fix(replication): honor disabled version deletes

2026-08-13 16:46:55 +00:00 · 2026-07-30 13:37:01 +08:00
864 changed files with 57305 additions and 245153 deletions
@@ -1,6 +1,6 @@
 ---
 name: adversarial-validation
-description: Execute the Adversarial Validation policy from the root AGENTS.md — run the applicable reviewer roles with RustFS-specific attack probes. Use on every behavior-affecting code change, bug fix, design proposal, or agent-instruction change that alters execution before declaring it done.
+description: Execute the Adversarial Validation policy from the root AGENTS.md — run the seven reviewer roles (correctness, simplicity, security, concurrency/durability, compatibility, performance, test coverage) with RustFS-specific attack probes. Use on every behavior-affecting code change, bug fix, or design proposal before declaring it done.
 ---

 # Adversarial Validation Playbooks
@@ -61,15 +61,14 @@ Null report example: "Attacked quorum-1 error reduction, exact max-keys listing

 ### Simplicity adversary

- Smaller-diff attack: inspect production growth separately from tests, fixtures, generated code, and documentation; test additions have no growth budget. Rewrite the production diff mentally (or in scratch) as the minimal equivalent edit. Report a finding only with a concrete smaller design that preserves correctness, compatibility, readability, and real boundaries; fewer lines alone are not evidence.
+- Smaller-diff attack: rewrite the diff's change mentally (or actually, in scratch) as the minimal in-place edit and compare. Flag as findings: a helper function with exactly one caller introduced by this diff; a file rewrite where a 3-line edit inside the existing control flow suffices; reshaped control flow in init/locking/metadata/quorum paths beyond what the fix requires; new string literals duplicating existing constants (grep the token first); #[path] module inclusion. If the smaller diff achieves identical behavior, report it with the concrete replacement.
  - Where: Any diff; extra scrutiny for crates/ecstore, crates/lock, rustfs/src/storage where 'preserve the existing control-flow shape' is an explicit rule
-  - Evidence: AGENTS.md 'Change Style for Existing Logic' (conditional extraction rule, preserve sensitive control flow, canonical modules) and 'Reuse Before You Write'; the Adversarial Validation roles list charters this attack.
- Reuse-and-necessity attack: for each new helper, search `crates/utils`, `crates/common`, the touched crate, the likely domain owner, and relevant direct dependencies. A reimplementation is a finding, but forced reuse with mismatched normalization, error, backoff, or durability semantics is also a finding. Demand a nameable trigger for new defensive branches. Tests remain subject to validity and near-duplicate coverage review, never a size limit.
-  - Where: Any diff adding helpers, branches on decoded/peer data, or tests
+  - Evidence: AGENTS.md 'Change Style for Existing Logic' (one-off helper ban, preserve control-flow shape in distributed/locking/metadata paths, no #[path]) and 'Reuse Before You Write' (constants clause); the Adversarial Validation roles list charters the simplicity adversary with exactly this attack.
+- Reuse-and-necessity attack: for each new helper the diff introduces, run `ls crates/utils/src crates/common/src` and `rg -i 'fn \w*<term>'` over those dirs plus the touched crate (snake_case signatures — a full-text single-word grep drowns, a multi-word phrase returns nothing). A reimplementation of an existing workspace utility, or of plain std/tokio behavior no wrapper refines, is a finding — but so is forced reuse with mismatched semantics (normalization such as `clean` resolving `.`/`..` against raw S3 keys, error type, backoff, durability gating). For each new defensive branch, demand the nameable trigger and flag re-validation of what a validated upstream layer on the SAME path already guarantees — excluding the Cross-Cutting Domain Invariant patterns (nil/empty/absent UUID, dual metadata keys, unversioned-tier versionId) and re-checks before destructive actions, which are load-bearing even when redundant on the happy path. For each new test, flag near-duplicates pinning the same code path AND poison-value class as an existing test — boundary companions (n==max vs max+1, absent vs empty vs nil UUID, MetaObject vs MetaDeleteMarker) are never near-duplicates; the test-coverage skeptic playbook below mandates them.
+  - Where: Any diff adding helpers, branches on decoded/peer data, or tests; helper checks against crates/utils, crates/common, and the touched crate
  - Evidence: AGENTS.md 'Reuse Before You Write' and 'Necessary Code Only'; GHSA-f4vq-9ffr-m8m3 (normalization-asymmetry traversal — why forced reuse of normalizing helpers on raw keys is itself an attack); docs/operations/tier-ilm-debugging.md nil-versionId incident (why boundary re-checks are load-bearing).
- Replacement-and-comment attack: when the diff introduces a replacement path or representation, trace all callers and flag a superseded in-scope path left behind without a compatibility requirement. Keep one canonical core behind compatibility adapters. Comments must state non-obvious invariants completely without narration or change history. Never demand unrelated deletion or trade away correctness, compatibility, or readability to reduce the diff.

-Null report example: "Separated production growth from tests/docs, tested a smaller equivalent, checked helper reuse and superseded paths, and found no break."
+Null report example: "Rewrote the diff as an in-place edit (no smaller equivalent exists), grepped both new helpers against crates/utils, crates/common, and the touched crate (no existing equivalent; call-site semantics checked), verified the two new defensive branches name concrete corrupt-input triggers, and checked the added tests against the existing suite (each pins a distinct poison-value class) — no break found."

 ### Security reviewer

@@ -196,9 +195,9 @@ Null report example: "Attacked dual-key metadata writes/removals against MinIO-o

 ### Performance reviewer

- For each `.clone()` or allocation added to a per-request/per-object path, identify the copied data and execution frequency. Report a finding only for a concrete repeated cost or benchmark regression. Recommend borrowing, moving, `Bytes`/`Arc`, `Cow`, or capacity reservation only when it reduces that cost without obscuring ownership or APIs.
+- For every `.clone()` the diff adds or moves onto a per-request/per-object path, open the cloned type and count heap fields (String, Vec, HashMap, Bytes). If >5 heap fields or it contains an EC block buffer, construct the cost: N concurrent PUTs x M objects -> N*M deep copies per second. Demand Arc-wrapping of heavy fields or pass-by-reference; also flag new `String` allocations in header/path/signature parsing where `&str`/`Cow<str>` suffices.
  - Where: crates/ecstore/src/set_disk/**, crates/ecstore/src/store*.rs, rustfs/src/storage/, crates/filemeta/, request handlers in rustfs/src/
-  - Evidence: crates/ecstore/AGENTS.md 'Allocation Discipline in Hot Paths'; .agents/skills/rust-code-quality/SKILL.md requires a concrete hot-path cost rather than a proxy metric
+  - Evidence: crates/ecstore/AGENTS.md 'Allocation Discipline in Hot Paths' (no Clone on >5-heap-field structs, Arc for large buffers, &str/Cow for temporary computations); .agents/skills/rust-code-quality/SKILL.md ranks 'unnecessary clone in hot path' as P1 must-fix
 - For every new sync_all/sync_data/fdatasync/flush/File::sync call in the diff, trace the call chain to DurabilityMode / RUSTFS_DRIVE_SYNC_ENABLE resolution (crates/ecstore/src/disk/local.rs:291 DurabilityMode, :347 resolve_durability_mode) and to per-bucket durability overrides. Construct the run where the operator sets mode=none (or legacy RUSTFS_DRIVE_SYNC_ENABLE=false) and the new fsync still fires — that is an ungated durability cost and a regression on 4KiB writes.
  - Where: crates/ecstore/src/disk/local.rs, crates/ecstore/src/bucket/durability.rs, crates/ecstore/src/set_disk/** (rename_data/commit paths), any crate doing tokio::fs or std::fs writes
  - Evidence: #4221 fsync work caused a measured -10% 4KiB write regression (#814 investigation), later gated; durability modes added in eaff17cad (#4397), per-bucket tier overrides in 13e48d93a (#4407); 2df315baf (#4493) shows even ancestor-dir fsyncs are routed through the gate
@@ -231,12 +230,12 @@ Null report example: "Attacked the new rename_data commit-section work, durabili

 ### Test-coverage skeptic

- For every testable behavior claim in the PR description, revert that hunk and name the focused test or executable check that detects the revert. If no reasonable check exists, require the reason and residual risk from the validation floor. Especially verify the check exercises the real production path, not a lookalike helper.
+- For every behavior claim in the PR description, revert that hunk (git stash / manual undo of the changed lines) and name the exact test (`cargo test -p <crate> <test_name>`) that fails. If no test fails on revert, the behavior is untested — file a finding, not a note. Especially verify the test exercises the REAL production call path, not a lookalike helper.
  - Where: All crates; highest value in crates/ecstore, rustfs/src/storage, crates/heal
-  - Evidence: AGENTS.md testable-behavior exit criterion. Real bug: PR #4220 (ghost-directory cleanup) merged with green tests but its fix never executed on the real delete path — required follow-up rustfs#4307, backlog#798 stayed OPEN. The tests exercised a path the production flow never took.
+  - Evidence: AGENTS.md exit criterion 'Every behavior change has a test that fails without it'. Real bug: PR #4220 (ghost-directory cleanup) merged with green tests but its fix never executed on the real delete path — required follow-up rustfs#4307, backlog#798 stayed OPEN. The tests exercised a path the production flow never took.
 - Read each added/modified test and confirm it asserts the real outcome (returned value, stored bytes, error variant), not merely 'call succeeded' or 'no panic'. Flag any test whose only observable is that the function returned, and any `assert!(result.is_err())` that never checks WHICH error. Then check: does the test prove the exploit/failure form is denied, or only that the intended form still works?
  - Where: crates/e2e_test (security_boundary_test.rs pattern), and every #[cfg(test)] module in the diff
-  - Evidence: Commit dee8e4e63 (#4466) had to rewrite 277 lines of crates/e2e_test/src/security_boundary_test.rs because 'security boundary tests' passed without asserting real outcomes. .agents/skills/rust-code-quality/SKILL.md requires an observable failure criterion; .agents/skills/security-advisory-lessons/SKILL.md asks whether the exploit form is denied.
+  - Evidence: Commit dee8e4e63 (#4466) had to rewrite 277 lines of crates/e2e_test/src/security_boundary_test.rs because 'security boundary tests' passed without asserting real outcomes. .agents/skills/rust-code-quality/SKILL.md checklist: 'Every test function has at least one assert!'; .agents/skills/security-advisory-lessons/SKILL.md: 'Does the test prove the exploit form is denied, or only that the intended form still works?'
 - When the diff adds a boolean/mode parameter or config flag, find the test that fails if the flag's effect is INVERTED inside the changed function. Tests that were mechanically updated to pass `false`/default at every call site assert nothing about the new behavior. Execute the check: flip the flag's branch in the source and confirm at least one test goes red for each branch.
  - Where: crates/ecstore/src/set_disk/ (e.g. build_codec_streaming_part_reader), any function gaining a parameter
  - Evidence: Commit 05890d6e2 (#4573): PR #4560 added a 15th param allow_inplace_legacy_fallback; the arity tests were fixed by passing `false` everywhere — they assert Err outcomes independent of the flag, so the fallback behavior itself has no revert-detecting test at those sites.
@@ -261,7 +260,7 @@ Null report example: "Attacked the new rename_data commit-section work, durabili
 - For any pagination/limit/truncation change, construct the exact-boundary test: result count == max (page exactly full), max+1, and a delimiter re-fold that lands precisely on the page boundary — assert both the item count AND the is_truncated/continuation marker. Off-by-one at the page boundary is a recurring shipped bug here.
  - Where: crates/ecstore listing paths (list_objects, ListMultipartUploads, metacache), S3 handlers in rustfs/src/storage
  - Evidence: Two shipped boundary bugs: fefa70b31 (#4447) ListMultipartUploads returned one upload past max-uploads; d91f4d455 (#4538) delimiter re-fold of a full page lost the truncation flag. Both survived existing tests because no test pinned n == max exactly.
- A green focused test is evidence only for the targets it builds. Follow the `AGENTS.md` validation tier: add package-scoped Clippy or broader test-target compilation only when changed targets, features, or dependents remain uncovered; do not require a workspace-wide build by default.
+- Green `cargo test -p <crate>` on the touched crate is not a coverage verdict for the diff's test code itself: run `cargo clippy --all-targets -p <crate>` and a workspace-wide test BUILD (`cargo check --workspace --all-targets` at minimum) before accepting the tests as evidence. Test-only code that doesn't compile workspace-wide or fails clippy has repeatedly broken main and masked whether tests ran at all.
  - Where: All crates; especially concurrent-branch merges into crates/ecstore
  - Evidence: #4322 broke main because only cargo test ran (field_reassign_with_default is clippy-only). b06f3df6b (#4441) and 05890d6e2 (#4573): test code broke the workspace test build (E0061) on main after textually-clean merges, failing CI for every open PR.

@@ -272,6 +271,7 @@ Null report example: "Attacked revert-detection for all 3 claimed behaviors (eac
 Probes are distilled from shipped bugs in git history (commit/PR references
 above), GitHub security advisories (see the security-advisory-lessons
 skill), scoped `AGENTS.md` rules, and invariants under `docs/architecture/`
-and `docs/operations/`. Line numbers drift; re-locate the invariant. Merge
-new incidents into an existing probe when they share a failure class; add a
-new probe only for a distinct attack, rather than growing the root policy.
+and `docs/operations/`. Line numbers drift; when a cited location no longer
+matches, trust the invariant and re-locate the code. When a new bug class
+ships, add a probe with its evidence here rather than growing the policy
+section in `AGENTS.md`.
@@ -24,17 +24,15 @@ Use this skill before `gh pr create`, before `gh pr edit`, or when reviewing whe

 2. Inspect change scope
 - Review the diff and summarize what changed.
- Inspect `git diff --stat` and `git diff --numstat`; assess production-code growth separately. Tests, fixtures, generated code, and documentation have no growth budget. Treat line counts as signals, not quotas.
 - Call out unrelated edits, generated artifacts, logs, or secrets as blockers.
 - Mark risky areas explicitly: auth, storage, config, network, migrations, breaking changes.
- Use the simplicity-adversary verdict instead of producing a per-symbol inventory. Block growth only when the review identifies duplication or gives a concrete smaller design that preserves correctness, compatibility, readability, and real boundaries.
- Confirm replacement implementations remove the superseded in-scope path or adapt compatibility at the boundary to one canonical core.
 - Scan the diff for newly added string literals and confirm whether they duplicate values already defined as constants/enums/typed wrappers in the same module or shared modules.
 - Treat introducing a new hardcoded literal where a project constant already exists as a likely regression risk; require either a refactor to reuse the constant or an explicit exception explanation in the PR body.

 3. Verify readiness requirements
- Select checks from `AGENTS.md` "Verification Before PR" based on the final diff's risk tier. Do not replace a focused behavioral test with `make pre-commit`, or a required high-risk `make pre-pr` with a narrower gate.
- For focused verification, state why the selected tier is sufficient and list the scope-specific commands in the PR body.
+- Require `make pre-commit` before marking PRs ready when the diff changes Rust code, product behavior, CI behavior, runtime configuration, security-sensitive logic, migrations, storage, auth, networking, or other high-risk paths.
+- For documentation-only, agent-instruction-only, or local developer-tooling-only changes, allow focused verification instead of `make pre-commit` when it directly validates the changed surface.
+- For focused verification, explain why the full gate was not run and list the scope-specific commands in the PR body.
 - If `make` is unavailable, use the equivalent commands from `.config/make/`.
 - Add scope-specific verification commands when the changed area needs more than the baseline.
 - If required checks fail, stop and return `BLOCKED`.
@@ -83,14 +81,13 @@ Use this skill before `gh pr create`, before `gh pr edit`, or when reviewing whe

 ## Blocker rules

- Return `BLOCKED` if the checks required by the `AGENTS.md` validation tier have not passed.
+- Return `BLOCKED` if a code, behavior, CI, runtime configuration, security-sensitive, migration, storage, auth, networking, or other high-risk change has not passed `make pre-commit`.
 - Return `BLOCKED` if a documentation-only, agent-instruction-only, or local developer-tooling-only change lacks focused verification for the changed surface.
 - Return `BLOCKED` if the diff contains unrelated changes that are not acknowledged.
 - Return `BLOCKED` if required template sections are missing.
 - Return `BLOCKED` if the title/body is not in English.
 - Return `BLOCKED` if the title does not follow the repository's Conventional Commit rule.
 - Return `BLOCKED` if the diff introduces string literals that should use existing constants but did not.
- Return `BLOCKED` for production-code growth only when the review identifies a duplicated or superseded implementation, or supplies a concrete smaller design with equivalent semantics. Fewer lines alone are not evidence.

 ## Reference

@@ -3,8 +3,8 @@
 - Confirm the branch is based on current `main`.
 - Confirm the diff matches the stated scope.
 - Confirm no secrets, logs, temp files, or unrelated refactors are included.
- Confirm the checks required by the `AGENTS.md` validation tier passed.
- For focused verification, confirm it covered the changed surface and the PR body explains why the selected tier is sufficient.
+- Confirm `make pre-commit` passed for code, behavior, CI, runtime configuration, security-sensitive, migration, storage, auth, networking, or other high-risk changes.
+- For documentation-only, agent-instruction-only, or local developer-tooling-only changes, confirm focused verification covered the changed surface and the PR body explains why the full gate was not run.
 - Confirm extra verification commands are listed for risky changes.
 - Confirm the PR title uses Conventional Commits and stays within 72 characters.
 - Confirm the PR title does not use tool-specific prefixes such as `[codex]`.
@@ -1,6 +1,6 @@
 ---
 name: rust-code-quality
-description: Enforce Rust-specific code quality rules on every Rust change. Use before merge to catch unwrap abuse, silent truncation, unnecessary cloning, lock ordering violations, recursion risks, and error type anti-patterns.
+description: Enforce Rust-specific code quality rules on every code change. Use before merge to catch unwrap abuse, silent truncation, unnecessary cloning, lock ordering violations, recursion risks, and error type anti-patterns.
 ---

 # Rust Code Quality Gate
@@ -12,29 +12,27 @@ Use this skill on every Rust code change to enforce quality rules that `cargo cl
 1. Identify changed `.rs` files.
 2. Run automated checks on changed files.
 3. Run manual review checklist on the diff.
-4. Resolve or rebut every finding with evidence; P0/P1 findings cannot be deferred.
+4. Report findings; block merge if P0/P1 issues exist.

 ## Automated Checks

-Use these searches to find candidates in changed `.rs` files. Inspect syntax,
-`#[cfg(test)]` scope, and the changed hunk before reporting a finding; text
-filters do not reliably distinguish production code from tests.
+Run these on every changed `.rs` file (excluding test modules):

 ```bash
-# 1. unwrap/expect candidates
-rg -n '\.unwrap\(\)|\.expect\(' <changed-files>
+# 1. unwrap/expect in production code
+rg -n '\.unwrap\(\)|\.expect\(' <changed-files> | grep -v '#\[cfg(test)\]' | grep -v 'test' | grep -v 'bench'

 # 2. Silent type truncation via `as` cast
 rg -n ' as (u8|u16|u32|u64|usize|i8|i16|i32|i64|isize)\b' <changed-files>

 # 3. String as error type
-rg -n 'Result<.*String>' <changed-files>
+rg -n 'Result<.*String>' <changed-files> | grep -v test

 # 4. Box<dyn Error> in public APIs
-rg -n 'Box<dyn.*Error' <changed-files>
+rg -n 'Box<dyn.*Error' <changed-files> | grep -v test

 # 5. println/eprintln in production
-rg -n 'println!\|eprintln!' <changed-files>
+rg -n 'println!\|eprintln!' <changed-files> | grep -v test

 # 6. Ordering::Relaxed usage (verify each is intentional)
 rg -n 'Ordering::Relaxed' <changed-files>
@@ -48,35 +46,37 @@ rg -n 'unwrap_or_default\(\)|unwrap_or\(' <changed-files>
 For every Rust code change, verify:

 ### Error Handling
- [ ] Every production `unwrap()` or `expect()` is infallible by type or a checked invariant; explain only non-obvious invariants, using an existing type, a useful `expect` message, or a concise comment
+- [ ] No `unwrap()` or `expect()` in production code without justification comment
 - [ ] No `Result<_, String>` in public API signatures
- [ ] Public library APIs use domain errors unless deliberate error erasure at a boundary is part of the contract
+- [ ] No `Box<dyn Error>` in public trait/struct methods
 - [ ] `Error::source()` is overridden when inner error is stored
- [ ] Error messages are actionable without exposing secret input
+- [ ] Error messages are actionable (what failed, with what input)

 ### Type Safety
 - [ ] No silent `as` truncation (negative→unsigned, large→small)
- [ ] Fallible numeric conversions use `TryFrom`/`try_into()` and return a typed error; clamp or saturate only when the domain explicitly requires it
- [ ] Floating-point to integer conversion validates finiteness, sign, and range before conversion
+- [ ] `try_into()` or explicit clamping used for numeric conversions
+- [ ] No `f64 as usize` without prior clamping

 ### Concurrency
 - [ ] Lock acquisition order is documented when multiple locks are used, and matches every other call site taking any overlapping subset (ABBA check)
 - [ ] No `tokio::sync` lock guard (read or write) held across `.await` without bounded hold time — long-lived read guards wedge writers (#4195)
- [ ] Atomic read-modify-write uses the direct `fetch_*` operation when possible; use `compare_exchange` only for conditional updates
+- [ ] Concurrent counters use `compare_exchange` loops, not load-then-store
 - [ ] `std::sync::Mutex` in async context is held only briefly, never across `.await`

 ### Memory and Performance
- [ ] On an identified hot path, report cloning or allocation only with a concrete per-request/per-object cost or benchmark signal
- [ ] Prefer borrowing, moving, `Bytes`/`Arc`, or capacity reservation only when it reduces that cost without obscuring ownership or APIs
+- [ ] No `.clone()` on structs with >5 heap-allocated fields in hot paths
+- [ ] `HashMap::with_capacity()` / `Vec::with_capacity()` used when size is known
+- [ ] Large buffers wrapped in `Arc` rather than cloned
+- [ ] Temporary string computations use `&str` or `Cow<str>` instead of `String`

 ### Recursion Safety
- [ ] Recursion over untrusted, persisted, or otherwise unbounded input has a depth limit or uses iterative traversal
+- [ ] Recursive functions have a depth limit or use iterative traversal
 - [ ] Tree/cache traversals handle corrupted/cyclic input safely

 ### Testing
- [ ] Tests have an observable failure criterion; delegated assertions, `#[should_panic]`, snapshot/property checks, and meaningful `Result` failures do not need a redundant `assert!`
- [ ] Use `expect` only when its message improves failure diagnosis; do not add boilerplate to self-evident test setup
- [ ] Test volume and line count are never treated as production-code growth
+- [ ] Every test function has at least one `assert!`
+- [ ] Tests use `.expect("context")` not bare `.unwrap()`
+- [ ] No `println!`/`eprintln!` in production code (use `tracing`)

 ### Serde
 - [ ] Structs from untrusted input have `#[serde(deny_unknown_fields)]`
@@ -88,18 +88,18 @@ For every Rust code change, verify:
 - [ ] New string literals don't duplicate existing constants

 ### Reuse and Necessity
- [ ] No new helper duplicates `crates/utils`, `crates/common`, the touched crate, the likely domain-owning crate, a relevant direct dependency, or plain std/tokio behavior; reused helpers match the call site's semantics
+- [ ] No new helper duplicating an existing workspace utility (`crates/utils`, `crates/common`, the touched crate) or plain std/tokio behavior no wrapper refines; reused helpers match the call site's semantics (normalization, error type, backoff, durability gating)
 - [ ] No branch without a nameable concrete trigger; no re-validation of what a validated upstream layer on the same path already guarantees (Cross-Cutting Domain Invariant patterns and pre-destructive-action re-checks are load-bearing — keep them)
 - [ ] Error context attached once where actionable, not re-wrapped at every hop; no typed→generic error conversion below aggregation/quorum layers
- [ ] Comments avoid narration and change history while completely stating non-obvious lock, `SAFETY`, durability, compatibility, and unwrap invariants
+- [ ] No comments narrating the next line, restating a signature, or describing the change itself (invariant comments — lock ordering, `SAFETY`, unwrap justification — are not narration)
 - [ ] No near-duplicate test pinning the same code path and poison-value class as an existing test (boundary companions — n==max vs max+1, absent/empty/nil UUID — are never near-duplicates)

 ## Severity Classification

- **P0 (Block merge)**: demonstrated data loss, security breach, remote crash, or deadlock
- **P1 (Must fix)**: concrete correctness, compatibility, or material hot-path regression
- **P2 (Should fix)**: avoidable duplication or maintainability issue with a concrete simpler replacement
- **P3 (Nice to fix)**: local style or clarity issue with no behavioral risk
+- **P0 (Block merge)**: `unwrap()` in request hot path, silent truncation on user input, lock ordering violation, recursion without depth limit
+- **P1 (Must fix)**: `Result<_, String>` in public API, unnecessary clone in hot path, `Box<dyn Error>` in trait method, `unwrap_or_default()` on a domain-required value (metadata, quorum, version id)
+- **P2 (Should fix)**: Missing `assert!` in test, `println!` in production, missing `with_capacity`, new helper duplicating an existing workspace utility, defensive branch with no nameable trigger (corrupt or stale persisted/peer data is always a nameable trigger for boundary-crossing values), near-duplicate test, redundant error re-wrapping
+- **P3 (Nice to fix)**: Naming convention violation, missing doc comment, `as_ptr()` vs `Arc::ptr_eq`, narrating comment

 ## Output Template

@@ -107,10 +107,10 @@ For every Rust code change, verify:
 ## Rust Code Quality Report

 ### Automated Scan
- unwrap/expect candidates inspected: N
- numeric-cast candidates inspected: N
- error-type candidates inspected: N
- output-macro candidates inspected: N
+- unwrap/expect in production: N found
+- as casts: N found
+- String errors: N found
+- println/eprintln: N found

 ### Findings
 - [P1] `path:line` — description
@@ -0,0 +1,52 @@
+# Rust Code Quality Checklist
+
+Use this as a quick pre-merge checklist for every Rust code change.
+
+## Critical (P0 — block merge)
+
+| Check | Command |
+|-------|---------|
+| No `unwrap()` in request/storage hot path | `rg '\.unwrap\(\)' <files> \| grep -v test` |
+| No `as` truncation on user input | `rg ' as (u32\|usize\|i32)' <files>` |
+| Lock order consistent across call sites | Manual: trace all lock acquisitions |
+| Recursive functions have depth limit | Manual: check for `max_depth` or iterative pattern |
+| No `panic!`/`unwrap_or_else(panic!)` in production | `rg 'panic!\|unwrap_or_else.*panic' <files> \| grep -v test` |
+
+## High (P1 — must fix)
+
+| Check | Command |
+|-------|---------|
+| No `Result<_, String>` in public API | `rg 'Result<.*String>' <files> \| grep -v test` |
+| No `Box<dyn Error>` in public trait | `rg 'Box<dyn.*Error' <files> \| grep -v test` |
+| No unnecessary `.clone()` in hot path | Manual: check loops and per-request paths |
+| `Error::source()` implemented when inner error stored | Manual: check `impl Error` |
+| No `eprintln!`/`println!` in production | `rg 'println!\|eprintln!' <files> \| grep -v test` |
+
+## Medium (P2 — should fix)
+
+| Check | Command |
+|-------|---------|
+| Tests have assertions | Manual: check for `assert` in test functions |
+| `HashMap`/`Vec` use `with_capacity` when size known | Manual: check `::new()` in loops |
+| No `#![allow(dead_code)]` at crate root | `rg 'allow.dead_code' <files> \| grep 'lib.rs'` |
+| Serde structs from untrusted input have `deny_unknown_fields` | Manual: check `#[derive(Deserialize)]` |
+
+## Low (P3 — nice to fix)
+
+| Check | Command |
+|-------|---------|
+| No camelCase statics | `rg 'static ref [a-z]' <files>` |
+| `Arc::ptr_eq` instead of `as_ptr + ptr::eq` | `rg 'as_ptr\|ptr::eq' <files>` |
+| Public functions have doc comments | `rg 'pub fn' <files> \| grep -v '///'` |
+
+## Quick One-Liner
+
+```bash
+# Run all automated checks on changed files
+CHANGED=$(git diff --name-only HEAD~1 -- '*.rs' | grep -v test | grep -v bench)
+echo "=== unwrap/expect ===" && rg -c '\.unwrap\(\)|\.expect\(' $CHANGED 2>/dev/null
+echo "=== as casts ===" && rg -c ' as (u8|u16|u32|u64|usize|i8|i16|i32|i64|isize)\b' $CHANGED 2>/dev/null
+echo "=== String errors ===" && rg -c 'Result<.*String>' $CHANGED 2>/dev/null
+echo "=== println ===" && rg -c 'println!|eprintln!' $CHANGED 2>/dev/null
+echo "=== Ordering::Relaxed ===" && rg -c 'Ordering::Relaxed' $CHANGED 2>/dev/null
+```
@@ -1,6 +1,6 @@
 ---
 name: rustfs-logging-governance
-description: Standardize and review RustFS logging with structured `tracing` events, lower noise on hot paths, preserve security-sensitive diagnostics, and extend guardrails to prevent legacy logging patterns from returning. Use whenever a change adds or edits any `tracing` macro call (`error!`/`warn!`/`info!`/`debug!`/`trace!`/`#[instrument]`) — including a single log line added in passing while fixing unrelated logic, which is how most new log sites enter the repo — and when reviewing RustFS logs, startup/config diagnostics, cloud metadata logs, request validation logs, or `scripts/check_logging_guardrails.sh`.
+description: Standardize and review RustFS logging with structured `tracing` events, lower noise on hot paths, preserve security-sensitive diagnostics, and extend guardrails to prevent legacy logging patterns from returning. Use when editing or reviewing RustFS logs, startup/config diagnostics, cloud metadata logs, request validation logs, or `scripts/check_logging_guardrails.sh`.
 ---

 # RustFS Logging Governance
@@ -1,21 +1,19 @@
 ---
 name: rustfs-release-publish
-description: "End-to-end RustFS release pipeline: first publish any merged-but-unreleased rustfs/console changes and wait for its latest Release asset, then bump RustFS version files on main directly to the final target, publish a visible GitHub prerelease from a preview tag without updating latest channels, validate it, and publish the final tag on the SAME commit. Use whenever the user wants to release/publish a RustFS version (发版/发布)."
+description: "End-to-end RustFS release pipeline: bump version files on main directly to the final target version, cut a preview tag on that commit, verify the CI build and release artifacts, run the downloaded binary locally and exercise the console, validate the server with the latest rc client, then publish the final tag on the SAME validated commit — never a new bump commit, never latest main. Use whenever the user wants to release/publish a RustFS version (发版/发布)."
 ---
 # RustFS Release Publish (preview-validated pipeline)

 This skill orchestrates a full release. It wraps `rustfs-release-version-bump` (which only edits version files and opens the PR) with a mandatory preview-tag validation loop before the final tag is published.

-Core design: **version files never carry a `-preview.N` suffix**. The preview suffix exists only in tag names. A preview tag creates a visible GitHub Release marked Prerelease and uploads versioned assets, but it never becomes GitHub Latest and never updates `*-latest`, `latest.json`, R2, Docker, or Helm channels. This works because the binary self-reports the git tag it was built from (`build::TAG` via shadow_rs, see `rustfs/src/config/cli.rs` `SHORT_VERSION`), and `build.yml` derives artifact names and preview classification from the tag name — Cargo.toml's version is only a no-tag fallback. Therefore the preview tag and the final tag can (and MUST) point at the exact same commit: what you validated is byte-for-byte the source that ships.
+Core design: **version files never carry a `-preview.N` suffix**. The preview suffix exists only in tag names. This works because the binary self-reports the git tag it was built from (`build::TAG` via shadow_rs, see `rustfs/src/config/cli.rs` `SHORT_VERSION`), and `build.yml` derives artifact names and prerelease classification from the tag name — Cargo.toml's version is only a no-tag fallback. Therefore the preview tag and the final tag can (and MUST) point at the exact same commit: what you validated is byte-for-byte the source that ships.

 Pipeline shape:

 ```
-check console main against its latest Release
-  -> if ahead: publish console -> wait for Release asset + latest API
-  -> bump RustFS version files to <target> (final version, ONE commit) -> merge
+bump version files to <target> (final version, ONE commit) -> merge
  -> tag <preview-tag> at that commit -> CI green
-  -> verify preview Release assets -> run binary locally + console checks
+  -> verify release artifacts -> run binary locally + console checks
  -> validate with latest rc client
  -> tag <target> at the SAME commit (zero delta) -> re-verify CI/release
 ```
@@ -25,7 +23,7 @@ On validation failure: fix lands on main via normal PR (version files are alread
 ## Required inputs

 - Final target version, for example `1.0.0-beta.10`.
- Preview iteration `N` (default: next unused preview tag for that target; check with `git tag -l '<target>-preview.*'` after `git fetch --tags`).
+- Preview iteration `N` (default: next unused preview tag for that target; check with `git tag -l '<target>-preview.*'` — and for stable targets `git tag -l '<target>-rc.*'` — after `git fetch --tags`).

 If the target version is missing or ambiguous, stop and ask before doing anything (see the semver gate below).

@@ -47,18 +45,14 @@ Rules:

 ## Preview tag naming

- Use `<target>-preview.N` for every target, e.g. `1.0.0-beta.10-preview.3` or `1.1.0-preview.1`.
- The canonical suffix is exactly `-preview.<digits>`. `build.yml` recognizes it before alpha/beta/rc classification and routes it to the preview-only path; any other tag containing `-preview` fails closed instead of being treated as a release.
- A preview Release MUST be published with `isPrerelease=true` and `isLatest=false`. Any `*-latest` preview asset or preview-triggered `latest.json`, R2, Docker, or Helm publication is a pipeline failure.
+- Prerelease target (contains `alpha`/`beta`/`rc`): preview tag is `<target>-preview.N`, e.g. `1.0.0-beta.10-preview.3`. It contains `beta`, so `build.yml`'s substring-based classification marks it prerelease — safe.
+- **Stable** target (e.g. `1.1.0`): NEVER tag `1.1.0-preview.N` — `build.yml` marks a tag prerelease only if its name contains `alpha`, `beta`, or `rc`, so `1.1.0-preview.N` would be treated as a stable release and overwrite `latest.json` as stable. Use `1.1.0-rc.N` as the preview tag instead.

 ## Hard rules

 - Version files (Cargo.toml, Cargo.lock, README, flake.nix, Chart.yaml, rustfs.spec) are bumped ONCE, directly to `<target>`. Never write a `-preview.N` suffix into any version file. If `rustfs-release-version-bump` is ever asked for a `-preview` version, that is a pipeline bug — stop.
- Preview Release assets are versioned and intentionally visible on the Releases page. Do not label them Latest or use them to update any latest distribution channel.
 - Tags have no `v` prefix. Always annotated: `git tag -a <tag> -m "Release <tag>"`.
 - The final tag MUST point at exactly `PREVIEW_HASH` — the commit the validated preview tag points at. Never tag current `main` HEAD (commits merged after validation are unvalidated), and never create an extra version-bump commit between preview and final.
- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
- Generated Release notes carry a workflow-management marker so retries can repair them. Before manually curating a generated body, remove that marker; unmarked non-placeholder notes are preserved by later workflow runs.
 - Phases run in order; a failure in any phase blocks everything after it. After the fix lands on main, restart from Phase 2 with the next preview iteration against the new `origin/main` hash — do not resume mid-pipeline against a stale hash.
 - If the release is abandoned after Phase 1 merged, main's version files claim a version that was never tagged. Either revert the bump PR or leave it to be overwritten by the next release — but tell the user explicitly and record the decision.
 - User-facing status updates in Chinese; commits, PR titles/bodies, and tag messages in English. No hard-wrapping in commit messages, PR bodies, or documentation prose — one logical line per sentence/paragraph, let soft wrap handle display.
@@ -69,61 +63,6 @@ Rules:
 - `gh auth status` works; confirm you can view `gh release list -L 3`.
 - Confirm the exact final target version with the user if not explicit.

-### Console release gate
-
-Complete this gate before changing any RustFS version file or creating any RustFS tag. RustFS `build.yml` downloads the asset returned by `repos/rustfs/console/releases/latest`, so a successful Console build alone is insufficient.
-
-1. Read the latest published Console tag and compare it with Console `main`:
-
-```bash
-CONSOLE_REPO="rustfs/console"
-CONSOLE_LATEST=$(gh api "repos/${CONSOLE_REPO}/releases/latest" --jq .tag_name)
-gh api "repos/${CONSOLE_REPO}/compare/${CONSOLE_LATEST}...main" \
-  --jq '{status, ahead_by, behind_by, commits: [.commits[] | {sha, message: .commit.message}]}'
-```
-
- `ahead_by == 0`: no merged Console change is waiting for release. Still verify the current latest asset using step 4, then continue to Phase 1.
- `ahead_by > 0` and `behind_by == 0`: publish Console before continuing. Report the merged commits and select the next unused `vX.Y.Z` tag. Default to the next patch version when the changes are fixes or backward-compatible UI work; stop for confirmation if a minor/major bump is plausible.
- Any diverged history or `behind_by > 0`: stop and resolve the Console release baseline explicitly. Do not guess a range or publish RustFS.
-
-2. Clone/fetch `rustfs/console` into a scratch directory and record its exact `main` commit. Before creating a tag, check for a `v*` tag or Release workflow already associated with that hash. If one is in progress, wait for it instead of creating another version:
-
-```bash
-CONSOLE_SCRATCH=$(mktemp -d)
-gh repo clone "$CONSOLE_REPO" "$CONSOLE_SCRATCH/console"
-git -C "$CONSOLE_SCRATCH/console" fetch origin main --tags
-CONSOLE_HASH=$(git -C "$CONSOLE_SCRATCH/console" rev-parse origin/main)
-git -C "$CONSOLE_SCRATCH/console" tag --points-at "$CONSOLE_HASH" 'v*'
-gh run list -R "$CONSOLE_REPO" --workflow release.yml --commit "$CONSOLE_HASH" --limit 5
-```
-
-If no release exists or is running for `CONSOLE_HASH`, create the selected annotated tag at that exact hash and push it:
-
-```bash
-git -C "$CONSOLE_SCRATCH/console" tag -a "<console-tag>" -m "Release <console-tag>" "$CONSOLE_HASH"
-git -C "$CONSOLE_SCRATCH/console" push origin "<console-tag>"
-```
-
-Console tags include the `v` prefix. Pushing the tag triggers `.github/workflows/release.yml` (`🚀 Release`). Remove `CONSOLE_SCRATCH` after the gate completes.
-
-3. Find the exact tag run and wait for completion:
-
-```bash
-gh run list -R "$CONSOLE_REPO" --workflow release.yml --branch "<console-tag>" --limit 1
-gh run watch -R "$CONSOLE_REPO" "<console-run-id>" --exit-status
-```
-
-4. Block until the published Release is non-draft, the latest endpoint returns the expected tag, and `rustfs-console-<console-tag>.zip` is uploaded, non-empty, and carries a `sha256:` digest:
-
-```bash
-gh release view -R "$CONSOLE_REPO" "<console-tag>" --json isDraft,isPrerelease,assets,url
-test "$(gh api "repos/${CONSOLE_REPO}/releases/latest" --jq .tag_name)" = "<console-tag>"
-test "$(gh api "repos/${CONSOLE_REPO}/releases/tags/<console-tag>" \
-  --jq '[.assets[] | select(.name == "rustfs-console-<console-tag>.zip" and .state == "uploaded" and .size > 0 and (.digest | startswith("sha256:")))] | length')" -eq 1
-```
-
-Treat a missing/mismatched asset, digest, latest tag, or failed/cancelled workflow as BLOCKED. Do not start Phase 1 until the Console gate passes. Record `CONSOLE_TAG`, `CONSOLE_HASH`, Console run URL, and Release URL for the final report.
-
 ## Phase 1 — Version bump to the final target (once)

 - If main's version files already read `<target>` (e.g. this is a restart after a failed preview), verify with `rg -n "<target>" Cargo.toml rustfs.spec helm/rustfs/Chart.yaml` and skip to Phase 2.
@@ -146,17 +85,16 @@ git push origin "<preview-tag>"

 Pushing the tag triggers `.github/workflows/build.yml` ("Build and Release"); `docker.yml` chains off it via `workflow_run`.

-The preview run builds versioned artifacts and publishes them in a GitHub prerelease. Its latest-channel, R2, Docker, and Helm jobs must be skipped. Those publication paths run only after the final tag is pushed.
-
 On a restart (N+1), refresh `PREVIEW_HASH=$(git rev-parse origin/main)` first — it must contain the fix — and re-report it.

-## Phase 3 — CI and preview Release verification
+## Phase 3 — CI and artifact verification

- Find and watch the tag build: `gh run list --workflow build.yml --branch "<preview-tag>" --limit 1` then `gh run watch <run-id>`. Every build matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64).
- Confirm the Release publication jobs (`create-release`, `upload-release-assets`, and `publish-release`) succeed while `update-latest-version` is skipped.
- Verify `gh release view "<preview-tag>" --json isPrerelease,assets,url`: `isPrerelease` must be `true`, and the Release must contain all 6 versioned platform zips, checksums, SBOM, and provenance with no `-latest` assets. Confirm `gh api repos/{owner}/{repo}/releases/latest --jq .tag_name` does not return `<preview-tag>`.
- Record `PREVIOUS_DELIVERABLE`, selected from published Releases by `publishedAt` after excluding the current tag and every `-preview.N` tag. Verify `gh release view "<preview-tag>" --json body --jq .body` contains `## What's Changed` and, when `PREVIOUS_DELIVERABLE` exists, `**Full Changelog**: https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<preview-tag>`. For a repository with no previous deliverable, verify a Full Changelog link exists and record the GitHub baseline fallback.
- Confirm preview-triggered Docker and Helm jobs are skipped. Preview validation covers the built RustFS binaries, embedded console, and rc compatibility; Docker image construction and Helm publication are deferred to the final tag because the Dockerfiles consume GitHub Release assets.
+- Watch the tag build: `gh run list --workflow build.yml --limit 5` then `gh run watch <run-id>`. Every matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64) plus the release and latest.json jobs.
+- Verify the GitHub release: `gh release view "<preview-tag>" --json isPrerelease,assets`
+  - `isPrerelease` must be `true`.
+  - Assets must include all 6 platform zips in both versioned (`rustfs-<platform>-v<tag>.zip`) and `-latest` forms, plus `SHA256SUMS`, `SHA512SUMS`, `rustfs-<tag>.sbom.cdx.json`, `rustfs-<tag>.provenance.json`.
+- Verify the chained Docker run succeeded: `gh run list --workflow docker.yml --limit 3`.
+- Checksum spot-check for the platform you will run locally: download the zip and `SHA256SUMS`, verify with `shasum -a 256 -c` (grep to one line).

 ## Phase 4 — Run the artifact locally, verify the console

@@ -219,15 +157,13 @@ git push origin "<target>"
 ```

 - CI rebuilds from the same source; the only changed input is the tag name, so the binary now self-reports `<target>`.
- Verify the final tag's complete publication path: all matrix and release jobs green; `gh release view "<target>"` shows the full versioned and `-latest` asset set plus checksums, SBOM, and provenance; Docker and Helm workflows succeed; `latest.json` points to `<target>`. A stable target must have `isPrerelease=false` and `isLatest=true`. An alpha/beta/rc target must have `isPrerelease=true`; GitHub does not permit prereleases to be Latest, but the project `latest.json` still advances to the final non-preview target.
- Verify the final Release body contains `## What's Changed` and a Full Changelog link. When `PREVIOUS_DELIVERABLE` exists, the link MUST be `https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<target>` and the baseline MUST equal the preview Release baseline; for example, both `1.0.0-beta.12-preview.1` and `1.0.0-beta.12` compare from `1.0.0-beta.11`.
+- Re-run the Phase 3 verification against the final tag: all matrix jobs green; `gh release view "<target>"` shows the full asset set; for a prerelease target `isPrerelease` is `true`, for a stable target it must be `false` and `latest.json` must be updated.
 - Optionally spot-check `./rustfs --version` from a final-tag artifact — it must report `<target>`.

 ## Output contract

 Always report:

- Console gate result: previous/latest Console tags, whether merged changes required a release, `CONSOLE_HASH`, and Console run/Release URLs when a release was published.
 - Target version, preview tag(s) used, `PREVIEW_HASH` (which both tags point at).
- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: preview and final Release URLs, preview `isPrerelease`/`isLatest` state, final latest-channel state, console check results, and the rc command matrix.
+- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: CI run URLs, release URLs, console check results, the rc command matrix.
 - Any deviation from this pipeline and why the user approved it.
@@ -18,7 +18,7 @@ Validated baseline: release pattern used in PR `#2957`.

 If target version is missing or ambiguous, stop and ask before editing.

-Reject any target version containing `-preview`: preview identifiers are tag-only (see `rustfs-release-publish`) and must never be written into version files. If asked for one, stop and point to the release pipeline instead of editing.
+Reject any target version containing a `-preview.` suffix: preview identifiers are tag-only (see `rustfs-release-publish`) and must never be written into version files. If asked for one, stop and point to the release pipeline instead of editing.

 ## Read before editing

@@ -66,23 +66,14 @@ For the full pattern map, read [advisory-patterns.md](references/advisory-patter

 ### STS, OIDC, and federation flows
 - Every STS endpoint must have an explicit authentication story: SigV4 where required, OIDC token verification for web identity, and role/session policy validation before issuing credentials.
- For web identity, the JWT is the credential; exemption from SigV4 is not itself an authentication bypass. Treat pre-verification claims only as untrusted routing hints, bound token size, normalize public failures, rate-limit discovery, and issue credentials only after signature, issuer, audience, and expiration checks.
 - JWT session tokens must be signed and verified by a trusted issuer/key path, not by service-account-controlled material or a reused root secret.
 - JWT verification must enforce required claims and expiration for every bearer token path; "allow missing exp" is never acceptable for user-presented credentials.
 - Public OIDC bootstrap and callback routes must treat `Host`, `X-Forwarded-Proto`, redirect targets, `state`, and callback parameters as untrusted; credential-bearing redirects require a configured, allowlisted origin.
 - OIDC discovery and validation URLs are SSRF sinks. Resolve and classify hostnames at connection time, reject rebinding to loopback/private/link-local ranges, and do not rely on literal string checks.

-### IAM policy conditions and plugins
- Treat request headers as attacker-controlled even after SigV4; callers sign their own spoofed headers. Do not merge them into server-derived condition keys such as identity, groups, version ID, signature version, JWT, or LDAP claims.
- Keep the condition-key namespace explicit. Reserved server-derived keys must reject or ignore colliding headers, while intentional request-header keys such as `s3:x-amz-*` remain available.
- Quantified IAM condition tests need partially overlapping multi-value sets. Fully contained and fully disjoint sets cannot distinguish `ForAllValues` from `ForAnyValue` bugs.
- External policy plugins must receive the same security context as built-in policy evaluation. If OPA or another plugin depends on existing object tags, load and pass `ExistingObjectTag/*` before the plugin decision.
-
-### S3 object actions, copy, multipart, and presigned POST
- Version-aware object requests need version-aware actions. Explicit `versionId` reads and copy sources must authorize `s3:GetObjectVersion`, not only `s3:GetObject`.
+### S3 copy, multipart, and presigned POST
 - Multipart copy must enforce source `GetObject` and destination `PutObject` semantics equivalent to `CopyObject`, including copy-source and policy conditions.
 - Do not let `CreateMultipartUpload`, `UploadPartCopy`, `CompleteMultipartUpload`, or `AbortMultipartUpload` return success without authorization.
- Fallbacks from version actions to non-version actions must still pass the same public-access-block, anonymous-deny, and post-authorization gates as a direct allow.
 - Presigned POST policies are server-side contracts. Enforce `content-length-range`, key prefix, exact metadata/content-type, and all signed policy conditions.

 ### Protocol frontends and IAM parity
@@ -141,11 +132,6 @@ For the full pattern map, read [advisory-patterns.md](references/advisory-patter
 - When touching reader/writer wrappers such as hashing, encryption, compression, or warp readers, verify wrapper order and inspect stored bytes in regression tests.
 - Avoid helper shortcuts that unwrap nested readers and accidentally bypass encryption or integrity layers.

-### Object Lock and retention invariants
- Object Lock state must fail closed when bucket metadata is unreadable, fabricated, or unparsable. Only a confirmed absence of Object Lock configuration may permit unprotected deletes or writes.
- Do not collapse metadata read faults, missing persisted metadata, parse failures, and genuinely absent Object Lock config into one "not configured" result.
- Retention enforcement must cover foreground deletes, batch deletes, force-delete helpers, default-retention materialization on PUT, lifecycle expiry, scanner sweeps, and all-versions expiry.
-
 ## Review Prompts

 Use these prompts while reviewing a diff:
@@ -162,9 +148,5 @@ Use these prompts while reviewing a diff:
 - Does this outbound validation path resolve attacker-supplied hostnames and reject private, loopback, link-local, and rebound addresses at the actual connection boundary?
 - Is an archive entry, object key, or policy resource normalized differently between authorization and storage?
 - Is the same operation implemented in multiple paths, such as `CopyObject` vs `UploadPartCopy`, and do all paths enforce the same security contract?
- Does an explicit object version, fallback action, or plugin authorization path pass through the same action and post-authorization gates as the direct S3 path?
- Can a caller-controlled header populate a condition key that should be derived only by the server?
- Do condition tests include partially overlapping multi-value inputs for quantified operators?
- Does unreadable bucket metadata make Object Lock or retention enforcement fail closed rather than disappear?
 - Does a preview or browser-surface fix preserve the original security invariant when adding alternate viewers or file-type detection?
 - Does the test prove the exploit form is denied, or only that the intended form still works?
@@ -35,21 +35,12 @@ Update this file only when an advisory adds or changes a reusable lesson, affect
 ### STS, OIDC, and federation flows

 - `GHSA-5qfg-mf7r-jp3w` and `GHSA-3473-5353-xhwh`: `AssumeRoleWithWebIdentity` was reachable through unauthenticated `POST /` routing and could issue temporary credentials from crafted web identity input. Lesson: every STS route needs explicit SigV4 or trusted identity-provider validation before role assumption, and unauthenticated exemptions must be narrowed to the exact action with uniform failure responses.
- `GHSA-jxrr-r6pv-h958`: unsigned JWT issuer data was decoded before verification to select an OIDC provider, and distinguishable failures could expose provider configuration. Lesson: web-identity routing may be unauthenticated, but pre-verification claims are untrusted routing hints; bound and rate-limit the request, normalize public errors, and verify signature, issuer, audience, and expiration before issuing credentials.
- `GHSA-ccrv-v8v9-ch9q`, `GHSA-48rf-7j3q-3hfv`, and `GHSA-xvfh-7c9g-hpw2`: service-account-controlled material could self-sign JWT session tokens with forged policy claims, and missing `exp` was accepted for service-account tokens. Lesson: session tokens must be signed by a trusted issuer/key path, enforce required claims and expiration, and reject self-signed or principal-controlled tokens.
+- `GHSA-ccrv-v8v9-ch9q` and `GHSA-48rf-7j3q-3hfv`: service-account-controlled material could self-sign JWT session tokens with forged policy claims, and missing `exp` was accepted for service-account tokens. Lesson: session tokens must be signed by a trusted issuer/key path, enforce required claims and expiration, and reject self-signed or principal-controlled tokens.
 - `GHSA-9pjf-w3c2-m32r`, `GHSA-4x2q-cpx9-9h26`, and `GHSA-xvpm-p3f7-34c3`: public OIDC authorize/callback flows trusted request `Host` or forwarded scheme when building credential-bearing redirects. Lesson: OIDC redirects must use configured allowlisted origins and trusted-proxy handling; never derive the post-login credential destination from direct client headers.
 - `GHSA-m479-9x88-94w6`, `GHSA-frwq-mfqx-83p8`, `GHSA-q9q8-rf9r-fg9f`, and `GHSA-j5c2-hhf7-6gf5`: OIDC validation accepted attacker-controlled discovery URLs because hostname checks rejected only literal forbidden IPs, allowing DNS rebinding SSRF. Lesson: outbound federation URL validation must resolve and classify hostnames at the connection boundary and reject loopback, private, link-local, and rebound addresses.

-### IAM policy conditions and external policy plugins
+### S3 copy, multipart, and upload policy validation

- `GHSA-6r96-hmgc-726c`: request headers collided with lowercase server-derived condition keys such as `userid`, `groups`, `versionid`, and JWT/LDAP claims. Lesson: never let caller-controlled headers append to or replace server-derived policy context; reserve trusted condition keys and keep intentional request-header keys separate.
- `GHSA-v9cp-qfw9-9pfp`: quantified negated string conditions applied negation after aggregation, transposing `ForAllValues` and `ForAnyValue` semantics. Lesson: push negation into the per-value predicate for quantified operators and test partially overlapping multi-value sets.
- `GHSA-5w8r-p896-6vq2`: OPA policy mode skipped `ExistingObjectTag/*` loading, so tagged objects looked untagged to external policies. Lesson: external authorization plugins need the same object-tag and request context as built-in policy evaluation before they decide.
-
-### S3 object actions, copy, multipart, and upload policy validation
-
- `GHSA-3ppv-fx5m-m749`: explicit `versionId` reads and copy sources authorized `s3:GetObject` instead of `s3:GetObjectVersion`. Lesson: version-specific object access must select version-specific actions for direct reads, `CopyObject`, and `UploadPartCopy`, with tests proving the backend is not reached on denial.
- `GHSA-x298-9x87-fvjq`: anonymous `ListObjectVersions` fell back to `ListBucket` and returned before public-access-block gates. Lesson: compatibility fallbacks must converge on the same post-authorization checks as direct grants, especially `RestrictPublicBuckets` and anonymous data-plane denies.
 - `GHSA-mx42-j6wv-px98`: `UploadPartCopy` missed source authorization and allowed cross-bucket object exfiltration. Lesson: multipart copy must enforce the same source and destination contract as `CopyObject`.
 - `GHSA-wfxj-ph3v-7mjf`: `UploadPartCopy` checked source and destination independently but missed destination copy-source policy constraints. Lesson: source read and destination write checks are not sufficient when policy constrains allowed copy sources.
 - `GHSA-w5fh-f8xh-5x3p`: presigned POST accepted uploads without enforcing signed policy conditions. Lesson: parse and enforce all POST policy constraints server-side, including size, key prefix, and content type.
@@ -68,7 +59,7 @@ Update this file only when an advisory adds or changes a reusable lesson, affect

 ### Secrets, defaults, and cryptographic misuse

- `GHSA-j59h-h7q5-q348`, `GHSA-3wm5-wpm5-hmfm`, `GHSA-6wc8-xm48-qhmx`, `GHSA-9gf3-jx4p-4xxf`, `GHSA-63xc-c3w3-m2cf`, and `GHSA-ch63-6q4v-hwp5`: RustFS shipped known default root credentials that could authenticate to S3, admin APIs, IAM, KMS, console, and token-signing surfaces. Lesson: root credentials must be operator-provided or generated per install; known defaults and warnings are not acceptable for network-reachable deployments.
+- `GHSA-j59h-h7q5-q348`, `GHSA-3wm5-wpm5-hmfm`, `GHSA-6wc8-xm48-qhmx`, `GHSA-9gf3-jx4p-4xxf`, and `GHSA-63xc-c3w3-m2cf`: RustFS shipped known default root credentials that could authenticate to S3, admin APIs, IAM, KMS, console, and token-signing surfaces. Lesson: root credentials must be operator-provided or generated per install; known defaults and warnings are not acceptable for network-reachable deployments.
 - `GHSA-h956-rh7x-ppgj`: gRPC used the hard-coded token `rustfs rpc` on both client and server. Lesson: source-visible shared tokens are authentication bypasses.
 - `GHSA-r5qv-rc46-hv8q`: internode RPC HMAC secret fell back to the public default `rustfsadmin`. Lesson: RPC/internode auth must fail closed instead of silently using public defaults.
 - `GHSA-75fx-qg6f-8rm7` and `GHSA-68cw-96m3-h2cf`: internode RPC secrets were derivable from known root credentials, making raw storage RPC signatures forgeable when explicit RPC secrets were unset. Lesson: RPC auth keys must be independent random secrets, never derived from S3 root credentials, and raw storage RPC should not share the public S3 listener without an internode-only boundary.
@@ -101,10 +92,6 @@ Update this file only when an advisory adds or changes a reusable lesson, affect

 - `GHSA-xrrf-67jm-3c2r`: SSE metadata reported encryption while reader composition bypassed `EncryptReader` and stored plaintext. Lesson: test actual bytes on disk and wrapper order, not only API metadata.

-### Object Lock and retention invariants
-
- `GHSA-j548-9grx-fh4f`: Object Lock enforcement treated unreadable, fabricated, or unparsable bucket metadata as absent configuration and allowed retained objects to be deleted or expired. Lesson: retention must fail closed unless Object Lock absence is authoritative, and every delete, lifecycle, scanner, force-delete, and default-retention path needs the same state distinction.
-
 ### Serde deserialization and input validation

 - No `#[serde(deny_unknown_fields)]` found across the entire codebase. Lesson: all structs deserialized from untrusted input (S3 API XML/JSON, lifecycle rules, bucket policies, replication configs) should have `#[serde(deny_unknown_fields)]` to reject malformed or adversarial payloads.
@@ -120,13 +107,11 @@ Use these targeted searches when a diff touches security-sensitive code:
 rg -n "validate_admin_request|check_permissions|AdminAction::|deny_only|is_allowed" rustfs crates
 rg -n "authorize_operation|FtpsDriver|SftpDriver|RETR|MKD|SIZE|MDTM|CreateBucket|GetObject|HeadObject" crates/protocols rustfs
 rg -n "UploadPartCopy|upload_part_copy|CompleteMultipart|PostObject|content-length-range|starts-with" rustfs crates
-rg -n "ListBucketVersions|GetObjectVersion|versionId|VersionId|ExistingObjectTag|ForAllValues|ForAnyValue|POLICY_PLUGIN|opa" rustfs crates
 rg -n "normalize_extract_entry_key|Snowball|auto-extract|PathBuf::join|canonicalize|\\.\\.|x-forwarded-for|x-real-ip|SourceIp" rustfs crates
 rg -n "DEFAULT_SECRET|DEFAULT_ACCESS|TEST_PRIVATE_KEY|rustfs rpc|RUSTFS_RPC_SECRET" rustfs crates
 rg -n "TONIC_RPC_PREFIX|verify_rpc_signature|check_auth|NodeServiceServer|x-rustfs-signature" rustfs crates
 rg -n "debug!|trace!|info!|error!|\\?resp|\\?merged_config|session_token|secret_key" rustfs crates
 rg -n "HashReader|EncryptReader|SSE|server-side encryption|Access-Control-Allow-Credentials|Origin" rustfs crates
-rg -n "ObjectLock|object_lock|retention|COMPLIANCE|GOVERNANCE|delete_prefix|lifecycle|scanner" rustfs crates
 rg -n "deny_unknown_fields|serde.default|as u32|as usize|as i32" rustfs crates
 ```

@@ -136,12 +121,9 @@ rg -n "deny_unknown_fields|serde.default|as u32|as usize|as i32" rustfs crates
 - Protocol frontend authz fixes: include denied `RETR`, `SIZE`/`MDTM`, `MKD`, bucket probe, and sibling allowed-operation cases, and assert denied paths do not reach the storage backend.
 - IAM fixes: include import/update/list service-account cases with attacker-controlled parent, claims, access key, secret key, and policy.
 - Copy/upload fixes: include cross-bucket, cross-user, source-denied, destination-denied, copy-source-condition, and multipart completion cases.
- Version-action fixes: include historical UUID, explicit current version, `null`, range, partNumber, presigned, STS/session, service-account, anonymous bucket-policy, copy source, and multipart-copy source cases.
- Policy-condition fixes: include reserved-key header collisions, missing keys, partially overlapping multi-value sets, plugin mode, and built-in policy mode.
 - Path fixes: include encoded traversal, absolute path, nested traversal, archive entries with `..`, valid object keys that resemble traversal text but should be rejected, and canonical bucket/prefix boundary checks.
 - Logging fixes: assert redacted output for structs and response bodies that may contain credentials.
 - IAM export fixes: assert exported archives omit plaintext user and service-account secrets unless the format deliberately encrypts or seals them.
 - RPC auth fixes: include captured metadata replay across two concrete methods, stale timestamps, wrong path, wrong method surrogate, wrong secret, and valid same-method calls.
 - Browser/CORS fixes: assert no credentials on reflected/default origins, correct behavior for explicit allowlists, and no same-origin script execution for previewed object content.
 - SSE fixes: inspect stored bytes and verify API metadata, read-back behavior, and on-disk ciphertext together.
- Object Lock fixes: include unreadable metadata, fabricated metadata defaults, unparsable config, confirmed absent config, COMPLIANCE/GOVERNANCE retention, lifecycle expiry, scanner sweeps, and force-delete paths.
@@ -60,16 +60,6 @@ body-cache-whitelist-check: ## Check the body-cache eligibility gate stays a fai
 	@echo "🧱 Checking body-cache whitelist guard..."
 	./scripts/check_body_cache_whitelist.sh

-.PHONY: s3s-footprint-check
-s3s-footprint-check: ## Check the s3s dependency footprint ratchet stays frozen
-	@echo "📦 Checking s3s footprint ratchet..."
-	./scripts/check_s3s_footprint.sh
-
-.PHONY: fips-wording-check
-fips-wording-check: ## Check outward docs do not make unsupported FIPS claims
-	@echo "📣 Checking FIPS wording guard..."
-	./scripts/check_fips_wording.sh
-
 .PHONY: log-analyzer-rules-check
 log-analyzer-rules-check: core-deps ## Check log-analyzer rule anchors still exist verbatim in source
 	@echo "🩺 Checking log-analyzer rule anchors..."
@@ -19,13 +19,13 @@ planning-docs-check: ## Check that no planning-type documents are committed
 	./scripts/check_no_planning_docs.sh

 .PHONY: pre-commit
-pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
+pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
 	@echo "✅ All pre-commit checks passed!"

 .PHONY: pre-pr
-pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests
+pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests
 	@echo "✅ All pre-PR checks passed!"

 .PHONY: dev-check
-dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks
+dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks
 	@echo "✅ Fast development checks passed!"
@@ -25,12 +25,9 @@ TEST_THREADS ?= 1
 script-tests: ## Run shell script tests
 	@echo "Running script tests..."
 	./scripts/test_build_rustfs_options.sh
-	./scripts/test_docker_runtime_timezone.sh
 	./scripts/test_entrypoint_credentials.sh
 	./scripts/test_internode_grpc_ab_bench.sh
 	./scripts/test_object_batch_bench_enhanced.sh
-	./scripts/test_hotpath_warp_ab_gate.sh
-	./scripts/test_hotpath_warp_abba.sh
 	./scripts/test_exact_1mib_handoff_abba.sh
 	./scripts/test_pinned_paired_abba_bench.sh
 	./scripts/test_manual_transition_runbooks.sh
@@ -9,8 +9,6 @@
 #   * bucket_lifecycle_ops::tests::concurrent_resend_same_part_commits_one_generation
 #     uses the shared multipart fixture and a deterministic uploadId-lock
 #     handoff, so it must not overlap another process mutating that fixture.
-#   * bucket::metadata_sys::tests::concurrent_config_writes_from_separate_nodes_do_not_lose_writes
-#     uses the shared transaction lock and must not overlap other ecstore tests.
 #
 # serial_test's #[serial] attribute does NOT serialize these across runs:
 # nextest executes each test in its own process, where the in-process
@@ -29,13 +27,10 @@

 [test-groups]
 ecstore-serial-flaky = { max-threads = 1 }
-embedded-test-ports = { max-threads = 1 }
-e2e-vault = { max-threads = 1 }

 # Reliability / fault-injection e2e tests each spawn a single-node 4-disk RustFS
 # server and manipulate its disk directories at runtime (crates/e2e_test:
-# reliability_disk_fault_test, degraded_read_eof_regression_test / dist-13, and
-# replacement_privileged_e2e_test when explicitly run as root on Linux). They
+# reliability_disk_fault_test, degraded_read_eof_regression_test / dist-13). They
 # are correct in isolation but resource-heavy; serialize them under nextest's
 # process boundary (serial_test's #[serial] does not cross it) so several 4-disk
 # servers never run at once. ci-7's nightly picks these up via the e2e suite;
@@ -45,7 +40,7 @@ e2e-inline-boundaries = { max-threads = 1 }

 # --- default profile (local): serialize the flaky groups, never retry --------
 [[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(concurrent_config_writes_from_separate_nodes_do_not_lose_writes) | test(/^store::bucket::tests::bucket_delete_(mark_delete|purge_removes|default_s3_delete)/))'
+filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(/^store::bucket::tests::bucket_delete_(mark_delete|purge_removes|default_s3_delete)/))'
 test-group = 'ecstore-serial-flaky'

 # Serialize the multipart crash-consistency scenarios (dist-2, backlog#1150):
@@ -57,53 +52,23 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::multipart::tests::crash_consistency::/)'
 test-group = 'ecstore-serial-flaky'

-# The production-handler relocation regression builds an isolated 8-disk,
-# 2-pool store and commits a 72 MiB multipart object. Keep that cross-disk IO
-# from overlapping the ecstore commit fixtures above.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(execute_get_object_resumes_from_relocated_pool_without_splicing_body)'
-test-group = 'ecstore-serial-flaky'
-
-# Embedded integration-test binaries discover an ephemeral port and release
-# the probe listener before RustFS binds it. Serialize that cross-process
-# TOCTOU window; retries would only hide real startup failures.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & (binary(/^embedded.*_test$/) | binary(admin_diagnostic_capability_e2e))'
-test-group = 'embedded-test-ports'
-
 # Serialize the durable manual-transition checkpoint test across nextest's
 # process boundary; it mutates bucket lifecycle metadata and is not quarantined.
 [[profile.default.overrides]]
 filter = 'package(rustfs-ecstore) & test(manual_transition_page_checkpoint_persists_durable_job_progress)'
 test-group = 'ecstore-serial-flaky'

-# Serialize the bucket-incarnation / lifecycle-fence tests. They drive
-# init_bucket_metadata_sys and bucket_metadata_sys_of, i.e. process-global
-# OnceLock state that serial_test's #[serial] cannot protect across nextest's
-# process boundary, and they delete+recreate buckets — the same shape that
-# raced into InsufficientWriteQuorum in backlog#937. Preventive only, no
-# retries. The matching ci-profile override is after [profile.ci].
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & (test(bucket_delete_waits_for_config_mutation_fence) | test(stale_config_request_cannot_mutate_a_recreated_bucket) | test(disk_incarnation_read_detects_stale_cache_until_peer_reload) | test(lifecycle_expiry_fails_closed_on_corrupt_object_lock_metadata) | test(expiry_configs_are_resolved_from_the_owning_store))'
-test-group = 'ecstore-serial-flaky'
-
 # Serialize the 4-disk reliability / degraded-read e2e tests (see the
 # e2e-reliability test-group note above). The matching ci-profile override is at
 # the end of the file, after [profile.ci] is declared.
 [[profile.default.overrides]]
-filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression|replacement_privileged_e2e)_test::/)'
+filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression)_test::/)'
 test-group = 'e2e-reliability'

 [[profile.default.overrides]]
 filter = 'package(e2e_test) & test(/^inline_fast_path_cluster_test::/)'
 test-group = 'e2e-inline-boundaries'

-# Vault KMS tests share the fixed dev-server port 8200. serial_test's #[serial]
-# does not cross nextest process boundaries, so keep these tests in one group.
-[[profile.default.overrides]]
-filter = 'package(e2e_test) & test(/^kms::kms_vault_test::/)'
-test-group = 'e2e-vault'
-
 # ---------------------------------------------------------------------------
 # ci profile — the strict CI gate (ci.yml `cargo nextest run --profile ci`)
 # ---------------------------------------------------------------------------
@@ -139,9 +104,9 @@ filter = 'package(rustfs-ecstore) & test(/^store::bucket::tests::bucket_delete_(
 test-group = 'ecstore-serial-flaky'
 retries = 2

-# Keep deterministic ECStore write handoffs isolated across nextest processes.
+# Keep the deterministic multipart handoff isolated across nextest processes.
 [[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(concurrent_config_writes_from_separate_nodes_do_not_lose_writes))'
+filter = 'package(rustfs-ecstore) & test(concurrent_resend_same_part_commits_one_generation)'
 test-group = 'ecstore-serial-flaky'

 # QUARANTINE: OPEN rustfs#4690 — walk_dir stall-budget accounting test depends
@@ -156,7 +121,7 @@ retries = 2
 # quarantine: no retries, just single-threaded so several 4-disk servers never
 # run concurrently when ci-7's nightly runs the full e2e suite.
 [[profile.ci.overrides]]
-filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression|replacement_privileged_e2e)_test::/)'
+filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression)_test::/)'
 test-group = 'e2e-reliability'

 # Serialize the multipart crash-consistency scenarios under the ci profile too
@@ -166,28 +131,12 @@ test-group = 'e2e-reliability'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::multipart::tests::crash_consistency::/)'
 test-group = 'ecstore-serial-flaky'

-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(execute_get_object_resumes_from_relocated_pool_without_splicing_body)'
-test-group = 'ecstore-serial-flaky'
-
-# Match the default-profile embedded test isolation without quarantining or
-# retrying failures in CI.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & (binary(/^embedded.*_test$/) | binary(admin_diagnostic_capability_e2e))'
-test-group = 'embedded-test-ports'
-
 # Serialize the durable manual-transition checkpoint test under the ci profile
 # too. No retries: failures stay visible.
 [[profile.ci.overrides]]
 filter = 'package(rustfs-ecstore) & test(manual_transition_page_checkpoint_persists_durable_job_progress)'
 test-group = 'ecstore-serial-flaky'

-# Serialize the bucket-incarnation / lifecycle-fence tests under the ci profile
-# too (see the matching default-profile override near the top). No retries.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & (test(bucket_delete_waits_for_config_mutation_fence) | test(stale_config_request_cannot_mutate_a_recreated_bucket) | test(disk_incarnation_read_detects_stale_cache_until_peer_reload) | test(lifecycle_expiry_fails_closed_on_corrupt_object_lock_metadata) | test(expiry_configs_are_resolved_from_the_owning_store))'
-test-group = 'ecstore-serial-flaky'
-
 # ---------------------------------------------------------------------------
 # e2e-smoke profile — PR smoke subset of the e2e_test crate (backlog#1149 ci-4)
 # ---------------------------------------------------------------------------
@@ -219,7 +168,7 @@ test-group = 'ecstore-serial-flaky'
 # the nightly profile derives its set as "the replication module MINUS this
 # allowlist", so any new replication test lands in nightly by default (never
 # silently unrun) until it is explicitly blessed as fast here. Keep the two
-# regexes byte-identical. Count invariant: 20 here + 49 nightly = 69 total
+# regexes byte-identical. Count invariant: 20 here + 28 nightly = 48 total
 # (authority: `cargo nextest list`; docs/testing/e2e-suite-inventory.md).
 # HISTORY (2026-07-11): the 20 fast tests were briefly pulled out of this lane
 # (#4724) because they set a loopback (127.0.0.1) replication target that the
@@ -255,7 +204,7 @@ test-group = 'ecstore-serial-flaky'
 [profile.e2e-smoke]
 default-filter = """
    package(e2e_test) & (
-        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|list_buckets_auth|list_buckets_iam_filter|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|multipart_storage_class|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat)_test::|^fake_s3_target::/)
+        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|multipart_storage_class|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat)_test::|^fake_s3_target::/)
        | test(/^replication_extension_test::(test_replication_check_succeeds_with_remote_target|test_replication_check_rejects_target_without_object_lock|test_set_remote_target_rejects_unversioned_source_bucket|test_replication_check_rejects_unversioned_source_bucket|test_replication_check_rejects_missing_replication_config|test_replication_check_rejects_invalid_bucket|test_set_remote_target_rejects_same_bucket_on_same_deployment|test_set_remote_target_rejects_unversioned_target_bucket|test_set_remote_target_update_requires_arn|test_set_remote_target_update_rejects_missing_target|test_set_remote_target_rejects_invalid_target_url|test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify|test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem|test_list_remote_targets_rejects_empty_bucket|test_list_remote_targets_rejects_invalid_bucket|test_remove_remote_target_rejects_missing_target|test_remove_remote_target_rejects_missing_arn|test_remove_remote_target_rejects_invalid_bucket|test_remove_remote_target_rejects_target_used_by_replication|test_delete_bucket_replication_removes_remote_target)$/)
        | test(/^reliant::lifecycle::/)
        | test(/^reliant::tiering::/)
@@ -263,17 +212,6 @@ default-filter = """
 """
 fail-fast = false

-[profile.e2e-smoke.junit]
-path = "junit.xml"
-
-# The pagination boundary cases can stall when a server/listing regression
-# prevents the continuation request from completing. Keep the timeout scoped
-# to those known failure modes so legitimate lifecycle/tiering waits retain
-# their test-level timing budget.
-[[profile.e2e-smoke.overrides]]
-filter = 'package(e2e_test) & test(/^list_objects_v2_pagination_test::tests::(test_list_objects_v2_delimiter_small_page_traverses_all|test_list_objects_v2_max_keys_above_limit_returns_token|test_list_objects_v2_maxkeys_above_limit_with_delimiter)$/)'
-slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
-
 # ---------------------------------------------------------------------------
 # e2e-repl-nightly profile — scheduled full replication e2e lane (repl-1)
 # ---------------------------------------------------------------------------
@@ -281,12 +219,10 @@ slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
 # tests that are unfit for the per-PR e2e-smoke gate:
 #
 #   * 2 remote-target TLS validation tests.
-#   * 15 bucket-replication data-plane/helper tests — they PUT/delete objects
-#     and poll until source and target converge; two replicate over HTTPS,
-#     six pin SSE replication contracts (managed SSE-S3/SSE-KMS re-encrypt on
-#     the target incl. multipart and the resync path, SSE-C and
-#     target-without-KMS stay fail-closed), and one guards event/history
-#     observers.
+#   * 12 bucket-replication data-plane/helper tests — they PUT/delete objects
+#     and poll until source and target converge; two replicate over HTTPS, two
+#     pin active SSE failure contracts, and one guards event/history observers.
+#     The SSE-S3 contract remains ignored under backlog#1291.
 #   * 12 `_real_dual_node` site-replication tests — each spawns TWO full rustfs
 #     servers and drives the cross-process site-replication control plane.
 #   * 1 `_real_three_node` site-replication test.
@@ -345,16 +281,16 @@ path = "junit.xml"
 #     object_lambda) — too heavy for the merge budget; they run in ci-7's
 #     nightly 4-node lane.
 #   * replication_extension_test — repl-1 already splits it into the PR
-#     `e2e-smoke` (20 fast) and `e2e-repl-nightly` (49 slow) lanes and reserves
+#     `e2e-smoke` (20 fast) and `e2e-repl-nightly` (27 slow) lanes and reserves
 #     it for those, so e2e-full does not double-run it.
 #   * #[ignore]d tests — nextest skips them by default (no --run-ignored); the
 #     manual-localhost:9000 reliant/policy tests are ci-13's migration.
 #
 # Each e2e test spawns its own single-node rustfs server on a random port with
 # an isolated temp dir (crates/e2e_test/src/common.rs), so the set is
-# parallel-safe — the same property e2e-smoke relies on. The exceptions are the
-# 4-disk reliability / degraded-read fault-injection tests and the fixed-port
-# Vault tests, both serialized below.
+# parallel-safe — the same property e2e-smoke relies on. The exception is the
+# 4-disk reliability / degraded-read fault-injection tests, serialized below
+# (identical to the ci profile) so several 4-disk servers never run at once.
 # KNOWN-FAILURE EXCLUSIONS (characterization run 29381309848, 2026-07-15:
 # 341 ran / 32 failed on the suites' first automated run ever). Deterministic
 # product failures cannot be quarantined away with retries, so each family is
@@ -364,6 +300,9 @@ path = "junit.xml"
 # negative-path siblings of each family stay in as regression guards.
 #   * rustfs#4843 — over-limit archive entry paths hard-reject the whole
 #     archive even under ignore-errors semantics.
+#   * rustfs#4846 — distributed-lock quorum tests misclassify as timeout
+#     under parallel load (multi-node in-process clusters; natural home is
+#     ci-7's nightly cluster lane).
 [profile.e2e-full]
 default-filter = """
    package(e2e_test)
@@ -372,6 +311,7 @@ default-filter = """
    & !test(/^replication_extension_test::/)
    & !test(/^multipart_auth_test::test_signed_put_object_extract_skips_invalid_entry_when_ignore_errors_enabled$/)
    & !test(/^snowball_auto_extract_test::tests::snowball_auto_extract_(ignores_invalid_entries_when_requested|supports_standard_headers_with_combined_extract_options)$/)
+    & !test(/^reliant::lock::test_distributed_lock_(2_nodes_grpc_read_survives_failed_node|4_nodes_grpc_read_write_quorum_split_with_two_failed_nodes)$/)
 """
 fail-fast = false

@@ -384,13 +324,9 @@ path = "junit.xml"
 # quarantine: no retries, just single-threaded so several 4-disk servers never
 # run concurrently.
 [[profile.e2e-full.overrides]]
-filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression|replacement_privileged_e2e)_test::/)'
+filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression)_test::/)'
 test-group = 'e2e-reliability'

 [[profile.e2e-full.overrides]]
 filter = 'package(e2e_test) & test(/^inline_fast_path_cluster_test::/)'
 test-group = 'e2e-inline-boundaries'
-
-[[profile.e2e-full.overrides]]
-filter = 'package(e2e_test) & test(/^kms::kms_vault_test::/)'
-test-group = 'e2e-vault'
@@ -60,16 +60,6 @@ The file `prometheus-rules/rustfs-get-optimization-alerts.yaml` contains pre-con
 | `CodecStreamingFallbackSpike` | Warning | Codec streaming fallback > 10x baseline for 10m |
 | `IoQueueSaturation` | Warning | IO queue utilization > 90% for 5m |

-The file `prometheus-rules/rustfs-kms-alerts.yml` contains alerting rules for the KMS backend operation metrics. Thresholds are conservative defaults pending staging baseline calibration; response procedures live in `docs/operations/kms-observability-runbook.md`, and the matching dashboard is `deploy/observability/grafana/rustfs-kms-observability.json`.
-
-| Alert | Severity | Condition |
-|-------|----------|-----------|
-| `KmsBackendFatalErrors` | Critical | Fatal (non-retryable) attempt failures > 0 for 5m |
-| `KmsBackendHighErrorRate` | Critical | Non-success operation ratio > 5% for 10m (with traffic guard) |
-| `KmsBackendP99LatencyHigh` | Warning | Operation p99 duration (incl. retries) > 2s for 10m |
-| `KmsBackendAttemptFailureSpike` | Warning | Attempt failure rate > 0.5/s for 10m |
-| `KmsBackendRetryBudgetExhausted` | Warning | budget_exhausted / deadline_exceeded outcomes > 0.05/s for 10m |
-
 ### Enabling Alert Rules

 Add the alert rules file to your Prometheus configuration:
@@ -170,10 +160,6 @@ Important behavior notes:

 - Logs and metrics usually appear during startup, so seeing those two signals
  first is expected.
- The OpenTelemetry bridge sends `tracing` fields as log attributes. Loki stores
-  those attributes as structured metadata, and the Collector also mirrors the
-  common troubleshooting fields into the log line so simple line filters can
-  find them.
 - Visible trace data usually requires real HTTP/S3/gRPC request traffic after
  startup, because request-path spans are created on demand.
 - `RUSTFS_OBS_LOGGER_LEVEL=info` keeps the top-level request span but filters
@@ -199,17 +185,6 @@ curl -I http://127.0.0.1:9000/health/ready
 # Jaeger:  http://localhost:16686
 ```

-For a structured RustFS log such as an inter-node RPC authentication failure,
-the Loki line now includes fields such as `event`, `component`, `subsystem`,
-`failure_reason`, `rpc_service`, `rpc_method`, and `expected_audience`. Useful
-LogQL checks:
-
-```logql
-{service_name="RustFS"} |= "RPC signature verification failed"
-{service_name="RustFS"} |= "failure_reason="
-{service_name="RustFS"} | failure_reason != ""
-```
-
 If logs and metrics are present but traces are sparse, the most common cause is
 "no real request traffic yet" or "`info` level filtered nested spans", not an
 OTLP routing failure.
@@ -60,16 +60,6 @@
 | `CodecStreamingFallbackSpike` | 警告 | Codec streaming 回退 > 10x 基线，持续 10 分钟 |
 | `IoQueueSaturation` | 警告 | IO 队列利用率 > 90%，持续 5 分钟 |

-文件 `prometheus-rules/rustfs-kms-alerts.yml` 包含 KMS 后端操作指标的告警规则。阈值为保守默认值，待 staging 基线校准；响应流程见 `docs/operations/kms-observability-runbook.md`，配套仪表盘为 `deploy/observability/grafana/rustfs-kms-observability.json`。
-
-| 告警 | 级别 | 条件 |
-|------|------|------|
-| `KmsBackendFatalErrors` | 严重 | fatal（不可重试）尝试失败 > 0，持续 5 分钟 |
-| `KmsBackendHighErrorRate` | 严重 | 非 success 操作占比 > 5%，持续 10 分钟（含流量下限保护） |
-| `KmsBackendP99LatencyHigh` | 警告 | 操作 p99 耗时（含重试）> 2s，持续 10 分钟 |
-| `KmsBackendAttemptFailureSpike` | 警告 | 尝试失败率 > 0.5/s，持续 10 分钟 |
-| `KmsBackendRetryBudgetExhausted` | 警告 | budget_exhausted / deadline_exceeded 结果 > 0.05/s，持续 10 分钟 |
-
 ### 启用告警规则

 在 Prometheus 配置中添加告警规则文件：
@@ -169,7 +159,6 @@ RustFS 会自动在该基础 URL 后补全：
 需要注意：

 - 启动阶段通常会先看到日志和指标，因此“先有日志/指标、后有 trace”是正常现象。
- OpenTelemetry bridge 会把 `tracing` 字段作为日志 attributes 发送。Loki 会将这些 attributes 存为 structured metadata，同时 Collector 会把常用排障字段镜像进日志行，方便用简单的行内容过滤直接查到。
 - 可见的 trace 数据通常依赖启动后的真实 HTTP/S3/gRPC 请求流量，因为请求路径上的 span 是按需创建的。
 - `RUSTFS_OBS_LOGGER_LEVEL=info` 会保留顶层请求 span，但会过滤掉很多 `debug` 级别的嵌套 span。
  如果 Tempo 或 Jaeger 中的 trace 看起来很稀疏，建议先改成 `RUSTFS_OBS_LOGGER_LEVEL=debug`，再判断是否是 collector 或 Tempo 问题。
@@ -193,14 +182,6 @@ curl -I http://127.0.0.1:9000/health/ready
 # Jaeger:  http://localhost:16686
 ```

-对于 RustFS 结构化日志，例如节点间 RPC 鉴权失败，Loki 日志行现在会包含 `event`、`component`、`subsystem`、`failure_reason`、`rpc_service`、`rpc_method`、`expected_audience` 等字段。常用 LogQL 检查：
-
-```logql
-{service_name="RustFS"} |= "RPC signature verification failed"
-{service_name="RustFS"} |= "failure_reason="
-{service_name="RustFS"} | failure_reason != ""
-```
-
 如果日志和指标已经正常，但 trace 仍然稀疏，最常见的原因通常是
 “还没有真实请求流量”或“`info` 级别过滤了嵌套 span”，而不是 OTLP 路由失败。

@@ -11500,831 +11500,6 @@
      ],
      "title": "Compression Operations Rate",
      "type": "timeseries"
-    },
-    {
-      "collapsed": false,
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 332
-      },
-      "id": 531,
-      "panels": [],
-      "title": "Metrics Dimensions Drilldown",
-      "type": "row"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${datasource}"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "showValues": false,
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": 0
-              }
-            ]
-          },
-          "unit": "ops"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 333
-      },
-      "id": 532,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull",
-            "max"
-          ],
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "pluginVersion": "12.3.2",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "A",
-          "expr": "sum by (server, name, type) (rate(rustfs_api_requests_requests_total_by_server{job=~\"$job\",server=~\"$server\",name=~\"$api\"}[$__rate_interval]))",
-          "legendFormat": "{{server}} | {{name}} | {{type}}"
-        }
-      ],
-      "title": "API Requests by Server and API",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${datasource}"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "showValues": false,
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": 0
-              }
-            ]
-          },
-          "unit": "s"
-        },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byFrameRefID",
-              "options": "A"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "none"
-              }
-            ]
-          }
-        ]
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 333
-      },
-      "id": 533,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull",
-            "max"
-          ],
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "pluginVersion": "12.3.2",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "A",
-          "expr": "max by (server, drive, pool_index, set_index, drive_index, state) (rustfs_system_drive_runtime_state{job=~\"$job\",server=~\"$server\",drive=~\"$drive\"})",
-          "legendFormat": "{{server}} | {{drive}} | p{{pool_index}}/s{{set_index}}/d{{drive_index}} | {{state}}"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "B",
-          "expr": "max by (server, drive, pool_index, set_index, drive_index) (rustfs_system_drive_offline_duration_seconds{job=~\"$job\",server=~\"$server\",drive=~\"$drive\"})",
-          "legendFormat": "{{server}} | {{drive}} | offline seconds"
-        }
-      ],
-      "title": "Drive Runtime State and Offline Duration",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${datasource}"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "showValues": false,
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": 0
-              }
-            ]
-          },
-          "unit": "ops"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 341
-      },
-      "id": 534,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull",
-            "max"
-          ],
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "pluginVersion": "12.3.2",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "A",
-          "expr": "sum by (server, drive, pool_index, set_index, drive_index, api) (rate(rustfs_system_drive_api_calls_total{job=~\"$job\",server=~\"$server\",drive=~\"$drive\",api=~\"$drive_api\"}[$__rate_interval]))",
-          "legendFormat": "{{server}} | {{drive}} | p{{pool_index}}/s{{set_index}}/d{{drive_index}} | {{api}}"
-        }
-      ],
-      "title": "Drive API Calls by Operation",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${datasource}"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "showValues": false,
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": 0
-              }
-            ]
-          },
-          "unit": "ops"
-        },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byFrameRefID",
-              "options": "B"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "short"
-              },
-              {
-                "id": "custom.axisPlacement",
-                "value": "right"
-              }
-            ]
-          }
-        ]
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 341
-      },
-      "id": 535,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull",
-            "max"
-          ],
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "pluginVersion": "12.3.2",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "A",
-          "expr": "sum by (server, source, state) (rate(rustfs_scanner_source_work_total{job=~\"$job\",server=~\"$server\",source=~\"$scanner_source\"}[$__rate_interval]))",
-          "legendFormat": "{{server}} | {{source}} | {{state}}"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "B",
-          "expr": "sum by (server, cycle_scope, source, state) (rustfs_scanner_cycle_source_work{job=~\"$job\",server=~\"$server\",source=~\"$scanner_source\"})",
-          "legendFormat": "{{server}} | {{cycle_scope}} | {{source}} | {{state}}"
-        }
-      ],
-      "title": "Scanner Source Work by Server",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${datasource}"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "showValues": false,
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": 0
-              }
-            ]
-          },
-          "unit": "ops"
-        },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byFrameRefID",
-              "options": "B"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "short"
-              },
-              {
-                "id": "custom.axisPlacement",
-                "value": "right"
-              }
-            ]
-          }
-        ]
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 349
-      },
-      "id": 536,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull",
-            "max"
-          ],
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "pluginVersion": "12.3.2",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "A",
-          "expr": "sum by (server, bucket, drive, result) (rate(rustfs_scanner_bucket_drive_result_total{job=~\"$job\",server=~\"$server\",bucket=~\"$bucket\",drive=~\"$drive\",result=~\"$scanner_result\"}[$__rate_interval]))",
-          "legendFormat": "{{server}} | {{bucket}} | {{drive}} | {{result}}"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "B",
-          "expr": "sum by (server, cycle_scope, bucket, drive, result) (rustfs_scanner_cycle_bucket_drive_result{job=~\"$job\",server=~\"$server\",bucket=~\"$bucket\",drive=~\"$drive\",result=~\"$scanner_result\"})",
-          "legendFormat": "{{server}} | {{cycle_scope}} | {{bucket}} | {{drive}} | {{result}}"
-        }
-      ],
-      "title": "Scanner Bucket Drive Results",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${datasource}"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "showValues": false,
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": 0
-              }
-            ]
-          },
-          "unit": "ops"
-        },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byFrameRefID",
-              "options": "B"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "Bps"
-              }
-            ]
-          }
-        ]
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 349
-      },
-      "id": 537,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull",
-            "max"
-          ],
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "pluginVersion": "12.3.2",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "A",
-          "expr": "sum by (bucket, target_arn) (rate(rustfs_bucket_replication_target_sent_count{job=~\"$job\",bucket=~\"$bucket\",target_arn=~\"$target_arn\"}[$__rate_interval]))",
-          "legendFormat": "sent objects | {{bucket}} | {{target_arn}}"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "B",
-          "expr": "sum by (bucket, target_arn) (rate(rustfs_bucket_replication_target_sent_bytes{job=~\"$job\",bucket=~\"$bucket\",target_arn=~\"$target_arn\"}[$__rate_interval]))",
-          "legendFormat": "sent bytes | {{bucket}} | {{target_arn}}"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "C",
-          "expr": "sum by (bucket, target_arn) (rate(rustfs_bucket_replication_target_total_failed_count{job=~\"$job\",bucket=~\"$bucket\",target_arn=~\"$target_arn\"}[$__rate_interval]))",
-          "legendFormat": "failed objects | {{bucket}} | {{target_arn}}"
-        }
-      ],
-      "title": "Bucket Replication Target Flow",
-      "type": "timeseries"
-    },
-    {
-      "datasource": {
-        "type": "prometheus",
-        "uid": "${datasource}"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "barWidthFactor": 0.6,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "smooth",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "never",
-            "showValues": false,
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": 0
-              }
-            ]
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 357
-      },
-      "id": 538,
-      "options": {
-        "legend": {
-          "calcs": [
-            "lastNotNull",
-            "max"
-          ],
-          "displayMode": "table",
-          "placement": "right",
-          "showLegend": true
-        },
-        "tooltip": {
-          "hideZeros": false,
-          "mode": "multi",
-          "sort": "desc"
-        }
-      },
-      "pluginVersion": "12.3.2",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "A",
-          "expr": "max by (server, target_id) (rustfs_audit_target_queue_length_by_server{job=~\"$job\",server=~\"$server\"})",
-          "legendFormat": "audit queue | {{server}} | {{target_id}}"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "editorMode": "code",
-          "range": true,
-          "refId": "B",
-          "expr": "max by (server, action, state) (rustfs_ilm_action_tasks{job=~\"$job\",server=~\"$server\"})",
-          "legendFormat": "ilm | {{server}} | {{action}} | {{state}}"
-        }
-      ],
-      "title": "Audit and ILM by Server",
-      "type": "timeseries"
    }
  ],
  "preload": false,
@@ -12376,32 +11551,6 @@
        "sort": 1,
        "type": "query"
      },
-      {
-        "allValue": ".*",
-        "current": {
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${datasource}"
-        },
-        "definition": "label_values(rustfs_system_drive_api_calls_total,api)",
-        "includeAll": true,
-        "label": "Drive API",
-        "multi": true,
-        "name": "drive_api",
-        "options": [],
-        "query": {
-          "qryType": 1,
-          "query": "label_values(rustfs_system_drive_api_calls_total,api)",
-          "refId": "PrometheusVariableQueryEditor-drive_api"
-        },
-        "refresh": 2,
-        "regex": "",
-        "sort": 1,
-        "type": "query"
-      },
      {
        "allValue": ".*",
        "current": {
@@ -12521,136 +11670,6 @@
        "regex": "",
        "sort": 1,
        "type": "query"
-      },
-      {
-        "allValue": ".*",
-        "current": {
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${datasource}"
-        },
-        "definition": "label_values(rustfs_api_requests_requests_total_by_server,server)",
-        "includeAll": true,
-        "label": "Server",
-        "multi": true,
-        "name": "server",
-        "options": [],
-        "query": {
-          "qryType": 1,
-          "query": "label_values(rustfs_api_requests_requests_total_by_server,server)",
-          "refId": "PrometheusVariableQueryEditor-server"
-        },
-        "refresh": 2,
-        "regex": "",
-        "sort": 1,
-        "type": "query"
-      },
-      {
-        "allValue": ".*",
-        "current": {
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${datasource}"
-        },
-        "definition": "label_values(rustfs_api_requests_requests_total_by_server,name)",
-        "includeAll": true,
-        "label": "API",
-        "multi": true,
-        "name": "api",
-        "options": [],
-        "query": {
-          "qryType": 1,
-          "query": "label_values(rustfs_api_requests_requests_total_by_server,name)",
-          "refId": "PrometheusVariableQueryEditor-api"
-        },
-        "refresh": 2,
-        "regex": "",
-        "sort": 1,
-        "type": "query"
-      },
-      {
-        "allValue": ".*",
-        "current": {
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${datasource}"
-        },
-        "definition": "label_values({__name__=\"rustfs_bucket_replication_target_sent_count\",bucket=~\"$bucket\"},target_arn)",
-        "includeAll": true,
-        "label": "Target ARN",
-        "multi": true,
-        "name": "target_arn",
-        "options": [],
-        "query": {
-          "qryType": 1,
-          "query": "label_values({__name__=\"rustfs_bucket_replication_target_sent_count\",bucket=~\"$bucket\"},target_arn)",
-          "refId": "PrometheusVariableQueryEditor-target_arn"
-        },
-        "refresh": 2,
-        "regex": "",
-        "sort": 1,
-        "type": "query"
-      },
-      {
-        "allValue": ".*",
-        "current": {
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${datasource}"
-        },
-        "definition": "label_values(rustfs_scanner_source_work_total,source)",
-        "includeAll": true,
-        "label": "Scanner Source",
-        "multi": true,
-        "name": "scanner_source",
-        "options": [],
-        "query": {
-          "qryType": 1,
-          "query": "label_values(rustfs_scanner_source_work_total,source)",
-          "refId": "PrometheusVariableQueryEditor-scanner_source"
-        },
-        "refresh": 2,
-        "regex": "",
-        "sort": 1,
-        "type": "query"
-      },
-      {
-        "allValue": ".*",
-        "current": {
-          "text": "All",
-          "value": "$__all"
-        },
-        "datasource": {
-          "type": "prometheus",
-          "uid": "${datasource}"
-        },
-        "definition": "label_values(rustfs_scanner_bucket_drive_result_total,result)",
-        "includeAll": true,
-        "label": "Scanner Result",
-        "multi": true,
-        "name": "scanner_result",
-        "options": [],
-        "query": {
-          "qryType": 1,
-          "query": "label_values(rustfs_scanner_bucket_drive_result_total,result)",
-          "refId": "PrometheusVariableQueryEditor-scanner_result"
-        },
-        "refresh": 2,
-        "regex": "",
-        "sort": 1,
-        "type": "query"
      }
    ]
  },
@@ -29,27 +29,11 @@ processors:
    limit_mib: 1024
    spike_limit_mib: 256
  transform/logs:
-    error_mode: ignore
    log_statements:
      - context: log
        statements:
-          - set(attributes["message"], body.string) where IsString(body)
-          - set(attributes["log.body"], body.string) where IsString(body)
-          - set(body, Concat([body, " event=", attributes["event"]], "")) where IsString(body) and attributes["event"] != nil
-          - set(body, Concat([body, " component=", attributes["component"]], "")) where IsString(body) and attributes["component"] != nil
-          - set(body, Concat([body, " subsystem=", attributes["subsystem"]], "")) where IsString(body) and attributes["subsystem"] != nil
-          - set(body, Concat([body, " state=", attributes["state"]], "")) where IsString(body) and attributes["state"] != nil
-          - set(body, Concat([body, " result=", attributes["result"]], "")) where IsString(body) and attributes["result"] != nil
-          - set(body, Concat([body, " reason=", attributes["reason"]], "")) where IsString(body) and attributes["reason"] != nil
-          - set(body, Concat([body, " failure_reason=", attributes["failure_reason"]], "")) where IsString(body) and attributes["failure_reason"] != nil
-          - set(body, Concat([body, " rpc_path=", attributes["rpc_path"]], "")) where IsString(body) and attributes["rpc_path"] != nil
-          - set(body, Concat([body, " rpc_service=", attributes["rpc_service"]], "")) where IsString(body) and attributes["rpc_service"] != nil
-          - set(body, Concat([body, " rpc_method=", attributes["rpc_method"]], "")) where IsString(body) and attributes["rpc_method"] != nil
-          - set(body, Concat([body, " expected_audience=", attributes["expected_audience"]], "")) where IsString(body) and attributes["expected_audience"] != nil
-          - set(body, Concat([body, " peer_addr=", attributes["peer_addr"]], "")) where IsString(body) and attributes["peer_addr"] != nil
-          - set(body, Concat([body, " replay_scope_bootstrap_allowed=", attributes["replay_scope_bootstrap_allowed"]], "")) where IsString(body) and attributes["replay_scope_bootstrap_allowed"] != nil
-          - set(body, Concat([body, " error=", attributes["error"]], "")) where IsString(body) and attributes["error"] != nil
-          - set(body, Concat([body, " exception_message=", attributes["exception.message"]], "")) where IsString(body) and attributes["exception.message"] != nil
+          - set(attributes["message"], body.string)
+          - set(attributes["log.body"], body.string)

 exporters:
  otlp/tempo:
@@ -1,251 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# =============================================================================
-# RustFS KMS backend — Prometheus alerting rules
-# =============================================================================
-#
-# Metric source: the KMS operation-policy choke point in
-# crates/kms/src/policy.rs, except KmsKeyRotationOverdue, which reads the
-# label-less key-lifecycle gauge published by the deletion worker's sweep
-# (crates/kms/src/deletion_worker.rs). All label values are bounded static
-# strings (operation, op_class, outcome, error_class, backend, scope); key
-# identifiers, key material, and tokens never appear in labels.
-#
-# Response procedures: docs/operations/kms-observability-runbook.md
-#
-# IMPORTANT — threshold status: every numeric threshold below is a
-# conservative default chosen without a production baseline. Calibrate against
-# a staging baseline before relying on these alerts for paging, and prefer
-# loosening over tightening until the baseline exists. Formal SLO targets are
-# deliberately not encoded here (see rustfs/backlog#1584).
-#
-# NOTE: prometheus.yml loads /etc/prometheus/rules/*.yml — keep the .yml
-# extension or the file is silently ignored by the docker-compose stack.
-#
-# Validate: promtool check rules rustfs-kms-alerts.yml
-# =============================================================================
-
-groups:
-  # ==========================================================================
-  # Critical alerts — immediate action required
-  # ==========================================================================
-  - name: rustfs-kms-critical
-    interval: 30s
-    rules:
-      # ------------------------------------------------------------------
-      # 1. KmsBackendFatalErrors
-      #    Any attempt failure classified as fatal (non-retryable): auth
-      #    or permission errors, malformed requests, missing keys. The
-      #    policy never retries these, so even a low rate means real
-      #    operations are failing right now.
-      # ------------------------------------------------------------------
-      - alert: KmsBackendFatalErrors
-        expr: |
-          sum by (operation) (rate(rustfs_kms_backend_attempt_failures_total{error_class="fatal"}[5m])) > 0
-        for: 5m
-        labels:
-          severity: critical
-          component: kms
-        annotations:
-          summary: "KMS backend fatal errors on operation {{ $labels.operation }}"
-          description: >-
-            Attempt failures classified as fatal are occurring at
-            {{ $value | printf "%.3f" }}/s on operation
-            {{ $labels.operation }}. Fatal failures are not retried:
-            each one is a KMS backend call that failed permanently
-            (authentication, permissions, malformed request, or a
-            missing key/version).
-          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendfatalerrors"
-
-      # ------------------------------------------------------------------
-      # 2. KmsBackendHighErrorRate
-      #    Sustained share of operations terminating without success
-      #    (fatal, budget/deadline exhaustion, admission backpressure,
-      #    or an open circuit). The cancelled outcome is excluded because
-      #    shutdowns legitimately produce it.
-      #    The traffic guard keeps a single failure on a near-idle
-      #    cluster from firing the alert.
-      #    Threshold: 5% for 10m — conservative default, calibrate
-      #    against a staging baseline.
-      # ------------------------------------------------------------------
-      - alert: KmsBackendHighErrorRate
-        expr: |
-          (
-            sum(rate(rustfs_kms_backend_operations_total{outcome!~"success|cancelled"}[5m]))
-            /
-            clamp_min(sum(rate(rustfs_kms_backend_operations_total[5m])), 1e-9)
-          ) > 0.05
-          and
-          sum(rate(rustfs_kms_backend_operations_total[5m])) > 0.02
-        for: 10m
-        labels:
-          severity: critical
-          component: kms
-        annotations:
-          summary: "KMS backend non-success ratio above 5% for 10m"
-          description: >-
-            {{ $value | humanizePercentage }} of KMS backend operations
-            are terminating in fatal, budget_exhausted,
-            deadline_exceeded, backpressure_timeout,
-            backpressure_rejected, or circuit_open. Object encryption
-            and decryption paths depending on the KMS are degraded or
-            failing.
-          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendhigherrorrate"
-
-  # ==========================================================================
-  # Warning alerts — investigation needed
-  # ==========================================================================
-  - name: rustfs-kms-warning
-    interval: 30s
-    rules:
-      # ------------------------------------------------------------------
-      # 3. KmsBackendP99LatencyHigh
-      #    p99 wall-clock duration of whole operations (attempts plus
-      #    backoff) is sustained above 2 seconds. Because the histogram
-      #    includes retries, a high p99 usually means the retry policy
-      #    is absorbing backend failures, not that every call is slow.
-      #    Threshold: 2s for 10m — conservative default, calibrate
-      #    against a staging baseline.
-      # ------------------------------------------------------------------
-      - alert: KmsBackendP99LatencyHigh
-        expr: |
-          histogram_quantile(0.99,
-            sum by (le) (rate(rustfs_kms_backend_operation_duration_seconds_bucket[5m]))
-          ) > 2
-        for: 10m
-        labels:
-          severity: warning
-          component: kms
-        annotations:
-          summary: "KMS backend operation p99 latency above 2s for 10m"
-          description: >-
-            The 99th-percentile KMS backend operation duration is
-            {{ $value | humanizeDuration }}, including retries and
-            backoff. Encryption and decryption latency is leaking into
-            S3 request latency.
-          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendp99latencyhigh"
-
-      # ------------------------------------------------------------------
-      # 4. KmsBackendAttemptFailureSpike
-      #    Aggregate attempt-failure rate (all error classes) sustained
-      #    above an absolute floor. An absolute threshold is used instead
-      #    of an offset-1d baseline ratio because fresh deployments have
-      #    no baseline and an empty offset vector would keep a ratio
-      #    alert from ever firing; switch to a baseline-relative form
-      #    (see rustfs-get-optimization-alerts.yaml for the pattern)
-      #    once a stable staging baseline exists.
-      #    Threshold: 0.5/s for 10m — conservative default, calibrate
-      #    against a staging baseline.
-      # ------------------------------------------------------------------
-      - alert: KmsBackendAttemptFailureSpike
-        expr: |
-          sum(rate(rustfs_kms_backend_attempt_failures_total[5m])) > 0.5
-        for: 10m
-        labels:
-          severity: warning
-          component: kms
-        annotations:
-          summary: "KMS backend attempt failures above 0.5/s for 10m"
-          description: >-
-            KMS backend attempts are failing at
-            {{ $value | printf "%.2f" }}/s across all error classes.
-            The retry policy may still be masking these from callers —
-            check the error-class breakdown before it stops absorbing
-            them.
-          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendattemptfailurespike"
-
-      # ------------------------------------------------------------------
-      # 5. KmsBackendRetryBudgetExhausted
-      #    Operations are running out of retry budget (budget_exhausted)
-      #    or operation deadline (deadline_exceeded). These surface to
-      #    callers as failed KMS operations even though every individual
-      #    failure was retryable — the backend is unhealthy for longer
-      #    than the policy can bridge.
-      #    Threshold: 0.05/s for 10m — conservative default, calibrate
-      #    against a staging baseline.
-      # ------------------------------------------------------------------
-      - alert: KmsBackendRetryBudgetExhausted
-        expr: |
-          sum by (outcome) (rate(rustfs_kms_backend_operations_total{outcome=~"budget_exhausted|deadline_exceeded"}[5m])) > 0.05
-        for: 10m
-        labels:
-          severity: warning
-          component: kms
-        annotations:
-          summary: "KMS backend operations exhausting retry budget ({{ $labels.outcome }})"
-          description: >-
-            KMS backend operations are terminating as
-            {{ $labels.outcome }} at {{ $value | printf "%.3f" }}/s.
-            Retryable failures are outlasting the retry budget, so
-            callers are seeing hard failures.
-          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendretrybudgetexhausted"
-
-      # ------------------------------------------------------------------
-      # 6. KmsBackendCircuitOpen
-      #    Direct circuit-state signal, independent of operation traffic.
-      #    A transient open can recover on its first half-open probe; alert
-      #    only when the circuit remains open or half-open for one minute.
-      # ------------------------------------------------------------------
-      - alert: KmsBackendCircuitOpen
-        expr: |
-          rustfs_kms_backend_circuit_open > 0
-        for: 1m
-        labels:
-          severity: warning
-          component: kms
-        annotations:
-          summary: "KMS backend circuit open ({{ $labels.backend }}/{{ $labels.scope }})"
-          description: >-
-            The KMS backend circuit for {{ $labels.backend }} scope
-            {{ $labels.scope }} has remained open or half-open for one
-            minute. Operations in this scope can terminate as
-            circuit_open until the half-open probe succeeds or returns
-            a non-retryable failure.
-          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmsbackendcircuitopen"
-
-      # ------------------------------------------------------------------
-      # 7. KmsKeyRotationOverdue
-      #    The least recently rotated usable key has gone more than 400
-      #    days without a rotation (measured from creation for keys with
-      #    no recorded rotation). Direct gauge state published by the
-      #    deletion worker's sweep, so no traffic guard applies; the
-      #    one-hour hold only bridges scrape gaps. The worker runs only
-      #    on backends with the schedule_deletion capability, so on the
-      #    Static backend the series never exists and this alert cannot
-      #    fire — that backend cannot rotate either; see the rotation
-      #    driver matrix in docs/operations/kms-backend-security.md.
-      #    Threshold: 400 days — conservative default sitting above a
-      #    one-year rotation policy. Align it with the rotation period
-      #    your compliance policy requires, and with
-      #    RUSTFS_KMS_ROTATION_MAX_AGE_SECS so the per-key rotation_due
-      #    verdict and this aggregate alert agree.
-      # ------------------------------------------------------------------
-      - alert: KmsKeyRotationOverdue
-        expr: |
-          rustfs_kms_oldest_key_rotation_age_seconds > (400 * 86400)
-        for: 1h
-        labels:
-          severity: warning
-          component: kms
-        annotations:
-          summary: "Oldest KMS key unrotated for more than 400 days"
-          description: >-
-            The least recently rotated usable KMS key was last rotated
-            {{ $value | humanizeDuration }} ago (measured from creation
-            for keys with no recorded rotation). List keys through the
-            admin API and read rotation_due / rotation_due_reason for
-            the per-key verdict; an "unsupported" reason means the
-            backend cannot rotate at all.
-          runbook_url: "https://github.com/rustfs/rustfs/blob/main/docs/operations/kms-observability-runbook.md#kmskeyrotationoverdue"
@@ -25,13 +25,9 @@ inputs:
    required: false
    default: "rustfs-deps"
  cache-save-if:
-    description: >-
-      Whether to save the cache. The fail-safe default is 'false': a caller that
-      wants to populate a cache must opt in explicitly, so a forgotten input
-      costs a cold cache (minutes) rather than silently consuming the
-      repository-wide 10GB Actions cache quota and evicting other lanes.
+    description: "Condition for saving cache"
    required: false
-    default: "false"
+    default: "true"
  install-cross-tools:
    description: "Install cross-compilation tools"
    required: false
@@ -40,52 +36,37 @@ inputs:
    description: "Target architecture to add"
    required: false
    default: ""
-  install-build-packaging-tools:
-    description: >-
-      Install musl-tools/zip/unzip, needed for musl linking and release
-      packaging. Off for CI test lanes, which use none of them.
+  github-token:
+    description: "GitHub token for API access"
    required: false
-    default: "true"
-  install-test-tools:
-    description: >-
-      Install cargo-nextest and the rustfmt/clippy components. Off for release
-      and audit lanes, which run no tests and no lints.
-    required: false
-    default: "true"
+    default: ""

 runs:
  using: "composite"
  steps:
-    # protobuf-compiler is deliberately absent: the setup-protoc step below
-    # installs 35.1 into the tool cache and prepends it to PATH, so the apt
-    # build (older, and never version-matched) was shadowed on every run and
-    # simply never used.
    - name: Install system dependencies (Ubuntu)
      if: runner.os == 'Linux'
      shell: bash
      run: |
        sudo apt-get update
        sudo apt-get install -y \
+          musl-tools \
          build-essential \
          pkg-config \
          libssl-dev \
-          ripgrep
-
-    # musl-gcc is needed by the native musl release leg, and zip/unzip by the
-    # release packaging steps. No CI test lane touches any of them.
-    - name: Install packaging and cross-linking dependencies (Ubuntu)
-      if: runner.os == 'Linux' && inputs.install-build-packaging-tools == 'true'
-      shell: bash
-      run: sudo apt-get install -y musl-tools zip unzip
+          ripgrep \
+          unzip \
+          zip \
+          protobuf-compiler

    - name: Install protoc
      uses: rustfs/setup-protoc@a3705324d8f9bf5b6c3573fb6cf8ae421db55dd6 # v3.0.1
      with:
-        version: "35.1"
+        version: "34.1"
        repo-token: ${{ github.token }}

    - name: Install flatc
-      uses: Nugine/setup-flatc@698800de72a96bfb22cf60431dc21a2ff9a7e07b # v1
+      uses: Nugine/setup-flatc@e7855e994773ce90094a3f1626d4afc9080c23ae # v1
      with:
        version: "25.12.19"

@@ -94,7 +75,7 @@ runs:
      with:
        toolchain: ${{ inputs.rust-version }}
        targets: ${{ inputs.target }}
-        components: ${{ inputs.install-test-tools == 'true' && 'rustfmt, clippy' || '' }}
+        components: rustfmt, clippy

    - name: Install Zig
      if: inputs.install-cross-tools == 'true'
@@ -105,24 +86,12 @@ runs:
      uses: taiki-e/install-action@a21ae4029b089b9ddc45704028756f51ab8abe48 # cargo-zigbuild

    - name: Install cargo-nextest
-      if: inputs.install-test-tools == 'true'
      uses: taiki-e/install-action@96c7780c1d8a2b8723e12031def873a434d39d8d # nextest

    - name: Setup Rust cache
      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      with:
-        # false is rust-cache's own default. With true, cleanup.ts returns
-        # *before* pruning ~/.cargo/registry/src, and config.ts archives the
-        # whole registry — so every cache carried the unpacked source tree of
-        # every dependency, not just "a few extra crates".
-        #
-        # No coverage is lost: getPackages runs `cargo metadata --all-features`,
-        # a strict superset of any single lane's feature closure, and -sys crates
-        # are explicitly exempted from pruning (their src timestamps would
-        # otherwise trigger rebuilds). Anything pruned is re-unpacked from the
-        # .crate files still in registry/cache, whose mtimes crates.io
-        # normalises, so cargo fingerprints stay valid.
-        cache-all-crates: false
+        cache-all-crates: true
        cache-on-failure: true
        shared-key: ${{ inputs.cache-shared-key }}
        save-if: ${{ inputs.cache-save-if }}
@@ -37,7 +37,6 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -46,11 +45,8 @@ jobs:
    name: Architecture Migration Rules
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Install ripgrep
        run: |
@@ -23,9 +23,6 @@ on:
      - 'deny.toml'
      - '.github/actions/**'
      - '.github/workflows/**'
-      - 'scripts/release/create_or_update_release.sh'
-      - 'scripts/security/check_performance_ab_workflow.sh'
-      - 'scripts/security/check_preview_release_workflow.sh'
      - 'scripts/security/check_workflow_pins.sh'
  pull_request:
    types: [ opened, synchronize, reopened, closed ]
@@ -36,17 +33,9 @@ on:
      - 'deny.toml'
      - '.github/actions/**'
      - '.github/workflows/**'
-      - 'scripts/release/create_or_update_release.sh'
-      - 'scripts/security/check_performance_ab_workflow.sh'
-      - 'scripts/security/check_preview_release_workflow.sh'
      - 'scripts/security/check_workflow_pins.sh'
  schedule:
-    # Daily, not weekly. This schedule exists to catch RustSec advisories
-    # published against an unchanged dependency tree; at weekly cadence a new
-    # advisory could sit unnoticed for seven days. The check list is unchanged —
-    # splitting it into a light daily advisories-only run and a weekly full run
-    # would create runs where sources/bans/licenses go unverified.
-    - cron: '0 3 * * *' # Daily 03:00 UTC (staggered after the midnight ci/build crons)
+    - cron: '0 3 * * 0' # Weekly on Sunday 03:00 UTC (staggered after the midnight ci/build crons)
  workflow_dispatch:

 permissions:
@@ -66,7 +55,6 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -82,32 +70,11 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

-      # cargo-deny compiles nothing, so the full setup composite (apt packages,
-      # protoc, flatc, nextest, rustfmt/clippy) was pure overhead here. It does
-      # still need a real cargo: `cargo deny check` runs `cargo metadata`, and
-      # Cargo.toml pins datafusion and s3s as git dependencies, which must be
-      # materialised into ~/.cargo/git — a cold clone is hundreds of MB, so the
-      # cache stays.
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-
-      # Was relying on the composite's default, which used to be "true": every
-      # PR touching Cargo.toml/Cargo.lock saved a second, PR-scoped copy of this
-      # cache and pushed the main-scoped lanes out of the 10GB quota. The
-      # default is now "false", but state it explicitly — see
-      # scripts/security/check_cache_save_if.sh.
-      - name: Setup Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
        with:
-          # Same reasoning as the setup composite: true archives every
-          # dependency's unpacked source tree.
-          cache-all-crates: false
-          cache-on-failure: true
-          shared-key: rustfs-cargo-deny
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+          cache-shared-key: rustfs-cargo-deny

      - name: Install cargo-deny
        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
@@ -125,31 +92,13 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Report unpinned GitHub Actions
        run: ./scripts/security/check_workflow_pins.sh --enforce

-      - name: Check setup cache-save-if is explicit
-        run: ./scripts/security/check_cache_save_if.sh
-
-      - name: Check every job declares a timeout
-        run: ./scripts/security/check_job_timeouts.sh
-
-      - name: Check checkouts clear their credentials
-        run: ./scripts/security/check_persist_credentials.sh
-
-      - name: Check preview release workflow policy
-        run: ./scripts/security/check_preview_release_workflow.sh
-
-      - name: Check performance A/B workflow trust boundary
-        run: ./scripts/security/check_performance_ab_workflow.sh
-
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    if: github.event_name == 'pull_request' && github.event.action != 'closed'
    permissions:
      contents: read
@@ -157,8 +106,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
@@ -171,28 +118,3 @@ jobs:
          # conscious re-review of the license/provenance claim (backlog#1181).
          allow-dependencies-licenses: pkg:cargo/rustfs-uring@0.1.0
          comment-summary-in-pr: always
-
-  alert-on-failure:
-    name: Alert on scheduled failure
-    # dependency-review is deliberately excluded: it only runs on pull_request,
-    # so it can never contribute a failure to a scheduled run.
-    needs: [cargo-deny, workflow-pin-report]
-    # A scheduled cargo-deny failure usually means the dependency tree just
-    # matched a newly published advisory — the single most important signal this
-    # workflow produces, and until now it was only visible to whoever happened to
-    # open the Actions tab. Same ci-8 mechanism coverage.yml and
-    # e2e-replication-nightly.yml already use.
-    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-      - name: Open or update failure-tracking issue
-        uses: ./.github/actions/schedule-failure-issue
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -50,18 +50,12 @@ on:
      - "**/*.svg"
      - ".gitignore"
      - ".dockerignore"
-      - "flake.lock"
  schedule:
    - cron: "0 1 * * 0" # Weekly on Sunday 01:00 UTC (staggered after the ci.yml midnight cron)
  workflow_dispatch:
    inputs:
      build_docker:
-        # Advisory only. docker.yml triggers on workflow_run and its job-level
-        # condition requires the triggering event to be a tag push, so a manual
-        # dispatch of this workflow never produces images regardless of this
-        # value. Kept because the summary step reports it; wiring it up would
-        # mean teaching docker.yml's version parser a second event shape.
-        description: "Build and push Docker images after binary build (ignored: dispatch runs never reach docker.yml)"
+        description: "Build and push Docker images after binary build"
        required: false
        default: true
        type: boolean
@@ -89,7 +83,6 @@ jobs:
  build-check:
    name: Build Strategy Check
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    outputs:
      should_build: ${{ steps.check.outputs.should_build }}
      build_type: ${{ steps.check.outputs.build_type }}
@@ -99,8 +92,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Determine build strategy
        id: check
@@ -116,21 +107,13 @@ jobs:

          # Determine build type based on trigger
          if [[ "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]]; then
-            # Tag push - preview, release, or prerelease
+            # Tag push - release or prerelease
            should_build=true
            tag_name="${GITHUB_REF#refs/tags/}"
            version="${tag_name}"

-            # Preview tags publish a GitHub prerelease for validation, but
-            # must not update any latest channel.
-            if [[ "$tag_name" =~ -preview\.[0-9]+$ ]]; then
-              build_type="preview"
-              is_prerelease=true
-              echo "🔍 Preview build detected: $tag_name"
-            elif [[ "$tag_name" == *"-preview"* ]]; then
-              echo "❌ Invalid preview tag: $tag_name (expected suffix: -preview.<number>)" >&2
-              exit 1
-            elif [[ "$tag_name" == *"alpha"* ]] || [[ "$tag_name" == *"beta"* ]] || [[ "$tag_name" == *"rc"* ]]; then
+            # Check if this is a prerelease
+            if [[ "$tag_name" == *"alpha"* ]] || [[ "$tag_name" == *"beta"* ]] || [[ "$tag_name" == *"rc"* ]]; then
              build_type="prerelease"
              is_prerelease=true
              echo "🚀 Prerelease build detected: $tag_name"
@@ -173,7 +156,6 @@ jobs:
    name: Prepare Platform Matrix
    needs: build-check
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    outputs:
      matrix: ${{ steps.select.outputs.matrix }}
      selected: ${{ steps.select.outputs.selected }}
@@ -181,14 +163,10 @@ jobs:
      - name: Select target platforms
        id: select
        shell: bash
-        env:
-          # via env, not interpolation: a dispatch input is free-form text and
-          # would otherwise be pasted into the script for bash to evaluate.
-          RAW_PLATFORMS: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.platforms || 'all' }}
        run: |
          set -euo pipefail

-          selected="$RAW_PLATFORMS"
+          selected="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.platforms || 'all' }}"
          selected="$(echo "${selected}" | tr -d '[:space:]')"
          if [[ -z "${selected}" ]]; then
            selected="all"
@@ -259,7 +237,6 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          persist-credentials: false
          fetch-depth: 0

      - name: Setup Rust environment
@@ -268,17 +245,9 @@ jobs:
          rust-version: stable
          target: ${{ matrix.target }}
          cache-shared-key: build-${{ matrix.target }}
-          # main only. A cache saved on refs/tags/X is scoped to that tag: no
-          # other tag, no main run and no PR can restore it, so every release
-          # cycle wrote up to 12 entries of 1-2GB (preview tag plus final tag,
-          # six legs each) that nobody could read, evicting the hot lanes from
-          # the repo-wide 10GB quota. Tag builds still restore the main-scoped
-          # cache, since default-branch caches are readable from every ref.
-          # The one real cost: re-running a failed leg of the same tag no longer
-          # finds that tag's own warm cache and falls back to main's.
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-save-if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
          install-cross-tools: ${{ matrix.cross }}
-          install-test-tools: 'false'

      - name: Download static console assets
        shell: bash
@@ -725,14 +694,9 @@ jobs:
    needs: [ build-check, build-rustfs ]
    if: always() && needs.build-check.outputs.should_build == 'true'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - name: Build completion summary
        shell: bash
-        env:
-          # dispatch input via env: free-form text must not be pasted into the
-          # script for bash to evaluate.
-          INPUT_BUILD_DOCKER: ${{ github.event.inputs.build_docker }}
        run: |
          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
          VERSION="${{ needs.build-check.outputs.version }}"
@@ -750,10 +714,6 @@ jobs:
          echo ""

          case "$BUILD_TYPE" in
-            "preview")
-              echo "🔍 Preview artifacts are published in a GitHub prerelease"
-              echo "⏭️  Preview releases do not update latest channels"
-              ;;
            "development")
              echo "🛠️  Development build artifacts have been uploaded to OSS dev directory"
              echo "⚠️  This is a development build - not suitable for production use"
@@ -772,9 +732,7 @@ jobs:

          echo ""
          echo "🐳 Docker Images:"
-          if [[ "$BUILD_TYPE" == "preview" ]]; then
-            echo "⏭️  Preview tags do not publish Docker images"
-          elif [[ "$INPUT_BUILD_DOCKER" == "false" ]]; then
+          if [[ "${{ github.event.inputs.build_docker }}" == "false" ]]; then
            echo "⏭️  Docker image build was skipped (binary only build)"
          elif [[ "$BUILD_STATUS" == "success" ]]; then
            echo "🔄 Docker images will be built and pushed automatically via workflow_run event"
@@ -782,13 +740,12 @@ jobs:
            echo "❌ Docker image build will be skipped due to build failure"
          fi

-  # Create GitHub Release for every valid release tag, including previews
+  # Create GitHub Release (only for tag pushes)
  create-release:
    name: Create GitHub Release
    needs: [ build-check, build-rustfs ]
-    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    permissions:
      contents: write
    outputs:
@@ -798,7 +755,6 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          persist-credentials: false
          fetch-depth: 0

      - name: Create GitHub Release
@@ -811,12 +767,9 @@ jobs:
          VERSION="${{ needs.build-check.outputs.version }}"
          IS_PRERELEASE="${{ needs.build-check.outputs.is_prerelease }}"
          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
-          TARGET_COMMITISH=$(git rev-parse --verify "refs/tags/${TAG}^{commit}")

          # Determine release type for title
-          if [[ "$BUILD_TYPE" == "preview" ]]; then
-            RELEASE_TYPE="preview"
-          elif [[ "$BUILD_TYPE" == "prerelease" ]]; then
+          if [[ "$BUILD_TYPE" == "prerelease" ]]; then
            if [[ "$TAG" == *"alpha"* ]]; then
              RELEASE_TYPE="alpha"
            elif [[ "$TAG" == *"beta"* ]]; then
@@ -830,34 +783,61 @@ jobs:
            RELEASE_TYPE="release"
          fi

-          # Create release title
-          if [[ "$IS_PRERELEASE" == "true" ]]; then
-            TITLE="RustFS $VERSION (${RELEASE_TYPE})"
+          # Check if release already exists
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG already exists"
+            RELEASE_ID=$(gh release view "$TAG" --json databaseId --jq '.databaseId')
+            RELEASE_URL=$(gh release view "$TAG" --json url --jq '.url')
          else
-            TITLE="RustFS $VERSION"
+            # Get release notes from tag message
+            RELEASE_NOTES=$(git tag -l --format='%(contents)' "${TAG}")
+            if [[ -z "$RELEASE_NOTES" || "$RELEASE_NOTES" =~ ^[[:space:]]*$ ]]; then
+              if [[ "$IS_PRERELEASE" == "true" ]]; then
+                RELEASE_NOTES="Pre-release ${VERSION} (${RELEASE_TYPE})"
+              else
+                RELEASE_NOTES="Release ${VERSION}"
+              fi
+            fi
+
+            # Create release title
+            if [[ "$IS_PRERELEASE" == "true" ]]; then
+              TITLE="RustFS $VERSION (${RELEASE_TYPE})"
+            else
+              TITLE="RustFS $VERSION"
+            fi
+
+            # Create the release
+            PRERELEASE_FLAG=""
+            if [[ "$IS_PRERELEASE" == "true" ]]; then
+              PRERELEASE_FLAG="--prerelease"
+            fi
+
+            gh release create "$TAG" \
+              --title "$TITLE" \
+              --notes "$RELEASE_NOTES" \
+              $PRERELEASE_FLAG \
+              --draft
+
+            RELEASE_ID=$(gh release view "$TAG" --json databaseId --jq '.databaseId')
+            RELEASE_URL=$(gh release view "$TAG" --json url --jq '.url')
          fi

-          ./scripts/release/create_or_update_release.sh \
-            "$TAG" \
-            "$TARGET_COMMITISH" \
-            "$TITLE" \
-            "$IS_PRERELEASE"
+          echo "release_id=$RELEASE_ID" >> "$GITHUB_OUTPUT"
+          echo "release_url=$RELEASE_URL" >> "$GITHUB_OUTPUT"
+          echo "Created release: $RELEASE_URL"

  # Prepare and upload release assets
  upload-release-assets:
    name: Upload Release Assets
    needs: [ build-check, build-rustfs, create-release ]
-    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    permissions:
      contents: write
      actions: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Download all build artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -940,10 +920,9 @@ jobs:
  # the pointed-to version is a prerelease.
  update-latest-version:
    name: Update Latest Version
-    needs: [ build-check, publish-release ]
-    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    needs: [ build-check, upload-release-assets ]
+    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    steps:
      - name: Update latest.json
        env:
@@ -1001,34 +980,51 @@ jobs:
  publish-release:
    name: Publish Release
    needs: [ build-check, create-release, upload-release-assets ]
-    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    if: startsWith(github.ref, 'refs/tags/') && needs.build-check.outputs.build_type != 'development'
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    permissions:
      contents: write
    steps:
-      - name: Publish release
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Update release notes and publish
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          TAG="${{ needs.build-check.outputs.version }}"
+          VERSION="${{ needs.build-check.outputs.version }}"
+          IS_PRERELEASE="${{ needs.build-check.outputs.is_prerelease }}"
          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
-          RELEASE_ID="${{ needs.create-release.outputs.release_id }}"

-          # Publish the release and correct its channel state on retries.
-          # Only a stable final release may become GitHub Latest.
-          if [[ "$BUILD_TYPE" == "release" ]]; then
-            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
-              -F draft=false \
-              -F prerelease=false \
-              -f make_latest=true >/dev/null
+          # Determine release type
+          if [[ "$BUILD_TYPE" == "prerelease" ]]; then
+            if [[ "$TAG" == *"alpha"* ]]; then
+              RELEASE_TYPE="alpha"
+            elif [[ "$TAG" == *"beta"* ]]; then
+              RELEASE_TYPE="beta"
+            elif [[ "$TAG" == *"rc"* ]]; then
+              RELEASE_TYPE="rc"
+            else
+              RELEASE_TYPE="prerelease"
+            fi
          else
-            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
-              -F draft=false \
-              -F prerelease=true \
-              -f make_latest=false >/dev/null
+            RELEASE_TYPE="release"
          fi

+          # Get original release notes from tag
+          ORIGINAL_NOTES=$(git tag -l --format='%(contents)' "${TAG}")
+          if [[ -z "$ORIGINAL_NOTES" || "$ORIGINAL_NOTES" =~ ^[[:space:]]*$ ]]; then
+            if [[ "$IS_PRERELEASE" == "true" ]]; then
+              ORIGINAL_NOTES="Pre-release ${VERSION} (${RELEASE_TYPE})"
+            else
+              ORIGINAL_NOTES="Release ${VERSION}"
+            fi
+          fi
+
+          # Publish the release (remove draft status)
+          gh release edit "$TAG" --draft=false
+
          echo "🎉 Released $TAG successfully!"
          echo "📄 Release URL: ${{ needs.create-release.outputs.release_url }}"
@@ -1,265 +0,0 @@
-# Copyright 2026 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Sole writer of the Rust dependency caches that ci.yml restores.
-#
-# Why this is a separate workflow rather than steps inside ci.yml: ci.yml's
-# concurrency group cancels in-progress runs on main pushes, and merges land far
-# faster than its 70-minute pipeline. Measured over 15 consecutive main pushes:
-# 12 cancelled, 2 failed, 0 succeeded. A cancelled run never reaches
-# Swatinem/rust-cache's post step (cache-on-failure does not cover cancellation),
-# so the writer lanes were saving nothing and every PR paid a cold restore —
-# 11.8-20.9 minutes of "Setup Rust environment" against 0.7-3.4 warm.
-#
-# Splitting cache writing out of the test pipeline lets ci.yml keep cancelling
-# superseded runs (which is correct — nobody needs test results for a commit
-# that is already three merges behind) while the caches still get written.
-#
-# The group below deliberately does NOT cancel in progress; see the comment on
-# it for how that bounds concurrency and why it is scoped by event.
-#
-# Each job below owns exactly one shared-key and is the only place that sets
-# cache-save-if to anything but 'false' for it; every lane in ci.yml reads.
-# scripts/security/check_cache_save_if.sh keeps the declarations explicit.
-#
-# The builds are supersets of what the reading lanes compile, because a reader
-# restores only what the writer saved. Feature resolution matters here: a lane
-# built with e2e-test-hooks resolves dependency features differently, which
-# changes -Cmetadata, so the plain build does not cover it. See
-# rustfs/backlog#1600.
-
-name: Cache Warm
-
-on:
-  push:
-    branches: [ main ]
-    # Mirrors ci.yml's push paths-ignore: if a commit cannot change what ci.yml
-    # compiles, it cannot change what ci.yml needs restored either.
-    paths-ignore:
-      - "**.md"
-      - "docs/**"
-      - "deploy/**"
-      - "scripts/dev_*.sh"
-      - "scripts/probe.sh"
-      - "LICENSE*"
-      - ".gitignore"
-      - ".dockerignore"
-      - "README*"
-      - "**/*.png"
-      - "**/*.jpg"
-      - "**/*.svg"
-      - ".github/workflows/build.yml"
-      - ".github/workflows/docker.yml"
-      - ".github/workflows/audit.yml"
-  workflow_dispatch:
-    inputs:
-      emit_timings:
-        description: >-
-          Also emit cargo --timings for the ci-dev build and upload it. Used to
-          decide whether sccache is worth adopting (rustfs/backlog#1601 gate).
-        required: false
-        default: false
-        type: boolean
-
-permissions:
-  contents: read
-
-# Scoped by event. A push run and a dispatch run do not compete: GitHub keeps
-# one running plus one pending per group, so with a single shared group a
-# manually dispatched run was displaced as pending by the next merge and
-# cancelled — observed three times in a row, which made the --timings gate in
-# rustfs/backlog#1601 effectively impossible to trigger while main was busy.
-#
-# Still no cancel-in-progress: a burst of merges collapses into "current run
-# finishes, newest queued run follows" rather than a pile-up, which is what
-# bounds this workflow to one self-hosted runner per event type.
-#
-# The two paths can now overlap and race to save the same key. That is benign:
-# the loser finds the key already present and skips, and both builds produce the
-# same artifacts from the same commit.
-concurrency:
-  group: cache-warm-${{ github.event_name }}
-  cancel-in-progress: false
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  # Readers: test-and-lint, test-ilm-integration-serial, build-rustfs-debug-binary,
-  # e2e-tests, e2e-full.
-  warm-ci-dev:
-    name: Warm ci-dev
-    runs-on: sm-standard-4
-    timeout-minutes: 90
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: stable
-          cache-shared-key: ci-dev
-          cache-save-if: 'true'
-          install-build-packaging-tools: 'false'
-
-      # rustfs/backlog#1601 gate. sccache can only cache compilation units whose
-      # --emit includes link, so it covers workspace rlibs and nothing else:
-      # clippy is metadata-only, and the ~100 test binaries, the rustfs bin and
-      # every build script invoke the system linker. Before spending a bucket,
-      # credentials and a supply-chain boundary on it, measure how much of the
-      # build is actually rlib codegen.
-      #
-      # Read from the report: workspace lib codegen as a share of the build, and
-      # s3select-query's own rlib as a share. The plan adopts sccache only above
-      # 50% and 25% respectively; if linking dominates instead, the answer is
-      # mold/lld plus split-debuginfo, which is exactly the part sccache cannot
-      # touch. Off by default — this doubles the ci-dev build.
-      - name: Build ci-dev superset (with --timings)
-        if: inputs.emit_timings
-        env:
-          CARGO_BUILD_JOBS: "2"
-        run: cargo build --workspace --all-targets --timings
-
-      - name: Upload cargo timings report
-        if: inputs.emit_timings
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: cargo-timings-ci-dev
-          path: target/cargo-timings/
-          retention-days: 30
-          if-no-files-found: error
-
-      # --all-targets covers the test binaries nextest builds, including
-      # e2e_test, which test-and-lint's own run excludes. The second build adds
-      # the e2e-test-hooks feature resolution that build-rustfs-debug-binary uses
-      # and that no lint lane enables.
-      - name: Build ci-dev superset
-        env:
-          # Same limit ci.yml puts on its nextest step: this builds the same
-          # ~100 workspace test binaries, and three concurrent links saturate the
-          # self-hosted runner's overlay I/O and can wedge Cargo (#5394).
-          CARGO_BUILD_JOBS: "2"
-        run: |
-          cargo build --workspace --all-targets
-          cargo build -p rustfs --bins --features e2e-test-hooks
-
-      # Runs before rust-cache's post step, so these are the sizes it is about
-      # to archive. Reported so the cache-all-crates decision stays evidence-led:
-      # registry/src is what that flag prunes, registry/cache is what the pruned
-      # sources are re-unpacked from. See rustfs/backlog#1600.
-      - name: Report cache input sizes
-        if: always()
-        run: |
-          # tee, not a plain redirect: sent only to $GITHUB_STEP_SUMMARY these
-          # numbers are readable in the UI but absent from the job log, and the
-          # REST API exposes the log, not the summary — which made the figures
-          # unreachable for exactly the scripted comparison they exist for.
-          sizes="$(du -sh ~/.cargo/registry/src ~/.cargo/registry/cache \
-                          ~/.cargo/registry/index ~/.cargo/git target 2>/dev/null || true)"
-          echo "cache-input-sizes-begin"
-          printf '%s\n' "$sizes"
-          echo "cache-input-sizes-end"
-          {
-            echo "### Cache input sizes (ci-dev)"
-            echo '```'
-            printf '%s\n' "$sizes"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-  # Readers: test-and-lint-rio-v2, build-rustfs-debug-binary-rio-v2.
-  warm-ci-feat-rio:
-    name: Warm ci-feat-rio
-    runs-on: sm-standard-4
-    timeout-minutes: 90
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: stable
-          cache-shared-key: ci-feat-rio
-          cache-save-if: 'true'
-          install-build-packaging-tools: 'false'
-
-      - name: Build ci-feat-rio superset
-        run: |
-          cargo build -p rustfs -p rustfs-ecstore --all-targets --features rio-v2
-          cargo build -p rustfs --bins --features rio-v2,e2e-test-hooks
-
-  # Readers: the swift and sftp legs of test-and-lint-protocols. Built in
-  # sequence rather than as `--features swift,sftp`, which is a combination no
-  # lane actually compiles; running both leaves the union in target/.
-  warm-ci-feat-proto:
-    name: Warm ci-feat-proto
-    runs-on: sm-standard-4
-    timeout-minutes: 90
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: stable
-          cache-shared-key: ci-feat-proto
-          cache-save-if: 'true'
-          install-build-packaging-tools: 'false'
-
-      - name: Build ci-feat-proto superset
-        run: |
-          cargo build -p rustfs -p rustfs-protocols --all-targets --features swift
-          cargo build -p rustfs -p rustfs-protocols --all-targets --features sftp
-
-  # Reader: uring-integration. Runs on ubuntu-latest to match it: rust-cache's
-  # key covers runner.os and arch but not the runner label or image, so a cache
-  # written on sm-standard-4 would be restored by the hosted runner as if it
-  # belonged to it.
-  warm-ci-uring:
-    name: Warm ci-uring
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: stable
-          cache-shared-key: ci-uring
-          cache-save-if: 'true'
-          install-build-packaging-tools: 'false'
-
-      - name: Install build dependencies
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
-      - name: Build ci-uring superset
-        run: cargo build -p rustfs-ecstore --all-targets
@@ -12,24 +12,18 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# Companion to ci.yml for required status checks.
+# Companion to ci.yml for the required "Test and Lint" status check.
 #
-# ci.yml skips docs-only pull requests via paths-ignore, but the branch ruleset
-# requires a check named "Test and Lint" — without this workflow a docs-only PR
-# would wait on it forever. This workflow triggers on exactly the paths ci.yml
-# ignores and reports success under the same job name. Mixed PRs trigger both
-# workflows and the real check still gates: a required check with any failing
-# run blocks the merge.
+# ci.yml skips docs-only pull requests via paths-ignore, but the branch
+# ruleset requires a check named "Test and Lint" — without this workflow a
+# docs-only PR would wait on that check forever. This workflow triggers on
+# exactly the paths ci.yml ignores and reports an instant success under the
+# same job name. Mixed PRs trigger both workflows and the real check still
+# gates: a required check with any failing run blocks the merge.
 # https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
 #
-# "Quick Checks" is mirrored here ahead of the ruleset change that will make it
-# required too (rustfs/backlog#1599). Until that change lands this job is
-# inert; mirroring it first is what lets the ruleset change happen without
-# stranding docs-only PRs on a check nobody reports.
-#
 # Keep the paths list below in sync with the pull_request paths-ignore list
-# in ci.yml, and keep the quick-checks steps below byte-identical to the
-# quick-checks job in ci.yml.
+# in ci.yml.

 name: Continuous Integration (docs only)

@@ -53,88 +47,17 @@ on:
      - ".github/workflows/build.yml"
      - ".github/workflows/docker.yml"
      - ".github/workflows/audit.yml"
-      - "flake.lock"

 permissions:
  contents: read

 jobs:
-  # Deliberately NOT a bare `echo`. Once "Quick Checks" becomes a required
-  # check, ci.yml gates every expensive job behind it, so a mixed PR reports
-  # two check runs with this name: the real one (45-51s) and this companion.
-  # GitHub has no written contract for how it picks between same-named
-  # required check runs ("latest wins" vs "any failure blocks"), so instead of
-  # relying on ordering we make both runs execute the same commands against
-  # the same merge ref — their conclusions are then necessarily identical and
-  # the choice does not matter. Keep these steps byte-identical to the
-  # quick-checks job in ci.yml (a guard script that asserts this, and the paths
-  # sync below, is tracked in rustfs/backlog#1603).
-  #
-  # For a genuinely docs-only PR this adds no strictness (no code changed, so
-  # fmt and the guards always pass) and costs ~50s of ubuntu-latest.
-  quick-checks:
-    name: Quick Checks
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Install ripgrep
-        run: sudo apt-get update && sudo apt-get install -y ripgrep
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-        with:
-          components: rustfmt
-
-      - name: Check code formatting
-        run: cargo fmt --all --check
-
-      - name: Check unsafe code allowances
-        run: ./scripts/check_unsafe_code_allowances.sh
-
-      - name: Check layered dependencies
-        run: ./scripts/check_layer_dependencies.sh
-
-      - name: Check architecture migration rules
-        run: ./scripts/check_architecture_migration_rules.sh
-
-      - name: Check logging guardrails
-        run: ./scripts/check_logging_guardrails.sh
-
-      - name: Check tokio io-uring feature guard
-        run: ./scripts/check_no_tokio_io_uring.sh
-
-      - name: Check extension schema boundaries
-        run: ./scripts/check_extension_schema_boundaries.sh
-
-      - name: Check body-cache whitelist guard
-        run: ./scripts/check_body_cache_whitelist.sh
-
-      - name: Check s3s footprint ratchet
-        run: ./scripts/check_s3s_footprint.sh
-
-      - name: Check no planning docs committed
-        run: ./scripts/check_no_planning_docs.sh
-
-      - name: Check CI paths stay in sync
-        run: ./scripts/check_ci_paths_sync.sh
-
-      - name: Check io_uring lane --lib precondition
-        run: ./scripts/check_uring_lane_lib_only.sh
-
  test-and-lint:
    name: Test and Lint
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      # Docs-only PRs skip the full code CI, but they are exactly where a
      # planning-type document could be slipped in (git add -f bypasses
@@ -33,7 +33,6 @@ on:
      - ".github/workflows/build.yml"
      - ".github/workflows/docker.yml"
      - ".github/workflows/audit.yml"
-      - "flake.lock"
  pull_request:
    types: [ opened, synchronize, reopened, closed ]
    branches: [ main ]
@@ -55,7 +54,6 @@ on:
      - ".github/workflows/build.yml"
      - ".github/workflows/docker.yml"
      - ".github/workflows/audit.yml"
-      - "flake.lock"
  merge_group:
    types: [ checks_requested ]
  schedule:
@@ -83,7 +81,6 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -92,20 +89,13 @@ jobs:
    name: Typos
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
      - name: Typos check with custom config file
        uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # master

  # Fast, compile-free checks that fail early so contributors get feedback in
  # ~1 minute instead of waiting for the full test job.
-  #
-  # These steps are mirrored byte-for-byte in ci-docs-only.yml so that a mixed
-  # PR, which reports two check runs named "Quick Checks", cannot get one red
-  # and one green. Edit both jobs together.
  quick-checks:
    name: Quick Checks
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
@@ -114,8 +104,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Install ripgrep
        run: sudo apt-get update && sudo apt-get install -y ripgrep
@@ -137,9 +125,6 @@ jobs:
      - name: Check architecture migration rules
        run: ./scripts/check_architecture_migration_rules.sh

-      - name: Check logging guardrails
-        run: ./scripts/check_logging_guardrails.sh
-
      - name: Check tokio io-uring feature guard
        run: ./scripts/check_no_tokio_io_uring.sh

@@ -149,54 +134,27 @@ jobs:
      - name: Check body-cache whitelist guard
        run: ./scripts/check_body_cache_whitelist.sh

-      - name: Check s3s footprint ratchet
-        run: ./scripts/check_s3s_footprint.sh
-
      - name: Check no planning docs committed
        run: ./scripts/check_no_planning_docs.sh

-      - name: Check CI paths stay in sync
-        run: ./scripts/check_ci_paths_sync.sh
-
-      - name: Check io_uring lane --lib precondition
-        run: ./scripts/check_uring_lane_lib_only.sh
-
  test-and-lint:
    name: Test and Lint
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 90
-    # Both lines are required. Job-level `permissions` replaces the workflow
-    # block rather than merging with it, so declaring only `actions: write`
-    # would drop `contents: read` and break this job's checkout and the
-    # repo-token the setup action hands to setup-protoc.
-    permissions:
-      contents: read
-      actions: write
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          # This job's token can cancel runs and delete Actions caches. Checkout
-          # otherwise writes it into .git/config, where a PR's own build.rs or
-          # proc-macro could read it back out.
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          # Every lane in this workflow reads its cache and none writes it.
-          # cache-warm.yml is the sole writer for all four keys: this workflow
-          # cancels superseded runs on main, and a cancelled run never reaches
-          # rust-cache's post step, so writing from here saved nothing (12 of 15
-          # consecutive main-push runs were cancelled). See rustfs/backlog#1600.
-          cache-shared-key: ci-dev
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
+          cache-shared-key: ci-test
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Prepare test evidence
        run: |
@@ -211,54 +169,43 @@ jobs:
      # Clippy runs before the test pass: lint failures are the most common
      # CI-only breakage and should surface in minutes, not after 20+ minutes
      # of tests.
-      # Sampled too: clippy is the natural control arm for any CARGO_BUILD_JOBS
-      # experiment, since --all-targets is check-only for workspace members and
-      # never links the ~100 test binaries the limit exists to throttle.
      - name: Run clippy lints
-        run: |
-          ./scripts/ci/resource_sampler.sh start clippy
-          trap './scripts/ci/resource_sampler.sh stop' EXIT
-          cargo clippy --all-targets -- -D warnings
+        run: cargo clippy --all-targets -- -D warnings

      - name: Run nextest tests
        env:
-          # #5394 mitigation, now under a measured experiment (backlog#1601).
-          #
-          # 2 was chosen when three concurrent workspace test links were believed
-          # to saturate the runner's overlay I/O and wedge Cargo until the 75m
-          # timeout. cgroup v2 readings from the sampler show the pod actually
-          # has 14 CPUs and 28GB (peak use 2.1GB), so 2 throttles compilation to
-          # a seventh of what is available and memory was never the constraint —
-          # the label name "sm-standard-4" had led everyone, including the
-          # original mitigation, to assume 4 cores.
-          #
-          # Raised to 3 on main pushes and manual dispatches; PRs keep 2 so the
-          # merge path is untouched while the experiment runs.
-          #
-          # Dispatch is included because push alone cannot supply the samples:
-          # this workflow cancels superseded runs on main, and only 4 of the last
-          # 20 push-triggered Test and Lint jobs reached a terminal state — at
-          # that rate ten samples would take roughly fifty merges. The
-          # concurrency group is scoped by event_name, so a dispatched run has
-          # its own group and is not cancelled by merge traffic, which makes the
-          # sample collectable on demand rather than by waiting.
-          #
-          # Baseline over 17 samples at 2:
-          # median nextest/clippy step ratio 1.95, spread 1.85-2.06. The gate-2
-          # criterion is that ratio dropping at least 10% (below ~1.76) with no
-          # 75m timeout and no run showing three consecutive samples of
-          # rustc/collect2/rust-lld in D state. If it does not, the conclusion is
-          # "this limit is not the bottleneck" — fix it back at 2 and record the
-          # experiment, which is a result, not a failure.
-          #
-          # Must stay step-level: rust-cache hashes CARGO/CC/CFLAGS/CXX/CMAKE/RUST
-          # prefixed variables from process.env into the cache key, so promoting
-          # this to job level would rotate every key on this lane.
-          CARGO_BUILD_JOBS: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && '3' || '2' }}
+          # Three concurrent workspace test links saturate the self-hosted
+          # runner's overlay I/O and can wedge Cargo until the 75m timeout.
+          CARGO_BUILD_JOBS: "2"
        run: |
          mkdir -p artifacts/test-and-lint
-          ./scripts/ci/resource_sampler.sh start nextest
-          trap './scripts/ci/resource_sampler.sh stop' EXIT
+          # Evidence sampler for issue #5394: the post-mortem pgrep below runs
+          # only after `timeout` has already TERM'd the whole cargo process
+          # group, so it cannot name a wedged process. Sample system and
+          # process state every 60s instead; the last samples before the
+          # timeout show what was stuck (rustc, linker, build script, memory
+          # pressure, ...). The log rides along in the existing artifact.
+          (
+            while true; do
+              {
+                echo "=== $(date --utc --iso-8601=seconds)"
+                echo "--- load";  cat /proc/loadavg
+                echo "--- psi";   grep -H . /proc/pressure/* 2>/dev/null || true
+                echo "--- mem";   free -m
+                echo "--- disk";  df -h / /home/runner 2>/dev/null || df -h /
+                echo "--- top-rss"
+                ps -eo pid,ppid,stat,etime,rss,pcpu,args --sort=-rss | head -15
+                echo "--- build/test processes"
+                ps -eo pid,ppid,stat,etime,rss,pcpu,args | grep -E '[c]argo|[r]ustc|[n]extest|[c]ollect2|rust-ll[d]|[b]uild-script|deps[/]' || true
+                echo "--- d-state (uninterruptible IO)"
+                ps -eo pid,stat,etime,args | awk 'NR > 1 && $2 ~ /D/' || true
+                echo
+              } >> artifacts/test-and-lint/sampler.log 2>&1 || true
+              sleep 60
+            done
+          ) &
+          sampler_pid=$!
+          trap 'kill "${sampler_pid}" 2>/dev/null || true' EXIT
          set +e
          NEXTEST_HIDE_PROGRESS_BAR=1 timeout --verbose --signal=TERM --kill-after=30s 75m \
            cargo nextest run --profile ci --all --exclude e2e_test \
@@ -330,50 +277,6 @@ jobs:
      - name: Run rebalance/decommission migration proofs
        run: ./scripts/check_migration_gate_count.sh

-      # Early stop. Once this job has failed the PR cannot merge, so the sibling
-      # lanes are burning runners on a result nobody can act on: on run
-      # 30674613104 three lanes had already failed while Test and Lint and the
-      # rio-v2 variant kept going past 70 minutes.
-      #
-      # Only this job may cancel. The lanes that are NOT required checks
-      # (protocols, ILM, e2e, s3-tests) must never hold that power: a flake in
-      # one of them would turn the required "Test and Lint" into `cancelled`,
-      # which blocks the merge. Today a maintainer can merge with sftp red, and
-      # that has to stay true.
-      #
-      # These steps run last so the `if: always()` artifact upload above still
-      # captures logs and diagnostics before the run goes away.
-      - name: Annotate early-stop reason
-        if: failure() && github.event_name == 'pull_request'
-        run: |
-          {
-            echo "## CI early-stop"
-            echo "Job \`${GITHUB_JOB}\` (Test and Lint) failed; cancelling run ${GITHUB_RUN_ID} to free runners."
-            echo "Sibling jobs showing **cancelled** were stopped by this job, not by their own failure."
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      # curl rather than `gh`: every existing `gh` call in this repo runs on
-      # ubuntu-latest, and the sm-standard-* images are custom and trimmed (they
-      # ship no C toolchain, see the e2e job below), so `gh` is not known to
-      # exist here.
-      #
-      # Fork PRs are excluded explicitly instead of relying on the error path:
-      # their GITHUB_TOKEN is forced read-only and job-level permissions cannot
-      # raise it, so the call would always 403. Skipping keeps their logs clean.
-      - name: Cancel run on failure (same-repo PR only)
-        if: >-
-          failure() && github.event_name == 'pull_request'
-          && github.event.pull_request.head.repo.full_name == github.repository
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          curl -fsS -X POST \
-            -H "Authorization: Bearer ${GH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/cancel" || true
-
  # Dedicated serial lane for the ILM / lifecycle integration tests. These tests
  # drive the object layer through process-global singletons (the GLOBAL_ENV
  # ECStore, the global tier-config manager, background-expiry workers) and bind
@@ -387,7 +290,6 @@ jobs:
  test-ilm-integration-serial:
    name: ILM Integration (serial)
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 45
    env:
@@ -395,16 +297,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-dev
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
+          cache-shared-key: ci-ilm-serial
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}

      # test_transition_and_restore_flows was re-enabled by rustfs/backlog#1303:
      # its "missing xl.meta on disk2" was a test-util bug (open_disk hardcoded
@@ -427,7 +327,6 @@ jobs:
  test-and-lint-rio-v2:
    name: Test and Lint (rio-v2)
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 60
    env:
@@ -435,16 +334,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-feat-rio
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
+          cache-shared-key: ci-test-rio-v2
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Run rio-v2 clippy lints
        run: cargo clippy -p rustfs -p rustfs-ecstore --all-targets --features rio-v2 -- -D warnings
@@ -457,17 +354,10 @@ jobs:
  test-and-lint-protocols:
    name: "Test and Lint (${{ matrix.features.name }})"
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 60
    strategy:
-      # On a PR, one failing protocol leg is enough to know the PR is not ready,
-      # so stop the sibling leg instead of paying another ~40 minutes for it.
-      # Everywhere else (main pushes, the merge queue, the weekly schedule) keep
-      # the full signal: there we want to know whether swift AND sftp are broken,
-      # not just whichever failed first. This is the only part of the early-stop
-      # work that also covers fork PRs, since it needs no token.
-      fail-fast: ${{ github.event_name == 'pull_request' }}
+      fail-fast: false
      matrix:
        features:
          - name: swift
@@ -479,16 +369,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-feat-proto
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
+          cache-shared-key: ci-test-${{ matrix.features.name }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Run clippy with ${{ matrix.features.name }}
        run: |
@@ -501,7 +389,6 @@ jobs:
  build-rustfs-debug-binary:
    name: Build RustFS Debug Binary
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 30
    env:
@@ -509,16 +396,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-dev
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
+          cache-shared-key: ci-rustfs-debug-binary
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build debug binary
        run: cargo build -p rustfs --bins --features e2e-test-hooks
@@ -534,7 +419,6 @@ jobs:
  build-rustfs-debug-binary-rio-v2:
    name: Build RustFS Debug Binary (rio-v2)
    if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    needs: [ quick-checks ]
    runs-on: sm-standard-4
    timeout-minutes: 30
    env:
@@ -542,16 +426,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-feat-rio
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
+          cache-shared-key: ci-rustfs-debug-binary-rio-v2
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build debug binary with rio-v2
        run: cargo build -p rustfs --bins --features rio-v2,e2e-test-hooks
@@ -566,14 +448,6 @@ jobs:

  uring-integration:
    name: io_uring Integration (real)
-    # The pull_request trigger includes `closed` purely so the concurrency
-    # group cancels in-flight runs of a closed PR; every other job opts out of
-    # that run with this guard (or is skipped through its `needs` chain). This
-    # job had neither, so each closed/merged PR really ran the whole io_uring
-    # suite (measured 4m17s / 7m19s / 7m31s on runs 30678272341 / 30678117601 /
-    # 30662728539) and kept the cancellation run in progress for minutes.
-    if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    needs: [ quick-checks ]
    # GitHub-hosted ubuntu-latest runs a recent kernel with io_uring and, unlike
    # a container, applies no seccomp filter that would block io_uring_setup — so
    # the probe succeeds and the tests exercise the real UringBackend/FdCache/
@@ -584,24 +458,17 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          # Keeps its own key rather than joining ci-dev. rust-cache's key is
-          # built from runner.os/arch plus rustc and lockfile fingerprints — it
-          # does NOT include the runner label or image. ubuntu-latest and
-          # sm-standard-4 are therefore indistinguishable to it, so sharing a key
-          # would let two different system images overwrite each other's
-          # artifacts, and would make a 2-core hosted runner unpack ci-dev's ~3GB
-          # instead of this lane's ~1.3GB. cache-warm.yml warms this key on
-          # ubuntu-latest for the same reason.
          cache-shared-key: ci-uring
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Install build dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

      # ext4 supports O_DIRECT; the runner's default TMPDIR may sit on tmpfs or
      # overlayfs, where open(O_DIRECT) returns EINVAL/EOPNOTSUPP and the native
@@ -628,17 +495,7 @@ jobs:
          RUSTFS_IO_URING_READ_ENABLE: "true"
          RUSTFS_URING_TESTS_MUST_RUN: "1"
          TMPDIR: /mnt/rustfs-odirect
-        # --lib narrows what gets compiled, not what gets run: every selected
-        # test lives in the lib target. The 7 integration binaries under
-        # crates/ecstore/tests/ each reported "running 0 tests" here, so they
-        # were compiled and linked for nothing.
-        #
-        # The `uring_` filter must stay exactly as it is. libtest matches on
-        # substring, so it also selects names containing `during_` — 6 of the 18
-        # selected tests are such incidental matches. Narrowing the filter to
-        # `io_uring` would silently drop them, which is a coverage change.
-        # scripts/check_uring_lane_lib_only.sh guards the --lib precondition.
-        run: cargo test -p rustfs-ecstore --lib uring_ -- --test-threads=1 --nocapture
+        run: cargo test -p rustfs-ecstore uring_ -- --test-threads=1 --nocapture

  e2e-tests:
    name: End-to-End Tests
@@ -648,8 +505,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      # Full setup with dependency caching: the smoke-suite step below
      # compiles the e2e_test crate, which pulls in most of the workspace.
@@ -658,9 +513,9 @@ jobs:
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-dev
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
+          cache-shared-key: ci-e2e
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}

      # Download after the cache restore so the freshly built binary from the
      # build job always wins over anything restored into target/debug.
@@ -673,17 +528,15 @@ jobs:
      - name: Make binary executable
        run: chmod +x ./target/debug/rustfs

-      # Build the e2e test graph once. The archive is reused by the security
-      # count-floor check and the smoke run below, avoiding a second compile of
-      # the same e2e_test target on cold runners (backlog#1645).
-      - name: Archive e2e smoke test binaries
-        env:
-          NEXTEST_ARCHIVE: ${{ runner.temp }}/rustfs-e2e-smoke.tar.zst
-          NEXTEST_LISTING: ${{ runner.temp }}/rustfs-e2e-smoke-list.json
-        run: |
-          cargo nextest archive --profile e2e-smoke -p e2e_test --archive-file "${NEXTEST_ARCHIVE}"
-          cargo nextest list --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" --message-format json > "${NEXTEST_LISTING}"
-          ./scripts/check_security_smoke_count.sh check "${NEXTEST_LISTING}"
+      # Guard the security negative-auth smoke subset (backlog#1151 sec-5)
+      # against a rename or deletion silently dropping it out of the e2e-smoke
+      # filter. The script lists what the profile selects and fails if the count
+      # of security auth-rejection tests falls below the committed floor in
+      # .config/security-smoke-floor.txt (infra-12 count-floor mechanism). Run
+      # before the smoke suite so a thinned gate fails fast; the `nextest list`
+      # here compiles the e2e_test binaries the run below reuses.
+      - name: Check security smoke subset count floor
+        run: ./scripts/check_security_smoke_count.sh check

      # PR smoke subset of the in-repo e2e suite (backlog#1149 ci-4). The
      # profile.e2e-smoke default-filter in .config/nextest.toml is the single
@@ -691,30 +544,7 @@ jobs:
      # adding new e2e jobs here. Each test spawns its own rustfs server on a
      # random port and reuses the downloaded debug binary above.
      - name: Run e2e smoke suite
-        env:
-          NEXTEST_ARCHIVE: ${{ runner.temp }}/rustfs-e2e-smoke.tar.zst
-          RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-smoke-logs
-        run: |
-          cargo nextest run --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" \
-            --status-level all --final-status-level all --failure-output final
-
-      - name: Upload e2e smoke diagnostics
-        if: failure()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: e2e-smoke-diagnostics-${{ github.run_number }}
-          path: |
-            ${{ runner.temp }}/rustfs-e2e-smoke-logs/
-            ${{ runner.temp }}/rustfs-e2e-smoke-list.json
-          if-no-files-found: warn
-
-      - name: Upload e2e smoke JUnit report
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: e2e-smoke-junit-${{ github.run_number }}
-          path: target/nextest/e2e-smoke/junit.xml
-          if-no-files-found: warn
+        run: cargo nextest run --profile e2e-smoke -p e2e_test

      - name: Install s3s-e2e test tool
        uses: taiki-e/cache-cargo-install-action@7447f04c51f2ba27ca35e7f1e28fab848c5b3ba7 # v2
@@ -759,42 +589,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
-          cache-shared-key: ci-dev
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
-
-      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.12"
-
-      - name: Install awscurl
-        run: |
-          python3 -m pip install --user --upgrade pip "awscurl==0.44"
-          echo "AWSCURL_PATH=$HOME/.local/bin/awscurl" >> "$GITHUB_ENV"
-
-      - name: Verify awscurl
-        run: test -x "$AWSCURL_PATH"
-
-      - name: Install Vault
-        run: |
-          VAULT_VERSION="1.17.6"
-          VAULT_ARCHIVE="vault_${VAULT_VERSION}_linux_amd64.zip"
-          curl -fsSLo "$RUNNER_TEMP/$VAULT_ARCHIVE" "https://releases.hashicorp.com/vault/${VAULT_VERSION}/${VAULT_ARCHIVE}"
-          echo "0cddc1fbbb88583b5ba5b845f9f8fae47c6fb39a6d48cd543c6ba6fd3ac1a669  $RUNNER_TEMP/$VAULT_ARCHIVE" | sha256sum --check --status
-          unzip -q "$RUNNER_TEMP/$VAULT_ARCHIVE" -d "$RUNNER_TEMP/vault-bin"
-          echo "RUSTFS_TEST_VAULT_BIN=$RUNNER_TEMP/vault-bin/vault" >> "$GITHUB_ENV"
-
-      - name: Verify Vault
-        run: |
-          "$RUSTFS_TEST_VAULT_BIN" version
+          cache-shared-key: ci-e2e
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cache-save-if: ${{ github.ref == 'refs/heads/main' }}

      # Download after the cache restore so the freshly built binary from the
      # build job always wins over anything restored into target/debug.
@@ -830,8 +632,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Clean up previous test run
        run: |
@@ -886,8 +686,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Download debug binary
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -948,20 +746,12 @@ jobs:
  # evaluates ILM within ~2s of the due time, well inside the poll window.
  s3-lifecycle-behavior-tests:
    name: S3 Lifecycle Behavior Tests
-    # Also gated on e2e-tests, matching s3-implemented-tests: when the e2e smoke
-    # suite is already red this lane cannot tell us anything new, and it holds a
-    # sm-standard-4 for up to 30 minutes doing so. Both lanes only download the
-    # prebuilt debug binary (no cargo build), and s3-implemented-tests — which
-    # already waits on e2e-tests — finishes later anyway, so a green PR's total
-    # wall clock is unchanged.
-    needs: [ build-rustfs-debug-binary, e2e-tests ]
+    needs: [ build-rustfs-debug-binary ]
    runs-on: sm-standard-4
    timeout-minutes: 30
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Download debug binary
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -22,18 +22,11 @@ on:
  issue_comment:
    types: [created, edited]

-# Least privilege at the top, widened per job below. This workflow runs on
-# pull_request_target and issue_comment, so it holds full secrets on every fork
-# PR and on any comment anyone writes — the one place in this repository where a
-# compromised action would be handed a repo-write token. It does not check out
-# or execute PR code, so there is no pwn-request path today, but the blast
-# radius should not depend on that staying true.
-#
-# contents: write in particular was never used: the signature records are
-# written to rustfs/cla through the scoped app token created below, and nothing
-# here writes to this repository's contents.
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
+  issues: write
+  checks: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
@@ -43,26 +36,14 @@ jobs:
  cancel-closed-pr-runs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request_target' && github.event.action == 'closed'
-    # Echoes one line; the run exists only so the concurrency group cancels the
-    # in-flight run of a closed PR.
-    permissions: {}
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."

  cla:
    if: ${{ (github.event_name != 'issue_comment' || github.event.issue.pull_request) && (github.event_name != 'pull_request_target' || github.event.action != 'closed') }}
-    # checks: write reports the merge-queue check run; pull-requests and issues
-    # let cla-bot comment and label. contents stays read — see the note above.
-    permissions:
-      contents: read
-      checks: write
-      issues: write
-      pull-requests: write
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    steps:
      - name: Report CLA result for merge queue
        if: github.event_name == 'merge_group'
@@ -62,16 +62,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
          cache-shared-key: ci-coverage
+          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          install-build-packaging-tools: 'false'

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
@@ -118,8 +116,6 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -82,10 +82,8 @@ jobs:
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'push' &&
-       github.event.workflow_run.head_branch != 'main' &&
-       !contains(github.event.workflow_run.head_branch, '-preview'))
+       github.event.workflow_run.head_branch != 'main')
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    outputs:
      should_build: ${{ steps.check.outputs.should_build }}
      should_push: ${{ steps.check.outputs.should_push }}
@@ -98,18 +96,11 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          persist-credentials: false
          # For workflow_run events, checkout the specific commit that triggered the workflow
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}

      - name: Check build conditions
        id: check
-        env:
-          # dispatch inputs via env, not `${{ }}` interpolation: they are
-          # free-form strings and would otherwise be evaluated by bash.
-          INPUT_VERSION: ${{ github.event.inputs.version }}
-          INPUT_PUSH_IMAGES: ${{ github.event.inputs.push_images }}
-          INPUT_FORCE_REBUILD: ${{ github.event.inputs.force_rebuild }}
        run: |
          should_build=false
          should_push=false
@@ -210,9 +201,9 @@ jobs:

          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            # Manual trigger
-            input_version="$INPUT_VERSION"
+            input_version="${{ github.event.inputs.version }}"
            version="${input_version}"
-            should_push="$INPUT_PUSH_IMAGES"
+            should_push="${{ github.event.inputs.push_images }}"
            should_build=true

            # Get short SHA
@@ -220,7 +211,7 @@ jobs:

            echo "🎯 Manual Docker build triggered:"
            echo "   📋 Requested version: $input_version"
-            echo "   🔧 Force rebuild: $INPUT_FORCE_REBUILD"
+            echo "   🔧 Force rebuild: ${{ github.event.inputs.force_rebuild }}"
            echo "   🚀 Push images: $should_push"

            case "$input_version" in
@@ -229,13 +220,6 @@ jobs:
                create_latest=true
                echo "🚀 Building with latest stable release version"
                ;;
-              *-preview*)
-                build_type="preview"
-                is_prerelease=true
-                should_build=false
-                should_push=false
-                echo "⏭️  Preview tags do not publish Docker images"
-                ;;
              # Prerelease versions (must match first, more specific)
              v*alpha*|v*beta*|v*rc*|*alpha*|*beta*|*rc*)
                build_type="prerelease"
@@ -306,8 +290,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
@@ -343,28 +325,32 @@ jobs:
          CREATE_LATEST="${{ needs.build-check.outputs.create_latest }}"
          VARIANT_SUFFIX="${{ matrix.suffix }}"

-          # Convert version format for Dockerfile compatibility. The former
-          # DOCKER_CHANNEL was "release" down every branch and was passed as a
-          # build-arg no Dockerfile declares, so it is gone.
+          # Convert version format for Dockerfile compatibility
          case "$VERSION" in
            "latest")
+              # For stable latest, use RELEASE=latest + release CHANNEL
              DOCKER_RELEASE="latest"
+              DOCKER_CHANNEL="release"
              ;;
            v*)
              # For versioned releases (v1.0.0), remove 'v' prefix for Dockerfile
              DOCKER_RELEASE="${VERSION#v}"
+              DOCKER_CHANNEL="release"
              ;;
            *)
              # For other versions, pass as-is
              DOCKER_RELEASE="${VERSION}"
+              DOCKER_CHANNEL="release"
              ;;
          esac

          echo "docker_release=$DOCKER_RELEASE" >> "$GITHUB_OUTPUT"
+          echo "docker_channel=$DOCKER_CHANNEL" >> "$GITHUB_OUTPUT"

          echo "🐳 Docker build parameters:"
          echo "  - Original version: $VERSION"
          echo "  - Docker RELEASE: $DOCKER_RELEASE"
+          echo "  - Docker CHANNEL: $DOCKER_CHANNEL"

          # Generate tags based on build type
          # Only support release and prerelease builds (no development builds)
@@ -418,24 +404,18 @@ jobs:
          push: ${{ needs.build-check.outputs.should_push == 'true' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          # No layer cache. This build compiles nothing — it downloads a
-          # release zip and runs apk/apt — so the cache could only save the
-          # minute or two those take, while creating a correctness problem: with
-          # RELEASE=latest the binary URL is resolved by curl *inside* a RUN
-          # layer, and the layer key does not include what that resolved to. A
-          # rebuild at the same RELEASE value (dispatch with version=latest, or
-          # a re-run of the same version) would hit the old layer and ship the
-          # previous release's binary. mode=max also consumed the same 10GB
-          # Actions cache quota the Rust lanes are fighting over.
-          #
-          # Only RELEASE is passed: it is the sole build-arg the Dockerfiles
-          # declare besides TARGETARCH. BUILDTIME, VERSION, BUILD_TYPE, REVISION
-          # and CHANNEL were never read by any stage (and BUILDTIME's $(date ...)
-          # was a literal here, not a shell substitution). BUILD_DATE and VCS_REF
-          # are declared by the Dockerfiles but deliberately left unset —
-          # supplying them would change the published image labels.
+          cache-from: |
+            type=gha,scope=docker-${{ matrix.variant }}
+          cache-to: |
+            type=gha,mode=max,scope=docker-${{ matrix.variant }}
          build-args: |
+            BUILDTIME=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
+            VERSION=${{ needs.build-check.outputs.version }}
+            BUILD_TYPE=${{ needs.build-check.outputs.build_type }}
+            REVISION=${{ github.sha }}
            RELEASE=${{ steps.meta.outputs.docker_release }}
+            CHANNEL=${{ steps.meta.outputs.docker_channel }}
+            BUILDKIT_INLINE_CACHE=1
          provenance: true
          sbom: true
          # Add retry mechanism by splitting the build process
@@ -451,7 +431,6 @@ jobs:
    needs: [ build-check, build-docker ]
    if: needs.build-check.outputs.should_build == 'true' && needs.build-check.outputs.should_push == 'true'
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
@@ -506,7 +485,6 @@ jobs:
    needs: [ build-check, build-docker ]
    if: always() && needs.build-check.outputs.should_build == 'true'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - name: Docker build completion summary
        run: |
@@ -14,24 +14,25 @@

 # Nightly full replication e2e lane (backlog#1147 repl-1, deps: ci-4).
 #
-# The per-PR gate (ci.yml `e2e-tests` job, `--profile e2e-smoke`) runs the
-# FAST replication tests. This scheduled lane runs the remaining heavier
-# replication e2e tests that are unfit for a per-PR gate: remote-target TLS
-# validation, bucket-replication data-plane/helper tests (PUT/delete + poll
-# for convergence, HTTPS targets, active SSE failure contracts, event/history
-# observers), and the `_real_dual_node` / `_real_three_node` /
-# `_real_single_node` site-replication tests that each spawn full rustfs
-# server processes.
+# The per-PR gate (ci.yml `e2e-tests` job, `--profile e2e-smoke`) runs the 20
+# FAST replication tests. This scheduled lane runs the remaining 27
+# heavier replication e2e tests that are unfit for a per-PR gate:
+#
+#   * 2 remote-target TLS validation tests.
+#   * 12 bucket-replication data-plane/helper tests (PUT/delete + poll for
+#     convergence; two replicate over HTTPS, two pin active SSE failure
+#     contracts, and one guards event/history observers). The SSE-S3 contract
+#     remains ignored under backlog#1291.
+#   * 11 `_real_dual_node` site-replication tests (each spawns TWO rustfs
+#     servers and drives the cross-process site-replication control plane).
+#   * 1 `_real_three_node` site-replication test.
+#   * 1 `_real_single_node` service-account round-trip test.
 #
 # The selection is the [profile.e2e-repl-nightly] default-filter in
 # .config/nextest.toml — the single wiring mechanism (repl-1 / ci-4). Do NOT
-# add ad-hoc cargo-test steps here; change the filterset instead. The
-# authoritative membership and count come from
-# `cargo nextest list -p e2e_test --profile e2e-repl-nightly`; the PR/nightly
-# count invariant is maintained next to the filtersets in .config/nextest.toml
-# (deliberately not duplicated here).
+# add ad-hoc cargo-test steps here; change the filterset instead.
 #
-# Explicit division of labor: the nightly subset runs ONLY here, never double-run
+# Explicit division of labor: these 27 tests run ONLY here, never double-run
 # in ci-5's future e2e-full merge gate. TODO(ci-7): once the ci domain's
 # consolidated scheduled e2e workflow exists, fold this interim repl-owned lane
 # into it rather than growing a second scheduled entrypoint.
@@ -63,16 +64,14 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
          cache-shared-key: ci-e2e-repl
+          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          install-build-packaging-tools: 'false'

      # awscurl lets the STS dual-node test actually exercise its path. Without
      # it the test skips gracefully with a visible log line
@@ -125,8 +124,6 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -45,13 +45,6 @@
 # The PR gate (ci.yml s3-implemented-tests) is unaffected: it avoids Docker
 # via DEPLOY_MODE=binary and defers all pip setup to run.sh's self-bootstrap.

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: e2e-s3tests

 on:
@@ -142,8 +135,6 @@ jobs:
      TEST_MODE: ${{ matrix.test-mode }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      # Provision Python explicitly rather than trusting the runner image to
      # ship a working pip (ci-1: a bare python3 without pip is what broke the
@@ -363,8 +354,6 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -12,13 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: Fuzz

 on:
@@ -66,7 +59,6 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -87,14 +79,13 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: nightly
          cache-shared-key: fuzz-${{ hashFiles('fuzz/Cargo.lock') }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'schedule' }}

      - name: Install cargo-fuzz
@@ -154,8 +145,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Download prebuilt fuzz binaries
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -211,8 +200,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Download prebuilt fuzz binaries
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -260,8 +247,6 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -32,14 +32,12 @@ permissions:
 jobs:
  build-helm-package:
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    if: |
-      (github.event_name == 'workflow_dispatch' && !contains(github.event.inputs.version, '-preview')) ||
+      github.event_name == 'workflow_dispatch' ||
      (
        github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.event == 'push' &&
-        contains(github.event.workflow_run.head_branch, '.') &&
-        !contains(github.event.workflow_run.head_branch, '-preview')
+        contains(github.event.workflow_run.head_branch, '.')
      )

    outputs:
@@ -50,26 +48,16 @@ jobs:
    steps:
      - name: Checkout helm chart repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

-      # Both inputs reach the shell through env rather than `${{ }}`
-      # interpolation. A git ref name may contain `$(...)` — anything without a
-      # space is a legal tag — and interpolation pastes it into the script
-      # verbatim, where bash would run it. Reading "$RAW_INPUT" instead makes it
-      # data.
      - name: Normalize release version
        id: version
-        env:
-          RAW_INPUT: ${{ github.event.inputs.version }}
-          RAW_BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: |
          set -eux

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            RAW="$RAW_INPUT"
+            RAW="${{ github.event.inputs.version }}"
          else
-            RAW="$RAW_BRANCH"
+            RAW="${{ github.event.workflow_run.head_branch }}"
          fi

          case "$RAW" in
@@ -84,13 +72,10 @@ jobs:
          ./scripts/helm_chart_version.sh "$RAW_TAG"

      - name: Replace chart version and app version
-        env:
-          CHART_VERSION: ${{ steps.version.outputs.chart_version }}
-          APP_VERSION: ${{ steps.version.outputs.app_version }}
        run: |
          set -eux
-          sed -i -E "s/^version:.*/version: \"${CHART_VERSION}\"/" helm/rustfs/Chart.yaml
-          sed -i -E "s/^appVersion:.*/appVersion: \"${APP_VERSION}\"/" helm/rustfs/Chart.yaml
+          sed -i -E 's/^version:.*/version: "${{ steps.version.outputs.chart_version }}"/' helm/rustfs/Chart.yaml
+          sed -i -E 's/^appVersion:.*/appVersion: "${{ steps.version.outputs.app_version }}"/' helm/rustfs/Chart.yaml

      - name: Set up Helm
        uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
@@ -115,7 +100,6 @@ jobs:

  publish-helm-package:
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    needs: [ build-helm-package ]
    if: needs.build-helm-package.result == 'success'

@@ -123,8 +107,6 @@ jobs:
      - name: Checkout helm package repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          # persist-credentials-exempt: this checkout's token IS the push credential —
-          # the job git-pushes to rustfs/helm below. Clearing it breaks chart publishing.
          repository: rustfs/helm
          token: ${{ secrets.RUSTFS_HELM_PACKAGE }}

@@ -140,19 +122,11 @@ jobs:
      - name: Generate index
        run: helm repo index . --url https://charts.rustfs.com

-      # app_version is derived from the triggering tag name, and this job holds
-      # the cross-repository push token with rustfs/helm already checked out —
-      # the worst place in the repo to paste an attacker-influenced string into
-      # a shell line. Passed through env so bash treats it as data.
      - name: Push helm package and index file
-        env:
-          GIT_USERNAME: ${{ secrets.USERNAME }}
-          GIT_EMAIL: ${{ secrets.EMAIL_ADDRESS }}
-          APP_VERSION: ${{ needs.build-helm-package.outputs.app_version }}
        run: |
          set -eux
-          git config --global user.name "${GIT_USERNAME}"
-          git config --global user.email "${GIT_EMAIL}"
+          git config --global user.name "${{ secrets.USERNAME }}"
+          git config --global user.email "${{ secrets.EMAIL_ADDRESS }}"
          git add .
-          git commit -m "Update rustfs helm package with ${APP_VERSION}." || echo "No changes to commit"
+          git commit -m "Update rustfs helm package with ${{ needs.build-helm-package.outputs.app_version }}." || echo "No changes to commit"
          git push origin main
@@ -12,13 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: "issue-translator"
 on:
  issue_comment:
@@ -33,7 +26,6 @@ permissions:
 jobs:
  build:
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - uses: usthe/issues-translate-action@b41f55ddc81d7d54bd542a4f289fe28ec081898e # v2.7
        with:
@@ -18,25 +18,11 @@
 # This is NOT a PR gate. The fixtures are real MinIO backend trees generated on
 # the fly (they are gitignored, never committed), so the job regenerates them
 # each run with Docker and then runs the `#[ignore]` reader tests in
-# rustfs/src/storage/minio_generated_read_test.rs.
-#
-# Scope: end-to-end MinIO-to-RustFS SSE interop is NOT implemented yet. Both
-# envelope parsers reject MinIO's own wrapped-DEK shape — see
-# `is_data_key_envelope` in crates/kms/src/encryption/dek.rs and the
-# `deny_unknown_fields` `LocalSseDekEnvelope` in rustfs/src/storage/sse.rs — and
-# closing that gap is tracked in rustfs/backlog#1638. Treat this job as the
-# harness for #1638, not as standing evidence that a MinIO migration reads back.
+# crates/ecstore/tests/minio_generated_read_test.rs.
 #
 # Runner: GitHub-hosted `ubuntu-latest`. It reliably ships Docker + Python,
 # unlike the self-hosted fleet, whose pods drift in Docker/pip availability
 # (see the infra note in e2e-s3tests.yml). Nightly + manual only.
-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: minio-interop

 on:
@@ -62,62 +48,23 @@ jobs:
    env:
      # Fixed 32-byte test KMS key baked into the fixture lab; not a secret.
      RUSTFS_MINIO_STATIC_KMS_KEY_B64: IyqsU3kMFloCNup4BsZtf/rmfHVcTgznO2F25CkEH1g=
-      # Single definition of "the interop tests", shared by the guard step and
-      # the run step so the two cannot drift apart.
-      #
-      # These used to live in crates/ecstore/tests/minio_generated_read_test.rs
-      # and were selected with `-p rustfs-ecstore -E
-      # 'binary(minio_generated_read_test)'`. #5435 moved them into the `rustfs`
-      # crate as a `#[cfg(test)] mod`, which deleted that test binary; the
-      # selector was never updated and has selected zero interop tests ever
-      # since (cargo-nextest 0.9.140 now rejects it outright: "operator didn't
-      # match any binary names", exit 94).
-      INTEROP_PACKAGE: rustfs
-      INTEROP_FEATURES: rio-v2
-      INTEROP_FILTER: "test(minio_generated_read_test::)"
-      INTEROP_REQUIRED_TESTS: '["reads_minio_generated_sse_s3_multipart_fixture", "reads_minio_generated_sse_kms_multipart_fixture", "rejects_minio_generated_sse_s3_fixture_with_wrong_kms_key", "rejects_minio_generated_sse_s3_fixture_with_truncated_ciphertext"]'
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
        with:
          rust-version: stable
          cache-shared-key: ci-minio-interop
+          github-token: ${{ secrets.GITHUB_TOKEN }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Generate real MinIO fixtures via Docker
        run: bash crates/rio-v2/tests/minio_fixture_lab/capture_via_docker.sh

-      # `binary(...)` at least dies loudly when nothing matches, but `test(...)`
-      # is a perfectly valid filterset that matches zero tests, so the next
-      # rename or module move would leave this job selecting nothing and
-      # reporting success without executing a single interop assertion. Count
-      # the selection and require every core reader test, while allowing new
-      # reader cases to be added without changing this guard.
-      #
-      # Count only `filter-match.status == "matches"`: the top-level
-      # `test-count` in the JSON is the package total and ignores `-E` entirely.
-      - name: Assert the interop selector still matches tests
-        run: |
-          set -euo pipefail
-          selection="$(cargo nextest list --run-ignored ignored-only \
-            -p "$INTEROP_PACKAGE" --features "$INTEROP_FEATURES" \
-            -E "$INTEROP_FILTER" --message-format json \
-            | python3 -c 'import json,os,sys; d=json.load(sys.stdin); required=json.loads(os.environ["INTEROP_REQUIRED_TESTS"]); matched=[name for suite in d.get("rust-suites", {}).values() for name,test in suite.get("testcases", {}).items() if test.get("filter-match", {}).get("status") == "matches"]; missing=[test for test in required if not any(name.endswith("minio_generated_read_test::" + test) for name in matched)]; print(len(matched)); print(",".join(missing))')"
-          count="$(printf '%s\n' "$selection" | sed -n '1p')"
-          missing="$(printf '%s\n' "$selection" | sed -n '2p')"
-          echo "interop tests selected: ${count}"
-          if [ -n "${missing}" ]; then
-            echo "::error::Selector '${INTEROP_FILTER}' in package '${INTEROP_PACKAGE}' is missing required tests: ${missing}. The MinIO interop reader tests have moved or been renamed; fix the selector instead of running an incomplete matrix. Context: rustfs/backlog#1638."
-            exit 1
-          fi
-
      - name: Run MinIO interop reader tests
        run: |
-          cargo nextest run --run-ignored ignored-only --no-tests=fail \
-            -p "$INTEROP_PACKAGE" --features "$INTEROP_FEATURES" \
-            -E "$INTEROP_FILTER"
+          cargo nextest run --run-ignored ignored-only \
+            -p rustfs-ecstore --features rio-v2 \
+            -E 'binary(minio_generated_read_test)'
@@ -45,13 +45,6 @@
 # docker-capable self-hosted `dind-sm-standard-2` label was the alternative but
 # has fewer cores and reintroduces fleet-state risk for no reliability gain.

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: mint

 on:
@@ -125,8 +118,6 @@ jobs:
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Enable buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
@@ -272,8 +263,6 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -1,196 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Nightly GNU Build
-
-on:
-  schedule:
-    - cron: "0 0 * * *"
-      timezone: "Asia/Shanghai"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: nightly-gnu-build-main-${{ github.event_name }}
-  cancel-in-progress: ${{ github.event_name == 'workflow_dispatch' }}
-
-env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
-
-jobs:
-  build:
-    name: Build x86_64 GNU
-    runs-on: sm-standard-2
-    timeout-minutes: 150
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-    steps:
-      - name: Checkout main branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-          ref: main
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          cache-shared-key: build-x86_64-unknown-linux-gnu
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
-          install-test-tools: 'false'
-
-      - name: Build RustFS
-        run: cargo build --release --locked --target x86_64-unknown-linux-gnu -p rustfs --bins
-
-  # Live-Vault lane for the rustfs-kms suite (rustfs/backlog#1774).
-  #
-  # RUSTFS_KMS_VAULT_TOKEN is the single switch that adds the Vault KV2 and
-  # Vault Transit backends to every for_each_backend spec in
-  # crates/kms/tests/behavior_*.rs (see crates/kms/AGENTS.md). rotate and
-  # versioning are advertised only by the Vault backends, so without this lane
-  # no CI run ever asserts the working half of behavior_rotation.rs — a
-  # rotation that silently dropped historical key versions would stay green.
-  # The same lane runs the dev-Vault #[ignore] tests and the two self-hosting
-  # live scripts (AppRole login, three-node Raft leader failover).
-  #
-  # GitHub-hosted ubuntu-latest, deliberately not the self-hosted sm-standard
-  # fleet: the HA failover script needs a working Docker daemon, and the
-  # self-hosted fleet is heterogeneous — a docker-dependent workflow has been
-  # burned by it before (see the banner in e2e-s3tests.yml, rustfs/backlog#1149).
-  kms-vault-lane:
-    name: KMS live Vault lane
-    runs-on: ubuntu-latest
-    timeout-minutes: 90
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-      # Root token of the ephemeral loopback dev server. Not a secret: the
-      # server lives only for this job, listens on 127.0.0.1, and holds only
-      # keys the tests create. The literal value matters — the dev-Vault
-      # #[ignore] fixtures in crates/kms/src/backends/vault.rs hardcode it.
-      VAULT_LANE_TOKEN: dev-only-token
-      VAULT_LANE_ADDR: http://127.0.0.1:8200
-      # Keeps a runner-level proxy from swallowing the loopback dev-server
-      # traffic (see crates/kms/AGENTS.md). Actions env keys are
-      # case-insensitive, so only the uppercase form is set; reqwest reads
-      # either casing.
-      NO_PROXY: 127.0.0.1,localhost
-    steps:
-      - name: Checkout main branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-          ref: main
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          # Dedicated key: rust-cache cannot tell runner images apart, so
-          # sharing a key with an sm-standard lane would let two different
-          # system images overwrite each other's artifacts (same reasoning as
-          # ci.yml's ci-uring lane). Saved from this nightly job itself so the
-          # next night starts warm.
-          cache-shared-key: kms-vault-lane
-          cache-save-if: 'true'
-          install-build-packaging-tools: 'false'
-          install-test-tools: 'false'
-
-      - name: Install Vault CLI
-        run: |
-          set -euo pipefail
-          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
-          echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list >/dev/null
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq vault
-          vault version
-
-      - name: Start Vault dev server with KV2 and Transit engines
-        run: |
-          set -euo pipefail
-          nohup vault server -dev \
-            -dev-root-token-id="${VAULT_LANE_TOKEN}" \
-            -dev-listen-address=127.0.0.1:8200 >/tmp/vault-dev.log 2>&1 &
-          for _ in $(seq 1 60); do
-            if curl -fsS "${VAULT_LANE_ADDR}/v1/sys/health" >/dev/null 2>&1; then
-              break
-            fi
-            sleep 1
-          done
-          curl -fsS "${VAULT_LANE_ADDR}/v1/sys/health"
-          export VAULT_ADDR="${VAULT_LANE_ADDR}" VAULT_TOKEN="${VAULT_LANE_TOKEN}"
-          # Dev mode mounts KV v2 at secret/ by default; Transit is explicit.
-          # Prove both engines actually work rather than assuming the defaults.
-          vault secrets enable transit
-          vault kv put secret/rustfs-ci-lane-probe value=ok >/dev/null
-          vault kv get secret/rustfs-ci-lane-probe >/dev/null
-          vault write -f transit/keys/rustfs-ci-lane-probe >/dev/null
-
-      - name: Run rustfs-kms suite with the Vault lane on
-        env:
-          RUSTFS_KMS_VAULT_TOKEN: ${{ env.VAULT_LANE_TOKEN }}
-          RUSTFS_KMS_VAULT_ADDR: ${{ env.VAULT_LANE_ADDR }}
-        run: cargo test -p rustfs-kms --locked
-
-      - name: Run dev-Vault ignored tests
-        env:
-          RUSTFS_KMS_VAULT_TOKEN: ${{ env.VAULT_LANE_TOKEN }}
-          RUSTFS_KMS_VAULT_ADDR: ${{ env.VAULT_LANE_ADDR }}
-        # Filters select the dev-Vault-only #[ignore] tests. The AWS #[ignore]
-        # tests (backends::aws, service_manager) stay excluded — they need real
-        # AWS credentials and create billable keys. The AppRole and HA #[ignore]
-        # tests are excluded here because their own scripts below provision the
-        # Vault topology they need.
-        run: |
-          set -euo pipefail
-          cargo test -p rustfs-kms --locked --lib backends::contract_tests -- --ignored
-          cargo test -p rustfs-kms --locked --lib backends::vault -- --ignored
-          cargo test -p rustfs-kms --locked --test vault_fault_injection -- --ignored
-
-      - name: Run AppRole live checks (self-hosting ephemeral Vault)
-        run: bash scripts/test/vault_approle_kms_live.sh
-
-      - name: Show Vault dev server log on failure
-        if: failure()
-        run: tail -n 200 /tmp/vault-dev.log || true
-
-  # Three-node Raft leader failover (crates/kms/tests/vault_ha_failover_live.rs,
-  # first validated by rustfs/rustfs#5653). Its own job so an election-timing
-  # flake cannot mask the main lane's verdict, and vice versa. The script
-  # provisions and tears down its own Docker cluster.
-  kms-vault-ha-failover:
-    name: KMS Vault HA failover lane
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-      NO_PROXY: 127.0.0.1,localhost
-    steps:
-      - name: Checkout main branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-          ref: main
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          cache-shared-key: kms-vault-lane
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
-          install-test-tools: 'false'
-
-      - name: Run HA leader failover live checks (three-node Raft cluster in Docker)
-        run: bash scripts/test/vault_ha_kms_live.sh
@@ -19,12 +19,9 @@ on:
  schedule:
    - cron: '0 5 * * 0' # Weekly on Sunday 05:00 UTC (staggered after the midnight ci/build crons)

-# GITHUB_TOKEN only needs to read the repository here: the branch push and the
-# pull request are both created by update-flake-lock using the
-# FLAKE_UPDATE_TOKEN PAT below, not by this token. Leaving write on it hands a
-# repo-write credential to an unattended weekly job that does not use it.
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -40,10 +37,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        # persist-credentials-exempt: update-flake-lock pushes the branch and opens
-        # the PR. It passes FLAKE_UPDATE_TOKEN to create-pull-request itself rather
-        # than reusing .git/config, but that is unverified — exempt until a
-        # workflow_dispatch run confirms it (rustfs/backlog#1602).

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3
@@ -12,13 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: Nix CI

 on:
@@ -53,7 +46,6 @@ jobs:
    name: Cancel Closed PR Runs
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - name: Explain cancellation run
        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
@@ -71,8 +63,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@4eea0b33e3d1f02ecfe37cf16e7204c424009606 # v3.21.0
@@ -1,477 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Package Workflow - Build DEB/RPM packages
-#
-# This workflow builds DEB and RPM packages from pre-built Linux binaries
-# and uploads them to Cloudflare R2.
-#
-# Trigger:
-# - release published: automatically package when a GitHub release is published
-# - workflow_dispatch: manual trigger with optional tag/run_id
-#
-# Flow:
-# 1. Find the Build workflow run for the release tag
-# 2. Download Linux binaries (x86_64-gnu, aarch64-gnu) from build artifacts
-# 3. Build DEB packages for amd64 and arm64
-# 4. Build RPM packages for x86_64 and aarch64
-# 5. Upload all packages to Cloudflare R2
-
-name: Package DEB/RPM
-
-permissions:
-  contents: read
-  actions: read
-
-on:
-  release:
-    types: [ published ]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Release tag to package (e.g. 1.0.0-beta.12). Leave empty for latest main build."
-        required: false
-        type: string
-      build_run_id:
-        description: "Build workflow run ID (overrides tag lookup)"
-        required: false
-        type: string
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.tag || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  # Resolve which build run to use and extract version info
-  resolve:
-    name: Resolve Build
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    outputs:
-      version: ${{ steps.resolve.outputs.version }}
-      build_type: ${{ steps.resolve.outputs.build_type }}
-      build_run_id: ${{ steps.resolve.outputs.build_run_id }}
-      tag: ${{ steps.resolve.outputs.tag }}
-    steps:
-      - name: Resolve build run
-        id: resolve
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          INPUT_TAG: ${{ github.event.inputs.tag }}
-          INPUT_RUN_ID: ${{ github.event.inputs.build_run_id }}
-        run: |
-          set -euo pipefail
-
-          # Determine tag
-          if [[ "${{ github.event_name }}" == "release" ]]; then
-            TAG="${{ github.event.release.tag_name }}"
-          elif [[ -n "$INPUT_TAG" ]]; then
-            TAG="$INPUT_TAG"
-          else
-            TAG=""
-          fi
-
-          echo "Tag: ${TAG:-<none>}"
-
-          # Determine build run ID
-          BUILD_RUN_ID=""
-
-          if [[ -n "$INPUT_RUN_ID" ]]; then
-            # Explicit run ID takes priority
-            BUILD_RUN_ID="$INPUT_RUN_ID"
-            echo "Using explicit build run ID: $BUILD_RUN_ID"
-
-          elif [[ -n "$TAG" ]]; then
-            # Find the build run that produced this tag
-            echo "Looking for build run for tag: $TAG"
-            BUILD_RUN_ID=$(gh api \
-              "repos/${{ github.repository }}/actions/workflows/build.yml/runs?branch=${TAG}&status=success&per_page=1" \
-              --jq '.workflow_runs[0].id' 2>/dev/null || echo "")
-
-            if [[ -z "$BUILD_RUN_ID" || "$BUILD_RUN_ID" == "null" ]]; then
-              # Tag might not be a branch; try event=push with head_branch matching
-              BUILD_RUN_ID=$(gh api \
-                "repos/${{ github.repository }}/actions/workflows/build.yml/runs?event=push&status=success&per_page=100" \
-                --jq ".workflow_runs[] | select(.head_branch == \"$TAG\") | .id" 2>/dev/null | head -1 || echo "")
-            fi
-
-            if [[ -z "$BUILD_RUN_ID" || "$BUILD_RUN_ID" == "null" ]]; then
-              echo "❌ No successful build run found for tag: $TAG"
-              exit 1
-            fi
-            echo "Found build run: $BUILD_RUN_ID"
-
-          else
-            # No tag — latest successful main build
-            echo "No tag specified, looking for latest main build"
-            BUILD_RUN_ID=$(gh api \
-              "repos/${{ github.repository }}/actions/workflows/build.yml/runs?branch=main&status=success&per_page=1" \
-              --jq '.workflow_runs[0].id' 2>/dev/null || echo "")
-
-            if [[ -z "$BUILD_RUN_ID" || "$BUILD_RUN_ID" == "null" ]]; then
-              echo "❌ No successful main build found"
-              exit 1
-            fi
-            echo "Latest main build: $BUILD_RUN_ID"
-          fi
-
-          # Determine version and build type
-          if [[ -n "$TAG" ]]; then
-            VERSION="$TAG"
-            if [[ "$TAG" == *"-preview"* ]]; then
-              BUILD_TYPE="preview"
-            elif [[ "$TAG" == *"alpha"* || "$TAG" == *"beta"* || "$TAG" == *"rc"* ]]; then
-              BUILD_TYPE="prerelease"
-            else
-              BUILD_TYPE="release"
-            fi
-          else
-            SHORT_SHA=$(gh api "repos/${{ github.repository }}/actions/runs/${BUILD_RUN_ID}" \
-              --jq '.head_sha' 2>/dev/null | head -c 7)
-            VERSION="dev-${SHORT_SHA}"
-            BUILD_TYPE="development"
-          fi
-
-          {
-            echo "version=$VERSION"
-            echo "build_type=$BUILD_TYPE"
-            echo "build_run_id=$BUILD_RUN_ID"
-            echo "tag=${TAG}"
-          } >> "$GITHUB_OUTPUT"
-
-          echo "📊 Resolved:"
-          echo "  Version: $VERSION"
-          echo "  Build type: $BUILD_TYPE"
-          echo "  Build run ID: $BUILD_RUN_ID"
-
-  # Build DEB and RPM packages for each architecture
-  package:
-    name: Package (${{ matrix.arch }})
-    needs: resolve
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - arch: x86_64
-            deb_arch: amd64
-            rpm_arch: x86_64
-            artifact_name: "rustfs-linux-x86_64-gnu"
-          - arch: aarch64
-            deb_arch: arm64
-            rpm_arch: aarch64
-            artifact_name: "rustfs-linux-aarch64-gnu"
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Download binary artifact from build run
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
-        with:
-          pattern: ${{ matrix.artifact_name }}*
-          path: ./binary-artifact
-          run-id: ${{ needs.resolve.outputs.build_run_id }}
-          github-token: ${{ github.token }}
-          merge-multiple: true
-
-      - name: Extract binary
-        id: binary
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          ZIP_FILE=$(find ./binary-artifact -name "*.zip" -type f | head -1)
-          if [[ -z "$ZIP_FILE" ]]; then
-            echo "❌ No binary artifact found"
-            ls -la ./binary-artifact/ || true
-            exit 1
-          fi
-
-          echo "Found artifact: $ZIP_FILE"
-
-          mkdir -p ./bin
-          unzip -o "$ZIP_FILE" -d ./bin
-
-          if [[ ! -f ./bin/rustfs ]]; then
-            echo "❌ rustfs binary not found in archive"
-            exit 1
-          fi
-
-          chmod +x ./bin/rustfs
-          ls -lh ./bin/rustfs
-          echo "✅ Binary extracted"
-
-      - name: Build DEB package
-        id: deb
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          VERSION="${{ needs.resolve.outputs.version }}"
-          DEB_ARCH="${{ matrix.deb_arch }}"
-          # DEB version: replace - with ~ (1.0.0-beta.12 -> 1.0.0~beta.12)
-          # Use a variable for ~ to prevent tilde expansion by bash
-          TILDE='~'
-          DEB_VERSION="${VERSION/-/$TILDE}"
-          PKG_DIR="rustfs_${DEB_VERSION}_${DEB_ARCH}"
-
-          echo "Building DEB: ${PKG_DIR}.deb"
-
-          mkdir -p "${PKG_DIR}/DEBIAN"
-          mkdir -p "${PKG_DIR}/usr/bin"
-          mkdir -p "${PKG_DIR}/etc/default"
-          mkdir -p "${PKG_DIR}/lib/systemd/system"
-          mkdir -p "${PKG_DIR}/usr/share/doc/rustfs"
-
-          cp ./bin/rustfs "${PKG_DIR}/usr/bin/"
-          chmod 755 "${PKG_DIR}/usr/bin/rustfs"
-
-          cp deploy/build/rustfs.service "${PKG_DIR}/lib/systemd/system/"
-
-          cat > "${PKG_DIR}/etc/default/rustfs" << 'ENVEOF'
-          # RustFS Environment Configuration
-          # See https://rustfs.com/docs/ for more information
-          # RUSTFS_VOLUMES=""
-          # RUSTFS_ROOT_USER=""
-          # RUSTFS_ROOT_PASSWORD=""
-          ENVEOF
-
-          cat > "${PKG_DIR}/DEBIAN/control" << EOF
-          Package: rustfs
-          Version: ${DEB_VERSION}
-          Section: utils
-          Priority: optional
-          Architecture: ${DEB_ARCH}
-          Depends: libc6 (>= 2.31)
-          Maintainer: RustFS Team <support@rustfs.com>
-          Description: High-performance distributed object storage
-           RustFS is a high-performance distributed object storage software
-           built using Rust. It is compatible with MinIO and S3 API.
-          Homepage: https://rustfs.com
-          EOF
-
-          cat > "${PKG_DIR}/DEBIAN/postinst" << 'POSTINST'
-          #!/bin/bash
-          set -e
-          if ! getent passwd rustfs > /dev/null 2>&1; then
-              useradd -r -s /bin/false -d /opt/rustfs rustfs
-          fi
-          mkdir -p /opt/rustfs /data/rustfs /var/log/rustfs
-          chown rustfs:rustfs /opt/rustfs /data/rustfs /var/log/rustfs
-          if [ -d /run/systemd/system ]; then
-              systemctl daemon-reload
-          fi
-          echo "RustFS installed. Configure /etc/default/rustfs then: systemctl start rustfs"
-          POSTINST
-          chmod 755 "${PKG_DIR}/DEBIAN/postinst"
-
-          cat > "${PKG_DIR}/DEBIAN/prerm" << 'PRERM'
-          #!/bin/bash
-          set -e
-          if [ -d /run/systemd/system ] && systemctl is-active --quiet rustfs; then
-              systemctl stop rustfs
-          fi
-          PRERM
-          chmod 755 "${PKG_DIR}/DEBIAN/prerm"
-
-          cat > "${PKG_DIR}/DEBIAN/postrm" << 'POSTRM'
-          #!/bin/bash
-          set -e
-          if [ -d /run/systemd/system ]; then
-              systemctl daemon-reload
-          fi
-          POSTRM
-          chmod 755 "${PKG_DIR}/DEBIAN/postrm"
-
-          cp LICENSE "${PKG_DIR}/usr/share/doc/rustfs/"
-          cp README.md "${PKG_DIR}/usr/share/doc/rustfs/"
-
-          fakeroot dpkg-deb --build "${PKG_DIR}"
-
-          DEB_FILE="${PKG_DIR}.deb"
-          ls -lh "$DEB_FILE"
-          echo "deb_file=$DEB_FILE" >> "$GITHUB_OUTPUT"
-          echo "✅ DEB built: $DEB_FILE"
-
-      - name: Build RPM package
-        id: rpm
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          VERSION="${{ needs.resolve.outputs.version }}"
-          RPM_ARCH="${{ matrix.rpm_arch }}"
-
-          echo "Building RPM for ${RPM_ARCH}"
-
-          sudo apt-get update && sudo apt-get install -y ruby ruby-dev build-essential
-          sudo gem install fpm
-
-          # Create config file for fpm (DEB build creates it in its package dir structure,
-          # but fpm needs the file to exist before packaging)
-          mkdir -p ./tmp-pkg/etc/default
-          cat > ./tmp-pkg/etc/default/rustfs << 'ENVEOF'
-          # RustFS Environment Configuration
-          # See https://rustfs.com/docs/ for more information
-          # RUSTFS_VOLUMES=""
-          # RUSTFS_ROOT_USER=""
-          # RUSTFS_ROOT_PASSWORD=""
-          ENVEOF
-
-          fpm -s dir -t rpm \
-            --name rustfs \
-            --version "$VERSION" \
-            --architecture "$RPM_ARCH" \
-            --depends "glibc >= 2.31" \
-            --maintainer "RustFS Team <support@rustfs.com>" \
-            --description "High-performance distributed object storage" \
-            --url "https://rustfs.com" \
-            --license "Apache-2.0" \
-            --after-install <(cat <<'POSTINST'
-          #!/bin/bash
-          set -e
-          if ! getent passwd rustfs > /dev/null 2>&1; then
-              useradd -r -s /bin/false -d /opt/rustfs rustfs
-          fi
-          mkdir -p /opt/rustfs /data/rustfs /var/log/rustfs
-          chown rustfs:rustfs /opt/rustfs /data/rustfs /var/log/rustfs
-          if [ -d /run/systemd/system ]; then
-              systemctl daemon-reload
-          fi
-          POSTINST
-            ) \
-            --before-remove <(cat <<'PRERM'
-          #!/bin/bash
-          set -e
-          if [ -d /run/systemd/system ] && systemctl is-active --quiet rustfs; then
-              systemctl stop rustfs
-          fi
-          PRERM
-            ) \
-            --after-remove <(cat <<'POSTRM'
-          #!/bin/bash
-          set -e
-          if [ -d /run/systemd/system ]; then
-              systemctl daemon-reload
-          fi
-          POSTRM
-            ) \
-            --config-files /etc/default/rustfs \
-            ./bin/rustfs=/usr/bin/rustfs \
-            ./tmp-pkg/etc/default/rustfs=/etc/default/rustfs \
-            deploy/build/rustfs.service=/lib/systemd/system/rustfs.service \
-            LICENSE=/usr/share/doc/rustfs/LICENSE \
-            README.md=/usr/share/doc/rustfs/README.md
-
-          RPM_FILE=$(ls -1 rustfs-*.rpm 2>/dev/null | head -1)
-          if [[ -z "$RPM_FILE" ]]; then
-            echo "❌ RPM build failed"
-            exit 1
-          fi
-
-          ls -lh "$RPM_FILE"
-          echo "rpm_file=$RPM_FILE" >> "$GITHUB_OUTPUT"
-          echo "✅ RPM built: $RPM_FILE"
-
-      - name: Upload packages to artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: packages-${{ matrix.arch }}
-          path: |
-            *.deb
-            *.rpm
-          retention-days: 30
-
-      - name: Upload packages to Cloudflare R2
-        if: env.R2_ACCESS_KEY_ID != ''
-        env:
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          AWS_EC2_METADATA_DISABLED: true
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [[ -z "$R2_ACCESS_KEY_ID" || -z "$R2_SECRET_ACCESS_KEY" || -z "$R2_ENDPOINT" || -z "$R2_BUCKET" ]]; then
-            echo "⚠️ R2 credentials missing, skipping upload"
-            exit 0
-          fi
-
-          if ! command -v aws >/dev/null 2>&1; then
-            sudo apt-get update && sudo apt-get install -y awscli
-          fi
-
-          export AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID"
-          export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
-          export AWS_DEFAULT_REGION="auto"
-
-          BUILD_TYPE="${{ needs.resolve.outputs.build_type }}"
-          if [[ "$BUILD_TYPE" == "development" ]]; then
-            R2_PREFIX="artifacts/rustfs/packages/dev"
-          else
-            R2_PREFIX="artifacts/rustfs/packages/release"
-          fi
-          R2_PATH="s3://${R2_BUCKET}/${R2_PREFIX}/"
-
-          echo "📤 Uploading to $R2_PATH"
-
-          DEB_FILE="${{ steps.deb.outputs.deb_file }}"
-          RPM_FILE="${{ steps.rpm.outputs.rpm_file }}"
-
-          for f in "$DEB_FILE" "$RPM_FILE"; do
-            if [[ -n "$f" && -f "$f" ]]; then
-              echo "Uploading: $f"
-              aws s3 cp "$f" "$R2_PATH" --endpoint-url "$R2_ENDPOINT" --only-show-errors
-            fi
-          done
-
-          echo "✅ Upload complete"
-
-          # Also upload as latest for release/prerelease
-          if [[ "$BUILD_TYPE" == "release" || "$BUILD_TYPE" == "prerelease" ]]; then
-            LATEST_PATH="s3://${R2_BUCKET}/artifacts/rustfs/packages/latest/"
-            for f in "$DEB_FILE" "$RPM_FILE"; do
-              if [[ -n "$f" && -f "$f" ]]; then
-                echo "Uploading latest: $(basename "$f")"
-                aws s3 cp "$f" "$LATEST_PATH" --endpoint-url "$R2_ENDPOINT" --only-show-errors
-              fi
-            done
-            echo "✅ Latest packages updated"
-          fi
-
-  # Summary
-  summary:
-    name: Summary
-    needs: [ resolve, package ]
-    if: always()
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Print summary
-        shell: bash
-        run: |
-          echo "## 📦 Package Summary" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Item | Value |" >> "$GITHUB_STEP_SUMMARY"
-          echo "|------|-------|" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Version | \`${{ needs.resolve.outputs.version }}\` |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Build Type | ${{ needs.resolve.outputs.build_type }} |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Build Run | #${{ needs.resolve.outputs.build_run_id }} |" >> "$GITHUB_STEP_SUMMARY"
-          echo "| Package Status | ${{ needs.package.result }} |" >> "$GITHUB_STEP_SUMMARY"
@@ -17,18 +17,11 @@
 # Two entry points, honestly scoped:
 #   * schedule (nightly, on main): post-merge detection — catches a regression
 #     within 24h of landing, not before merge.
-#   * workflow_dispatch: an explicitly selected trusted ref.
-# The dispatch input can run the gate with --allow-regression so a deliberate
-# correctness cost (e.g. the #4221 fsync durability fix) is recorded, not
-# blocked (rustfs/backlog#935 correction 1).
+#   * pull_request labeled `perf-ab`: opt-in pre-merge gate for a specific PR.
+# The `perf-deliberate-tradeoff` label runs the gate with --allow-regression so
+# a deliberate correctness cost (e.g. the #4221 fsync durability fix) is
+# recorded but does not block (rustfs/backlog#935 correction 1).

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: Performance A/B

 on:
@@ -46,6 +39,8 @@ on:
        required: false
        default: false
        type: boolean
+  pull_request:
+    types: [labeled, synchronize, reopened]
  push:
    # Every main commit pre-builds and caches its release binary (perf-3) so the
    # nightly A/B restores a ready baseline instead of paying the double build.
@@ -53,6 +48,14 @@ on:

 permissions:
  contents: read
+  pull-requests: write
+
+# Per-PR: a new push cancels the previous (up to 90-minute) A/B run instead of
+# stacking them. Nightly schedule and manual dispatch get a unique group and
+# always run to completion.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

 env:
  CARGO_TERM_COLOR: always
@@ -60,8 +63,8 @@ env:

 jobs:
  # perf-3: on every push to main, build the release binary once and cache it
-  # keyed by commit SHA (rustfs-baseline-<sha>). The warp-ab measurements
-  # restore this instead of paying the ~32min-per-side source
+  # keyed by commit SHA (rustfs-baseline-<sha>). The nightly A/B (and, later, the
+  # perf-7 PR gate) restore this instead of paying the ~32min-per-side source
  # build. That double build is what pushed the expanded 24-cell nightly past its
  # ceiling — 2026-07-11..07-14 all cancelled on the 120min timeout. Incremental
  # builds off the shared cargo cache keep each push cheap, and building on the
@@ -89,8 +92,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false

      - name: Setup Rust environment
        uses: ./.github/actions/setup
@@ -98,6 +99,7 @@ jobs:
          rust-version: stable
          cache-shared-key: warp-ab-${{ hashFiles('**/Cargo.lock') }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build release rustfs
        run: cargo build --release --bin rustfs
@@ -116,11 +118,17 @@ jobs:

  warp-ab:
    name: Warp A/B budget gate
-    # Always run on schedule / manual dispatch. Never on push — that event only
-    # feeds build-baseline-cache above.
+    # Always run on schedule / manual dispatch. Opt-in on PRs: only when the
+    # `perf-ab` label is present, and for `labeled` events only when the label
+    # being added is `perf-ab` itself (adding an unrelated label to an opted-in
+    # PR must not re-run the gate). Never on push — that event only feeds
+    # build-baseline-cache above.
    if: >-
      github.event_name == 'schedule' ||
-      github.event_name == 'workflow_dispatch'
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' &&
+       contains(github.event.pull_request.labels.*.name, 'perf-ab') &&
+       (github.event.action != 'labeled' || github.event.label.name == 'perf-ab'))
    runs-on: sm-standard-2
    # With perf-3's cached baseline binary the common (cache-hit) nightly is
    # measurement-only and finishes well under 50min. This ceiling stays
@@ -134,7 +142,6 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
-          persist-credentials: false
          fetch-depth: 0 # baseline is built from origin/main

      - name: Setup Rust environment
@@ -143,6 +150,7 @@ jobs:
          rust-version: stable
          cache-shared-key: warp-ab-${{ hashFiles('**/Cargo.lock') }}
          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install warp
        run: |
@@ -154,11 +162,13 @@ jobs:

      - name: Decide exemption
        id: exempt
-        env:
-          INPUT_ALLOW_REGRESSION: ${{ github.event.inputs.allow_regression }}
        run: |
          allow="false"
-          if [[ "$INPUT_ALLOW_REGRESSION" == "true" ]]; then
+          if [[ "${{ github.event_name }}" == "pull_request" ]] \
+            && ${{ contains(github.event.pull_request.labels.*.name, 'perf-deliberate-tradeoff') }}; then
+            allow="true"
+          fi
+          if [[ "${{ github.event.inputs.allow_regression }}" == "true" ]]; then
            allow="true"
          fi
          echo "allow_regression=$allow" >> "$GITHUB_OUTPUT"
@@ -205,34 +215,8 @@ jobs:
          cp target/release/rustfs baseline-bin/rustfs
          echo "built=true" >> "$GITHUB_OUTPUT"

-      - name: Build baseline on cache miss (different candidate)
-        id: baseline_build
-        if: >-
-          steps.baseline_cache.outputs.cache-hit != 'true' &&
-          steps.commits.outputs.baseline_sha != steps.commits.outputs.candidate_sha
-        run: |
-          set -euo pipefail
-          baseline_root="$RUNNER_TEMP/rustfs-baseline-${{ github.run_id }}"
-          baseline_target="$RUNNER_TEMP/rustfs-baseline-target-${{ github.run_id }}"
-          git worktree add --detach "$baseline_root" "${{ steps.commits.outputs.baseline_sha }}"
-          cargo build --release --manifest-path "$baseline_root/Cargo.toml" --bin rustfs --target-dir "$baseline_target"
-          mkdir -p baseline-bin
-          cp "$baseline_target/release/rustfs" baseline-bin/rustfs
-          git worktree remove --force "$baseline_root"
-          echo "built=true" >> "$GITHUB_OUTPUT"
-
-      - name: Build candidate binary
-        id: candidate_build
-        if: steps.commits.outputs.baseline_sha != steps.commits.outputs.candidate_sha
-        run: |
-          set -euo pipefail
-          cargo build --release --bin rustfs
-          mkdir -p candidate-bin
-          cp target/release/rustfs candidate-bin/rustfs
-          echo "built=true" >> "$GITHUB_OUTPUT"
-
      - name: Save self-healed baseline to cache
-        if: steps.selfheal.outputs.built == 'true' || steps.baseline_build.outputs.built == 'true'
+        if: steps.selfheal.outputs.built == 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: baseline-bin/rustfs
@@ -240,66 +224,62 @@ jobs:

      - name: Run warp A/B and gate
        id: ab
-        env:
-          INPUT_DURATION: ${{ github.event.inputs.duration }}
        run: |
          set -euo pipefail
-          # The formal runner executes A1 baseline -> B1 candidate -> B2 candidate
-          # -> A2 baseline for each workload and drive-sync cell. It requires three
-          # rounds per leg to emit tail latency and error-rate evidence.
+          # Budget note: with perf-3's cached baseline the nightly does no source
+          # build on a cache hit, so the wall-clock is dominated by the short warp
+          # matrix — duration/rounds/cooldown are kept small to fit all 24 cells
+          # (6 workloads x 2 phases x 2 drive-sync) rather than dropping cells.
          # --health-timeout 180 outlasts the server's own 120s startup-readiness
          # budget, which the rig's previous 60s health poll undershot (the first
          # two nightly failures). perf-6 recalibrates these once the noise study
          # lands.
-          duration="${INPUT_DURATION:-12s}"
+          duration="${{ github.event.inputs.duration || '12s' }}"
          baseline_sha="${{ steps.commits.outputs.baseline_sha }}"
          candidate_sha="${{ steps.commits.outputs.candidate_sha }}"
          baseline_hit="${{ steps.baseline_cache.outputs.cache-hit }}"
          selfheal_built="${{ steps.selfheal.outputs.built }}"
-          baseline_built="${{ steps.baseline_build.outputs.built }}"
-          candidate_built="${{ steps.candidate_build.outputs.built }}"

-          args=(--duration "$duration" --rounds 3 --cooldown 5 --health-timeout 180 --baseline-revision "$baseline_sha" --candidate-revision "$candidate_sha")
+          args=(--duration "$duration" --rounds 2 --cooldown 5 --health-timeout 180)

-          if [[ "$baseline_hit" == "true" || "$selfheal_built" == "true" || "$baseline_built" == "true" ]]; then
+          if [[ "$baseline_hit" == "true" || "$selfheal_built" == "true" ]]; then
            chmod +x baseline-bin/rustfs
            base_bin="$PWD/baseline-bin/rustfs"
            args+=(--baseline-bin "$base_bin")
            if [[ "$baseline_hit" == "true" ]]; then
              base_src="actions-cache (rustfs-baseline-$baseline_sha)"
-            elif [[ "$selfheal_built" == "true" ]]; then
-              base_src="source build (cache self-heal, saved as rustfs-baseline-$baseline_sha)"
            else
-              base_src="isolated origin/main source build (saved as rustfs-baseline-$baseline_sha)"
+              base_src="source build (cache self-heal, saved as rustfs-baseline-$baseline_sha)"
            fi
            if [[ "$candidate_sha" == "$baseline_sha" ]]; then
              # Nightly on main: the candidate is the same commit as the baseline,
              # so reuse the one binary for both phases and skip all builds.
-              args+=(--candidate-bin "$base_bin")
+              args+=(--candidate-bin "$base_bin" --skip-build)
              cand_src="same binary as baseline (same commit)"
-            elif [[ "$candidate_built" == "true" ]]; then
-              chmod +x candidate-bin/rustfs
-              args+=(--candidate-bin "$PWD/candidate-bin/rustfs")
-              cand_src="source build of the checked-out ref"
            else
-              echo "::error::candidate binary was not built" >&2
-              exit 2
+              cand_src="source build of the checked-out ref"
            fi
          else
-            echo "::error::baseline binary was not restored or built" >&2
-            exit 2
+            # Cache miss with candidate != baseline (opt-in PR gate only): fall
+            # back to the source double-build. With the post-#4806 LTO profile
+            # this will overrun the job budget and alert; rerun once the push
+            # cache build for origin/main has completed, or wait for perf-7's
+            # merge-base caching.
+            args+=(--baseline-ref origin/main)
+            base_src="source build of origin/main (cache miss)"
+            cand_src="source build of the checked-out ref"
          fi

-          echo "baseline binary: $base_src"
-          echo "candidate binary: $cand_src"
+          args+=(--provenance-note "baseline commit: $baseline_sha - $base_src")
+          args+=(--provenance-note "candidate commit: $candidate_sha - $cand_src")

          if [[ "${{ steps.exempt.outputs.allow_regression }}" == "true" ]]; then
-            args+=(--allow-regression --exemption-reason "workflow dispatch override")
+            args+=(--allow-regression --exemption-reason "labeled perf-deliberate-tradeoff / dispatch override")
          fi
          # Do not let a gate FAIL abort the job here; capture status and surface
-          # it after the step summary is written.
+          # it after the PR comment is posted.
          set +e
-          bash scripts/run_hotpath_warp_abba.sh "${args[@]}"
+          bash scripts/run_hotpath_warp_ab.sh "${args[@]}"
          echo "status=$?" >> "$GITHUB_OUTPUT"
          set -e
          # Locate the newest run dir + gate.md for the summary/comment/artifact
@@ -307,10 +287,10 @@ jobs:
          # holds server-logs/ for diagnosis.
          # Run dirs are UTC-timestamp names (no special chars); ls is safe here.
          # shellcheck disable=SC2012
-          run_dir="$(ls -td target/hotpath-abba/*/ 2>/dev/null | head -n1 || true)"
+          run_dir="$(ls -td target/hotpath-ab/*/ 2>/dev/null | head -n1 || true)"
          echo "run_dir=${run_dir%/}" >> "$GITHUB_OUTPUT"
          # shellcheck disable=SC2012
-          gate_md="$(ls -t target/hotpath-abba/*/candidate_gate.md 2>/dev/null | head -n1 || true)"
+          gate_md="$(ls -t target/hotpath-ab/*/gate.md 2>/dev/null | head -n1 || true)"
          echo "gate_md=$gate_md" >> "$GITHUB_OUTPUT"

      - name: Upload A/B results
@@ -318,10 +298,10 @@ jobs:
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: hotpath-warp-ab-${{ github.run_number }}
-          # Includes per-cell median_summary.csv / baseline_compare.csv, both gates,
+          # Includes per-cell median_summary.csv / baseline_compare.csv, gate.md,
          # and server-logs/ (rustfs.log + startup env per phase) so a failed run
          # is diagnosable. Short retention: this is churny nightly debug data.
-          path: target/hotpath-abba/
+          path: target/hotpath-ab/
          if-no-files-found: warn
          retention-days: 14

@@ -362,6 +342,13 @@ jobs:
            fi
          } >> "$GITHUB_STEP_SUMMARY"

+      - name: Comment gate result on PR
+        if: always() && github.event_name == 'pull_request' && steps.ab.outputs.gate_md != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr comment "${{ github.event.pull_request.number }}" --body-file "${{ steps.ab.outputs.gate_md }}"
+
      # Scheduled failure alerting is handled by the alert-on-failure job below
      # (perf-2 consuming ci-8's schedule-failure-issue composite action).

@@ -370,7 +357,7 @@ jobs:
        run: |
          status="${{ steps.ab.outputs.status }}"
          if [[ "$status" != "0" ]]; then
-            echo "::error::warp A/B budget gate failed (exit $status). See the step summary / gate.md artifact." >&2
+            echo "::error::warp A/B budget gate failed (exit $status). See the step summary / PR comment / gate.md artifact." >&2
            exit "$status"
          fi
          echo "warp A/B budget gate passed."
@@ -380,12 +367,14 @@ jobs:
    needs: [warp-ab]
    # `always()` is required: without it this job is skipped when a needed
    # job fails. Alerts only for scheduled (nightly) runs (backlog#1149
-    # ci-8); manual dispatch failures are already watched by a human.
+    # ci-8); PR and manual dispatch failures are already watched by a human.
    # `cancelled` is included alongside `failure` on purpose: a job that hits
    # timeout-minutes ends as `cancelled`, and the 2026-07-11..07-14 nightly
    # timeouts went silent precisely because the guard was failure-only. The
    # composite action already reports cancelled/timed-out jobs in the issue
-    # body.
+    # body. (Scheduled runs get a unique concurrency group with
+    # cancel-in-progress off, so a cancellation here means a timeout/manual
+    # abort, never a superseding run.)
    if: >-
      always() && github.event_name == 'schedule' &&
      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
@@ -396,8 +385,6 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -1,81 +0,0 @@
-# Copyright 2026 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Asserts that the self-hosted runners are still ephemeral — one job per pod.
-#
-# This repository is public and its pull_request jobs run on those runners,
-# executing the PR's own build.rs, proc-macros and tests. The only thing keeping
-# that code from reaching a later job is that each ARC pod handles exactly one
-# job and is then destroyed. That guarantee lives in the ARC scale-set
-# configuration, outside this repository, where it can be changed without any PR
-# — so it is asserted here from the outside, against real run data, instead of
-# being assumed.
-#
-# Monthly rather than per-PR: the property changes only when someone
-# reconfigures the scale set, and the check costs a few dozen API calls.
-# See docs/ci/runners.md and rustfs/backlog#1602.
-
-name: Runner Hygiene
-
-on:
-  schedule:
-    - cron: "0 6 1 * *" # Monthly, 1st at 06:00 UTC (after the daily audit cron)
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: runner-hygiene
-  cancel-in-progress: false
-
-jobs:
-  check-ephemerality:
-    name: Check runner ephemerality
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      # Exit 2 (inconclusive / broken) is deliberately not a pass: a window
-      # where every sm-* job was still queued would otherwise look identical to
-      # a clean bill of health.
-      - name: Assert one job per self-hosted runner
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./scripts/ci/check_runner_ephemerality.sh 40
-
-  alert-on-failure:
-    name: Alert on scheduled failure
-    needs: [check-ephemerality]
-    # Same ci-8 mechanism as coverage.yml, audit.yml and the nightly lanes:
-    # scheduled runs file a tracking issue, manual dispatch stays quiet so
-    # debugging never produces a spurious alert.
-    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-      - name: Open or update failure-tracking issue
-        uses: ./.github/actions/schedule-failure-issue
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -24,13 +24,6 @@
 # The run itself is expected to end red (the forced failure); only the
 # alert-on-failure job result matters.

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: Schedule Failure Alert Drill

 on:
@@ -63,8 +56,6 @@ jobs:
      issues: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
      - name: Open or update failure-tracking issue
        uses: ./.github/actions/schedule-failure-issue
        with:
@@ -12,13 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: "Mark stale issues"
 on:
  schedule:
@@ -27,7 +20,6 @@ on:
 jobs:
  stale:
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    steps:
      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
        with:
@@ -15,7 +15,6 @@ concurrency:
 jobs:
  update:
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
      - uses: overtrue/repo-visuals-action@72f34d24769ff5d341956da2f23952594ef2f1e2 # v1.3.0
        with:
@@ -1,90 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Windows Filesystem Tests
-
-on:
-  push:
-    branches: [ main ]
-    paths:
-      - "crates/ecstore/src/disk/**"
-      - "crates/ecstore/src/store/init_format.rs"
-      - "crates/ecstore/Cargo.toml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/actions/setup/**"
-      - ".github/workflows/windows-filesystem.yml"
-  pull_request:
-    branches: [ main ]
-    paths:
-      - "crates/ecstore/src/disk/**"
-      - "crates/ecstore/src/store/init_format.rs"
-      - "crates/ecstore/Cargo.toml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/actions/setup/**"
-      - ".github/workflows/windows-filesystem.yml"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-env:
-  CARGO_TERM_COLOR: always
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  RUST_BACKTRACE: 1
-
-jobs:
-  rename-safety:
-    name: Rename Safety
-    runs-on: windows-latest
-    timeout-minutes: 60
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: stable
-          cache-shared-key: build-x86_64-pc-windows-msvc
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
-          install-test-tools: 'false'
-
-      - name: Check production Windows dependencies
-        shell: pwsh
-        run: cargo check -p rustfs-ecstore --lib
-
-      - name: Test guarded rename publication
-        shell: pwsh
-        run: cargo test -p rustfs-ecstore --lib rename_all_ -- --nocapture
-
-      - name: Test Windows handle guards
-        shell: pwsh
-        run: cargo test -p rustfs-ecstore --lib windows_ -- --nocapture
-
-      - name: Test startup temporary-directory cleanup
-        shell: pwsh
-        run: cargo test -p rustfs-ecstore --lib cleanup_tmp_on_startup_ -- --nocapture
-
-      - name: Test fresh format publication
-        shell: pwsh
-        run: cargo test -p rustfs-ecstore --lib fresh_format_load_initializes_all_disks -- --nocapture
@@ -83,7 +83,3 @@ worktrees/*

 # Local AI-agent review artifacts (omo evidence dumps)
 .omo/
-
-# insta scratch files; the accepted .snap files ARE the assertions and are committed
-*.snap.new
-*.pending-snap
@@ -1,116 +0,0 @@
---
-name: issue-triage
-description: Triage a GitHub issue — determine if it is already fixed, needs implementation, or should be closed. Searches related commits and PRs, verifies implementation status, and posts a triage comment or closes the issue. Use when the user provides an issue URL and asks whether it can be closed or needs work.
---
-
-# Issue Triage
-
-Use this skill when the user provides a GitHub issue URL and asks "can this be closed?", "is this already implemented?", "check completion status", or similar triage questions.
-
-## Workflow
-
-### 1. Fetch issue context
-
-```bash
-gh issue view <N> --repo <owner/repo> --json title,body,state,comments,labels,updatedAt
-```
-
-Read the issue body to understand what was requested. Extract:
- The specific feature/fix/behavior described.
- Any linked PRs or commits mentioned in the body or comments.
- Any checklist items or sub-issues.
-
-### 2. Search for related work
-
-Search git history for commits referencing the issue:
-```bash
-git log --oneline --all --grep="<N>" | head -30
-```
-
-Search for related PRs:
-```bash
-gh pr list --search "fixes #<N> OR closes #<N> OR #<N>" --state all --json number,title,state,mergedAt
-```
-
-If the issue mentions specific PRs, check their status:
-```bash
-gh pr view <PR_N> --json state,mergedAt,title
-```
-
-### 3. Verify implementation
-
-For each linked or related PR that is merged, verify the fix is actually present on the current main branch:
-```bash
-git log --oneline main | grep -i "<keyword>"
-# or
-git log --oneline main --grep="<PR_N>"
-```
-
-If the issue describes a specific defect, check the relevant code to confirm the fix is in place:
-```bash
-grep -n "<pattern>" crates/<relevant>/src/<file>.rs
-```
-
-For issues with checklists, verify each item individually. If sub-items are tracked as separate issues, check those too:
-```bash
-gh issue view <SUB_N> --repo <owner/repo> --json state
-```
-
-### 4. Determine verdict
-
- **All items fixed and merged**: Close with a summary comment listing what was fixed and which PRs.
- **Some items fixed, some remaining**: Comment with status of each item. Do not close.
- **Not yet implemented**: Comment with a summary of what remains. Do not close.
- **Superseded or no longer relevant**: Close with explanation.
-
-### 5. Take action
-
-Close with comment:
-```bash
-gh issue close <N> --repo <owner/repo> --comment "<body>"
-```
-
-Comment without closing:
-```bash
-gh issue comment <N> --repo <owner/repo> --body-file /tmp/triage.md
-```
-
-Update issue labels if needed:
-```bash
-gh issue edit <N> --repo <owner/repo> --add-label "completed" --remove-label "needs-triage"
-```
-
-Always use `--body-file` for multiline content, never inline `--body`.
-
-### 6. Handle multi-issue batches
-
-When the user asks to check multiple issues (e.g., "check all issues by user X" or "scan backlog for closable issues"):
-1. List the issues: `gh issue list --repo <repo> --author <user> --state open --json number,title,updatedAt`
-2. For each issue, run steps 1-5 above.
-3. Report a summary table of all triaged issues with verdicts.
-
-## Output format
-
-### Issue Triage: #<N> — <title>
-
-**State**: OPEN / CLOSED
-**Linked PRs**: <list with merge status>
-
-#### Assessment
-<what was requested vs what is implemented>
-
-#### Verdict
- Close — all items resolved by <PR list>
- Keep open — <remaining items>
- Not started — <what needs to be done>
-
-#### Action taken
- Closed with comment / Commented / No action
-
-## Notes
-
- The user may ask in Chinese ("是否可以关闭", "检查完成情况"); respond in the same language.
- When closing, always include a summary of what was fixed and which PRs resolved it — this creates a useful audit trail.
- For issues in `rustfs/backlog`, use `--repo rustfs/backlog`.
- For issues in `rustfs/rustfs`, use `--repo rustfs/rustfs`.
- If the issue has sub-issues (GitHub sub-issues API), check each one's state before declaring the parent complete.
@@ -1,147 +0,0 @@
---
-name: pr-review
-description: Review a GitHub PR end-to-end from a URL or number — fetch metadata, inspect the diff, run multi-role adversarial review, check CI status, and post the review comment. Use when the user provides a PR link and asks to review it.
---
-
-# PR Review
-
-Use this skill when the user provides a GitHub PR URL or number and asks to review it. This covers the full review lifecycle: data gathering, code review, CI verification, and posting the result.
-
-## Prerequisites
-
- Read `AGENTS.md` for the repository's adversarial validation policy and change-style rules.
- The `adversarial-validation` skill handles the review role playbooks; this skill orchestrates the workflow around it.
-
-## Workflow
-
-### 1. Gather PR context
-
-```bash
-gh pr view <N> --json title,author,state,body,additions,deletions,changedFiles,commits,baseRefName,headRefName
-gh pr diff <N> --name-only
-```
-
-Read the PR body and linked issues to understand the change's purpose. If the PR references an issue, fetch that too:
-```bash
-gh issue view <ISSUE> --json title,body,state
-```
-
-### 2. Fetch the diff and classify the change
-
-```bash
-git fetch origin pull/<N>/head:pr-<N>
-git diff main...pr-<N> --stat
-```
-
-Classify the change by risk tier (per AGENTS.md):
- **Exempt**: docs/comments/instruction-only, formatting, typos.
- **Mechanical**: renames, file moves, test-only or tooling changes.
- **Standard** (default): any behavior change.
- **High risk**: locking, erasure coding, quorum/heal, replication, multipart, RPC, lifecycle/tiering, metadata formats, persistence/fsync, IAM/KMS/auth, on-disk/on-wire formats, S3 API-visible behavior.
-
-### 3. Cluster changed files and delegate review
-
-Group the changed files into logical clusters (by crate or functional area). For each cluster, spawn a subagent with a focused review prompt that includes:
- The cluster's changed files and their diffs.
- The applicable adversarial role probes (from the `adversarial-validation` skill).
- The repository's AGENTS.md rules relevant to that domain.
-
-For standard-tier changes: correctness adversary + simplicity adversary + test-coverage skeptic, plus every role whose domain the diff touches.
-For high-risk changes: run all seven roles.
-
-Each subagent must produce findings (concrete failure scenario with file:line) or a null report ("attacked X, Y, Z — no break found").
-
-### 4. Check CI status
-
-```bash
-gh pr checks <N>
-```
-
-If any checks fail, investigate:
-```bash
-gh run view --log-failed --job=<JOB_ID>
-```
-
-Determine whether failures are pre-existing (on main), flaky, or caused by the PR.
-
-### 5. Synthesize findings
-
-Combine all subagent findings into a structured review:
- **Summary**: one-paragraph overview of the change and overall assessment.
- **Findings**: each finding with severity (critical/major/minor/nit), file:line, concrete failure scenario, and suggested fix.
- **CI status**: pass/fail with notes on any failures.
- **Verdict**: APPROVE, REQUEST_CHANGES, or COMMENT.
-
-### 6. Post the review
-
-Write the review body to a temp file and post via CLI:
-```bash
-# Request changes
-gh pr review <N> --request-changes --body-file /tmp/pr_review.md
-
-# Approve
-gh pr review <N> --approve --body-file /tmp/pr_review.md
-
-# Comment only (no verdict)
-gh pr review <N> --comment --body-file /tmp/pr_review.md
-```
-
-For inline comments on specific lines, use the GitHub API:
-```bash
-cat > /tmp/pr_review.json <<'EOF'
-{
-  "body": "review body",
-  "event": "REQUEST_CHANGES",
-  "comments": [
-    {
-      "path": "crates/foo/src/bar.rs",
-      "line": 42,
-      "body": "finding description"
-    }
-  ]
-}
-EOF
-gh api --method POST /repos/{owner}/{repo}/pulls/<N>/reviews --input /tmp/pr_review.json
-```
-
-Always use `--body-file` or `--input`, never inline multiline `--body`.
-
-### 7. Handle follow-up
-
-If the review requests changes:
- Monitor for new commits: `gh pr view <N> --json commits`
- Re-review changed files only: `git diff pr-<N>..origin/pull/<N>/head`
- Update the review when findings are addressed.
-
-If CI was failing due to pre-existing main breakage:
- Comment on the PR noting the failure is pre-existing.
- Suggest updating the branch: `gh pr update-branch <N>`
-
-## Output format
-
-### PR Review: #<N> — <title>
-
-**Author**: <author>
-**Risk tier**: exempt | mechanical | standard | high-risk
-**Changed files**: <count> across <cluster count> clusters
-
-#### Summary
-<one-paragraph overview>
-
-#### Findings
-| Severity | Location | Finding |
-|----------|----------|---------|
-| critical | file:line | concrete failure scenario |
-
-#### CI Status
- All checks pass / Failing: <details>
-
-#### Verdict
-APPROVE / REQUEST_CHANGES / COMMENT
-
-## Notes
-
- The user may ask for review in Chinese; respond in the same language but keep the review body in English per AGENTS.md rules.
- When the user asks for "多角色对抗 review", run the full adversarial validation protocol — this skill's step 3 covers that.
- If the PR is from a fork, check `maintainerCanModify` before attempting to push fixes.
- For very large PRs (>50 files), cluster aggressively and delegate in parallel to keep review time reasonable.
@@ -21,22 +21,6 @@ If repo-level instructions conflict, follow the nearest file and keep behavior a
 - Avoid redundant file reads, repeated commands, and unnecessary exploratory work once enough context is available.
 - A good result is a minimal diff with clear assumptions, no over-engineering, and independent verification that survives Adversarial Validation (below).

-## Worktree and Disk Hygiene
-
- Unless the requester explicitly says otherwise, treat every new implementation task as isolated work: fetch the latest `origin/main`, confirm the requested change is not already present there, and create a dedicated feature branch and worktree from that exact upstream commit before editing. Do not implement new work directly in the primary checkout or reuse a worktree from another task.
- Check available disk space before creating the worktree or starting dependency downloads, builds, tests, coverage, or other artifact-heavy commands. For long-running or artifact-heavy work, re-check disk usage at natural phase boundaries and before broad validation; if remaining space may not safely accommodate the next command, stop and reclaim task-owned artifacts before continuing.
- Keep cleanup scoped and safe: remove generated build/test/coverage artifacts and temporary files created by the task when they are no longer needed, and never delete another task's worktree or uncommitted files. Prefer shared dependency caches where supported instead of duplicating large artifacts across worktrees.
- At handoff, report the disk-space checks, cleanup performed, and any retained worktree or artifacts with the reason they are still needed.
-
-## PR Lifecycle Monitoring
-
- Creating or updating a PR is not the terminal state. Unless the requester explicitly limits the task to PR creation, monitor the PR through its terminal state: merged, closed, or explicitly handed off because progress requires user or maintainer action.
- While the task is active, monitor CI/check runs, review decisions and unresolved threads, mergeability and conflicts, and unexpected head/base changes. Prefer event-driven or bounded waits provided by the current environment over frequent polling; report only state changes, actionable failures, or meaningful prolonged delays.
- Investigate every failing check and review comment before changing code. Fix failures attributable to the task, run the verification required for the new diff, push the update, respond to or resolve the corresponding review threads, and resume monitoring. Do not weaken checks, dismiss valid feedback, or retry flaky failures merely to obtain a green result.
- Treat opening, green CI, approval, and mergeability as intermediate states. Never merge without the required reviewer approval or explicit authority. If progress depends on credentials, infrastructure, a maintainer decision, or another external action, report the exact blocker and the evidence already collected.
- If the current execution environment cannot remain active until the next PR event, use a supported automation, monitor, or thread wakeup when available and within scope. Otherwise leave an explicit handoff containing the PR, current state, next event to observe, and pending cleanup; do not imply that background monitoring exists when none is scheduled.
- After observing a merge, verify the commits are preserved on the upstream base, ensure the worktree is clean, remove the dedicated worktree, prune stale worktree metadata, and delete the local task branch when it is no longer in use. For a closed or abandoned PR, preserve any unmerged work unless deletion was explicitly authorized. Do not delete remote branches unless explicitly requested or repository automation owns that cleanup.
-
 ## Autonomy and Approval Boundaries

 - Inquiry tasks (answer, explain, review, diagnose, plan): report findings; do not change files unless a fix is explicitly requested.
@@ -51,25 +35,26 @@ If repo-level instructions conflict, follow the nearest file and keep behavior a

 ## Change Style for Existing Logic

- Start with the smallest direct, local edit. Add production files, types, traits, helpers, wrappers, or abstraction layers only when current behavior requires them. Extraction must remove present duplication, enforce a real boundary, or materially clarify a non-trivial flow; anticipated reuse is not enough.
+- Prefer direct, local code over extracting one-off helpers.
+- Extract a helper only when logic is reused or the extraction materially clarifies a non-trivial flow.
 - Use Rust's default module file layout (`mod foo;` with `foo.rs` or `foo/mod.rs`/`foo/*.rs`).
  Avoid `#[path = "..."]` for module inclusion; move files into the canonical module tree instead.
  If an unavoidable generated-code, FFI, or test-fixture exception remains, keep it local and document why the canonical layout cannot work.
 - Solve only the requested problem; do not add speculative features, configurability, or adjacent improvements.
 - Prefer editing existing code over rewriting files or reshaping unrelated logic.
- Modify only what is required. Remove any in-scope path or representation superseded by the change. If compatibility or rollback requires retention, adapt at the boundary to one canonical core and follow the repository's `RUSTFS_COMPAT_TODO` removal policy; never delete unrelated code merely to improve addition/deletion statistics.
+- Modify only what is required and remove only artifacts introduced by your own changes.
 - Preserve the existing control-flow and logic shape when fixing bugs or addressing review comments, especially in init, distributed coordination, locking, metadata, and concurrency paths.
 - Do not refactor existing code only to make it easier to unit test.
 - Keep fixes narrowly aligned with the requested behavior; avoid semantic-adjacent rewrites while touching sensitive paths.
- Keep code elegant, concise, and direct. Prefer the smallest readable design and existing abstractions over parallel managers, factories, adapters, or wrappers added only to make the design look extensible.
- Comments state non-obvious reasons, assumptions, and invariants in the shortest complete form. Their length follows the invariant's complexity: `SAFETY`, lock ordering, durability, and compatibility contracts may need a short list of conditions. Never narrate the next line, restate a signature, or record change history; move durable design rationale to architecture or operations documentation.
+- Keep code elegant, concise, and direct. Prefer minimal, readable implementations over over-engineering and excessive abstraction. Use comments to clarify non-obvious intent and invariants, not to compensate for unclear code.
+- Do not write comments that narrate what the next line does, restate a signature, or describe the change you just made — that commentary belongs in the PR description, not the code. Required invariant comments — lock ordering, `SAFETY`, unwrap justification, `#[allow(dead_code)]` rationale, `RUSTFS_COMPAT_TODO` — are never narration.
 - Mention unrelated issues when useful, but do not fix them as part of a narrow task.

 ## Reuse Before You Write

 Search for an existing implementation before writing a new one; extend what exists instead of duplicating it:

- **Helpers and utilities** (path/string handling, hashing, retry, env parsing, IO wrappers): check `crates/utils`, `crates/common`, the touched crate, the likely domain-owning crate, and relevant direct workspace dependencies from `Cargo.toml`. Search snake_case signatures with a focused term. Reimplementing an existing workspace helper — or hand-rolling what `std`, `tokio`, or an existing dependency already provides — is a review finding, not a style preference.
+- **Helpers and utilities** (path/string handling, hashing, retry, env parsing, IO wrappers): check `ls crates/utils/src` first — file names map to operations (`retry.rs`, `envs.rs`, `hash.rs`, `path.rs`, `string.rs`, `io.rs`) — plus `crates/common` (shared structures/globals), then `rg -i 'fn \w*<term>' crates/utils/src crates/common/src <touched-crate>/src` for signatures. Helpers are snake_case: a full-text single-word grep over a large crate drowns you and a multi-word phrase returns nothing. Reimplementing an existing workspace helper — or hand-rolling what `std`, `tokio`, or an existing workspace dependency already provides — is a review finding, not a style preference.
 - **Reuse requires matching semantics, not a matching name**: before adopting a helper, check its normalization (`clean` resolves `.`/`..` — never apply it to raw S3 object keys), error type, backoff/deadline behavior, and durability gating against the call site. When semantics differ, a new narrowly-named helper with a comment naming the rejected lookalike is the correct outcome. The inverse also holds: workspace wrappers exist because raw `std`/`tokio` semantics were insufficient (durability gates, retries) — prefer the wrapper over the raw call.
 - **Constants and fixed tokens** (protocol labels, error identifiers, header keys, event names, metric names, command tags): search for existing constants/enums that already represent the same semantic value and reuse them. If a value is truly new, define one local constant near related logic; never scatter the literal across sites. When changing existing behavior, align naming and format with the established constants.
 - **Test scaffolding**: reuse existing test utilities and fixtures (the touched crate's own `test_util` module and `tests/fixtures`, or `crates/test-utils`) instead of writing new setup code — run `rg -l '<fn-under-test>' <crate>/src <crate>/tests` before writing a test. A new test must pin a failure mode no existing test covers. Near-duplicate means same code path AND same poison-value class: this repo's boundary companions (n==max vs max+1, absent vs empty vs nil UUID bytes, MetaObject vs MetaDeleteMarker) are distinct by definition and must all be written.
@@ -78,7 +63,6 @@ Search for an existing implementation before writing a new one; extend what exis

 Net-new code — files, types, branches, comments — is cost to justify, not progress:

- Inspect production-code additions separately. Tests, fixtures, generated code, and documentation do not count as production-code growth. Line counts are signals, not quotas: new production structures must map to a current requirement, and a blocker requires a concrete smaller design that preserves correctness, compatibility, readability, and real boundaries.
 - Validate at the trust boundary — untrusted client input, bytes read from disk, RPC payloads, config (see Serde Safety and Cross-Cutting Domain Invariants) — then trust the type: do not re-check what the type system or a validated upstream layer already guarantees, and cite the establishing check (`file:line`) when the guarantee is not obvious.
 - The exception is load-bearing: a value that crossed a persistence, RPC, or version boundary is never guaranteed by the code on the other side — a peer may be older or buggy, disk bytes may be corrupt — so the Cross-Cutting Domain Invariant patterns apply at every consumer, and re-checks immediately before a destructive action (delete, overwrite, quorum decision) stay. Deleting an existing guard is a behavior change requiring adversarial review, not cleanup.
 - Every new branch needs a nameable trigger: a concrete input, state, or failure that reaches it — for boundary-crossing values, corrupt or stale persisted/peer data is always nameable. If you cannot name one, do not write the branch. If the case is truly unreachable, encode the invariant in the type; where that is impossible, return a typed internal error (fail closed). `debug_assert!` is acceptable only for pure internal arithmetic on values that never crossed a disk/RPC/config boundary — never as the sole guard on decoded or peer-supplied data.
@@ -121,78 +105,33 @@ CI) fails the build if anything is committed under `docs/superpowers/`, even via

 ## Verification Before PR

-Convert changes into independently verifiable outcomes. This section controls
-agent-run local validation; preparing a commit or PR does not by itself require
-the broadest gate. Inspect only the final task-owned diff, classify it by
-behavioral impact rather than line count or path alone, and run the smallest
-set of checks that provides meaningful coverage. Do not let unrelated
-worktree changes or a generic contributor checklist expand the scope.
-Non-exempt changes must also pass Adversarial Validation (next section) before
-the checks below count as completion.
+Convert changes into independently verifiable outcomes. Prefer focused tests for behavior changes and run the relevant checks before declaring completion.
+Non-exempt changes must also pass Adversarial Validation (next section) before the checks below count as completion.

-### Validation floor
+For code changes, run and pass the following before opening a PR:

- Every change that is not documentation-only must finish with
-  `cargo fmt --all --check` passing. An umbrella gate that runs this exact
-  check satisfies the requirement; do not run it twice. Use `cargo fmt --all`
-  only when formatting needs to be fixed. Run the configured formatter or
-  validator for other changed languages when one exists.
- Documentation-only or instruction-only means all task-owned changes are
-  prose or documentation assets and cannot affect runtime, builds, CI,
-  dependencies, generated code, or tests. Run `git diff --check` and any
-  relevant documentation guard, but skip Cargo formatting, compilation,
-  Clippy, tests, `make pre-commit`, and `make pre-pr`.
- Behavior changes require relevant existing or new tests. Prefer the most
-  focused test or affected package. A passing targeted test can also provide
-  sufficient compilation coverage when it builds every changed target and
-  feature involved; do not add a redundant `cargo check` in that case.
- `cargo check` supplements compilation coverage; it never substitutes for a
-  behavioral test. If a relevant test cannot reasonably be added or run, use
-  the narrowest compilation check and report the reason and remaining risk.
+```bash
+make pre-pr
+```

-### Validation tiers
+Before committing code changes, prefer focused verification for the touched
+surface and use the faster local gate when a broad smoke check is needed:

-1. **Documentation/instruction-only:** Apply the exemption above. Run a guard
-   such as `make doc-paths-check` only when it is relevant to the edited text.
-2. **Non-behavioral source change:** For comments, formatting, or another
-   demonstrably non-executable change, run the formatting floor. Compilation,
-   Clippy, and tests may be skipped only when the edit cannot affect
-   compilation or runtime behavior; run targeted doctests if executable
-   documentation examples changed.
-3. **Localized or bounded behavior change:** Run the formatting floor and the
-   narrowest relevant tests. Add package-scoped `cargo check` or Clippy only
-   for changed targets, features, APIs, error handling, async behavior, or
-   control flow not already covered. When several crates are affected but the
-   dependency set is identifiable, validate those packages and known
-   dependents instead of the whole workspace. Use `make pre-commit` only when
-   a repository-wide fast gate adds useful confidence beyond those checks.
-4. **Broad or high-risk change:** Run `make pre-pr` only when targeted coverage
-   cannot bound the impact, including:
-   - dependency, feature, build-script, procedural-macro, code-generation,
-     toolchain, or CI changes that alter compilation or the test matrix;
-   - cross-crate public APIs, shared foundational code, or broad refactors with
-     an unbounded dependent set;
-   - locking, storage durability or formats, erasure coding, replication,
-     RPC/protocol compatibility, IAM/KMS/auth, cryptography, or other
-     security-sensitive behavior;
-   - a targeted check that reveals wider impact, an explicit user request, or
-     a release policy that requires the full gate.
+```bash
+make pre-commit
+```

-Documentation-only and non-behavioral classifications take precedence over
-path-based triggers. A small diff can still be high-risk, while a CI comment,
-manifest comment, or release-note edit does not require full validation.
+For migration batches, do not run the full `make pre-pr` gate before every
+intermediate commit. Use focused tests and `make pre-commit` during
+development, then reserve `make pre-pr` for the final PR-ready branch.

-`make pre-pr` includes `make pre-commit` coverage. Never run both for the same
-unchanged diff, and do not repeat equivalent checks during PR preparation or
-because a local hook already ran them. Rerun only checks whose scope is affected
-by later edits. Full workspace checks do not replace a relevant integration or
-E2E test for changed behavior; run that focused test when required and
-available, or report why it was not run and the remaining risk.
+Before pushing code changes, make sure formatting is clean:

-If `make` is unavailable, run the equivalent checks defined under
-`.config/make/`. At handoff, list the checks actually run, checks intentionally
-skipped, and the reason for the selected tier.
+- Run `cargo fmt --all`.
+- Run `cargo fmt --all --check` and ensure no files are modified unexpectedly.

+If `make` is unavailable, run the equivalent checks defined under `.config/make/`.
+Documentation-only or instruction-only changes are exempt from the verification commands above (including the `.config/make/` equivalents), though any locally installed git pre-commit hooks may still run on commit unless explicitly skipped.
 After build-based verification completes, clean generated build artifacts before wrapping up to avoid unnecessary disk usage.
 Do not open a PR with code changes when the required checks fail.
 Make a failing check pass by fixing the cause, never by weakening the gate:
@@ -218,10 +157,9 @@ not to bless it.

 Pick the tier from the riskiest file touched; when in doubt, pick the higher.

- **Exempt:** docs/comments, formatting, and typos that cannot affect runtime,
-  builds, tests, or agent execution. Skip this section.
- **Mechanical:** pure renames, file moves, test-only or tooling changes, and
-  agent-instruction changes that alter execution —
+- **Exempt:** docs/comments/instruction-only changes, formatting, typos with
+  no runtime surface. Skip this section.
+- **Mechanical:** pure renames, file moves, test-only or tooling changes —
  correctness and simplicity adversaries only.
 - **Standard (the default):** any change that affects behavior.
 - **High risk:** touches locking, erasure coding, quorum/heal, replication,
@@ -243,7 +181,7 @@ encode this repo's shipped bugs.
 - **Correctness adversary** — construct a concrete input/state/interleaving
  that yields wrong output, data loss, or a crash. Probe error paths and edge
  values (empty, nil UUID, zero-length, quorum−1, missing version).
- **Simplicity adversary** — same behavior, less code. Hunt reimplemented helpers, rewrites where an in-place edit suffices, speculative abstractions, defensive branches with no nameable trigger, redundant error wrapping, near-duplicate tests, and narration comments. A one-caller helper is a finding only when it merely forwards or splits a short linear flow without adding domain naming, boundary isolation, an invariant, or useful error context. Report a concrete smaller replacement; fewer lines alone are not evidence.
+- **Simplicity adversary** — same behavior, less code. Hunt the materially smaller or more idiomatic diff (see Change Style for Existing Logic, Reuse Before You Write, and Necessary Code Only): reimplemented workspace helpers, one-caller extractions, rewrites where an in-place edit suffices, defensive branches with no nameable trigger, redundant error wrapping, near-duplicate tests, narration comments. A smaller diff achieving identical behavior is a finding, reported with the concrete replacement; forced reuse of a helper with mismatched semantics is equally a finding.
 - **Security reviewer** — authn/authz bypass, injection, secret leakage,
  untrusted deserialization (see Serde Safety), path traversal, timing leaks.
 - **Concurrency/durability reviewer** — lock ordering, races, cancellation,
@@ -254,11 +192,10 @@ encode this repo's shipped bugs.
  time across IO, sync or CPU-heavy work on async runtime threads, added
  fsync/flush outside the durability gate, hot-path logging noise. A
  measurable regression on a per-request or per-object path is a finding.
- **Test-coverage skeptic** — for each testable behavior claim, name the test
-  or executable check that detects a revert; then name a changed line that
-  could be wrong while all checks stay green. If a focused check is not
-  reasonable, require the reason and residual risk from the validation floor.
-  Test additions have no line-count or growth budget.
+- **Test-coverage skeptic** — for each claimed behavior, name the test that
+  fails if the change is reverted; then name a changed line that could be
+  wrong while all tests stay green — if one exists, coverage is insufficient.
+  A missing test is a finding, not a note.

 Standard tier: correctness adversary + simplicity adversary + test-coverage
 skeptic, plus every role whose domain the diff touches (async or
@@ -284,9 +221,7 @@ High risk: all seven roles.

 - Every applicable role has run; every finding is fixed or rebutted with
  evidence.
- Every testable behavior change has a focused regression check. Exceptions
-  follow the validation floor and state why a check is impractical and what
-  risk remains.
+- Every behavior change has a test that fails without it.
 - The Verification Before PR gates pass — adversarial review supplements
  those gates, never replaces them.
 - High risk only: record a one-line verdict per role in the PR description.
@@ -326,28 +261,6 @@ High risk: all seven roles.
 - Use environment variables or vault tooling for sensitive configuration.
 - For localhost-sensitive tests, verify proxy settings to avoid traffic leakage.

-## Logging
-
-Applies to **every** `tracing` macro you add or edit, including a single line
-added in passing while fixing something else — not only to log-focused changes.
-
- Fields first, message second: `event`, `component`, `subsystem`,
-  `result`/`state`, then key context. The message is a short label, not a
-  sentence with values interpolated into it.
- Reuse the existing `EVENT_*` / `LOG_COMPONENT_*` / `LOG_SUBSYSTEM_*`
-  constants of the module you are editing; match the shape of the log sites
-  already in that file rather than introducing a second style next to them.
- Level policy: `error` for behavior/security-affecting failures, `warn` for
-  degraded or fallback paths, `info` for low-frequency lifecycle, `debug` for
-  targeted diagnostics, `trace` for hot paths. Per-object and per-request
-  success paths are `trace`.
- Never log secrets, tokens, credential payloads, or merged config dumps.
- `scripts/check_logging_guardrails.sh` enforces a subset of this on the files
-  it lists; passing it is a floor, not evidence the log matches the house style.
-
-See `.agents/skills/rustfs-logging-governance/SKILL.md` for the full event
-model, level policy, and guardrail-update checklist.
-
 ## Tools

 ### xl.meta decode tool Quick Use
@@ -373,11 +286,6 @@ cargo run -p rustfs-filemeta --example dump_fileinfo -- "/path/to/file/xl.meta"
  absent, empty, and nil all mean "no value", never `Uuid::nil()`.
 - A remote-tier version of `None`/`""` means the tier bucket is unversioned:
  send **no** `versionId` on tier GET/DELETE.
- Structs persisted in the scanner data-usage cache (`DataUsageCacheInfo`,
-  `DataUsageEntry`) carry a hand-written map-encoded `Serialize`. MessagePack
-  encodes derived structs as arrays, where an appended field makes the whole
-  cache a decode error for older readers — keep new fields `#[serde(default)]`
-  and keep the map encoding rather than reverting to `derive(Serialize)`.

 ## Naming Conventions

@@ -1,6 +1,6 @@
 # ARCHITECTURE.md

-> Last updated: 2026-08-12 · Revision: 3
+> Last updated: 2026-07-02 · Revision: 2
 >
 > This document describes the high-level architecture of RustFS.
 > If you want to familiarize yourself with the code base, you are in the right place!
@@ -119,44 +119,19 @@ module split is tracked under `docs/architecture/`.

 3. **Each type has exactly one definition.** Types shared across crates must be defined
   in one crate and re-exported or imported by others.
-   - ⚠️ VIOLATED: `ReplicationStats` names three unrelated types
-     (`crates/data-usage/src/data_usage.rs`,
-     `crates/obs/src/metrics/collectors/replication.rs`,
-     `crates/ecstore/src/bucket/replication/replication_state.rs`) — a naming
-     collision, not copies; renaming is tracked in rustfs/backlog#1847.
-   - `LastMinuteLatency` has two deliberately different implementations: the
-     per-second bucketed accumulator in `crates/common/src/last_minute.rs` and
-     the in-memory endpoint-health sample tracker in
-     `crates/ecstore/src/bucket/bucket_target_sys.rs` (its doc comment explains
-     why it stays local).
-   - ✅ RESOLVED: `BackpressureConfig` and `DataUsageInfo` each have exactly one
-     definition (`crates/io-core/src/backpressure.rs`,
-     `crates/data-usage/src/data_usage.rs`). The zero-consumer
-     `BackpressureSettings` copy that lingered in io-metrics was removed
-     (rustfs/backlog#1833).
+   - ⚠️ VIOLATED: `ReplicationStats` (4 copies), `LastMinuteLatency` (3 copies),
+     `BackpressureConfig` (3 copies), `DataUsageInfo` (2 copies).

 4. **ecstore does not know about HTTP or S3 protocol details.** It operates on
   storage-level abstractions (objects, buckets, disks, pools).
-   - ⚠️ VIOLATED: 58 files under `crates/ecstore/src` reference `s3s`
-     (`rg -l 's3s' crates/ecstore/src | wc -l`), `crates/ecstore/src/client/`
-     is a ~9.4K-line embedded S3 HTTP client, and `crates/ecstore/Cargo.toml`
-     depends on `s3s`, `http`, `hyper`/`hyper-util`/`hyper-rustls`, and
-     `reqwest`. Target state: the engine's need to act as an S3 client
-     (tiering, replication targets) is served by an extracted client crate,
-     and ecstore holds no wire or DTO types.

 5. **The `rustfs` binary crate is the only place that wires everything together.**
   Individual crates should be testable in isolation.

 6. **Error types use `thiserror` with descriptive names** (e.g., `StorageError`,
   not bare `Error`).
-   - ✅ RESOLVED (strategy): `snafu` is gone from source
-     (`rg -l snafu crates/ rustfs/` is empty) and library code no longer uses
-     `anyhow` (remaining hits are test code and the `e2e_test` crate; `heal`
-     uses `thiserror`).
-   - ⚠️ VIOLATED (naming): 6 crates still export a bare `pub enum Error`:
-     `crypto`, `filemeta`, `heal`, `iam`, `policy`, and `replication`
-     (`src/resync.rs`) — all `thiserror`-derived.
+   - ⚠️ VIOLATED: 6 crates use `pub enum Error`; 2 crates use `snafu`;
+      `heal` use `anyhow` in library code.

 ## Known Structural Issues

@@ -165,25 +140,13 @@ module split is tracked under `docs/architecture/`.

 ### Critical

- **scanner/data-usage duplicate `.usage-cache.bin` serialization types.** The
-  original finding ("common/scanner code duplication, ~3K lines") is resolved:
-  `scanner` imports the shared data-usage types from `rustfs-data-usage` (see
-  the `pub use rustfs_data_usage::…` re-exports at the top of
-  `crates/scanner/src/data_usage_define.rs`). What remains: `scanner` and
-  `data-usage` each hold their own serialization types for the scanner cache
-  file (`DataUsageCacheInfo`/`DataUsageEntryInfo` in
-  `crates/scanner/src/data_usage_define.rs` vs
-  `DataUsageCacheInfo`/`DataUsageEntry` in
-  `crates/data-usage/src/data_usage.rs`); convergence is tracked in
-  rustfs/backlog#1828.
+- **common/scanner code duplication (~3K lines).** `scanner` depends on `common`
+  but maintains its own copies of `DataUsageInfo`, `LastMinuteLatency`, and related
+  types instead of importing them.

- **ecstore is a monolith (265 files, ~288K lines — roughly half is inline
-  `#[cfg(test)]` code).** Measured with
-  `find crates/ecstore/src -name '*.rs' | xargs wc -l`. It contains disk
-  management, bucket management, erasure coding, replication, lifecycle, RPC,
-  and configuration — all in one crate. It should be decomposed along its
-  existing subdirectories; the split plan lives in
-  [docs/architecture/ecstore-module-split-plan.md](docs/architecture/ecstore-module-split-plan.md).
+- **ecstore is a monolith (87K lines, 163 files).** It contains disk management,
+  bucket management, erasure coding, replication, lifecycle, RPC, and configuration
+  — all in one crate. It should be decomposed along its existing subdirectories.

 ### High

@@ -191,26 +154,19 @@ module split is tracked under `docs/architecture/`.
  `common → filemeta/madmin` edges must stay removed so leaf/helper crates do
  not regain upward dependencies.

- **Three-layer backpressure/deadlock policy bridging** across io-core,
-  concurrency, and `rustfs/src/storage`. The config types are no longer
-  duplicated (`BackpressureConfig` and `DeadlockDetectorConfig` are each
-  defined once, in io-core). Storage policies expose and consume explicit
-  projections into the concurrency/io-core policy shapes, and workload
+- **Three-layer BackpressureConfig/DeadlockConfig duplication** across io-core,
+  concurrency, and `rustfs/src/storage`. Storage policies now expose and consume
+  explicit projections into the concurrency/io-core policy shapes, and workload
  admission snapshots are composed through provider registries; later work
  should use those bridges before deleting compatibility wrappers.

 ### Medium

- **Bare `Error` naming.** Error-handling strategy has converged on `thiserror`
-  (no `snafu`, no `anyhow` in library code); the remaining inconsistency is the
-  bare `pub enum Error` naming in the 6 crates listed under Invariant 6.
+- **Inconsistent error handling.** Three strategies (thiserror/snafu/anyhow) and
+  mixed naming (bare `Error` vs descriptive names).

- **`common` is mostly parked domain code, not shared utilities.** Of its
-  6,724 lines, ~83% is scanner/heal domain code stranded there to break
-  dependency cycles (`metrics.rs`, ~4,810 lines of scanner-domain metrics;
-  `heal_channel.rs`, ~776 lines of heal-domain channel types). The
-  "common vs utils" naming ambiguity is secondary to moving that code to its
-  domain owners.
+- **Ambiguous common vs utils boundary.** Both described as "utilities and data
+  structures." Need clear ownership rules.

 ## Cross-Cutting Concerns

@@ -276,7 +232,7 @@ The binary (`main.rs`) boots in this order:

 ```
                            ┌─────────┐
-                            │  rustfs │  (binary + lib)
+                            │  rustfs │  (binary + lib, 75K lines)
                            │  main   │
                            └────┬────┘
                                 │
@@ -299,7 +255,7 @@ The binary (`main.rs`) boots in this order:
              │                  │                  │
        ┌─────▼──────┐    ┌──────▼──────┐    ┌──────▼──────┐
        │  ecstore   │    │     rio     │    │   io-core   │
-        │   (core)   │    │  (readers)  │    │ (zero-copy) │
+        │ (87K,core) │    │  (readers)  │    │ (zero-copy) │
        └─────┬──────┘    └─────────────┘    └─────────────┘
              │
     ┌─────┬──┼──┬─────┬──────┐
@@ -69,7 +69,7 @@ edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
 rust-version = "1.97.1"
-version = "1.0.0-rc.1"
+version = "1.0.0-beta.12"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
@@ -86,52 +86,52 @@ redundant_clone = "warn"

 [workspace.dependencies]
 # RustFS Internal Crates
-rustfs = { path = "./rustfs", version = "1.0.0-rc.1" }
-rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.1" }
-rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.1" }
-rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.1" }
-rustfs-common = { path = "crates/common", version = "1.0.0-rc.1" }
-rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.1" }
-rustfs-config = { path = "./crates/config", version = "1.0.0-rc.1" }
-rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.1" }
-rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.1" }
-rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.1" }
-rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.1" }
-rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.1" }
-rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.1" }
-rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.1" }
-rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.1" }
-rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.1" }
-rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.1" }
-rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.1" }
-rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.1" }
-rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.1" }
-rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.1" }
-rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.1" }
-rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.1", default-features = false }
-rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.1" }
-rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.1" }
-rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.1" }
-rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.1" }
-rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.1" }
-rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.1" }
-rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.1" }
-rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.1" }
-rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.1" }
-rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.1" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.1" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.1" }
-rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.1" }
-rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.1" }
-rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.1" }
-rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.1" }
-rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.1" }
-rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.1" }
-rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.1" }
-rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.1" }
-rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.1" }
-rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.1" }
-rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.1" }
+rustfs = { path = "./rustfs", version = "1.0.0-beta.12" }
+rustfs-heal = { path = "crates/heal", version = "1.0.0-beta.12" }
+rustfs-audit = { path = "crates/audit", version = "1.0.0-beta.12" }
+rustfs-checksums = { path = "crates/checksums", version = "1.0.0-beta.12" }
+rustfs-common = { path = "crates/common", version = "1.0.0-beta.12" }
+rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-beta.12" }
+rustfs-config = { path = "./crates/config", version = "1.0.0-beta.12" }
+rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-beta.12" }
+rustfs-credentials = { path = "crates/credentials", version = "1.0.0-beta.12" }
+rustfs-crypto = { path = "crates/crypto", version = "1.0.0-beta.12" }
+rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-beta.12" }
+rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-beta.12" }
+rustfs-iam = { path = "crates/iam", version = "1.0.0-beta.12" }
+rustfs-keystone = { path = "crates/keystone", version = "1.0.0-beta.12" }
+rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-beta.12" }
+rustfs-kms = { path = "crates/kms", version = "1.0.0-beta.12" }
+rustfs-lock = { path = "crates/lock", version = "1.0.0-beta.12" }
+rustfs-madmin = { path = "crates/madmin", version = "1.0.0-beta.12" }
+rustfs-notify = { path = "crates/notify", version = "1.0.0-beta.12" }
+rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-beta.12" }
+rustfs-io-core = { path = "crates/io-core", version = "1.0.0-beta.12" }
+rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-beta.12" }
+rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-beta.12" }
+rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-beta.12" }
+rustfs-obs = { path = "crates/obs", version = "1.0.0-beta.12" }
+rustfs-policy = { path = "crates/policy", version = "1.0.0-beta.12" }
+rustfs-protos = { path = "crates/protos", version = "1.0.0-beta.12" }
+rustfs-protocols = { path = "crates/protocols", version = "1.0.0-beta.12" }
+rustfs-replication = { path = "crates/replication", version = "1.0.0-beta.12" }
+rustfs-rio = { path = "crates/rio", version = "1.0.0-beta.12" }
+rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-beta.12" }
+rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-beta.12" }
+rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-beta.12" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-beta.12" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-beta.12" }
+rustfs-scanner = { path = "crates/scanner", version = "1.0.0-beta.12" }
+rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-beta.12" }
+rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-beta.12" }
+rustfs-signer = { path = "crates/signer", version = "1.0.0-beta.12" }
+rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-beta.12" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-beta.12" }
+rustfs-targets = { path = "crates/targets", version = "1.0.0-beta.12" }
+rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-beta.12" }
+rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-beta.12" }
+rustfs-utils = { path = "crates/utils", version = "1.0.0-beta.12" }
+rustfs-zip = { path = "./crates/zip", version = "1.0.0-beta.12" }

 # Async Runtime and Networking
 async-channel = "2.5.0"
@@ -139,13 +139,13 @@ async_zip = { default-features = false, version = "0.0.18" }
 mysql_async = { default-features = false, version = "0.37" }
 async-compression = { version = "0.4.43" }
 async-recursion = "1.1.1"
-async-trait = "0.1.92"
+async-trait = "0.1.91"
 async-nats = { version = "0.50.0", default-features = false }
 axum = "0.8.9"
-futures = "0.3.34"
-futures-core = "0.3.34"
+futures = "0.3.33"
+futures-core = "0.3.33"
 futures-lite = "2.6.1"
-futures-util = "0.3.34"
+futures-util = "0.3.33"
 pollster = "1.0.1"
 pulsar = { default-features = false, version = "6.8.0" }
 lapin = { default-features = false, version = "4.10.0" }
@@ -154,7 +154,7 @@ hyper-rustls = { default-features = false, version = "0.27.9" }
 hyper-util = { version = "0.1.20" }
 http = "1.5.0"
 http-body = "1.1.0"
-http-body-util = "0.1.5"
+http-body-util = "0.1.4"
 minlz = "1.2.3"
 reqwest = "0.13.4"
 rustfs-kafka-async = { version = "1.2.0" }
@@ -171,9 +171,9 @@ tower = { version = "0.5.3" }
 tower-http = { version = "0.7.0" }

 # Serialization and Data Formats
-apache-avro = "0.22.0"
+apache-avro = "0.21.0"
 bytes = { version = "1.12.1" }
-bytesize = "2.7.0"
+bytesize = "2.4.2"
 byteorder = "1.5.0"
 flatbuffers = "25.12.19"
 form_urlencoded = "1.2.2"
@@ -182,7 +182,6 @@ quick-xml = "0.41.0"
 rmp = { version = "0.8.15" }
 rmp-serde = { version = "1.3.1" }
 serde = { version = "1.0.229" }
-serde_ignored = { version = "0.1" }
 serde_json = { version = "1.0.151" }
 serde_urlencoded = "0.7.1"

@@ -213,7 +212,7 @@ zeroize = { version = "1.9.0" }
 chrono = { version = "0.4.45" }
 humantime = "2.4.0"
 jiff = { version = "0.2.35" }
-time = { version = "0.3.55" }
+time = { version = "0.3.54" }

 # Database
 deadpool-postgres = { version = "0.14" }
@@ -228,16 +227,15 @@ atoi = "3.1.0"
 atomic_enum = "0.3.0"
 aws-config = { version = "1.10.1" }
 aws-credential-types = { version = "1.3.0" }
-aws-sdk-kms = { default-features = false, version = "1.114.0" }
-aws-sdk-s3 = { default-features = false, version = "1.141.0" }
+aws-sdk-s3 = { default-features = false, version = "1.140.0" }
 aws-sdk-sts = { default-features = false, version = "1.110.0" }
-aws-smithy-http-client = { default-features = false, version = "1.3.0" }
+aws-smithy-http-client = { default-features = false, version = "1.2.0" }
 aws-smithy-runtime-api = { version = "1.14.0" }
-aws-smithy-types = { version = "1.6.2" }
-base64 = "0.23.1"
+aws-smithy-types = { version = "1.6.1" }
+base64 = "0.23.0"
 base64-simd = "0.8.0"
 brotli = "8.0.4"
-clap = { version = "4.6.6" }
+clap = { version = "4.6.4" }
 const-str = { version = "1.1.0" }
 convert_case = "0.11.0"
 criterion = { version = "0.8" }
@@ -245,15 +243,15 @@ crossbeam-queue = "0.3.13"
 crossbeam-channel = "0.5.16"
 crossbeam-deque = "0.8.7"
 crossbeam-utils = "0.8.22"
-datafusion = { default-features = false, git = "https://github.com/apache/datafusion.git", rev = "e08aed1e5de41dcf81d529140dae07723b942a5e" }
+datafusion = { default-features = false, git = "https://github.com/apache/datafusion.git", rev = "dae03ee062b2abf986de8df12ea82fb1578a2d99" }
 #datafusion = { default-features = false, version = "54.1.0" }
 derive_builder = "0.20.2"
 enumset = "1.1.14"
 faster-hex = "0.10.0"
 flate2 = "1.1.9"
 glob = "0.3.4"
-google-cloud-storage = "1.17.0"
-google-cloud-auth = "1.15.0"
+google-cloud-storage = "1.16.0"
+google-cloud-auth = "1.14.0"
 hashbrown = { version = "0.17.1" }
 hex = "0.4.3"
 hex-simd = "0.8.0"
@@ -269,33 +267,33 @@ lz4 = "1.28.1"
 matchit = "0.9.2"
 md-5 = "0.11.0"
 mime_guess = "2.0.5"
-moka = { version = "0.12.16" }
+moka = { version = "0.12.15" }
 netif = "0.1.6"
 num_cpus = { version = "1.17.0" }
 nvml-wrapper = "0.12.1"
 parking_lot = "0.12.5"
 path-absolutize = "4.0.1"
+path-clean = "1.0.1"
 percent-encoding = "2.3.2"
 pin-project-lite = "0.2.17"
 pretty_assertions = "1.4.1"
 rand = { version = "0.10.2" }
-ratelimit = "2.0.0"
+ratelimit = "0.10.1"
 rayon = "1.12.0"
 reed-solomon-erasure = { package = "rustfs-erasure-codec", version = "8.0.2" }
 reed-solomon-simd = "3.1.0"
 regex = { version = "1.13.1" }
 rumqttc = { package = "rumqttc-next", version = "0.33.3" }
 redis = { version = "1.5.0" }
-rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.4" }
 rust-embed = { version = "8.12.0" }
 rustc-hash = { version = "2.1.3" }
-s3s = { git = "https://github.com/rustfs/s3s.git", rev = "d7028511a53f69d41ed3c69f36899f9b1aede647" }
+s3s = { git = "https://github.com/cxymds/s3s.git", rev = "fe3941d91fa1c69956f209a9145995c9f0235bff" }
 serial_test = "4.0.1"
 shadow-rs = { default-features = false, version = "2.0.0" }
 siphasher = "1.0.3"
 smallvec = { version = "1.15.2" }
-compact_str = "0.10.0"
+smartstring = "1.0.1"
 snap = "1.1.2"
 starshard = { version = "2.2.2" }
 strum = { version = "0.28.0" }
@@ -303,7 +301,7 @@ sysinfo = "0.39.6"
 temp-env = "0.3.6"
 tempfile = "3.27.0"
 test-case = "3.3.1"
-thiserror = "2.0.20"
+thiserror = "2.0.19"
 tracing = { version = "0.1.44" }
 tracing-appender = "0.2.5"
 tracing-core = "0.1.36"
@@ -340,22 +338,21 @@ pyroscope = { version = "2.1.1" }
 libunftp = { version = "0.23.0" }
 unftp-core = "0.1.0"
 suppaftp = { version = "10.0.1" }
-rcgen = { version = "0.14.9", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
-russh = { version = "0.62.6" }
-russh-sftp = "2.4.0"
+rcgen = { version = "0.14.8", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
+russh = { version = "0.62.4" }
+russh-sftp = "2.3.0"

 # WebDAV
 dav-server = "0.11.0"

 # Performance Analysis and Memory Profiling
-mimalloc = { version = "0.1.52", git = "https://github.com/xonatius/mimalloc_rust.git", rev = "6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11" }
-libmimalloc-sys = { version = "0.1.49", git = "https://github.com/xonatius/mimalloc_rust.git", rev = "6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11", features = ["extended"] }
-hotpath = { version = "0.23.2", default-features = false }
+mimalloc = "0.1.52"
+hotpath = "0.22.0"
 # Snapshot testing for output format regression detection
 insta = { version = "1.48" }

 [workspace.metadata.cargo-shear]
-ignored = ["hotpath", "rustfs"]
+ignored = ["rustfs"]

 [profile.dev]
 # Full debuginfo roughly doubles compile+link time and produces multi-GB
@@ -91,12 +91,7 @@ LABEL name="RustFS" \
 # Upgrade base-image packages so published images pick up security fixes
 # (e.g. openssl/libssl3 CVEs) without waiting for a new Alpine point release.
 RUN apk upgrade --no-cache && \
-    apk add --no-cache \
-    ca-certificates \
-    coreutils \
-    curl \
-    tzdata \
-    && test "$(TZ=Asia/Kolkata date +%z)" = "+0530"
+    apk add --no-cache ca-certificates coreutils curl

 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=build /build/rustfs /usr/bin/rustfs
@@ -96,11 +96,9 @@ LABEL name="RustFS" \
 # Upgrade base-image packages so published images pick up security fixes
 # (e.g. tar/gzip/perl CVEs) without waiting for a new Ubuntu point release.
 RUN apt-get update && apt-get upgrade -y \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
-    tzdata \
-    && test "$(TZ=Asia/Kolkata date +%z)" = "+0530" \
    && rm -rf /var/lib/apt/lists/*

 COPY --from=build /build/rustfs /usr/bin/rustfs
@@ -116,7 +116,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.1
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.12
 ```

 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command
@@ -113,7 +113,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.1
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.12
 ```

 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：
@@ -47,9 +47,6 @@ consts = "consts"
 Hashi = "Hashi"  # HashiCorp
 # Accept alternate spelling used in parser/XML comments.
 unparseable = "unparseable"
-# Disaster-recovery objectives: recovery time and recovery point.
-RTO = "RTO"
-rto = "rto"

 [files]
 extend-exclude = []
@@ -25,40 +25,14 @@ documentation = "https://docs.rs/rustfs-audit/latest/rustfs_audit/"
 keywords = ["audit", "target", "management", "fan-out", "RustFS"]
 categories = ["web-programming", "development-tools", "asynchronous", "api-bindings"]

-[features]
-default = []
-hotpath = [
-    "hotpath/hotpath",
-    "hotpath/tokio",
-    "hotpath/futures",
-    "rustfs-config/hotpath",
-    "rustfs-s3-types/hotpath",
-    "rustfs-targets/hotpath",
-]
-hotpath-alloc = [
-    "hotpath",
-    "hotpath/hotpath-alloc",
-    "rustfs-config/hotpath-alloc",
-    "rustfs-s3-types/hotpath-alloc",
-    "rustfs-targets/hotpath-alloc",
-]
-hotpath-cpu = [
-    "hotpath",
-    "hotpath/hotpath-cpu",
-    "rustfs-config/hotpath-cpu",
-    "rustfs-s3-types/hotpath-cpu",
-    "rustfs-targets/hotpath-cpu",
-]
-
 [dependencies]
-hotpath.workspace = true
 rustfs-targets = { workspace = true }
 rustfs-config = { workspace = true, features = ["audit", "server-config-model"] }
 rustfs-s3-types = { workspace = true }
+chrono = { workspace = true, features = ["serde"] }
 const-str = { workspace = true, features = ["std", "proc"] }
 futures = { workspace = true }
 hashbrown = { workspace = true, features = ["serde", "rayon"] }
-jiff = { workspace = true, features = ["serde"] }
 metrics = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, features = ["raw_value"] }
@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

+use chrono::{DateTime, Utc};
 use hashbrown::HashMap;
-use jiff::Timestamp;
 use rustfs_s3_types::EventName;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
@@ -151,8 +151,8 @@ pub struct AuditEntry {
    pub deployment_id: Option<String>,
    #[serde(rename = "siteName", skip_serializing_if = "Option::is_none")]
    pub site_name: Option<String>,
-    #[serde(with = "jiff::fmt::serde::timestamp::millisecond::required")]
-    pub time: Timestamp,
+    #[serde(with = "chrono::serde::ts_milliseconds")]
+    pub time: DateTime<Utc>,
    pub event: EventName,
    #[serde(rename = "type", skip_serializing_if = "Option::is_none")]
    pub entry_type: Option<String>,
@@ -198,7 +198,7 @@ impl AuditEntryBuilder {
    pub fn new(version: impl Into<String>, event: EventName, trigger: impl Into<String>, api: ApiDetails) -> Self {
        Self(AuditEntry {
            version: version.into(),
-            time: Timestamp::now(),
+            time: Utc::now(),
            event,
            trigger: trigger.into(),
            api,
@@ -232,7 +232,7 @@ impl AuditEntryBuilder {
        self
    }

-    pub fn time(mut self, time: Timestamp) -> Self {
+    pub fn time(mut self, time: DateTime<Utc>) -> Self {
        self.0.time = time;
        self
    }
@@ -342,23 +342,4 @@ mod tests {
        assert_eq!(value["requestID"], Value::String("req-audit-123".to_string()));
        assert!(value.get("request_id").is_none(), "historical audit contract must not expose request_id");
    }
-
-    #[test]
-    fn audit_entry_time_serializes_as_epoch_milliseconds() {
-        let entry = AuditEntryBuilder::new(
-            "1",
-            EventName::ObjectCreatedPut,
-            "s3",
-            ApiDetailsBuilder::new()
-                .name("PutObject")
-                .status("OK")
-                .status_code(200)
-                .build(),
-        )
-        .time(Timestamp::from_millisecond(1_711_423_698_870).expect("timestamp should be valid"))
-        .build();
-
-        let value = serde_json::to_value(entry).expect("audit entry should serialize");
-        assert_eq!(value["time"], Value::Number(1_711_423_698_870_i64.into()));
-    }
 }
@@ -97,7 +97,7 @@ async fn test_audit_log_dispatch_performance() {
        return; // Alternatively: assert!(false, "AuditSystem failed to start");
    }

-    use jiff::Timestamp;
+    use chrono::Utc;
    use rustfs_targets::EventName;
    use serde_json::json;
    use std::collections::HashMap;
@@ -136,7 +136,7 @@ async fn test_audit_log_dispatch_performance() {
        version: "1".to_string(),
        deployment_id: Some(format!("test-deployment-{id}")),
        site_name: Some("test-site".to_string()),
-        time: Timestamp::now(),
+        time: Utc::now(),
        event: EventName::ObjectCreatedPut,
        entry_type: Some("object".to_string()),
        trigger: "api".to_string(),
@@ -298,7 +298,7 @@ fn test_performance_requirements() {
    for i in 0..3000 {
        // Simulate event name parsing and processing
        let _event_id = format!("s3:ObjectCreated:Put_{i}");
-        let _timestamp = jiff::Timestamp::now().to_string();
+        let _timestamp = chrono::Utc::now().to_rfc3339();

        // Simulate basic audit entry creation overhead
        let _entry_size = 512; // bytes
@@ -264,7 +264,7 @@ fn create_sample_audit_entry() -> AuditEntry {
 }

 fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {
-    use jiff::Timestamp;
+    use chrono::Utc;
    use rustfs_targets::EventName;
    use serde_json::json;

@@ -301,7 +301,7 @@ fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {
        version: "1".to_string(),
        deployment_id: Some(format!("test-deployment-{id}")),
        site_name: Some("test-site".to_string()),
-        time: Timestamp::now(),
+        time: Utc::now(),
        event: EventName::ObjectCreatedPut,
        entry_type: Some("object".to_string()),
        trigger: "api".to_string(),
@@ -28,14 +28,7 @@ documentation = "https://docs.rs/rustfs-checksums/latest/rustfs_checksum/"
 [lints]
 workspace = true

-[features]
-default = []
-hotpath = ["hotpath/hotpath"]
-hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
-hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
-
 [dependencies]
-hotpath.workspace = true
 bytes = { workspace = true, features = ["serde"] }
 crc-fast = { workspace = true }
 http = { workspace = true }
@@ -21,13 +21,6 @@ use crate::{
    Xxhash3, Xxhash64, Xxhash128,
 };

-// DELIBERATE DUPLICATION of the x-amz-checksum-* names that also exist as
-// AMZ_CHECKSUM_* in rustfs-utils' headers module (crates/utils/src/http/
-// headers.rs): this crate is a zero-internal-dependency leaf, so it cannot
-// import them, and it additionally owns the RustFS extension names
-// (sha512/xxhash*) that utils does not carry. Values are pinned by the S3
-// wire protocol; do not merge without a maintainer decision on the leaf
-// boundary (backlog#1833).
 pub const CRC_32_HEADER_NAME: &str = "x-amz-checksum-crc32";
 pub const CRC_32_C_HEADER_NAME: &str = "x-amz-checksum-crc32c";
 pub const SHA_1_HEADER_NAME: &str = "x-amz-checksum-sha1";
@@ -41,14 +41,6 @@ pub const XXHASH_64_NAME: &str = "xxhash64";
 pub const XXHASH_128_NAME: &str = "xxhash128";
 pub const MD5_NAME: &str = "md5";

-/// One of three deliberately separate checksum registries (backlog#1833):
-/// this enum owns the **streaming-hash algorithm registry**, including the
-/// RustFS extensions (sha512, xxhash3/64/128). The on-disk xl.meta bitset
-/// lives in `rustfs_rio::ChecksumType` (crates/rio/src/checksum.rs, varint
-/// bits are append-only), and the MinIO-port client keeps its own
-/// `ChecksumMode` (crates/ecstore/src/client/checksum.rs). When adding an
-/// algorithm, extend all three (or record why not) — they do not derive from
-/// each other.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 #[non_exhaustive]
 pub enum ChecksumAlgorithm {
@@ -27,27 +27,16 @@ categories = ["web-programming", "development-tools", "data-structures"]
 [lints]
 workspace = true

-[features]
-default = []
-hotpath = ["hotpath/hotpath", "hotpath/tokio"]
-hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
-hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
-
 [dependencies]
-hotpath.workspace = true
 tokio = { workspace = true, features = ["fs", "rt-multi-thread"] }
 tonic = { workspace = true, features = ["gzip", "deflate"] }
 uuid = { workspace = true, features = ["v4", "fast-rng", "macro-diagnostics"] }
 chrono = { workspace = true, features = ["serde"] }
-jiff = { workspace = true, features = ["serde"] }
 metrics = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 rmp-serde = { workspace = true }
 s3s = { workspace = true, features = ["minio"] }
 tracing = { workspace = true }

-[dev-dependencies]
-serde_json = { workspace = true }
-
 [lib]
 doctest = false
@@ -0,0 +1,87 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::last_minute::{self};
+use std::collections::HashMap;
+
+pub struct ReplicationLatency {
+    // Delays for single and multipart PUT requests
+    upload_histogram: last_minute::LastMinuteHistogram,
+}
+
+impl ReplicationLatency {
+    // Merge two ReplicationLatency
+    pub fn merge(&mut self, other: &mut ReplicationLatency) -> &ReplicationLatency {
+        self.upload_histogram.merge(&other.upload_histogram);
+        self
+    }
+
+    // Get upload delay (categorized by object size interval)
+    pub fn get_upload_latency(&mut self) -> HashMap<String, u64> {
+        let mut ret = HashMap::new();
+        let avg = self.upload_histogram.get_avg_data();
+        for (i, v) in avg.iter().enumerate() {
+            let avg_duration = v.avg();
+            ret.insert(self.size_tag_to_string(i), avg_duration.as_millis() as u64);
+        }
+        ret
+    }
+    pub fn update(&mut self, size: i64, during: std::time::Duration) {
+        self.upload_histogram.add(size, during);
+    }
+
+    // Simulate the conversion from size tag to string
+    fn size_tag_to_string(&self, tag: usize) -> String {
+        match tag {
+            0 => String::from("Size < 1 KiB"),
+            1 => String::from("Size < 1 MiB"),
+            2 => String::from("Size < 10 MiB"),
+            3 => String::from("Size < 100 MiB"),
+            4 => String::from("Size < 1 GiB"),
+            _ => String::from("Size > 1 GiB"),
+        }
+    }
+}
+
+// #[derive(Debug, Clone, Default)]
+// pub struct ReplicationLastMinute {
+//     pub last_minute: LastMinuteLatency,
+// }
+
+// impl ReplicationLastMinute {
+//     pub fn merge(&mut self, other: ReplicationLastMinute) -> ReplicationLastMinute {
+//         let mut nl = ReplicationLastMinute::default();
+//         nl.last_minute = self.last_minute.merge(&mut other.last_minute);
+//         nl
+//     }
+
+//     pub fn add_size(&mut self, n: i64) {
+//         let t = SystemTime::now()
+//             .duration_since(UNIX_EPOCH)
+//             .expect("Time went backwards")
+//             .as_secs();
+//         self.last_minute.add_all(t - 1, &AccElem { total: t - 1, size: n as u64, n: 1 });
+//     }
+
+//     pub fn get_total(&self) -> AccElem {
+//         self.last_minute.get_total()
+//     }
+// }
+
+// impl fmt::Display for ReplicationLastMinute {
+//     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+//         let t = self.last_minute.get_total();
+//         write!(f, "ReplicationLastMinute sz= {}, n= {}, dur= {}", t.size, t.n, t.total)
+//     }
+// }
@@ -356,8 +356,6 @@ pub struct HealChannelRequest {
    pub recursive: Option<bool>,
    /// Whether to dry run
    pub dry_run: Option<bool>,
-    /// Whether to skip namespace locking
-    pub no_lock: Option<bool>,
    /// Timeout in seconds (optional)
    pub timeout_seconds: Option<u64>,
    /// Origin of the request for operational status and queue accounting
@@ -562,7 +560,6 @@ pub fn create_heal_request(
        update_parity: None,
        recursive: None,
        dry_run: None,
-        no_lock: None,
        timeout_seconds: None,
        source: HealRequestSource::Internal,
        disk: None,
@@ -721,7 +718,6 @@ pub async fn send_heal_disk(set_disk_id: String, priority: Option<HealChannelPri
        update_parity: None,
        recursive: None,
        dry_run: None,
-        no_lock: None,
        timeout_seconds: None,
        source: HealRequestSource::AutoHeal,
    };
@@ -572,3 +572,44 @@ mod tests {
        assert_eq!(total.n, 6);
    }
 }
+
+const SIZE_LAST_ELEM_MARKER: usize = 10; // Assumed marker size is 10, modify according to actual situation
+
+#[allow(dead_code)]
+#[derive(Debug, Default)]
+pub struct LastMinuteHistogram {
+    histogram: Vec<LastMinuteLatency>,
+    size: u32,
+}
+
+impl LastMinuteHistogram {
+    pub fn merge(&mut self, other: &LastMinuteHistogram) {
+        for i in 0..self.histogram.len() {
+            self.histogram[i].merge(&other.histogram[i]);
+        }
+    }
+
+    pub fn add(&mut self, size: i64, t: Duration) {
+        let index = size_to_tag(size);
+        self.histogram[index].add(&t);
+    }
+
+    pub fn get_avg_data(&mut self) -> [AccElem; SIZE_LAST_ELEM_MARKER] {
+        let mut res = [AccElem::default(); SIZE_LAST_ELEM_MARKER];
+        for (i, elem) in self.histogram.iter_mut().enumerate() {
+            res[i] = elem.get_total();
+        }
+        res
+    }
+}
+
+fn size_to_tag(size: i64) -> usize {
+    match size {
+        _ if size < 1024 => 0,               // sizeLessThan1KiB
+        _ if size < 1024 * 1024 => 1,        // sizeLessThan1MiB
+        _ if size < 10 * 1024 * 1024 => 2,   // sizeLessThan10MiB
+        _ if size < 100 * 1024 * 1024 => 3,  // sizeLessThan100MiB
+        _ if size < 1024 * 1024 * 1024 => 4, // sizeLessThan1GiB
+        _ => 5,                              // sizeGreaterThan1GiB
+    }
+}
@@ -12,13 +12,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

+pub mod bucket_stats;
 // pub mod error;
 pub mod globals;
 pub mod heal_channel;
 pub mod last_minute;
 pub mod metrics;
 mod readiness;
-pub mod table_catalog;

 pub use globals::*;
 pub use readiness::{GlobalReadiness, SystemStage};
@@ -15,10 +15,9 @@
 use crate::heal_channel::HealScanMode;
 use crate::last_minute::{AccElem, LastMinuteLatency};
 use chrono::{DateTime, Utc};
-use jiff::Timestamp;
 use serde::{Deserialize, Serialize};
 use std::{
-    collections::{BTreeSet, HashMap},
+    collections::HashMap,
    fmt::Display,
    future::Future,
    pin::Pin,
@@ -670,7 +669,7 @@ impl LockedLastMinuteLatency {
 #[derive(Clone, Debug)]
 struct CurrentPathState {
    path: String,
-    updated_at: Timestamp,
+    updated_at: DateTime<Utc>,
 }

 struct CurrentPathTracker {
@@ -679,10 +678,10 @@ struct CurrentPathTracker {

 impl CurrentPathTracker {
    fn new(initial_path: String) -> Self {
-        Self::new_at(initial_path, Timestamp::now())
+        Self::new_at(initial_path, Utc::now())
    }

-    fn new_at(initial_path: String, updated_at: Timestamp) -> Self {
+    fn new_at(initial_path: String, updated_at: DateTime<Utc>) -> Self {
        Self {
            state: Arc::new(RwLock::new(CurrentPathState {
                path: initial_path,
@@ -694,7 +693,7 @@ impl CurrentPathTracker {
    async fn update_path(&self, path: String) {
        let mut state = self.state.write().await;
        state.path = path;
-        state.updated_at = Timestamp::now();
+        state.updated_at = Utc::now();
    }

    async fn get_state(&self) -> CurrentPathState {
@@ -702,36 +701,6 @@ impl CurrentPathTracker {
    }
 }

-fn chrono_to_jiff_timestamp(dt: DateTime<Utc>) -> Timestamp {
-    let seconds = dt.timestamp();
-    let nanoseconds = match i32::try_from(dt.timestamp_subsec_nanos()) {
-        Ok(nanoseconds) => nanoseconds,
-        Err(_) => {
-            return if seconds < 0 { Timestamp::MIN } else { Timestamp::MAX };
-        }
-    };
-
-    match Timestamp::new(seconds, nanoseconds) {
-        Ok(timestamp) => timestamp,
-        Err(_) => {
-            if seconds < 0 {
-                Timestamp::MIN
-            } else {
-                Timestamp::MAX
-            }
-        }
-    }
-}
-
-fn timestamp_elapsed_seconds_since(now: Timestamp, earlier: Timestamp) -> u64 {
-    let duration = now.duration_since(earlier);
-    if duration.is_negative() {
-        return 0;
-    }
-
-    u64::try_from(duration.as_secs()).map_or(u64::MAX, |seconds| seconds)
-}
-
 #[derive(Clone, Copy, Debug, Default)]
 struct ScannerDiskBucketScanState {
    concurrency_limit: u64,
@@ -739,48 +708,6 @@ struct ScannerDiskBucketScanState {
    active: u64,
 }

-type ScannerDiskBucketScanKey = (String, String);
-
-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct ScannerDiskBucketScanSnapshot {
-    pub pool: String,
-    pub set: String,
-    pub concurrency_limit: u64,
-    pub queued: u64,
-    pub active: u64,
-}
-
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
-struct ScannerBucketDriveResultKey {
-    bucket: String,
-    drive: String,
-    result: String,
-}
-
-impl ScannerBucketDriveResultKey {
-    fn new(bucket: impl Into<String>, drive: impl Into<String>, result: impl Into<String>) -> Self {
-        Self {
-            bucket: bucket.into(),
-            drive: drive.into(),
-            result: result.into(),
-        }
-    }
-}
-
-const MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS: usize = 4096;
-
-#[derive(Debug, Default)]
-struct ScannerBucketDriveResults {
-    counts: HashMap<ScannerBucketDriveResultKey, ScannerBucketDriveResultValue>,
-    eviction_index: BTreeSet<(u64, ScannerBucketDriveResultKey)>,
-}
-
-#[derive(Clone, Copy, Debug)]
-struct ScannerBucketDriveResultValue {
-    count: u64,
-    last_seen: u64,
-}
-
 // ---------------------------------------------------------------------------
 // Metrics
 // ---------------------------------------------------------------------------
@@ -811,11 +738,7 @@ pub struct Metrics {
    scanner_set_scan_concurrency_limit: AtomicU64,
    scanner_set_scans_queued: AtomicU64,
    scanner_set_scans_active: AtomicU64,
-    scanner_disk_bucket_scan_states: Mutex<HashMap<ScannerDiskBucketScanKey, ScannerDiskBucketScanState>>,
-    scanner_bucket_drive_results: Mutex<ScannerBucketDriveResults>,
-    scanner_bucket_drive_result_clock: AtomicU64,
-    current_scan_cycle_bucket_drive_results_start: Mutex<HashMap<ScannerBucketDriveResultKey, u64>>,
-    last_scan_cycle_bucket_drive_results: Mutex<Vec<ScannerBucketDriveResultSnapshot>>,
+    scanner_disk_bucket_scan_states: Mutex<HashMap<String, ScannerDiskBucketScanState>>,
    scanner_leader_lock_state: RwLock<String>,
    scanner_leader_lock_held: AtomicBool,
    scanner_leader_lock_last_error: RwLock<String>,
@@ -915,13 +838,11 @@ const SCAN_CYCLE_RESULT_SUCCESS: u8 = 1;
 const SCAN_CYCLE_RESULT_ERROR: u8 = 2;
 const SCAN_CYCLE_RESULT_PARTIAL: u8 = 3;
 const SCAN_CYCLE_RESULT_SUPERSEDED: u8 = 4;
-const SCAN_CYCLE_RESULT_DEFERRED: u8 = 5;
 const SCAN_CYCLE_RESULT_UNKNOWN_LABEL: &str = "unknown";
 const SCAN_CYCLE_RESULT_SUCCESS_LABEL: &str = "success";
 const SCAN_CYCLE_RESULT_ERROR_LABEL: &str = "error";
 const SCAN_CYCLE_RESULT_PARTIAL_LABEL: &str = "partial";
 const SCAN_CYCLE_RESULT_SUPERSEDED_LABEL: &str = "superseded";
-const SCAN_CYCLE_RESULT_DEFERRED_LABEL: &str = "deferred";

 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub enum ScanCyclePartialReason {
@@ -1037,14 +958,6 @@ pub struct ScannerSourceWorkSnapshot {
    pub missed: u64,
 }

-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct ScannerBucketDriveResultSnapshot {
-    pub bucket: String,
-    pub drive: String,
-    pub result: String,
-    pub count: u64,
-}
-
 #[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
 pub struct ScannerReplicationRepairSnapshot {
    pub source: String,
@@ -1199,12 +1112,12 @@ pub struct ScannerLastMinute {

 #[derive(Clone, Debug, Default, Serialize, Deserialize)]
 pub struct ScannerMetricsReport {
-    pub collected_at: Timestamp,
+    pub collected_at: DateTime<Utc>,
    pub current_cycle: u64,
    #[serde(default)]
    pub current_cycle_active: bool,
-    pub current_started: Timestamp,
-    pub cycles_completed_at: Vec<Timestamp>,
+    pub current_started: DateTime<Utc>,
+    pub cycles_completed_at: Vec<DateTime<Utc>>,
    pub ongoing_buckets: usize,
    #[serde(default)]
    pub active_scan_paths: usize,
@@ -1377,18 +1290,6 @@ pub struct ScannerMetricsReport {
    pub partial_cycles: u64,
 }

-#[derive(Clone, Debug, Default, Serialize, Deserialize)]
-pub struct ScannerRuntimeDetailsReport {
-    #[serde(default)]
-    pub disk_bucket_scan_states: Vec<ScannerDiskBucketScanSnapshot>,
-    #[serde(default)]
-    pub bucket_drive_results: Vec<ScannerBucketDriveResultSnapshot>,
-    #[serde(default)]
-    pub current_cycle_bucket_drive_results: Vec<ScannerBucketDriveResultSnapshot>,
-    #[serde(default)]
-    pub last_cycle_bucket_drive_results: Vec<ScannerBucketDriveResultSnapshot>,
-}
-
 impl CurrentCycle {
    pub fn unmarshal(&mut self, buf: &[u8]) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        *self = rmp_serde::from_slice(buf)?;
@@ -1426,7 +1327,6 @@ fn scan_cycle_result_label(result: u8) -> &'static str {
        SCAN_CYCLE_RESULT_ERROR => SCAN_CYCLE_RESULT_ERROR_LABEL,
        SCAN_CYCLE_RESULT_PARTIAL => SCAN_CYCLE_RESULT_PARTIAL_LABEL,
        SCAN_CYCLE_RESULT_SUPERSEDED => SCAN_CYCLE_RESULT_SUPERSEDED_LABEL,
-        SCAN_CYCLE_RESULT_DEFERRED => SCAN_CYCLE_RESULT_DEFERRED_LABEL,
        _ => SCAN_CYCLE_RESULT_UNKNOWN_LABEL,
    }
 }
@@ -1755,14 +1655,8 @@ pub fn emit_scan_cycle_superseded(duration: Duration) {
    metrics::counter!(OTEL_SCANNER_CYCLES, "result" => SCAN_CYCLE_RESULT_SUPERSEDED_LABEL).increment(1);
 }

-pub fn emit_scan_cycle_deferred(duration: Duration) {
-    global_metrics().record_scan_cycle_deferred(duration);
-    metrics::counter!(OTEL_SCANNER_CYCLES, "result" => SCAN_CYCLE_RESULT_DEFERRED_LABEL).increment(1);
-}
-
 pub fn emit_scan_bucket_drive_complete(success: bool, bucket: &str, disk: &str, duration: Duration) {
    let result = if success { "success" } else { "error" };
-    global_metrics().record_scanner_bucket_drive_result(bucket, disk, result);
    metrics::counter!(
        OTEL_SCANNER_BUCKETS_SCANNED,
        "result" => result,
@@ -1779,7 +1673,6 @@ pub fn emit_scan_bucket_drive_complete(success: bool, bucket: &str, disk: &str,
 }

 pub fn emit_scan_bucket_drive_partial(bucket: &str, disk: &str, duration: Duration) {
-    global_metrics().record_scanner_bucket_drive_result(bucket, disk, SCAN_CYCLE_RESULT_PARTIAL_LABEL);
    metrics::counter!(
        OTEL_SCANNER_BUCKETS_SCANNED,
        "result" => SCAN_CYCLE_RESULT_PARTIAL_LABEL,
@@ -1830,10 +1723,6 @@ impl Metrics {
            scanner_set_scans_queued: AtomicU64::new(0),
            scanner_set_scans_active: AtomicU64::new(0),
            scanner_disk_bucket_scan_states: Mutex::new(HashMap::new()),
-            scanner_bucket_drive_results: Mutex::new(ScannerBucketDriveResults::default()),
-            scanner_bucket_drive_result_clock: AtomicU64::new(0),
-            current_scan_cycle_bucket_drive_results_start: Mutex::new(HashMap::new()),
-            last_scan_cycle_bucket_drive_results: Mutex::new(Vec::new()),
            scanner_leader_lock_state: RwLock::new("unknown".to_string()),
            scanner_leader_lock_held: AtomicBool::new(false),
            scanner_leader_lock_last_error: RwLock::new(String::new()),
@@ -2404,7 +2293,7 @@ impl Metrics {
        queued: Option<usize>,
        active: Option<usize>,
    ) {
-        let key = (pool.to_string(), set.to_string());
+        let key = format!("{pool}/{set}");
        let mut states = self
            .scanner_disk_bucket_scan_states
            .lock()
@@ -2421,41 +2310,6 @@ impl Metrics {
        }
    }

-    pub fn record_scanner_bucket_drive_result(&self, bucket: &str, drive: &str, result: &str) {
-        if bucket.is_empty() || drive.is_empty() || result.is_empty() {
-            return;
-        }
-        let key = ScannerBucketDriveResultKey::new(bucket, drive, result);
-        let mut results = self
-            .scanner_bucket_drive_results
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner());
-        let last_seen = self.scanner_bucket_drive_result_clock.fetch_add(1, Ordering::Relaxed);
-        if let Some(previous_last_seen) = results.counts.get_mut(&key).map(|value| {
-            let previous_last_seen = value.last_seen;
-            value.count = value.count.saturating_add(1);
-            value.last_seen = last_seen;
-            previous_last_seen
-        }) {
-            results.eviction_index.remove(&(previous_last_seen, key.clone()));
-            results.eviction_index.insert((last_seen, key));
-            return;
-        }
-
-        if results.counts.len() >= MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS
-            && let Some((_, stale_key)) = results.eviction_index.pop_first()
-        {
-            results.counts.remove(&stale_key);
-        }
-
-        if results.counts.len() < MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS {
-            results
-                .counts
-                .insert(key.clone(), ScannerBucketDriveResultValue { count: 1, last_seen });
-            results.eviction_index.insert((last_seen, key));
-        }
-    }
-
    // -----------------------------------------------------------------------
    // Read-side helpers
    // -----------------------------------------------------------------------
@@ -2557,17 +2411,6 @@ impl Metrics {
            .store(duration_millis_saturated(duration), Ordering::Relaxed);
    }

-    pub fn record_scan_cycle_deferred(&self, duration: Duration) {
-        self.record_scanner_cycle_end_time();
-        self.last_scan_cycle_result
-            .store(SCAN_CYCLE_RESULT_DEFERRED, Ordering::Relaxed);
-        self.last_scan_cycle_partial_reason
-            .store(ScanCyclePartialReason::Unknown as u8, Ordering::Relaxed);
-        self.last_scan_cycle_partial_source.store(0, Ordering::Relaxed);
-        self.last_scan_cycle_duration_millis
-            .store(duration_millis_saturated(duration), Ordering::Relaxed);
-    }
-
    pub fn record_scan_cycle_partial(&self, duration: Duration, reason: ScanCyclePartialReason) {
        self.record_scan_cycle_partial_with_source(duration, reason, None);
    }
@@ -2638,11 +2481,6 @@ impl Metrics {
            &self.current_scan_cycle_replication_repair_work_start,
            &replication_repair_snapshot,
        );
-        let bucket_drive_results = self.scanner_bucket_drive_result_counts();
-        match self.current_scan_cycle_bucket_drive_results_start.lock() {
-            Ok(mut start) => *start = bucket_drive_results,
-            Err(poisoned) => *poisoned.into_inner() = bucket_drive_results,
-        }
        self.current_scan_cycle_work_active.store(true, Ordering::Release);
        snapshot
    }
@@ -2655,11 +2493,6 @@ impl Metrics {
        self.record_scan_cycle_work(work);
        self.record_scan_cycle_source_work(&source_work);
        self.record_scan_cycle_replication_repair_work(&replication_repair_work);
-        let bucket_drive_results = self.current_cycle_bucket_drive_result_snapshots();
-        match self.last_scan_cycle_bucket_drive_results.lock() {
-            Ok(mut last) => *last = bucket_drive_results,
-            Err(poisoned) => *poisoned.into_inner() = bucket_drive_results,
-        }
        self.current_scan_cycle_work_active.store(false, Ordering::Release);
    }

@@ -2743,105 +2576,6 @@ impl Metrics {
        }
    }

-    fn scanner_bucket_drive_result_counts(&self) -> HashMap<ScannerBucketDriveResultKey, u64> {
-        self.scanner_bucket_drive_results
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .counts
-            .iter()
-            .map(|(key, value)| (key.clone(), value.count))
-            .collect()
-    }
-
-    fn scanner_bucket_drive_result_snapshots(
-        counts: impl IntoIterator<Item = (ScannerBucketDriveResultKey, u64)>,
-    ) -> Vec<ScannerBucketDriveResultSnapshot> {
-        let mut snapshots = counts
-            .into_iter()
-            .filter(|(_, count)| *count > 0)
-            .map(|(key, count)| ScannerBucketDriveResultSnapshot {
-                bucket: key.bucket,
-                drive: key.drive,
-                result: key.result,
-                count,
-            })
-            .collect::<Vec<_>>();
-        snapshots.sort_by(|left, right| {
-            left.bucket
-                .cmp(&right.bucket)
-                .then_with(|| left.drive.cmp(&right.drive))
-                .then_with(|| left.result.cmp(&right.result))
-        });
-        snapshots
-    }
-
-    fn scanner_bucket_drive_result_counter_snapshots(&self) -> Vec<ScannerBucketDriveResultSnapshot> {
-        Self::scanner_bucket_drive_result_snapshots(self.scanner_bucket_drive_result_counts())
-    }
-
-    fn current_cycle_bucket_drive_result_snapshots(&self) -> Vec<ScannerBucketDriveResultSnapshot> {
-        let current = self.scanner_bucket_drive_result_counts();
-        let start = self
-            .current_scan_cycle_bucket_drive_results_start
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .clone();
-        Self::scanner_bucket_drive_result_snapshots(current.into_iter().filter_map(|(key, count)| {
-            let delta = count.saturating_sub(start.get(&key).copied().unwrap_or_default());
-            (delta > 0).then_some((key, delta))
-        }))
-    }
-
-    pub fn scanner_runtime_details_report(&self) -> ScannerRuntimeDetailsReport {
-        self.scanner_runtime_details_report_for_active(self.current_scan_cycle_work_active.load(Ordering::Acquire))
-    }
-
-    fn scanner_runtime_details_report_for_active(&self, current_cycle_active: bool) -> ScannerRuntimeDetailsReport {
-        let current_cycle_bucket_drive_results = if current_cycle_active {
-            self.current_cycle_bucket_drive_result_snapshots()
-        } else {
-            Vec::new()
-        };
-        ScannerRuntimeDetailsReport {
-            disk_bucket_scan_states: self.scanner_disk_bucket_scan_state_snapshots(),
-            bucket_drive_results: self.scanner_bucket_drive_result_counter_snapshots(),
-            current_cycle_bucket_drive_results,
-            last_cycle_bucket_drive_results: self
-                .last_scan_cycle_bucket_drive_results
-                .lock()
-                .unwrap_or_else(|poisoned| poisoned.into_inner())
-                .clone(),
-        }
-    }
-
-    fn scanner_disk_bucket_scan_state_snapshots(&self) -> Vec<ScannerDiskBucketScanSnapshot> {
-        let mut disk_bucket_scan_states = match self.scanner_disk_bucket_scan_states.lock() {
-            Ok(states) => states
-                .iter()
-                .map(|((pool, set), state)| ScannerDiskBucketScanSnapshot {
-                    pool: pool.clone(),
-                    set: set.clone(),
-                    concurrency_limit: state.concurrency_limit,
-                    queued: state.queued,
-                    active: state.active,
-                })
-                .collect::<Vec<_>>(),
-            Err(poisoned) => poisoned
-                .into_inner()
-                .iter()
-                .map(|((pool, set), state)| ScannerDiskBucketScanSnapshot {
-                    pool: pool.clone(),
-                    set: set.clone(),
-                    concurrency_limit: state.concurrency_limit,
-                    queued: state.queued,
-                    active: state.active,
-                })
-                .collect::<Vec<_>>(),
-        };
-        disk_bucket_scan_states.sort_by(|left, right| left.pool.cmp(&right.pool).then_with(|| left.set.cmp(&right.set)));
-        disk_bucket_scan_states
-    }
-
    fn scanner_source_work_values(&self) -> Vec<ScannerSourceWorkValues> {
        ScannerWorkSource::all()
            .iter()
@@ -3027,26 +2761,20 @@ impl Metrics {

    /// Build a full metrics report snapshot.
    pub async fn report(&self) -> ScannerMetricsReport {
-        self.report_with_runtime_details().await.0
-    }
-
-    pub async fn report_with_runtime_details(&self) -> (ScannerMetricsReport, ScannerRuntimeDetailsReport) {
        let mut m = ScannerMetricsReport::default();
-        let runtime_details;

        let has_cycle = {
            let cycle = self.cycle_info.read().await;
            let has_cycle = if let Some(cycle) = cycle.as_ref() {
                m.current_cycle = cycle.current;
-                m.cycles_completed_at = cycle.cycle_completed.iter().copied().map(chrono_to_jiff_timestamp).collect();
-                m.current_started = chrono_to_jiff_timestamp(cycle.started);
+                m.cycles_completed_at = cycle.cycle_completed.clone();
+                m.current_started = cycle.started;
                true
            } else {
                false
            };
            m.current_cycle_active = self.current_scan_cycle_work_active.load(Ordering::Acquire);
            if m.current_cycle_active {
-                // Keep cycle_info before cycle-baseline locks so active scrapes cannot mix two cycle identities.
                let current_work = self.scan_cycle_work_since(self.current_scan_cycle_work_start());
                let current_source_work = self.scanner_source_work_since(&self.current_scan_cycle_source_work_start_values());
                let current_replication_repair_work =
@@ -3069,20 +2797,19 @@ impl Metrics {
                m.current_cycle_replication_repair =
                    self.scanner_replication_repair_work_snapshots(&current_replication_repair_work);
            }
-            runtime_details = self.scanner_runtime_details_report_for_active(m.current_cycle_active);
            has_cycle
        };

        if !has_cycle && let Some(init_time) = crate::get_global_init_time().await {
-            m.current_started = chrono_to_jiff_timestamp(init_time);
+            m.current_started = init_time;
        }

-        m.collected_at = Timestamp::now();
+        m.collected_at = Utc::now();
        let current_path_snapshots = self.current_path_snapshots().await;
        m.active_scan_paths = current_path_snapshots.len();
        m.oldest_active_path_age_seconds = current_path_snapshots
            .iter()
-            .map(|(_, state)| timestamp_elapsed_seconds_since(m.collected_at, state.updated_at))
+            .map(|(_, state)| m.collected_at.signed_duration_since(state.updated_at).num_seconds().max(0) as u64)
            .max()
            .unwrap_or_default();
        m.active_paths = current_path_snapshots
@@ -3099,11 +2826,15 @@ impl Metrics {
        m.current_set_scan_concurrency_limit = self.scanner_set_scan_concurrency_limit.load(Ordering::Relaxed);
        m.current_set_scans_queued = self.scanner_set_scans_queued.load(Ordering::Relaxed);
        m.current_set_scans_active = self.scanner_set_scans_active.load(Ordering::Relaxed);
-        let disk_bucket_scan_states = self.scanner_disk_bucket_scan_state_snapshots();
        let (disk_scan_concurrency_limit, disk_bucket_scans_queued, disk_bucket_scans_active) =
-            disk_bucket_scan_states.iter().fold((0, 0, 0), |acc, state| {
-                (acc.0 + state.concurrency_limit, acc.1 + state.queued, acc.2 + state.active)
-            });
+            match self.scanner_disk_bucket_scan_states.lock() {
+                Ok(states) => states.values().fold((0, 0, 0), |acc, state| {
+                    (acc.0 + state.concurrency_limit, acc.1 + state.queued, acc.2 + state.active)
+                }),
+                Err(poisoned) => poisoned.into_inner().values().fold((0, 0, 0), |acc, state| {
+                    (acc.0 + state.concurrency_limit, acc.1 + state.queued, acc.2 + state.active)
+                }),
+            };
        m.current_disk_scan_concurrency_limit = disk_scan_concurrency_limit;
        m.current_disk_bucket_scans_queued = disk_bucket_scans_queued;
        m.current_disk_bucket_scans_active = disk_bucket_scans_active;
@@ -3272,7 +3003,7 @@ impl Metrics {
        m.pacing_pressure = scanner_pacing_pressure(&m);
        m.maintenance_control = scanner_maintenance_control(&m);

-        (m, runtime_details)
+        m
    }
 }

@@ -3358,22 +3089,6 @@ impl Drop for CloseDiskGuard {
 mod tests {
    use super::*;

-    #[test]
-    fn scanner_metrics_report_timestamps_serialize_as_rfc3339_utc() {
-        let report = ScannerMetricsReport {
-            collected_at: Timestamp::constant(1_700_000_000, 123_456_000),
-            current_started: Timestamp::constant(1_699_999_940, 0),
-            cycles_completed_at: vec![Timestamp::constant(1_700_000_060, 987_654_000)],
-            ..Default::default()
-        };
-
-        let value = serde_json::to_value(&report).expect("scanner metrics report should serialize");
-
-        assert_eq!(value["collected_at"].as_str(), Some("2023-11-14T22:13:20.123456Z"));
-        assert_eq!(value["current_started"].as_str(), Some("2023-11-14T22:12:20Z"));
-        assert_eq!(value["cycles_completed_at"][0].as_str(), Some("2023-11-14T22:14:20.987654Z"));
-    }
-
    #[tokio::test]
    async fn close_disk_guard_runs_cleanup_when_an_early_return_drops_it() {
        let (closed_tx, closed_rx) = tokio::sync::oneshot::channel();
@@ -3432,7 +3147,7 @@ mod tests {
    #[tokio::test]
    async fn report_counts_active_scan_paths() {
        let metrics = Metrics::new();
-        let updated_at = Timestamp::now() - jiff::SignedDuration::from_secs(12);
+        let updated_at = Utc::now() - chrono::Duration::seconds(12);
        metrics.current_paths.write().await.insert(
            "disk-a".to_string(),
            Arc::new(CurrentPathTracker::new_at("bucket-a".to_string(), updated_at)),
@@ -3454,7 +3169,7 @@ mod tests {
        let metrics = Metrics::new();
        let tracker = Arc::new(CurrentPathTracker::new_at(
            "bucket-a".to_string(),
-            Timestamp::now() - jiff::SignedDuration::from_secs(60 * 60),
+            Utc::now() - chrono::Duration::hours(1),
        ));
        metrics
            .current_paths
@@ -4227,7 +3942,7 @@ mod tests {
        let report = metrics.report().await;
        *crate::globals::GLOBAL_INIT_TIME.write().await = previous_init_time;

-        assert_eq!(report.current_started, chrono_to_jiff_timestamp(cycle_started));
+        assert_eq!(report.current_started, cycle_started);
    }

    #[tokio::test]
@@ -4283,21 +3998,6 @@ mod tests {
        assert_eq!(report.partial_cycles, 0);
    }

-    #[tokio::test]
-    async fn report_tracks_deferred_cycle_without_failed_increment() {
-        let metrics = Metrics::new();
-        metrics.record_scan_cycle_deferred(Duration::from_millis(250));
-
-        let report = metrics.report().await;
-
-        assert_eq!(report.last_cycle_result, SCAN_CYCLE_RESULT_DEFERRED_LABEL);
-        assert_eq!(report.last_cycle_result_code, u64::from(SCAN_CYCLE_RESULT_DEFERRED));
-        assert_eq!(report.last_cycle_duration_seconds, 0.25);
-        assert_eq!(report.failed_cycles, 0);
-        assert_eq!(report.superseded_cycles, 0);
-        assert_eq!(report.partial_cycles, 0);
-    }
-
    #[tokio::test]
    async fn report_tracks_successful_scan_cycle_without_failed_increment() {
        let metrics = Metrics::new();
@@ -4400,137 +4100,6 @@ mod tests {
        assert_eq!(report.life_time_ops.get("scan_bucket_drive_failure"), Some(&1));
    }

-    #[tokio::test]
-    async fn report_includes_structured_bucket_drive_results() {
-        let metrics = Metrics::new();
-        metrics.record_scanner_bucket_drive_result("photos", "/data1", "success");
-
-        let cycle_start = metrics.start_scan_cycle_work();
-        metrics.record_scanner_bucket_drive_result("photos", "/data1", "partial");
-
-        let active_report = metrics.scanner_runtime_details_report();
-        assert_eq!(
-            active_report.current_cycle_bucket_drive_results,
-            vec![ScannerBucketDriveResultSnapshot {
-                bucket: "photos".to_string(),
-                drive: "/data1".to_string(),
-                result: "partial".to_string(),
-                count: 1,
-            }]
-        );
-
-        metrics.finish_scan_cycle_work(cycle_start);
-
-        let report = metrics.scanner_runtime_details_report();
-
-        assert_eq!(
-            report.bucket_drive_results,
-            vec![
-                ScannerBucketDriveResultSnapshot {
-                    bucket: "photos".to_string(),
-                    drive: "/data1".to_string(),
-                    result: "partial".to_string(),
-                    count: 1,
-                },
-                ScannerBucketDriveResultSnapshot {
-                    bucket: "photos".to_string(),
-                    drive: "/data1".to_string(),
-                    result: "success".to_string(),
-                    count: 1,
-                },
-            ]
-        );
-        assert!(report.current_cycle_bucket_drive_results.is_empty());
-        assert_eq!(
-            report.last_cycle_bucket_drive_results,
-            vec![ScannerBucketDriveResultSnapshot {
-                bucket: "photos".to_string(),
-                drive: "/data1".to_string(),
-                result: "partial".to_string(),
-                count: 1,
-            }]
-        );
-    }
-
-    #[tokio::test]
-    async fn scanner_bucket_drive_results_are_bounded() {
-        let metrics = Metrics::new();
-        for index in 0..MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS {
-            metrics.record_scanner_bucket_drive_result(&format!("bucket-{index}"), "/data1", "success");
-        }
-        metrics.record_scanner_bucket_drive_result("overflow", "/data1", "success");
-
-        let report = metrics.scanner_runtime_details_report();
-
-        assert_eq!(report.bucket_drive_results.len(), MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS);
-        assert!(
-            report
-                .bucket_drive_results
-                .iter()
-                .any(|snapshot| snapshot.bucket == "overflow")
-        );
-        assert!(
-            report
-                .bucket_drive_results
-                .iter()
-                .all(|snapshot| snapshot.bucket != "bucket-0")
-        );
-    }
-
-    #[tokio::test]
-    async fn scanner_bucket_drive_result_eviction_keeps_recent_keys() {
-        let metrics = Metrics::new();
-        for index in 0..MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS {
-            metrics.record_scanner_bucket_drive_result(&format!("bucket-{index}"), "/data1", "success");
-        }
-        metrics.record_scanner_bucket_drive_result("bucket-0", "/data1", "success");
-        metrics.record_scanner_bucket_drive_result("overflow", "/data1", "success");
-
-        let report = metrics.scanner_runtime_details_report();
-
-        assert_eq!(report.bucket_drive_results.len(), MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS);
-        assert!(
-            report
-                .bucket_drive_results
-                .iter()
-                .any(|snapshot| snapshot.bucket == "bucket-0" && snapshot.count == 2)
-        );
-        assert!(
-            report
-                .bucket_drive_results
-                .iter()
-                .all(|snapshot| snapshot.bucket != "bucket-1")
-        );
-    }
-
-    #[tokio::test]
-    async fn scanner_bucket_drive_result_eviction_survives_full_refresh() {
-        let metrics = Metrics::new();
-        for index in 0..MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS {
-            metrics.record_scanner_bucket_drive_result(&format!("bucket-{index}"), "/data1", "success");
-        }
-        for index in 0..MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS {
-            metrics.record_scanner_bucket_drive_result(&format!("bucket-{index}"), "/data1", "success");
-        }
-        metrics.record_scanner_bucket_drive_result("overflow", "/data1", "success");
-
-        let report = metrics.scanner_runtime_details_report();
-
-        assert_eq!(report.bucket_drive_results.len(), MAX_SCANNER_BUCKET_DRIVE_RESULT_KEYS);
-        assert!(
-            report
-                .bucket_drive_results
-                .iter()
-                .any(|snapshot| snapshot.bucket == "overflow")
-        );
-        assert!(
-            report
-                .bucket_drive_results
-                .iter()
-                .all(|snapshot| snapshot.bucket != "bucket-0")
-        );
-    }
-
    #[tokio::test]
    async fn report_includes_usage_freshness_status() {
        let metrics = Metrics::new();
@@ -4665,7 +4234,7 @@ mod tests {
        let active = metrics.report().await;
        assert!(active.current_cycle_active);
        assert_eq!(active.current_cycle, 12);
-        assert_eq!(active.current_started, chrono_to_jiff_timestamp(cycle_started));
+        assert_eq!(active.current_started, cycle_started);

        let idle_cycle = CurrentCycle {
            current: 0,
@@ -4696,10 +4265,9 @@ mod tests {
        };
        let cycle_ten_start = metrics.start_scan_cycle_work_with_cycle(cycle_ten.clone()).await;
        metrics.operations[Metric::ScanObject as usize].store(1, Ordering::Relaxed);
-        metrics.record_scanner_bucket_drive_result("cycle-ten", "/data1", "partial");

        let paths = metrics.current_paths.write().await;
-        let mut report = Box::pin(metrics.report_with_runtime_details());
+        let mut report = Box::pin(metrics.report());
        let waker = std::task::Waker::noop();
        let mut context = std::task::Context::from_waker(waker);
        assert!(report.as_mut().poll(&mut context).is_pending());
@@ -4716,22 +4284,12 @@ mod tests {
            })
            .await;
        metrics.operations[Metric::ScanObject as usize].store(101, Ordering::Relaxed);
-        metrics.record_scanner_bucket_drive_result("cycle-eleven", "/data1", "partial");

        drop(paths);
-        let (snapshot, runtime_details) = report.await;
+        let snapshot = report.await;

        assert_eq!(snapshot.current_cycle, 10);
        assert_eq!(snapshot.current_cycle_objects_scanned, 1);
-        assert_eq!(
-            runtime_details.current_cycle_bucket_drive_results,
-            vec![ScannerBucketDriveResultSnapshot {
-                bucket: "cycle-ten".to_string(),
-                drive: "/data1".to_string(),
-                result: "partial".to_string(),
-                count: 1,
-            }]
-        );

        metrics
            .finish_scan_cycle_work_with_cycle(cycle_eleven_start, CurrentCycle::default())
@@ -1,17 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-/// Cross-crate lock identity used to fence table-bucket publication against
-/// object mutations that bypass the S3 request authorization layer.
-pub const TABLE_BUCKET_PUBLICATION_LOCK_PATH: &str = ".rustfs-table/warehouses/default/publication.lock";
@@ -13,14 +13,7 @@ categories = ["concurrency", "filesystem"]
 [lints]
 workspace = true

-[features]
-default = []
-hotpath = ["hotpath/hotpath", "hotpath/tokio", "rustfs-io-core/hotpath"]
-hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc", "rustfs-io-core/hotpath-alloc"]
-hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu", "rustfs-io-core/hotpath-cpu"]
-
 [dependencies]
-hotpath.workspace = true
 # Internal crates
 rustfs-io-core = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
@@ -25,7 +25,6 @@ keywords = ["configuration", "settings", "management", "rustfs", "Minio"]
 categories = ["web-programming", "development-tools", "config"]

 [dependencies]
-hotpath.workspace = true
 const-str = { workspace = true, optional = true, features = ["std", "proc"] }
 serde = { workspace = true, optional = true, features = ["derive"] }
 serde_json = { workspace = true, optional = true, features = ["raw_value"] }
@@ -35,9 +34,6 @@ workspace = true

 [features]
 default = ["constants"]
-hotpath = ["hotpath/hotpath"]
-hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
-hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
 audit = ["dep:const-str", "constants"]
 constants = ["dep:const-str"]
 notify = ["dep:const-str", "constants"]
@@ -97,14 +97,6 @@ Current guidance:
  - enables minimal payload mode for GET health responses (`status`, `ready` only).
 - `RUSTFS_HEALTH_READINESS_CACHE_TTL_MS`
  - TTL for readiness cache evaluation.
- `RUSTFS_HEALTH_OBJECT_PROGRESS_ENABLE`
-  - withdraws readiness when bounded object read/write stages stop completing while requests remain active.
-  - default is `true`.
- `RUSTFS_HEALTH_OBJECT_PROGRESS_TIMEOUT_MS`
-  - maximum time without completion in a bounded object stage before readiness is withdrawn.
-  - default is `30000`; `0` uses the default.
-  - the effective value is at least 5 seconds longer than `RUSTFS_OBJECT_LOCK_ACQUIRE_TIMEOUT`.
-  - this readiness SLO is independent of disk read/write failure deadlines and may withdraw traffic before those deadlines expire.
 - `RUSTFS_HEALTH_COMPAT_BUSY_CHECK_ENABLE`
  - enables busy protection behavior for health probes.
  - default is `false`.
@@ -230,19 +230,6 @@ pub const ENV_RUSTFS_KMS_ENABLE: &str = "RUSTFS_KMS_ENABLE";
 /// Default value: false
 pub const DEFAULT_KMS_ENABLE: bool = false;

-/// Environment variable enabling per-key KMS authorization on the SSE-KMS data path.
-///
-/// When enabled, an SSE-KMS write additionally requires `kms:GenerateDataKey` and an
-/// SSE-KMS read additionally requires `kms:Decrypt` on the resolved key, evaluated as
-/// the requesting identity. SSE-S3 and SSE-C are unaffected.
-pub const ENV_RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY: &str = "RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY";
-
-/// Default per-key KMS authorization mode for the SSE-KMS data path.
-///
-/// Off for now so deployments whose identity policies only grant s3 actions keep
-/// working; the default flips to on in a later release.
-pub const DEFAULT_KMS_ENFORCE_SSE_KEY_POLICY: bool = false;
-
 /// Environment variable for server KMS backend.
 pub const ENV_RUSTFS_KMS_BACKEND: &str = "RUSTFS_KMS_BACKEND";

@@ -353,11 +340,6 @@ pub const DEFAULT_OBS_TRACES_EXPORT_ENABLED: bool = true;
 /// Environment variable: RUSTFS_OBS_METRICS_EXPORT_ENABLED
 pub const DEFAULT_OBS_METRICS_EXPORT_ENABLED: bool = true;

-/// Default detailed PUT stage metrics enabled
-/// Default value: false
-/// Environment variable: RUSTFS_OBS_PUT_STAGE_METRICS_ENABLED
-pub const DEFAULT_OBS_PUT_STAGE_METRICS_ENABLED: bool = false;
-
 /// Default logs export enabled
 /// It is used to enable or disable exporting logs
 /// Default value: true
@@ -22,19 +22,6 @@ pub const DEFAULT_HEALTH_ENDPOINT_ENABLE: bool = true;
 pub const ENV_HEALTH_READINESS_CACHE_TTL_MS: &str = "RUSTFS_HEALTH_READINESS_CACHE_TTL_MS";
 pub const DEFAULT_HEALTH_READINESS_CACHE_TTL_MS: u64 = 1000;

-/// Enable readiness withdrawal when bounded object read/write stages stop
-/// completing while requests remain active.
-pub const ENV_HEALTH_OBJECT_PROGRESS_ENABLE: &str = "RUSTFS_HEALTH_OBJECT_PROGRESS_ENABLE";
-pub const DEFAULT_HEALTH_OBJECT_PROGRESS_ENABLE: bool = true;
-
-/// Requested time without completion in a bounded object stage before local
-/// readiness is withdrawn (milliseconds). A value of `0` uses the default;
-/// runtime adds a safety floor based on the object-lock acquisition timeout.
-pub const ENV_HEALTH_OBJECT_PROGRESS_TIMEOUT_MS: &str = "RUSTFS_HEALTH_OBJECT_PROGRESS_TIMEOUT_MS";
-pub const DEFAULT_HEALTH_OBJECT_PROGRESS_TIMEOUT_MS: u64 = 30_000;
-/// Additional time beyond the configured object-lock acquisition deadline.
-pub const HEALTH_OBJECT_PROGRESS_LOCK_MARGIN_MS: u64 = 5_000;
-
 /// Timeout for cluster health readiness collectors (milliseconds).
 /// This bounds expensive storage and lock quorum checks used by cluster probes.
 pub const ENV_HEALTH_CLUSTER_TIMEOUT_MS: &str = "RUSTFS_HEALTH_CLUSTER_TIMEOUT_MS";
@@ -177,9 +177,10 @@ const _: () = assert!(!DEFAULT_INTERNODE_RPC_REPLAY_SCOPE_STRICT);
 ///
 /// The cache retains each nonce for the ~10-minute signature freshness envelope. Once peers use
 /// replay-scoped v3 authentication, every authenticated RPC consumes one entry, so the steady
-/// state holds roughly `authenticated RPC RPS x 601s` entries. This default is the minimum floor:
-/// explicit operator values and resource-aware auto sizing both clamp upward to at least this
-/// value. Overflow fails closed — legitimate signed traffic is the only thing that can fill the
+/// state holds roughly `authenticated RPC RPS x 601s` entries. The default sustains about 1,700
+/// authenticated RPCs per second (about 120 MiB worst case, allocated only under sustained load);
+/// operators must size it for the node's aggregate peak RPC rate before enabling strict replay
+/// scope. Overflow fails closed — legitimate signed traffic is the only thing that can fill the
 /// cache (replays are rejected before insertion, and an attacker cannot mint valid nonces without
 /// the shared secret) — and increments
 /// `rustfs_system_network_internode_replay_cache_overflow_total`, so a sustained non-zero overflow
@@ -137,21 +137,6 @@ pub const DEFAULT_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED: bool = false;
 const _: () = assert!(!DEFAULT_TIER_REMOTE_VERSION_STATE_WRITE);
 const _: () = assert!(!DEFAULT_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED);

-/// Request preserving legacy per-part checksum metadata during data movement.
-///
-/// This remains ineffective until
-/// [`ENV_DATA_MOVEMENT_PART_CHECKSUMS_FLEET_CONFIRMED`] is also enabled.
-pub const ENV_DATA_MOVEMENT_PART_CHECKSUMS_WRITE: &str = "RUSTFS_DATA_MOVEMENT_PART_CHECKSUMS_WRITE";
-pub const DEFAULT_DATA_MOVEMENT_PART_CHECKSUMS_WRITE: bool = false;
-
-/// Operator-attested confirmation that every serving node understands the
-/// data-movement per-part checksum sidecar.
-pub const ENV_DATA_MOVEMENT_PART_CHECKSUMS_FLEET_CONFIRMED: &str = "RUSTFS_DATA_MOVEMENT_PART_CHECKSUMS_FLEET_CONFIRMED";
-pub const DEFAULT_DATA_MOVEMENT_PART_CHECKSUMS_FLEET_CONFIRMED: bool = false;
-
-const _: () = assert!(!DEFAULT_DATA_MOVEMENT_PART_CHECKSUMS_WRITE);
-const _: () = assert!(!DEFAULT_DATA_MOVEMENT_PART_CHECKSUMS_FLEET_CONFIRMED);
-
 // =============================================================================
 // Concurrent Request Fix - Timeout and Backpressure Configuration
 // =============================================================================
@@ -664,13 +649,4 @@ mod remote_version_state_tests {
            "RUSTFS_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED"
        );
    }
-
-    #[test]
-    fn data_movement_part_checksum_gate_uses_stable_environment_names() {
-        assert_eq!(super::ENV_DATA_MOVEMENT_PART_CHECKSUMS_WRITE, "RUSTFS_DATA_MOVEMENT_PART_CHECKSUMS_WRITE");
-        assert_eq!(
-            super::ENV_DATA_MOVEMENT_PART_CHECKSUMS_FLEET_CONFIRMED,
-            "RUSTFS_DATA_MOVEMENT_PART_CHECKSUMS_FLEET_CONFIRMED"
-        );
-    }
 }
@@ -81,9 +81,6 @@ pub const ENV_TEST_IAM_FAIL_INIT_ATTEMPTS: &str = "RUSTFS_TEST_IAM_FAIL_INIT_ATT
 pub const ENV_TEST_IAM_RETRY_INTERVAL_MS: &str = "RUSTFS_TEST_IAM_RETRY_INTERVAL_MS";
 /// Runtime env var controlling the transition worker count.
 pub const ENV_TRANSITION_WORKERS: &str = "RUSTFS_MAX_TRANSITION_WORKERS";
-/// Runtime env var controlling the ILM expiry worker count. A set, parsable,
-/// non-zero value wins; anything else falls back to `min(cpus, 16)`.
-pub const ENV_MAX_EXPIRY_WORKERS: &str = "RUSTFS_MAX_EXPIRY_WORKERS";
 /// Runtime env var controlling the absolute maximum transition workers.
 pub const ENV_TRANSITION_WORKERS_ABSOLUTE_MAX: &str = "RUSTFS_ABSOLUTE_MAX_WORKERS";
 /// Runtime env var controlling the transition queue capacity.
@@ -36,11 +36,6 @@ pub const ENV_TRUST_SYSTEM_CA: &str = "RUSTFS_TRUST_SYSTEM_CA";
 /// To change this behavior, set the environment variable RUSTFS_TRUST_SYSTEM_CA=1
 pub const DEFAULT_TRUST_SYSTEM_CA: bool = false;

-/// Environment variable for an extra outbound root CA certificate bundle.
-/// Use this to trust an internal CA for outbound HTTPS clients without replacing
-/// the default operating-system/web PKI roots via SSL_CERT_FILE.
-pub const ENV_RUSTFS_EXTRA_CA_CERT: &str = "RUSTFS_EXTRA_CA_CERT";
-
 /// Environment variable to trust leaf certificates as CA
 /// When set to "1", RustFS will treat leaf certificates as CA certificates for trust validation.
 /// By default, this is disabled.
@@ -44,10 +44,6 @@ pub const ENV_OBS_METRICS_EXPORT_ENABLED: &str = "RUSTFS_OBS_METRICS_EXPORT_ENAB
 pub const ENV_OBS_LOGS_EXPORT_ENABLED: &str = "RUSTFS_OBS_LOGS_EXPORT_ENABLED";
 pub const ENV_OBS_PROFILING_EXPORT_ENABLED: &str = "RUSTFS_OBS_PROFILING_EXPORT_ENABLED";

-/// Enables detailed per-stage PUT metrics. Disabled by default because each
-/// PUT records multiple timers and histograms when attribution is active.
-pub const ENV_OBS_PUT_STAGE_METRICS_ENABLED: &str = "RUSTFS_OBS_PUT_STAGE_METRICS_ENABLED";
-
 pub const ENV_OBS_LOGGER_LEVEL: &str = "RUSTFS_OBS_LOGGER_LEVEL";
 pub const ENV_OBS_LOG_STDOUT_ENABLED: &str = "RUSTFS_OBS_LOG_STDOUT_ENABLED";
 pub const ENV_OBS_LOG_DIRECTORY: &str = "RUSTFS_OBS_LOG_DIRECTORY";
@@ -145,7 +141,6 @@ mod tests {
        assert_eq!(ENV_OBS_METRICS_EXPORT_ENABLED, "RUSTFS_OBS_METRICS_EXPORT_ENABLED");
        assert_eq!(ENV_OBS_LOGS_EXPORT_ENABLED, "RUSTFS_OBS_LOGS_EXPORT_ENABLED");
        assert_eq!(ENV_OBS_PROFILING_EXPORT_ENABLED, "RUSTFS_OBS_PROFILING_EXPORT_ENABLED");
-        assert_eq!(ENV_OBS_PUT_STAGE_METRICS_ENABLED, "RUSTFS_OBS_PUT_STAGE_METRICS_ENABLED");
        // Test log cleanup related env keys
        assert_eq!(ENV_OBS_LOG_MAX_TOTAL_SIZE_BYTES, "RUSTFS_OBS_LOG_MAX_TOTAL_SIZE_BYTES");
        assert_eq!(ENV_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES, "RUSTFS_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES");
@@ -24,14 +24,7 @@ description = "Credentials management utilities for RustFS, enabling secure hand
 keywords = ["rustfs", "Minio", "credentials", "authentication", "authorization"]
 categories = ["web-programming", "development-tools", "data-structures", "security"]

-[features]
-default = []
-hotpath = ["hotpath/hotpath"]
-hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
-hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
-
 [dependencies]
-hotpath.workspace = true
 base64-simd = { workspace = true }
 hmac = { workspace = true }
 rand = { workspace = true, features = ["serde"] }
@@ -29,7 +29,6 @@ documentation = "https://docs.rs/rustfs-crypto/latest/rustfs_crypto/"
 workspace = true

 [dependencies]
-hotpath.workspace = true
 aes-gcm = { workspace = true, optional = true, features = ["rand_core"] }
 argon2 = { workspace = true, optional = true }
 chacha20poly1305 = { workspace = true, optional = true }
@@ -50,9 +49,6 @@ time = { workspace = true, features = ["parsing", "formatting", "macros", "serde

 [features]
 default = ["crypto", "fips"]
-hotpath = ["hotpath/hotpath"]
-hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc"]
-hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu"]
 fips = []
 crypto = [
    "dep:aes-gcm",
@@ -27,16 +27,10 @@ categories = ["data-structures", "filesystem"]
 [lints]
 workspace = true

-[features]
-default = []
-hotpath = ["hotpath/hotpath", "rustfs-filemeta/hotpath"]
-hotpath-alloc = ["hotpath", "hotpath/hotpath-alloc", "rustfs-filemeta/hotpath-alloc"]
-hotpath-cpu = ["hotpath", "hotpath/hotpath-cpu", "rustfs-filemeta/hotpath-cpu"]
-
 [dependencies]
-hotpath.workspace = true
 serde = { workspace = true, features = ["derive"] }
 rmp-serde = { workspace = true }
+async-trait = { workspace = true }
 rustfs-filemeta = { workspace = true }

 [lib]
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-use serde::{Deserialize, Serialize, ser::SerializeMap as _};
+use serde::{Deserialize, Serialize};
 use std::{
    collections::{HashMap, HashSet},
    hash::{DefaultHasher, Hash, Hasher},
@@ -37,10 +37,6 @@ pub const USAGE_LAST_UPDATE_FUTURE_TOLERANCE: Duration = Duration::from_secs(5 *
 /// Keeping the existing object name preserves rolling-upgrade and rollback
 /// compatibility without allowing an ambiguous snapshot to become authoritative.
 pub const DATA_USAGE_OBJECT_NAME: &str = ".usage.v2.json";
-/// Latest structurally complete scanner observation. Unlike
-/// [`DATA_USAGE_OBJECT_NAME`], this object is never authoritative for quota
-/// admission because namespace activity may have raced the scan.
-pub const DATA_USAGE_OBSERVED_OBJECT_NAME: &str = ".usage.observed.json";

 /// Usage snapshot written by scanner implementations predating distributed
 /// leadership fencing. It is read only when neither authoritative snapshot
@@ -55,36 +51,24 @@ pub fn usage_last_update_is_untrusted_future(existing_last_update: SystemTime, n
    existing_last_update > now + USAGE_LAST_UPDATE_FUTURE_TOLERANCE
 }

-#[derive(Clone, Copy, Default, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Clone, Copy, Default, Debug, Serialize, Deserialize, PartialEq)]
 pub struct TierStats {
    pub total_size: u64,
-    pub num_versions: u64,
-    pub num_objects: u64,
+    pub num_versions: i32,
+    pub num_objects: i32,
 }

 impl TierStats {
    pub fn add(&self, u: &TierStats) -> TierStats {
        TierStats {
-            total_size: self.total_size.saturating_add(u.total_size),
-            num_versions: self.num_versions.saturating_add(u.num_versions),
-            num_objects: self.num_objects.saturating_add(u.num_objects),
+            total_size: self.total_size + u.total_size,
+            num_versions: self.num_versions + u.num_versions,
+            num_objects: self.num_objects + u.num_objects,
        }
    }
-
-    /// True when [`TierStats::add`] would report the exact sum instead of saturating.
-    pub fn fits_add(&self, u: &TierStats) -> bool {
-        self.total_size.checked_add(u.total_size).is_some()
-            && self.num_versions.checked_add(u.num_versions).is_some()
-            && self.num_objects.checked_add(u.num_objects).is_some()
-    }
-
-    /// True when this tier contributed nothing, i.e. merging it is a no-op.
-    pub fn is_empty(&self) -> bool {
-        self.total_size == 0 && self.num_versions == 0 && self.num_objects == 0
-    }
 }

-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq)]
 pub struct AllTierStats {
    pub tiers: HashMap<String, TierStats>,
 }
@@ -94,35 +78,31 @@ impl AllTierStats {
        Self { tiers: HashMap::new() }
    }

-    pub fn is_empty(&self) -> bool {
-        self.tiers.is_empty()
-    }
-
-    /// Folds a scan summary's per-tier map in.
-    ///
-    /// Scanners seed the map with a zeroed entry for every configured tier, so
-    /// empty contributions are skipped to keep the persisted cache from growing
-    /// one key per tier on every folder that never held tiered data.
-    pub fn add_sizes(&mut self, tiers: &HashMap<String, TierStats>) {
+    pub fn add_sizes(&mut self, tiers: HashMap<String, TierStats>) {
        for (tier, st) in tiers {
-            if st.is_empty() {
-                continue;
-            }
-            let entry = self.tiers.entry(tier.clone()).or_default();
-            *entry = entry.add(st);
+            self.tiers
+                .insert(tier.clone(), self.tiers.get(&tier).copied().unwrap_or_default().add(&st));
        }
    }

-    pub fn merge(&mut self, other: &AllTierStats) {
-        self.add_sizes(&other.tiers);
+    pub fn merge(&mut self, other: AllTierStats) {
+        for (tier, st) in other.tiers {
+            self.tiers
+                .insert(tier.clone(), self.tiers.get(&tier).copied().unwrap_or_default().add(&st));
+        }
    }

-    /// True when [`AllTierStats::merge`] would report exact sums for every tier.
-    pub fn fits_merge(&self, other: &AllTierStats) -> bool {
-        other
-            .tiers
-            .iter()
-            .all(|(tier, right)| self.tiers.get(tier).is_none_or(|left| left.fits_add(right)))
+    pub fn populate_stats(&self, stats: &mut HashMap<String, TierStats>) {
+        for (tier, st) in &self.tiers {
+            stats.insert(
+                tier.clone(),
+                TierStats {
+                    total_size: st.total_size,
+                    num_versions: st.num_versions,
+                    num_objects: st.num_objects,
+                },
+            );
+        }
    }
 }

@@ -203,14 +183,6 @@ pub struct DataUsageInfo {
    pub objects_total_size: u64,
    /// Replication info across all buckets
    pub replication_info: HashMap<String, BucketTargetUsageInfo>,
-    /// Usage per storage class and remote tier across all buckets.
-    ///
-    /// Absent on snapshots written before per-tier accounting was published,
-    /// and on clusters with no remote tier configured: the scanner classifies
-    /// objects by tier (including `STANDARD`/`REDUCED_REDUNDANCY`) only once a
-    /// tier exists, so an absent value means "not accounted", never "zero".
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tier_stats: Option<AllTierStats>,

    /// Total number of buckets in this cluster
    pub buckets_count: u64,
@@ -222,20 +194,6 @@ pub struct DataUsageInfo {
    /// explicit entry for every bucket, including confirmed-empty buckets.
    #[serde(default)]
    pub usage_snapshot_complete: bool,
-    /// Whether no namespace activity or dirty-usage generation changed while
-    /// the coordinated snapshot was being produced.
-    ///
-    /// `false` still describes a structurally complete, useful point-in-time
-    /// usage view, but follow-up scanner work remains pending. `None` is kept
-    /// for snapshots written before this status became observable.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub usage_snapshot_converged: Option<bool>,
-    /// Identity of the authoritative snapshot from which a nonconverged
-    /// observation started. Admin readers require an exact match before using
-    /// the observation, so bucket namespace mutations fence old observations
-    /// without relying on synchronized clocks.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub usage_snapshot_authoritative_baseline: Option<DataUsageSnapshotIdentity>,
    /// Deprecated kept here for backward compatibility reasons
    pub bucket_sizes: HashMap<String, u64>,
    /// Per-disk snapshot information when available
@@ -243,59 +201,6 @@ pub struct DataUsageInfo {
    pub disk_usage_status: Vec<DiskUsageStatus>,
 }

-/// Stable identity fields changed by both coordinated scanner publication and
-/// backward-compatible bucket namespace cleanup.
-#[derive(Debug, Default, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
-pub struct DataUsageSnapshotIdentity {
-    pub last_update: Option<SystemTime>,
-    pub scanner_cycle: Option<u64>,
-    pub scanner_epoch: Option<u64>,
-}
-
-impl DataUsageInfo {
-    pub fn snapshot_identity(&self) -> DataUsageSnapshotIdentity {
-        DataUsageSnapshotIdentity {
-            last_update: self.last_update,
-            scanner_cycle: self.scanner_cycle,
-            scanner_epoch: self.scanner_epoch,
-        }
-    }
-}
-
-/// Return whether `candidate` was produced after `baseline`.
-///
-/// New coordinated snapshots are ordered by leadership epoch and scanner
-/// cycle. The timestamp fallback preserves ordering for legacy snapshots that
-/// predate those fields.
-pub fn data_usage_snapshot_is_newer(candidate: &DataUsageInfo, baseline: &DataUsageInfo) -> bool {
-    match (
-        candidate.scanner_epoch.zip(candidate.scanner_cycle),
-        baseline.scanner_epoch.zip(baseline.scanner_cycle),
-    ) {
-        (Some(candidate), Some(baseline)) => candidate > baseline,
-        (Some(_), None) => true,
-        (None, Some(_)) => false,
-        (None, None) => match (candidate.last_update, baseline.last_update) {
-            (Some(candidate), Some(baseline)) => candidate > baseline,
-            (Some(_), None) => true,
-            (None, Some(_) | None) => false,
-        },
-    }
-}
-
-/// Return whether a nonconverged observation may safely supersede the admin
-/// view of `authoritative`.
-///
-/// The exact baseline identity is independent of clock ordering. Older binaries
-/// already advance the authoritative timestamp when deleting a bucket, so a
-/// rollback delete/recreate fences the previous bucket incarnation too.
-pub fn observed_data_usage_is_newer(observed: &DataUsageInfo, authoritative: &DataUsageInfo) -> bool {
-    observed.usage_snapshot_converged == Some(false)
-        && observed.is_complete_bucket_usage_snapshot()
-        && observed.usage_snapshot_authoritative_baseline.as_ref() == Some(&authoritative.snapshot_identity())
-        && data_usage_snapshot_is_newer(observed, authoritative)
-}
-
 /// Metadata describing the status of a disk-level data usage snapshot.
 #[derive(Debug, Default, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct DiskUsageStatus {
@@ -657,7 +562,7 @@ impl ReplicationAllStats {
 }

 /// Data usage cache entry
-#[derive(Clone, Debug, Default, Deserialize)]
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
 pub struct DataUsageEntry {
    pub children: DataUsageHashMap,
    // These fields do not include any children.
@@ -672,34 +577,6 @@ pub struct DataUsageEntry {
    /// Number of objects that failed to scan (e.g., IO errors)
    #[serde(default)]
    pub failed_objects: usize,
-    /// Per-tier usage contributed by this entry, present only once a scan
-    /// observed tier-classified objects.
-    #[serde(default)]
-    pub all_tier_stats: Option<AllTierStats>,
-}
-
-impl Serialize for DataUsageEntry {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: serde::Serializer,
-    {
-        // Keep entries map-encoded so older readers can ignore fields appended
-        // by newer scanner versions during rolling upgrades. The derived
-        // (array) encoding made any appended field a decode error for them.
-        let mut state = serializer.serialize_map(Some(11))?;
-        state.serialize_entry("children", &self.children)?;
-        state.serialize_entry("size", &self.size)?;
-        state.serialize_entry("objects", &self.objects)?;
-        state.serialize_entry("versions", &self.versions)?;
-        state.serialize_entry("delete_markers", &self.delete_markers)?;
-        state.serialize_entry("obj_sizes", &self.obj_sizes)?;
-        state.serialize_entry("obj_versions", &self.obj_versions)?;
-        state.serialize_entry("replication_stats", &self.replication_stats)?;
-        state.serialize_entry("compacted", &self.compacted)?;
-        state.serialize_entry("failed_objects", &self.failed_objects)?;
-        state.serialize_entry("all_tier_stats", &self.all_tier_stats)?;
-        state.end()
-    }
 }

 impl DataUsageEntry {
@@ -758,22 +635,10 @@ impl DataUsageEntry {
            }
        }

-        if let Some(o_tiers) = other.all_tier_stats.as_ref().filter(|tiers| !tiers.is_empty()) {
-            self.all_tier_stats.get_or_insert_with(AllTierStats::new).merge(o_tiers);
-        }
-
        self.obj_sizes.merge_from(&other.obj_sizes);
        self.obj_versions.merge_from(&other.obj_versions);
    }

-    /// Folds a scan summary's per-tier map into this entry.
-    pub fn add_tier_sizes(&mut self, tiers: &HashMap<String, TierStats>) {
-        if tiers.values().all(TierStats::is_empty) {
-            return;
-        }
-        self.all_tier_stats.get_or_insert_with(AllTierStats::new).add_sizes(tiers);
-    }
-
    pub fn checked_merge(&mut self, other: &DataUsageEntry) -> bool {
        let scalar_counts_fit = self.objects.checked_add(other.objects).is_some()
            && self.versions.checked_add(other.versions).is_some()
@@ -833,12 +698,7 @@ impl DataUsageEntry {
            }
        };

-        let tier_stats_fit = match (&self.all_tier_stats, &other.all_tier_stats) {
-            (_, None) | (None, Some(_)) => true,
-            (Some(left), Some(right)) => left.fits_merge(right),
-        };
-
-        if !scalar_counts_fit || !histograms_fit || !replication_fits || !tier_stats_fit {
+        if !scalar_counts_fit || !histograms_fit || !replication_fits {
            return false;
        }
        self.merge(other);
@@ -846,15 +706,8 @@ impl DataUsageEntry {
    }
 }

-/// Read-only projection of the scanner's `.usage-cache.bin` info block.
-///
-/// The canonical wire format is written by the hand-written map-encoded
-/// `Serialize` on the scanner-side `DataUsageCacheInfo`
-/// (`crates/scanner/src/data_usage_define.rs`), which carries 16 fields.
-/// This type decodes only the shared subset and is deliberately not
-/// `Serialize`: a derived (array) encoding of this 6-field subset would
-/// corrupt the cache for scanner readers, so no write path may exist here.
-#[derive(Clone, Debug, Default, Deserialize)]
+/// Data usage cache info
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
 pub struct DataUsageCacheInfo {
    pub name: String,
    pub next_cycle: u64,
@@ -870,12 +723,8 @@ pub struct DataUsageCacheInfo {
    pub snapshot_complete: bool,
 }

-/// Read-only projection of a scanner-written `.usage-cache.bin` file.
-///
-/// The scanner-side `DataUsageCache` (`crates/scanner/src/data_usage_define.rs`)
-/// owns the persisted format; this type only decodes it (see
-/// [`DataUsageCacheInfo`]) and must never grow a serialization path.
-#[derive(Clone, Debug, Default, Deserialize)]
+/// Data usage cache
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
 pub struct DataUsageCache {
    pub info: DataUsageCacheInfo,
    pub cache: HashMap<String, DataUsageEntry>,
@@ -1189,7 +1038,6 @@ impl DataUsageCache {
            versions_total_count: flat.versions as u64,
            delete_markers_total_count: flat.delete_markers as u64,
            objects_total_size: flat.size as u64,
-            tier_stats: flat.all_tier_stats.filter(|tiers| !tiers.is_empty()),
            buckets_count: u64::try_from(buckets.len()).unwrap_or(u64::MAX),
            buckets_usage,
            usage_snapshot_complete: self.info.snapshot_complete,
@@ -1197,10 +1045,31 @@ impl DataUsageCache {
        }
    }

+    pub fn marshal_msg(&self) -> Result<Vec<u8>, Box<dyn std::error::Error + Send + Sync>> {
+        let mut buf = Vec::new();
+        self.serialize(&mut rmp_serde::Serializer::new(&mut buf))?;
+        Ok(buf)
+    }
+
    pub fn unmarshal(buf: &[u8]) -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
        let t: Self = rmp_serde::from_slice(buf)?;
        Ok(t)
    }
+
+    // Note: load and save methods are storage-specific and should be implemented
+    // in the ecstore crate where storage access is available
+}
+
+/// Trait for storage-specific operations on DataUsageCache
+#[async_trait::async_trait]
+pub trait DataUsageCacheStorage {
+    /// Load data usage cache from backend storage
+    async fn load(store: &dyn std::any::Any, name: &str) -> Result<Self, Box<dyn std::error::Error + Send + Sync>>
+    where
+        Self: Sized;
+
+    /// Save data usage cache to backend storage
+    async fn save(&self, name: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>>;
 }

 // Helper structs and functions for cache operations
@@ -1656,248 +1525,6 @@ mod tests {
        buckets_count: u64,
    }

-    fn tier_entry(tier: &str, stats: TierStats) -> DataUsageEntry {
-        let mut entry = DataUsageEntry::default();
-        entry.add_tier_sizes(&HashMap::from([(tier.to_string(), stats)]));
-        entry
-    }
-
-    #[test]
-    fn tier_stats_survive_entry_merge() {
-        let mut left = tier_entry(
-            "WARM",
-            TierStats {
-                total_size: 10,
-                num_versions: 2,
-                num_objects: 1,
-            },
-        );
-        let mut right = tier_entry(
-            "WARM",
-            TierStats {
-                total_size: 5,
-                num_versions: 1,
-                num_objects: 1,
-            },
-        );
-        right.add_tier_sizes(&HashMap::from([(
-            "COLD".to_string(),
-            TierStats {
-                total_size: 7,
-                num_versions: 1,
-                num_objects: 0,
-            },
-        )]));
-
-        assert!(left.checked_merge(&right), "merging exact tier totals must be accepted");
-
-        let tiers = &left.all_tier_stats.expect("merged entry keeps tier stats").tiers;
-        assert_eq!(
-            tiers.get("WARM"),
-            Some(&TierStats {
-                total_size: 15,
-                num_versions: 3,
-                num_objects: 2,
-            })
-        );
-        assert_eq!(
-            tiers.get("COLD"),
-            Some(&TierStats {
-                total_size: 7,
-                num_versions: 1,
-                num_objects: 0,
-            })
-        );
-    }
-
-    #[test]
-    fn tier_stats_merge_into_an_untiered_entry() {
-        let mut left = DataUsageEntry::default();
-        let right = tier_entry(
-            "WARM",
-            TierStats {
-                total_size: 10,
-                num_versions: 1,
-                num_objects: 1,
-            },
-        );
-
-        assert!(left.checked_merge(&right));
-
-        assert_eq!(
-            left.all_tier_stats.expect("tier stats adopted from the merged entry").tiers["WARM"],
-            TierStats {
-                total_size: 10,
-                num_versions: 1,
-                num_objects: 1,
-            }
-        );
-    }
-
-    #[test]
-    fn checked_merge_rejects_overflowing_tier_totals() {
-        let mut left = tier_entry(
-            "WARM",
-            TierStats {
-                total_size: u64::MAX,
-                num_versions: 1,
-                num_objects: 1,
-            },
-        );
-        let right = tier_entry(
-            "WARM",
-            TierStats {
-                total_size: 1,
-                num_versions: 1,
-                num_objects: 1,
-            },
-        );
-
-        assert!(!left.checked_merge(&right), "saturating tier totals must not be published");
-        assert_eq!(left.all_tier_stats.expect("left is untouched").tiers["WARM"].total_size, u64::MAX);
-    }
-
-    /// Entry shape released before per-tier accounting, using the derived
-    /// (array) encoding those writers produced.
-    #[derive(Serialize, Deserialize)]
-    struct LegacyEntry {
-        children: DataUsageHashMap,
-        size: usize,
-        objects: usize,
-        versions: usize,
-        delete_markers: usize,
-        obj_sizes: SizeHistogram,
-        obj_versions: VersionsHistogram,
-        replication_stats: Option<ReplicationAllStats>,
-        compacted: bool,
-        #[serde(default)]
-        failed_objects: usize,
-    }
-
-    #[test]
-    fn entries_are_map_encoded_so_appended_fields_stay_readable() {
-        // A derived (array) encoding turns every appended field into a decode
-        // error for readers built before it existed, which would cost a mixed
-        // -version cluster its whole scan cache. Entries must stay map-encoded.
-        let current = tier_entry(
-            "WARM",
-            TierStats {
-                total_size: 3,
-                num_versions: 1,
-                num_objects: 1,
-            },
-        );
-        let mut encoded = Vec::new();
-        current
-            .serialize(&mut rmp_serde::Serializer::new(&mut encoded))
-            .expect("encode current entry");
-
-        let legacy: LegacyEntry = rmp_serde::from_slice(&encoded).expect("legacy reader should ignore the appended field");
-        assert_eq!(legacy.objects, 0);
-    }
-
-    #[test]
-    fn legacy_array_encoded_entries_still_load() {
-        let legacy = LegacyEntry {
-            children: DataUsageHashMap::default(),
-            size: 12,
-            objects: 3,
-            versions: 4,
-            delete_markers: 1,
-            obj_sizes: SizeHistogram::default(),
-            obj_versions: VersionsHistogram::default(),
-            replication_stats: None,
-            compacted: false,
-            failed_objects: 2,
-        };
-        let mut encoded = Vec::new();
-        legacy
-            .serialize(&mut rmp_serde::Serializer::new(&mut encoded))
-            .expect("encode legacy entry");
-
-        let decoded: DataUsageEntry = rmp_serde::from_slice(&encoded).expect("current reader should default the missing field");
-
-        assert_eq!(decoded.size, 12);
-        assert_eq!(decoded.failed_objects, 2);
-        assert!(decoded.all_tier_stats.is_none());
-    }
-
-    /// Scanner-written `.usage-cache.bin` bytes: a 2-element array of the
-    /// canonical 16-field map-encoded info block and one map-encoded entry.
-    /// Captured from the canonical writer's `marshal_msg` — see
-    /// `usage_cache_wire_format_is_pinned` in
-    /// `crates/scanner/src/data_usage_define.rs`, which pins these exact
-    /// bytes and documents regeneration. Hardcoded here because a
-    /// dev-dependency on rustfs-scanner would pull the whole ecstore tree
-    /// into this crate's test build, and a fixture generated at test runtime
-    /// could not detect writer drift anyway.
-    const SCANNER_USAGE_CACHE_WIRE_FIXTURE: &[u8] = &[
-        0x92, 0xde, 0x00, 0x10, 0xa4, 0x6e, 0x61, 0x6d, 0x65, 0xab, 0x77, 0x69, 0x72, 0x65, 0x2d, 0x62, 0x75, 0x63, 0x6b, 0x65,
-        0x74, 0xaa, 0x6e, 0x65, 0x78, 0x74, 0x5f, 0x63, 0x79, 0x63, 0x6c, 0x65, 0x07, 0xac, 0x6c, 0x65, 0x61, 0x64, 0x65, 0x72,
-        0x5f, 0x65, 0x70, 0x6f, 0x63, 0x68, 0x09, 0xab, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x92,
-        0xce, 0x65, 0x53, 0xf1, 0x00, 0x00, 0xac, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x68, 0x65, 0x61, 0x6c, 0x69, 0x6e, 0x67, 0xc3,
-        0xa9, 0x6c, 0x69, 0x66, 0x65, 0x63, 0x79, 0x63, 0x6c, 0x65, 0xc0, 0xab, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74,
-        0x69, 0x6f, 0x6e, 0xc0, 0xae, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x81,
-        0xb0, 0x77, 0x69, 0x72, 0x65, 0x2d, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x2f, 0x6c, 0x6f, 0x73, 0x74, 0x0b, 0xb1, 0x73,
-        0x63, 0x61, 0x6e, 0x5f, 0x72, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x5f, 0x61, 0x66, 0x74, 0x65, 0x72, 0xb2, 0x77, 0x69, 0x72,
-        0x65, 0x2d, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x2f, 0x72, 0x65, 0x73, 0x75, 0x6d, 0x65, 0xaf, 0x73, 0x63, 0x61, 0x6e,
-        0x5f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0xc0, 0xad, 0x70, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67,
-        0x5f, 0x68, 0x65, 0x61, 0x6c, 0x73, 0x91, 0x9a, 0xa6, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0xab, 0x77, 0x69, 0x72, 0x65,
-        0x2d, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0xa6, 0x62, 0x72, 0x6f, 0x6b, 0x65, 0x6e, 0xc0, 0x01, 0x64, 0xcc, 0xc8, 0x03,
-        0xa8, 0x64, 0x65, 0x66, 0x65, 0x72, 0x72, 0x65, 0x64, 0xa6, 0x62, 0x75, 0x64, 0x67, 0x65, 0x74, 0xab, 0x6f, 0x62, 0x6a,
-        0x65, 0x63, 0x74, 0x5f, 0x6c, 0x6f, 0x63, 0x6b, 0xc0, 0xa6, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x92, 0x01, 0x02, 0xb1,
-        0x73, 0x6e, 0x61, 0x70, 0x73, 0x68, 0x6f, 0x74, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0xc3, 0xb0, 0x73,
-        0x63, 0x61, 0x6e, 0x5f, 0x70, 0x6c, 0x61, 0x6e, 0x5f, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0xdc, 0x00, 0x20, 0x03, 0x03,
-        0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
-        0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0xb0, 0x63, 0x61, 0x63, 0x68, 0x65, 0x5f, 0x6b, 0x65, 0x79,
-        0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x01, 0x81, 0xab, 0x77, 0x69, 0x72, 0x65, 0x2d, 0x62, 0x75, 0x63, 0x6b, 0x65,
-        0x74, 0x8b, 0xa8, 0x63, 0x68, 0x69, 0x6c, 0x64, 0x72, 0x65, 0x6e, 0x90, 0xa4, 0x73, 0x69, 0x7a, 0x65, 0xcd, 0x10, 0x00,
-        0xa7, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x03, 0xa8, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x05, 0xae,
-        0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x01, 0xa9, 0x6f, 0x62, 0x6a, 0x5f,
-        0x73, 0x69, 0x7a, 0x65, 0x73, 0x9b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xac, 0x6f, 0x62,
-        0x6a, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x97, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb1, 0x72,
-        0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x73, 0xc0, 0xa9, 0x63, 0x6f,
-        0x6d, 0x70, 0x61, 0x63, 0x74, 0x65, 0x64, 0xc3, 0xae, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x5f, 0x6f, 0x62, 0x6a, 0x65,
-        0x63, 0x74, 0x73, 0x02, 0xae, 0x61, 0x6c, 0x6c, 0x5f, 0x74, 0x69, 0x65, 0x72, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x73, 0x91,
-        0x81, 0xa4, 0x57, 0x41, 0x52, 0x4d, 0x93, 0xcd, 0x08, 0x00, 0x02, 0x01,
-    ];
-
-    #[test]
-    fn thin_usage_cache_decodes_scanner_wire_fixture() {
-        let decoded =
-            DataUsageCache::unmarshal(SCANNER_USAGE_CACHE_WIRE_FIXTURE).expect("thin projection decodes a scanner-written cache");
-
-        // The six fields shared with the scanner's 16-field info block; the
-        // remaining ten (lifecycle, replication, checkpoint, heals, ...) must
-        // be skipped, not error.
-        assert_eq!(decoded.info.name, "wire-bucket");
-        assert_eq!(decoded.info.next_cycle, 7);
-        assert_eq!(
-            decoded.info.last_update,
-            Some(SystemTime::UNIX_EPOCH + Duration::from_secs(1_700_000_000))
-        );
-        assert!(decoded.info.skip_healing);
-        assert_eq!(decoded.info.failed_objects.get("wire-bucket/lost"), Some(&11));
-        assert!(decoded.info.snapshot_complete);
-
-        // Entries use the shared canonical map-encoded type end to end.
-        let entry = decoded.cache.get("wire-bucket").expect("fixture entry decodes");
-        assert_eq!(entry.size, 4096);
-        assert_eq!(entry.objects, 3);
-        assert_eq!(entry.versions, 5);
-        assert_eq!(entry.delete_markers, 1);
-        assert!(entry.compacted);
-        assert_eq!(entry.failed_objects, 2);
-        assert_eq!(
-            entry.all_tier_stats.as_ref().and_then(|tiers| tiers.tiers.get("WARM")),
-            Some(&TierStats {
-                total_size: 2048,
-                num_versions: 2,
-                num_objects: 1,
-            })
-        );
-    }
-
    #[test]
    fn hash_path_uses_portable_slash_semantics() {
        for (input, expected) in [
@@ -1920,8 +1547,6 @@ mod tests {
        let current = DataUsageInfo {
            last_update: Some(SystemTime::UNIX_EPOCH),
            usage_snapshot_complete: true,
-            usage_snapshot_converged: Some(false),
-            usage_snapshot_authoritative_baseline: Some(DataUsageSnapshotIdentity::default()),
            ..Default::default()
        };
        let encoded = rmp_serde::to_vec_named(&current).expect("encode current data usage snapshot");
@@ -1929,76 +1554,6 @@ mod tests {

        assert_eq!(legacy.buckets_count, 0);
        assert!(current.is_complete_bucket_usage_snapshot());
-        assert_eq!(current.usage_snapshot_converged, Some(false));
-    }
-
-    #[test]
-    fn convergence_marker_defaults_to_unknown_for_older_snapshots() {
-        let encoded = rmp_serde::to_vec_named(&DataUsageInfo {
-            last_update: Some(SystemTime::UNIX_EPOCH),
-            usage_snapshot_complete: true,
-            ..Default::default()
-        })
-        .expect("encode pre-convergence data usage snapshot");
-        let decoded: DataUsageInfo = rmp_serde::from_slice(&encoded).expect("decode older data usage snapshot");
-
-        assert!(decoded.is_complete_bucket_usage_snapshot());
-        assert_eq!(decoded.usage_snapshot_converged, None);
-    }
-
-    #[test]
-    fn observation_selection_is_clock_independent_and_baseline_fenced() {
-        let mut authoritative = DataUsageInfo {
-            last_update: Some(SystemTime::UNIX_EPOCH + Duration::from_secs(600)),
-            scanner_epoch: Some(7),
-            scanner_cycle: Some(10),
-            usage_snapshot_complete: true,
-            ..Default::default()
-        };
-        let observed = DataUsageInfo {
-            // A newer leader may have a slower wall clock.
-            last_update: Some(SystemTime::UNIX_EPOCH + Duration::from_secs(300)),
-            scanner_epoch: Some(8),
-            scanner_cycle: Some(1),
-            usage_snapshot_complete: true,
-            usage_snapshot_converged: Some(false),
-            usage_snapshot_authoritative_baseline: Some(authoritative.snapshot_identity()),
-            ..Default::default()
-        };
-
-        assert!(observed_data_usage_is_newer(&observed, &authoritative));
-
-        authoritative.last_update = Some(SystemTime::UNIX_EPOCH + Duration::from_secs(601));
-        assert!(
-            !observed_data_usage_is_newer(&observed, &authoritative),
-            "an old-binary namespace mutation must fence the prior bucket incarnation regardless of clock skew"
-        );
-    }
-
-    #[test]
-    fn observation_selection_requires_nonconverged_complete_newer_data() {
-        let authoritative = DataUsageInfo {
-            last_update: Some(SystemTime::UNIX_EPOCH),
-            scanner_epoch: Some(2),
-            scanner_cycle: Some(10),
-            usage_snapshot_complete: true,
-            ..Default::default()
-        };
-        let baseline = Some(authoritative.snapshot_identity());
-        let candidate = |epoch, cycle, converged, complete| DataUsageInfo {
-            last_update: Some(SystemTime::UNIX_EPOCH + Duration::from_secs(1)),
-            scanner_epoch: Some(epoch),
-            scanner_cycle: Some(cycle),
-            usage_snapshot_complete: complete,
-            usage_snapshot_converged: converged,
-            usage_snapshot_authoritative_baseline: baseline,
-            ..Default::default()
-        };
-
-        assert!(observed_data_usage_is_newer(&candidate(2, 11, Some(false), true), &authoritative));
-        assert!(!observed_data_usage_is_newer(&candidate(2, 9, Some(false), true), &authoritative));
-        assert!(!observed_data_usage_is_newer(&candidate(2, 11, Some(true), true), &authoritative));
-        assert!(!observed_data_usage_is_newer(&candidate(2, 11, Some(false), false), &authoritative));
    }

    #[test]
@@ -2346,44 +1901,6 @@ mod tests {
        assert_eq!(info.buckets_count, 2);
        assert!(info.buckets_usage.is_empty());
        assert_eq!(info.objects_total_count, 3);
-        assert!(info.tier_stats.is_none());
-    }
-
-    #[test]
-    fn test_dui_reports_tier_usage_from_the_flattened_tree() {
-        let root_hash = hash_path("root");
-        let bucket_hash = hash_path("bucket-a");
-        let mut cache = DataUsageCache {
-            info: DataUsageCacheInfo {
-                name: "root".to_string(),
-                ..Default::default()
-            },
-            ..Default::default()
-        };
-        cache.replace_hashed(&root_hash, &None, &DataUsageEntry::default());
-        cache.replace_hashed(
-            &bucket_hash,
-            &Some(root_hash),
-            &tier_entry(
-                "WARM",
-                TierStats {
-                    total_size: 40,
-                    num_versions: 2,
-                    num_objects: 2,
-                },
-            ),
-        );
-
-        let info = cache.dui("root", &["bucket-a".to_string()]);
-
-        assert_eq!(
-            info.tier_stats.expect("child tier usage should roll up to the root").tiers["WARM"],
-            TierStats {
-                total_size: 40,
-                num_versions: 2,
-                num_objects: 2,
-            }
-        );
    }

    #[test]
@@ -25,58 +25,10 @@ workspace = true

 [features]
 default = []
-hotpath = [
-    "hotpath/hotpath",
-    "hotpath/tokio",
-    "hotpath/futures",
-    "hotpath/reqwest-0-13",
-    "rustfs-config/hotpath",
-    "rustfs-credentials/hotpath",
-    "rustfs-data-usage/hotpath",
-    "rustfs-ecstore/hotpath",
-    "rustfs-filemeta/hotpath",
-    "rustfs-lock/hotpath",
-    "rustfs-madmin/hotpath",
-    "rustfs-protos/hotpath",
-    "rustfs-rio/hotpath",
-    "rustfs-signer/hotpath",
-    "rustfs-utils/hotpath",
-]
-hotpath-alloc = [
-    "hotpath",
-    "hotpath/hotpath-alloc",
-    "rustfs-config/hotpath-alloc",
-    "rustfs-credentials/hotpath-alloc",
-    "rustfs-data-usage/hotpath-alloc",
-    "rustfs-ecstore/hotpath-alloc",
-    "rustfs-filemeta/hotpath-alloc",
-    "rustfs-lock/hotpath-alloc",
-    "rustfs-madmin/hotpath-alloc",
-    "rustfs-protos/hotpath-alloc",
-    "rustfs-rio/hotpath-alloc",
-    "rustfs-signer/hotpath-alloc",
-    "rustfs-utils/hotpath-alloc",
-]
-hotpath-cpu = [
-    "hotpath",
-    "hotpath/hotpath-cpu",
-    "rustfs-config/hotpath-cpu",
-    "rustfs-credentials/hotpath-cpu",
-    "rustfs-data-usage/hotpath-cpu",
-    "rustfs-ecstore/hotpath-cpu",
-    "rustfs-filemeta/hotpath-cpu",
-    "rustfs-lock/hotpath-cpu",
-    "rustfs-madmin/hotpath-cpu",
-    "rustfs-protos/hotpath-cpu",
-    "rustfs-rio/hotpath-cpu",
-    "rustfs-signer/hotpath-cpu",
-    "rustfs-utils/hotpath-cpu",
-]
 ftps = []
 sftp = []

 [dependencies]
-hotpath.workspace = true
 rustfs-config = { workspace = true, features = ["constants"] }
 rustfs-credentials.workspace = true
 rustfs-ecstore.workspace = true
@@ -26,18 +26,75 @@
 //! Later batches tracked on backlog#1154: config get/set, info, pools status,
 //! group lifecycle, import/export IAM.

-use crate::common::{
-    RustFSTestEnvironment, admin_ok, admin_request, admin_request_with_session_token, build_test_sts_client, init_logging,
-};
+use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::{Client, Config};
+use http::header::{CONTENT_TYPE, HOST};
 use reqwest::StatusCode;
+use rustfs_signer::constants::UNSIGNED_PAYLOAD;
+use rustfs_signer::sign_v4;
+use s3s::Body;
 use serial_test::serial;
 use std::error::Error;
 use tokio::time::{Duration, sleep};

 type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+type BoxError = Box<dyn Error + Send + Sync>;
+
+/// Signs and sends an admin HTTP request with the given credential, returning
+/// status and body. Native `/rustfs/admin/v3` requests and responses are plain
+/// JSON (the MinIO-compat encryption applies only to `/minio/admin/v3` paths).
+async fn admin_request(
+    base_url: &str,
+    method: http::Method,
+    path_and_query: &str,
+    body: Option<String>,
+    access_key: &str,
+    secret_key: &str,
+) -> Result<(StatusCode, String), BoxError> {
+    let url = format!("{base_url}{path_and_query}");
+    let uri = url.parse::<http::Uri>()?;
+    let authority = uri.authority().ok_or("admin URL missing authority")?.to_string();
+    let mut builder = http::Request::builder()
+        .method(method.clone())
+        .uri(uri)
+        .header(HOST, authority)
+        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
+    if body.is_some() {
+        builder = builder.header(CONTENT_TYPE, "application/json");
+    }
+
+    let content_len = body.as_ref().map(|b| b.len() as i64).unwrap_or_default();
+    let signed = sign_v4(builder.body(Body::empty())?, content_len, access_key, secret_key, "", "us-east-1");
+
+    let reqwest_method = reqwest::Method::from_bytes(method.as_str().as_bytes())?;
+    let mut request = local_http_client().request(reqwest_method, &url);
+    for (name, value) in signed.headers() {
+        request = request.header(name, value);
+    }
+    if let Some(body) = body {
+        request = request.body(body);
+    }
+    let response = request.send().await?;
+    let status = response.status();
+    let text = response.text().await.unwrap_or_default();
+    Ok((status, text))
+}
+
+/// Root-credential admin request that must succeed; returns the response body.
+async fn admin_ok(
+    env: &RustFSTestEnvironment,
+    method: http::Method,
+    path_and_query: &str,
+    body: Option<String>,
+) -> Result<String, BoxError> {
+    let (status, text) = admin_request(&env.url, method.clone(), path_and_query, body, &env.access_key, &env.secret_key).await?;
+    if !status.is_success() {
+        return Err(format!("{method} {path_and_query} failed: {status} {text}").into());
+    }
+    Ok(text)
+}

 fn build_s3_client(url: &str, access_key: &str, secret_key: &str) -> Client {
    let config = Config::builder()
@@ -89,262 +146,6 @@ fn bucket_rw_policy(bucket: &str) -> String {
    .to_string()
 }

-async fn create_user_with_service_account_update_policy(
-    env: &RustFSTestEnvironment,
-    user: &str,
-    secret: &str,
-    policy: &str,
-) -> TestResult {
-    admin_ok(
-        env,
-        http::Method::PUT,
-        &format!("/rustfs/admin/v3/add-user?accessKey={user}"),
-        Some(serde_json::json!({ "secretKey": secret, "status": "enabled" }).to_string()),
-    )
-    .await?;
-    admin_ok(
-        env,
-        http::Method::PUT,
-        &format!("/rustfs/admin/v3/add-canned-policy?name={policy}"),
-        Some(
-            serde_json::json!({
-                "Version": "2012-10-17",
-                "Statement": [
-                    {
-                        "Effect": "Allow",
-                        "Action": ["admin:UpdateServiceAccount"]
-                    },
-                    {
-                        "Effect": "Allow",
-                        "Action": ["sts:AssumeRole"],
-                        "Resource": ["arn:aws:s3:::*"]
-                    }
-                ]
-            })
-            .to_string(),
-        ),
-    )
-    .await?;
-    admin_ok(
-        env,
-        http::Method::POST,
-        "/rustfs/admin/v3/idp/builtin/policy/attach",
-        Some(serde_json::json!({ "policies": [policy], "user": user }).to_string()),
-    )
-    .await?;
-    Ok(())
-}
-
-async fn create_service_account_for(
-    env: &RustFSTestEnvironment,
-    parent: &str,
-) -> Result<(String, String), Box<dyn Error + Send + Sync>> {
-    let response = admin_ok(
-        env,
-        http::Method::PUT,
-        "/rustfs/admin/v3/add-service-accounts",
-        Some(serde_json::json!({ "targetUser": parent }).to_string()),
-    )
-    .await?;
-    let response: serde_json::Value = serde_json::from_str(&response)?;
-    let access_key = response["credentials"]["accessKey"]
-        .as_str()
-        .ok_or("service account response should contain credentials.accessKey")?
-        .to_owned();
-    let secret_key = response["credentials"]["secretKey"]
-        .as_str()
-        .ok_or("service account response should contain credentials.secretKey")?
-        .to_owned();
-    Ok((access_key, secret_key))
-}
-
-async fn assert_admin_status(
-    env: &RustFSTestEnvironment,
-    credentials: (&str, &str, Option<&str>),
-    path: &str,
-    body: String,
-    expected: StatusCode,
-    context: &str,
-) -> TestResult {
-    let (access_key, secret_key, session_token) = credentials;
-    let (status, response) =
-        admin_request_with_session_token(&env.url, http::Method::POST, path, Some(body), access_key, secret_key, session_token)
-            .await?;
-    assert_eq!(status, expected, "{context}: got {status}: {response}");
-    if expected == StatusCode::FORBIDDEN {
-        assert!(response.contains("AccessDenied"), "{context}: expected AccessDenied body, got {response}");
-    }
-    Ok(())
-}
-
-#[tokio::test]
-#[serial]
-async fn test_update_service_account_enforces_owner_and_parent_scope() -> TestResult {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let parent = "updateparent";
-    let parent_secret = "updateparentsecret";
-    let outsider = "updateoutsider";
-    let outsider_secret = "updateoutsidersecret";
-    let ordinary = "updateordinary";
-    let ordinary_secret = "updateordinarysecret";
-    create_user_with_service_account_update_policy(&env, parent, parent_secret, "update-parent-policy").await?;
-    create_user_with_service_account_update_policy(&env, outsider, outsider_secret, "update-outsider-policy").await?;
-    admin_ok(
-        &env,
-        http::Method::POST,
-        "/rustfs/admin/v3/idp/builtin/policy/attach",
-        Some(serde_json::json!({ "policies": ["consoleAdmin"], "user": outsider }).to_string()),
-    )
-    .await?;
-    admin_ok(
-        &env,
-        http::Method::PUT,
-        &format!("/rustfs/admin/v3/add-user?accessKey={ordinary}"),
-        Some(serde_json::json!({ "secretKey": ordinary_secret, "status": "enabled" }).to_string()),
-    )
-    .await?;
-
-    let (target_access_key, _) = create_service_account_for(&env, parent).await?;
-    let target_path = format!("/rustfs/admin/v3/update-service-account?accessKey={target_access_key}");
-
-    assert_admin_status(
-        &env,
-        (&env.access_key, &env.secret_key, None),
-        &target_path,
-        serde_json::json!({}).to_string(),
-        StatusCode::NO_CONTENT,
-        "root no-op update across parents must succeed",
-    )
-    .await?;
-
-    let custom_policy = serde_json::json!({
-        "Version": "2012-10-17",
-        "Statement": [{
-            "Effect": "Allow",
-            "Action": ["s3:GetObject"],
-            "Resource": ["arn:aws:s3:::update-scope/*"]
-        }]
-    });
-    assert_admin_status(
-        &env,
-        (&env.access_key, &env.secret_key, None),
-        &target_path,
-        serde_json::json!({ "newPolicy": custom_policy }).to_string(),
-        StatusCode::NO_CONTENT,
-        "root implied-to-custom update across parents must succeed",
-    )
-    .await?;
-
-    assert_admin_status(
-        &env,
-        (parent, parent_secret, None),
-        &target_path,
-        serde_json::json!({ "newDescription": "updated by parent" }).to_string(),
-        StatusCode::NO_CONTENT,
-        "parent with UpdateServiceAccount may update its own service account",
-    )
-    .await?;
-
-    let takeover = serde_json::json!({
-        "newSecretKey": "cross-parent-takeover-secret",
-        "newDescription": "cross-parent takeover"
-    })
-    .to_string();
-    assert_admin_status(
-        &env,
-        (ordinary, ordinary_secret, None),
-        &target_path,
-        takeover.clone(),
-        StatusCode::FORBIDDEN,
-        "ordinary user must not update another parent's service account",
-    )
-    .await?;
-    assert_admin_status(
-        &env,
-        (outsider, outsider_secret, None),
-        &target_path,
-        takeover.clone(),
-        StatusCode::FORBIDDEN,
-        "non-owner consoleAdmin must not update across parents",
-    )
-    .await?;
-
-    let (derived_access_key, derived_secret_key) = create_service_account_for(&env, outsider).await?;
-    assert_admin_status(
-        &env,
-        (&derived_access_key, &derived_secret_key, None),
-        &target_path,
-        takeover.clone(),
-        StatusCode::FORBIDDEN,
-        "service-account credential must not update across parents",
-    )
-    .await?;
-
-    let assumed = build_test_sts_client(&env.url, outsider, outsider_secret, None, "e2e-admin-update-service-account")
-        .assume_role()
-        .role_arn("arn:aws:iam::123456789012:role/update-service-account")
-        .role_session_name("update-service-account-scope")
-        .send()
-        .await?;
-    let temporary = assumed
-        .credentials()
-        .ok_or("AssumeRole response should contain credentials")?;
-    assert_admin_status(
-        &env,
-        (temporary.access_key_id(), temporary.secret_access_key(), Some(temporary.session_token())),
-        &target_path,
-        takeover,
-        StatusCode::FORBIDDEN,
-        "temporary credential must not update across parents",
-    )
-    .await?;
-
-    let info = admin_ok(
-        &env,
-        http::Method::GET,
-        &format!("/rustfs/admin/v3/info-service-account?accessKey={target_access_key}"),
-        None,
-    )
-    .await?;
-    let info: serde_json::Value = serde_json::from_str(&info)?;
-    assert_eq!(
-        info["impliedPolicy"].as_bool(),
-        Some(false),
-        "root update must replace the implied policy with a custom policy"
-    );
-    assert!(
-        info["policy"].as_str().is_some_and(|policy| policy.contains("s3:GetObject")),
-        "custom policy must round-trip through the handler: {info}"
-    );
-    assert_eq!(
-        info["description"].as_str(),
-        Some("updated by parent"),
-        "denied takeover attempts must not mutate target"
-    );
-
-    let (missing_status, missing_body) = admin_request(
-        &env.url,
-        http::Method::POST,
-        "/rustfs/admin/v3/update-service-account?accessKey=missing-service-account",
-        Some(serde_json::json!({}).to_string()),
-        &env.access_key,
-        &env.secret_key,
-    )
-    .await?;
-    assert_eq!(missing_status, StatusCode::NOT_FOUND, "missing target must fail closed: {missing_body}");
-    assert!(
-        missing_body.contains("NoSuchResource"),
-        "missing target must preserve the lookup error: {missing_body}"
-    );
-
-    env.stop_server();
-    Ok(())
-}
-
 /// Full user -> policy -> service-account lifecycle, proving each management
 /// call takes effect on the data plane, not just that the endpoint answers 200.
 #[tokio::test]
@@ -16,17 +16,91 @@

 #[cfg(test)]
 mod tests {
-    use crate::common::{RustFSTestEnvironment, init_logging, signed_s3_request};
+    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::error::ProvideErrorMetadata;
    use aws_sdk_s3::types::{
        AccelerateConfiguration, BucketAccelerateStatus, BucketLoggingStatus, IndexDocument, LoggingEnabled, Payer,
        RequestPaymentConfiguration, WebsiteConfiguration,
    };
-    use http::Method;
-    use http::header::CONTENT_TYPE;
    use serial_test::serial;
+    use std::path::PathBuf;
+    use std::process::Command;
    use tracing::info;

+    fn awscurl_binary_path() -> PathBuf {
+        std::env::var_os("AWSCURL_PATH")
+            .map(PathBuf::from)
+            .unwrap_or_else(|| PathBuf::from("awscurl"))
+    }
+
+    fn awscurl_available() -> bool {
+        Command::new(awscurl_binary_path()).arg("--version").output().is_ok()
+    }
+
+    fn execute_s3_awscurl(
+        method: &str,
+        url: &str,
+        access_key: &str,
+        secret_key: &str,
+    ) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+        let output = Command::new(awscurl_binary_path())
+            .args([
+                "--service",
+                "s3",
+                "--region",
+                "us-east-1",
+                "--access_key",
+                access_key,
+                "--secret_key",
+                secret_key,
+                "-i",
+                "-X",
+                method,
+                url,
+            ])
+            .output()?;
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            let stdout = String::from_utf8_lossy(&output.stdout);
+            return Err(format!("awscurl failed: stderr='{stderr}', stdout='{stdout}'").into());
+        }
+        Ok(String::from_utf8_lossy(&output.stdout).to_string())
+    }
+
+    fn parse_status(raw: &str) -> Option<u16> {
+        raw.lines()
+            .filter_map(|line| {
+                if line.starts_with("HTTP/") {
+                    line.split_whitespace().nth(1)?.parse::<u16>().ok()
+                } else {
+                    None
+                }
+            })
+            .next_back()
+    }
+
+    fn parse_body(raw: &str) -> String {
+        if let Some(pos) = raw.rfind("\r\n\r\n") {
+            return raw[pos + 4..].to_string();
+        }
+        if let Some(pos) = raw.rfind("\n\n") {
+            return raw[pos + 2..].to_string();
+        }
+        String::new()
+    }
+
+    fn parse_headers(raw: &str) -> String {
+        let start = raw.rfind("HTTP/").unwrap_or(0);
+        let tail = &raw[start..];
+        if let Some(pos) = tail.find("\r\n\r\n") {
+            return tail[..pos].to_string();
+        }
+        if let Some(pos) = tail.find("\n\n") {
+            return tail[..pos].to_string();
+        }
+        tail.to_string()
+    }
+
    #[tokio::test]
    #[serial]
    async fn test_dummy_bucket_compatibility_endpoints() {
@@ -396,6 +470,10 @@ mod tests {
    async fn test_dummy_bucket_endpoints_http_contracts() {
        init_logging();
        info!("Starting test: dummy-compat bucket API HTTP contracts");
+        if !awscurl_available() {
+            info!("Skipping test_dummy_bucket_endpoints_http_contracts: awscurl binary not found");
+            return;
+        }

        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
@@ -410,112 +488,56 @@ mod tests {
            .await
            .expect("Failed to create bucket");

-        let logging_response = signed_s3_request(
-            Method::GET,
-            &format!("{}/{bucket}?logging=", env.url),
-            None,
-            None,
-            &env.access_key,
-            &env.secret_key,
-        )
-        .await
-        .expect("GetBucketLogging HTTP request failed");
-        assert_eq!(logging_response.status(), 200, "GetBucketLogging should return 200");
-        let logging_body = logging_response
-            .text()
-            .await
-            .expect("Failed to read GetBucketLogging response body");
+        let logging_raw = execute_s3_awscurl("GET", &format!("{}/{bucket}?logging=", env.url), &env.access_key, &env.secret_key)
+            .expect("GetBucketLogging HTTP request failed");
+        assert_eq!(parse_status(&logging_raw), Some(200), "GetBucketLogging should return 200");
+        let logging_body = parse_body(&logging_raw);
        assert!(
            logging_body.contains("<BucketLoggingStatus"),
            "GetBucketLogging response should contain BucketLoggingStatus XML, got: {logging_body}"
        );

-        let accel_response = signed_s3_request(
-            Method::GET,
-            &format!("{}/{bucket}?accelerate=", env.url),
-            None,
-            None,
-            &env.access_key,
-            &env.secret_key,
-        )
-        .await
-        .expect("GetBucketAccelerateConfiguration HTTP request failed");
-        assert_eq!(accel_response.status(), 200, "GetBucketAccelerateConfiguration should return 200");
-        let accel_body = accel_response
-            .text()
-            .await
-            .expect("Failed to read GetBucketAccelerateConfiguration response body");
+        let accel_raw = execute_s3_awscurl("GET", &format!("{}/{bucket}?accelerate=", env.url), &env.access_key, &env.secret_key)
+            .expect("GetBucketAccelerateConfiguration HTTP request failed");
+        assert_eq!(parse_status(&accel_raw), Some(200), "GetBucketAccelerateConfiguration should return 200");
+        let accel_body = parse_body(&accel_raw);
        assert!(
            accel_body.contains("<AccelerateConfiguration"),
            "GetBucketAccelerateConfiguration response should contain AccelerateConfiguration XML, got: {accel_body}"
        );

-        let payment_response = signed_s3_request(
-            Method::GET,
-            &format!("{}/{bucket}?requestPayment=", env.url),
-            None,
-            None,
-            &env.access_key,
-            &env.secret_key,
-        )
-        .await
-        .expect("GetBucketRequestPayment HTTP request failed");
-        assert_eq!(payment_response.status(), 200, "GetBucketRequestPayment should return 200");
-        let payment_body = payment_response
-            .text()
-            .await
-            .expect("Failed to read GetBucketRequestPayment response body");
+        let payment_raw =
+            execute_s3_awscurl("GET", &format!("{}/{bucket}?requestPayment=", env.url), &env.access_key, &env.secret_key)
+                .expect("GetBucketRequestPayment HTTP request failed");
+        assert_eq!(parse_status(&payment_raw), Some(200), "GetBucketRequestPayment should return 200");
+        let payment_body = parse_body(&payment_raw);
        assert!(
            payment_body.contains("<Payer>BucketOwner</Payer>"),
            "GetBucketRequestPayment should return BucketOwner payer, got: {payment_body}"
        );

-        let website_response = signed_s3_request(
-            Method::GET,
-            &format!("{}/{bucket}?website=", env.url),
-            None,
-            None,
-            &env.access_key,
-            &env.secret_key,
-        )
-        .await
-        .expect("GetBucketWebsite HTTP request failed");
+        let website_raw = execute_s3_awscurl("GET", &format!("{}/{bucket}?website=", env.url), &env.access_key, &env.secret_key)
+            .expect("GetBucketWebsite HTTP request failed");
        assert_eq!(
-            website_response.status(),
-            404,
+            parse_status(&website_raw),
+            Some(404),
            "GetBucketWebsite should return 404 when website config is absent"
        );
-        let website_content_type = website_response
-            .headers()
-            .get(CONTENT_TYPE)
-            .expect("GetBucketWebsite response should include Content-Type")
-            .to_str()
-            .expect("GetBucketWebsite Content-Type should be valid ASCII")
-            .to_ascii_lowercase();
+        let website_content_type = parse_headers(&website_raw).to_ascii_lowercase();
        assert!(
-            website_content_type.contains("xml"),
+            website_content_type.contains("content-type:") && website_content_type.contains("xml"),
            "GetBucketWebsite error response should be XML, got content-type: {website_content_type}"
        );
-        let website_body = website_response
-            .text()
-            .await
-            .expect("Failed to read GetBucketWebsite response body");
+        let website_body = parse_body(&website_raw);
        assert!(
            website_body.contains("<Code>NoSuchWebsiteConfiguration</Code>"),
            "GetBucketWebsite should return NoSuchWebsiteConfiguration code, got: {website_body}"
        );

-        let delete_response = signed_s3_request(
-            Method::DELETE,
-            &format!("{}/{bucket}?website=", env.url),
-            None,
-            None,
-            &env.access_key,
-            &env.secret_key,
-        )
-        .await
-        .expect("DeleteBucketWebsite HTTP request failed");
-        assert_eq!(delete_response.status(), 204, "DeleteBucketWebsite should return 204");
+        let delete_raw =
+            execute_s3_awscurl("DELETE", &format!("{}/{bucket}?website=", env.url), &env.access_key, &env.secret_key)
+                .expect("DeleteBucketWebsite HTTP request failed");
+        assert_eq!(parse_status(&delete_raw), Some(204), "DeleteBucketWebsite should return 204");

        env.stop_server();
    }
@@ -1,295 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Regression tests for bucket statistics and data usage accuracy.
-//!
-//! Covers the recurring pattern where bucket statistics (object count, size)
-//! show stale/incorrect values, remain at 0, or oscillate between complete,
-//! partial, and zero. This has regressed 10+ times.
-//!
-//! ## Regression Issues
-//!
-//! - rustfs#5615: bucket statistics remain unchanged after data expiration
-//! - rustfs#5008: Admin usage reports only one pool
-//! - rustfs#5116: Admin usage reports stale 0/0 for non-empty bucket after upgrade
-//! - rustfs#5055: console object count and size still loading
-//! - rustfs#5010: Storage usage info changed abnormally
-//! - rustfs#3662: Incorrect bucket, object count and size
-//! - rustfs#3898: DataUsageInfo undercounts versioned bucket versions
-//! - rustfs#1012: Object count in the console doesn't change
-
-#[cfg(test)]
-mod tests {
-    use crate::common::{FAST_DATA_USAGE_SCANNER_ENV, RustFSTestEnvironment, awscurl_get, init_logging};
-    use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
-    use rustfs_data_usage::DataUsageInfo;
-    use serial_test::serial;
-    use std::error::Error;
-    use tokio::time::{Duration, sleep};
-    use tracing::info;
-
-    type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
-
-    async fn get_data_usage(env: &RustFSTestEnvironment) -> Result<DataUsageInfo, Box<dyn Error + Send + Sync>> {
-        let url = format!("{}/rustfs/admin/v3/datausageinfo", env.url);
-        let resp = awscurl_get(&url, &env.access_key, &env.secret_key).await?;
-        Ok(serde_json::from_str(&resp)?)
-    }
-
-    /// RT-09: Verify bucket object count updates after PUT.
-    ///
-    /// Regression pattern: bucket stats remain at 0 after objects are uploaded
-    /// (rustfs#5055, rustfs#1012).
-    ///
-    /// Steps:
-    /// 1. Create a bucket
-    /// 2. Upload 10 objects
-    /// 3. Query admin data usage API
-    /// 4. Verify object count > 0
-    #[tokio::test]
-    #[serial]
-    async fn test_bucket_object_count_updates_after_put() -> TestResult {
-        init_logging();
-        info!("RT-09: bucket object count updates after PUT");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
-        env.start_rustfs_server_with_env(vec![], FAST_DATA_USAGE_SCANNER_ENV)
-            .await
-            .expect("start RustFS");
-
-        let client = env.create_s3_client();
-        let bucket = "rt09-stats-put";
-
-        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
-
-        // Upload 10 objects
-        for i in 0..10 {
-            client
-                .put_object()
-                .bucket(bucket)
-                .key(format!("stat-obj-{i:04}.txt"))
-                .body(ByteStream::from_static(b"statistical data"))
-                .send()
-                .await
-                .expect("put object");
-        }
-
-        // Wait for scanner to process (up to 90 seconds)
-        let mut found_nonzero = false;
-        let mut last_query_error = None;
-        for attempt in 0..18 {
-            sleep(Duration::from_secs(5)).await;
-
-            let usage = match get_data_usage(&env).await {
-                Ok(usage) => {
-                    last_query_error = None;
-                    usage
-                }
-                Err(err) => {
-                    last_query_error = Some(err.to_string());
-                    continue;
-                }
-            };
-            if let Some(bucket_usage) = usage.buckets_usage.get(bucket) {
-                info!("  attempt {attempt}: objectsCount = {}", bucket_usage.objects_count);
-                if bucket_usage.objects_count >= 10 {
-                    found_nonzero = true;
-                    break;
-                }
-            }
-        }
-
-        assert!(
-            found_nonzero,
-            "RT-09 FAIL: bucket object count did not update after PUT 10 objects (regression: stats stuck at 0); last query error: {}",
-            last_query_error.as_deref().unwrap_or("none")
-        );
-
-        info!("RT-09 PASS: bucket object count updates after PUT");
-        Ok(())
-    }
-
-    /// RT-09b: Verify bucket stats update after DELETE.
-    ///
-    /// Regression pattern: stats remain unchanged after objects are deleted
-    /// (rustfs#5615).
-    #[tokio::test]
-    #[serial]
-    async fn test_bucket_object_count_updates_after_delete() -> TestResult {
-        init_logging();
-        info!("RT-09b: bucket object count updates after DELETE");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
-        env.start_rustfs_server_with_env(vec![], FAST_DATA_USAGE_SCANNER_ENV)
-            .await
-            .expect("start RustFS");
-
-        let client = env.create_s3_client();
-        let bucket = "rt09b-stats-delete";
-
-        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
-
-        // Upload 5 objects
-        for i in 0..5 {
-            client
-                .put_object()
-                .bucket(bucket)
-                .key(format!("del-stat-{i}.txt"))
-                .body(ByteStream::from_static(b"data"))
-                .send()
-                .await
-                .expect("put object");
-        }
-
-        let mut found_nonzero = false;
-        for attempt in 0..18 {
-            sleep(Duration::from_secs(5)).await;
-
-            if let Ok(usage) = get_data_usage(&env).await
-                && let Some(bucket_usage) = usage.buckets_usage.get(bucket)
-            {
-                info!("  baseline attempt {attempt}: objectsCount = {}", bucket_usage.objects_count);
-                if bucket_usage.objects_count >= 5 {
-                    found_nonzero = true;
-                    break;
-                }
-            }
-        }
-        assert!(found_nonzero, "RT-09b setup failed: scanner did not observe the 5 uploaded objects");
-
-        // Delete all objects
-        for i in 0..5 {
-            client
-                .delete_object()
-                .bucket(bucket)
-                .key(format!("del-stat-{i}.txt"))
-                .send()
-                .await
-                .expect("delete object");
-        }
-
-        // Wait for scanner to update stats (up to 90 seconds)
-        let mut found_zero = false;
-        let mut last_query_error = None;
-        for attempt in 0..18 {
-            sleep(Duration::from_secs(5)).await;
-
-            let usage = match get_data_usage(&env).await {
-                Ok(usage) => {
-                    last_query_error = None;
-                    usage
-                }
-                Err(err) => {
-                    last_query_error = Some(err.to_string());
-                    continue;
-                }
-            };
-            if let Some(bucket_usage) = usage.buckets_usage.get(bucket) {
-                info!("  attempt {attempt}: objectsCount = {}", bucket_usage.objects_count);
-                if bucket_usage.objects_count == 0 {
-                    found_zero = true;
-                    break;
-                }
-            }
-        }
-
-        assert!(
-            found_zero,
-            "RT-09b FAIL: bucket object count did not update to 0 after deleting all objects (regression rustfs#5615); last query error: {}",
-            last_query_error.as_deref().unwrap_or("none")
-        );
-
-        info!("RT-09b PASS: bucket object count updates to 0 after DELETE");
-        Ok(())
-    }
-
-    /// RT-09c: Verify versioned bucket stats count all versions.
-    ///
-    /// Regression pattern: DataUsageInfo undercounts versioned bucket versions
-    /// and delete markers (rustfs#3898).
-    #[tokio::test]
-    #[serial]
-    async fn test_versioned_bucket_stats_count_all_versions() -> TestResult {
-        init_logging();
-        info!("RT-09c: versioned bucket stats count all versions");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
-        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
-            .await
-            .expect("start RustFS");
-
-        let client = env.create_s3_client();
-        let bucket = "rt09c-versioned-stats";
-
-        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
-
-        client
-            .put_bucket_versioning()
-            .bucket(bucket)
-            .versioning_configuration(
-                VersioningConfiguration::builder()
-                    .status(BucketVersioningStatus::Enabled)
-                    .build(),
-            )
-            .send()
-            .await
-            .expect("enable versioning");
-
-        // Create 3 versions of the same object
-        for i in 0..3 {
-            client
-                .put_object()
-                .bucket(bucket)
-                .key("multi-version.txt")
-                .body(ByteStream::from(format!("version-{i}").into_bytes()))
-                .send()
-                .await
-                .expect("put version");
-        }
-
-        // Create a delete marker
-        client
-            .delete_object()
-            .bucket(bucket)
-            .key("multi-version.txt")
-            .send()
-            .await
-            .expect("create delete marker");
-
-        // Verify versions via API (immediate, no scanner wait)
-        let versions = client
-            .list_object_versions()
-            .bucket(bucket)
-            .send()
-            .await
-            .expect("list versions");
-
-        assert_eq!(
-            versions.versions().len(),
-            3,
-            "RT-09c FAIL: expected 3 versions, found {}",
-            versions.versions().len()
-        );
-        assert_eq!(
-            versions.delete_markers().len(),
-            1,
-            "RT-09c FAIL: expected 1 delete marker, found {}",
-            versions.delete_markers().len()
-        );
-
-        info!("RT-09c PASS: versioned bucket correctly tracks all versions and delete markers");
-        Ok(())
-    }
-}
@@ -40,8 +40,6 @@ use http::header::{CONTENT_TYPE, HOST};
 use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use s3s::Body;
-use sha2::{Digest, Sha256};
-use std::collections::{BTreeMap, BTreeSet};
 use std::error::Error;
 use std::path::{Path, PathBuf};
 use tracing::info;
@@ -50,62 +48,6 @@ use walkdir::WalkDir;

 type ChaosResult<T> = Result<T, Box<dyn Error + Send + Sync>>;

-/// Physical `xl.meta` and shard-file census for one object version on one disk.
-///
-/// A successful S3 GET only proves that a quorum can serve an object. Replacement
-/// tests need this lower-level record to prove that the rebuilt target holds the
-/// `xl.meta` selected for a specific version and every `part.N` it declares.
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub(crate) struct VersionShardCensus {
-    pub version_id: Option<String>,
-    pub has_xl_meta: bool,
-    pub data_dir: Option<String>,
-    pub erasure_index: Option<usize>,
-    pub expected_part_numbers: BTreeSet<usize>,
-    pub present_part_fingerprints: BTreeMap<usize, PartShardFingerprint>,
-    pub inline_data_fingerprint: Option<PartShardFingerprint>,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub(crate) struct PartShardFingerprint {
-    pub size: u64,
-    pub sha256: String,
-}
-
-impl VersionShardCensus {
-    pub(crate) fn is_complete(&self) -> bool {
-        self.has_xl_meta
-            && self.expected_part_numbers.len() == self.present_part_fingerprints.len()
-            && self
-                .expected_part_numbers
-                .iter()
-                .all(|part_number| self.present_part_fingerprints.contains_key(part_number))
-    }
-
-    pub(crate) fn matches_manifest(&self, manifest: &Self) -> bool {
-        self.version_id == manifest.version_id
-            && self.is_complete()
-            && manifest.is_complete()
-            && self.data_dir == manifest.data_dir
-            && self.erasure_index == manifest.erasure_index
-            && self.expected_part_numbers == manifest.expected_part_numbers
-            && self.present_part_fingerprints == manifest.present_part_fingerprints
-            && self.inline_data_fingerprint == manifest.inline_data_fingerprint
-    }
-}
-
-fn sha256_hex(data: &[u8]) -> String {
-    let digest = Sha256::digest(data);
-    digest.iter().map(|byte| format!("{byte:02x}")).collect()
-}
-
-fn shard_fingerprint(data: &[u8]) -> ChaosResult<PartShardFingerprint> {
-    Ok(PartShardFingerprint {
-        size: u64::try_from(data.len())?,
-        sha256: sha256_hex(data),
-    })
-}
-
 /// Single-node RustFS server with `disk_count` local volume directories that
 /// can be faulted individually while the server is running.
 pub struct DiskFaultHarness {
@@ -277,93 +219,6 @@ impl DiskFaultHarness {
    pub fn object_metadata_exists_on_disk(&self, disk_index: usize, bucket: &str, key: &str) -> bool {
        self.disks[disk_index].join(bucket).join(key).join("xl.meta").is_file()
    }
-
-    /// Census the physical files selected by `version_id` on one disk.
-    ///
-    /// Missing metadata and missing shard files are represented in the returned
-    /// census rather than as an error so callers can poll replacement progress.
-    /// Invalid metadata or an unknown requested version remains an error: treating
-    /// either as an incomplete rebuild would hide corruption or a wrong-version
-    /// recovery result.
-    pub(crate) fn census_object_version(
-        &self,
-        disk_index: usize,
-        bucket: &str,
-        key: &str,
-        version_id: Option<&str>,
-    ) -> ChaosResult<VersionShardCensus> {
-        census_object_version_on_disk(&self.disks[disk_index], bucket, key, version_id)
-    }
-}
-
-/// Census one physical object version without requiring a single-node harness.
-/// Cluster replacement tests use the same evidence as the disk-fault tests.
-pub(crate) fn census_object_version_on_disk(
-    disk: &Path,
-    bucket: &str,
-    key: &str,
-    version_id: Option<&str>,
-) -> ChaosResult<VersionShardCensus> {
-    let version_id = version_id.map(str::to_owned);
-    let object_dir = disk.join(bucket).join(key);
-    let meta_path = object_dir.join("xl.meta");
-    if !meta_path.is_file() {
-        return Ok(VersionShardCensus {
-            version_id,
-            has_xl_meta: false,
-            data_dir: None,
-            erasure_index: None,
-            expected_part_numbers: BTreeSet::new(),
-            present_part_fingerprints: BTreeMap::new(),
-            inline_data_fingerprint: None,
-        });
-    }
-
-    let metadata = rustfs_filemeta::FileMeta::load(&std::fs::read(&meta_path)?)?;
-    let file_info = metadata.into_fileinfo(bucket, key, version_id.as_deref().unwrap_or_default(), true, false, true)?;
-    let expected_part_numbers = if file_info.inline_data() {
-        BTreeSet::new()
-    } else {
-        file_info.parts.iter().map(|part| part.number).collect()
-    };
-    let data_dir = file_info.data_dir.map(|id| id.to_string());
-    let erasure_index = Some(file_info.erasure.index);
-    let inline_data_fingerprint = file_info.data.as_deref().map(shard_fingerprint).transpose()?;
-    let part_dir = data_dir.as_ref().map_or_else(|| object_dir.clone(), |id| object_dir.join(id));
-    let present_part_fingerprints = match std::fs::read_dir(&part_dir) {
-        Ok(entries) => {
-            let mut fingerprints = BTreeMap::new();
-            for entry in entries {
-                let entry = entry?;
-                if !entry.file_type()?.is_file() {
-                    continue;
-                }
-                let file_name = entry.file_name();
-                let Some(part_number) = file_name
-                    .to_str()
-                    .and_then(|name| name.strip_prefix("part."))
-                    .and_then(|number| number.parse::<usize>().ok())
-                else {
-                    continue;
-                };
-                let data = std::fs::read(entry.path())?;
-                fingerprints.insert(part_number, shard_fingerprint(&data)?);
-            }
-            fingerprints
-        }
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => BTreeMap::new(),
-        Err(error) => return Err(error.into()),
-    };
-
-    Ok(VersionShardCensus {
-        version_id,
-        has_xl_meta: true,
-        data_dir,
-        erasure_index,
-        expected_part_numbers,
-        present_part_fingerprints,
-        inline_data_fingerprint,
-    })
 }

 /// `POST` a signed (SigV4, service `s3`) admin request without relying on the
@@ -402,43 +257,3 @@ pub async fn signed_admin_post(url: &str, body: Option<&str>, access_key: &str,

    Ok(body)
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn complete_census() -> VersionShardCensus {
-        VersionShardCensus {
-            version_id: Some("version".to_string()),
-            has_xl_meta: true,
-            data_dir: Some("data-dir".to_string()),
-            erasure_index: Some(3),
-            expected_part_numbers: BTreeSet::from([1]),
-            present_part_fingerprints: BTreeMap::from([(1, shard_fingerprint(b"part").unwrap())]),
-            inline_data_fingerprint: None,
-        }
-    }
-
-    #[test]
-    fn shard_fingerprint_uses_physical_length_and_sha256() {
-        assert_eq!(
-            shard_fingerprint(b"abc").unwrap(),
-            PartShardFingerprint {
-                size: 3,
-                sha256: "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad".to_string(),
-            }
-        );
-    }
-
-    #[test]
-    fn manifest_requires_matching_inline_payload() {
-        let mut expected = complete_census();
-        expected.expected_part_numbers.clear();
-        expected.present_part_fingerprints.clear();
-        expected.inline_data_fingerprint = Some(shard_fingerprint(b"expected").unwrap());
-        let mut changed = expected.clone();
-        changed.inline_data_fingerprint = Some(shard_fingerprint(b"changed").unwrap());
-        assert!(expected.matches_manifest(&expected));
-        assert!(!changed.matches_manifest(&expected));
-    }
-}
@@ -24,12 +24,7 @@
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::{Client, Config};
 use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
-use http::header::{CONTENT_TYPE, HOST};
 use reqwest::Client as HttpClient;
-use reqwest::StatusCode;
-use rustfs_signer::constants::UNSIGNED_PAYLOAD;
-use rustfs_signer::sign_v4;
-use s3s::Body;
 use std::ffi::OsStr;
 use std::fs as stdfs;
 use std::path::{Path, PathBuf};
@@ -47,44 +42,11 @@ use walkdir::WalkDir;
 pub const DEFAULT_ACCESS_KEY: &str = "rustfsadmin";
 pub const DEFAULT_SECRET_KEY: &str = "rustfsadmin";
 pub const ENV_RUSTFS_BUILD_FEATURES: &str = "RUSTFS_BUILD_FEATURES";
-pub(crate) const FAST_DATA_USAGE_SCANNER_ENV: &[(&str, &str)] =
-    &[("RUSTFS_SCANNER_CYCLE", "1"), ("RUSTFS_SCANNER_START_DELAY_SECS", "0")];
 pub const TEST_BUCKET: &str = "e2e-test-bucket";
 const RUSTFS_FULL_FEATURE: &str = "full";

-fn capture_log_path(log_dir: &Path, temp_dir: &str) -> Option<PathBuf> {
-    let temp_name = Path::new(temp_dir).file_name()?.to_string_lossy();
-    Some(log_dir.join(format!("{temp_name}.log")))
-}
-
-fn configured_capture_log_path(temp_dir: &str) -> Option<String> {
-    let log_dir = std::env::var_os("RUSTFS_E2E_LOG_DIR")?;
-    if stdfs::create_dir_all(&log_dir).is_err() {
-        warn!(?log_dir, "failed to create configured E2E server log directory");
-        return None;
-    }
-
-    capture_log_path(Path::new(&log_dir), temp_dir).map(|path| path.to_string_lossy().into_owned())
-}
-
-fn capture_command_logs(command: &mut Command, log_path: Option<&str>) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let Some(log_path) = log_path else {
-        return Ok(());
-    };
-    let file = stdfs::OpenOptions::new().create(true).append(true).open(log_path)?;
-    let stderr_file = file.try_clone()?;
-    command.stdout(Stdio::from(file)).stderr(Stdio::from(stderr_file));
-    Ok(())
-}
-
-pub(crate) fn build_test_s3_config(
-    endpoint_url: &str,
-    access_key: &str,
-    secret_key: &str,
-    session_token: Option<&str>,
-    provider_name: &'static str,
-) -> Config {
-    let credentials = Credentials::new(access_key, secret_key, session_token.map(str::to_owned), None, provider_name);
+fn build_test_s3_config(endpoint_url: &str, access_key: &str, secret_key: &str, provider_name: &'static str) -> Config {
+    let credentials = Credentials::new(access_key, secret_key, None, None, provider_name);
    let mut config = Config::builder()
        .credentials_provider(credentials)
        .region(Region::new("us-east-1"))
@@ -99,33 +61,6 @@ pub(crate) fn build_test_s3_config(
    config.build()
 }

-pub(crate) fn build_test_sts_client(
-    endpoint_url: &str,
-    access_key: &str,
-    secret_key: &str,
-    session_token: Option<&str>,
-    provider_name: &'static str,
-) -> aws_sdk_sts::Client {
-    let mut config = aws_sdk_sts::Config::builder()
-        .credentials_provider(aws_sdk_sts::config::Credentials::new(
-            access_key,
-            secret_key,
-            session_token.map(str::to_owned),
-            None,
-            provider_name,
-        ))
-        .region(aws_sdk_sts::config::Region::new("us-east-1"))
-        .endpoint_url(endpoint_url)
-        .retry_config(aws_sdk_sts::config::retry::RetryConfig::standard().with_max_attempts(1))
-        .behavior_version_latest();
-
-    if endpoint_url.starts_with("http://") {
-        config = config.http_client(SmithyHttpClientBuilder::new().build_http());
-    }
-
-    aws_sdk_sts::Client::from_conf(config.build())
-}
-
 pub fn workspace_root() -> PathBuf {
    let mut path = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
    path.pop(); // e2e_test
@@ -140,102 +75,6 @@ pub fn local_http_client() -> HttpClient {
        .expect("failed to build local reqwest client")
 }

-pub(crate) async fn signed_s3_request(
-    method: http::Method,
-    url: &str,
-    body: Option<String>,
-    content_type: Option<&str>,
-    access_key: &str,
-    secret_key: &str,
-) -> Result<reqwest::Response, Box<dyn std::error::Error + Send + Sync>> {
-    signed_s3_request_with_session_token(method, url, body, content_type, access_key, secret_key, None).await
-}
-
-async fn signed_s3_request_with_session_token(
-    method: http::Method,
-    url: &str,
-    body: Option<String>,
-    content_type: Option<&str>,
-    access_key: &str,
-    secret_key: &str,
-    session_token: Option<&str>,
-) -> Result<reqwest::Response, Box<dyn std::error::Error + Send + Sync>> {
-    let uri = url.parse::<http::Uri>()?;
-    let authority = uri.authority().ok_or("S3 URL missing authority")?.to_string();
-    let mut request = http::Request::builder()
-        .method(method.clone())
-        .uri(uri)
-        .header(HOST, authority)
-        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
-    if let Some(content_type) = content_type {
-        request = request.header(CONTENT_TYPE, content_type);
-    }
-
-    let content_length = i64::try_from(body.as_ref().map_or(0, String::len)).map_err(|_| "S3 request body is too large")?;
-    let signed = sign_v4(
-        request.body(Body::empty())?,
-        content_length,
-        access_key,
-        secret_key,
-        session_token.unwrap_or_default(),
-        "us-east-1",
-    );
-
-    let mut request = local_http_client().request(method, url);
-    for (name, value) in signed.headers() {
-        request = request.header(name, value);
-    }
-    if let Some(body) = body {
-        request = request.body(body);
-    }
-    Ok(request.send().await?)
-}
-
-/// Signs and sends an admin HTTP request with the given credentials.
-pub(crate) async fn admin_request(
-    base_url: &str,
-    method: http::Method,
-    path_and_query: &str,
-    body: Option<String>,
-    access_key: &str,
-    secret_key: &str,
-) -> Result<(StatusCode, String), Box<dyn std::error::Error + Send + Sync>> {
-    admin_request_with_session_token(base_url, method, path_and_query, body, access_key, secret_key, None).await
-}
-
-pub(crate) async fn admin_request_with_session_token(
-    base_url: &str,
-    method: http::Method,
-    path_and_query: &str,
-    body: Option<String>,
-    access_key: &str,
-    secret_key: &str,
-    session_token: Option<&str>,
-) -> Result<(StatusCode, String), Box<dyn std::error::Error + Send + Sync>> {
-    let url = format!("{base_url}{path_and_query}");
-    let content_type = body.as_ref().map(|_| "application/json");
-    let response =
-        signed_s3_request_with_session_token(method, &url, body, content_type, access_key, secret_key, session_token).await?;
-    let status = response.status();
-    let body = response.text().await?;
-    Ok((status, body))
-}
-
-/// Sends a root-credential admin request and returns its successful response body.
-pub(crate) async fn admin_ok(
-    env: &RustFSTestEnvironment,
-    method: http::Method,
-    path_and_query: &str,
-    body: Option<String>,
-) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
-    let (status, response_body) =
-        admin_request(&env.url, method.clone(), path_and_query, body, &env.access_key, &env.secret_key).await?;
-    if !status.is_success() {
-        return Err(format!("{method} {path_and_query} failed: {status} {response_body}").into());
-    }
-    Ok(response_body)
-}
-
 /// Resolve the RustFS binary relative to the workspace.
 pub fn rustfs_binary_path() -> PathBuf {
    rustfs_binary_path_with_features(requested_rustfs_build_features().as_deref())
@@ -465,7 +304,6 @@ impl RustFSTestEnvironment {
    pub async fn new() -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
        let temp_dir = format!("/tmp/rustfs_e2e_test_{}", Uuid::new_v4());
        fs::create_dir_all(&temp_dir).await?;
-        let capture_log_path = configured_capture_log_path(&temp_dir);

        // Use a unique port for each test environment
        let port = Self::find_available_port().await?;
@@ -479,7 +317,7 @@ impl RustFSTestEnvironment {
            access_key: DEFAULT_ACCESS_KEY.to_string(),
            secret_key: DEFAULT_SECRET_KEY.to_string(),
            process: None,
-            capture_log_path,
+            capture_log_path: None,
        })
    }

@@ -487,7 +325,6 @@ impl RustFSTestEnvironment {
    pub async fn with_address(address: &str) -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
        let temp_dir = format!("/tmp/rustfs_e2e_test_{}", Uuid::new_v4());
        fs::create_dir_all(&temp_dir).await?;
-        let capture_log_path = configured_capture_log_path(&temp_dir);

        let url = format!("http://{address}");

@@ -498,7 +335,7 @@ impl RustFSTestEnvironment {
            access_key: DEFAULT_ACCESS_KEY.to_string(),
            secret_key: DEFAULT_SECRET_KEY.to_string(),
            process: None,
-            capture_log_path,
+            capture_log_path: None,
        })
    }

@@ -567,7 +404,13 @@ impl RustFSTestEnvironment {
        for (key, value) in extra_env {
            command.env(key, value);
        }
-        capture_command_logs(&mut command, self.capture_log_path.as_deref())?;
+        // Optionally capture the child's stdout+stderr to a file so the test can
+        // grep server logs (e.g. to confirm which GET reader path was taken).
+        if let Some(log_path) = &self.capture_log_path {
+            let file = stdfs::OpenOptions::new().create(true).append(true).open(log_path)?;
+            let stderr_file = file.try_clone()?;
+            command.stdout(Stdio::from(file)).stderr(Stdio::from(stderr_file));
+        }
        let process = command.args(&args).spawn()?;

        self.process = Some(process);
@@ -647,12 +490,7 @@ impl RustFSTestEnvironment {

    /// Create an AWS S3 client configured for this RustFS instance
    pub fn create_s3_client(&self) -> Client {
-        self.create_s3_client_with_credentials(&self.access_key, &self.secret_key)
-    }
-
-    /// Create an AWS S3 client with explicit credentials for this RustFS instance.
-    pub fn create_s3_client_with_credentials(&self, access_key: &str, secret_key: &str) -> Client {
-        Client::from_conf(build_test_s3_config(&self.url, access_key, secret_key, None, "e2e-test"))
+        Client::from_conf(build_test_s3_config(&self.url, &self.access_key, &self.secret_key, "e2e-test"))
    }

    /// Create test bucket
@@ -1055,7 +893,6 @@ pub struct RustFSTestClusterEnvironment {
    pub secret_key: String,
    pub extra_env: Vec<(String, String)>,
    pub node_extra_env: Vec<Vec<(String, String)>>,
-    pub node_capture_log_paths: Vec<Option<String>>,
    pub topology: ClusterTopology,
 }

@@ -1155,7 +992,6 @@ impl RustFSTestClusterEnvironment {
            secret_key: "rustfs-cluster-test-secret".to_string(),
            extra_env,
            node_extra_env: vec![Vec::new(); topology.node_count],
-            node_capture_log_paths: vec![None; topology.node_count],
            topology,
        })
    }
@@ -1185,20 +1021,6 @@ impl RustFSTestClusterEnvironment {
        Ok(())
    }

-    /// Capture stdout+stderr for a single cluster node process.
-    pub fn set_node_capture_log_path<P>(
-        &mut self,
-        node_idx: usize,
-        path: P,
-    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>>
-    where
-        P: Into<String>,
-    {
-        self.ensure_node_index(node_idx)?;
-        self.node_capture_log_paths[node_idx] = Some(path.into());
-        Ok(())
-    }
-
    fn ensure_node_index(&self, node_idx: usize) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        if node_idx >= self.nodes.len() {
            return Err(format!("node_idx {node_idx} is invalid").into());
@@ -1288,7 +1110,6 @@ impl RustFSTestClusterEnvironment {
            for (key, value) in &self.node_extra_env[i] {
                command.env(key, value);
            }
-            capture_command_logs(&mut command, self.node_capture_log_paths[i].as_deref())?;

            let process = command.current_dir(&node.data_dir).spawn()?;

@@ -1315,7 +1136,6 @@ impl RustFSTestClusterEnvironment {

        let binary_path = rustfs_binary_path();
        let volumes_arg = self.build_volumes_arg();
-        let log_path = self.node_capture_log_paths[node_idx].clone();
        let node = &mut self.nodes[node_idx];
        info!("Starting cluster node {} on {}", node_idx, node.address);

@@ -1334,7 +1154,6 @@ impl RustFSTestClusterEnvironment {
        for (key, value) in &self.node_extra_env[node_idx] {
            command.env(key, value);
        }
-        capture_command_logs(&mut command, log_path.as_deref())?;

        let process = command.current_dir(&node.data_dir).spawn()?;
        node.process = Some(process);
@@ -1403,7 +1222,6 @@ impl RustFSTestClusterEnvironment {
            &self.nodes[node_idx].url,
            &self.access_key,
            &self.secret_key,
-            None,
            "cluster-test",
        )))
    }
@@ -1517,14 +1335,6 @@ mod tests {
        assert_eq!(normalize_rustfs_build_features(" , "), None);
    }

-    #[test]
-    fn capture_log_path_uses_temp_directory_basename() {
-        assert_eq!(
-            capture_log_path(Path::new("/tmp/e2e-logs"), "/tmp/rustfs_e2e_test_abc"),
-            Some(PathBuf::from("/tmp/e2e-logs/rustfs_e2e_test_abc.log"))
-        );
-    }
-
    #[test]
    fn full_feature_enables_any_required_feature() {
        assert!(rustfs_build_feature_enabled(Some("full"), "sftp"));
@@ -1586,7 +1396,6 @@ mod tests {
            secret_key: DEFAULT_SECRET_KEY.to_string(),
            extra_env: Vec::new(),
            node_extra_env: vec![Vec::new(); topology.node_count],
-            node_capture_log_paths: vec![None; topology.node_count],
            topology,
        }
    }
@@ -1682,16 +1491,6 @@ mod tests {
        );
    }

-    #[test]
-    fn cluster_node_log_capture_supports_per_node_paths() {
-        let mut env = fake_cluster(ClusterTopology::single_pool(3));
-        env.set_node_capture_log_path(1, "/tmp/node1.log").unwrap();
-        assert_eq!(env.node_capture_log_paths[0], None);
-        assert_eq!(env.node_capture_log_paths[1], Some("/tmp/node1.log".to_string()));
-        assert_eq!(env.node_capture_log_paths[2], None);
-        assert!(env.set_node_capture_log_path(3, "/tmp/invalid.log").is_err());
-    }
-
    #[test]
    fn cluster_node_env_rejects_invalid_index() {
        let mut env = fake_cluster(ClusterTopology::single_pool(4));
@@ -117,14 +117,9 @@ mod tests {
            .key("assets/explicit-copy.js")
            .copy_source(format!("{bucket}/{key}"))
            .metadata_directive(MetadataDirective::Copy)
-            .customize()
-            .mutate_request(|request| {
-                request.headers_mut().insert("content-type", "application/octet-stream");
-                request.headers_mut().insert("x-amz-meta-request-only", "ignored");
-            })
            .send()
            .await
-            .expect("explicit COPY directive with request metadata failed");
+            .expect("explicit COPY directive failed");
        let explicit_copy_head = client
            .head_object()
            .bucket(bucket)
@@ -133,18 +128,6 @@ mod tests {
            .await
            .expect("HEAD failed after explicit COPY");
        assert_eq!(explicit_copy_head.cache_control(), Some("max-age=60"));
-        assert_eq!(explicit_copy_head.content_type(), Some("text/javascript; charset=utf-8"));
-        assert_eq!(
-            explicit_copy_head.metadata().and_then(|metadata| metadata.get("mtime")),
-            Some(&"1777992333".to_string())
-        );
-        assert_eq!(
-            explicit_copy_head
-                .metadata()
-                .and_then(|metadata| metadata.get("request-only")),
-            None,
-            "COPY must ignore request metadata"
-        );
        assert_eq!(
            explicit_copy_head.website_redirect_location(),
            None,
@@ -588,6 +571,20 @@ mod tests {
            Some("InvalidArgument")
        );

+        let ignored_replacement = client
+            .copy_object()
+            .bucket(bucket)
+            .key(key)
+            .copy_source(format!("{bucket}/{key}"))
+            .content_type("application/ignored")
+            .send()
+            .await
+            .expect_err("Replacement fields without REPLACE should be rejected");
+        assert_eq!(
+            ignored_replacement.as_service_error().and_then(|error| error.code()),
+            Some("InvalidRequest")
+        );
+
        let unchanged = client
            .get_object()
            .bucket(bucket)
@@ -18,7 +18,7 @@ use rustfs_data_usage::DataUsageInfo;
 use serial_test::serial;
 use tokio::time::{Duration, sleep};

-use crate::common::{FAST_DATA_USAGE_SCANNER_ENV, RustFSTestEnvironment, TEST_BUCKET, awscurl_get, init_logging};
+use crate::common::{RustFSTestEnvironment, TEST_BUCKET, awscurl_get, init_logging};

 async fn get_data_usage_info(env: &RustFSTestEnvironment) -> Result<DataUsageInfo, Box<dyn std::error::Error + Send + Sync>> {
    let url = format!("{}/rustfs/admin/v3/datausageinfo", env.url);
@@ -35,26 +35,16 @@ where
    F: FnMut(&DataUsageInfo) -> bool,
 {
    let mut last_usage = DataUsageInfo::default();
-    let mut last_query_error = None;
    for _ in 0..45 {
-        match get_data_usage_info(env).await {
-            Ok(usage) => {
-                last_query_error = None;
-                if usage.buckets_usage.contains_key(bucket) && predicate(&usage) {
-                    return Ok(usage);
-                }
-                last_usage = usage;
-            }
-            Err(err) => last_query_error = Some(err.to_string()),
+        let usage = get_data_usage_info(env).await?;
+        if usage.buckets_usage.contains_key(bucket) && predicate(&usage) {
+            return Ok(usage);
        }
+        last_usage = usage;
        sleep(Duration::from_secs(2)).await;
    }

-    Err(format!(
-        "bucket usage did not converge for {bucket}; last usage: {last_usage:?}; last query error: {}",
-        last_query_error.as_deref().unwrap_or("none")
-    )
-    .into())
+    Err(format!("bucket usage did not converge for {bucket}; last usage: {last_usage:?}").into())
 }

 /// Regression test for data usage accuracy (issue #1012).
@@ -66,7 +56,7 @@ async fn data_usage_reports_all_objects() -> Result<(), Box<dyn std::error::Erro
    init_logging();

    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server_with_env(vec![], FAST_DATA_USAGE_SCANNER_ENV).await?;
+    env.start_rustfs_server(vec![]).await?;

    let client = env.create_s3_client();

@@ -84,14 +74,8 @@ async fn data_usage_reports_all_objects() -> Result<(), Box<dyn std::error::Erro
            .await?;
    }

-    let usage = wait_for_bucket_usage(&env, TEST_BUCKET, |usage| {
-        usage
-            .buckets_usage
-            .get(TEST_BUCKET)
-            .map(|bucket_usage| usage.objects_total_count >= 1000 && bucket_usage.objects_count >= 1000)
-            .unwrap_or(false)
-    })
-    .await?;
+    // Query admin data usage API
+    let usage = get_data_usage_info(&env).await?;

    // Assert total object count and per-bucket count are not truncated
    let bucket_usage = usage
@@ -124,7 +108,7 @@ async fn data_usage_reports_versioned_objects_and_delete_markers() -> Result<(),
    init_logging();

    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server_with_env(vec![], FAST_DATA_USAGE_SCANNER_ENV).await?;
+    env.start_rustfs_server(vec![]).await?;

    let client = env.create_s3_client();
    let bucket = "data-usage-versioned";
@@ -200,8 +184,8 @@ async fn data_usage_reports_versioned_objects_and_delete_markers() -> Result<(),
    assert_eq!(usage.versions_total_count, 3, "total version count should match bucket usage");
    assert_eq!(usage.delete_markers_total_count, 1, "total delete marker count should match bucket usage");

-    env.restart_server_preserving_data(vec![], FAST_DATA_USAGE_SCANNER_ENV)
-        .await?;
+    env.stop_server();
+    env.start_rustfs_server(vec![]).await?;

    let restarted_usage = wait_for_bucket_usage(&env, bucket, |usage| {
        usage
@@ -56,21 +56,6 @@ mod tests {
        );
    }

-    async fn assert_current_list_hides_delete_marker(client: &Client, bucket: &str, key: &str) {
-        let listed = client
-            .list_objects_v2()
-            .bucket(bucket)
-            .prefix(key)
-            .send()
-            .await
-            .expect("list current objects after delete marker");
-
-        assert!(
-            listed.contents().iter().all(|object| object.key() != Some(key)),
-            "ListObjectsV2 must hide an object whose latest version is a delete marker"
-        );
-    }
-
    #[tokio::test]
    #[serial]
    async fn test_versioning_only_delete_marker_has_minio_compatible_visibility_for_migration_proof() {
@@ -109,7 +94,6 @@ mod tests {
        assert_eq!(markers[0].version_id(), Some(delete_marker_version_id));
        assert_eq!(markers[0].is_latest(), Some(true));
        assert_current_get_is_delete_marker_not_found(&client, bucket, key).await;
-        assert_current_list_hides_delete_marker(&client, bucket, key).await;
    }

    #[tokio::test]
@@ -134,17 +118,6 @@ mod tests {
            .await
            .expect("put historical version");
        let data_version_id = put.version_id().expect("put should return data version id");
-        let listed_before_delete = client
-            .list_objects_v2()
-            .bucket(bucket)
-            .prefix(key)
-            .send()
-            .await
-            .expect("list current object before creating delete marker");
-        assert!(
-            listed_before_delete.contents().iter().any(|object| object.key() == Some(key)),
-            "ListObjectsV2 must include the current object before it is deleted"
-        );

        let delete_marker = client
            .delete_object()
@@ -172,7 +145,6 @@ mod tests {
        assert_eq!(markers[0].version_id(), Some(delete_marker_version_id));
        assert_eq!(markers[0].is_latest(), Some(true));
        assert_current_get_is_delete_marker_not_found(&client, bucket, key).await;
-        assert_current_list_hides_delete_marker(&client, bucket, key).await;

        let historical = client
            .get_object()
@@ -1,445 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Regression tests for object delete operations.
-//!
-//! Covers the recurring pattern where DELETE succeeds at the API level but the
-//! object remains visible in LIST, or deleted objects reappear after restart,
-//! or versioned delete operations fail with FileAccessDenied.
-//! This has regressed 15+ times across the entire release history.
-//!
-//! ## Regression Issues
-//!
-//! - rustfs#5375: delete object in a bucket list api also exist this object
-//! - rustfs#5349: The deleted bucket was rebuilt after some time
-//! - rustfs#5339: data not delete in Object Lock bucket
-//! - rustfs#5029: Node Does Not Remove Files After Reconnect to Cluster
-//! - rustfs#4978: DELETE fails with InternalError/FileAccessDenied on beta 10
-//! - rustfs#760: Cannot delete a versioned bucket
-
-#[cfg(test)]
-mod tests {
-    use crate::common::{RustFSTestEnvironment, init_logging};
-    use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::{BucketVersioningStatus, Delete, ObjectIdentifier, VersioningConfiguration};
-    use serial_test::serial;
-    use std::error::Error;
-    use tracing::info;
-
-    type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
-
-    /// RT-05: Verify DELETE → LIST → HEAD consistency.
-    ///
-    /// Regression pattern: DELETE returns 200 but the object remains in LIST.
-    /// Covers rustfs#5375.
-    ///
-    /// Steps:
-    /// 1. Create a bucket and upload an object
-    /// 2. Verify the object is in LIST
-    /// 3. DELETE the object
-    /// 4. Verify the object is NOT in LIST
-    /// 5. Verify HEAD returns 404
-    #[tokio::test]
-    #[serial]
-    async fn test_delete_removes_object_from_list() -> TestResult {
-        init_logging();
-        info!("RT-05: delete removes object from list");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
-        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
-            .await
-            .expect("start RustFS");
-
-        let client = env.create_s3_client();
-        let bucket = "rt05-delete-consistency";
-
-        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
-
-        // Upload an object
-        client
-            .put_object()
-            .bucket(bucket)
-            .key("to-delete.txt")
-            .body(ByteStream::from_static(b"will be deleted"))
-            .send()
-            .await
-            .expect("put object");
-
-        // Verify it appears in LIST
-        let list = client
-            .list_objects_v2()
-            .bucket(bucket)
-            .send()
-            .await
-            .expect("list objects before delete");
-
-        assert!(
-            list.contents()
-                .iter()
-                .map(|o| o.key().unwrap_or(""))
-                .any(|key| key == "to-delete.txt"),
-            "RT-05 FAIL: object not in LIST before delete"
-        );
-
-        // DELETE
-        client
-            .delete_object()
-            .bucket(bucket)
-            .key("to-delete.txt")
-            .send()
-            .await
-            .expect("delete object");
-
-        // Verify NOT in LIST
-        let list = client
-            .list_objects_v2()
-            .bucket(bucket)
-            .send()
-            .await
-            .expect("list objects after delete");
-
-        assert!(
-            !list
-                .contents()
-                .iter()
-                .map(|o| o.key().unwrap_or(""))
-                .any(|key| key == "to-delete.txt"),
-            "RT-05 FAIL: deleted object still in LIST (regression rustfs#5375)"
-        );
-
-        // Verify HEAD returns 404
-        let head = client.head_object().bucket(bucket).key("to-delete.txt").send().await;
-
-        assert!(head.is_err(), "RT-05 FAIL: HEAD on deleted object should return error, got success");
-
-        info!("RT-05 PASS: delete correctly removes object from LIST and HEAD");
-        Ok(())
-    }
-
-    /// RT-05c: Verify batch delete (DeleteObjects) consistency.
-    ///
-    /// Regression pattern: batch delete returns success but some objects
-    /// remain in LIST.
-    #[tokio::test]
-    #[serial]
-    async fn test_batch_delete_removes_all_objects() -> TestResult {
-        init_logging();
-        info!("RT-05c: batch delete removes all objects");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
-        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
-            .await
-            .expect("start RustFS");
-
-        let client = env.create_s3_client();
-        let bucket = "rt05c-batch-delete";
-
-        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
-
-        // Upload multiple objects
-        let keys: Vec<String> = (0..5).map(|i| format!("batch-{i:04}.txt")).collect();
-        for key in &keys {
-            client
-                .put_object()
-                .bucket(bucket)
-                .key(key)
-                .body(ByteStream::from_static(b"batch-delete-me"))
-                .send()
-                .await
-                .expect("put object");
-        }
-
-        // Verify all in LIST
-        let list = client
-            .list_objects_v2()
-            .bucket(bucket)
-            .send()
-            .await
-            .expect("list before batch delete");
-
-        assert_eq!(
-            list.contents().len(),
-            5,
-            "RT-05c FAIL: expected 5 objects before batch delete, found {}",
-            list.contents().len()
-        );
-
-        // Batch delete
-        let objects: Vec<ObjectIdentifier> = keys
-            .iter()
-            .map(|k| ObjectIdentifier::builder().key(k).build().expect("build object id"))
-            .collect();
-
-        client
-            .delete_objects()
-            .bucket(bucket)
-            .delete(Delete::builder().set_objects(Some(objects)).build().expect("build delete"))
-            .send()
-            .await
-            .expect("batch delete");
-
-        // Verify all removed
-        let list = client
-            .list_objects_v2()
-            .bucket(bucket)
-            .send()
-            .await
-            .expect("list after batch delete");
-
-        assert!(
-            list.contents().is_empty(),
-            "RT-05c FAIL: {} objects remain after batch delete (regression: delete objects not fully applied)",
-            list.contents().len()
-        );
-
-        info!("RT-05c PASS: batch delete removes all objects");
-        Ok(())
-    }
-
-    /// RT-05d: Verify versioned delete → permanent delete → object gone.
-    ///
-    /// Covers the pattern where permanent deletion of a specific version
-    /// fails with FileAccessDenied (rustfs#4978).
-    #[tokio::test]
-    #[serial]
-    async fn test_versioned_permanent_delete() -> TestResult {
-        init_logging();
-        info!("RT-05d: versioned permanent delete");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
-        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
-            .await
-            .expect("start RustFS");
-
-        let client = env.create_s3_client();
-        let bucket = "rt05d-permanent-delete";
-
-        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
-
-        client
-            .put_bucket_versioning()
-            .bucket(bucket)
-            .versioning_configuration(
-                VersioningConfiguration::builder()
-                    .status(BucketVersioningStatus::Enabled)
-                    .build(),
-            )
-            .send()
-            .await
-            .expect("enable versioning");
-
-        // Upload a single object (single version)
-        let put_resp = client
-            .put_object()
-            .bucket(bucket)
-            .key("single-version.txt")
-            .body(ByteStream::from_static(b"to-be-permanently-deleted"))
-            .send()
-            .await
-            .expect("put object");
-
-        let version_id = put_resp.version_id().expect("version ID should be present").to_string();
-
-        // Permanently delete the specific version (rustfs#4978: FileAccessDenied)
-        client
-            .delete_object()
-            .bucket(bucket)
-            .key("single-version.txt")
-            .version_id(&version_id)
-            .send()
-            .await
-            .expect("permanent delete should succeed (regression rustfs#4978)");
-
-        // Verify the object is completely gone
-        let versions = client
-            .list_object_versions()
-            .bucket(bucket)
-            .send()
-            .await
-            .expect("list versions");
-
-        assert!(
-            versions.versions().is_empty(),
-            "RT-05d FAIL: version still present after permanent delete"
-        );
-
-        info!("RT-05d PASS: versioned permanent delete succeeds");
-        Ok(())
-    }
-
-    /// RT-05e: Verify delete marker + version history interaction.
-    ///
-    /// Covers the pattern where creating a delete marker and then listing
-    /// versions shows incorrect state (rustfs#760).
-    #[tokio::test]
-    #[serial]
-    async fn test_versioned_delete_marker_and_list_consistency() -> TestResult {
-        init_logging();
-        info!("RT-05e: versioned delete marker and list consistency");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
-        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
-            .await
-            .expect("start RustFS");
-
-        let client = env.create_s3_client();
-        let bucket = "rt05e-dm-consistency";
-
-        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
-
-        client
-            .put_bucket_versioning()
-            .bucket(bucket)
-            .versioning_configuration(
-                VersioningConfiguration::builder()
-                    .status(BucketVersioningStatus::Enabled)
-                    .build(),
-            )
-            .send()
-            .await
-            .expect("enable versioning");
-
-        // Create 3 versions
-        for i in 0..3 {
-            client
-                .put_object()
-                .bucket(bucket)
-                .key("history.txt")
-                .body(ByteStream::from(format!("v{i}").into_bytes()))
-                .send()
-                .await
-                .expect("put version");
-        }
-
-        // Create a delete marker
-        let del = client
-            .delete_object()
-            .bucket(bucket)
-            .key("history.txt")
-            .send()
-            .await
-            .expect("delete (create marker)");
-
-        assert!(del.delete_marker().unwrap_or(false), "RT-05e FAIL: should have created a delete marker");
-
-        // ListObjectVersions should show 3 versions + 1 delete marker
-        let versions = client
-            .list_object_versions()
-            .bucket(bucket)
-            .send()
-            .await
-            .expect("list versions");
-
-        assert_eq!(
-            versions.versions().len(),
-            3,
-            "RT-05e FAIL: expected 3 versions, found {}",
-            versions.versions().len()
-        );
-        assert_eq!(
-            versions.delete_markers().len(),
-            1,
-            "RT-05e FAIL: expected 1 delete marker, found {}",
-            versions.delete_markers().len()
-        );
-
-        // Now delete the delete marker (restore the object)
-        let dm_version = &versions.delete_markers()[0];
-        client
-            .delete_object()
-            .bucket(bucket)
-            .key("history.txt")
-            .version_id(dm_version.version_id().expect("dm version id"))
-            .send()
-            .await
-            .expect("delete delete-marker");
-
-        // HEAD should succeed now (latest version is accessible)
-        let head = client.head_object().bucket(bucket).key("history.txt").send().await;
-
-        assert!(head.is_ok(), "RT-05e FAIL: HEAD should succeed after removing delete marker");
-
-        info!("RT-05e PASS: versioned delete marker and list consistency");
-        Ok(())
-    }
-
-    /// RT-05f: Verify object deletion does not leave orphan data on disk.
-    ///
-    /// Regression pattern: after delete, the object data files remain on disk
-    /// (rustfs#5029: Node Does Not Remove Files After Reconnect).
-    #[tokio::test]
-    #[serial]
-    async fn test_delete_removes_object_head_returns_404() -> TestResult {
-        init_logging();
-        info!("RT-05f: delete → HEAD 404 consistency");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
-        env.start_rustfs_server_with_env(vec![], &[("RUSTFS_CONSOLE_ENABLE", "false")])
-            .await
-            .expect("start RustFS");
-
-        let client = env.create_s3_client();
-        let bucket = "rt05f-delete-head";
-
-        client.create_bucket().bucket(bucket).send().await.expect("create bucket");
-
-        // Upload, delete, verify HEAD returns 404
-        let keys = vec!["small.txt", "medium.txt", "with-slash.txt", "special+chars.txt"];
-
-        for key in &keys {
-            client
-                .put_object()
-                .bucket(bucket)
-                .key(*key)
-                .body(ByteStream::from_static(b"delete-me"))
-                .send()
-                .await
-                .expect("put object");
-        }
-
-        for key in &keys {
-            client
-                .delete_object()
-                .bucket(bucket)
-                .key(*key)
-                .send()
-                .await
-                .expect("delete object");
-        }
-
-        // All HEAD requests should return 404
-        for key in &keys {
-            let head = client.head_object().bucket(bucket).key(*key).send().await;
-
-            assert!(head.is_err(), "RT-05f FAIL: HEAD on deleted key '{key}' should return error");
-        }
-
-        // LIST should be empty
-        let list = client
-            .list_objects_v2()
-            .bucket(bucket)
-            .send()
-            .await
-            .expect("list after all deletes");
-
-        assert!(
-            list.contents().is_empty(),
-            "RT-05f FAIL: {} objects remain after deleting all",
-            list.contents().len()
-        );
-
-        info!("RT-05f PASS: all deleted objects return 404 on HEAD");
-        Ok(())
-    }
-}
@@ -1,202 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Regression tests for distributed cluster startup and quorum.
-//!
-//! Covers the recurring pattern where multi-node clusters fail to start due to
-//! lock quorum issues, DNS resolution delays, or erasure quorum deadlocks.
-//! This has regressed 7+ times.
-//!
-//! ## Regression Issues
-//!
-//! - rustfs#5416: RustFS cannot cold-start with 2/3 quorum when Pod DNS missing
-//! - rustfs#2945: Distributed mode fails on K8s: erasure quorum deadlock
-//! - rustfs#2794: distributed deployment does not become ready
-//! - rustfs#2601: fresh pod immediately enters FaultyDisk state
-//! - rustfs#4040: Distributed startup can fail lock quorum before AppContext initializes
-//! - rustfs#5655: fix(ecstore): bootstrap fresh four-node clusters reliably
-//! - rustfs#4954: S3/health endpoint unavailability after multi-pool scale-up
-
-#[cfg(test)]
-mod tests {
-    use crate::common::{RustFSTestClusterEnvironment, init_logging};
-    use aws_sdk_s3::primitives::ByteStream;
-    use serial_test::serial;
-    use std::error::Error;
-    use tokio::time::{Duration, sleep};
-    use tracing::info;
-
-    type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
-
-    /// RT-10: Verify 4-node cluster starts successfully and all nodes are ready.
-    ///
-    /// Regression pattern: distributed startup fails with quorum deadlock or
-    /// lock acquisition timeout (rustfs#2945, rustfs#5655).
-    ///
-    /// Steps:
-    /// 1. Create a 4-node cluster
-    /// 2. Start all nodes simultaneously
-    /// 3. Verify all nodes report healthy
-    /// 4. Verify S3 operations work through any node
-    #[tokio::test]
-    #[serial]
-    async fn test_four_node_cluster_startup_and_health() -> TestResult {
-        init_logging();
-        info!("RT-10: 4-node cluster startup and health");
-
-        let mut cluster = RustFSTestClusterEnvironment::new(4).await.expect("create 4-node cluster");
-
-        cluster.start().await.expect("start 4-node cluster");
-
-        // Create a bucket and verify it's accessible from all nodes
-        cluster
-            .create_test_bucket("rt10-startup")
-            .await
-            .expect("create bucket on cluster");
-
-        let clients = cluster.create_all_clients().expect("create per-node clients");
-
-        // Verify S3 operations work from every node
-        for (i, client) in clients.iter().enumerate() {
-            client
-                .put_object()
-                .bucket("rt10-startup")
-                .key(format!("from-node-{i}.txt"))
-                .body(ByteStream::from_static(b"hello from node"))
-                .send()
-                .await
-                .unwrap_or_else(|e| panic!("PUT from node {i} failed: {e}"));
-        }
-
-        // Verify all objects are visible from node 0
-        let list = clients[0]
-            .list_objects_v2()
-            .bucket("rt10-startup")
-            .send()
-            .await
-            .expect("list objects from node 0");
-
-        assert_eq!(
-            list.contents().len(),
-            4,
-            "RT-10 FAIL: expected 4 objects (one per node), found {}",
-            list.contents().len()
-        );
-
-        info!("RT-10 PASS: 4-node cluster starts and serves S3 from all nodes");
-        Ok(())
-    }
-
-    /// RT-10b: Verify cluster handles node restart gracefully.
-    ///
-    /// Regression pattern: after a node restart, it cannot rejoin the cluster
-    /// or enters a faulty state (rustfs#2601).
-    #[tokio::test]
-    #[serial]
-    async fn test_cluster_survives_node_restart() -> TestResult {
-        init_logging();
-        info!("RT-10b: cluster survives node restart");
-
-        let mut cluster = RustFSTestClusterEnvironment::new(4).await.expect("create 4-node cluster");
-
-        cluster.start().await.expect("start cluster");
-
-        cluster.create_test_bucket("rt10b-restart").await.expect("create bucket");
-
-        // Write data
-        let clients = cluster.create_all_clients()?;
-        clients[0]
-            .put_object()
-            .bucket("rt10b-restart")
-            .key("before-restart.txt")
-            .body(ByteStream::from_static(b"persistent data"))
-            .send()
-            .await
-            .expect("put object before restart");
-
-        // Stop node 3
-        cluster.stop_node(3).expect("stop node 3");
-        sleep(Duration::from_secs(2)).await;
-
-        // Verify cluster still works with 3/4 nodes (quorum)
-        clients[0]
-            .put_object()
-            .bucket("rt10b-restart")
-            .key("during-offline.txt")
-            .body(ByteStream::from_static(b"written while node 3 down"))
-            .send()
-            .await
-            .expect("PUT should succeed with 3/4 nodes");
-
-        // Restart node 3
-        cluster.start_node(3).await.expect("restart node 3");
-
-        // Wait for node to rejoin
-        sleep(Duration::from_secs(3)).await;
-
-        // Verify the restarted node can serve reads
-        let list = clients[3]
-            .list_objects_v2()
-            .bucket("rt10b-restart")
-            .send()
-            .await
-            .expect("list from restarted node");
-
-        assert!(
-            list.contents().len() >= 2,
-            "RT-10b FAIL: restarted node sees {} objects, expected >= 2",
-            list.contents().len()
-        );
-
-        info!("RT-10b PASS: cluster survives and recovers from node restart");
-        Ok(())
-    }
-
-    /// RT-10c: Verify bucket creation persists across all nodes.
-    ///
-    /// Regression pattern: bucket metadata is not replicated to all nodes,
-    /// causing NoSuchBucket errors on some nodes (rustfs#3191).
-    #[tokio::test]
-    #[serial]
-    async fn test_bucket_visible_from_all_nodes() -> TestResult {
-        init_logging();
-        info!("RT-10c: bucket visible from all nodes");
-
-        let mut cluster = RustFSTestClusterEnvironment::new(4).await.expect("create 4-node cluster");
-
-        cluster.start().await.expect("start cluster");
-
-        cluster
-            .create_test_bucket("rt10c-bucket-visibility")
-            .await
-            .expect("create bucket");
-
-        let clients = cluster.create_all_clients()?;
-
-        // Verify the bucket is visible from every node
-        for (i, client) in clients.iter().enumerate() {
-            let resp = client
-                .list_objects_v2()
-                .bucket("rt10c-bucket-visibility")
-                .send()
-                .await
-                .unwrap_or_else(|e| panic!("list from node {i} failed (NoSuchBucket?): {e}"));
-
-            assert!(resp.contents().is_empty(), "RT-10c: fresh bucket should be empty on node {i}");
-        }
-
-        info!("RT-10c PASS: bucket visible from all 4 nodes");
-        Ok(())
-    }
-}
@@ -30,10 +30,10 @@ use s3s::access::{S3Access, S3AccessContext};
 use s3s::auth::SimpleAuth;
 use s3s::dto::{
    AbortMultipartUploadInput, AbortMultipartUploadOutput, CompleteMultipartUploadInput, CompleteMultipartUploadOutput,
-    CreateMultipartUploadInput, CreateMultipartUploadOutput, DeleteMarkerEntry, DeleteObjectInput, DeleteObjectOutput, ETag,
+    CreateMultipartUploadInput, CreateMultipartUploadOutput, DeleteObjectInput, DeleteObjectOutput, ETag,
    GetBucketVersioningInput, GetBucketVersioningOutput, GetObjectInput, GetObjectOutput, HeadBucketInput, HeadBucketOutput,
-    HeadObjectInput, HeadObjectOutput, ListObjectVersionsInput, ListObjectVersionsOutput, ObjectVersionId, PutObjectInput,
-    PutObjectOutput, StreamingBlob, Timestamp, TimestampFormat, UploadPartInput, UploadPartOutput,
+    HeadObjectInput, HeadObjectOutput, PutObjectInput, PutObjectOutput, StreamingBlob, Timestamp, TimestampFormat,
+    UploadPartInput, UploadPartOutput,
 };
 use s3s::service::{S3Service, S3ServiceBuilder};
 use s3s::validation::{AwsNameValidation, NameValidation};
@@ -91,7 +91,6 @@ pub enum Operation {
    GetObject,
    HeadObject,
    DeleteObject,
-    ListObjectVersions,
    CreateMultipartUpload,
    UploadPart,
    CompleteMultipartUpload,
@@ -110,8 +109,6 @@ pub enum FaultAction {
    /// already have buffered the rest of the current frame; the journal reports
    /// the threshold, and the backend never receives or stores the request.
    DisconnectAfterBytes(usize),
-    /// Apply the request, then close the connection before returning its response.
-    DisconnectAfterResponse,
    /// Drain a request body in fixed-size slices, sleeping after every slice.
    SlowDrain { chunk_bytes: usize, delay: Duration },
    /// Store the request normally but replace the response ETag.
@@ -137,15 +134,12 @@ pub struct RequestRecord {
 #[derive(Default)]
 struct ControlState {
    scripts: HashMap<Operation, VecDeque<FaultAction>>,
-    keyed_scripts: HashMap<(Operation, String), VecDeque<FaultAction>>,
    requests: VecDeque<RequestRecord>,
    next_sequence: u64,
 }

 #[derive(Default)]
 struct StoreState {
-    assign_own_version_ids: bool,
-    assign_own_multipart_version_ids: bool,
    buckets: HashMap<String, BucketState>,
    uploads: HashMap<String, MultipartState>,
    total_bytes: usize,
@@ -358,60 +352,25 @@ impl FakeS3Target {
        state.buckets.entry(bucket).or_default();
    }

-    /// Remove all retained object versions while preserving the bucket.
-    pub fn clear_bucket_objects(&self, bucket: &str) {
-        let mut state = lock(&self.backend.store);
-        let (removed_versions, removed_bytes) = state
-            .buckets
-            .get_mut(bucket)
-            .expect("fake target bucket must exist")
-            .objects
-            .drain()
-            .flat_map(|(_, versions)| versions)
-            .fold((0usize, 0usize), |(count, bytes), version| (count + 1, bytes + version.body.len()));
-        state.total_versions = state
-            .total_versions
-            .checked_sub(removed_versions)
-            .expect("fake target version accounting must not underflow");
-        state.total_bytes = state
-            .total_bytes
-            .checked_sub(removed_bytes)
-            .expect("fake target byte accounting must not underflow");
-    }
-
-    pub fn has_object(&self, bucket: &str, key: &str) -> bool {
-        lock(&self.backend.store)
-            .buckets
-            .get(bucket)
-            .and_then(|bucket| bucket.objects.get(key))
-            .and_then(|versions| versions.last())
-            .is_some_and(|version| !version.delete_marker)
-    }
-
-    /// Make the target mint its own version ids instead of mirroring the
-    /// forwarded source version id — models a generic S3 service.
-    pub fn assign_own_version_ids(&self, enabled: bool) {
-        lock(&self.backend.store).assign_own_version_ids = enabled;
-    }
-
-    /// Mint own version ids for the multipart path only — models a target
-    /// that adopts PutObject version ids but not CreateMultipartUpload ones.
-    pub fn assign_own_multipart_version_ids(&self, enabled: bool) {
-        lock(&self.backend.store).assign_own_multipart_version_ids = enabled;
-    }
-
-    pub fn active_multipart_upload_count(&self) -> usize {
-        lock(&self.backend.store).uploads.len()
-    }
-
    /// Queue `times` copies of a fault for one operation.
    pub fn inject(&self, operation: Operation, action: FaultAction, times: usize) {
        if times == 0 {
            return;
        }
-        validate_fault_action(&action);
+        if let FaultAction::SlowDrain { chunk_bytes: 0, .. } = action {
+            panic!("slow-drain chunk size must be non-zero");
+        }
+        match &action {
+            FaultAction::Delay(duration) if *duration > MAX_FAULT_DURATION => {
+                panic!("fault delay must not exceed 30 seconds");
+            }
+            FaultAction::SlowDrain { delay, .. } if *delay >= MAX_FAULT_DURATION => {
+                panic!("slow-drain slice delay must be below 30 seconds");
+            }
+            _ => {}
+        }
        let mut state = lock(&self.control);
-        let queued = queued_fault_count(&state);
+        let queued = state.scripts.values().map(VecDeque::len).sum::<usize>();
        if queued.checked_add(times).is_none_or(|total| total > MAX_SCRIPTED_FAULTS) {
            panic!("fake target queues at most 4096 scripted faults");
        }
@@ -422,28 +381,8 @@ impl FakeS3Target {
            .extend(std::iter::repeat_n(action, times));
    }

-    /// Queue faults for one exact object key without affecting concurrent requests.
-    pub fn inject_for_key(&self, operation: Operation, key: impl Into<String>, action: FaultAction, times: usize) {
-        if times == 0 {
-            return;
-        }
-        validate_fault_action(&action);
-        let mut state = lock(&self.control);
-        let queued = queued_fault_count(&state);
-        if queued.checked_add(times).is_none_or(|total| total > MAX_SCRIPTED_FAULTS) {
-            panic!("fake target queues at most 4096 scripted faults");
-        }
-        state
-            .keyed_scripts
-            .entry((operation, key.into()))
-            .or_default()
-            .extend(std::iter::repeat_n(action, times));
-    }
-
    pub fn clear_faults(&self) {
-        let mut state = lock(&self.control);
-        state.scripts.clear();
-        state.keyed_scripts.clear();
+        lock(&self.control).scripts.clear();
    }

    pub fn requests(&self) -> Vec<RequestRecord> {
@@ -454,25 +393,6 @@ impl FakeS3Target {
        lock(&self.control).requests.drain(..).collect()
    }

-    /// Stored versions for one key as `(version_id, is_delete_marker)`, oldest
-    /// first. Empty when the bucket or key does not exist. Lets purge tests
-    /// assert on the target's actual state instead of inferring it from the
-    /// request journal (a versioned DELETE is a silent no-op for missing ids).
-    pub fn stored_versions(&self, bucket: &str, key: &str) -> Vec<(String, bool)> {
-        let state = lock(&self.backend.store);
-        state
-            .buckets
-            .get(bucket)
-            .and_then(|bucket_state| bucket_state.objects.get(key))
-            .map(|versions| {
-                versions
-                    .iter()
-                    .map(|version| (version.version_id.clone(), version.delete_marker))
-                    .collect()
-            })
-            .unwrap_or_default()
-    }
-
    pub async fn shutdown(mut self) {
        let _ = self.shutdown.send(true);
        if let Some(task) = self.task.take() {
@@ -500,25 +420,6 @@ fn lock<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
    mutex.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
 }

-fn validate_fault_action(action: &FaultAction) {
-    if let FaultAction::SlowDrain { chunk_bytes: 0, .. } = action {
-        panic!("slow-drain chunk size must be non-zero");
-    }
-    match action {
-        FaultAction::Delay(duration) if *duration > MAX_FAULT_DURATION => {
-            panic!("fault delay must not exceed 30 seconds");
-        }
-        FaultAction::SlowDrain { delay, .. } if *delay >= MAX_FAULT_DURATION => {
-            panic!("slow-drain slice delay must be below 30 seconds");
-        }
-        _ => {}
-    }
-}
-
-fn queued_fault_count(state: &ControlState) -> usize {
-    state.scripts.values().map(VecDeque::len).sum::<usize>() + state.keyed_scripts.values().map(VecDeque::len).sum::<usize>()
-}
-
 #[async_trait]
 impl S3Access for FaultAccess {
    async fn check(&self, context: &mut S3AccessContext<'_>) -> S3Result<()> {
@@ -591,12 +492,7 @@ fn record_request(
    content_length: Option<u64>,
 ) -> Option<RequestFault> {
    let mut state = lock(control);
-    let action = parsed
-        .key
-        .as_ref()
-        .and_then(|key| state.keyed_scripts.get_mut(&(operation, key.clone())))
-        .and_then(VecDeque::pop_front)
-        .or_else(|| state.scripts.get_mut(&operation).and_then(VecDeque::pop_front));
+    let action = state.scripts.get_mut(&operation).and_then(VecDeque::pop_front);
    state.next_sequence += 1;
    let sequence = state.next_sequence;
    if state.requests.len() == MAX_REQUEST_RECORDS {
@@ -673,14 +569,12 @@ fn parse_request(method: &Method, uri: &Uri) -> ParsedRequest {
    let operation = match (method, key.is_some()) {
        (&Method::HEAD, false) => Operation::HeadBucket,
        (&Method::GET, false) if query.contains_key("versioning") => Operation::GetBucketVersioning,
-        (&Method::GET, false) if query.contains_key("versions") => Operation::ListObjectVersions,
        (&Method::PUT, true) if upload_id.is_some() && part_number.is_some() => Operation::UploadPart,
        (&Method::PUT, true) if upload_id.is_some() || query.contains_key("partNumber") => Operation::Unknown,
        (&Method::POST, true) if query.contains_key("uploads") => Operation::CreateMultipartUpload,
        (&Method::POST, true) if upload_id.is_some() => Operation::CompleteMultipartUpload,
        (&Method::DELETE, true) if upload_id.is_some() => Operation::AbortMultipartUpload,
-        // A replication PUT addresses the source version via `?versionId=`.
-        (&Method::PUT, true) if only_query_keys(&["versionId"]) => Operation::PutObject,
+        (&Method::PUT, true) if only_query_keys(&[]) => Operation::PutObject,
        (&Method::GET, true) if only_query_keys(&["versionId"]) => Operation::GetObject,
        (&Method::HEAD, true) if only_query_keys(&["versionId"]) => Operation::HeadObject,
        (&Method::DELETE, true) if only_query_keys(&["versionId"]) => Operation::DeleteObject,
@@ -730,17 +624,10 @@ fn validate_retained_identifier(value: String, field: &str) -> S3Result<String>
    }
 }

-/// `assign_own` models a target that mints its own version ids (a generic S3
-/// service): the forwarded source-version-id header is validated but NOT
-/// mirrored into the stored version.
-fn new_version_id(headers: &HeaderMap, assign_own: bool) -> S3Result<String> {
+fn new_version_id(headers: &HeaderMap) -> S3Result<String> {
    let Some(value) = header_value(headers, &SOURCE_VERSION_ID_HEADERS) else {
        return Ok(Uuid::new_v4().to_string());
    };
-    if assign_own {
-        validate_retained_identifier(value.trim().to_owned(), "source version ID")?;
-        return Ok(Uuid::new_v4().to_string());
-    }
    let value = validate_retained_identifier(value.trim().to_owned(), "source version ID")?;
    let version_id = Uuid::parse_str(&value).map_err(|_| s3s::s3_error!(InvalidArgument, "source version ID must be a UUID"))?;
    Ok(version_id.to_string())
@@ -825,10 +712,7 @@ async fn apply_non_body_fault(fault: Option<&RequestFault>, control: &Mutex<Cont
            update_consumed(control, fault.expect("matched fault").sequence, 0);
            Err(scripted_disconnect_error())
        }
-        Some(FaultAction::SlowDrain { .. })
-        | Some(FaultAction::WrongEtag)
-        | Some(FaultAction::DisconnectAfterResponse)
-        | None => Ok(()),
+        Some(FaultAction::SlowDrain { .. }) | Some(FaultAction::WrongEtag) | None => Ok(()),
    }
 }

@@ -869,7 +753,7 @@ async fn collect_stream(
            Some(FaultAction::SlowDrain { chunk_bytes, delay }) => {
                return collect_stream_slow(body, capacity, *chunk_bytes, *delay).await;
            }
-            Some(FaultAction::WrongEtag) | Some(FaultAction::DisconnectAfterResponse) | None => {}
+            Some(FaultAction::WrongEtag) | None => {}
        }

        let mut output = BytesMut::with_capacity(capacity);
@@ -931,9 +815,6 @@ fn apply_response_fault<T>(mut response: S3Response<T>, fault: Option<&RequestFa
    if fault.is_some_and(|fault| fault.action == FaultAction::WrongEtag) {
        response.headers.insert(ETAG, HeaderValue::from_static(WRONG_ETAG));
    }
-    if fault.is_some_and(|fault| fault.action == FaultAction::DisconnectAfterResponse) {
-        response.headers.insert(DISCONNECT_HEADER, HeaderValue::from_static("true"));
-    }
    response
 }

@@ -1122,63 +1003,6 @@ impl S3 for FakeBackend {
        ))
    }

-    /// Prefix + max-keys subset only — enough for the replication-check probe
-    /// key allocation. No pagination markers or delimiter folding.
-    async fn list_object_versions(
-        &self,
-        req: S3Request<ListObjectVersionsInput>,
-    ) -> S3Result<S3Response<ListObjectVersionsOutput>> {
-        let fault = request_fault(&req);
-        apply_non_body_fault(fault.as_ref(), &self.control).await?;
-        let state = lock(&self.store);
-        let Some(bucket_state) = state.buckets.get(&req.input.bucket) else {
-            return Err(s3s::s3_error!(NoSuchBucket, "bucket does not exist"));
-        };
-        let prefix = req.input.prefix.as_deref().unwrap_or_default();
-        let max_keys = req.input.max_keys.unwrap_or(1000).max(0) as usize;
-
-        let mut keys: Vec<&String> = bucket_state.objects.keys().filter(|key| key.starts_with(prefix)).collect();
-        keys.sort();
-
-        let mut versions = Vec::new();
-        let mut delete_markers = Vec::new();
-        'keys: for key in keys {
-            for version in bucket_state.objects[key].iter().rev() {
-                if versions.len() + delete_markers.len() >= max_keys {
-                    break 'keys;
-                }
-                if version.delete_marker {
-                    delete_markers.push(DeleteMarkerEntry {
-                        key: Some(key.clone()),
-                        version_id: Some(ObjectVersionId::from(version.version_id.clone())),
-                        last_modified: Some(version.last_modified.clone()),
-                        ..Default::default()
-                    });
-                } else {
-                    versions.push(s3s::dto::ObjectVersion {
-                        key: Some(key.clone()),
-                        version_id: Some(ObjectVersionId::from(version.version_id.clone())),
-                        last_modified: Some(version.last_modified.clone()),
-                        e_tag: Some(ETag::Strong(version.e_tag.clone())),
-                        size: Some(version.body.len() as i64),
-                        ..Default::default()
-                    });
-                }
-            }
-        }
-        drop(state);
-
-        Ok(apply_response_fault(
-            S3Response::new(ListObjectVersionsOutput {
-                name: Some(req.input.bucket),
-                versions: Some(versions),
-                delete_markers: Some(delete_markers),
-                ..Default::default()
-            }),
-            fault.as_ref(),
-        ))
-    }
-
    async fn put_object(&self, req: S3Request<PutObjectInput>) -> S3Result<S3Response<PutObjectOutput>> {
        let fault = request_fault(&req);
        let _body_permit = timeout(MAX_FAULT_DURATION, Arc::clone(&self.body_limit).acquire_owned())
@@ -1189,8 +1013,7 @@ impl S3 for FakeBackend {
        let input = req.input;
        let body = collect_stream(input.body, input.content_length, fault.as_ref(), &self.control).await?;
        validate_stored_metadata(&input.content_type, &input.metadata)?;
-        let assign_own = lock(&self.store).assign_own_version_ids;
-        let version_id = new_version_id(&headers, assign_own)?;
+        let version_id = new_version_id(&headers)?;
        let e_tag = match source_etag(&headers)? {
            Some(value) => value,
            None => {
@@ -1233,7 +1056,7 @@ impl S3 for FakeBackend {
                content_type: version.content_type,
                metadata: version.metadata,
                e_tag: Some(ETag::Strong(version.e_tag)),
-                last_modified: Some(version.last_modified.clone()),
+                last_modified: Some(version.last_modified),
                version_id: Some(version.version_id),
                ..Default::default()
            }),
@@ -1255,7 +1078,7 @@ impl S3 for FakeBackend {
                content_type: version.content_type,
                metadata: version.metadata,
                e_tag: Some(ETag::Strong(version.e_tag)),
-                last_modified: Some(version.last_modified.clone()),
+                last_modified: Some(version.last_modified),
                version_id: Some(version.version_id),
                ..Default::default()
            }),
@@ -1324,9 +1147,7 @@ impl S3 for FakeBackend {
            ));
        }

-        // `state` is the live store guard: read the flag from it. Re-locking
-        // would self-deadlock (the store mutex is not reentrant).
-        let version_id = new_version_id(&headers, state.assign_own_version_ids)?;
+        let version_id = new_version_id(&headers)?;
        upsert_version(
            &mut state,
            &input.bucket,
@@ -1366,16 +1187,12 @@ impl S3 for FakeBackend {
        ensure_upload_budget(&state)?;
        validate_stored_metadata(&input.content_type, &input.metadata)?;
        let upload_id = Uuid::new_v4().to_string();
-        // Read the flag before the mutable borrow of `state.uploads` below
-        // (and never re-lock the store: the mutex is not reentrant).
-        let mint_own = state.assign_own_version_ids || state.assign_own_multipart_version_ids;
-        let version_id = new_version_id(&headers, mint_own)?;
        state.uploads.insert(
            upload_id.clone(),
            MultipartState {
                bucket: input.bucket.clone(),
                key: input.key.clone(),
-                version_id,
+                version_id: new_version_id(&headers)?,
                content_type: input.content_type,
                metadata: input.metadata,
                parts: BTreeMap::new(),
@@ -189,6 +189,8 @@ mod tests {
            ("RUSTFS_GET_CODEC_STREAMING_ROLLOUT_PCT", "100"),
            ("RUSTFS_GET_CODEC_STREAMING_BODY_COMPAT_CONFIRMED", "true"),
            ("RUSTFS_GET_CODEC_STREAMING_HEADER_COMPAT_CONFIRMED", "true"),
+            // Lower the min-size floor so every non-inline object below is eligible.
+            ("RUSTFS_GET_CODEC_STREAMING_MIN_SIZE", "4096"),
            // Route multipart objects through per-part codec streaming too.
            ("RUSTFS_GET_CODEC_STREAMING_MULTIPART_ENABLE", "true"),
            // Lock optimization is on by default, but pin it so the gate's
@@ -313,13 +315,6 @@ mod tests {
                },
                payload(64 * 1024, 2),
            ),
-            (
-                Shape {
-                    key: "small-non-inline-256kib-plus",
-                    expect_large: true,
-                },
-                payload(256 * 1024 + 1, 6),
-            ),
            (
                Shape {
                    key: "mid-1_5mib",
@@ -14,7 +14,7 @@

 //! E2E tests for group management (fixes #2028).

-use crate::common::{RustFSTestEnvironment, admin_request, awscurl_delete, awscurl_get, awscurl_put, init_logging};
+use crate::common::{RustFSTestEnvironment, awscurl_delete, awscurl_get, awscurl_put, init_logging};
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::{Client, Config};
 use serial_test::serial;
@@ -32,56 +32,6 @@ fn create_user_s3_client(env: &RustFSTestEnvironment, access_key: &str, secret_k
    Client::from_conf(config)
 }

-#[tokio::test(flavor = "multi_thread")]
-async fn update_group_members_rejects_invalid_new_group_names() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let invalid_groups = [
-        ("test group", "group name contains whitespace"),
-        ("test=group", "group name contains reserved characters =,"),
-        ("test,group", "group name contains reserved characters =,"),
-    ];
-
-    for (group, expected_message) in invalid_groups {
-        let body = serde_json::json!({
-            "group": group,
-            "members": [],
-            "isRemove": false,
-            "groupStatus": "enabled"
-        })
-        .to_string();
-        let (status, response_body) = admin_request(
-            &env.url,
-            http::Method::PUT,
-            "/rustfs/admin/v3/update-group-members",
-            Some(body),
-            &env.access_key,
-            &env.secret_key,
-        )
-        .await?;
-
-        assert_eq!(
-            status,
-            reqwest::StatusCode::BAD_REQUEST,
-            "invalid group {group:?} must return HTTP 400, body: {response_body}"
-        );
-        assert!(
-            response_body.contains("<Code>InvalidArgument</Code>"),
-            "invalid group {group:?} must return InvalidArgument, body: {response_body}"
-        );
-        assert!(
-            response_body.contains(&format!("<Message>{expected_message}</Message>")),
-            "invalid group {group:?} returned an unexpected message: {response_body}"
-        );
-    }
-
-    env.stop_server();
-    Ok(())
-}
-
 /// Test that deleting a group with members fails, and deleting an empty group succeeds.
 #[tokio::test(flavor = "multi_thread")]
 #[serial]
--- a/Show More
+++ b/Show More