COMPONENT_ECSTORE,
-        subsystem = LOG_SUBSYSTEM_POOLS,
-        state = "lifecycle_expiry_deferred",
-        bucket = %bucket,
-        object = %object,
-        action = ?action,
-        reason,
-        "Data movement deferred a version's lifecycle expiry; moving the version"
-    );
-}
-
 #[allow(clippy::too_many_arguments)]
 pub(crate) async fn should_skip_lifecycle_for_data_movement(
     store: Arc<ECStore>,
     bucket: &str,
     version: &rustfs_filemeta::FileInfo,
-    lifecycle_config: Option<&BucketLifecycleConfiguration>,
+    lifecycle_config: Option<&PersistedLifecycleConfiguration>,
     object_lock_config: Option<&ObjectLockConfiguration>,
     apply_actions: bool,
     event_source: &LcEventSrc,
@@ -12506,21 +12491,6 @@ pub(crate) async fn should_skip_lifecycle_for_data_movement(
             }
             let applied = !apply_actions
                 || match lock_lost_signal {
-                    // A delete-all is a prefix delete that takes the bucket
-                    // lifecycle write lock, which the lifecycle read locks held
-                    // by the inline apply and by the rebalance entry's bucket
-                    // incarnation fence would block until timeout. The version
-                    // is still live, so it moves like any other version and
-                    // lifecycle expires it on the target.
-                    Some(_) if action.delete_all() => {
-                        log_data_movement_lifecycle_expiry_deferred(
-                            bucket,
-                            &version.name,
-                            action,
-                            DATA_MOVEMENT_DELETE_ALL_DEFERRED_REASON,
-                        );
-                        return Ok(false);
-                    }
                     Some(signal) => {
                         apply_expiry_rule_for_data_movement(store, &event, event_source, &object_info, Some(signal)).await
                     }
@@ -12546,15 +12516,16 @@ pub(crate) async fn should_skip_lifecycle_for_data_movement(
                             // The version is still live, so it moves like any
                             // other version and lifecycle expires it on the
                             // target.
-                            log_data_movement_lifecycle_expiry_deferred(
-                                bucket,
-                                &version.name,
-                                action,
-                                if delete_all {
-                                    DATA_MOVEMENT_DELETE_ALL_DEFERRED_REASON
-                                } else {
-                                    "not_applied"
-                                },
+                            warn!(
+                                event = EVENT_DECOMMISSION_ENTRY,
+                                component = LOG_COMPONENT_ECSTORE,
+                                subsystem = LOG_SUBSYSTEM_POOLS,
+                                state = "lifecycle_expiry_deferred",
+                                bucket = %bucket,
+                                object = %version.name,
+                                action = ?action,
+                                reason = if delete_all { "delete_all_needs_bucket_write_lock" } else { "not_applied" },
+                                "Data movement deferred a transitioned version's lifecycle expiry; moving the version"
                             );
                             return Ok(false);
                         }
@@ -16153,9 +16124,9 @@ impl ECStore {
         generation: OffsetDateTime,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<BucketLifecycleConfiguration>,
+        lifecycle_config: Option<PersistedLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         source_changed_exhaustions: Arc<AtomicUsize>,
         entry_budget: Arc<Semaphore>,
@@ -16327,9 +16298,9 @@ impl ECStore {
         mut deferred_entry: DeferredDecommissionEntry,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<BucketLifecycleConfiguration>,
+        lifecycle_config: Option<PersistedLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         source_changed_exhaustions: Arc<AtomicUsize>,
         entry_budget: Arc<Semaphore>,
@@ -16436,9 +16407,9 @@ impl ECStore {
         generation: OffsetDateTime,
         set: Arc<SetDisks>,
         bi: DecomBucketInfo,
-        lifecycle_config: Option<BucketLifecycleConfiguration>,
+        lifecycle_config: Option<PersistedLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         source_changed_exhaustions: Arc<AtomicUsize>,
         entry_budget: Arc<Semaphore>,
@@ -17076,7 +17047,6 @@ impl ECStore {
             &[],
             data_movement::SourceCleanupBucketFence {
                 expected_incarnation_id: None,
-                lifecycle_owner: None,
                 lifecycle_guard: None,
                 namespace_lock_lost_signal: pool_meta_guard.lock_lost_signal(),
                 object_mutation_fence: Some(&object_fence),
@@ -17114,9 +17084,9 @@ impl ECStore {
         entry: MetaCacheEntry,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<BucketLifecycleConfiguration>,
+        lifecycle_config: Option<PersistedLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         source_changed_exhaustions: Arc<AtomicUsize>,
         attempts: &mut usize,
@@ -17300,9 +17270,9 @@ impl ECStore {
         entry: MetaCacheEntry,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<BucketLifecycleConfiguration>,
+        lifecycle_config: Option<PersistedLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         entry_attempt: usize,
         scanner_backlog_handoff_attempt: usize,
@@ -17345,7 +17315,7 @@ impl ECStore {
         let operation_gate = self.ctx.data_movement_operation_gate();
 
         let bucket_incarnation_fence = match expected_bucket_incarnation_id {
-            Some(expected) => Some(Arc::new(self.acquire_bucket_incarnation_fence(&bucket, expected).await?)),
+            Some(expected) => Some(self.acquire_bucket_incarnation_fence(&bucket, expected).await?),
             None => None,
         };
 
@@ -18281,8 +18251,9 @@ impl ECStore {
                         &cleanup_transferred_tier_versions,
                         data_movement::SourceCleanupBucketFence {
                             expected_incarnation_id: expected_bucket_incarnation_id,
-                            lifecycle_owner: bucket_incarnation_fence.as_ref(),
-                            lifecycle_guard: None,
+                            lifecycle_guard: bucket_incarnation_fence
+                                .as_ref()
+                                .and_then(|guard| guard.namespace_lock_guard()),
                             namespace_lock_lost_signal: None,
                             object_mutation_fence: Some(&source_cleanup_mutation_fence),
                         },
@@ -18589,7 +18560,7 @@ impl ECStore {
         entry: MetaCacheEntry,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<BucketLifecycleConfiguration>,
+        lifecycle_config: Option<PersistedLifecycleConfiguration>,
     ) -> Result<()> {
         let expected_bucket_incarnation_id = if is_meta_bucketname(&bucket) {
             None
@@ -29408,7 +29379,6 @@ mod pools_tests {
             pool_meta_save_gate: tokio::sync::Mutex::new(super::PoolMetaWriteState::for_test_bootstrap()),
             ctx,
             bucket_fence_registry: Arc::default(),
-            ordinary_classification: Default::default(),
         })
     }
 

crates/ecstore/src/core/pools_test.rs

@@ -499,7 +499,6 @@ mod decommission_lock_order_tests {
             ),
             ctx,
             bucket_fence_registry: Arc::default(),
-            ordinary_classification: Default::default(),
         });
         crate::bucket::metadata_sys::init_bucket_metadata_sys(Arc::clone(&store), Vec::new()).await;
         (store, refresh_calls)

crates/ecstore/src/core/sets.rs

@@ -72,6 +72,38 @@ type WalkOptions = StorageWalkOptions<fn(&FileInfo) -> bool>;
 
 const LIST_MULTIPART_SETS_CONCURRENCY: usize = 4;
 
+#[cfg(test)]
+type TestSetLockers = HashMap<usize, Vec<Arc<dyn rustfs_lock::LockClient>>>;
+
+#[cfg(test)]
+static TEST_SET_LOCKERS: std::sync::LazyLock<std::sync::Mutex<TestSetLockers>> =
+    std::sync::LazyLock::new(|| std::sync::Mutex::new(HashMap::new()));
+
+/// Keep a fixture's real locker domain scoped to its owning instance.
+#[cfg(test)]
+pub(crate) struct ScopedSetLockers(Arc<InstanceContext>);
+
+#[cfg(test)]
+impl ScopedSetLockers {
+    pub(crate) fn install(ctx: Arc<InstanceContext>, lockers: Vec<Arc<dyn rustfs_lock::LockClient>>) -> Self {
+        let key = Arc::as_ptr(&ctx) as usize;
+        let mut domains = TEST_SET_LOCKERS.lock().expect("test set lockers mutex");
+        assert!(!domains.contains_key(&key), "the instance already owns a test locker domain");
+        domains.insert(key, lockers);
+        Self(ctx)
+    }
+}
+
+#[cfg(test)]
+impl Drop for ScopedSetLockers {
+    fn drop(&mut self) {
+        TEST_SET_LOCKERS
+            .lock()
+            .expect("test set lockers mutex")
+            .remove(&(Arc::as_ptr(&self.0) as usize));
+    }
+}
+
 fn is_idempotent_delete_prefix_error(err: &Error) -> bool {
     is_err_object_not_found(err) || is_err_strict_volume_not_found(err)
 }
@@ -99,33 +131,6 @@ pub struct Sets {
     ctx: Arc<InstanceContext>,
 }
 
-#[cfg(test)]
-impl Sets {
-    pub(crate) fn from_test_set(
-        set: Arc<SetDisks>,
-        endpoints: PoolEndpoints,
-        format: FormatV3,
-        pool_idx: usize,
-        parity_count: usize,
-        ctx: Arc<InstanceContext>,
-    ) -> Arc<Self> {
-        Arc::new(Self {
-            id: format.id,
-            disk_set: vec![set],
-            pool_idx,
-            set_count: 1,
-            set_drive_count: endpoints.drives_per_set,
-            endpoints,
-            format,
-            parity_count,
-            default_parity_count: parity_count,
-            distribution_algo: DistributionAlgoVersion::V1,
-            exit_signal: None,
-            ctx,
-        })
-    }
-}
-
 impl Drop for Sets {
     fn drop(&mut self) {
         if let Some(exit_signal) = self.exit_signal.take() {
@@ -300,6 +305,14 @@ impl Sets {
                 }
             }
 
+            #[cfg(test)]
+            let pool_lockers = TEST_SET_LOCKERS
+                .lock()
+                .expect("test set lockers mutex")
+                .get(&(Arc::as_ptr(&instance_ctx) as usize))
+                .cloned()
+                .unwrap_or_else(|| pool_lockers.clone());
+
             let set_disks = SetDisks::new_with_instance_ctx(
                 runtime_sources::local_node_name().await,
                 Arc::new(RwLock::new(set_drive)),
@@ -827,10 +840,6 @@ impl crate::storage_api_contracts::object::ObjectOperations for Sets {
             mod_time: dst_opts.mod_time,
             http_preconditions: dst_opts.http_preconditions.clone(),
             quota_admission: dst_opts.quota_admission,
-            expected_bucket_incarnation_id: dst_opts.expected_bucket_incarnation_id,
-            bucket_lifecycle_lock_fence: dst_opts.bucket_lifecycle_lock_fence.clone(),
-            bucket_incarnation_fence: dst_opts.bucket_incarnation_fence.clone(),
-            object_lock_config_snapshot: dst_opts.object_lock_config_snapshot.clone(),
             ..Default::default()
         };
 

crates/ecstore/src/data_movement/mod.rs

@@ -31,7 +31,7 @@ use crate::storage_api_contracts::{
     namespace::NamespaceLocking as _,
     object::{HTTPPreconditions, ObjectOperations as _},
 };
-use crate::store::{BucketIncarnationFenceGuard, DecommissionFixedReadAnchor, ECStore, SourceCleanupMutationFence};
+use crate::store::{DecommissionFixedReadAnchor, ECStore, SourceCleanupMutationFence};
 use bytes::Bytes;
 use rustfs_filemeta::{FileInfo, FileInfoVersions, ObjectPartInfo};
 use rustfs_rio::{EtagResolvable, HashReader, HashReaderDetector, Index, TryGetIndex};
@@ -1278,7 +1278,6 @@ pub(crate) enum SourceCleanupError {
 #[derive(Clone, Default)]
 pub(crate) struct SourceCleanupBucketFence<'a> {
     pub(crate) expected_incarnation_id: Option<uuid::Uuid>,
-    pub(crate) lifecycle_owner: Option<&'a Arc<BucketIncarnationFenceGuard>>,
     pub(crate) lifecycle_guard: Option<&'a rustfs_lock::NamespaceLockGuard>,
     pub(crate) namespace_lock_lost_signal: Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>>,
     pub(crate) object_mutation_fence: Option<&'a SourceCleanupMutationFence>,
@@ -1487,10 +1486,9 @@ pub(crate) async fn cleanup_source_entry_if_unchanged(
         )
     };
 
-    if bucket_fence.lifecycle_owner.is_some_and(|owner| owner.is_lock_lost())
-        || bucket_fence
-            .lifecycle_guard
-            .is_some_and(rustfs_lock::NamespaceLockGuard::is_lock_lost)
+    if bucket_fence
+        .lifecycle_guard
+        .is_some_and(rustfs_lock::NamespaceLockGuard::is_lock_lost)
     {
         return Err(SourceCleanupError::Storage(Error::other(format!(
             "{op_label}: bucket incarnation fence was lost before source cleanup"
@@ -1529,9 +1527,6 @@ pub(crate) async fn cleanup_source_entry_if_unchanged(
     if let Some(object_mutation_fence) = bucket_fence.object_mutation_fence {
         object_mutation_fence.add_namespace_lock_fence(&mut opts);
     }
-    if let Some(owner) = bucket_fence.lifecycle_owner {
-        owner.attach_owner(&mut opts);
-    }
     if let Some(bucket_lifecycle_guard) = bucket_fence.lifecycle_guard {
         opts.add_bucket_lifecycle_lock_guard(bucket_lifecycle_guard);
     }

crates/ecstore/src/data_usage/mod.rs

@@ -216,7 +216,7 @@ pub async fn lookup_degraded_bucket_usage_baseline(store: Arc<ECStore>, bucket:
     // Stale or empty cache: refresh through the TTL-bounded loader. A failed
     // refresh carries the previous baseline forward, so quota admission keeps
     // its last grounded values through a backend read outage.
-    let _ = project_data_usage_from_backend_cached(store, |_| ()).await;
+    let _ = load_data_usage_from_backend_cached(store).await;
     let cache = data_usage_snapshot_cache().read().await;
     cache
         .as_ref()
@@ -237,34 +237,31 @@ struct CachedDataUsageSnapshot {
 }
 
 impl CachedDataUsageSnapshot {
-    fn result<T>(&self, project: impl FnOnce(&DataUsageInfo) -> T) -> Result<T, Error> {
+    fn result(&self) -> Result<DataUsageInfo, Error> {
         self.info
-            .as_ref()
-            .map(project)
+            .clone()
             .ok_or_else(|| Error::other("data usage snapshot load recently failed"))
     }
 }
 
-fn fresh_cached_data_usage_snapshot<T>(
+fn fresh_cached_data_usage_snapshot(
     cache: &Option<CachedDataUsageSnapshot>,
     now: tokio::time::Instant,
     ttl: Duration,
-    project: impl FnOnce(&DataUsageInfo) -> T,
-) -> Option<Result<T, Error>> {
+) -> Option<Result<DataUsageInfo, Error>> {
     cache
         .as_ref()
         .filter(|cached| now.duration_since(cached.loaded_at) < ttl)
-        .map(|cached| cached.result(project))
+        .map(CachedDataUsageSnapshot::result)
 }
 
-fn cache_data_usage_snapshot_result<T>(
+fn cache_data_usage_snapshot_result(
     cache: &mut Option<CachedDataUsageSnapshot>,
     result: Result<LoadedUsageBaseline, Error>,
     loaded_at: tokio::time::Instant,
     refresh_generation: u64,
     current_generation: u64,
-    project: impl FnOnce(&DataUsageInfo) -> T,
-) -> Option<Result<T, Error>> {
+) -> Option<Result<DataUsageInfo, Error>> {
     if current_generation != refresh_generation {
         return None;
     }
@@ -283,13 +280,12 @@ fn cache_data_usage_snapshot_result<T>(
                     degraded_baseline.entry(bucket.clone()).or_insert(*size);
                 }
             }
-            let projected = project(&info);
             *cache = Some(CachedDataUsageSnapshot {
-                info: Some(info),
+                info: Some(info.clone()),
                 loaded_at,
                 degraded_baseline,
             });
-            Ok(projected)
+            Ok(info)
         }
         Err(e) => {
             // Keep the previous baseline through a failed refresh: quota
@@ -1490,21 +1486,12 @@ async fn normalize_loaded_data_usage(
 /// `save_data_usage_in_backend` invalidates the cache so a fresh scanner save
 /// is visible immediately in the saving process.
 pub async fn load_data_usage_from_backend_cached(store: Arc<ECStore>) -> Result<DataUsageInfo, Error> {
-    project_data_usage_from_backend_cached(store, DataUsageInfo::clone).await
-}
-
-// Project under the cache guard so scalar readers never copy the snapshot's
-// bucket maps. The owned API shares the same TTL, refresh and invalidation path.
-async fn project_data_usage_from_backend_cached<T>(
-    store: Arc<ECStore>,
-    project: impl Fn(&DataUsageInfo) -> T,
-) -> Result<T, Error> {
     let ttl = Duration::from_secs(DATA_USAGE_CACHE_TTL_SECS);
 
     loop {
         {
             let cache = data_usage_snapshot_cache().read().await;
-            if let Some(result) = fresh_cached_data_usage_snapshot(&cache, tokio::time::Instant::now(), ttl, &project) {
+            if let Some(result) = fresh_cached_data_usage_snapshot(&cache, tokio::time::Instant::now(), ttl) {
                 return result;
             }
         }
@@ -1516,7 +1503,7 @@ async fn project_data_usage_from_backend_cached<T>(
             .await;
         {
             let cache = data_usage_snapshot_cache().read().await;
-            if let Some(result) = fresh_cached_data_usage_snapshot(&cache, tokio::time::Instant::now(), ttl, &project) {
+            if let Some(result) = fresh_cached_data_usage_snapshot(&cache, tokio::time::Instant::now(), ttl) {
                 return result;
             }
         }
@@ -1525,14 +1512,9 @@ async fn project_data_usage_from_backend_cached<T>(
         let result = load_data_usage_from_backend_with_baseline(store.clone()).await;
         let loaded_at = tokio::time::Instant::now();
         let mut cache = data_usage_snapshot_cache().write().await;
-        if let Some(result) = cache_data_usage_snapshot_result(
-            &mut cache,
-            result,
-            loaded_at,
-            refresh_generation,
-            data_usage_snapshot_generation(),
-            &project,
-        ) {
+        if let Some(result) =
+            cache_data_usage_snapshot_result(&mut cache, result, loaded_at, refresh_generation, data_usage_snapshot_generation())
+        {
             return result;
         }
         drop(cache);
@@ -1550,8 +1532,7 @@ pub async fn load_admin_data_usage_from_backend_cached(store: Arc<ECStore>) -> R
     loop {
         {
             let cache = admin_data_usage_snapshot_cache().read().await;
-            if let Some(result) = fresh_cached_data_usage_snapshot(&cache, tokio::time::Instant::now(), ttl, DataUsageInfo::clone)
-            {
+            if let Some(result) = fresh_cached_data_usage_snapshot(&cache, tokio::time::Instant::now(), ttl) {
                 return result;
             }
         }
@@ -1562,8 +1543,7 @@ pub async fn load_admin_data_usage_from_backend_cached(store: Arc<ECStore>) -> R
             .await;
         {
             let cache = admin_data_usage_snapshot_cache().read().await;
-            if let Some(result) = fresh_cached_data_usage_snapshot(&cache, tokio::time::Instant::now(), ttl, DataUsageInfo::clone)
-            {
+            if let Some(result) = fresh_cached_data_usage_snapshot(&cache, tokio::time::Instant::now(), ttl) {
                 return result;
             }
         }
@@ -1584,7 +1564,6 @@ pub async fn load_admin_data_usage_from_backend_cached(store: Arc<ECStore>) -> R
             loaded_at,
             refresh_generation,
             admin_data_usage_snapshot_generation(),
-            DataUsageInfo::clone,
         ) {
             return result;
         }
@@ -2298,10 +2277,8 @@ async fn get_persisted_bucket_usage(bucket: &str) -> Option<u64> {
 }
 
 async fn persisted_bucket_usage(store: Arc<ECStore>, bucket: &str) -> Option<u64> {
-    project_data_usage_from_backend_cached(store, |info| info.buckets_usage.get(bucket).map(|usage| usage.size))
-        .await
-        .ok()
-        .flatten()
+    let info = load_data_usage_from_backend_cached(store).await.ok()?;
+    info.buckets_usage.get(bucket).map(|usage| usage.size)
 }
 
 async fn reload_persisted_bucket_usage(store: Arc<ECStore>, bucket: &str) -> Option<u64> {
@@ -2398,7 +2375,6 @@ where
         tokio::time::Instant::now(),
         refresh_generation,
         data_usage_snapshot_generation(),
-        |_| (),
     )
     .is_some()
 }
@@ -2915,8 +2891,6 @@ pub async fn init_compression_total_memory_from_backend(store: Arc<ECStore>) {
 
 #[cfg(test)]
 mod tests {
-    mod snapshot_projection;
-
     use super::*;
     use crate::layout::endpoints::EndpointServerPools;
     use crate::runtime::instance::InstanceContext;
@@ -3360,7 +3334,6 @@ mod tests {
             pool_meta_save_gate: TokioMutex::default(),
             ctx,
             bucket_fence_registry: Arc::default(),
-            ordinary_classification: Default::default(),
         })
     }
 
@@ -4599,29 +4572,15 @@ mod tests {
             loaded_at,
             refresh_generation,
             data_usage_snapshot_generation(),
-            DataUsageInfo::clone,
         )
         .expect("an uninterrupted refresh should populate the cache");
         assert!(matches!(first, Err(Error::ErasureReadQuorum)));
 
-        let cached = fresh_cached_data_usage_snapshot(
-            &cache,
-            loaded_at + Duration::from_secs(1),
-            Duration::from_secs(30),
-            DataUsageInfo::clone,
-        )
-        .expect("the failed load must remain cached within the TTL");
+        let cached = fresh_cached_data_usage_snapshot(&cache, loaded_at + Duration::from_secs(1), Duration::from_secs(30))
+            .expect("the failed load must remain cached within the TTL");
         assert!(cached.is_err());
 
-        assert!(
-            fresh_cached_data_usage_snapshot(
-                &cache,
-                loaded_at + Duration::from_secs(30),
-                Duration::from_secs(30),
-                DataUsageInfo::clone
-            )
-            .is_none()
-        );
+        assert!(fresh_cached_data_usage_snapshot(&cache, loaded_at + Duration::from_secs(30), Duration::from_secs(30)).is_none());
     }
 
     #[test]
@@ -4642,20 +4601,14 @@ mod tests {
             loaded_at,
             refresh_generation,
             data_usage_snapshot_generation(),
-            DataUsageInfo::clone,
         )
         .expect("an uninterrupted refresh should populate the cache")
         .expect("successful load must be returned");
         assert_snapshot_bucket(&first, "bucket");
 
-        let cached = fresh_cached_data_usage_snapshot(
-            &cache,
-            loaded_at + Duration::from_secs(1),
-            Duration::from_secs(30),
-            DataUsageInfo::clone,
-        )
-        .expect("successful load must remain cached within the TTL")
-        .expect("cached success must remain successful");
+        let cached = fresh_cached_data_usage_snapshot(&cache, loaded_at + Duration::from_secs(1), Duration::from_secs(30))
+            .expect("successful load must remain cached within the TTL")
+            .expect("cached success must remain successful");
         assert_snapshot_bucket(&cached, "bucket");
     }
 
@@ -4680,7 +4633,6 @@ mod tests {
             loaded_at,
             refresh_generation,
             data_usage_snapshot_generation(),
-            DataUsageInfo::clone,
         )
         .expect("an uninterrupted refresh should populate the cache")
         .expect("successful load must be returned");
@@ -4714,7 +4666,6 @@ mod tests {
             loaded_at,
             refresh_generation,
             data_usage_snapshot_generation(),
-            DataUsageInfo::clone,
         );
 
         assert!(stale_result.is_none());

crates/ecstore/src/data_usage/tests/snapshot_projection.rs

@@ -1,191 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use super::*;
-
-#[test]
-fn scalar_projection_borrows_snapshot_and_preserves_unknown_and_zero() {
-    let loaded_at = tokio::time::Instant::now();
-    let mut info = data_usage_info_for_test("known", 1, 42, SystemTime::UNIX_EPOCH);
-    info.buckets_usage.insert("empty".to_string(), BucketUsageInfo::default());
-    let cache = Some(CachedDataUsageSnapshot {
-        info: Some(info),
-        loaded_at,
-        degraded_baseline: HashMap::new(),
-    });
-    let stored = cache
-        .as_ref()
-        .expect("cached snapshot")
-        .info
-        .as_ref()
-        .expect("known snapshot");
-    let ttl = Duration::from_secs(30);
-
-    for (bucket, expected) in [("known", Some(42)), ("empty", Some(0)), ("missing", None)] {
-        let value = fresh_cached_data_usage_snapshot(&cache, loaded_at, ttl, |info| {
-            assert!(std::ptr::eq(info, stored), "projection must borrow the cached snapshot");
-            info.buckets_usage.get(bucket).map(|usage| usage.size)
-        })
-        .expect("fresh snapshot")
-        .expect("successful snapshot");
-        let owned = fresh_cached_data_usage_snapshot(&cache, loaded_at, ttl, DataUsageInfo::clone)
-            .expect("fresh snapshot")
-            .expect("successful snapshot");
-        assert_eq!(value, expected);
-        assert_eq!(value, owned.buckets_usage.get(bucket).map(|usage| usage.size));
-    }
-}
-
-#[test]
-fn projection_is_skipped_for_missing_failed_expired_or_invalidated_snapshots() {
-    let loaded_at = tokio::time::Instant::now();
-    let ttl = Duration::from_secs(30);
-    let never_project = |_: &DataUsageInfo| -> u64 { panic!("unusable snapshots must not be projected") };
-    assert!(fresh_cached_data_usage_snapshot(&None, loaded_at, ttl, never_project).is_none());
-
-    let mut cache = None;
-    let failure = cache_data_usage_snapshot_result(&mut cache, Err(Error::ErasureReadQuorum), loaded_at, 1, 1, never_project)
-        .expect("matching generation");
-    assert!(matches!(failure, Err(Error::ErasureReadQuorum)));
-    assert!(
-        fresh_cached_data_usage_snapshot(&cache, loaded_at, ttl, never_project)
-            .expect("negative cache remains fresh")
-            .is_err()
-    );
-
-    cache = Some(CachedDataUsageSnapshot {
-        info: Some(data_usage_info_for_test("known", 1, 42, SystemTime::UNIX_EPOCH)),
-        loaded_at,
-        degraded_baseline: HashMap::new(),
-    });
-    assert!(fresh_cached_data_usage_snapshot(&cache, loaded_at + ttl, ttl, never_project).is_none());
-    cache = None;
-    let rejected = cache_data_usage_snapshot_result(
-        &mut cache,
-        Ok(LoadedUsageBaseline {
-            info: data_usage_info_for_test("known", 1, 42, SystemTime::UNIX_EPOCH),
-            degraded_baseline: HashMap::new(),
-            observed_unavailable: false,
-        }),
-        loaded_at,
-        1,
-        2,
-        never_project,
-    );
-    assert!(rejected.is_none());
-    assert!(cache.is_none(), "rejected generation must not republish stale data");
-}
-
-#[test]
-fn projected_publication_moves_bucket_maps_into_cache() {
-    let info = data_usage_info_for_test("known", 1, 42, SystemTime::UNIX_EPOCH);
-    let original_key = info.buckets_usage.get_key_value("known").expect("source bucket").0.as_ptr();
-    let mut cache = None;
-    let usage = cache_data_usage_snapshot_result(
-        &mut cache,
-        Ok(LoadedUsageBaseline {
-            info,
-            degraded_baseline: HashMap::new(),
-            observed_unavailable: false,
-        }),
-        tokio::time::Instant::now(),
-        1,
-        1,
-        |info| {
-            assert_eq!(
-                info.buckets_usage
-                    .get_key_value("known")
-                    .expect("projected bucket")
-                    .0
-                    .as_ptr(),
-                original_key
-            );
-            info.buckets_usage.get("known").map(|usage| usage.size)
-        },
-    )
-    .expect("matching generation")
-    .expect("successful publication");
-    assert_eq!(usage, Some(42));
-    let cached = cache
-        .as_ref()
-        .expect("published cache")
-        .info
-        .as_ref()
-        .expect("published snapshot");
-    assert_eq!(
-        cached.buckets_usage.get_key_value("known").expect("cached bucket").0.as_ptr(),
-        original_key
-    );
-}
-
-#[tokio::test]
-#[serial]
-async fn persisted_scalar_projection_shares_cache_refresh_and_invalidation() {
-    use crate::bucket::metadata_sys::test_support::isolated_store_over_temp_disks;
-    use crate::config::com::save_config;
-
-    let (_dirs, store) = isolated_store_over_temp_disks().await;
-    let mut info = data_usage_info_for_test("known", 1, 42, SystemTime::UNIX_EPOCH);
-    info.buckets_usage.insert("empty".to_string(), BucketUsageInfo::default());
-    info.bucket_sizes.insert("empty".to_string(), 0);
-    info.buckets_count = 2;
-    save_config(
-        store.clone(),
-        DATA_USAGE_OBJ_NAME_PATH.as_str(),
-        serde_json::to_vec(&info).expect("encode snapshot"),
-    )
-    .await
-    .expect("persist snapshot");
-    invalidate_data_usage_snapshot_cache().await;
-
-    for (bucket, expected) in [("known", Some(42)), ("empty", Some(0)), ("missing", None)] {
-        assert_eq!(persisted_bucket_usage(store.clone(), bucket).await, expected);
-        let owned = load_data_usage_from_backend_cached(store.clone())
-            .await
-            .expect("owned cached snapshot");
-        assert_eq!(expected, owned.buckets_usage.get(bucket).map(|usage| usage.size));
-    }
-    info.buckets_usage.get_mut("known").expect("known bucket").size = 84;
-    info.bucket_sizes.insert("known".to_string(), 84);
-    save_config(
-        store.clone(),
-        DATA_USAGE_OBJ_NAME_PATH.as_str(),
-        serde_json::to_vec(&info).expect("encode new snapshot"),
-    )
-    .await
-    .expect("persist new snapshot without invalidating cache");
-    assert_eq!(
-        persisted_bucket_usage(store.clone(), "known").await,
-        Some(42),
-        "warm reads reuse the TTL cache"
-    );
-    invalidate_data_usage_snapshot_cache().await;
-    assert_eq!(
-        persisted_bucket_usage(store.clone(), "known").await,
-        Some(84),
-        "invalidation exposes the new snapshot"
-    );
-    invalidate_data_usage_snapshot_cache().await;
-    if let Some(cancel) = store.ctx.background_cancel_token() {
-        cancel.cancel();
-    }
-    for pool in &store.pools {
-        for set in &pool.disk_set {
-            let disks = set.disks.read().await.clone();
-            for disk in disks.iter().flatten() {
-                disk.close().await.expect("stop fixture disk monitoring");
-            }
-        }
-    }
-}

crates/ecstore/src/disk/fs.rs

@@ -117,6 +117,9 @@ pub const O_APPEND: FileMode = 0x00400;
 //     create_new: bool,
 
 pub async fn open_file(path: impl AsRef<Path>, mode: FileMode) -> io::Result<File> {
+    if mode & O_CREATE != 0 {
+        super::os::record_native_publication(path.as_ref());
+    }
     let base_opts = match mode & (O_RDONLY | O_WRONLY | O_RDWR) {
         O_RDONLY => get_readonly_options(),
         O_WRONLY => get_writeonly_options(),
@@ -159,6 +162,11 @@ pub fn lstat_std(path: impl AsRef<Path>) -> io::Result<Metadata> {
     std::fs::symlink_metadata(path)
 }
 
+pub async fn make_dir_all(path: impl AsRef<Path>) -> io::Result<()> {
+    super::os::record_native_publication(path.as_ref());
+    fs::create_dir_all(path.as_ref()).await
+}
+
 fn is_dir_error(e: &io::Error) -> bool {
     e.raw_os_error() == Some(libc::EISDIR)
         || e.kind() == io::ErrorKind::IsADirectory
@@ -206,12 +214,19 @@ pub fn remove_all_std(path: impl AsRef<Path>) -> io::Result<()> {
     }
 }
 
+pub async fn mkdir(path: impl AsRef<Path>) -> io::Result<()> {
+    super::os::record_native_publication(path.as_ref());
+    fs::create_dir(path.as_ref()).await
+}
+
 pub async fn rename(from: impl AsRef<Path>, to: impl AsRef<Path>) -> io::Result<()> {
+    super::os::record_native_publication(to.as_ref());
     fs::rename(from, to).await
 }
 
 #[cfg(any(not(windows), test))]
 pub fn rename_std(from: impl AsRef<Path>, to: impl AsRef<Path>) -> io::Result<()> {
+    super::os::record_native_publication(to.as_ref());
     std::fs::rename(from, to)
 }
 
@@ -464,6 +479,17 @@ mod tests {
         assert!(metadata.file_type().is_symlink());
     }
 
+    #[tokio::test]
+    async fn test_make_dir_all() {
+        let temp_dir = TempDir::new().unwrap();
+        let nested_path = temp_dir.path().join("level1").join("level2").join("level3");
+
+        // Should create nested directories
+        assert!(make_dir_all(&nested_path).await.is_ok());
+        assert!(nested_path.exists());
+        assert!(nested_path.is_dir());
+    }
+
     #[tokio::test]
     async fn test_remove_file() {
         let temp_dir = TempDir::new().unwrap();
@@ -536,6 +562,17 @@ mod tests {
         assert!(!dir_path.exists());
     }
 
+    #[tokio::test]
+    async fn test_mkdir() {
+        let temp_dir = TempDir::new().unwrap();
+        let dir_path = temp_dir.path().join("test_mkdir");
+
+        // Create directory
+        assert!(mkdir(&dir_path).await.is_ok());
+        assert!(dir_path.exists());
+        assert!(dir_path.is_dir());
+    }
+
     #[tokio::test]
     async fn test_rename() {
         let temp_dir = TempDir::new().unwrap();

crates/ecstore/src/disk/local/artifact_lease.rs

@@ -1,740 +0,0 @@
-// Copyright 2026 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::disk::error::{DiskError, Result};
-use std::{fs::File, sync::Arc};
-
-/// A target disk's admitted artifact publication. Physical mutation workers
-/// retain this Arc until their final syscall and rollback have finished.
-pub struct ArtifactLease {
-    _active: File,
-    _key_directory: File,
-    _seal_directory: File,
-    _root: File,
-}
-
-pub type ArtifactPutLease = ArtifactLease;
-pub type ArtifactRepairLease = ArtifactLease;
-
-/// Read-only census owns both already-closed physical mutation domains.
-pub(super) struct ArtifactInventoryLease {
-    _put: Arc<ArtifactLease>,
-    _repair: Arc<ArtifactLease>,
-}
-
-pub(super) async fn drain_closed(root: File, key: [u8; 32], deadline: tokio::time::Instant) -> Result<ArtifactInventoryLease> {
-    #[cfg(unix)]
-    {
-        unix::drain_closed(root, key, deadline).await
-    }
-    #[cfg(not(unix))]
-    {
-        let _ = (root, key, deadline);
-        Err(DiskError::UnsupportedDisk)
-    }
-}
-
-#[derive(Clone, Copy)]
-pub(crate) enum Domain {
-    Put,
-    Repair,
-}
-
-impl Domain {
-    fn directory(self) -> &'static str {
-        match self {
-            Self::Put => ".rustfs-artifact-put-seals",
-            Self::Repair => ".rustfs-artifact-repair-seals",
-        }
-    }
-
-    fn closed(self) -> &'static [u8] {
-        match self {
-            Self::Put => b"rustfs-artifact-put-sealed-v1\n",
-            Self::Repair => b"rustfs-artifact-repair-sealed-v1\n",
-        }
-    }
-}
-
-pub(super) async fn pinned_root(disk: &super::LocalDisk) -> Result<File> {
-    #[cfg(target_os = "linux")]
-    let root = disk.mount_lease.clone();
-    #[cfg(all(unix, not(target_os = "linux")))]
-    let root = disk.artifact_identity_root.clone();
-    #[cfg(not(unix))]
-    let _ = disk;
-    tokio::task::spawn_blocking(move || {
-        #[cfg(unix)]
-        {
-            root.try_clone().map_err(DiskError::from)
-        }
-        #[cfg(not(unix))]
-        {
-            Err(DiskError::other("artifact disk leases require Unix"))
-        }
-    })
-    .await
-    .map_err(DiskError::from)?
-}
-
-pub(super) async fn acquire(root: File, key: [u8; 32]) -> Result<Arc<ArtifactPutLease>> {
-    acquire_in(root, key, Domain::Put).await
-}
-
-pub(super) async fn acquire_in(root: File, key: [u8; 32], domain: Domain) -> Result<Arc<ArtifactLease>> {
-    #[cfg(unix)]
-    {
-        unix::acquire(root, key, domain).await
-    }
-    #[cfg(not(unix))]
-    {
-        let _ = (root, key, domain);
-        Err(DiskError::other("artifact disk leases require Unix"))
-    }
-}
-
-pub(super) async fn seal(root: File, key: [u8; 32]) -> Result<()> {
-    seal_in(root, key, Domain::Put).await
-}
-
-pub(super) async fn seal_in(root: File, key: [u8; 32], domain: Domain) -> Result<()> {
-    #[cfg(unix)]
-    {
-        unix::seal(root, key, domain).await
-    }
-    #[cfg(not(unix))]
-    {
-        let _ = (root, key, domain);
-        Err(DiskError::other("artifact disk leases require Unix"))
-    }
-}
-
-#[cfg(unix)]
-mod unix {
-    use super::*;
-    use rustix::fs::{FlockOperation, Mode, OFlags, flock, mkdirat, openat};
-    use rustix::io::Errno;
-    use std::{io, io::Read, io::Write, os::unix::fs::MetadataExt, time::Duration};
-
-    const POLL_INTERVAL: Duration = Duration::from_millis(10);
-    const LOCK_TIMEOUT: Duration = Duration::from_secs(30);
-
-    struct Opened {
-        root: File,
-        seals: File,
-        key: File,
-        admission: File,
-        active: File,
-        domain: Domain,
-    }
-
-    fn invalid() -> io::Error {
-        io::Error::new(io::ErrorKind::InvalidData, "invalid artifact seal filesystem state")
-    }
-
-    fn directory(parent: &File, name: &str, device: u64) -> io::Result<File> {
-        match mkdirat(parent, name, Mode::RWXU) {
-            Ok(()) | Err(Errno::EXIST) => {}
-            Err(error) => return Err(error.into()),
-        }
-        let file = File::from(openat(
-            parent,
-            name,
-            OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC,
-            Mode::empty(),
-        )?);
-        let metadata = file.metadata()?;
-        if !metadata.is_dir() || metadata.dev() != device || metadata.mode() & 0o077 != 0 {
-            return Err(invalid());
-        }
-        Ok(file)
-    }
-
-    fn regular(file: &File, device: u64) -> io::Result<std::fs::Metadata> {
-        let metadata = file.metadata()?;
-        if !metadata.is_file() || metadata.dev() != device || metadata.nlink() != 1 || metadata.mode() & 0o077 != 0 {
-            return Err(invalid());
-        }
-        Ok(metadata)
-    }
-
-    fn lock_file(parent: &File, name: &str, device: u64) -> io::Result<File> {
-        let file = File::from(openat(
-            parent,
-            name,
-            OFlags::CREATE | OFlags::RDWR | OFlags::NOFOLLOW | OFlags::CLOEXEC | OFlags::NONBLOCK,
-            Mode::RUSR | Mode::WUSR,
-        )?);
-        if regular(&file, device)?.len() != 0 {
-            return Err(invalid());
-        }
-        Ok(file)
-    }
-
-    impl Opened {
-        fn open(root: File, key: [u8; 32], domain: Domain) -> io::Result<Self> {
-            let metadata = root.metadata()?;
-            if !metadata.is_dir() {
-                return Err(invalid());
-            }
-            let seals = directory(&root, domain.directory(), metadata.dev())?;
-            let name = hex_simd::encode_to_string(key, hex_simd::AsciiCase::Lower);
-            let key = directory(&seals, &name, metadata.dev())?;
-            // Neither lock inode is ever removed or replaced, including after
-            // closing. Independent processes must always lock the same inode.
-            let admission = lock_file(&key, "admission.lock", metadata.dev())?;
-            let active = lock_file(&key, "active.lock", metadata.dev())?;
-            Ok(Self {
-                root,
-                seals,
-                key,
-                admission,
-                active,
-                domain,
-            })
-        }
-
-        fn closed(&self) -> io::Result<Option<File>> {
-            self.closed_with_flags(OFlags::RDWR)
-        }
-
-        fn closed_with_flags(&self, access: OFlags) -> io::Result<Option<File>> {
-            let mut file = match openat(
-                &self.key,
-                "closed",
-                access | OFlags::NOFOLLOW | OFlags::CLOEXEC | OFlags::NONBLOCK,
-                Mode::empty(),
-            ) {
-                Ok(file) => File::from(file),
-                Err(Errno::NOENT) => return Ok(None),
-                Err(error) => return Err(error.into()),
-            };
-            let length = u64::try_from(self.domain.closed().len()).map_err(|_| invalid())?;
-            if regular(&file, self.root.metadata()?.dev())?.len() != length {
-                return Err(invalid());
-            }
-            let mut bytes = vec![0; self.domain.closed().len()];
-            file.read_exact(&mut bytes)?;
-            if bytes != self.domain.closed() {
-                return Err(invalid());
-            }
-            Ok(Some(file))
-        }
-
-        fn admit(self) -> io::Result<Arc<ArtifactLease>> {
-            if self.closed()?.is_some() {
-                return Err(io::Error::new(
-                    io::ErrorKind::PermissionDenied,
-                    "artifact attempt mutation domain is closed",
-                ));
-            }
-            // Admission serializes the closed check with taking this shared
-            // physical owner. A sealer cannot pass between those two steps.
-            flock(&self.active, FlockOperation::NonBlockingLockShared)?;
-            flock(&self.admission, FlockOperation::Unlock)?;
-            Ok(Arc::new(ArtifactLease {
-                _active: self.active,
-                _key_directory: self.key,
-                _seal_directory: self.seals,
-                _root: self.root,
-            }))
-        }
-
-        fn close(self) -> io::Result<Self> {
-            let marker = match self.closed()? {
-                Some(marker) => marker,
-                None => {
-                    let mut marker = File::from(openat(
-                        &self.key,
-                        "closed",
-                        OFlags::CREATE | OFlags::EXCL | OFlags::RDWR | OFlags::NOFOLLOW | OFlags::CLOEXEC,
-                        Mode::RUSR | Mode::WUSR,
-                    )?);
-                    regular(&marker, self.root.metadata()?.dev())?;
-                    marker.write_all(self.domain.closed())?;
-                    marker
-                }
-            };
-            // No admission is released until the permanent denial and every
-            // ancestor entry are durable. A failed/cancelled close never removes it.
-            marker.sync_all()?;
-            self.admission.sync_all()?;
-            self.active.sync_all()?;
-            self.key.sync_all()?;
-            self.seals.sync_all()?;
-            self.root.sync_all()?;
-            flock(&self.admission, FlockOperation::Unlock)?;
-            Ok(self)
-        }
-    }
-
-    async fn lock(file: &File, operation: FlockOperation) -> io::Result<()> {
-        tokio::time::timeout(LOCK_TIMEOUT, async {
-            loop {
-                match flock(file, operation) {
-                    Ok(()) => return Ok(()),
-                    Err(Errno::WOULDBLOCK | Errno::INTR) => tokio::time::sleep(POLL_INTERVAL).await,
-                    Err(error) => return Err(error.into()),
-                }
-            }
-        })
-        .await
-        .map_err(|_| io::Error::new(io::ErrorKind::TimedOut, "artifact disk lease lock deadline"))?
-    }
-
-    async fn open(root: File, key: [u8; 32], domain: Domain) -> Result<Opened> {
-        tokio::task::spawn_blocking(move || Opened::open(root, key, domain))
-            .await
-            .map_err(DiskError::from)?
-            .map_err(DiskError::from)
-    }
-
-    fn read_error(error: io::Error) -> DiskError {
-        match error.kind() {
-            io::ErrorKind::NotFound => DiskError::other("artifact inventory requires closed PUT and repair domains"),
-            io::ErrorKind::InvalidData | io::ErrorKind::NotADirectory => DiskError::FileCorrupt,
-            io::ErrorKind::TimedOut => DiskError::Timeout,
-            _ if error.raw_os_error() == Some(Errno::LOOP.raw_os_error()) => DiskError::FileCorrupt,
-            _ => DiskError::from(error),
-        }
-    }
-
-    fn existing_directory(parent: &File, name: &str, device: u64) -> io::Result<File> {
-        let file = File::from(openat(
-            parent,
-            name,
-            OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC,
-            Mode::empty(),
-        )?);
-        let metadata = file.metadata()?;
-        if metadata.dev() != device || metadata.mode() & 0o077 != 0 {
-            return Err(invalid());
-        }
-        Ok(file)
-    }
-
-    fn existing(root: File, key: [u8; 32], domain: Domain) -> io::Result<Opened> {
-        let device = root.metadata()?.dev();
-        let seals = existing_directory(&root, domain.directory(), device)?;
-        let name = hex_simd::encode_to_string(key, hex_simd::AsciiCase::Lower);
-        let key = existing_directory(&seals, &name, device)?;
-        let lock = |name| -> io::Result<File> {
-            let file = File::from(openat(
-                &key,
-                name,
-                OFlags::RDONLY | OFlags::NOFOLLOW | OFlags::CLOEXEC | OFlags::NONBLOCK,
-                Mode::empty(),
-            )?);
-            if regular(&file, device)?.len() != 0 {
-                return Err(invalid());
-            }
-            Ok(file)
-        };
-        let admission = lock("admission.lock")?;
-        let active = lock("active.lock")?;
-        let opened = Opened {
-            root,
-            seals,
-            key,
-            admission,
-            active,
-            domain,
-        };
-        if opened.closed_with_flags(OFlags::RDONLY)?.is_none() {
-            return Err(io::Error::from(io::ErrorKind::NotFound));
-        }
-        Ok(opened)
-    }
-
-    fn retained(opened: Opened) -> Arc<ArtifactLease> {
-        Arc::new(ArtifactLease {
-            _active: opened.active,
-            _key_directory: opened.key,
-            _seal_directory: opened.seals,
-            _root: opened.root,
-        })
-    }
-
-    pub(super) async fn drain_closed(
-        root: File,
-        key: [u8; 32],
-        deadline: tokio::time::Instant,
-    ) -> Result<ArtifactInventoryLease> {
-        let (put, repair) = tokio::task::spawn_blocking(move || {
-            let put = existing(root.try_clone()?, key, Domain::Put)?;
-            let repair = existing(root, key, Domain::Repair)?;
-            Ok::<_, io::Error>((put, repair))
-        })
-        .await
-        .map_err(DiskError::from)?
-        .map_err(read_error)?;
-        // Lock order: closed PUT active exclusive -> closed repair active
-        // exclusive. No admission lock is acquired and no seal is created.
-        tokio::time::timeout_at(deadline, async {
-            lock(&put.active, FlockOperation::NonBlockingLockExclusive).await?;
-            lock(&repair.active, FlockOperation::NonBlockingLockExclusive).await
-        })
-        .await
-        .map_err(|_| DiskError::Timeout)?
-        .map_err(read_error)?;
-        Ok(ArtifactInventoryLease {
-            _put: retained(put),
-            _repair: retained(repair),
-        })
-    }
-
-    pub(super) async fn acquire(root: File, key: [u8; 32], domain: Domain) -> Result<Arc<ArtifactLease>> {
-        let opened = open(root, key, domain).await?;
-        // Lock order: admission exclusive -> active shared. Contention sleeps
-        // asynchronously; no blocking executor thread waits for another owner.
-        lock(&opened.admission, FlockOperation::NonBlockingLockExclusive).await?;
-        tokio::task::spawn_blocking(move || opened.admit())
-            .await
-            .map_err(DiskError::from)?
-            .map_err(DiskError::from)
-    }
-
-    pub(super) async fn seal(root: File, key: [u8; 32], domain: Domain) -> Result<()> {
-        let opened = open(root, key, domain).await?;
-        lock(&opened.admission, FlockOperation::NonBlockingLockExclusive).await?;
-        let opened = tokio::task::spawn_blocking(move || opened.close())
-            .await
-            .map_err(DiskError::from)??;
-        // Closing is already durable. Cancellation or timeout here only loses
-        // the confirmation; admission stays permanently closed across reopen.
-        lock(&opened.active, FlockOperation::NonBlockingLockExclusive).await?;
-        Ok(())
-    }
-}
-
-#[cfg(all(test, unix))]
-mod tests {
-    use super::*;
-    use std::{path::Path, time::Duration};
-
-    const KEY: [u8; 32] = [7; 32];
-
-    fn root(path: &Path) -> File {
-        use rustix::fs::{Mode, OFlags, open};
-        File::from(
-            open(
-                path,
-                OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC,
-                Mode::empty(),
-            )
-            .expect("open pinned test root"),
-        )
-    }
-
-    fn directory(path: &Path) -> std::path::PathBuf {
-        path.join(Domain::Put.directory())
-            .join(hex_simd::encode_to_string(KEY, hex_simd::AsciiCase::Lower))
-    }
-
-    async fn closed(path: &Path) {
-        tokio::time::timeout(Duration::from_secs(5), async {
-            while !directory(path).join("closed").exists() {
-                tokio::time::sleep(Duration::from_millis(5)).await;
-            }
-        })
-        .await
-        .expect("sealer reaches its monotonic close point");
-    }
-
-    #[tokio::test]
-    async fn artifact_repair_closing_domain_is_independent_and_survives_reopen() {
-        let temp = tempfile::tempdir().expect("disk root");
-        seal(root(temp.path()), KEY).await.expect("PUT closes first");
-        let repair = acquire_in(root(temp.path()), KEY, Domain::Repair)
-            .await
-            .expect("PUT closure permits existing-version repair");
-        assert!(acquire(root(temp.path()), KEY).await.is_err());
-        drop(repair);
-        seal_in(root(temp.path()), KEY, Domain::Repair)
-            .await
-            .expect("repair closes independently");
-        assert!(acquire_in(root(temp.path()), KEY, Domain::Repair).await.is_err());
-        seal_in(root(temp.path()), KEY, Domain::Repair)
-            .await
-            .expect("reopened repair close is durable");
-
-        let other = [8; 32];
-        seal_in(root(temp.path()), other, Domain::Repair)
-            .await
-            .expect("close only repair admission");
-        drop(
-            acquire(root(temp.path()), other)
-                .await
-                .expect("repair closure permits PUT domain"),
-        );
-    }
-
-    #[tokio::test]
-    async fn artifact_repair_cancelled_waiter_keeps_physical_owner_and_durable_close() {
-        let temp = tempfile::tempdir().expect("disk root");
-        let writer = acquire_in(root(temp.path()), KEY, Domain::Repair)
-            .await
-            .expect("repair admitted");
-        let (entered, started) = tokio::sync::oneshot::channel();
-        let (release, waiting) = std::sync::mpsc::channel();
-        let owner = tokio::spawn(async move {
-            tokio::task::spawn_blocking(move || {
-                let _owner = writer;
-                let _ = entered.send(());
-                let _ = waiting.recv();
-            })
-            .await
-            .expect("repair worker");
-        });
-        started.await.expect("physical repair entered");
-        owner.abort();
-        assert!(owner.await.expect_err("cancel repair waiter").is_cancelled());
-        let sealer = tokio::spawn(seal_in(root(temp.path()), KEY, Domain::Repair));
-        let marker = temp
-            .path()
-            .join(Domain::Repair.directory())
-            .join(hex_simd::encode_to_string(KEY, hex_simd::AsciiCase::Lower))
-            .join("closed");
-        tokio::time::timeout(Duration::from_secs(5), async {
-            while !marker.exists() {
-                tokio::time::sleep(Duration::from_millis(5)).await;
-            }
-        })
-        .await
-        .expect("repair admission durably closes");
-        assert!(!sealer.is_finished(), "ARTIFACT_REPAIR_CANCELLED_PHYSICAL_TAIL");
-        sealer.abort();
-        assert!(sealer.await.expect_err("cancel repair close waiter").is_cancelled());
-        assert!(acquire_in(root(temp.path()), KEY, Domain::Repair).await.is_err());
-        let pending = seal_in(root(temp.path()), KEY, Domain::Repair);
-        tokio::pin!(pending);
-        assert!(
-            tokio::time::timeout(Duration::from_millis(50), &mut pending).await.is_err(),
-            "ARTIFACT_REPAIR_REOPEN_MUST_DRAIN_PHYSICAL_TAIL"
-        );
-        release.send(()).expect("release physical repair");
-        tokio::time::timeout(Duration::from_secs(5), &mut pending)
-            .await
-            .expect("physical drain bounded")
-            .expect("reopened close confirms repair drain");
-        assert!(acquire_in(root(temp.path()), KEY, Domain::Repair).await.is_err());
-    }
-
-    #[tokio::test]
-    async fn artifact_put_seal_waits_for_independent_openers_and_last_clone() {
-        let temp = tempfile::tempdir().expect("disk root");
-        let first = acquire(root(temp.path()), KEY).await.expect("first admitted writer");
-        let tail = first.clone();
-        let second = acquire(root(temp.path()), KEY).await.expect("independent shared writer");
-        let pending = seal(root(temp.path()), KEY);
-        tokio::pin!(pending);
-        assert!(
-            tokio::time::timeout(Duration::from_millis(50), &mut pending).await.is_err(),
-            "ARTIFACT_PUT_ACTIVE_WRITERS_DRAIN"
-        );
-        drop(first);
-        drop(second);
-        assert!(
-            tokio::time::timeout(Duration::from_millis(50), &mut pending).await.is_err(),
-            "ARTIFACT_PUT_PHYSICAL_CLONE_RETAINED"
-        );
-        assert!(acquire(root(temp.path()), KEY).await.is_err(), "ARTIFACT_PUT_CLOSE_REJECTS_ADMISSION");
-        drop(tail);
-        tokio::time::timeout(Duration::from_secs(5), &mut pending)
-            .await
-            .expect("physical tail drain bounded")
-            .expect("seal complete");
-        seal(root(temp.path()), KEY)
-            .await
-            .expect("independent reopen preserves closed state");
-        assert!(acquire(root(temp.path()), KEY).await.is_err(), "ARTIFACT_PUT_CLOSED_AFTER_REOPEN");
-    }
-
-    #[tokio::test]
-    async fn artifact_put_close_cancellation_leaves_durable_denial() {
-        let temp = tempfile::tempdir().expect("disk root");
-        let writer = acquire(root(temp.path()), KEY).await.expect("admitted writer");
-        let sealer = tokio::spawn(seal(root(temp.path()), KEY));
-        closed(temp.path()).await;
-        sealer.abort();
-        assert!(sealer.await.expect_err("cancel close waiter").is_cancelled());
-        assert!(
-            acquire(root(temp.path()), KEY).await.is_err(),
-            "ARTIFACT_PUT_CANCELLED_CLOSE_STAYS_CLOSED"
-        );
-        drop(writer);
-        seal(root(temp.path()), KEY).await.expect("reopen finishes physical drain");
-        assert!(acquire(root(temp.path()), KEY).await.is_err(), "ARTIFACT_PUT_CANCELLED_CLOSE_REOPEN");
-    }
-
-    #[tokio::test]
-    async fn artifact_put_physical_worker_retains_lease_after_waiter_cancellation() {
-        let temp = tempfile::tempdir().expect("disk root");
-        let writer = acquire(root(temp.path()), KEY).await.expect("physical writer admitted");
-        let (entered, started) = tokio::sync::oneshot::channel();
-        let (release, waiting) = std::sync::mpsc::channel();
-        let owner = tokio::spawn(async move {
-            tokio::task::spawn_blocking(move || {
-                let _physical_owner = writer;
-                let _ = entered.send(());
-                let _ = waiting.recv();
-            })
-            .await
-            .expect("physical worker");
-        });
-        started.await.expect("physical syscall entered");
-        owner.abort();
-        assert!(owner.await.expect_err("cancel async writer").is_cancelled());
-        let pending = seal(root(temp.path()), KEY);
-        tokio::pin!(pending);
-        assert!(
-            tokio::time::timeout(Duration::from_millis(50), &mut pending).await.is_err(),
-            "ARTIFACT_PUT_CANCELLED_PHYSICAL_TAIL"
-        );
-        release.send(()).expect("release physical worker");
-        tokio::time::timeout(Duration::from_secs(5), &mut pending)
-            .await
-            .expect("physical worker drains")
-            .expect("seal confirms real completion");
-    }
-
-    #[tokio::test]
-    async fn artifact_put_seal_waits_for_another_process() {
-        const CHILD_ROOT: &str = "RUSTFS_TEST_ARTIFACT_PUT_SEAL_ROOT";
-        if let Some(path) = std::env::var_os(CHILD_ROOT) {
-            seal(root(Path::new(&path)), KEY)
-                .await
-                .expect("child closes and drains parent writer");
-            assert!(acquire(root(Path::new(&path)), KEY).await.is_err(), "ARTIFACT_PUT_CHILD_CLOSED");
-            return;
-        }
-        struct Child(std::process::Child);
-        impl Drop for Child {
-            fn drop(&mut self) {
-                let _ = self.0.kill();
-                let _ = self.0.wait();
-            }
-        }
-        let temp = tempfile::tempdir().expect("disk root");
-        let writer = acquire(root(temp.path()), KEY).await.expect("parent owns physical write");
-        let mut child = Child(
-            std::process::Command::new(std::env::current_exe().expect("test executable"))
-                .args([
-                    "--exact",
-                    "disk::local::artifact_lease::tests::artifact_put_seal_waits_for_another_process",
-                ])
-                .env(CHILD_ROOT, temp.path())
-                .spawn()
-                .expect("start independent sealer"),
-        );
-        closed(temp.path()).await;
-        assert!(child.0.try_wait().expect("probe child").is_none(), "ARTIFACT_PUT_CROSS_PROCESS_DRAIN");
-        assert!(
-            acquire(root(temp.path()), KEY).await.is_err(),
-            "ARTIFACT_PUT_CROSS_PROCESS_ADMISSION_CLOSED"
-        );
-        drop(writer);
-        let status = tokio::time::timeout(Duration::from_secs(5), async {
-            loop {
-                if let Some(status) = child.0.try_wait().expect("child wait") {
-                    break status;
-                }
-                tokio::time::sleep(Duration::from_millis(10)).await;
-            }
-        })
-        .await
-        .expect("child physically drains");
-        assert!(status.success(), "ARTIFACT_PUT_CROSS_PROCESS_SEAL");
-        assert!(acquire(root(temp.path()), KEY).await.is_err(), "ARTIFACT_PUT_PROCESS_REOPEN_CLOSED");
-    }
-
-    #[tokio::test]
-    async fn artifact_put_lease_rejects_symlinks_at_every_seal_component() {
-        use std::os::unix::fs::{PermissionsExt, symlink};
-        for component in ["directory", "key", "admission.lock", "active.lock", "closed"] {
-            let temp = tempfile::tempdir().expect("disk root");
-            let outside = tempfile::tempdir().expect("symlink destination");
-            let sentinel = outside.path().join("untouched");
-            std::fs::write(&sentinel, b"unchanged").expect("sentinel");
-            let target = match component {
-                "directory" => temp.path().join(Domain::Put.directory()),
-                "key" => {
-                    std::fs::create_dir(temp.path().join(Domain::Put.directory())).expect("seal directory");
-                    std::fs::set_permissions(temp.path().join(Domain::Put.directory()), std::fs::Permissions::from_mode(0o700))
-                        .expect("private seal directory");
-                    directory(temp.path())
-                }
-                file => {
-                    drop(acquire(root(temp.path()), KEY).await.expect("initialize seal files"));
-                    let target = directory(temp.path()).join(file);
-                    if file != "closed" {
-                        std::fs::remove_file(&target).expect("replace fixture lock");
-                    }
-                    target
-                }
-            };
-            symlink(
-                if matches!(component, "directory" | "key") {
-                    outside.path()
-                } else {
-                    &sentinel
-                },
-                target,
-            )
-            .expect("symlink fixture");
-            assert!(
-                acquire(root(temp.path()), KEY).await.is_err(),
-                "ARTIFACT_PUT_SYMLINK_REJECTED: {component}"
-            );
-            assert!(
-                seal(root(temp.path()), KEY).await.is_err(),
-                "ARTIFACT_PUT_SYMLINK_SEAL_REJECTED: {component}"
-            );
-            assert_eq!(std::fs::read(&sentinel).expect("sentinel intact"), b"unchanged");
-        }
-    }
-
-    #[tokio::test]
-    async fn artifact_put_lease_rejects_corrupt_closed_marker() {
-        use std::os::unix::fs::PermissionsExt;
-        let temp = tempfile::tempdir().expect("disk root");
-        drop(acquire(root(temp.path()), KEY).await.expect("initialize seal files"));
-        let marker = directory(temp.path()).join("closed");
-        std::fs::write(&marker, b"partial").expect("corrupt marker fixture");
-        std::fs::set_permissions(&marker, std::fs::Permissions::from_mode(0o600)).expect("marker permissions");
-        assert!(acquire(root(temp.path()), KEY).await.is_err(), "ARTIFACT_PUT_CORRUPT_MARKER_FAILS_CLOSED");
-        assert!(seal(root(temp.path()), KEY).await.is_err(), "ARTIFACT_PUT_CORRUPT_MARKER_NOT_CONFIRMED");
-        assert_eq!(std::fs::read(marker).expect("corruption retained"), b"partial");
-    }
-
-    #[tokio::test]
-    async fn artifact_put_lease_stays_on_pinned_root_after_path_replacement() {
-        let temp = tempfile::tempdir().expect("disk root parent");
-        let current = temp.path().join("current");
-        let original = temp.path().join("original");
-        std::fs::create_dir(&current).expect("initial disk root");
-        let pin = root(&current);
-        drop(
-            acquire(pin.try_clone().expect("root pin clone"), KEY)
-                .await
-                .expect("initialize pinned seal"),
-        );
-        std::fs::rename(&current, &original).expect("replace configured pathname");
-        std::fs::create_dir(&current).expect("replacement disk root");
-        seal(pin, KEY).await.expect("close original disk through its descriptor");
-        assert!(directory(&original).join("closed").exists(), "ARTIFACT_PUT_ROOT_PINNED");
-        assert!(!current.join(Domain::Put.directory()).exists(), "ARTIFACT_PUT_REPLACEMENT_UNTOUCHED");
-        assert!(acquire(root(&original), KEY).await.is_err());
-    }
-}

crates/ecstore/src/disk/local/commit.rs

@@ -345,8 +345,6 @@ async fn prepare_rename_commit_and_destination_metadata(
         let publication_root = publication_root.clone();
         os::run_blocking_namespace_operation(mutation_lease, move || {
             if create_source_parent {
-                #[cfg(test)]
-                super::volume_mutation_test_hooks::run(super::volume_mutation_test_hooks::Stage::Create, &source_parent);
                 std::fs::create_dir_all(&source_parent)?;
             }
             let guard = match os::prepare_rename_commit_guard(&source_parent, &destination_parent, &base_dir, &publication_root) {
@@ -367,15 +365,9 @@ async fn prepare_rename_commit_and_destination_metadata(
     };
     #[cfg(not(any(windows, target_os = "linux")))]
     let result = {
+        let _ = mutation_lease;
         if create_source_parent {
-            let source_parent = source_parent.to_path_buf();
-            os::run_blocking_namespace_operation(mutation_lease, move || {
-                #[cfg(test)]
-                super::volume_mutation_test_hooks::run(super::volume_mutation_test_hooks::Stage::Create, &source_parent);
-                std::fs::create_dir_all(source_parent)
-            })
-            .await
-            .map_err(to_file_error)?;
+            fs::create_dir_all(source_parent).await.map_err(to_file_error)?;
         }
         let guard =
             os::prepare_rename_commit_guard(source_parent, destination_parent, base_dir, publication_root).map_err(|err| {
@@ -406,31 +398,30 @@ pub(in crate::disk) struct LocalRenamePreflightRejection(());
 pub(super) struct RenameDataState {
     namespace_owner: Option<Arc<dyn Send + Sync>>,
     preflight_rejection: Option<LocalRenamePreflightRejection>,
-    prepared: Option<Arc<os::NamespaceMutationLease>>,
-}
-
-pub(in crate::disk) struct PreparedRenameData {
-    file_info: FileInfo,
-    mutation_lease: Arc<os::NamespaceMutationLease>,
 }
 
 impl LocalDisk {
-    async fn prepare_rename_data_admission(
+    #[tracing::instrument(name = "rename_data", target = "rustfs_ecstore::disk::local", level = "trace", skip_all)]
+    pub(super) async fn rename_data_inner(
         &self,
+        src_volume: &str,
+        src_path: &str,
         fi: FileInfo,
-        source: (&str, &str),
-        destination: (&str, &str),
-        source_volume: Option<&str>,
-        namespace_owner: Option<Arc<dyn Send + Sync>>,
-    ) -> Result<PreparedRenameData> {
-        let (src_volume, src_path) = source;
-        let (dst_volume, dst_path) = destination;
+        dst_volume: &str,
+        dst_path: &str,
+        state: &mut RenameDataState,
+    ) -> Result<RenameDataResp> {
+        crate::hp_guard!("LocalDisk::rename_data");
+        #[cfg(feature = "e2e-test-hooks")]
+        if fi.is_healing() {
+            wait_for_heal_commit_test_barrier(&self.root, dst_volume, dst_path).await?;
+        }
         let mut fi = fi;
         // A non-force DeleteBucket must not remove a directory while a local
         // object commit is publishing into it. The peer's empty scan remains
         // optimistic; this lease establishes the local commit/delete order and
         // remains owned by any blocking syscall that outlives async cancellation.
-        let destination_object_path = self.io_get_object_path(dst_volume, dst_path)?;
+        let (dst_volume_dir, destination_object_path) = self.io_get_bucket_and_object_path(dst_volume, dst_path)?;
         let quota_fence_token =
             match rustfs_utils::http::metadata_compat::get_consistent_str(&fi.metadata, QUOTA_MUTATION_FENCE_METADATA_SUFFIX) {
                 Some(value) => {
@@ -464,27 +455,16 @@ impl LocalDisk {
                 .strip_prefix(self.io_root())
                 .map_err(|_| DiskError::InvalidPath)?,
         );
-        let metadata_lease = os::acquire_metadata_mutation_lease(&root_destination_object_path, namespace_owner).await;
-        let mutation_lease = if let Some(source_volume) = source_volume {
-            os::acquire_rename_data_mutation_lease_for_volumes(
-                &self.root,
-                source_volume,
-                dst_volume,
-                &destination_object_path,
-                staging_prefix.as_deref(),
-                Some(metadata_lease),
-            )
-            .await
-        } else {
-            os::acquire_rename_data_mutation_lease_with_owner(
-                &self.root,
-                dst_volume,
-                &destination_object_path,
-                staging_prefix.as_deref(),
-                Some(metadata_lease),
-            )
-            .await
-        };
+        let metadata_lease =
+            os::acquire_metadata_mutation_lease(&root_destination_object_path, state.namespace_owner.take()).await;
+        let mutation_lease = os::acquire_rename_data_mutation_lease_with_owner(
+            &self.root,
+            dst_volume,
+            &destination_object_path,
+            staging_prefix.as_deref(),
+            Some(metadata_lease),
+        )
+        .await;
         if let Some(claim) = quota_fence_claim {
             mutation_lease.attach_external_guard(claim);
         }
@@ -492,99 +472,6 @@ impl LocalDisk {
             fi.erasure.index = 0;
         }
         fi.validate_for_metadata_read()?;
-        Ok(PreparedRenameData {
-            file_info: fi,
-            mutation_lease,
-        })
-    }
-
-    pub(in crate::disk) async fn begin_legacy_rename_data(
-        &self,
-        source: (&str, &str),
-        fi: &FileInfo,
-        destination: (&str, &str),
-        permit: crate::disk::io_admission::DiskIoPermit,
-        namespace_owner: Option<Arc<dyn Send + Sync>>,
-    ) -> Result<PreparedRenameData> {
-        // Capture the same permit, mount FD and listener-instance owner before
-        // quota -> metadata -> namespace -> sorted volume READ admission.
-        #[cfg(target_os = "linux")]
-        let owner: Arc<dyn Send + Sync> = Arc::new((permit, self.mount_lease.clone(), namespace_owner));
-        #[cfg(not(target_os = "linux"))]
-        let owner: Arc<dyn Send + Sync> = Arc::new((permit, namespace_owner));
-        let prepared = self
-            .prepare_rename_data_admission(fi.clone(), source, destination, Some(source.0), Some(owner))
-            .await?;
-        for volume in [Some(source.0), (source.0 != destination.0).then_some(destination.0)]
-            .into_iter()
-            .flatten()
-        {
-            if !skip_access_checks(volume) {
-                let path = self.io_get_bucket_path(volume)?;
-                let metadata = fs::symlink_metadata(path)
-                    .await
-                    .map_err(crate::disk::error_conv::to_volume_error)?;
-                if !metadata.is_dir() {
-                    return Err(DiskError::VolumeNotFound);
-                }
-            }
-        }
-        Ok(prepared)
-    }
-
-    pub(in crate::disk) async fn rename_data_prepared(
-        &self,
-        source: (&str, &str),
-        destination: (&str, &str),
-        prepared: PreparedRenameData,
-    ) -> Result<RenameDataResp> {
-        let PreparedRenameData {
-            file_info,
-            mutation_lease,
-        } = prepared;
-        let mut state = RenameDataState {
-            prepared: Some(mutation_lease),
-            ..Default::default()
-        };
-        self.rename_data_inner(source.0, source.1, file_info, destination.0, destination.1, &mut state)
-            .await
-    }
-
-    #[tracing::instrument(name = "rename_data", target = "rustfs_ecstore::disk::local", level = "trace", skip_all)]
-    pub(super) async fn rename_data_inner(
-        &self,
-        src_volume: &str,
-        src_path: &str,
-        fi: FileInfo,
-        dst_volume: &str,
-        dst_path: &str,
-        state: &mut RenameDataState,
-    ) -> Result<RenameDataResp> {
-        crate::hp_guard!("LocalDisk::rename_data");
-        #[cfg(feature = "e2e-test-hooks")]
-        if fi.is_healing() {
-            wait_for_heal_commit_test_barrier(&self.root, dst_volume, dst_path).await?;
-        }
-        let PreparedRenameData {
-            file_info: fi,
-            mutation_lease,
-        } = if let Some(mutation_lease) = state.prepared.take() {
-            PreparedRenameData {
-                file_info: fi,
-                mutation_lease,
-            }
-        } else {
-            self.prepare_rename_data_admission(
-                fi,
-                (src_volume, src_path),
-                (dst_volume, dst_path),
-                None,
-                state.namespace_owner.take(),
-            )
-            .await?
-        };
-        let no_inline = fi.data.is_none() && fi.size > 0;
-        let fi_healing = fi.is_healing();
         // Snapshot the destination part paths before `fi` is consumed below. These
         // are the descriptors a reader may hold for the version this call is about
         // to replace (backlog#1145); readers build the identical string in
@@ -620,7 +507,6 @@ impl LocalDisk {
             return Err(to_access_error(e, DiskError::VolumeAccessDenied).into());
         }
 
-        let dst_volume_dir = self.io_get_bucket_path(dst_volume)?;
         if !skip_access_checks(dst_volume)
             && let Err(e) = super::super::fs::access_std(&dst_volume_dir)
         {
@@ -638,19 +524,24 @@ impl LocalDisk {
             return Err(to_access_error(e, DiskError::VolumeAccessDenied).into());
         }
 
-        // Keep recovery authority separate from active upload metadata so a
-        // committed upload cannot reopen when set-level cleanup fails.
-        let preserve_upload_metadata = src_volume == super::super::RUSTFS_META_MULTIPART_BUCKET;
-        let source_metadata_name = if preserve_upload_metadata {
-            super::super::MULTIPART_COMMIT_METADATA_FILE
-        } else {
-            STORAGE_FORMAT_FILE
-        };
-        let src_file_path = self.io_get_object_path(src_volume, format!("{src_path}/{source_metadata_name}").as_str())?;
+        // xl.meta path
+        let src_file_path = self.io_get_object_path(src_volume, format!("{}/{}", src_path, STORAGE_FORMAT_FILE).as_str())?;
         let dst_file_path = self.io_get_object_open_path(dst_volume, format!("{}/{}", dst_path, STORAGE_FORMAT_FILE).as_str())?;
 
+        // Multipart restore completion has validated staged local parts,
+        // while its public status stays pending until finalization.
+        let pending_multipart_restore = src_volume == crate::disk::RUSTFS_META_MULTIPART_BUCKET
+            && fi
+                .metadata
+                .get(rustfs_filemeta::metadata_keys::RESTORE)
+                .and_then(|value| rustfs_filemeta::parse_restore_obj_status(value).ok())
+                .is_some_and(|status| status.is_restore_in_progress == Some(true));
+        if pending_multipart_restore && fi.data_dir.is_none_or(|dir| dir.is_nil()) {
+            return Err(DiskError::FileCorrupt);
+        }
+
         // data_dir path (only used by the non-inline commit branch)
-        let has_data_dir_path = if no_inline && !fi.is_remote() {
+        let has_data_dir_path = if no_inline && (!fi.is_remote() || pending_multipart_restore) {
             if let Some(data_dir) = fi
                 .data_dir
                 .map(|dir| rustfs_utils::path::retain_slash(dir.to_string().as_str()))
@@ -711,35 +602,6 @@ impl LocalDisk {
             data_paths: has_data_dir_path.as_ref(),
         };
 
-        if preserve_upload_metadata {
-            let source_object_path = self.get_object_path(src_volume, src_path)?;
-            let authority_owner: Arc<dyn Send + Sync> = if source_object_path == self.get_object_path(dst_volume, dst_path)? {
-                commit.mutation_lease.clone()
-            } else {
-                os::try_acquire_metadata_mutation_lease_with_owner(&source_object_path, commit.mutation_lease.clone())?
-            };
-            let authority = self.io_get_object_path(src_volume, &format!("{src_path}/{STORAGE_FORMAT_FILE}"))?;
-            let recovery = self.io_get_object_path(
-                src_volume,
-                &format!("{src_path}/{}/{STORAGE_FORMAT_FILE}", super::super::MULTIPART_RECOVERY_DIR),
-            )?;
-            check_path_length(recovery.to_string_lossy().as_ref())?;
-            // Both volume READs are already held. Neither source key may wait
-            // behind a competing owner that is queued behind a volume WRITE.
-            let recovery_lease = os::try_acquire_namespace_mutation_lease_with_owner(&recovery, authority_owner.clone())?;
-            os::rename_all_with_lease(&authority, &recovery, &src_volume_dir, commit.publication_root, recovery_lease).await?;
-            // This is system metadata authority, so use its existing strict
-            // durability policy even when the object payload is relaxed.
-            if effective_durability(src_volume).syncs_commit_metadata() {
-                os::fsync_dir_with_owner(recovery.parent().ok_or(DiskError::InvalidPath)?, Some(authority_owner.clone()))
-                    .await
-                    .map_err(to_file_error)?;
-                os::fsync_dir_with_owner(src_file_parent, Some(authority_owner.clone()))
-                    .await
-                    .map_err(to_file_error)?;
-            }
-        }
-
         if no_inline {
             // Non-inline: read xl.meta, parse, write, rename data dir, rename xl.meta
             let mut xlmeta = FileMeta::new();
@@ -948,7 +810,7 @@ impl LocalDisk {
             if let (Some(old_data_dir), Some(dst_buf)) = (rollback_data_dir, has_dst_buf.as_ref()) {
                 let backup_parent = dst_file_parent.join(old_data_dir.to_string());
                 #[cfg(not(windows))]
-                if let Err(err) = os::make_dir_all_with_owner(&backup_parent, &skip_parent, commit.mutation_lease.clone()).await {
+                if let Err(err) = os::make_dir_all(&backup_parent, &skip_parent).await {
                     commit.restore_published_data_source().await?;
                     return Err(err);
                 }
@@ -1127,8 +989,14 @@ impl LocalDisk {
             #[cfg(windows)]
             drop(commit.directory_guard);
 
-            if !preserve_upload_metadata && let Some(parent) = src_file_path.parent() {
-                let _ = std::fs::remove_dir(parent);
+            if let Some(src_file_path_parent) = src_file_path.parent() {
+                if src_volume != super::super::RUSTFS_META_MULTIPART_BUCKET {
+                    let _ = std::fs::remove_dir(src_file_path_parent);
+                } else {
+                    let _ = self
+                        .delete_file(&dst_volume_dir, &src_file_path_parent.to_path_buf(), true, false)
+                        .await;
+                }
             }
 
             // Heal reuses a version's `data_dir` and lands the rebuilt shard on
@@ -1161,12 +1029,18 @@ impl LocalDisk {
             // allowing a retry to reuse the deterministic staging path too early.
             let src = src_file_path.clone();
             let dst = dst_file_path.clone();
+            let cleanup_path = if src_volume == super::super::RUSTFS_META_MULTIPART_BUCKET {
+                src_file_path.parent().map(|p| p.to_path_buf())
+            } else {
+                None
+            };
             let dst_path_for_failpoint = dst_path.to_string();
             let dst_volume_for_source = dst_volume.to_string();
             let dst_path_for_source = dst_path.to_string();
             let dst_volume_dir_for_commit = dst_volume_dir.clone();
             let publication_root_for_commit = self.publication_root.clone();
-            let cleanup_src_parent = !preserve_upload_metadata;
+            #[cfg(not(windows))]
+            let cleanup_src_parent = cleanup_path.is_none();
             #[cfg(windows)]
             let source_parent = src_file_parent.to_path_buf();
             let rename_commit_guard_for_preparation = commit.directory_guard.clone();
@@ -1366,9 +1240,13 @@ impl LocalDisk {
                     drop(file_sync_admission.take());
                     #[cfg(windows)]
                     drop(commit.directory_guard);
-                    #[cfg(windows)]
-                    if cleanup_src_parent && let Some(parent) = src_file_path.parent() {
-                        let _ = std::fs::remove_dir(parent);
+                    if let Some(ref cleanup) = cleanup_path {
+                        let _ = self.delete_file(&dst_volume_dir, cleanup, true, false).await;
+                    } else {
+                        #[cfg(windows)]
+                        if let Some(parent) = src_file_path.parent() {
+                            let _ = std::fs::remove_dir(parent);
+                        }
                     }
                     for part_path in &invalidate_part_paths {
                         self.io_backend.invalidate_cached_fd(dst_volume, part_path).await;
@@ -1415,25 +1293,18 @@ impl LocalDisk {
                 let backup_path = dst_parent
                     .join(rollback_data_dir.to_string())
                     .join(STORAGE_FORMAT_FILE_BACKUP);
-                // Keep backup mutations serialized, but never wait for a second
-                // namespace while holding the volume READ: its owner can be
-                // queued behind a volume DELETE that is waiting for this commit.
+                // rename_all acquires the backup path's namespace lease. Do not
+                // hold a disk admission while acquiring another namespace lock.
                 drop(file_sync_admission.take());
-                let backup_result =
-                    match os::try_acquire_namespace_mutation_lease_with_owner(&backup_path, commit.mutation_lease.clone()) {
-                        Ok(lease) => {
-                            os::rename_all_with_lease(
-                                staged_backup,
-                                &backup_path,
-                                &dst_volume_dir,
-                                commit.publication_root,
-                                lease,
-                            )
-                            .await
-                        }
-                        Err(err) => Err(err),
-                    };
-                if let Err(err) = backup_result {
+                if let Err(err) = os::rename_all_with_owner(
+                    staged_backup,
+                    &backup_path,
+                    &dst_volume_dir,
+                    commit.publication_root,
+                    Some(commit.mutation_lease.clone()),
+                )
+                .await
+                {
                     let _ = remove_file_if_exists(staged_backup);
                     return Err(err);
                 }
@@ -1593,7 +1464,9 @@ impl LocalDisk {
             }
 
             // Cleanup
-            if cleanup_src_parent && let Some(parent) = src_file_path.parent() {
+            if let Some(ref cleanup) = cleanup_path {
+                let _ = self.delete_file(&dst_volume_dir, cleanup, true, false).await;
+            } else if let Some(parent) = src_file_path.parent() {
                 let _ = std::fs::remove_dir(parent);
             }
 

crates/ecstore/src/disk/mod.rs

@@ -27,7 +27,6 @@ mod io_admission;
 #[cfg(test)]
 pub(crate) mod lifecycle_test_io;
 pub mod local;
-pub use local::artifact_inventory::{ArtifactInventoryFrame, ArtifactInventoryVersion};
 pub mod os;
 
 #[cfg(test)]
@@ -50,9 +49,6 @@ pub const FORMAT_CONFIG_FILE: &str = "format.json";
 pub const HEALING_MARKER_PATH: &str = "healing.bin";
 pub const STORAGE_FORMAT_FILE: &str = "xl.meta";
 pub const STORAGE_FORMAT_FILE_BACKUP: &str = "xl.meta.bkp";
-/// Original upload authority after it stops admitting active part mutations.
-pub(crate) const MULTIPART_RECOVERY_DIR: &str = ".abort-authority";
-pub(crate) const MULTIPART_COMMIT_METADATA_FILE: &str = "xl.meta.complete";
 pub const PART_TRANSACTION_NEW_META: &str = "new.meta";
 pub const PART_TRANSACTION_OLD_META: &str = "old.meta";
 pub const PART_TRANSACTION_ROLLBACK: &str = "rollback";
@@ -74,10 +70,6 @@ use crate::cluster::rpc::RemoteDisk;
 use crate::cluster::rpc::build_internode_data_transport_from_env;
 use crate::disk::disk_store::DiskStoreRenameDataExt;
 use crate::disk::disk_store::LocalDiskWrapper;
-pub use crate::disk::disk_store::{
-    LegacyFileStream, LegacyFileWrite, LegacyMetadataWrite, LegacyPartMutation, LegacyPartOperation, LegacyPathDelete,
-    LegacyPathDeleteOperation, LegacyRenameData, LegacyRenameFile,
-};
 use crate::disk::health_state::RuntimeDriveHealthState;
 use crate::disk::local::ScanGuard;
 use bytes::Bytes;
@@ -90,7 +82,12 @@ use rustfs_filemeta::{FileInfo, ObjectPartInfo, RawFileInfo};
 use rustfs_madmin::info_commands::DiskMetrics;
 use rustfs_rio::ChunkReaderBox;
 use serde::{Deserialize, Serialize};
-use std::{fmt::Debug, path::PathBuf, sync::Arc, time::Duration};
+use std::{
+    fmt::Debug,
+    path::PathBuf,
+    sync::{Arc, atomic::AtomicBool},
+    time::Duration,
+};
 use time::OffsetDateTime;
 use tokio::io::{AsyncRead, AsyncWrite};
 use uuid::Uuid;
@@ -98,7 +95,6 @@ use uuid::Uuid;
 /// Independent admission and physical ownership for one disk rename.
 #[derive(Default)]
 pub(crate) struct RenameDataGuards {
-    pub(crate) artifact_put: Option<crate::bucket::artifact::ArtifactPutIdentity>,
     pub(crate) scanner_publication_lease_token: Option<Uuid>,
     pub(crate) external_guard: Option<Arc<dyn Send + Sync>>,
     pub(crate) namespace_owner: Option<Arc<dyn Send + Sync>>,
@@ -240,117 +236,6 @@ pub enum Disk {
 }
 
 impl Disk {
-    /// Capture local file-write admission before authoritative classification.
-    pub async fn begin_legacy_file_write(&self, volume: &str) -> Result<LegacyFileWrite> {
-        match self {
-            Self::Local(disk) => disk.begin_legacy_file_write(volume).await,
-            Self::Remote(_) => Err(DiskError::DiskNotFound),
-        }
-    }
-
-    pub(crate) async fn begin_legacy_file_write_with_namespace_owner(
-        &self,
-        volume: &str,
-        owner: Option<Arc<dyn Send + Sync>>,
-    ) -> Result<LegacyFileWrite> {
-        match self {
-            Self::Local(disk) => disk.begin_legacy_file_write_with_namespace_owner(volume, owner).await,
-            Self::Remote(_) => Err(DiskError::DiskNotFound),
-        }
-    }
-
-    /// Capture metadata publication admission before authoritative classification.
-    pub async fn begin_legacy_metadata_write(&self, volume: &str, path: &str) -> Result<LegacyMetadataWrite> {
-        match self {
-            Self::Local(disk) => disk.begin_legacy_metadata_write(volume, path).await,
-            Self::Remote(_) => Err(DiskError::DiskNotFound),
-        }
-    }
-
-    pub(crate) async fn begin_legacy_metadata_write_with_namespace_owner(
-        &self,
-        volume: &str,
-        path: &str,
-        namespace_owner: Option<Arc<dyn Send + Sync>>,
-    ) -> Result<LegacyMetadataWrite> {
-        match self {
-            Self::Local(disk) => {
-                disk.begin_legacy_metadata_write_with_namespace_owner(volume, path, namespace_owner)
-                    .await
-            }
-            Self::Remote(_) => Err(DiskError::DiskNotFound),
-        }
-    }
-
-    pub(crate) fn record_legacy_admission_failure(
-        &self,
-        operation: &'static str,
-        error: &DiskError,
-        started: std::time::Instant,
-    ) {
-        if let Self::Local(disk) = self {
-            disk.record_legacy_admission_failure(operation, error, started);
-        }
-    }
-
-    pub(crate) async fn begin_legacy_path_delete(
-        &self,
-        volume: &str,
-        operation: LegacyPathDeleteOperation,
-        owner: Option<Arc<dyn Send + Sync>>,
-        deadline: tokio::time::Instant,
-    ) -> Result<LegacyPathDelete> {
-        match self {
-            Self::Local(disk) => disk.begin_legacy_path_delete(volume, operation, owner, deadline).await,
-            Self::Remote(_) => Err(DiskError::DiskNotFound),
-        }
-    }
-
-    pub(crate) async fn begin_legacy_part_mutation(
-        &self,
-        source: Option<(&str, &str)>,
-        destination: (&str, &str),
-        namespace_owner: Option<Arc<dyn Send + Sync>>,
-        operation: LegacyPartOperation,
-    ) -> Result<LegacyPartMutation> {
-        match self {
-            Self::Local(disk) => {
-                disk.begin_legacy_part_mutation(source, destination, namespace_owner, operation)
-                    .await
-            }
-            Self::Remote(_) => Err(DiskError::DiskNotFound),
-        }
-    }
-
-    pub(crate) async fn begin_legacy_rename_file(
-        &self,
-        source: (&str, &str),
-        destination: (&str, &str),
-        durable: bool,
-        namespace_owner: Option<Arc<dyn Send + Sync>>,
-    ) -> Result<LegacyRenameFile> {
-        match self {
-            Self::Local(disk) => {
-                disk.begin_legacy_rename_file(source, destination, durable, namespace_owner)
-                    .await
-            }
-            Self::Remote(_) => Err(DiskError::DiskNotFound),
-        }
-    }
-
-    pub(crate) async fn begin_legacy_rename_data(
-        &self,
-        source: (&str, &str),
-        fi: &FileInfo,
-        destination: (&str, &str),
-        namespace_owner: Option<Arc<dyn Send + Sync>>,
-    ) -> Result<LegacyRenameData> {
-        match self {
-            Self::Local(disk) => disk.begin_legacy_rename_data(source, fi, destination, namespace_owner).await,
-            Self::Remote(_) => Err(DiskError::DiskNotFound),
-        }
-    }
-
     /// A read-only probe; the physical delete repeats the same leaf checks.
     pub async fn is_plain_orphan_data_dir(&self, volume: &str, path: &str) -> Result<bool> {
         match self {
@@ -659,6 +544,13 @@ impl DiskAPI for Disk {
         }
     }
 
+    async fn bucket_creation_witness(&self, volume: &str) -> Result<Option<os::NativeBucketCreationWitness>> {
+        match self {
+            Disk::Local(local_disk) => local_disk.bucket_creation_witness(volume).await,
+            Disk::Remote(_) => Ok(None),
+        }
+    }
+
     #[tracing::instrument(level = "trace", skip_all)]
     async fn make_volume(&self, volume: &str) -> Result<()> {
         match self {
@@ -1174,27 +1066,13 @@ impl Disk {
         dst_volume: &str,
         dst_path: &str,
     ) -> Result<RenameDataResp> {
-        let bucket_scope = crate::store::bucket_heal_scope_for_object(dst_volume, dst_path);
-        let repair_scope = crate::bucket::artifact::artifact_repair_scope(dst_volume, dst_path);
-        if let Some(scope) = &bucket_scope {
-            scope.check()?;
-        }
-        if let Some(scope) = &repair_scope {
-            scope.check().map_err(DiskError::other)?;
-        }
-        let repair_lease = if let (Self::Local(disk), Some(scope)) = (self, &repair_scope) {
-            if let Some(identity) = scope.receiver_identity() {
-                scope.check_version(fi.version_id).await.map_err(DiskError::other)?;
-                Some(disk.acquire_artifact_repair_lease(identity.receiver_key).await?)
-            } else {
-                None
-            }
-        } else {
-            None
+        let Some(scope) = crate::store::bucket_heal_scope_for_object(dst_volume, dst_path) else {
+            return self
+                .rename_data_borrowed_with_fence(src_volume, src_path, fi, dst_volume, dst_path, None)
+                .await;
         };
-        let owner: Option<Arc<dyn Send + Sync>> = (bucket_scope.is_some() || repair_scope.is_some())
-            .then(|| Arc::new((bucket_scope, repair_scope, repair_lease)) as Arc<dyn Send + Sync>);
-        self.rename_data_borrowed_with_fence_and_guard(src_volume, src_path, fi, dst_volume, dst_path, None, owner)
+        scope.check()?;
+        self.rename_data_borrowed_with_fence_and_guard(src_volume, src_path, fi, dst_volume, dst_path, None, Some(scope))
             .await
     }
 
@@ -1205,20 +1083,10 @@ impl Disk {
         fi: &FileInfo,
         dst_volume: &str,
         dst_path: &str,
-        mut guards: RenameDataGuards,
+        guards: RenameDataGuards,
     ) -> RenameDataObservation {
         match self {
             Disk::Local(local_disk) => {
-                if let Some(identity) = guards.artifact_put.take() {
-                    let lease = match local_disk.acquire_artifact_put_lease(identity.receiver_key).await {
-                        Ok(lease) => lease,
-                        Err(error) => return RenameDataObservation::unknown(Err(error)),
-                    };
-                    // Keep the existing timeout policy; physical workers own the
-                    // receiver lease even after the caller's disk deadline.
-                    guards.namespace_owner =
-                        Some(Arc::new((guards.external_guard.clone(), guards.namespace_owner.take(), lease)));
-                }
                 local_disk
                     .rename_data_observed_with_guards(src_volume, src_path, fi, dst_volume, dst_path, guards)
                     .await
@@ -1226,17 +1094,39 @@ impl Disk {
             Disk::Remote(remote_disk) => RenameDataObservation::unknown(
                 remote_disk
                     .rename_data_borrowed_with_fence(
-                        (src_volume, src_path),
+                        src_volume,
+                        src_path,
                         fi,
-                        (dst_volume, dst_path),
+                        dst_volume,
+                        dst_path,
                         guards.scanner_publication_lease_token,
-                        guards.artifact_put.map(|identity| identity.incarnation),
                     )
                     .await,
             ),
         }
     }
 
+    pub(crate) async fn rename_data_borrowed_with_fence(
+        &self,
+        src_volume: &str,
+        src_path: &str,
+        fi: &FileInfo,
+        dst_volume: &str,
+        dst_path: &str,
+        scanner_publication_lease_token: Option<Uuid>,
+    ) -> Result<RenameDataResp> {
+        self.rename_data_borrowed_with_fence_and_guard(
+            src_volume,
+            src_path,
+            fi,
+            dst_volume,
+            dst_path,
+            scanner_publication_lease_token,
+            None,
+        )
+        .await
+    }
+
     #[allow(clippy::too_many_arguments)]
     pub async fn rename_data_borrowed_with_fence_and_guard(
         &self,
@@ -1257,11 +1147,12 @@ impl Disk {
             Disk::Remote(remote_disk) => {
                 remote_disk
                     .rename_data_borrowed_with_fence(
-                        (src_volume, src_path),
+                        src_volume,
+                        src_path,
                         fi,
-                        (dst_volume, dst_path),
+                        dst_volume,
+                        dst_path,
                         scanner_publication_lease_token,
-                        None,
                     )
                     .await
             }
@@ -1473,6 +1364,11 @@ pub trait DiskAPI: Debug + Send + Sync + 'static {
     // NSScanner
 
     // Volume operations.
+    /// Unknown or remote backends cannot attest process-local publication history.
+    async fn bucket_creation_witness(&self, _volume: &str) -> Result<Option<os::NativeBucketCreationWitness>> {
+        Ok(None)
+    }
+
     async fn make_volume(&self, volume: &str) -> Result<()>;
     async fn make_volumes(&self, volume: Vec<&str>) -> Result<()>;
     async fn list_volumes(&self) -> Result<Vec<VolumeInfo>>;
@@ -2026,6 +1922,12 @@ pub struct WalkDirOptions {
     // Override the remote stream stall timeout for long background walks.
     #[serde(default)]
     pub stall_timeout_ms: Option<u64>,
+
+    /// In-process completion state for bounded local walks. This is skipped
+    /// from RPC serialization; remote peers retain the legacy natural-EOF
+    /// behavior until they support an explicit capability.
+    #[serde(skip)]
+    pub producer_limit_reached: Option<Arc<AtomicBool>>,
 }
 
 impl WalkDirOptions {
@@ -2219,7 +2121,7 @@ impl DeleteRecoveryJournal {
             }
             let id = request.version_id.unwrap_or_default();
             let Some(original) = originals.get(&id) else {
-                return false;
+                return !id.is_nil() && !locals.contains_key(&id);
             };
             match locals.get(&id) {
                 Some(local) => local == original,
@@ -2269,7 +2171,10 @@ impl DeleteRecoveryJournal {
             };
             match (local, remote) {
                 (Some(local), Some(remote)) => local == remote,
-                (None, None) => self.original_digest.is_none() && authority.original_digest.is_none(),
+                (None, None) => {
+                    (!(request.deleted && request.mark_deleted) && request.version_id.is_some_and(|id| !id.is_nil()))
+                        || (self.original_digest.is_none() && authority.original_digest.is_none())
+                }
                 _ => false,
             }
         })
@@ -2870,6 +2775,7 @@ mod tests {
             skip_total_timeout: false,
             timeout_ms: Some(10_000),
             stall_timeout_ms: Some(20_000),
+            producer_limit_reached: None,
         };
 
         assert_eq!(opts.bucket, "test-bucket");
@@ -3592,6 +3498,46 @@ mod delete_recovery_adoption_tests {
         };
         assert!(journal.matches_adoption_source(&[]), "certified non-null removal can already be absent");
         assert!(journal.matches_adoption_source(std::slice::from_ref(&source)));
+        let missing = Uuid::new_v4();
+        journal.requests.push(FileInfo {
+            version_id: Some(missing),
+            ..Default::default()
+        });
+        journal.original_digest = Some([3; 32]);
+        assert!(
+            journal.matches_prepared_authority(&journal),
+            "an explicit UUID absent from both prepared sources remains a no-op with original metadata"
+        );
+        assert!(journal.matches_adoption_source(&[]), "both non-null versions can remain absent");
+        assert!(
+            journal.matches_adoption_source(std::slice::from_ref(&source)),
+            "a missing non-null version in the batch remains a no-op"
+        );
+        let mut unexpected = source.clone();
+        unexpected.version_id = Some(missing);
+        let mut foreign_preparation = journal.clone();
+        foreign_preparation.original_versions.push(unexpected.clone());
+        assert!(
+            !journal.matches_prepared_authority(&foreign_preparation)
+                && !foreign_preparation.matches_prepared_authority(&journal),
+            "absence from only one prepared source cannot establish a generation"
+        );
+        assert!(
+            !journal.matches_adoption_source(&[source.clone(), unexpected]),
+            "a version absent from the authority cannot be deleted locally"
+        );
+        for version_id in [None, Some(Uuid::nil())] {
+            journal.requests.last_mut().expect("missing-version request").version_id = version_id;
+            assert!(
+                !journal.matches_prepared_authority(&journal),
+                "a missing null version with original metadata cannot establish its generation"
+            );
+            assert!(
+                !journal.matches_adoption_source(std::slice::from_ref(&source)),
+                "a missing null version cannot establish its generation"
+            );
+        }
+        journal.requests.pop();
         let mut foreign = source.clone();
         foreign.metadata_digest = [2; 32];
         assert!(!journal.matches_adoption_source(std::slice::from_ref(&foreign)));
@@ -3607,6 +3553,25 @@ mod delete_recovery_adoption_tests {
         assert!(journal.matches_adoption_source(std::slice::from_ref(&journal.original_versions[0])));
         journal.requests.clear();
         assert!(!journal.matches_adoption_source(&journal.original_versions));
+
+        let mut marker = journal.clone();
+        marker.requests = vec![FileInfo {
+            version_id: Some(id),
+            deleted: true,
+            mark_deleted: true,
+            ..Default::default()
+        }];
+        marker.original_versions.clear();
+        marker.original_digest = Some([3; 32]);
+        assert!(
+            !marker.matches_prepared_authority(&marker),
+            "a marker with original metadata requires a source generation"
+        );
+        marker.original_digest = None;
+        assert!(
+            marker.matches_prepared_authority(&marker),
+            "marker preparation without original metadata retains the existing allowance"
+        );
     }
 }
 

crates/ecstore/src/ecstore_validation_blackbox.rs

@@ -153,13 +153,10 @@ async fn refresh_loss_lock_client_keeps_rejection_observable_for_late_waiters()
     );
 }
 
-/// Keep the real metadata owner and backing directories alive together.
-pub(crate) async fn make_local_set_disks(
-    drive_count: usize,
-    parity_count: usize,
-) -> (crate::set_disk::HermeticSetFixture, Arc<SetDisks>) {
-    let (fixture, _, set) = crate::set_disk::hermetic_set_disks_for_pool_with_default_parity(drive_count, 0, parity_count).await;
-    (fixture, set)
+/// Returns the backing [`tempfile::TempDir`]s alongside the set so callers keep
+/// them alive for the test's duration and the directories are removed on drop.
+pub(crate) async fn make_local_set_disks(drive_count: usize, parity_count: usize) -> (Vec<tempfile::TempDir>, Arc<SetDisks>) {
+    make_local_set_disks_with_ctx(drive_count, parity_count, crate::runtime::instance::bootstrap_ctx()).await
 }
 
 /// Like [`make_local_set_disks`], but binds the set to an explicit instance
@@ -759,9 +756,6 @@ async fn blackbox_range_read_restores_exact_slice_with_one_offline_disk() {
 #[tokio::test]
 async fn blackbox_delete_marker_hides_object_body_without_erasing_prior_version_metadata() {
     let (_dirs, set_disks) = make_local_set_disks(4, 2).await;
-    let store = crate::bucket::metadata_sys::object_store_in(set_disks.instance_ctx())
-        .await
-        .expect("fixture metadata authority should belong to this set");
     let bucket = "bb-delete-marker-read-negative";
     let object = "object.bin";
     let opts = ObjectOptions {
@@ -771,26 +765,13 @@ async fn blackbox_delete_marker_hides_object_body_without_erasing_prior_version_
         ..Default::default()
     };
 
-    store
+    set_disks
         .make_bucket(bucket, &MakeBucketOptions::default())
         .await
         .expect("bucket should be created");
     let mut reader = PutObjReader::from_vec(b"body hidden by delete marker".to_vec());
     set_disks
-        .put_object(
-            bucket,
-            object,
-            &mut reader,
-            &ObjectOptions {
-                object_lock_config_snapshot: Some(
-                    store
-                        .object_lock_config_snapshot(bucket)
-                        .await
-                        .expect("PUT fixture should own the bucket lifecycle and Object Lock snapshot"),
-                ),
-                ..opts.clone()
-            },
-        )
+        .put_object(bucket, object, &mut reader, &opts)
         .await
         .expect("object should be written before delete marker");
 

crates/ecstore/src/error/mod.rs

@@ -17,8 +17,8 @@
 use crate::bucket::error::BucketMetadataError;
 use crate::disk::error::DiskError;
 use crate::storage_api_contracts::{error::StorageErrorCode, range::HTTPRangeError};
+use rustfs_s3_types::S3ErrorCode;
 use rustfs_utils::path::decode_dir_object;
-use s3s::S3ErrorCode;
 
 pub type Error = StorageError;
 pub type Result<T> = core::result::Result<T, Error>;
@@ -1086,14 +1086,8 @@ impl From<rmp_serde::decode::Error> for Error {
     }
 }
 
-impl From<s3s::xml::SerError> for Error {
-    fn from(e: s3s::xml::SerError) -> Self {
-        Error::other(e)
-    }
-}
-
-impl From<s3s::xml::DeError> for Error {
-    fn from(e: s3s::xml::DeError) -> Self {
+impl From<crate::bucket::utils::BucketConfigXmlError> for Error {
+    fn from(e: crate::bucket::utils::BucketConfigXmlError) -> Self {
         Error::other(e)
     }
 }

crates/ecstore/src/lib.rs

@@ -56,7 +56,7 @@ mod storage_api_contracts;
 mod store;
 
 pub use disk::{with_background_disk_io, with_background_resource_unit};
-pub use store::{BucketIncarnationFenceGuard, PoolMetaWriteGateStatus};
+pub use store::PoolMetaWriteGateStatus;
 
 // pub mod checksum;
 mod event;

crates/ecstore/src/object_api/object_api_utils.rs

@@ -20,7 +20,6 @@
 #![allow(clippy::all)]
 
 use http::HeaderMap;
-use s3s::dto::ETag;
 use std::{collections::HashMap, io::Cursor, sync::Arc};
 use tokio::io::BufReader;
 
@@ -29,7 +28,7 @@ use crate::object_api::{GetObjectReader, ObjectInfo, ObjectOptions};
 use crate::storage_api_contracts::range::HTTPRangeSpec;
 use rustfs_filemeta::ObjectPartInfo;
 use rustfs_rio::HashReader;
-use s3s::S3ErrorCode;
+use rustfs_s3_types::S3ErrorCode;
 
 //#[derive(Clone)]
 pub struct PutObjReader {
@@ -150,24 +149,6 @@ pub fn new_getobjectreader<'a>(
     })
 }
 
-/// Convert a raw stored ETag into the strongly-typed `s3s::dto::ETag`.
-///
-/// Supports already quoted (`"abc"`), weak (`W/"abc"`), or plain (`abc`) values.
-pub fn to_s3s_etag(etag: &str) -> ETag {
-    if let Some(rest) = etag.strip_prefix("W/\"") {
-        if let Some(body) = rest.strip_suffix('"') {
-            return ETag::Weak(body.to_string());
-        }
-        return ETag::Weak(rest.to_string());
-    }
-
-    if let Some(body) = etag.strip_prefix('"').and_then(|rest| rest.strip_suffix('"')) {
-        return ETag::Strong(body.to_string());
-    }
-
-    ETag::Strong(etag.to_string())
-}
-
 pub fn get_raw_etag(metadata: &HashMap<String, String>) -> String {
     metadata
         .get("etag")
@@ -232,28 +213,42 @@ mod tests {
     }
 
     #[test]
-    fn test_to_s3s_etag() {
-        // Test unquoted ETag - should become strong etag
-        assert_eq!(
-            to_s3s_etag("6af8d12c0c74b78094884349f3c8a079"),
-            ETag::Strong("6af8d12c0c74b78094884349f3c8a079".to_string())
-        );
+    fn test_new_getobjectreader_rejects_a_range_past_the_object_as_invalid_range() {
+        let oi = multipart_object_info();
+        let past_the_end = Some(HTTPRangeSpec {
+            is_suffix_length: false,
+            start: oi.size,
+            end: oi.size + 10,
+        });
 
-        assert_eq!(
-            to_s3s_etag("\"6af8d12c0c74b78094884349f3c8a079\""),
-            ETag::Strong("6af8d12c0c74b78094884349f3c8a079".to_string())
-        );
+        let err = new_getobjectreader(&past_the_end, &oi, &ObjectOptions::default(), &HeaderMap::new())
+            .err()
+            .expect("a range starting at the object size must be rejected");
 
-        assert_eq!(
-            to_s3s_etag("W/\"6af8d12c0c74b78094884349f3c8a079\""),
-            ETag::Weak("6af8d12c0c74b78094884349f3c8a079".to_string())
-        );
+        assert_eq!(err.code, S3ErrorCode::InvalidRange);
+        assert_eq!(err.code.as_str(), "InvalidRange");
+        assert_eq!(err.key, None);
+        assert_eq!(err.bucket_name, None);
+    }
 
-        assert_eq!(to_s3s_etag(""), ETag::Strong(String::new()));
+    #[test]
+    fn test_new_getobjectreader_rejects_an_unknown_size_without_a_range_as_invalid_range() {
+        let oi = ObjectInfo {
+            bucket: "bucket".to_string(),
+            name: "object".to_string(),
+            size: -1,
+            ..Default::default()
+        };
 
-        assert_eq!(to_s3s_etag("\"incomplete"), ETag::Strong("\"incomplete".to_string()));
+        let err = new_getobjectreader(&None, &oi, &ObjectOptions::default(), &HeaderMap::new())
+            .err()
+            .expect("an object of unknown size cannot be read without a range");
 
-        assert_eq!(to_s3s_etag("incomplete\""), ETag::Strong("incomplete\"".to_string()));
+        assert_eq!(err.code, S3ErrorCode::InvalidRange);
+        assert_eq!(err.code.as_str(), "InvalidRange");
+        assert_eq!(err.message, "Invalid range");
+        assert_eq!(err.key.as_deref(), Some("object"));
+        assert_eq!(err.bucket_name.as_deref(), Some("bucket"));
     }
 
     #[test]

crates/ecstore/src/object_api/readers.rs

@@ -4473,7 +4473,3 @@ mod tests {
             .expect_err("a lying frame-layout marker must fail closed, not serve plaintext");
     }
 }
-
-#[cfg(test)]
-#[path = "readers/compression_index_compatibility_tests.rs"]
-mod compression_index_compatibility_tests;

crates/ecstore/src/object_api/readers/compression_index_compatibility_tests.rs

@@ -1,185 +0,0 @@
-use super::*;
-use rustfs_utils::http::metadata_compat::{SUFFIX_ACTUAL_SIZE, SUFFIX_COMPRESSION, insert_str};
-use sha2::{Digest, Sha256};
-use std::io::Cursor;
-use tokio::io::AsyncReadExt;
-
-const STREAM: &[u8] = include_bytes!(concat!(
-    env!("CARGO_MANIFEST_DIR"),
-    "/tests/fixtures/compression-index/legacy-lz4-stream.bin"
-));
-const HISTORICAL_INDEX: &[u8] = include_bytes!(concat!(
-    env!("CARGO_MANIFEST_DIR"),
-    "/tests/fixtures/compression-index/pre-zigzag-index.bin"
-));
-#[cfg(not(feature = "rio-v2"))]
-const CURRENT_INDEX: &[u8] =
-    include_bytes!(concat!(env!("CARGO_MANIFEST_DIR"), "/tests/fixtures/compression-index/zigzag-index.bin"));
-const PLAINTEXT_LEN: usize = 3 * 1024 * 1024 + 123;
-const PLAINTEXT_SHA256: &str = "68f9edf6f9600395d6d2b5517d97570fecd2a0c6dbe6130617ef415a3b48d89c";
-
-fn fixture_info(index: &[u8]) -> ObjectInfo {
-    let mut metadata = HashMap::new();
-    insert_str(&mut metadata, SUFFIX_COMPRESSION, "lz4".to_owned());
-    insert_str(&mut metadata, SUFFIX_ACTUAL_SIZE, PLAINTEXT_LEN.to_string());
-    ObjectInfo {
-        size: i64::try_from(STREAM.len()).expect("fixed fixture size fits i64"),
-        parts: Arc::new(vec![ObjectPartInfo {
-            number: 1,
-            size: STREAM.len(),
-            actual_size: i64::try_from(PLAINTEXT_LEN).expect("fixed plaintext length fits i64"),
-            index: Some(Bytes::copy_from_slice(index)),
-            ..Default::default()
-        }]),
-        user_defined: Arc::new(metadata),
-        ..Default::default()
-    }
-}
-
-fn fixture_plaintext() -> Vec<u8> {
-    (0..PLAINTEXT_LEN)
-        .map(|offset| {
-            let chunk = offset / 1024;
-            let lane = offset % 1024;
-            if lane < 8 {
-                u64::try_from(chunk).expect("fixed chunk number fits u64").to_le_bytes()[lane]
-            } else {
-                b"abcdefghijklmnopqrstuvwxyz"[(offset + chunk) % 26]
-            }
-        })
-        .collect()
-}
-
-#[tokio::test]
-async fn historical_index_preserves_the_complete_compressed_body() {
-    let info = fixture_info(HISTORICAL_INDEX);
-    let (mut reader, storage_offset, _) = GetObjectReader::new(
-        Box::new(Cursor::new(STREAM.to_vec())),
-        None,
-        &info,
-        &ObjectOptions::default(),
-        &HeaderMap::new(),
-    )
-    .await
-    .expect("construct reader for fixed historical index");
-    let mut actual = Vec::new();
-    reader.read_to_end(&mut actual).await.expect("read complete historical body");
-    assert_eq!(storage_offset, 0);
-    assert_eq!(actual.len(), PLAINTEXT_LEN);
-    assert_eq!(
-        hex_simd::encode_to_string(Sha256::digest(&actual), hex_simd::AsciiCase::Lower),
-        PLAINTEXT_SHA256
-    );
-}
-
-#[tokio::test]
-async fn historical_index_preserves_ranges_across_compression_blocks() {
-    let info = fixture_info(HISTORICAL_INDEX);
-    let expected = fixture_plaintext();
-    for start in [7, 1024 * 1024 - 17, 2 * 1024 * 1024 + 31, PLAINTEXT_LEN - 97] {
-        let range = HTTPRangeSpec {
-            is_suffix_length: false,
-            start: i64::try_from(start).expect("fixed range start fits i64"),
-            end: i64::try_from(start + 63).expect("fixed range end fits i64"),
-        };
-        let plan = ReadPlan::build(Some(range.clone()), &info, &ObjectOptions::default(), &HeaderMap::new())
-            .await
-            .expect("plan historical compressed range");
-        let physical = plan.storage_offset;
-        let input = STREAM.get(physical..).expect("planned offset stays within the fixed stream");
-        let (mut reader, _, _) = GetObjectReader::new(
-            Box::new(Cursor::new(input.to_vec())),
-            Some(range),
-            &info,
-            &ObjectOptions::default(),
-            &HeaderMap::new(),
-        )
-        .await
-        .expect("construct historical range reader");
-        let mut actual = Vec::new();
-        reader.read_to_end(&mut actual).await.expect("read historical range");
-        assert_eq!(actual, expected[start..start + 64], "range starting at {start}");
-    }
-}
-
-#[cfg(not(feature = "rio-v2"))]
-#[tokio::test]
-async fn current_index_selects_a_fixed_compressed_block_for_a_range() {
-    let info = fixture_info(CURRENT_INDEX);
-    let start = 2 * 1024 * 1024 + 31;
-    let range = HTTPRangeSpec {
-        is_suffix_length: false,
-        start: i64::try_from(start).expect("fixed range start fits i64"),
-        end: i64::try_from(start + 63).expect("fixed range end fits i64"),
-    };
-    let plan = ReadPlan::build(Some(range.clone()), &info, &ObjectOptions::default(), &HeaderMap::new())
-        .await
-        .expect("plan range with fixed current index");
-    assert_eq!(plan.storage_offset, 34_663, "use the recorded second block boundary");
-    let physical = plan.storage_offset;
-    let (mut reader, _, _) = GetObjectReader::new(
-        Box::new(Cursor::new(STREAM[physical..].to_vec())),
-        Some(range),
-        &info,
-        &ObjectOptions::default(),
-        &HeaderMap::new(),
-    )
-    .await
-    .expect("construct indexed range reader");
-    let mut actual = Vec::new();
-    reader.read_to_end(&mut actual).await.expect("read indexed range");
-    assert_eq!(actual, fixture_plaintext()[start..start + 64]);
-}
-
-#[tokio::test]
-async fn truncated_index_falls_back_without_truncating_the_range() {
-    let info = fixture_info(&HISTORICAL_INDEX[..HISTORICAL_INDEX.len() - 3]);
-    let start = 2 * 1024 * 1024 + 31;
-    let range = HTTPRangeSpec {
-        is_suffix_length: false,
-        start: i64::try_from(start).expect("fixed range start fits i64"),
-        end: i64::try_from(start + 96).expect("fixed range end fits i64"),
-    };
-    let plan = ReadPlan::build(Some(range.clone()), &info, &ObjectOptions::default(), &HeaderMap::new())
-        .await
-        .expect("invalid index still permits a sequential range plan");
-    assert_eq!(plan.storage_offset, 0, "truncated index must not select a storage offset");
-    let (mut reader, _, _) = GetObjectReader::new(
-        Box::new(Cursor::new(STREAM.to_vec())),
-        Some(range),
-        &info,
-        &ObjectOptions::default(),
-        &HeaderMap::new(),
-    )
-    .await
-    .expect("construct sequential fallback reader");
-    let mut actual = Vec::new();
-    reader
-        .read_to_end(&mut actual)
-        .await
-        .expect("read range without the truncated index");
-    assert_eq!(actual, fixture_plaintext()[start..start + 97]);
-}
-
-#[tokio::test]
-async fn historical_index_fallback_does_not_hide_a_body_checksum_failure() {
-    let info = fixture_info(HISTORICAL_INDEX);
-    let mut corrupted = STREAM.to_vec();
-    corrupted[4] ^= 1; // Corrupt the first block's stored CRC, leaving its payload intact.
-    let (mut reader, _, _) = GetObjectReader::new(
-        Box::new(Cursor::new(corrupted)),
-        None,
-        &info,
-        &ObjectOptions::default(),
-        &HeaderMap::new(),
-    )
-    .await
-    .expect("construct reader before body checksum verification");
-    let mut actual = Vec::new();
-    let error = reader
-        .read_to_end(&mut actual)
-        .await
-        .expect_err("bad body CRC cannot become successful EOF");
-    assert_eq!(error.kind(), std::io::ErrorKind::InvalidData);
-    assert!(actual.len() < PLAINTEXT_LEN);
-}

crates/ecstore/src/object_api/types.rs

@@ -152,7 +152,7 @@ pub struct ObjectLockConfigSnapshot {
     config_revision: Option<OffsetDateTime>,
     state: crate::bucket::metadata_sys::ObjectLockConfigState,
     lifecycle_fence: NamespaceLockFence,
-    _lifecycle_guard: Option<Arc<rustfs_lock::NamespaceLockGuard>>,
+    _lifecycle_guard: Option<rustfs_lock::NamespaceLockGuard>,
     metadata_transaction_guard: Option<Arc<rustfs_lock::NamespaceLockGuard>>,
 }
 
@@ -210,33 +210,8 @@ impl ObjectLockConfigSnapshot {
             config_revision: Some(config_revision),
             state,
             lifecycle_fence,
-            _lifecycle_guard: Some(Arc::new(lifecycle_guard)),
-            metadata_transaction_guard: Some(Arc::new(metadata_transaction_guard)),
-        }
-    }
-
-    pub(crate) fn for_store_bucket_under_lifecycle_owner(
-        store_id: Uuid,
-        bucket: &str,
-        bucket_incarnation_id: Uuid,
-        config_revision: OffsetDateTime,
-        state: crate::bucket::metadata_sys::ObjectLockConfigState,
-        lifecycle_guard: Arc<rustfs_lock::NamespaceLockGuard>,
-        metadata_transaction_guard: Arc<rustfs_lock::NamespaceLockGuard>,
-    ) -> Self {
-        let mut lifecycle_fence = NamespaceLockFence::new();
-        if let Some(signal) = lifecycle_guard.lock_lost_signal() {
-            lifecycle_fence.add_signal(signal);
-        }
-        Self {
-            store_id: Some(store_id),
-            bucket: Some(bucket.to_owned()),
-            bucket_incarnation_id: Some(bucket_incarnation_id),
-            config_revision: Some(config_revision),
-            state,
-            lifecycle_fence,
             _lifecycle_guard: Some(lifecycle_guard),
-            metadata_transaction_guard: Some(metadata_transaction_guard),
+            metadata_transaction_guard: Some(Arc::new(metadata_transaction_guard)),
         }
     }
 
@@ -279,15 +254,6 @@ impl ObjectLockConfigSnapshot {
         &self.state
     }
 
-    pub(crate) fn is_unbound(&self) -> bool {
-        self.store_id.is_none()
-            && self.bucket.is_none()
-            && self.bucket_incarnation_id.is_none()
-            && self.config_revision.is_none()
-            && self._lifecycle_guard.is_none()
-            && self.metadata_transaction_guard.is_none()
-    }
-
     pub(crate) fn is_valid_for_destructive_put(&self, store_id: Uuid, bucket: &str, bucket_incarnation_id: Uuid) -> bool {
         self.store_id == Some(store_id)
             && self.bucket.as_deref() == Some(bucket)
@@ -300,11 +266,6 @@ impl ObjectLockConfigSnapshot {
                 .is_some_and(|guard| !guard.is_lock_lost())
     }
 
-    pub(crate) fn owns_bucket_lifecycle_fence(&self, store_id: Uuid, bucket: &str, bucket_incarnation_id: Uuid) -> bool {
-        self.is_valid_for_destructive_put(store_id, bucket, bucket_incarnation_id)
-            && self._lifecycle_guard.as_ref().is_some_and(|guard| !guard.is_lock_lost())
-    }
-
     /// Share the held transaction lock without queuing another reader behind
     /// a metadata writer that is itself waiting for this snapshot to drop.
     pub(crate) fn metadata_transaction_guard_for(
@@ -1001,12 +962,6 @@ pub struct ObjectOptions {
     /// A genuine target write guard; loss fences alone do not authorize a borrowed write.
     #[doc(hidden)]
     pub write_lock_context: Option<WriteLockContext>,
-    /// Ordinary ECStore PUT target bound to its bucket's immutable artifact namespace.
-    #[doc(hidden)]
-    pub artifact_put_target: Option<Arc<crate::bucket::artifact::ArtifactPutTarget>>,
-    /// Owned, non-serializable authority for one fully sealed managed version.
-    #[doc(hidden)]
-    pub artifact_delete_target: Option<Arc<crate::bucket::artifact::ArtifactDeleteTarget>>,
     /// In-process delete ownership for late filesystem completion. Never
     /// serialized or copied into object metadata.
     #[doc(hidden)]
@@ -1058,6 +1013,10 @@ pub struct ObjectOptions {
     /// `ecstore` must leave it unset.
     #[doc(hidden)]
     pub data_movement_transferred_tier_versions: Option<crate::data_movement::TransferredTierVersions>,
+    /// Marks the physical copy-back write of a RestoreObject operation. This
+    /// is in-memory request context and must not be copied into object metadata.
+    #[doc(hidden)]
+    pub restore_copyback: bool,
     /// Internal, in-memory protection context. Never populated from S3 metadata.
     /// None selects the rollout default only for a new write, not for a rewrite.
     #[doc(hidden)]
@@ -1086,9 +1045,6 @@ pub struct ObjectOptions {
     /// Proves an upper layer holds the bucket lifecycle sentinel. A separate
     /// fence avoids recursively acquiring the read lock behind a queued writer.
     pub bucket_lifecycle_lock_fence: Option<NamespaceLockFence>,
-    /// Actual generation owner retained by storage commits and their physical tails.
-    #[doc(hidden)]
-    pub bucket_incarnation_fence: Option<Arc<crate::store::BucketIncarnationFenceGuard>>,
     /// Retains the actual lifecycle guard for an owned multipart commit. A
     /// lock-loss fence alone does not keep a cancelled caller's lock alive. The
     /// owner also retains the continuous incarnation-validation coverage.

crates/ecstore/src/object_api/write_commit_context.rs

@@ -71,7 +71,7 @@ impl WriteCommitGuard {
 
     /// Namespace locks key the disk identity of the name (see `new_ns_lock`),
     /// so a guard proves every spelling that resolves to the same file.
-    pub(crate) fn matches(&self, bucket: &str, object: &str) -> bool {
+    fn matches(&self, bucket: &str, object: &str) -> bool {
         self.bucket.as_ref() == bucket && self.object.as_ref() == object_name_disk_identity(object).as_ref()
     }
 }

crates/ecstore/src/runtime/global.rs

@@ -275,16 +275,16 @@ pub(crate) type TypeLocalDiskSetDrives = Vec<Vec<Vec<Option<DiskStore>>>>;
 ///
 /// # Returns
 /// * None
-pub fn set_global_region(region: s3s::region::Region) {
+pub fn set_global_region(region: rustfs_s3_types::Region) {
     current_ctx().set_region(region);
 }
 
 /// Get the global region
 ///
 /// # Returns
-/// * `Option<s3s::region::Region>` - The global region, if set
+/// * `Option<rustfs_s3_types::Region>` - The global region, if set
 ///
-pub fn get_global_region() -> Option<s3s::region::Region> {
+pub fn get_global_region() -> Option<rustfs_s3_types::Region> {
     current_ctx().region()
 }
 

crates/ecstore/src/runtime/instance.rs

@@ -51,7 +51,7 @@ use crate::services::event_notification::EventNotifier;
 use crate::services::tier::tier::TierConfigMgr;
 use crate::store::delete_recovery_runtime::DeleteRecoveryHints;
 use rustfs_lock::{GlobalLockManager, get_global_lock_manager};
-use s3s::region::Region;
+use rustfs_s3_types::Region;
 use std::collections::{HashMap, HashSet};
 use std::sync::{
     Arc, OnceLock,
@@ -814,14 +814,6 @@ impl InstanceContext {
         self.tier_config_mgr.get_or_init(TierConfigMgr::new).clone()
     }
 
-    #[cfg(test)]
-    pub(crate) fn set_test_tier_config_mgr(&self, manager: Arc<RwLock<TierConfigMgr>>) {
-        assert!(
-            self.tier_config_mgr.set(manager).is_ok(),
-            "test tier manager must be installed before use"
-        );
-    }
-
     /// This instance's event notifier, materializing it on first access.
     /// Shared for the lifetime of the instance.
     pub fn event_notifier(&self) -> Arc<RwLock<EventNotifier>> {

crates/ecstore/src/runtime/sources.rs

@@ -44,10 +44,10 @@ use crate::{
 };
 use rustfs_concurrency::WorkloadAdmissionSnapshotProvider;
 use rustfs_config::server_config::{Config, get_global_server_config, set_global_server_config};
+use rustfs_gateway_types::persistence::PersistedLifecycleConfiguration;
 use rustfs_io_metrics::internode_metrics::global_internode_metrics;
 use rustfs_lock::client::LockClient;
-use s3s::dto::BucketLifecycleConfiguration;
-use s3s::region::Region;
+use rustfs_s3_types::Region;
 use tokio::sync::{OwnedRwLockReadGuard, RwLock};
 use tokio_util::sync::CancellationToken;
 #[cfg(test)]
@@ -371,7 +371,7 @@ pub fn global_tier_config_mgr() -> Arc<RwLock<TierConfigMgr>> {
     get_global_tier_config_mgr()
 }
 
-pub(crate) async fn bucket_lifecycle_config(bucket: &str) -> Option<BucketLifecycleConfiguration> {
+pub(crate) async fn bucket_lifecycle_config(bucket: &str) -> Option<PersistedLifecycleConfiguration> {
     GLOBAL_LIFECYCLE_SYS.get(bucket).await
 }
 

crates/ecstore/src/services/notification_sys.rs

@@ -659,6 +659,28 @@ pub async fn acquire_legacy_transition_state_reconcile_fleet_proof() -> Option<L
     .then_some(proof)
 }
 
+pub async fn require_restore_copyback_fleet_capability() -> Result<()> {
+    let Some(topology) = REMOTE_VERSION_STATE_PROBE_TOPOLOGY.get() else {
+        #[cfg(any(test, feature = "test-util"))]
+        return Ok(());
+        #[cfg(not(any(test, feature = "test-util")))]
+        return Err(Error::other("restore copy-back capability topology is unavailable"));
+    };
+    let Some(notification_sys) = get_global_notification_sys() else {
+        #[cfg(any(test, feature = "test-util"))]
+        return Ok(());
+        #[cfg(not(any(test, feature = "test-util")))]
+        return Err(Error::other("restore copy-back capability probe is unavailable"));
+    };
+    timeout(
+        REMOTE_VERSION_STATE_PROBE_TIMEOUT,
+        notification_sys.probe_restore_copyback_fleet(topology),
+    )
+    .await
+    .map_err(|_| Error::other("restore copy-back capability fleet probe timed out"))??;
+    Ok(())
+}
+
 fn acquire_legacy_transition_state_reconcile_fleet_proof_from(
     state: &FleetCapabilityProofState,
     expected_topology: &str,
@@ -1561,6 +1583,30 @@ impl NotificationSys {
         Ok(peer_epochs)
     }
 
+    async fn probe_restore_copyback_fleet(&self, topology_fingerprint: &str) -> Result<BTreeMap<String, Uuid>> {
+        if self.peer_clients.len() != self.peer_topology_hosts.len() {
+            return Err(Error::other("restore copy-back capability fleet membership is incomplete"));
+        }
+        let probes = self.peer_clients.iter().map(|client| async {
+            let client = client
+                .as_ref()
+                .ok_or_else(|| Error::other("restore copy-back capability peer is unreachable"))?;
+            client
+                .probe_restore_copyback_capability(topology_fingerprint.to_string())
+                .await
+        });
+        let mut peer_epochs = BTreeMap::new();
+        for result in join_all(probes).await {
+            let (peer, epoch) = result?;
+            insert_remote_version_state_peer(&mut peer_epochs, peer, epoch)?;
+        }
+        let expected = self.peer_topology_hosts.iter().cloned().collect::<BTreeSet<_>>();
+        if expected.len() != self.peer_topology_hosts.len() || peer_epochs.keys().ne(expected.iter()) {
+            return Err(Error::other("restore copy-back capability fleet membership does not match topology"));
+        }
+        Ok(peer_epochs)
+    }
+
     async fn probe_transition_transaction_compaction_fleet(&self, topology_fingerprint: &str) -> Result<BTreeMap<String, Uuid>> {
         if self.peer_clients.len() != self.peer_topology_hosts.len() {
             return Err(Error::other(