ci: build macOS and Windows on a weekly schedule

Keep the 01:13 UTC cron on Linux and add a Sunday 16:00 UTC cron
for macOS and Windows. Select that subset from the firing cron so a
delayed runner cannot guess the weekday.

Co-authored-by: hector <majinghe@users.noreply.github.com>

.config/e2e-full-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=0374e6b9b061dd5d622686301386232a4aa1cb22eedc18af70d2a7411bc66f8d
-sha256-linux=f2cee240f7a744ae991971820f48a6c9c28d19f525e8b2345fcb76eeaaf1e382
+sha256-darwin=9901a4950099b94d3d2618524d540f1ed4bf6023044903886f98b6c4bf5f30fb
+sha256-linux=09fd5f48f5556c9fc576357222dccd7ebb0b90b790798f1834db2ec5d67b4952

.config/e2e-repl-nightly-selection.txt

@@ -1 +1 @@
-sha256=4eac269f9a59b2f9be4e7a87ea6aa38454f5ebe10ede35c9b8d4218137d2cd35
+sha256=e4ee3898b840a8374cb02c64342cc15f8d7ecd1becaf4b4a2a4657290f9e7ff1

.config/e2e-smoke-selection.txt

@@ -1 +1 @@
-sha256=21e9a1561ac20382503c38353bbb9b830658534a4f277c254a42d0afc6ebed8b
+sha256=5bdd4c2eadbc41625ae3184fff34062e000d328108436259b2b7c4fe2531ecaf

.config/make/lint-fmt.mak

@@ -70,16 +70,6 @@ s3s-footprint-check: ## Check the s3s dependency footprint ratchet stays frozen
 	@echo "📦 Checking s3s footprint ratchet..."
 	./scripts/check_s3s_footprint.sh
 
-.PHONY: test-count-ratchet-check
-test-count-ratchet-check: ## Check no workspace crate fell below its test floor or rose above its #[ignore] ceiling in the committed baseline
-	@echo "🧪 Checking per-crate test-count ratchet..."
-	./scripts/check_test_count_ratchet.sh
-
-.PHONY: test-seams-check
-test-seams-check: ## Check tests outside an operation's owner call its use-case only through rustfs/src/app/test_seams
-	@echo "🧪 Checking cross-owner test seams..."
-	$(RUSTFS_PYTHON_BIN) ./scripts/check_test_seams.py
-
 .PHONY: fips-wording-check
 fips-wording-check: ## Check docs and crates/kms do not over-claim crypto capabilities
 	@echo "📣 Checking cryptographic capability wording guard..."

.config/make/pre-commit.mak

@@ -20,11 +20,11 @@ planning-docs-check: ## Check that no planning-type documents are committed
 	./scripts/check_no_planning_docs.sh
 
 .PHONY: pre-commit
-pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check test-count-ratchet-check test-seams-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
+pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
 	@echo "✅ All pre-commit checks passed!"
 
 .PHONY: pre-pr
-pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check test-count-ratchet-check test-seams-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check log-analyzer-rules-check offline-enrollment-e2e-check clippy-check test ## Run full pre-PR checks with clippy and tests
+pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check log-analyzer-rules-check offline-enrollment-e2e-check clippy-check test ## Run full pre-PR checks with clippy and tests
 	@echo "✅ All pre-PR checks passed!"
 
 .PHONY: dev-check

.config/make/tests.mak

@@ -60,18 +60,9 @@ script-tests: ## Run shell script tests
 	./scripts/test_python_bin.sh
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_check_doc_paths.py
 	./scripts/check_embedded_secrets.sh --self-test
-	./scripts/check_s3s_footprint.sh --self-test
-	./scripts/test_check_test_count_ratchet.sh
-	./scripts/test_guard_source_set.sh
-	./scripts/test_split_guard_rules.sh
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_test_wiring.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/codemods/s3_error_to_s3_types.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/codemods/split_bucket_usecase.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/codemods/split_lifecycle_transition_api_test.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/check_test_seams.py --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_e2e_binary.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_download_release_asset.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_reference_binary.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_inspect_btf_prototypes.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_release_build_workflow.py
 	$(RUSTFS_PYTHON_BIN) -m unittest discover -s scripts/release -p "test_*.py"
@@ -95,11 +86,8 @@ script-tests: ## Run shell script tests
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_inspect_validation_runner.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_retain_validation_evidence.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_ci_timing_report.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_junit_diff.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/s3-tests/test_report_compat.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/s3-tests/test_runner_tools.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/s3-tests/test_api_coverage.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/s3-tests/test_reference_parity.py
 	bash -n ./scripts/validate_object_data_cache_cold_stampede.sh
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_object_data_cache_follower_samples.py --self-test
 	./scripts/validate_object_data_cache_cold_stampede.sh --self-test

.config/nextest.toml

@@ -137,7 +137,7 @@ filter = '(package(rustfs) & test(/^(admin::handlers::replication::target_repair
 setup = 'ecstore-base-stack'
 
 [[profile.default.scripts]]
-filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::complete::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
+filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
 setup = 'ecstore-base-stack'
 
 # These handler/store fixtures and the relocated-pool GET compose deep storage
@@ -356,12 +356,6 @@ threads-required = "num-test-threads"
 filter = 'package(rustfs-ecstore) & test(=store::init::tests::dispatch_manifest_rollback_bounded_concurrency_reaches_tail_behind_slow_member)'
 threads-required = "num-test-threads"
 
-# These short-deadline real-disk progress probes need the test run's capacity
-# for scanner and object-lock handoffs; keep their assertions and deadlines.
-[[profile.default.overrides]]
-filter = '(package(rustfs-scanner) & (test(=scanner::tests::cycle_persist_failure::later_cycle_post_commit_failure_reloads_durable_state) | test(=scanner::tests::running_main_loop_catches_up_pause_cleared_after_startup_observe))) | (package(rustfs-ecstore) & test(=store::init::tests::restored_transitioned_delete_causally_enqueues_free_version))'
-threads-required = "num-test-threads"
-
 # ---------------------------------------------------------------------------
 # ci profile — the strict CI gate (ci.yml `cargo nextest run --profile ci`)
 # ---------------------------------------------------------------------------
@@ -430,12 +424,6 @@ threads-required = "num-test-threads"
 filter = 'package(rustfs-scanner) & (test(/^scanner::backlog::tests::native_/) | test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(/^scanner_io::tests::service_cohort::/))'
 threads-required = "num-test-threads"
 
-# Keep short-deadline real-disk progress probes from competing with unrelated
-# tests for scanner and object-lock capacity. Assertions and deadlines stay on.
-[[profile.ci.overrides]]
-filter = '(package(rustfs-scanner) & (test(=scanner::tests::cycle_persist_failure::later_cycle_post_commit_failure_reloads_durable_state) | test(=scanner::tests::running_main_loop_catches_up_pause_cleared_after_startup_observe))) | (package(rustfs-ecstore) & test(=store::init::tests::restored_transitioned_delete_causally_enqueues_free_version))'
-threads-required = "num-test-threads"
-
 # Emit this expensive fixture's stage timings in CI and use tmpfs when safe.
 [[profile.ci.overrides]]
 filter = 'package(rustfs-ecstore) & test(=store::init::tests::decommission_durable_ilm_receipt_pagination_fails_closed_on_second_page)'
@@ -455,7 +443,7 @@ filter = '(package(rustfs) & test(/^(admin::handlers::replication::target_repair
 setup = 'ecstore-base-stack'
 
 [[profile.ci.scripts]]
-filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::complete::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
+filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
 setup = 'ecstore-base-stack'
 
 [[profile.ci.scripts]]
@@ -710,14 +698,6 @@ test-group = 'ecstore-serial-flaky'
 # the PR-lane e2e coverage for scanner usage snapshots consumed by quota and
 # admin surfaces. It uses the same single-node, random-port, isolated-temp-dir
 # fixture as the existing smoke modules.
-#
-# Dual-stack differential (rustfs/backlog#2740): `dual_stack_differential::`
-# starts two single-node servers from the same binary, one per
-# RUSTFS_S3_STACK value, on random ports with isolated temp dirs, and runs one
-# SDK script covering every operation of `impl S3 for FS` against both. Its
-# comparator unit tests need no server. It meets the admission criteria
-# unchanged; the module clause admits a new differential test without another
-# filter edit.
 [profile.e2e-smoke]
 default-filter = """
     package(e2e_test) & (
@@ -726,7 +706,6 @@ default-filter = """
         | test(/^reliant::lifecycle::/)
         | test(/^conditional_delete_objects_test::/)
         | test(/^reliant::tiering::/)
-        | test(/^dual_stack_differential::/)
         | test(/^upgrade_compatibility_test::upgrade_write_readiness_tests::/)
         | test(/^on_demand_migration::(get_basic_test::(get_miss_pulls_inline_and_serves_locally_afterwards|head_miss_answers_from_the_source_without_persisting)|interaction_test::test_odm_admin_config_is_redacted_and_status_counts_match_the_source)$/)
     )
@@ -946,10 +925,6 @@ path = "junit.xml"
 # parallel-safe — the same property e2e-smoke relies on. The exceptions are the
 # 4-disk reliability / degraded-read fault-injection tests, multi-node heal
 # clusters, and the fixed-port Vault tests, all serialized below.
-# `dual_stack_differential::reference::` holds hermetic unit tests of how the
-# differential picks side A (shell-script stand-ins, no server, no reference
-# binary). They already run on every pull request in e2e-smoke, so e2e-full
-# excludes them to keep its selection digest unchanged.
 [profile.e2e-full]
 default-filter = """
     package(e2e_test)
@@ -960,7 +935,6 @@ default-filter = """
     & !test(/^replication_target_matrix_test::/)
     & !test(/^on_demand_migration::(concurrency_test|fault_test|interop_test|real_source_test)::/)
     & !test(/^upgrade_compatibility_test::upgrade_write_readiness_tests::/)
-    & !test(/^dual_stack_differential::reference::/)
 """
 fail-fast = false
 

.config/reference-binary.toml

@@ -1,20 +0,0 @@
-# Pinned RustFS release used as the "reference" target of parity lanes
-# (.github/workflows/reference-parity.yml). This is the single place that names
-# the reference release; .github/actions/reference-binary resolves, downloads and
-# verifies it, and fails on a missing pin, a missing asset or a digest mismatch.
-#
-# Bumping the reference is a reviewed event: every per-test difference between
-# the candidate and the reference is measured against this exact build.
-#
-# Each sha256 is the value published in the release's SHA256SUMS asset, which
-# matches the digest GitHub reports for the same asset. The action checks both.
-
-schema = 1
-repository = "rustfs/rustfs"
-version = "1.0.5"
-tag = "1.0.5"
-
-[platforms.linux-x86_64-gnu]
-asset = "rustfs-linux-x86_64-gnu-v1.0.5.zip"
-sha256 = "5addae2f74756bf80104d0975e6347cda843bc2daffdfcd1f0cb80118b95cbd0"
-executable = "rustfs"

.config/reference-parity-targets.toml

@@ -1,24 +0,0 @@
-# Targets of the s3-tests reference parity lane (.github/workflows/reference-parity.yml).
-#
-# Exactly one target uses `binary = "reference"` (the release pinned in
-# .config/reference-binary.toml). Every other target uses `binary = "candidate"`
-# (the binary built from the branch under test) and is compared per node id
-# against the reference. All targets run the same harness, test list and server
-# configuration; `env` adds only the target's own RUSTFS_* settings.
-#
-# Adding a target is one more [[targets]] table, for example:
-#
-#   [[targets]]
-#   name = "candidate-gateway"
-#   binary = "candidate"
-#   env = { RUSTFS_S3_STACK = "gateway" }
-
-schema = 1
-
-[[targets]]
-name = "reference"
-binary = "reference"
-
-[[targets]]
-name = "candidate-legacy"
-binary = "candidate"

.config/reference-parity-tolerated.txt

@@ -1,12 +0,0 @@
-# Tolerated per-test differences of the s3-tests reference parity lane.
-#
-# One entry per line, four fields separated by " | ":
-#
-#   <target> | <pytest node id> | <tracking issue URL> | <reason>
-#
-# <target> is a candidate name from .config/reference-parity-targets.toml, the
-# node id is exactly as the lane prints it (s3tests/functional/test_s3.py::...),
-# and the issue URL is https://github.com/rustfs/<repo>/issues/<number>.
-#
-# Same semantics as scripts/junit_diff.py --allow: an entry whose difference no
-# longer occurs is stale and fails the lane, so remove it when it is fixed.

.config/s3s-edge-allowlist.txt

@@ -1,37 +0,0 @@
-# Files that may still reference s3s (`s3s::` or `s3s_sigv4`) when Phase 1 of
-# the gateway migration ends (rustfs/backlog#2734 task T0.6, rustfs/backlog#2741).
-# Consumed only by `scripts/check_s3s_footprint.sh --mode allowlist`.
-#
-# One entry per line: a repository-relative file path or a git `:(glob)`
-# pathspec. `**` matches across directories, `*` stays within one path
-# component, and a directory entry matches everything under it. Blank lines
-# and lines starting with `#` are ignored; an entry may not contain whitespace,
-# so a note belongs on its own comment line.
-#
-# Every Rust file listed by `git grep -l '\bs3s\(::\|_sigv4\)' -- '*.rs'` that
-# no entry matches fails the allowlist mode. Task T1.9 switches CI to that
-# mode; until then `--dry-run` prints the files still outside this list, which
-# is the Phase 1 tracking list.
-#
-# Never add crates/** other than crates/e2e_test: the engine crates leave s3s
-# entirely, and the script rejects such an entry. Only the s3s-facing edge of
-# the rustfs binary and the e2e oracle keep it.
-
-# rustfs binary: the s3s-facing edge that survives Phase 1
-rustfs/src/storage/ecfs.rs
-rustfs/src/storage/s3_compat/**
-rustfs/src/storage/access.rs
-rustfs/src/auth.rs
-rustfs/src/error.rs
-rustfs/src/storage_api.rs
-rustfs/src/app/storage_api.rs
-rustfs/src/admin/router.rs
-rustfs/src/app/metadata_route.rs
-rustfs/src/server/http.rs
-rustfs/src/server/layer.rs
-rustfs/src/server/hybrid.rs
-rustfs/src/protocols/client.rs
-
-# e2e oracle: the test target that verifies S3 behaviour against s3s
-crates/e2e_test/src/fake_s3_target/**
-crates/e2e_test/src/**

.config/s3s-footprint-baseline.txt

@@ -1,17 +0,0 @@
-# Exact baseline for the direct s3s footprint, consumed only by
-# scripts/check_s3s_footprint.sh (rustfs/backlog#1677; rustfs/backlog#2734 T0.4).
-#
-# Each value is the exact measurement of the tree, not a ceiling. CI fails when a
-# measured counter differs from its line here in either direction:
-#   - a larger measurement means new code widened the s3s surface: route it
-#     through the gateway abstractions instead; never raise a value here;
-#   - a smaller measurement means the PR shrank the surface: lower the matching
-#     value to the measured number in the same PR.
-#
-# files           Rust files referencing s3s paths, repo-wide minus crates/e2e_test
-# s3_error_lines  lines holding s3_error!, same scope, minus those the script
-#                 header's rule clears (rustfs_s3_types's macro); fails closed
-# ecstore_files   Rust files referencing s3s paths under crates/ecstore/src
-files=63
-s3_error_lines=217
-ecstore_files=0

.config/test-count-baseline.txt

@@ -1,67 +0,0 @@
-# Per-crate test-count baseline consumed by scripts/check_test_count_ratchet.sh
-# (rustfs/backlog#2734 section 1 rule 3; T0.3 in rustfs/backlog#2738).
-#
-# One row per workspace member: <package>, tests, ignored, tab-separated.
-# tests counts #[test], #[tokio::test], #[tokio::test(...)] and #[test_case(...)]
-# attribute lines under the package directory; ignored counts #[ignore] and
-# #[ignore = "..."]. The tests column is a floor and the ignored column is a
-# ceiling: CI fails when a crate's tests fall below its row or its ignored count
-# rises above it. Extra tests and fewer ignores pass; --update tightens the rows.
-# Lowering a tests row or raising an ignored row is a reviewed statement that
-# tests were intentionally removed or ignored; justify it in the PR description.
-# Regenerate with:
-#   scripts/check_test_count_ratchet.sh --update
-e2e_test	1026	20
-rustfs	6449	64
-rustfs-audit	70	0
-rustfs-checksums	28	1
-rustfs-common	36	0
-rustfs-concurrency	87	0
-rustfs-config	43	0
-rustfs-connect-symbol-catalog	6	0
-rustfs-credentials	24	0
-rustfs-crypto	67	0
-rustfs-data-usage	58	0
-rustfs-ecstore	7858	2
-rustfs-extension-schema	23	0
-rustfs-filemeta	361	0
-rustfs-gateway-adapter	74	0
-rustfs-heal	1128	3
-rustfs-heal-contracts	8	0
-rustfs-iam	415	0
-rustfs-io-core	52	0
-rustfs-io-metrics	157	0
-rustfs-keystone	31	0
-rustfs-kms	716	25
-rustfs-license	2	0
-rustfs-lifecycle	156	0
-rustfs-lock	182	0
-rustfs-log-analyzer	91	0
-rustfs-madmin	210	0
-rustfs-notify	140	0
-rustfs-object-capacity	92	0
-rustfs-object-data-cache	141	0
-rustfs-obs	387	0
-rustfs-policy	758	0
-rustfs-protocols	770	1
-rustfs-protos	75	0
-rustfs-replication	209	0
-rustfs-rio	225	1
-rustfs-rio-v2	34	6
-rustfs-s3-client	71	0
-rustfs-s3-ops	8	0
-rustfs-s3-types	105	0
-rustfs-s3select-api	232	0
-rustfs-s3select-query	235	2
-rustfs-scanner	1392	20
-rustfs-scanner-metrics	90	0
-rustfs-security-governance	20	0
-rustfs-signer	34	0
-rustfs-storage-api	34	0
-rustfs-targets	612	26
-rustfs-test-utils	1	0
-rustfs-tls-runtime	44	0
-rustfs-trusted-proxies	72	0
-rustfs-utils	253	1
-rustfs-zip	30	0
-zstd	11	0

.docker/README.md

@@ -140,12 +140,6 @@ With list syntax, use `- RUSTFS_OBS_LOG_DIRECTORY=/var/log/rustfs/` or quote the
 
 ---
 
-## Local storage pool expansion
-
-To append a second four-drive pool, set `RUSTFS_VOLUMES: "/data/rustfs0/{0...3} /data/rustfs1/{0...3}"` and keep the original pool's drives, order, and erasure set width. The container prepares each drive directory and passes one argument per pool to RustFS.
-
-If an older image already formatted both ranges together as a single eight-drive pool, list the eight individual paths in their original order to keep that layout when upgrading.
-
 ## 🔧 Common Operations
 
 ### Cleaning Up

.github/actions/quick-checks/action.yml

@@ -97,14 +97,6 @@ runs:
       shell: bash
       run: ./scripts/check_s3s_footprint.sh
 
-    - name: Check per-crate test-count ratchet
-      shell: bash
-      run: ./scripts/check_test_count_ratchet.sh
-
-    - name: Check cross-owner tests use test seams
-      shell: bash
-      run: python3 ./scripts/check_test_seams.py
-
     - name: Check cryptographic capability wording
       shell: bash
       run: ./scripts/check_fips_wording.sh

.github/actions/reference-binary/action.yml

@@ -1,96 +0,0 @@
-# Copyright 2026 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: "Reference RustFS binary"
-description: "Download the pinned reference RustFS release, verify its sha256 and expose the executable path. A missing pin, missing asset or digest mismatch fails the step."
-
-inputs:
-  pin-file:
-    description: "Pin file naming the reference release (repository-relative)"
-    required: false
-    default: ".config/reference-binary.toml"
-  platform:
-    description: "Platform table in the pin file"
-    required: false
-    default: "linux-x86_64-gnu"
-  destination:
-    description: "Directory that receives the executable; defaults to $RUNNER_TEMP/reference-binary"
-    required: false
-    default: ""
-
-outputs:
-  path:
-    description: "Absolute path of the verified executable"
-    value: ${{ steps.unpack.outputs.path }}
-  version:
-    description: "Pinned reference version"
-    value: ${{ steps.pin.outputs.version }}
-  sha256:
-    description: "Pinned and verified archive sha256"
-    value: ${{ steps.pin.outputs.sha256 }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Resolve reference pin
-      id: pin
-      shell: bash
-      env:
-        PIN_TOOL: ${{ github.action_path }}/reference_binary.py
-        PIN_FILE: ${{ inputs.pin-file }}
-        PIN_PLATFORM: ${{ inputs.platform }}
-      run: |
-        set -euo pipefail
-        resolved="$(python3 "$PIN_TOOL" resolve --pin "$PIN_FILE" --platform "$PIN_PLATFORM")"
-        printf '%s\n' "$resolved"
-        printf '%s\n' "$resolved" >> "$GITHUB_OUTPUT"
-
-    - name: Download and verify reference archive
-      id: download
-      shell: bash
-      env:
-        GH_TOKEN: ${{ github.token }}
-        ASSET_DOWNLOADER: ${{ github.action_path }}/../setup/download_release_asset.py
-        REF_REPOSITORY: ${{ steps.pin.outputs.repository }}
-        REF_TAG: ${{ steps.pin.outputs.tag }}
-        REF_ASSET: ${{ steps.pin.outputs.asset }}
-        REF_SHA256: ${{ steps.pin.outputs.sha256 }}
-      run: |
-        set -euo pipefail
-        archive="$RUNNER_TEMP/reference-archive/$REF_ASSET"
-        # Fails unless the release lists exactly one asset of this name whose
-        # published digest equals the pin and whose downloaded bytes match it.
-        python3 "$ASSET_DOWNLOADER" --repository "$REF_REPOSITORY" --tag "$REF_TAG" \
-          --asset "$REF_ASSET" --output "$archive" --sha256 "$REF_SHA256"
-        echo "archive=$archive" >> "$GITHUB_OUTPUT"
-
-    - name: Unpack reference executable
-      id: unpack
-      shell: bash
-      env:
-        PIN_TOOL: ${{ github.action_path }}/reference_binary.py
-        REF_ARCHIVE: ${{ steps.download.outputs.archive }}
-        REF_SHA256: ${{ steps.pin.outputs.sha256 }}
-        REF_EXECUTABLE: ${{ steps.pin.outputs.executable }}
-        REF_DESTINATION: ${{ inputs.destination }}
-      run: |
-        set -euo pipefail
-        destination="${REF_DESTINATION:-$RUNNER_TEMP/reference-binary}"
-        unpacked="$(python3 "$PIN_TOOL" unpack --archive "$REF_ARCHIVE" --sha256 "$REF_SHA256" \
-          --executable "$REF_EXECUTABLE" --destination "$destination")"
-        path="${unpacked#path=}"
-        test -x "$path"
-        echo "Reference executable: $path"
-        "$path" --version
-        echo "path=$path" >> "$GITHUB_OUTPUT"

.github/actions/reference-binary/reference_binary.py

@@ -1,144 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2026 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-"""Resolve and unpack the pinned reference RustFS release binary.
-
-`resolve` reads the pin file and prints the selected platform's identity as
-`key=value` lines (GitHub step-output format). `unpack` re-verifies the
-downloaded archive digest against the pin and extracts exactly one executable.
-Every missing or malformed input is a failure; nothing is skipped.
-"""
-
-import argparse
-import hashlib
-from pathlib import Path
-import re
-import sys
-import tomllib
-import zipfile
-
-REPOSITORY = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9][A-Za-z0-9_.-]*")
-TAG = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.+-]*")
-PLATFORM = re.compile(r"[a-z0-9][a-z0-9_-]*")
-ASSET = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.+-]*\.zip")
-SHA256 = re.compile(r"[0-9a-f]{64}")
-EXECUTABLE = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.-]*")
-MAX_EXECUTABLE_BYTES = 1024 * 1024 * 1024
-
-
-class PinError(Exception):
-    """A pin, archive or argument that cannot be trusted."""
-
-
-def field(table, key, pattern, where):
-    value = table.get(key)
-    if not isinstance(value, str) or not pattern.fullmatch(value):
-        raise PinError(f"{where}: missing or invalid '{key}'")
-    return value
-
-
-def resolve(pin_path, platform):
-    if not PLATFORM.fullmatch(platform or ""):
-        raise PinError("invalid platform name")
-    try:
-        data = tomllib.loads(Path(pin_path).read_text(encoding="utf-8"))
-    except FileNotFoundError as exc:
-        raise PinError(f"{pin_path}: reference pin file is missing") from exc
-    except (OSError, UnicodeDecodeError, tomllib.TOMLDecodeError) as exc:
-        raise PinError(f"{pin_path}: cannot read reference pin: {exc}") from exc
-    if data.get("schema") != 1 or type(data.get("schema")) is not int:
-        raise PinError(f"{pin_path}: unsupported pin schema")
-    identity = {
-        "repository": field(data, "repository", REPOSITORY, pin_path),
-        "version": field(data, "version", TAG, pin_path),
-        "tag": field(data, "tag", TAG, pin_path),
-    }
-    platforms = data.get("platforms")
-    if not isinstance(platforms, dict) or not platforms:
-        raise PinError(f"{pin_path}: no pinned platforms")
-    entry = platforms.get(platform)
-    if not isinstance(entry, dict):
-        raise PinError(f"{pin_path}: no pin for platform '{platform}'")
-    where = f"{pin_path} [platforms.{platform}]"
-    identity["asset"] = field(entry, "asset", ASSET, where)
-    identity["sha256"] = field(entry, "sha256", SHA256, where)
-    identity["executable"] = field(entry, "executable", EXECUTABLE, where)
-    if identity["version"] not in identity["asset"]:
-        raise PinError(f"{where}: asset name does not carry version {identity['version']}")
-    unknown = set(entry) - {"asset", "sha256", "executable"}
-    if unknown:
-        raise PinError(f"{where}: unknown keys {sorted(unknown)}")
-    return identity
-
-
-def file_sha256(path):
-    with open(path, "rb") as stream:
-        return hashlib.file_digest(stream, "sha256").hexdigest()
-
-
-def unpack(archive, sha256, executable, destination):
-    if not SHA256.fullmatch(sha256 or "") or not EXECUTABLE.fullmatch(executable or ""):
-        raise PinError("invalid expected digest or executable name")
-    try:
-        actual = file_sha256(archive)
-    except OSError as exc:
-        raise PinError(f"{archive}: reference archive is missing or unreadable") from exc
-    if actual != sha256:
-        raise PinError(f"{archive}: sha256 {actual} does not match the pinned digest")
-    try:
-        with zipfile.ZipFile(archive) as bundle:
-            matches = [info for info in bundle.infolist() if info.filename == executable]
-            if len(matches) != 1:
-                raise PinError(f"{archive}: must contain exactly one top-level '{executable}'")
-            info = matches[0]
-            if info.is_dir() or not 0 < info.file_size <= MAX_EXECUTABLE_BYTES:
-                raise PinError(f"{archive}: '{executable}' is not a plausible executable")
-            destination = Path(destination)
-            destination.mkdir(parents=True, exist_ok=True)
-            target = destination / executable
-            with bundle.open(info) as source, open(target, "wb") as sink:
-                while chunk := source.read(1024 * 1024):
-                    sink.write(chunk)
-    except zipfile.BadZipFile as exc:
-        raise PinError(f"{archive}: not a valid zip archive") from exc
-    target.chmod(0o755)
-    return target
-
-
-def main(argv=None):
-    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
-    sub = parser.add_subparsers(dest="mode", required=True)
-    res = sub.add_parser("resolve")
-    res.add_argument("--pin", required=True)
-    res.add_argument("--platform", required=True)
-    unp = sub.add_parser("unpack")
-    unp.add_argument("--archive", required=True)
-    unp.add_argument("--sha256", required=True)
-    unp.add_argument("--executable", required=True)
-    unp.add_argument("--destination", required=True)
-    args = parser.parse_args(argv)
-    try:
-        if args.mode == "resolve":
-            for key, value in resolve(args.pin, args.platform).items():
-                print(f"{key}={value}")
-        else:
-            print(f"path={unpack(args.archive, args.sha256, args.executable, args.destination)}")
-    except PinError as exc:
-        print(f"reference binary: {exc}", file=sys.stderr)
-        return 1
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/scheduled-validations.json

@@ -360,14 +360,15 @@
       "cadence": "nightly",
       "timezone": "UTC",
       "schedule": [
-        "13 1 * * *"
+        "13 1 * * *",
+        "0 16 * * 0"
       ],
       "owner": "@overtrue",
       "policy": "active",
       "monitor": "workflow",
       "max_age_hours": 36,
       "result_owner": "build.yml",
-      "disposition": "Builds artifacts only; public release writes belong to release-publish.yml.",
+      "disposition": "Daily cron builds Linux; Sunday 16:00 UTC builds macOS and Windows. Public release writes belong to release-publish.yml.",
       "failure_owner": "workflow",
       "origin": "baseline",
       "alert_contract": "scheduled-validation"
@@ -869,33 +870,6 @@
       "failure_owner": "watchdog",
       "origin": "baseline"
     },
-    {
-      "workflow": ".github/workflows/reference-parity.yml",
-      "name": "Reference Parity",
-      "roles": [
-        "pr",
-        "periodic",
-        "manual"
-      ],
-      "events": [
-        "pull_request",
-        "schedule",
-        "workflow_dispatch"
-      ],
-      "cadence": "nightly",
-      "timezone": "UTC",
-      "schedule": [
-        "37 1 * * *"
-      ],
-      "owner": "@overtrue",
-      "policy": "active",
-      "monitor": "workflow",
-      "max_age_hours": 36,
-      "result_owner": "reference-parity.yml",
-      "disposition": "s3-tests per-node-id parity of branch candidates against the pinned reference release",
-      "failure_owner": "watchdog",
-      "origin": "added"
-    },
     {
       "workflow": ".github/workflows/functional-chain-health.yml",
       "name": "Functional chain health",
@@ -1021,26 +995,6 @@
       "policy_reason": "Preserve operator-disabled state; enabling requires a separate policy decision.",
       "origin": "baseline"
     },
-    {
-      "workflow": ".github/workflows/manual-main-packages.yml",
-      "name": "Manual main packages",
-      "roles": [
-        "manual"
-      ],
-      "events": [
-        "workflow_dispatch"
-      ],
-      "cadence": "event",
-      "timezone": "UTC",
-      "schedule": [],
-      "owner": "@overtrue",
-      "policy": "active",
-      "monitor": "none",
-      "result_owner": "manual-main-packages.yml",
-      "disposition": "Packages the origin/main tip as workflow artifacts only. No GitHub Release or download-channel writes.",
-      "monitor_reason": "Operator-requested packaging has no periodic freshness obligation.",
-      "origin": "manual-main-packages"
-    },
     {
       "workflow": ".github/workflows/minio-interop.yml",
       "name": "minio-interop",

.github/workflows/README.md

@@ -80,6 +80,6 @@ Rows using `macos-latest-xlarge` or a label starting with `sm-`, `dind-`, `ubicl
 
 ## Release stages
 
-The [candidate release pipeline](../../docs/operations/release-pipeline.md) builds Linux first and defers paid desktop capacity until acceptance. Daily development builds also select Linux; use manual platform selection for desktop development artifacts. All six platforms remain required before publication. The pipeline records and promotes the exact tested bytes. Builder workflows have no public-release credentials. Keep periodic development builds, PR verification and field-test chains separate when their contracts differ; do not re-enable disabled workflows as part of a source-file migration.
+The [candidate release pipeline](../../docs/operations/release-pipeline.md) builds Linux first and defers paid desktop capacity until acceptance. The daily `build.yml` schedule selects Linux; the Sunday 16:00 UTC schedule selects macOS and Windows. Manual dispatch can still select any platform list. All six platforms remain required before publication. The pipeline records and promotes the exact tested bytes. Builder workflows have no public-release credentials. Keep periodic development builds, PR verification and field-test chains separate when their contracts differ; do not re-enable disabled workflows as part of a source-file migration.
 
 Larger runners remain billed for public repositories; see [GitHub runner billing](https://docs.github.com/en/actions/concepts/runners/larger-runners#billing). Actual spending comes from organization billing, not runner labels or an estimated build duration.

.github/workflows/build.yml

@@ -12,7 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Nightly development artifacts and reusable immutable-candidate builds.
+# Scheduled development artifacts and reusable immutable-candidate builds.
+# The daily cron builds Linux. Sunday 16:00 UTC builds macOS and Windows.
 # Public release writes live exclusively in release-publish.yml. Candidate callers
 # select Linux or desktop and pin release inputs before any matrix starts.
 
@@ -30,7 +31,8 @@ on:
         required: true
         type: string
   schedule:
-    - cron: "13 1 * * *" # Nightly 01:13 UTC
+    - cron: "13 1 * * *" # Daily Linux, 01:13 UTC
+    - cron: "0 16 * * 0" # Weekly macOS and Windows, Sunday 16:00 UTC (Monday 00:00 Asia/Shanghai)
   workflow_dispatch:
     inputs:
       publish:
@@ -219,16 +221,33 @@ jobs:
         env:
           # via env, not interpolation: a dispatch input is free-form text and
           # would otherwise be pasted into the script for bash to evaluate.
-          # Daily development builds cover Linux. Desktop remains available on
-          # manual dispatch and is required after candidate field acceptance.
+          # A direct schedule has no platforms input. Choose its subset from
+          # github.event.schedule, which is fixed when that cron fires, so a
+          # queued job cannot switch subsets because the runner clock moved.
+          # Callers that pass platforms keep that list, including a scheduled
+          # caller: inputs.platforms is set even though event_name stays schedule.
           RAW_PLATFORMS: ${{ inputs.platforms || 'linux' }}
+          HAS_PLATFORM_INPUT: ${{ inputs.platforms && 'true' || 'false' }}
+          EVENT_NAME: ${{ github.event_name }}
+          EVENT_SCHEDULE: ${{ github.event.schedule }}
         run: |
           set -euo pipefail
 
-          selected="$RAW_PLATFORMS"
-          selected="$(echo "${selected}" | tr -d '[:space:]')"
-          if [[ -z "${selected}" ]]; then
-            selected="all"
+          if [[ "${EVENT_NAME}" == "schedule" && "${HAS_PLATFORM_INPUT}" != "true" ]]; then
+            if [[ "${EVENT_SCHEDULE}" == "13 1 * * *" ]]; then
+              selected="linux"
+            elif [[ "${EVENT_SCHEDULE}" == "0 16 * * 0" ]]; then
+              selected="desktop"
+            else
+              echo "Unrecognized schedule cron: ${EVENT_SCHEDULE}" >&2
+              exit 1
+            fi
+          else
+            selected="${RAW_PLATFORMS}"
+            selected="$(echo "${selected}" | tr -d '[:space:]')"
+            if [[ -z "${selected}" ]]; then
+              selected="all"
+            fi
           fi
 
           # linux-aarch64-* need a real aarch64 host (placement rule: hardware)

.github/workflows/ci.yml

@@ -16,9 +16,7 @@ name: Continuous Integration
 
 on:
   push:
-    # gateway/integration receives the daily merge of main as a direct push
-    # (rustfs/backlog#2734), so its pushes must prove the result like main's.
-    branches: [ main, gateway/integration ]
+    branches: [ main ]
     paths-ignore:
       - "**.md"
       - "docs/**"
@@ -95,7 +93,6 @@ jobs:
       packages: ${{ steps.scope.outputs.packages }}
       full_validation: ${{ steps.scope.outputs.full_validation || 'true' }}
       rehearse_shards: ${{ steps.scope.outputs.rehearse_shards || 'false' }}
-      gateway_smoke: ${{ steps.scope.outputs.gateway_smoke || 'true' }}
     steps:
       - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
         with:
@@ -117,7 +114,7 @@ jobs:
             echo "Base CI policy unavailable; running the full matrix."
           fi
           if ! grep -q '^plan=' "$GITHUB_OUTPUT" || ! grep -q '^plan_contract=3$' "$GITHUB_OUTPUT"; then
-            printf '%s\n' 'mode=full' 'connect=true' 'full_validation=true' 'rehearse_shards=false' 'gateway_smoke=true' 'packages=' 'plan=' >> "$GITHUB_OUTPUT"
+            printf '%s\n' 'mode=full' 'connect=true' 'full_validation=true' 'rehearse_shards=false' 'packages=' 'plan=' >> "$GITHUB_OUTPUT"
             echo "Base policy does not cover this workflow contract; retaining the full matrix."
           fi
       - name: Retain verification plan
@@ -649,10 +646,6 @@ jobs:
             flags: "--features sftp"
           - name: http3
             flags: "--features http3,swift"
-          - name: internode-transport
-            flags: "--features rustfs/internode-transport"
-            packages: "-p rustfs-ecstore -p rustfs-rio"
-            tests: "--no-tests fail -E 'test(peer_transport_)'"
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
@@ -678,7 +671,7 @@ jobs:
         run: |
           ./scripts/ci/resource_sampler.sh start clippy
           trap './scripts/ci/resource_sampler.sh stop' EXIT
-          cargo clippy -p rustfs ${{ matrix.features.packages || '-p rustfs-protocols' }} --all-targets ${{ matrix.features.flags }} -- -D warnings
+          cargo clippy -p rustfs -p rustfs-protocols --all-targets ${{ matrix.features.flags }} -- -D warnings
 
       - name: Run tests with ${{ matrix.features.name }}
         id: protocol-tests
@@ -695,7 +688,7 @@ jobs:
           mkdir -p artifacts/protocol-tests
           ./scripts/ci/resource_sampler.sh start nextest
           trap './scripts/ci/resource_sampler.sh stop' EXIT
-          cargo nextest run --profile ci -p rustfs ${{ matrix.features.packages || '-p rustfs-protocols' }} ${{ matrix.features.flags }} ${{ matrix.features.tests }} \
+          cargo nextest run --profile ci -p rustfs -p rustfs-protocols ${{ matrix.features.flags }} \
             2>&1 | tee artifacts/protocol-tests/nextest.log
 
       - name: Upload protocol test reports and diagnostics
@@ -972,8 +965,6 @@ jobs:
     # Retain the producer image and fixture paths until the runtime pilot passes.
     runs-on: sm-standard-4
     timeout-minutes: 30
-    env:
-      RUSTFS_S3_STACK: legacy
     steps:
       - name: Checkout repository
         uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
@@ -1094,137 +1085,18 @@ jobs:
           path: ${{ runner.temp }}/rustfs-e2e-*/rustfs.log
           retention-days: 3
 
-  # The same e2e-smoke suite against the same debug binary with the gateway
-  # S3 stack selected (rustfs/backlog#2734). Report-only: it is outside the
-  # Test and Lint aggregate and becomes required at T2.10. The test-binary
-  # download, identity, membership, run and completeness steps must stay
-  # identical to e2e-tests; scripts/ci_gate.py enforces that.
-  #
-  # When it runs: every push to main or gateway/integration, merge group,
-  # nightly schedule and manual dispatch, and every pull request that changes a
-  # gateway-stack input (GATEWAY_SMOKE_PATHS and the rustfs-gateway pins in
-  # scripts/ci_gate.py, published by Select CI scope as gateway_smoke).
-  # Why it is skipped on every other pull request: until T2.10 the gateway
-  # stack does not serve the whole smoke suite, so the lane fails on any
-  # revision. A pull request that touches none of its inputs can neither cause
-  # nor fix that failure, and a red check there says nothing about the change.
-  # Skipped is the honest state; a failure must never be rendered green, so no
-  # step here may carry continue-on-error. A selection that is missing or
-  # unreadable runs the lane. At T2.10, when the lane becomes required, it
-  # must run on every pull request again: delete the selection, do not extend
-  # it.
-  e2e-tests-gateway:
-    name: e2e-smoke (gateway, report-only until T2.10)
-    needs: [ classify-changes, build-rustfs-debug-binary ]
-    if: github.event_name != 'pull_request' || needs.classify-changes.outputs.gateway_smoke != 'false'
-    runs-on: sm-standard-2
-    timeout-minutes: 30
-    continue-on-error: true
-    env:
-      RUSTFS_S3_STACK: gateway
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Install verification runtime
-        uses: ./.github/actions/test-runtime
-
-      - name: Download E2E test binaries
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: e2e-test-binaries
-          path: ${{ runner.temp }}
-
-      - name: Verify E2E archive identity
-        run: python3 scripts/ci_test_artifact.py verify --configuration e2e --archive "$RUNNER_TEMP/e2e-tests.tar.zst"
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-
-      - name: Install awscurl
-        run: |
-          python3 -m pip install --user --upgrade pip "awscurl==0.44"
-          echo "AWSCURL_PATH=$HOME/.local/bin/awscurl" >> "$GITHUB_ENV"
-
-      - name: Verify awscurl
-        run: test -x "$AWSCURL_PATH"
-
-      # Download after the cache restore so the freshly built binary from the
-      # build job always wins over anything restored into target/debug.
-      - name: Download debug binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: rustfs-debug-binary
-          path: target/debug
-
-      - name: Make binary executable
-        run: chmod +x ./target/debug/rustfs
-
-      # Build the e2e test graph once. The archive is reused by the smoke
-      # selection guard, security exact-count check, and run below, avoiding a
-      # second compile of the same e2e_test target on cold runners (backlog#1645).
-      - name: Verify e2e smoke test membership
-        env:
-          NEXTEST_ARCHIVE: ${{ runner.temp }}/e2e-tests.tar.zst
-          NEXTEST_LISTING: ${{ runner.temp }}/rustfs-e2e-smoke-list.json
-        run: |
-          cargo nextest list --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" --workspace-remap "$GITHUB_WORKSPACE" --extract-to "$GITHUB_WORKSPACE" --extract-overwrite --message-format json > "${NEXTEST_LISTING}"
-          python3 ./scripts/check_test_wiring.py --check-profile e2e-smoke "${NEXTEST_LISTING}"
-          ./scripts/check_security_smoke_count.sh check "${NEXTEST_LISTING}"
-
-      # PR smoke subset of the in-repo e2e suite (backlog#1149 ci-4). The
-      # profile.e2e-smoke default-filter in .config/nextest.toml is the single
-      # wiring mechanism for e2e tests in CI — extend that filter instead of
-      # adding new e2e jobs here. Each test spawns its own rustfs server on a
-      # random port and reuses the downloaded debug binary above.
-      - name: Run e2e smoke suite
-        env:
-          NEXTEST_ARCHIVE: ${{ runner.temp }}/e2e-tests.tar.zst
-          RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-smoke-logs
-          SAMPLER_INTERVAL_SECS: "15"
-        run: |
-          ./scripts/ci/resource_sampler.sh start e2e-smoke
-          trap './scripts/ci/resource_sampler.sh stop' EXIT
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-smoke --cargo-metadata target/nextest/cargo-metadata.json --binaries-metadata target/nextest/binaries-metadata.json --workspace-remap "$GITHUB_WORKSPACE" --target-dir-remap "$GITHUB_WORKSPACE/target" \
-            --status-level all --final-status-level all --failure-output final
-
-      - name: Verify e2e smoke execution completeness
-        run: python3 scripts/ci_test_artifact.py evidence "$RUNNER_TEMP/rustfs-e2e-smoke-list.json" target/nextest/e2e-smoke/junit.xml
-
-      - name: Upload e2e smoke diagnostics
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: e2e-smoke-gateway-diagnostics-${{ github.run_number }}-${{ github.run_attempt }}
-          path: |
-            ${{ runner.temp }}/rustfs-e2e-smoke-logs/
-            ${{ runner.temp }}/rustfs-e2e-smoke-list.json
-          if-no-files-found: warn
-
-      - name: Upload e2e smoke JUnit report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: e2e-smoke-gateway-junit-${{ github.run_number }}-${{ github.run_attempt }}
-          path: target/nextest/e2e-smoke/junit.xml
-          if-no-files-found: warn
-
   e2e-full:
     name: End-to-End Tests (full merge gate)
     # Merge gate only (backlog#1149 ci-5): the never-automated user-visible
     # suites — KMS, object_lock, multipart_auth, quota, checksum, encryption,
     # security-boundary, ... — via the e2e-full nextest profile. Too heavy for
-    # every PR, so it is gated to main and gateway/integration pushes, the merge
-    # queue, and manual dispatch. protocols / the 7 cluster suites / replication
-    # / #[ignore] are owned by other lanes (see .config/nextest.toml profile.e2e-full).
+    # every PR, so it is gated to main pushes, the merge queue, and manual
+    # dispatch. protocols / the 7 cluster suites / replication / #[ignore] are
+    # owned by other lanes (see .config/nextest.toml profile.e2e-full).
     if: >-
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'merge_group' ||
-      (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/gateway/integration'))
+      (github.event_name == 'push' && github.ref == 'refs/heads/main')
     needs: [ build-rustfs-debug-binary ]
     # Retain the producer image and fixture paths until the runtime pilot passes.
     runs-on: sm-standard-4

.github/workflows/manual-main-packages.yml

@@ -1,415 +0,0 @@
-# Copyright 2026 RustFS Team
-# SPDX-License-Identifier: Apache-2.0
-
-# Manual packaging of the current origin/main tip. Workflow artifacts only.
-# Dispatch uses this file from the selected branch. The build fetches
-# refs/heads/main and checks out that commit, not the dispatch ref or a tag.
-
-name: Manual main packages
-
-on:
-  workflow_dispatch:
-    inputs:
-      architecture:
-        description: "Linux targets: x86 (x86_64 musl+gnu), arm (aarch64 musl+gnu), or all"
-        required: true
-        type: choice
-        options:
-          - x86
-          - arm
-          - all
-        default: all
-      version:
-        description: "Binary and package version: MAJOR.MINOR.PATCH, or MAJOR.MINOR.PATCH-(alpha|beta|rc).N. No leading v."
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
-  CARGO_INCREMENTAL: 0
-
-jobs:
-  prepare:
-    name: Resolve main tip and version
-    if: github.repository == 'rustfs/rustfs'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    outputs:
-      source_sha: ${{ steps.pin.outputs.source_sha }}
-      version: ${{ steps.version.outputs.version }}
-      toolchain: ${{ steps.inputs.outputs.toolchain }}
-      console: ${{ steps.inputs.outputs.console }}
-      matrix: ${{ steps.matrix.outputs.matrix }}
-    steps:
-      - name: Checkout main
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          ref: main
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Pin the tip of origin/main
-        id: pin
-        shell: bash
-        run: |
-          set -euo pipefail
-          GIT_TERMINAL_PROMPT=0 git fetch --no-tags origin refs/heads/main
-          sha=$(git rev-parse FETCH_HEAD)
-          git checkout --detach "$sha"
-          test "$(git rev-parse HEAD)" = "$sha"
-          printf 'source_sha=%s\n' "$sha" >> "$GITHUB_OUTPUT"
-          printf 'Pinned origin/main %s\n' "$sha"
-
-      - name: Validate package version
-        id: version
-        shell: bash
-        env:
-          PACKAGE_VERSION: ${{ inputs.version }}
-        run: |
-          set -euo pipefail
-          bash scripts/release/package_manual_artifacts.sh validate \
-            --version "$PACKAGE_VERSION" \
-            --arch x86_64 \
-            --libc gnu | tee "$RUNNER_TEMP/package-version.txt"
-          printf 'version=%s\n' "$PACKAGE_VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Install stable Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-        with:
-          toolchain: stable
-
-      - name: Resolve console assets and toolchain
-        id: inputs
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          toolchain=$(rustc --version | awk '{print $2}')
-          [[ "$toolchain" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
-          gh api repos/rustfs/console/releases/latest > console-release.json
-          TOOLCHAIN="$toolchain" python3 - <<'PY'
-          import json, os, sys
-          sys.path.insert(0, "scripts/release")
-          import candidate
-          console = candidate.console_asset(candidate.read_json("console-release.json"))
-          candidate.emit_output("console", json.dumps(console, separators=(",", ":")))
-          candidate.emit_output("toolchain", os.environ["TOOLCHAIN"])
-          print(f"toolchain={os.environ['TOOLCHAIN']}")
-          print(f"console={console['tag']} {console['name']}")
-          PY
-
-      - name: Select Linux targets
-        id: matrix
-        shell: bash
-        env:
-          ARCHITECTURE: ${{ inputs.architecture }}
-        run: |
-          set -euo pipefail
-          matrix=$(bash scripts/release/package_manual_artifacts.sh matrix "$ARCHITECTURE")
-          count=$(python3 -c 'import json,sys; print(len(json.loads(sys.argv[1])["include"]))' "$matrix")
-          [[ "$count" -gt 0 ]]
-          printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
-          printf 'Selected %s target(s) for %s\n' "$count" "$ARCHITECTURE"
-
-  package:
-    name: Package RustFS (${{ matrix.target_id }})
-    needs: prepare
-    if: github.repository == 'rustfs/rustfs'
-    # x86_64 uses sm-standard-4, the official release compile pool: the workspace
-    # release build needs that disk (placement rule: disk) and reads build.yml's
-    # cache without writing it. aarch64 uses ubicloud-standard-16-arm so the
-    # packaged binary and console smoke execute natively (placement rule: hardware).
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 210
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-      RUSTUP_TOOLCHAIN: ${{ needs.prepare.outputs.toolchain }}
-      RUSTFLAGS: "${{ matrix.rustflags }}"
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.prepare.outputs.matrix) }}
-    steps:
-      - name: Checkout the pinned origin/main commit
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          ref: ${{ needs.prepare.outputs.source_sha }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Confirm the checkout is that main commit
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ needs.prepare.outputs.source_sha }}
-        run: |
-          set -euo pipefail
-          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
-          GIT_TERMINAL_PROMPT=0 git fetch --no-tags origin refs/heads/main
-          git merge-base --is-ancestor "$SOURCE_SHA" FETCH_HEAD
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: ${{ needs.prepare.outputs.toolchain }}
-          target: ${{ matrix.target }}
-          cache-shared-key: build-${{ matrix.target }}${{ matrix.glibc && format('-glibc-{0}', matrix.glibc) || '' }}${{ matrix.os == 'ubicloud-standard-16-arm' && '-ubicloud-arm' || '' }}
-          # build.yml owns this key. This job only restores it.
-          cache-save-if: 'false'
-          install-cross-tools: ${{ matrix.cross }}
-          install-build-packaging-tools: 'true'
-          install-test-tools: 'false'
-
-      - name: Download static console assets
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          CONSOLE_IDENTITY: ${{ needs.prepare.outputs.console }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PYCONSOLE'
-          import json, os, pathlib, subprocess, zipfile
-          value = json.loads(os.environ["CONSOLE_IDENTITY"])
-          subprocess.run(["python3", ".github/actions/setup/download_release_asset.py",
-              "--repository", "rustfs/console", "--tag", value["tag"], "--asset", value["name"],
-              "--sha256", value["sha256"], "--output", "console.zip"], check=True)
-          destination = pathlib.Path("rustfs/static")
-          destination.mkdir(parents=True, exist_ok=True)
-          with zipfile.ZipFile("console.zip") as archive:
-              for member in archive.infolist():
-                  path = pathlib.PurePosixPath(member.filename)
-                  if path.is_absolute() or ".." in path.parts or "\\" in member.filename:
-                      raise SystemExit("unsafe Console archive member")
-              archive.extractall(destination)
-          if not (destination / "index.html").is_file():
-              raise SystemExit("Console archive has no index.html")
-          PYCONSOLE
-          rm -f console.zip
-
-      - name: Build RustFS
-        shell: bash
-        env:
-          RUSTFS_BUILD_VERSION: ${{ needs.prepare.outputs.version }}
-          BUILD_TARGET: ${{ matrix.target }}
-          BUILD_OS: ${{ matrix.build_os }}
-          BUILD_FEATURES: ${{ matrix.features }}
-          BUILD_GLIBC: ${{ matrix.glibc }}
-          BUILD_CROSS: ${{ matrix.cross }}
-        run: |
-          set -euo pipefail
-          touch rustfs/build.rs
-
-          feature_args=()
-          if [[ -n "$BUILD_FEATURES" ]]; then
-            feature_args=(--features "$BUILD_FEATURES")
-          fi
-
-          # gnu targets pin glibc 2.31 through cargo-zigbuild (<target>.<glibc>).
-          target_arg="$BUILD_TARGET"
-          if [[ -n "$BUILD_GLIBC" ]]; then
-            target_arg="${target_arg}.${BUILD_GLIBC}"
-          fi
-
-          profile_args=()
-          if [[ "$BUILD_TARGET" == *-linux-gnu && "$BUILD_FEATURES" == pyroscope ]]; then
-            profile_args=(--config 'profile.release.strip="none"')
-          fi
-
-          case "$BUILD_CROSS" in
-            true)
-              cargo zigbuild --release --locked --target "$target_arg" "${feature_args[@]}" "${profile_args[@]}" -p rustfs --bin rustfs
-              ;;
-            false)
-              cargo build --release --locked --target "$target_arg" "${feature_args[@]}" "${profile_args[@]}" -p rustfs --bin rustfs
-              ;;
-            *)
-              printf 'unexpected cross flag: %q\n' "$BUILD_CROSS" >&2
-              exit 1
-              ;;
-          esac
-
-          bin="target/${BUILD_TARGET}/release/rustfs"
-          version_output=$("$bin" --version)
-          first=${version_output%%$'\n'*}
-          if [[ "$first" != "rustfs ${RUSTFS_BUILD_VERSION}" ]]; then
-            printf 'binary version line is %q, expected %q\n' "$first" "rustfs ${RUSTFS_BUILD_VERSION}" >&2
-            printf '%s\n' "$version_output" >&2
-            exit 1
-          fi
-          if ! grep -Fxq "build target : ${BUILD_TARGET}" <<< "$version_output" || \
-             ! grep -Fxq "build os     : ${BUILD_OS}" <<< "$version_output" || \
-             ! grep -Fxq "rust channel : stable-${BUILD_TARGET}" <<< "$version_output"; then
-            printf 'release binary reports an unexpected compile target\n' >&2
-            printf '%s\n' "$version_output" >&2
-            exit 1
-          fi
-          if [[ -n "$BUILD_GLIBC" ]]; then
-            python3 scripts/release/check_glibc.py "$BUILD_GLIBC" "$bin"
-          fi
-
-      - name: Generate the CPU symbol catalog
-        if: endsWith(matrix.target, '-linux-gnu') && matrix.features == 'pyroscope'
-        shell: bash
-        env:
-          BUILD_TARGET: ${{ matrix.target }}
-        run: |
-          set -euo pipefail
-          cargo metadata --locked --format-version 1 --filter-platform "$BUILD_TARGET" \
-            --features rustfs/pyroscope > "$RUNNER_TEMP/cpu-catalog-metadata.json"
-          features=$(jq -ce '
-            (.packages[] | select(.name == "rustfs") | .id) as $id |
-            .resolve.nodes[] | select(.id == $id) | .features | map(select(. != "default")) | sort
-          ' "$RUNNER_TEMP/cpu-catalog-metadata.json")
-          release_dir="target/${BUILD_TARGET}/release"
-          rm -f "$release_dir/rustfs.cpu-symbol-catalog.json" "$release_dir/rustfs.cpu-symbol-catalog.sha256"
-          cargo run --locked -p rustfs-connect-symbol-catalog -- \
-            "$release_dir/rustfs" "$(git rev-parse HEAD)" "$BUILD_TARGET" "$features" \
-            "$release_dir/rustfs.cpu-symbol-catalog.json" > "$release_dir/rustfs.cpu-symbol-catalog.sha256"
-
-      - name: Install DEB and RPM tools
-        shell: bash
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y ruby ruby-dev build-essential rpm fakeroot cpio
-          sudo gem install fpm --version 1.17.0 --no-document
-
-      - name: Package zip, deb, and rpm
-        shell: bash
-        env:
-          PACKAGE_VERSION: ${{ needs.prepare.outputs.version }}
-          ARCH: ${{ matrix.arch }}
-          LIBC: ${{ matrix.libc }}
-          BUILD_TARGET: ${{ matrix.target }}
-          BUILD_FEATURES: ${{ matrix.features }}
-          SOURCE_SHA: ${{ needs.prepare.outputs.source_sha }}
-        run: |
-          set -euo pipefail
-          binary="target/${BUILD_TARGET}/release/rustfs"
-          extra=()
-          if [[ "$BUILD_TARGET" == *-linux-gnu && "$BUILD_FEATURES" == pyroscope ]]; then
-            extra=(
-              --zip-extra "target/${BUILD_TARGET}/release/rustfs.cpu-symbol-catalog.json"
-              --zip-extra "target/${BUILD_TARGET}/release/rustfs.cpu-symbol-catalog.sha256"
-            )
-          fi
-          bash scripts/release/package_manual_artifacts.sh package \
-            --version "$PACKAGE_VERSION" \
-            --arch "$ARCH" \
-            --libc "$LIBC" \
-            --binary "$binary" \
-            --output dist \
-            "${extra[@]}"
-          printf 'Packaged %s from origin/main %s\n' "$PACKAGE_VERSION" "$SOURCE_SHA"
-
-      - name: Verify the packaged binary
-        shell: bash
-        env:
-          PACKAGE_VERSION: ${{ needs.prepare.outputs.version }}
-          ARCH: ${{ matrix.arch }}
-          LIBC: ${{ matrix.libc }}
-          BUILD_TARGET: ${{ matrix.target }}
-          BUILD_OS: ${{ matrix.build_os }}
-          BUILD_FEATURES: ${{ matrix.features }}
-        run: |
-          set -euo pipefail
-          stem="rustfs-linux-${ARCH}-${LIBC}-v${PACKAGE_VERSION}"
-          package_file="dist/${stem}.zip"
-          [[ -f "$package_file" && -f "dist/${stem}.deb" && -f "dist/${stem}.rpm" ]]
-          [[ "$(find dist -maxdepth 1 -type f | wc -l)" -eq 3 ]]
-          archive_members=$(unzip -Z1 "$package_file" | sort)
-          if [[ "$BUILD_TARGET" == *-linux-gnu && "$BUILD_FEATURES" == pyroscope ]]; then
-            expected_members=$(printf '%s\n' rustfs rustfs.cpu-symbol-catalog.json rustfs.cpu-symbol-catalog.sha256 | sort)
-          else
-            expected_members=$(printf '%s\n' rustfs)
-          fi
-          if [[ "$archive_members" != "$expected_members" ]]; then
-            printf 'Linux package does not contain the expected files\n' >&2
-            printf '%s\n' "$archive_members" >&2
-            exit 1
-          fi
-          binary_dir=$(mktemp -d)
-          trap 'rm -rf "$binary_dir"' EXIT
-          unzip -q "$package_file" rustfs -d "$binary_dir"
-          version_output=$("$binary_dir/rustfs" --version)
-          first=${version_output%%$'\n'*}
-          if [[ "$first" != "rustfs ${PACKAGE_VERSION}" ]]; then
-            printf 'packaged binary version line is %q, expected %q\n' "$first" "rustfs ${PACKAGE_VERSION}" >&2
-            exit 1
-          fi
-          if ! grep -Fxq "build target : ${BUILD_TARGET}" <<< "$version_output" || \
-             ! grep -Fxq "build os     : ${BUILD_OS}" <<< "$version_output"; then
-            printf 'packaged binary reports an unexpected compile target\n' >&2
-            exit 1
-          fi
-
-      - name: Verify packaged console
-        if: matrix.target == 'x86_64-unknown-linux-gnu' || matrix.target == 'aarch64-unknown-linux-gnu'
-        shell: bash
-        env:
-          PACKAGE_VERSION: ${{ needs.prepare.outputs.version }}
-          ARCH: ${{ matrix.arch }}
-          LIBC: ${{ matrix.libc }}
-        run: |
-          set -euo pipefail
-          package_file="dist/rustfs-linux-${ARCH}-${LIBC}-v${PACKAGE_VERSION}.zip"
-
-          find_free_port() {
-            python3 - <<'PY'
-          import socket
-
-          with socket.socket() as sock:
-              sock.bind(("127.0.0.1", 0))
-              print(sock.getsockname()[1])
-          PY
-          }
-
-          package_dir=$(mktemp -d)
-          data_dir=$(mktemp -d)
-          log_file="${RUNNER_TEMP}/rustfs-console-smoke.log"
-          server_pid=""
-          trap '
-            if [[ -n "${server_pid:-}" ]]; then
-              kill "$server_pid" 2>/dev/null || true
-              wait "$server_pid" 2>/dev/null || true
-            fi
-            rm -rf "$package_dir" "$data_dir"
-          ' EXIT
-
-          unzip -q "$package_file" -d "$package_dir"
-          api_port=$(find_free_port)
-          console_port=$(find_free_port)
-          console_url="http://127.0.0.1:${console_port}/rustfs/console/"
-
-          "$package_dir/rustfs" server \
-            --address "127.0.0.1:${api_port}" \
-            --console-enable \
-            --console-address "127.0.0.1:${console_port}" \
-            --access-key console-smoke \
-            --secret-key console-smoke-secret \
-            "$data_dir" >"$log_file" 2>&1 &
-          server_pid=$!
-
-          for _ in {1..40}; do
-            response=$(curl --silent --output /dev/null --write-out '%{http_code} %{content_type}' "$console_url" || true)
-            if [[ "$response" == 200\ text/html* ]]; then
-              exit 0
-            fi
-            sleep 0.25
-          done
-
-          printf 'Console endpoint did not return 200 text/html: %s\n' "$response" >&2
-          cat "$log_file"
-          exit 1
-
-      - name: Upload packages
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: packages-${{ matrix.target_id }}-v${{ needs.prepare.outputs.version }}
-          path: dist/*
-          if-no-files-found: error
-          compression-level: 0
-          retention-days: 30

.github/workflows/mint.yml

@@ -112,11 +112,9 @@ jobs:
     # GitHub-hosted: reliably provides a running Docker daemon + buildx +
     # python3. See the header note (ci-2) for why the self-hosted sm-standard-4
     # label was abandoned (no docker.sock on the pod its only run landed on).
-    # sm-standard-2 has no docker.sock either (weekly runs failed at "Enable
-    # buildx" from 2026-09-27 to 2026-11-08), so keep this job on ubuntu-latest.
     # TODO(ci-8): scheduled-failure alerting (auto-open issue on a red weekly
     # run) is added by the ci-8 composite action; do not implement it here.
-    runs-on: ubuntu-latest
+    runs-on: sm-standard-2
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7

.github/workflows/reference-parity.yml

@@ -1,444 +0,0 @@
-# Copyright 2026 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# s3-tests reference parity lane (rustfs/backlog#2773).
-#
-# Runs the ceph/s3-tests implemented list (scripts/s3-tests/implemented_tests.txt)
-# against every target in .config/reference-parity-targets.toml and fails on
-# any per-node-id difference between a candidate and the reference:
-#
-#   - reference: the release pinned in .config/reference-binary.toml, downloaded
-#     and sha256-verified by .github/actions/reference-binary;
-#   - candidate targets: the debug binary built from this checkout exactly as
-#     ci.yml's build-rustfs-debug-binary job builds it for S3 Implemented Tests.
-#
-# Every target runs the same harness (scripts/s3-tests/run.sh from this
-# checkout), test list and server configuration on its own hosted runner. A
-# target's failures get one rerun against a fresh server; a case that passes it
-# is flaky, not a difference. scripts/s3-tests/reference_parity.py judges the
-# result and honours .config/reference-parity-tolerated.txt, whose entries must
-# each match a real difference.
-#
-# The `differential` job adds the 73-operation dual-stack differential
-# (crates/e2e_test/src/dual_stack_differential, rustfs/backlog#2740) against the
-# same pinned reference: side A is the released binary (RUSTFS_E2E_REFERENCE_BINARY,
-# started without RUSTFS_S3_STACK), side B is the candidate built above on its
-# legacy stack. It reuses the candidate build artifact, never builds the candidate
-# twice, and prints reference_side, version_a and version_b from the report the test
-# wrote; it fails when side A was not the reference or both sides report the same
-# version. Every (op, field, a, b) difference goes to the job summary. Report-only
-# until the first result has been reviewed.
-#
-# Report-only: not part of the Test and Lint aggregate. Scheduled failures are
-# owned by the scheduled-validation watchdog (.github/scheduled-validations.json).
-
-name: Reference Parity
-
-on:
-  pull_request:
-    paths:
-      - ".github/workflows/reference-parity.yml"
-      - ".github/actions/reference-binary/**"
-      - ".config/reference-binary.toml"
-      - ".config/reference-parity-targets.toml"
-      - ".config/reference-parity-tolerated.txt"
-      - "scripts/s3-tests/reference_parity.py"
-      - "scripts/junit_diff.py"
-      - "crates/e2e_test/src/dual_stack_differential/**"
-  schedule:
-    - cron: "37 1 * * *"
-  workflow_dispatch:
-
-# Matches ci.yml: these variables are hashed into the rust-cache key, so the
-# candidate build reads the same ci-dev cache as build-rustfs-debug-binary.
-env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  plan:
-    name: Plan parity targets
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      targets: ${{ steps.targets.outputs.targets }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Validate target list
-        id: targets
-        run: |
-          set -euo pipefail
-          targets="$(python3 scripts/s3-tests/reference_parity.py targets --config .config/reference-parity-targets.toml)"
-          echo "targets=${targets}" >> "$GITHUB_OUTPUT"
-          echo "Parity targets: ${targets}"
-
-  build-candidate:
-    name: Build candidate binary
-    # Critical-path CPU and cache ownership: the same debug build as ci.yml's
-    # build-rustfs-debug-binary, reading the ci-dev cache written on sm-standard-4.
-    runs-on: sm-standard-4
-    timeout-minutes: 60
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: stable
-          cache-shared-key: ci-dev
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
-
-      - name: Build debug binary
-        run: python3 scripts/e2e_binary.py build --bins --features e2e-test-hooks
-
-      - name: Upload candidate binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: reference-parity-candidate-binary
-          overwrite: true
-          path: |
-            target/debug/rustfs
-            target/debug/rustfs.e2e.json
-          if-no-files-found: error
-          retention-days: 1
-
-  s3tests:
-    name: s3-tests (${{ matrix.target.name }})
-    needs: [ plan, build-candidate ]
-    runs-on: ubuntu-latest
-    timeout-minutes: 75
-    strategy:
-      fail-fast: false
-      matrix:
-        target: ${{ fromJSON(needs.plan.outputs.targets) }}
-    env:
-      TARGET_NAME: ${{ matrix.target.name }}
-      TARGET_KIND: ${{ matrix.target.binary }}
-      # Above this many first-run failures the target is systemically broken;
-      # a rerun would only repeat it, so the first run is judged as is.
-      RERUN_CAP: "50"
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Fetch pinned reference binary
-        id: reference
-        if: matrix.target.binary == 'reference'
-        uses: ./.github/actions/reference-binary
-
-      - name: Download candidate binary
-        if: matrix.target.binary == 'candidate'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: reference-parity-candidate-binary
-          path: target/debug
-
-      - name: Select target binary
-        env:
-          REFERENCE_PATH: ${{ steps.reference.outputs.path }}
-        run: |
-          set -euo pipefail
-          case "$TARGET_KIND" in
-            reference) binary="$REFERENCE_PATH" ;;
-            candidate) chmod +x target/debug/rustfs; binary="$PWD/target/debug/rustfs" ;;
-            *) echo "unknown target binary kind: $TARGET_KIND" >&2; exit 1 ;;
-          esac
-          test -x "$binary"
-          echo "TARGET_BINARY=$binary" >> "$GITHUB_ENV"
-          mkdir -p "parity/$TARGET_NAME"
-          {
-            echo "target=$TARGET_NAME"
-            echo "binary=$TARGET_KIND"
-            echo "sha256=$(sha256sum "$binary" | cut -d' ' -f1)"
-            echo "version=$("$binary" --version | tr '\n' ' ')"
-          } | tee "parity/$TARGET_NAME/target.txt"
-
-      - name: Apply target environment
-        env:
-          TARGET_JSON: ${{ toJSON(matrix.target) }}
-        run: |
-          set -euo pipefail
-          python3 scripts/s3-tests/reference_parity.py export-env --target-json "$TARGET_JSON" \
-            | tee -a "$GITHUB_ENV" "parity/$TARGET_NAME/target-env.txt"
-
-      - name: Run implemented s3-tests
-        run: |
-          set -uo pipefail
-          report="parity/$TARGET_NAME"
-          harness="artifacts/s3tests-single"
-
-          # Same invocation as ci.yml's S3 Implemented Tests, with a fresh data
-          # root and port per run. $1 optionally replaces the test list.
-          run_suite() {
-            local list="$1" label="$2" root port
-            root="${RUNNER_TEMP}/rustfs-s3tests-${label}"
-            rm -rf "$harness" "$root"
-            mkdir -p "$root"
-            port="$(python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1", 0)); print(s.getsockname()[1]); s.close()')"
-            env DEPLOY_MODE=binary \
-              RUSTFS_BINARY="$TARGET_BINARY" \
-              TEST_MODE=single \
-              MAXFAIL=0 \
-              XDIST=4 \
-              S3_PORT="$port" \
-              DATA_ROOT="$root" \
-              S3TESTS_CONF="$harness/s3tests.conf" \
-              ${list:+IMPLEMENTED_TESTS_FILE="$list"} \
-              ./scripts/s3-tests/run.sh
-          }
-
-          # A run is usable only if it produced a JUnit report; test failures
-          # are data for the comparison, a missing report is a lane failure.
-          keep() {
-            local prefix="$1"
-            for file in pytest.log compat-report.md; do
-              if [[ -f "$harness/$file" ]]; then cp "$harness/$file" "$report/${prefix}${file}"; fi
-            done
-            if [[ -f "$harness/rustfs-single/rustfs.log" ]]; then cp "$harness/rustfs-single/rustfs.log" "$report/${prefix}rustfs.log"; fi
-            test -s "$harness/junit.xml" || { echo "::error::$TARGET_NAME produced no JUnit report (${prefix:-first} run)"; return 1; }
-            cp "$harness/junit.xml" "$report/${prefix}junit.xml"
-          }
-
-          run_suite "" first
-          echo "first_run_exit=$?" >> "$report/target.txt"
-          keep "" || exit 1
-          cp "$harness/selected-nodeids.txt" "$report/selected-nodeids.txt" || exit 1
-
-          failures="$(python3 scripts/s3-tests/reference_parity.py failed --report "$report")" || exit 1
-          count="$(printf '%s' "$failures" | grep -c . || true)"
-          echo "first_run_failures=$count" >> "$report/target.txt"
-          if (( count == 0 )); then
-            exit 0
-          fi
-          if (( count > RERUN_CAP )); then
-            echo "::warning::$TARGET_NAME has $count failures (cap $RERUN_CAP); judging the first run without a rerun"
-            echo "rerun=skipped-over-cap" >> "$report/target.txt"
-            exit 0
-          fi
-          printf '%s\n' "$failures" > "$RUNNER_TEMP/rerun-tests.txt"
-          run_suite "$RUNNER_TEMP/rerun-tests.txt" rerun
-          echo "rerun_exit=$?" >> "$report/target.txt"
-          keep rerun- || exit 1
-
-      - name: Upload target report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: reference-parity-report-${{ matrix.target.name }}
-          overwrite: true
-          path: parity/${{ matrix.target.name }}/
-          if-no-files-found: error
-          retention-days: 14
-
-  differential:
-    name: Dual-stack differential (reference vs candidate)
-    needs: [ build-candidate ]
-    # Compiles the e2e_test harness against the ci-dev cache like the other
-    # sm-standard-4 jobs; the candidate server itself is the downloaded artifact.
-    runs-on: sm-standard-4
-    timeout-minutes: 90
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-      NO_PROXY: 127.0.0.1,localhost,::1
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: stable
-          cache-shared-key: ci-dev
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
-
-      - name: Fetch pinned reference binary
-        id: reference
-        uses: ./.github/actions/reference-binary
-
-      - name: Download candidate binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: reference-parity-candidate-binary
-          path: target/debug
-
-      - name: Run dual-stack differential
-        id: differential
-        continue-on-error: true
-        env:
-          REFERENCE_PATH: ${{ steps.reference.outputs.path }}
-          RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-differential-logs
-        run: |
-          set -euo pipefail
-          export no_proxy="$NO_PROXY"
-          chmod +x target/debug/rustfs
-          test -x "$REFERENCE_PATH"
-          mkdir -p "$RUSTFS_E2E_LOG_DIR"
-          # Side A: the released binary. Side B: the candidate on its legacy stack.
-          export RUSTFS_E2E_REFERENCE_BINARY="$REFERENCE_PATH"
-          test_name='dual_stack_differential::tests::both_stacks_answer_every_operation_identically'
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- \
-            cargo test --locked -p e2e_test --lib "$test_name" -- --exact --nocapture \
-            2>&1 | tee "$RUNNER_TEMP/differential-test.log"
-
-      - name: Summarize report and verify the reference side
-        if: always()
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          import glob, json, os, sys
-
-          summary = os.environ["GITHUB_STEP_SUMMARY"]
-          reports = sorted(glob.glob("target/dual-stack/self-comparison-*.json"))
-          lines = ["## Dual-stack differential: reference vs candidate", ""]
-          failures = []
-          if len(reports) != 1:
-              failures.append(f"expected exactly one self-comparison report, found {len(reports)}: {reports}")
-          else:
-              report = json.load(open(reports[0]))
-              side = report.get("reference_side")
-              version_a = report.get("version_a")
-              version_b = report.get("version_b")
-              lines += [
-                  f"- report: `{reports[0]}`",
-                  f"- reference_side: `{side}`",
-                  f"- version_a: `{(version_a or '').splitlines()[0] if version_a else version_a}`",
-                  f"- version_b: `{(version_b or '').splitlines()[0] if version_b else version_b}`",
-                  f"- stack_a: `{report.get('stack_a')}`, stack_b: `{report.get('stack_b')}`",
-                  f"- compared_ops: {report.get('compared_ops')}, compared_cases: {report.get('compared_cases')}",
-                  "",
-              ]
-              print(f"reference_side={side}\nversion_a={version_a}\nversion_b={version_b}")
-              lines += ["```", "version_a:", version_a or "", "", "version_b:", version_b or "", "```", ""]
-              if side != "a":
-                  failures.append(f"reference_side is {side!r}, expected 'a'")
-              if not version_a or not version_b:
-                  failures.append("version_a or version_b is missing")
-              elif version_a == version_b:
-                  failures.append("version_a equals version_b: the reference was replaced by the candidate")
-              diffs = report.get("differences") or []
-              lines.append(f"### Differences: {len(diffs)}")
-              by_op = {}
-              for d in diffs:
-                  by_op.setdefault(d["op"], []).append(d)
-              for op in sorted(by_op):
-                  lines += ["", f"#### {op}", "", "| case | field | a (reference) | b (candidate) |", "| --- | --- | --- | --- |"]
-                  for d in by_op[op]:
-                      cell = lambda v: "`" + str(v).replace("|", "\\|").replace("`", "'") + "`"
-                      lines.append(f"| {d['case']} | {d['field']} | {cell(d['a'])} | {cell(d['b'])} |")
-          if failures:
-              lines += ["", "### Observation check failed", ""] + [f"- {f}" for f in failures]
-          open(summary, "a").write("\n".join(lines) + "\n")
-          print("\n".join(lines))
-          for f in failures:
-              print(f"::error::{f}")
-          sys.exit(1 if failures else 0)
-          PY
-
-      - name: Upload differential reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: reference-differential-report
-          overwrite: true
-          path: |
-            target/dual-stack/*.json
-            ${{ runner.temp }}/differential-test.log
-          if-no-files-found: warn
-          retention-days: 14
-
-      - name: Fail when the differential found differences
-        if: steps.differential.outcome == 'failure'
-        run: |
-          echo "::error::the dual-stack differential failed; see the job summary for every (op, field, a, b)"
-          exit 1
-
-  compare:
-    name: Compare targets
-    needs: [ plan, s3tests ]
-    if: always() && needs.plan.result == 'success'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Download target reports
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: reference-parity-report-*
-          path: parity-download
-
-      - name: Compare per node id
-        env:
-          TARGETS: ${{ needs.plan.outputs.targets }}
-          S3TESTS_RESULT: ${{ needs.s3tests.result }}
-        run: |
-          set -uo pipefail
-          mkdir -p parity
-          for dir in parity-download/reference-parity-report-*; do
-            if [[ -d "$dir" ]]; then mv "$dir" "parity/${dir#parity-download/reference-parity-report-}"; fi
-          done
-          python3 scripts/s3-tests/reference_parity.py compare \
-            --targets-json "$TARGETS" \
-            --reports parity \
-            --tolerated .config/reference-parity-tolerated.txt \
-            --markdown "$GITHUB_STEP_SUMMARY" \
-            --json parity/diff.json > parity/diff.md
-          status=$?
-          cat parity/diff.md
-          if [[ "$S3TESTS_RESULT" != "success" ]]; then
-            echo "::error::s3-tests target jobs finished with '$S3TESTS_RESULT'"
-            status=1
-          fi
-          exit "$status"
-
-      - name: Upload parity diff
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: reference-parity-diff
-          overwrite: true
-          path: |
-            parity/diff.md
-            parity/diff.json
-          if-no-files-found: warn
-          retention-days: 14

ARCHITECTURE.md

@@ -155,7 +155,7 @@ default build (lifecycle:
    - ⚠️ PARTIALLY VIOLATED: serving-side `s3s` references remain in ecstore
      (bucket metadata/replication/lifecycle DTOs and error mapping). The
      count is ratcheted shrink-only by `scripts/check_s3s_footprint.sh`
-     (the `ecstore_files` line of `.config/s3s-footprint-baseline.txt`; the `object_lock` module was converted to
+     (`S3S_ECSTORE_FILES_BASELINE`; the `object_lock` module was converted to
      storage-level types as the first ratchet step). Target state: the
      baseline reaches zero and ecstore's `Cargo.toml` drops `s3s`.
 

CHANGELOG.md

@@ -7,27 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Notifications and audit
-
-- Notify and audit targets that keep the default `queue_dir` now work on native Windows: the defaults `/opt/rustfs/events` and `/opt/rustfs/audit` resolve per node, to `%ProgramData%\RustFS\events` and `%ProgramData%\RustFS\audit` on Windows, instead of failing validation as non-absolute paths. The new `RUSTFS_TARGET_STORE_DIR` (Helm `config.rustfs.target_store_dir`) relocates both default queues on any platform. Linux and macOS behavior is unchanged when it is unset, persisted configuration is unchanged, and pending entries are not migrated when the root changes. See `docs/operations/target-queue-storage.md`.
-
 ### Deployment
 
-- Before upgrading, verify that the configured root access key is at least 3 bytes and the root secret key is at least 8 bytes. RustFS now rejects shorter values at startup and identifies the setting to update. Version 1.0.5 accepted these settings at startup and returned HTTP 500 when root requested STS credentials. Coordinate root credential changes across all nodes and clients. See [root credential rotation considerations](docs/operations/two-factor-auth.md#root-credentials-cannot-be-changed-at-runtime).
-
 - Existing volumes created by older root-running container images must be writable by the non-root runtime identity before upgrading. The default container UID/GID is `10001:10001`; stop the affected instances, verify host mount paths, and for ordinary bind mounts run `sudo chown -R 10001:10001 /actual/data /actual/logs` on each RustFS data/log mount. Account for ACLs, NFS, Kubernetes, and rootless UID mappings. Image-build ownership changes do not migrate mounted data. See the Docker Quick Start in [README.md](README.md).
 - Local disk initialization now checks file creation, writing, and deletion in the data root and fixed internal metadata directories. Unwritable disks are rejected using existing startup/quorum rules, with filesystem errors and Unix runtime/owner IDs logged for permission failures, instead of admitting those disks and discovering the mismatch on a later write. Existing object trees are not scanned and volume ownership is never changed automatically.
 
 ### Security
 
-- **Key-scoped KMS policy statements now hold for every spelling of an AWS key**: a statement such as `Deny kms:Decrypt` on `arn:aws:kms:::key/<key-id>` was matched against the key identifier exactly as the request spelled it, so naming the same key by its AWS ARN (`arn:aws:kms:<region>:<account>:key/<key-id>`) was evaluated as a different key and the `Deny` did not apply. With `RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY=true` and the AWS KMS backend, an identity allowed on all keys but denied one could still write under that key, and read objects stored under its ARN spelling; the per-key admin endpoints were affected the same way. A key ARN is now evaluated as its key id, on the SSE-KMS data path and the admin endpoints alike. A request that names a key by alias, which only the backend can resolve, now fails closed against key-scoped statements: every key-scoped `Deny` applies and only an `Allow` on every key covers it. The KMS deletion impact report recognizes the default key and bucket default-encryption references across the id and ARN spellings as well. Deployments without key-scoped KMS statements, and the other KMS backends, whose key ids have a single spelling, are unaffected.
-
 - **Header-signed SigV4 requests honour only signed headers** (GHSA-xm99-m3gq-83g8): a request authenticated with a SigV4 `Authorization` header that carries an `x-amz-*` request header not listed in its `SignedHeaders` is now rejected with `403 AccessDenied` ("There were headers present in the request which were not signed"), matching AWS S3 and the presigned rule from GHSA-g8w9-qw9q-fghr. Previously anyone holding one header-signed `PutObject` request could add an unsigned `x-amz-copy-source` and turn it into a `CopyObject` that ran with the signer's permissions, copying any object the signer could read into the target. An `Authorization` header whose algorithm token is not `AWS4-HMAC-SHA256` is now rejected instead of being verified as SigV4. The request-envelope headers `x-amz-content-sha256`, `x-amz-decoded-content-length`, `x-amz-trailer` and `x-amz-checksum-algorithm` (the same set the upstream `s3s` fix exempts) and `x-amz-cf-id` (CloudFront) remain tolerated unsigned; AWS SDKs and RustFS's own signers already sign every other `x-amz-*` header. SigV2, JWT and anonymous requests are unchanged.
 
 ### Replication
 
-- Site replication now seals an SSE-KMS replica under the peer's key of the same name as the source object's key. The replica write used to carry only the `aws:kms` intent, so an object written under a key named in the request was sealed under the peer's bucket default or site default instead, and with `RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY=true` a caller scoped to the named key could read the object on the site that took the write but got `AccessDenied` for its replica. This changes the default outbound request to site-replication peers: every key name in use, including each site's default key name, must exist on every site, or the affected SSE-KMS objects stay `FAILED` until the key is created. Existing replicas are not rewritten. Bucket replication through a remote target still sends the intent only.
-- Site replication now replicates SSE-KMS objects when the receiving site runs with `RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY=true`. The receiving site authorizes each replica write against the KMS key it resolves to, and the managed `site-replicator-0` account held no `kms` grant, so every SSE-KMS object stayed `FAILED` with `AccessDenied` while SSE-S3 and SSE-C objects replicated. The account's embedded policy now grants `kms:GenerateDataKey` on every key; existing accounts are refreshed by the reconcile tick and the failed objects catch up afterwards. It is deliberately not granted `kms:Decrypt`, so reads proxied to a peer for an SSE-KMS object are still refused under enforcement. Bucket replication through a remote target needs the same grant on the identity whose credentials the target uses. Sites that do not enable enforcement are unaffected.
 - Object Lock replication PUTs now carry a required integrity header, fixing target rejection introduced by the plain-payload default ([#7097](https://github.com/rustfs/rustfs/pull/7097)). This changes the default outbound request for locked objects but adds no persisted format.
 - Multipart source objects stay on the multipart transport even when their checksum record is a whole-object checksum, so objects above the single-PUT limit remain replicable ([#7047](https://github.com/rustfs/rustfs/pull/7047)).
 - Targets that mint their own version IDs now use a per-target version ledger for tag, retention, legal-hold, and permanent-delete mutations; ambiguous pre-ledger matches fail with backoff instead of guessing ([#7368](https://github.com/rustfs/rustfs/pull/7368)). This adds dual-prefixed internal metadata keys that older readers ignore.
@@ -43,11 +33,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Presigned URLs honour only signed headers** (GHSA-g8w9-qw9q-fghr): a SigV4 presigned request that carries an `x-amz-*` request header not listed in `X-Amz-SignedHeaders` is now rejected with `403 AccessDenied` ("There were headers present in the request which were not signed"), matching AWS S3. Previously the holder of a presigned `PutObject` URL could add unsigned `x-amz-tagging`, `x-amz-storage-class`, `x-amz-website-redirect-location`, ACL, metadata, Object Lock or SSE headers and have them applied. Presigners that intend a property must set it before signing so the SDK lists the header in `SignedHeaders`; `x-amz-cf-id` (CloudFront) remains tolerated unsigned. Header-signed SigV4 and SigV2 requests are unchanged.
 
 ### Fixed
-
-- **KMS keys could not be described by ARN through the path route**: `GET /rustfs/admin/v3/kms/keys/{key_id}` read the path segment verbatim, so a key id that has to be percent-encoded to fit in one segment — an AWS key ARN, with its `:` and `/` — was looked up, authorized and audited under its encoded spelling and answered `404`. The segment is now percent-decoded first; a segment that is not valid UTF-8 after decoding is refused with `400 InvalidArgument`. The `describe-key?keyId=` form was unaffected.
-
-- **SSE-KMS objects written through the AWS KMS backend could not be read**: `GetObject`, `CopyObject` and every other read of an `aws:kms` object failed with `400 InvalidRequest` ("SSE-S3 requires RUSTFS_SSE_S3_MASTER_KEY to be set ...") on a deployment using `RUSTFS_KMS_BACKEND=aws`, although the write and `HeadObject` succeeded. The AWS backend stored the `GenerateDataKey` blob as it came from AWS, the read path took those unrecognized bytes for a locally wrapped key, and AWS was never asked to decrypt. The backend now stores the blob inside the same data-key envelope the other backends use, and a blob stored without one is routed to AWS when the AWS backend is active. Objects written by 1.0.4 and 1.0.5 are intact and become readable after the upgrade, with no rewrite. Setting `RUSTFS_SSE_S3_MASTER_KEY` was never a workaround. An object written by this release is not readable by an older one; the same was already true of every object the older release wrote itself.
-- **Immediate KMS key deletion no longer reports success without destroying the key** (behavior change): with `RUSTFS_KMS_ALLOW_IMMEDIATE_DELETION=true`, a `DELETE /rustfs/admin/v3/kms/keys/delete` request with `force_immediate` against an `Enabled` or `Disabled` key on the Vault KV2 or Vault Transit backend returned success but only moved the key to `PendingDeletion`; the key material stayed in Vault and objects encrypted under it remained readable, while the Local backend destroyed the key in that one request. Key destruction is now the same two explicit steps on every backend: schedule the deletion, then either let the waiting window elapse or send `force_immediate` to destroy the pending key early. `force_immediate` against a key that is not `PendingDeletion` is refused with `400` and changes nothing, so a success response always means the key is gone and no single request can destroy a key in use. Automation that destroyed Local keys with one `force_immediate` request must schedule the deletion first. On Vault Transit, a read under a key that no longer exists in Vault now fails with `KMS.NotFoundException` instead of `503 ServiceUnavailable`. No persisted format changes. See `docs/operations/kms-key-destruction.md`.
 - **`mc admin info` and `mc admin replicate resync` work again**: since the cluster snapshot view (#3803), `GET /v3/info` and `GET /v3/storageinfo` returned the madmin `InfoMessage` / `StorageInfo` nested under an `info` key next to `admin_discovery` (and, for `/info`, `bitrotSelftest`). madmin decodes those bodies directly, so `mc admin info` printed empty values and `mc admin replicate resync start/status` rejected every alias with "alias provided is not part of cluster replication" because the local `deploymentID` read as empty. Requests on the MinIO-compatible `/minio/admin/v3` prefix now receive the bare madmin body again; `/rustfs/admin/v3`, which rc and the console use, keeps the envelope unchanged.
 - **Replication status writebacks no longer invalidate scanner cycles**: every replication status writeback (`persist_replication_state_if_current` in `Update` mode, including the heals the scanner queues during its own walk) marked the bucket dirty on the namespace path, advanced the dirty-usage generation and woke the scanner, so a site-replication resync or any steadily replicated bucket ended every cycle `superseded`, the authoritative usage baseline was never certified, and the console reported usage freshness as stale for as long as replication ran (#8375). Those writebacks are now status class: they do not touch the dirty-usage generation, the activity snapshot, the dirty-usage wake or the durable dirty journal, and only the process-local producer coverage is recorded. They need no rescan queue, because a deployment with an active replication rule already walks every bucket on every cycle and that walk refreshes `replication_stats`. Tier-expiration cleanup, which removes data, stays on the namespace path. No persisted format, protocol, admin API or configuration changes. Design: `docs/architecture/scanner-per-bucket-convergence.md`.
 - **A bucket written during a scanner walk no longer supersedes the whole cycle**: the post-walk cluster activity proof required the entire activity snapshot and the dirty-usage generation to be unchanged, so a single-node deployment with one bucket written every few seconds never reached a `Complete` cycle, `usage_snapshot_converged` never became true and the authoritative usage baseline was never certified (#8494). Dirty usage is now certified per bucket: a structurally complete walk that the guardrail did not veto is `Complete`, buckets whose dirty generation still matches the start snapshot are cleared, and buckets written during the walk stay dirty and are published as the pending set, so `usage_snapshot_converged` means "no bucket pending" and the next cycle is scoped to the pending buckets. Such a cycle writes the authoritative usage object; the observed object is now selected by an explicit observational mark that vetoed cycles carry. The guardrail itself vetoes only on the fields that change which namespace the walk described (peer set, process instance, protocol version, topology, maintenance generation, data movement, movement generation, publication blocked) and reports the field and host in the scanner log and in the new `usage_freshness` fields `guardrail_veto_total`, `last_guardrail_veto_unix_secs` and `last_guardrail_veto_reason`. In a distributed deployment a remote peer whose dirty usage moved during the walk still supersedes the cycle until scoped acknowledgements can name its buckets. `.usage.v2.json` gains the additive, default-when-absent fields `usage_snapshot_pending_buckets`, `usage_snapshot_pending_bucket_count` and `usage_snapshot_observational`; older readers ignore them and treat the snapshot as an authoritative but unconverged publication. Quota is unchanged: an uncertified bucket keeps its last usage value as the floor and live writes do not advance it. No protocol or configuration changes. Design: `docs/architecture/scanner-per-bucket-convergence.md`.

Cargo.toml

@@ -26,7 +26,6 @@ members = [
     "crates/ecstore", # Erasure coding storage implementation
     "crates/e2e_test", # End-to-end test suite
     "crates/filemeta", # File metadata management
-    "crates/gateway-adapter", # RustFS implementations of the gateway extension traits
     "crates/heal", # Erasure set and object healing
     "crates/heal-contracts", # Heal request/response channel contracts
     "crates/iam", # Identity and Access Management
@@ -49,7 +48,7 @@ members = [
     "crates/replication", # Replication contracts and wire formats
     "crates/concurrency", # Concurrency management for RustFS - timeout, locking, backpressure, and I/O scheduling
     "crates/s3-client", # S3 client for engine-side consumption of remote S3 endpoints (tiering, transition targets)
-    "crates/s3-types", # S3 event and error type definitions
+    "crates/s3-types", # S3 event type definitions
     "crates/s3-ops", # S3 operation definitions and mapping
     "crates/s3select-api", # S3 Select API interface
     "crates/s3select-query", # S3 Select query engine
@@ -94,7 +93,6 @@ redundant_clone = "warn"
 [workspace.dependencies]
 # RustFS Internal Crates
 rustfs = { path = "./rustfs", version = "1.0.5" }
-rustfs-gateway-adapter = { path = "crates/gateway-adapter", version = "1.0.5" }
 rustfs-heal = { path = "crates/heal", version = "1.0.5" }
 rustfs-heal-contracts = { path = "crates/heal-contracts", version = "1.0.5" }
 rustfs-scanner-metrics = { path = "crates/scanner-metrics", version = "1.0.5" }
@@ -145,26 +143,13 @@ rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.5" }
 rustfs-utils = { path = "crates/utils", version = "1.0.5" }
 rustfs-zip = { path = "./crates/zip", version = "1.0.5" }
 
-# The gateway's S3 types: the DTOs and persisted bucket-configuration codecs the
-# engine crates move onto from s3s (rustfs/backlog#2745). The one pin of the
-# gateway in this workspace; no crate may enable a `compat-s3s*` feature except
-# the s3s-facing edge of the rustfs binary.
-rustfs-gateway-types = { git = "https://github.com/rustfs/gateway.git", rev = "7915d06950f88611d883f6ab3d95efc90c65dec0", version = "0.40.0", default-features = false }
-rustfs-gateway-stream = { git = "https://github.com/rustfs/gateway.git", rev = "7915d06950f88611d883f6ab3d95efc90c65dec0", version = "0.2.0", default-features = false }
-# The gateway framework itself, consumed for its extension traits by the ring-2
-# adapter. `default-features = false` keeps the `server` feature, and with it the
-# server crate, out of the build.
-rustfs-gateway = { git = "https://github.com/rustfs/gateway.git", rev = "7915d06950f88611d883f6ab3d95efc90c65dec0", version = "0.62.0", default-features = false }
-# Test-only: builds the `EffectiveHost` a host-resolution test queries with.
-rustfs-gateway-http = { git = "https://github.com/rustfs/gateway.git", rev = "7915d06950f88611d883f6ab3d95efc90c65dec0", default-features = false }
-
 # Async Runtime and Networking
 async-channel = "2.5.0"
 async_zip = { default-features = false, version = "0.0.19" }
 mysql_async = { default-features = false, version = "0.37.1" }
 async-compression = { version = "0.4.52" }
 async-trait = "0.1.92"
-async-nats = { version = "0.52.0", default-features = false }
+async-nats = { version = "0.51.0", default-features = false }
 axum = "0.8.9"
 futures = "0.3.34"
 futures-core = "0.3.34"
@@ -211,7 +196,7 @@ bytesize = "2.7.0"
 byteorder = "1.5.0"
 flatbuffers = "25.12.19"
 form_urlencoded = "1.2.2"
-prost = "0.14.5"
+prost = "0.14.4"
 quick-xml = "0.42.0"
 rmp = { version = "0.8.15" }
 rmp-serde = { version = "1.3.1" }
@@ -240,7 +225,7 @@ p256 = { version = "0.14.0", features = ["ecdsa", "pkcs8"] }
 rsa = { version = "=0.10.0-rc.18" }
 rustls = { default-features = false, version = "0.23.46" }
 rustls-native-certs = "0.8"
-rustls-pki-types = "1.16.0"
+rustls-pki-types = "1.15.1"
 x509-parser = "0.18.1"
 sha1 = "0.11.0"
 sha2 = "0.11.1"
@@ -251,7 +236,7 @@ proptest = "1"
 # Time and Date
 chrono = { version = "0.4.45" }
 humantime = "2.4.0"
-jiff = { version = "0.2.43" }
+jiff = { version = "0.2.39" }
 time = { version = "0.3.55" }
 
 # Database
@@ -261,22 +246,22 @@ tokio-postgres-rustls = "0.14.0"
 
 # Utilities and Tools
 anyhow = "1.0.104"
-arc-swap = "1.9.5"
+arc-swap = "1.9.3"
 rustfs-tokio-tar = { version = "0.7.1" }
 # Candidate Snowball parser versions exercised by rustfs-zip compatibility fixtures.
-tar-codec = "0.0.16"
-tar-framing = "0.0.16"
+tar-codec = "0.0.15"
+tar-framing = "0.0.15"
 atoi = "3.1.1"
 atomic_enum = "0.3.0"
-aws-config = { version = "1.13.2" }
+aws-config = { version = "1.13.0" }
 aws-credential-types = { version = "1.3.1" }
-aws-sdk-kms = { default-features = false, version = "1.131.0" }
-aws-sdk-s3 = { default-features = false, version = "1.159.0" }
-aws-sdk-sts = { default-features = false, version = "1.126.0" }
+aws-sdk-kms = { default-features = false, version = "1.129.0" }
+aws-sdk-s3 = { default-features = false, version = "1.157.0" }
+aws-sdk-sts = { default-features = false, version = "1.124.0" }
 aws-smithy-async = { version = "1.3.1" }
 aws-smithy-http-client = { default-features = false, version = "1.5.2" }
-aws-smithy-runtime-api = { version = "1.21.0" }
-aws-smithy-types = { version = "1.9.4" }
+aws-smithy-runtime-api = { version = "1.19.2" }
+aws-smithy-types = { version = "1.9.1" }
 base64-simd = "0.8.0"
 brotli = "9.1.1"
 clap = { version = "4.6.7" }
@@ -292,10 +277,10 @@ derive_builder = "0.20.2"
 ed25519-dalek = "3.0.0"
 enumset = "1.1.15"
 faster-hex = "1.0.0"
-flate2 = "1.1.11"
+flate2 = "1.1.10"
 glob = "0.3.4"
-google-cloud-storage = "1.22.0"
-google-cloud-auth = "1.19.0"
+google-cloud-storage = "1.21.0"
+google-cloud-auth = "1.18.0"
 hashbrown = { version = "0.17.1" }
 # Base32 for RFC 6238 TOTP shared secrets (RFC 4648 unpadded, the alphabet
 # every authenticator app expects). Already in the graph transitively.
@@ -340,24 +325,19 @@ rumqttc = { package = "rumqttc-next", version = "0.34.0" }
 redis = { version = "1.8.1" }
 rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.6" }
-rust-embed = { version = "8.14.0" }
+rust-embed = { version = "8.13.0" }
 rustc-hash = { version = "2.1.3" }
 s3s = { git = "https://github.com/s3s-project/s3s", rev = "5761ddfe4c509fcac87e3b99fd5bd9e176b442c0", features = ["minio"] }
 s3s-sigv4 = { git = "https://github.com/s3s-project/s3s", rev = "5761ddfe4c509fcac87e3b99fd5bd9e176b442c0" }
-# The same s3s pin under the name the legacy edge of the gateway migration uses
-# (crates/s3-types, feature `compat-s3s`). Keep `rev` identical to `s3s` above.
-# DELETE BY T4.2 (rustfs/backlog#2784).
-legacy-s3s = { package = "s3s", git = "https://github.com/s3s-project/s3s", rev = "5761ddfe4c509fcac87e3b99fd5bd9e176b442c0", features = ["minio"] }
 serial_test = "4.0.1"
 shadow-rs = { default-features = false, version = "2.0.0" }
 siphasher = "1.0.4"
-smallvec = { version = "1.16.5" }
+smallvec = { version = "1.16.4" }
 compact_str = "0.10.0"
 snap = "1.1.2"
-starshard = { version = "2.4.1" }
+starshard = { version = "2.4.0" }
 strum = { version = "0.28.0" }
-sync_wrapper = "1.0.2"
-sysinfo = "0.40.3"
+sysinfo = "0.40.1"
 temp-env = "0.3.6"
 tempfile = "3.27.0"
 test-case = "3.4.1"
@@ -371,7 +351,7 @@ tracing-subscriber = { version = "0.3.23" }
 transform-stream = "0.3.1"
 url = "2.5.8"
 urlencoding = "2.1.3"
-uuid = { version = "1.29.2" }
+uuid = { version = "1.29.0" }
 vaultrs = { version = "0.8.0" }
 tar = "0.4.46"
 walkdir = "2.5.0"
@@ -379,13 +359,13 @@ winapi-util = "0.1.11"
 windows = { version = "0.62.2" }
 windows-sys = "0.61.2"
 xxhash-rust = { version = "0.8.19" }
-zip = "9.5.1"
+zip = "9.3.0"
 zstd = "0.14.3"
 
 # Observability and Metrics
 metrics = "0.24.6"
 metrics-util = "0.20"
-dial9 = { version = "0.5.8", default-features = false }
+dial9 = { version = "0.5.7", default-features = false }
 opentelemetry = { version = "0.33.1" }
 opentelemetry-appender-tracing = { version = "0.33.1" }
 opentelemetry-otlp = { version = "0.33.1" }
@@ -397,7 +377,7 @@ pyroscope = { version = "2.1.5" }
 
 # FTP and SFTP
 libunftp = { version = "0.24.0" }
-unftp-core = "0.1.1"
+unftp-core = "0.1.0"
 suppaftp = { version = "12.2.1" }
 rcgen = { version = "0.14.10", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
 russh = { version = "0.65.1" }
@@ -407,9 +387,9 @@ russh-sftp = "3.0.1"
 dav-server = "0.11.0"
 
 # Performance Analysis and Memory Profiling
-rustfs-mimalloc = { version = "0.7.4" }
+rustfs-mimalloc = { version = "0.7.3" }
 # Preserve Unicode focus filters until rustfs/backlog#2302 is resolved.
-hotpath = { version = "0.31.2", default-features = false }
+hotpath = { version = "0.30.3", default-features = false }
 # Snapshot testing for output format regression detection
 insta = { version = "1.49" }
 

Dockerfile.source

@@ -24,10 +24,9 @@
 #
 # Supports cross-compilation for amd64 and arm64 via TARGETPLATFORM.
 
-# Do not declare TARGETPLATFORM, BUILDPLATFORM or TARGETARCH here: a global
-# declaration without a value shadows BuildKit's automatic values, so the
-# stage-level re-declarations below see empty strings. They are only
-# declared inside the stage that uses them.
+ARG TARGETPLATFORM
+ARG BUILDPLATFORM
+ARG TARGETARCH
 ARG RUSTFS_BUILD_FEATURES=""
 ARG RC_RELEASE=latest
 
@@ -170,24 +169,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     ;; \
     esac
 
-# TARGETARCH is only provided by BuildKit. Fall back to TARGETPLATFORM (for
-# example set by docker-compose) and then to the build host, like the cargo
-# step above, so every path that builds this file passes a real architecture.
-RUN set -eu; \
-    rc_arch="${TARGETARCH:-}"; \
-    if [ -z "${rc_arch}" ]; then \
-    case "${TARGETPLATFORM:-}" in \
-    linux/amd64) rc_arch=amd64 ;; \
-    linux/arm64) rc_arch=arm64 ;; \
-    *) \
-    case "$(uname -m)" in \
-    x86_64) rc_arch=amd64 ;; \
-    aarch64|arm64) rc_arch=arm64 ;; \
-    *) echo "TARGETARCH is empty and TARGETPLATFORM='${TARGETPLATFORM:-}' is not linux/amd64 or linux/arm64; cannot choose an rc architecture on $(uname -m)" >&2; exit 1 ;; \
-    esac ;; \
-    esac; \
-    fi; \
-    sh /usr/src/rustfs/scripts/download_rc.sh "${rc_arch}" musl "${RC_RELEASE}" /usr/local/bin/rc
+RUN sh /usr/src/rustfs/scripts/download_rc.sh "$TARGETARCH" musl "$RC_RELEASE" /usr/local/bin/rc
 
 # -----------------------------
 # Development stage (keeps toolchain)

README.md

@@ -199,7 +199,7 @@ docker run -d --name rustfs -p 9000:9000 \
 Notes:
 - `RUSTFS_NOTIFY_ENABLE=true` enables the global notify module switch.
 - For ARN `arn:rustfs:sqs::primary:webhook`, use instance-scoped env vars with `_PRIMARY`.
-- If queue dir is omitted, the official image maps `/opt/rustfs/events` into the persistent `/data` volume so it is writable by the runtime user and pending events survive container recreation. Override `queue_dir` when using another deployment layout, or set `RUSTFS_TARGET_STORE_DIR` to move every default queue; native Windows defaults to `%ProgramData%\RustFS`. See [Target queue storage](docs/operations/target-queue-storage.md).
+- If queue dir is omitted, the official image maps `/opt/rustfs/events` into the persistent `/data` volume so it is writable by the runtime user and pending events survive container recreation. Override `queue_dir` when using another deployment layout.
 - `RUSTFS_NOTIFY_WEBHOOK_SKIP_TLS_VERIFY_PRIMARY` defaults to `false`; enabling it skips webhook TLS certificate verification, allows MITM attacks, and emits a startup warning. Prefer `RUSTFS_NOTIFY_WEBHOOK_CLIENT_CA_PRIMARY` for private CAs.
 - Since `1.0.0-beta.11`, webhook endpoints on private or container networks
   (`Docker Compose service names`, `host.docker.internal`, RFC 1918 addresses) are

crates/config/README.md

@@ -276,13 +276,6 @@ Drive timeout profile preset:
   - values must be positive; `0` or an invalid value falls back to the default, and values above `60` are clamped to `60`.
   - the setting is read by the aggregating node only; it does not change the internode RPC wire contract. Any retry shares one round deadline rather than receiving a fresh timeout.
 
-## Target queue directory
-
-- `RUSTFS_TARGET_STORE_DIR`
-  - absolute root for notify and audit target queues whose `queue_dir` is the default `/opt/rustfs/events` or `/opt/rustfs/audit`; they open `<root>/events` and `<root>/audit` on this node.
-  - unset keeps those paths on Linux and macOS; native Windows uses `%ProgramData%\RustFS\events` and `%ProgramData%\RustFS\audit`.
-  - explicit `queue_dir` values are never relocated, and the persisted target configuration is unchanged. Changing the root does not migrate pending entries. See `docs/operations/target-queue-storage.md`.
-
 ## Startup filesystem boundary policy
 
 - `RUSTFS_UNSUPPORTED_FS_POLICY` controls startup behavior when RustFS detects local endpoint filesystems that are outside the supported production boundary.

crates/config/src/constants/targets.rs

@@ -144,12 +144,6 @@ pub const POSTGRES_QUEUE_LIMIT: &str = "queue_limit";
 /// Applies to both notify and audit target queue stores.
 pub const ENV_TARGET_STORE_COMPRESS: &str = "RUSTFS_TARGET_STORE_COMPRESS";
 
-/// Environment variable that relocates the root of the default notify and audit queue directories.
-///
-/// It applies only to targets whose `queue_dir` is the logical default (`EVENT_DEFAULT_DIR` or
-/// `AUDIT_DEFAULT_DIR`); their queues move to `<root>/events` and `<root>/audit` on this node.
-pub const ENV_TARGET_STORE_DIR: &str = "RUSTFS_TARGET_STORE_DIR";
-
 /// Queue-store compression is enabled by default to reduce disk footprint.
 pub const DEFAULT_TARGET_STORE_COMPRESS: bool = true;
 

crates/config/src/observability/mod.rs

@@ -91,12 +91,7 @@ pub const ENV_OBS_LOG_MATCH_MODE: &str = "RUSTFS_OBS_LOG_MATCH_MODE";
 
 /// Default values for log cleanup
 pub const DEFAULT_OBS_LOG_MAX_TOTAL_SIZE_BYTES: u64 = 2 * 1024 * 1024 * 1024; // 2 GiB
-pub const DEFAULT_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES: u64 = 0; // No per-file trim by the cleaner
-/// Size at which the active log file is rolled when
-/// `RUSTFS_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES` is unset. Without a size roll
-/// the active file is bounded only by the rotation period, and the cleaner
-/// never touches the active file. An explicit `0` keeps size rolling off.
-pub const DEFAULT_OBS_LOG_ACTIVE_FILE_ROLL_SIZE_BYTES: u64 = 256 * 1024 * 1024; // 256 MiB
+pub const DEFAULT_OBS_LOG_MAX_SINGLE_FILE_SIZE_BYTES: u64 = 0; // No single file limit
 pub const DEFAULT_OBS_LOG_COMPRESS_OLD_FILES: bool = true;
 pub const DEFAULT_OBS_LOG_GZIP_COMPRESSION_LEVEL: u32 = 6;
 pub const DEFAULT_OBS_LOG_COMPRESSION_ALGORITHM_GZIP: &str = "gzip";

crates/e2e_test/README.md

@@ -29,7 +29,6 @@ Registered in [`src/lib.rs`](src/lib.rs). Grouped by concern:
 | **distributed 4×4** | [`src/distributed/`](src/distributed) | Nightly `e2e-distributed` lane: S3, object lock/WORM, versioning, bucket/site replication, quota, expand/decommission/rebalance, concurrency, chaos, 4-node upgrade of historical data and IAM AK/SK. Map: [`docs/testing/distributed-e2e.md`](../../docs/testing/distributed-e2e.md) |
 | **chaos / reliability** | [`src/chaos.rs`](src/chaos.rs), `reliability_disk_fault_test`, `heal_erasure_disk_rebuild_test`, `server_startup_failfast_test` | Disk offline/replace/corrupt, EC rebuild, heal, fail-fast startup |
 | **upgrade compatibility** | `upgrade_compatibility_test` | Pinned previous-release writes followed by current-build reads on the same data directory |
-| **dual-stack differential** | `dual_stack_differential` | Two single-node servers answer one SDK script for all 73 S3 operations and every differing `(op, field, a, b)` is reported. Side A is the binary under test on `RUSTFS_S3_STACK=legacy`; side B runs `RUSTFS_E2E_STACK_B`. Set `RUSTFS_E2E_REFERENCE_BINARY` to a released `rustfs` binary to make side A that binary instead (started without `RUSTFS_S3_STACK`, which older releases do not know). A missing, non-file or non-executable path fails the run; it never skips or falls back to the same-binary mode. The report in `<target>/dual-stack/<run>.json` records `reference_side` and each side's `--version` output |
 
 The external-tool `storage_metric_ownership_test` validates the OTLP/Collector/Prometheus path, including a rolling upgrade and node failures. See the [storage metrics guide](../../docs/operations/storage-metrics.md) for its required binaries and focused command.
 

crates/e2e_test/src/anonymous_access_test.rs

@@ -17,8 +17,7 @@
 //! when PublicAccessBlock configuration is missing or explicitly set.
 
 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
-use crate::sts_query_compat_test::{OPA_AUTH_TOKEN, OpaMock};
-use aws_sdk_s3::types::{PublicAccessBlockConfiguration, Tag, Tagging};
+use aws_sdk_s3::types::PublicAccessBlockConfiguration;
 use tracing::info;
 
 async fn setup_public_bucket(
@@ -70,110 +69,6 @@ async fn anonymous_get_object(
     local_http_client().get(&url).send().await
 }
 
-#[tokio::test]
-async fn test_plain_http_matches_secure_transport_false_bucket_policy() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-    assert!(env.url.starts_with("http://"), "fixture must exercise plaintext HTTP: {}", env.url);
-
-    let bucket = "secure-transport-policy";
-    let key = "plain-http.txt";
-    let admin = env.create_s3_client();
-    admin.create_bucket().bucket(bucket).send().await?;
-    admin
-        .put_object()
-        .bucket(bucket)
-        .key(key)
-        .body(aws_sdk_s3::primitives::ByteStream::from_static(b"plain http"))
-        .send()
-        .await?;
-    admin
-        .put_bucket_policy()
-        .bucket(bucket)
-        .policy(
-            serde_json::json!({
-                "Version": "2012-10-17",
-                "Statement": [{
-                    "Effect": "Allow",
-                    "Principal": "*",
-                    "Action": "s3:GetObject",
-                    "Resource": format!("arn:aws:s3:::{bucket}/*"),
-                    "Condition": {"Bool": {"aws:SecureTransport": "false"}}
-                }]
-            })
-            .to_string(),
-        )
-        .send()
-        .await?;
-
-    let response = anonymous_get_object(&env, bucket, key).await?;
-    assert_eq!(response.status().as_u16(), 200);
-    assert_eq!(response.bytes().await?.as_ref(), b"plain http");
-    Ok(())
-}
-
-/// Root credentials have no attached IAM policy, so these requests depend on
-/// the owner flag reaching policy evaluation unchanged.
-#[tokio::test]
-async fn test_root_requests_keep_policy_owner_flag() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let opa = OpaMock::start().await?;
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server_with_env(
-        vec![],
-        &[
-            ("RUSTFS_POLICY_PLUGIN_URL", opa.url.as_str()),
-            ("RUSTFS_POLICY_PLUGIN_AUTH_TOKEN", OPA_AUTH_TOKEN),
-        ],
-    )
-    .await?;
-
-    let bucket = "root-owner-flag";
-    let key = "owner.txt";
-    let client = env.create_s3_client();
-    client.create_bucket().bucket(bucket).send().await?;
-    client
-        .put_object()
-        .bucket(bucket)
-        .key(key)
-        .body(aws_sdk_s3::primitives::ByteStream::from_static(b"owner access"))
-        .send()
-        .await?;
-
-    // Duplicate tag keys are ambiguous, so PutBucketTagging rejects them
-    // before they can reach stored metadata or the OPA tag-loading path.
-    let duplicate = client
-        .put_bucket_tagging()
-        .bucket(bucket)
-        .tagging(
-            Tagging::builder()
-                .tag_set(Tag::builder().key("department").value("finance").build()?)
-                .tag_set(Tag::builder().key("department").value("engineering").build()?)
-                .build()?,
-        )
-        .send()
-        .await
-        .expect_err("duplicate bucket tag keys must be rejected");
-    assert_eq!(duplicate.into_service_error().meta().code(), Some("InvalidTag"));
-    client
-        .put_bucket_tagging()
-        .bucket(bucket)
-        .tagging(
-            Tagging::builder()
-                .tag_set(Tag::builder().key("department").value("finance").build()?)
-                .build()?,
-        )
-        .send()
-        .await?;
-    let object = client.get_object().bucket(bucket).key(key).send().await?;
-
-    assert_eq!(object.body.collect().await?.into_bytes().as_ref(), b"owner access");
-    Ok(())
-}
-
 /// Issue #2036: Anonymous GetObject should succeed when bucket policy allows it
 /// and no PublicAccessBlock configuration exists (ConfigNotFound).
 #[tokio::test]

crates/e2e_test/src/common.rs

@@ -774,18 +774,6 @@ impl RustFSTestEnvironment {
             .await
     }
 
-    /// Like [`Self::start_rustfs_server_from_binary`], but leaves other running RustFS processes
-    /// alone, so that two servers of different binaries can be alive at once.
-    pub async fn start_rustfs_server_from_binary_without_cleanup(
-        &mut self,
-        binary_path: &Path,
-        extra_args: Vec<&str>,
-        extra_env: &[(&str, &str)],
-    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-        self.start_rustfs_server_inner_with_binary(binary_path, extra_args, extra_env, false)
-            .await
-    }
-
     /// Start RustFS server with basic configuration
     pub async fn start_rustfs_server(&mut self, extra_args: Vec<&str>) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         self.start_rustfs_server_inner(extra_args, &[], true).await

crates/e2e_test/src/distributed/multipart_fence_acceptance_test.rs

@@ -1285,9 +1285,7 @@ async fn list_parts_disk_loss_after_metadata_read(
     let error = result.expect_err("one missing directory and three unavailable participants cannot prove an empty upload");
     let response = error.raw_response().expect("ListParts must return an S3 service response");
     assert_eq!(response.status().as_u16(), 503);
-    // Since #9149, SlowDownRead is reserved for GET/HEAD object reads; a
-    // ListParts read-quorum failure is reported as ServiceUnavailable.
-    assert_eq!(error.as_service_error().and_then(|err| err.meta().code()), Some("ServiceUnavailable"));
+    assert_eq!(error.as_service_error().and_then(|err| err.meta().code()), Some("SlowDownRead"));
     assert!(response.headers().get("x-rustfs-error-cause").is_none());
     assert!(response.headers().get("retry-after").is_none());
     assert!(

crates/e2e_test/src/distributed/replication_quota_test.rs

@@ -13,7 +13,7 @@
 // limitations under the License.
 
 use super::harness::{
-    DistCluster, DistLayout, TestResult, cluster_admin, enable_versioning, put_bucket_replication, put_object,
+    DistCluster, DistLayout, TestResult, cluster_admin_ok, enable_versioning, put_bucket_replication, put_object,
     quota_stats_current_usage, quota_stats_on_every_node, retrying_put, set_bucket_quota, set_remote_target, unique_bucket,
     wait_for_ready, wait_for_replicated_bytes, wait_until,
 };
@@ -119,7 +119,6 @@ async fn four_node_quota_changes_refresh_peers_before_response() -> TestResult {
     let native_path = format!("/rustfs/admin/v3/quota/{bucket}");
     let compat_set = format!("/rustfs/admin/v3/set-bucket-quota?bucket={bucket}");
     let compat_get = format!("/rustfs/admin/v3/get-bucket-quota?bucket={bucket}");
-    let complete_reload = serde_json::json!({"status": "complete", "unconfirmed_peers": []});
 
     // Warm every node's no-quota cache. The compatibility GET does not
     // depend on a scanner usage snapshot for this newly created bucket.
@@ -134,12 +133,7 @@ async fn four_node_quota_changes_refresh_peers_before_response() -> TestResult {
         )
         .await?;
         assert_eq!(status, StatusCode::OK, "{body}");
-        let response: serde_json::Value = serde_json::from_str(&body)?;
-        assert_eq!(response["quota"], 0);
-        assert!(
-            response.get("metadata_reload").is_none(),
-            "GET must not report a mutation outcome: {body}"
-        );
+        assert_eq!(serde_json::from_str::<serde_json::Value>(&body)?["quota"], 0);
     }
     wait_until(
         Duration::from_secs(30),
@@ -157,8 +151,6 @@ async fn four_node_quota_changes_refresh_peers_before_response() -> TestResult {
                 return Ok(false);
             }
             assert_eq!(status, StatusCode::OK, "{body}");
-            let response: serde_json::Value = serde_json::from_str(&body)?;
-            assert_eq!(response["metadata_reload"], complete_reload, "{body}");
             Ok(true)
         },
         "quota fleet capability ready",
@@ -188,14 +180,7 @@ async fn four_node_quota_changes_refresh_peers_before_response() -> TestResult {
         ),
     ] {
         if method != Method::GET {
-            let (status, body) = cluster_admin(&dist.cluster, method, path, payload.map(|value| value.to_string())).await?;
-            assert_eq!(status, StatusCode::OK, "{body}");
-            if path == compat_set {
-                assert!(body.is_empty(), "compatible quota mutations must preserve their empty response: {body}");
-            } else {
-                let response: serde_json::Value = serde_json::from_str(&body)?;
-                assert_eq!(response["metadata_reload"], complete_reload, "{body}");
-            }
+            cluster_admin_ok(&dist.cluster, method, path, payload.map(|value| value.to_string())).await?;
         }
         // No polling: a successful mutation waits for healthy peers to reload.
         for (index, node) in dist.cluster.nodes.iter().enumerate() {
@@ -209,11 +194,10 @@ async fn four_node_quota_changes_refresh_peers_before_response() -> TestResult {
             )
             .await?;
             assert_eq!(status, StatusCode::OK, "node {index}: {body}");
-            let response: serde_json::Value = serde_json::from_str(&body)?;
-            assert_eq!(response["quota"], expected.unwrap_or(0), "node {index} kept stale quota metadata",);
-            assert!(
-                response.get("metadata_reload").is_none(),
-                "GET must not report a mutation outcome: {body}"
+            assert_eq!(
+                serde_json::from_str::<serde_json::Value>(&body)?["quota"],
+                expected.unwrap_or(0),
+                "node {index} kept stale quota metadata",
             );
             if expected.is_some() {
                 let (status, body) = admin_request(
@@ -226,37 +210,21 @@ async fn four_node_quota_changes_refresh_peers_before_response() -> TestResult {
                 )
                 .await?;
                 assert_eq!(status, StatusCode::OK, "node {index}: {body}");
-                let response: serde_json::Value = serde_json::from_str(&body)?;
-                assert_eq!(response["quota"].as_u64(), expected);
-                assert!(
-                    response.get("metadata_reload").is_none(),
-                    "GET must not report a mutation outcome: {body}"
-                );
+                assert_eq!(serde_json::from_str::<serde_json::Value>(&body)?["quota"].as_u64(), expected);
             }
         }
     }
 
-    let (status, body) = cluster_admin(
+    cluster_admin_ok(
         &dist.cluster,
         Method::PUT,
         &native_path,
         Some(serde_json::json!({"quota": 8192, "quota_type": "HARD"}).to_string()),
     )
     .await?;
-    assert_eq!(status, StatusCode::OK, "{body}");
-    let response: serde_json::Value = serde_json::from_str(&body)?;
-    assert_eq!(response["metadata_reload"], complete_reload, "{body}");
-    let offline_host = dist.cluster.nodes[3].address.clone();
     dist.cluster.stop_node(3)?;
     // An unreachable peer cannot turn an already committed clear into a failure.
-    let (status, body) = cluster_admin(&dist.cluster, Method::DELETE, &native_path, None).await?;
-    assert_eq!(status, StatusCode::OK, "{body}");
-    let response: serde_json::Value = serde_json::from_str(&body)?;
-    assert_eq!(
-        response["metadata_reload"],
-        serde_json::json!({"status": "incomplete", "unconfirmed_peers": [offline_host]}),
-        "the response must identify exactly the peer that did not acknowledge the reload: {body}",
-    );
+    cluster_admin_ok(&dist.cluster, Method::DELETE, &native_path, None).await?;
     for node in dist.cluster.nodes.iter().take(3) {
         let (status, body) = admin_request(
             &node.url,
@@ -268,12 +236,7 @@ async fn four_node_quota_changes_refresh_peers_before_response() -> TestResult {
         )
         .await?;
         assert_eq!(status, StatusCode::OK, "{body}");
-        let response: serde_json::Value = serde_json::from_str(&body)?;
-        assert_eq!(response["quota"], 0);
-        assert!(
-            response.get("metadata_reload").is_none(),
-            "GET must not report a mutation outcome: {body}"
-        );
+        assert_eq!(serde_json::from_str::<serde_json::Value>(&body)?["quota"], 0);
     }
     Ok(())
 }

crates/e2e_test/src/distributed/upgrade_test.rs

@@ -493,12 +493,7 @@ async fn compare_degraded_legacy_list_parts(dist: &mut DistCluster, seed: &Upgra
     assert!(legacy.parts().is_empty());
     let current = current.expect_err("current coordinator must not infer empty from missing directories and offline disks");
     assert_eq!(current.raw_response().expect("current S3 response").status().as_u16(), 503);
-    // Since #9149, SlowDownRead is reserved for GET/HEAD object reads; a
-    // ListParts read-quorum failure is reported as ServiceUnavailable.
-    assert_eq!(
-        current.as_service_error().and_then(|error| error.meta().code()),
-        Some("ServiceUnavailable")
-    );
+    assert_eq!(current.as_service_error().and_then(|error| error.meta().code()), Some("SlowDownRead"));
     dist.cluster.start_node_from_binary(3, previous).await?;
     wait_for_upgrade_write_readiness(&clients, &seed.history_bucket, "mixed-list-restored", CREDENTIAL_TIMEOUT).await?;
     for (path, before) in original_files {

crates/e2e_test/src/dual_stack_differential/compare.rs

@@ -1,524 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! What one stack answered, and how two answers are compared.
-//!
-//! An [`Observation`] keeps only what a client acts on: the HTTP status, the S3 error code, the
-//! allowlisted response headers and a few typed fields decoded from the response. The error
-//! message is kept for diagnostics and never compared: message wording is judged by the wire
-//! corpus, not here. The comparator is pure so it can be tested without a server.
-
-use serde::Serialize;
-use std::collections::{BTreeMap, BTreeSet};
-use std::path::{Path, PathBuf};
-
-/// Response headers compared exactly (after [`normalized_header_value`]).
-const HEADER_ALLOWLIST: [&str; 7] = [
-    "content-type",
-    "x-amz-version-id",
-    "etag",
-    "x-amz-delete-marker",
-    "content-range",
-    "accept-ranges",
-    "x-amz-request-charged",
-];
-
-/// Every response header with this prefix is compared as well.
-const HEADER_ALLOWLIST_PREFIX: &str = "x-amz-server-side-encryption";
-
-/// Placeholder for a field one side did not send.
-const ABSENT: &str = "<absent>";
-
-/// The lowercase header name if the comparator looks at this header.
-pub(crate) fn compared_header(name: &str) -> Option<String> {
-    let name = name.to_ascii_lowercase();
-    (HEADER_ALLOWLIST.contains(&name.as_str()) || name.starts_with(HEADER_ALLOWLIST_PREFIX)).then_some(name)
-}
-
-/// A version ID is minted per process, so its value never matches across two servers; only
-/// whether it is the literal `null` (an unversioned write) carries meaning.
-fn normalized_header_value(name: &str, value: &str) -> String {
-    if name == "x-amz-version-id" && value != "null" {
-        "<version-id>".to_owned()
-    } else {
-        value.to_owned()
-    }
-}
-
-/// One request's outcome as a client sees it.
-#[derive(Clone, Debug, Serialize)]
-pub(crate) struct Observation {
-    /// The S3 operation, named as in the `s3s::S3` trait (`GetObject`).
-    pub op: &'static str,
-    /// Which request of the script this was (`normal`, `negative`, or a setup label).
-    pub case: &'static str,
-    /// HTTP status; 0 when no response arrived.
-    pub status: u16,
-    /// The S3 error code, or the SDK's error kind when there was no service error.
-    pub error_code: Option<String>,
-    /// Allowlisted headers only, lowercase names, normalized values.
-    pub headers: BTreeMap<String, String>,
-    /// Typed values decoded from the response body, never free text.
-    pub fields: BTreeMap<String, String>,
-    /// Diagnostic only; never compared.
-    #[serde(skip)]
-    pub message: Option<String>,
-}
-
-impl Observation {
-    /// Builds an observation, keeping only the allowlisted headers.
-    pub(crate) fn new<'h>(
-        op: &'static str,
-        case: &'static str,
-        status: u16,
-        error_code: Option<String>,
-        headers: impl IntoIterator<Item = (&'h str, &'h str)>,
-    ) -> Self {
-        let headers = headers
-            .into_iter()
-            .filter_map(|(name, value)| compared_header(name).map(|name| (name, value)))
-            .map(|(name, value)| {
-                let value = normalized_header_value(&name, value);
-                (name, value)
-            })
-            .collect();
-        Self {
-            op,
-            case,
-            status,
-            error_code,
-            headers,
-            fields: BTreeMap::new(),
-            message: None,
-        }
-    }
-
-    pub(crate) fn with_field(mut self, name: &str, value: impl Into<String>) -> Self {
-        self.fields.insert(name.to_owned(), value.into());
-        self
-    }
-
-    pub(crate) fn is_success(&self) -> bool {
-        (200..300).contains(&self.status)
-    }
-}
-
-/// One field on which the two stacks answered differently.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
-pub(crate) struct Difference {
-    pub op: String,
-    pub case: String,
-    pub field: String,
-    pub a: String,
-    pub b: String,
-}
-
-/// Every difference between two transcripts of the same script, matched by `(op, case)`.
-pub(crate) fn compare(a: &[Observation], b: &[Observation]) -> Vec<Difference> {
-    let mut differences = Vec::new();
-    let (index_a, duplicates_a) = index(a);
-    let (index_b, duplicates_b) = index(b);
-    for (op, case) in duplicates_a.union(&duplicates_b) {
-        let count = |side: &[Observation]| {
-            side.iter()
-                .filter(|observation| (observation.op, observation.case) == (*op, *case))
-                .count()
-                .to_string()
-        };
-        differences.push(difference(op, case, "duplicate_case", count(a), count(b)));
-    }
-    let keys: BTreeSet<_> = index_a.keys().chain(index_b.keys()).copied().collect();
-    for key @ (op, case) in keys {
-        match (index_a.get(&key), index_b.get(&key)) {
-            (Some(a), Some(b)) => compare_one(a, b, &mut differences),
-            (a, b) => {
-                let presence = |side: Option<&&Observation>| if side.is_some() { "present" } else { ABSENT }.to_owned();
-                differences.push(difference(op, case, "observation", presence(a), presence(b)));
-            }
-        }
-    }
-    differences
-}
-
-type Key = (&'static str, &'static str);
-
-fn index(side: &[Observation]) -> (BTreeMap<Key, &Observation>, BTreeSet<Key>) {
-    let mut index = BTreeMap::new();
-    let mut duplicates = BTreeSet::new();
-    for observation in side {
-        let key = (observation.op, observation.case);
-        if index.insert(key, observation).is_some() {
-            duplicates.insert(key);
-        }
-    }
-    (index, duplicates)
-}
-
-fn difference(op: &str, case: &str, field: &str, a: String, b: String) -> Difference {
-    Difference {
-        op: op.to_owned(),
-        case: case.to_owned(),
-        field: field.to_owned(),
-        a,
-        b,
-    }
-}
-
-fn compare_one(a: &Observation, b: &Observation, differences: &mut Vec<Difference>) {
-    let mut field = |name: String, value_a: Option<&str>, value_b: Option<&str>| {
-        if value_a != value_b {
-            let show = |value: Option<&str>| value.unwrap_or(ABSENT).to_owned();
-            differences.push(difference(a.op, a.case, &name, show(value_a), show(value_b)));
-        }
-    };
-    field(
-        "status".to_owned(),
-        Some(a.status.to_string().as_str()),
-        Some(b.status.to_string().as_str()),
-    );
-    field("error_code".to_owned(), a.error_code.as_deref(), b.error_code.as_deref());
-    let headers: BTreeSet<_> = a.headers.keys().chain(b.headers.keys()).collect();
-    for name in headers {
-        field(
-            format!("header.{name}"),
-            a.headers.get(name).map(String::as_str),
-            b.headers.get(name).map(String::as_str),
-        );
-    }
-    let fields: BTreeSet<_> = a.fields.keys().chain(b.fields.keys()).collect();
-    for name in fields {
-        field(
-            format!("body.{name}"),
-            a.fields.get(name).map(String::as_str),
-            b.fields.get(name).map(String::as_str),
-        );
-    }
-}
-
-/// Operations observed on both sides.
-pub(crate) fn compared_ops(a: &[Observation], b: &[Observation]) -> BTreeSet<&'static str> {
-    let ops_b: BTreeSet<_> = b.iter().map(|observation| observation.op).collect();
-    a.iter()
-        .map(|observation| observation.op)
-        .filter(|op| ops_b.contains(op))
-        .collect()
-}
-
-/// `(op, case)` pairs observed on both sides.
-pub(crate) fn compared_cases(a: &[Observation], b: &[Observation]) -> usize {
-    let cases_b: BTreeSet<_> = b.iter().map(|observation| (observation.op, observation.case)).collect();
-    a.iter()
-        .map(|observation| (observation.op, observation.case))
-        .collect::<BTreeSet<_>>()
-        .intersection(&cases_b)
-        .count()
-}
-
-/// The JSON report written for every run.
-#[derive(Debug, Serialize)]
-pub(crate) struct Report {
-    pub schema: u32,
-    pub run: String,
-    pub stack_a: String,
-    pub stack_b: String,
-    /// Which side is the pinned release binary: `"a"`, or `None` when both sides are the binary
-    /// under test.
-    pub reference_side: Option<&'static str>,
-    /// `--version` output of the binary each side actually ran.
-    pub version_a: String,
-    pub version_b: String,
-    pub region_a: Option<String>,
-    pub region_b: Option<String>,
-    pub compared_ops: usize,
-    pub compared_cases: usize,
-    pub differences: Vec<Difference>,
-}
-
-impl Report {
-    /// Writes the report as `<directory>/<run>.json` and returns its path.
-    pub(crate) fn write_to(&self, directory: &Path) -> std::io::Result<PathBuf> {
-        std::fs::create_dir_all(directory)?;
-        let path = directory.join(format!("{}.json", self.run));
-        let json = serde_json::to_vec_pretty(self).map_err(std::io::Error::other)?;
-        std::fs::write(&path, json)?;
-        Ok(path)
-    }
-}
-
-/// One line per difference, for a failing assertion.
-pub(crate) fn render(differences: &[Difference]) -> String {
-    differences
-        .iter()
-        .map(|d| format!("({}, {}, {}, a={:?}, b={:?})", d.op, d.case, d.field, d.a, d.b))
-        .collect::<Vec<_>>()
-        .join("\n")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn ok(op: &'static str) -> Observation {
-        Observation::new(op, "normal", 200, None, [("content-type", "application/xml")])
-    }
-
-    fn fields(differences: &[Difference]) -> Vec<&str> {
-        differences.iter().map(|d| d.field.as_str()).collect()
-    }
-
-    #[test]
-    fn identical_transcripts_have_no_difference() {
-        let a = vec![
-            ok("HeadBucket"),
-            ok("GetBucketLocation").with_field("location_constraint", "us-east-1"),
-        ];
-        let b = a.clone();
-        assert_eq!(compare(&a, &b), Vec::new());
-        assert_eq!(compared_ops(&a, &b).len(), 2);
-    }
-
-    #[test]
-    fn a_status_difference_is_reported() {
-        let a = vec![ok("PutBucketAcl")];
-        let b = vec![Observation::new(
-            "PutBucketAcl",
-            "normal",
-            403,
-            None,
-            [("content-type", "application/xml")],
-        )];
-        assert_eq!(
-            compare(&a, &b),
-            vec![Difference {
-                op: "PutBucketAcl".into(),
-                case: "normal".into(),
-                field: "status".into(),
-                a: "200".into(),
-                b: "403".into(),
-            }]
-        );
-    }
-
-    #[test]
-    fn an_error_code_difference_is_reported() {
-        let a = vec![Observation::new("GetObject", "negative", 404, Some("NoSuchKey".into()), [])];
-        let b = vec![Observation::new(
-            "GetObject",
-            "negative",
-            404,
-            Some("NoSuchBucket".into()),
-            [],
-        )];
-        let differences = compare(&a, &b);
-        assert_eq!(fields(&differences), ["error_code"]);
-        assert_eq!((differences[0].a.as_str(), differences[0].b.as_str()), ("NoSuchKey", "NoSuchBucket"));
-    }
-
-    #[test]
-    fn an_error_code_on_one_side_only_is_reported() {
-        let a = vec![Observation::new("HeadBucket", "negative", 404, Some("NotFound".into()), [])];
-        let b = vec![Observation::new("HeadBucket", "negative", 404, None, [])];
-        let differences = compare(&a, &b);
-        assert_eq!(fields(&differences), ["error_code"]);
-        assert_eq!(differences[0].b, ABSENT);
-    }
-
-    #[test]
-    fn an_allowlisted_header_difference_is_reported() {
-        let a = vec![Observation::new("HeadObject", "normal", 200, None, [("ETag", "\"aa\"")])];
-        let b = vec![Observation::new("HeadObject", "normal", 200, None, [("etag", "\"bb\"")])];
-        assert_eq!(fields(&compare(&a, &b)), ["header.etag"]);
-    }
-
-    #[test]
-    fn a_header_sent_by_one_side_only_is_reported() {
-        let a = vec![Observation::new(
-            "DeleteObject",
-            "normal",
-            204,
-            None,
-            [("x-amz-delete-marker", "true")],
-        )];
-        let b = vec![Observation::new("DeleteObject", "normal", 204, None, [])];
-        let differences = compare(&a, &b);
-        assert_eq!(fields(&differences), ["header.x-amz-delete-marker"]);
-        assert_eq!((differences[0].a.as_str(), differences[0].b.as_str()), ("true", ABSENT));
-    }
-
-    #[test]
-    fn every_server_side_encryption_header_is_compared() {
-        let header = "x-amz-server-side-encryption-customer-key-md5";
-        let a = vec![Observation::new("PutObject", "sse-c", 200, None, [(header, "one")])];
-        let b = vec![Observation::new("PutObject", "sse-c", 200, None, [(header, "two")])];
-        assert_eq!(fields(&compare(&a, &b)), [format!("header.{header}")]);
-    }
-
-    #[test]
-    fn headers_outside_the_allowlist_are_not_compared() {
-        let a = vec![Observation::new(
-            "ListBuckets",
-            "normal",
-            200,
-            None,
-            [
-                ("date", "Mon"),
-                ("x-amz-request-id", "1"),
-                ("server", "a"),
-                ("content-length", "10"),
-            ],
-        )];
-        let b = vec![Observation::new(
-            "ListBuckets",
-            "normal",
-            200,
-            None,
-            [
-                ("date", "Tue"),
-                ("x-amz-request-id", "2"),
-                ("server", "b"),
-                ("content-length", "11"),
-            ],
-        )];
-        assert_eq!(compare(&a, &b), Vec::new());
-        assert!(a[0].headers.is_empty(), "non-allowlisted headers were kept: {:?}", a[0].headers);
-    }
-
-    #[test]
-    fn distinct_version_ids_are_not_a_difference() {
-        let a = vec![Observation::new(
-            "PutObject",
-            "normal",
-            200,
-            None,
-            [("x-amz-version-id", "0b1c")],
-        )];
-        let b = vec![Observation::new(
-            "PutObject",
-            "normal",
-            200,
-            None,
-            [("x-amz-version-id", "9f8e")],
-        )];
-        assert_eq!(compare(&a, &b), Vec::new());
-    }
-
-    #[test]
-    fn a_null_version_id_against_a_real_one_is_reported() {
-        let a = vec![Observation::new(
-            "PutObject",
-            "normal",
-            200,
-            None,
-            [("x-amz-version-id", "null")],
-        )];
-        let b = vec![Observation::new(
-            "PutObject",
-            "normal",
-            200,
-            None,
-            [("x-amz-version-id", "9f8e")],
-        )];
-        assert_eq!(fields(&compare(&a, &b)), ["header.x-amz-version-id"]);
-    }
-
-    #[test]
-    fn a_body_field_difference_is_reported() {
-        let a = vec![ok("GetBucketLocation").with_field("location_constraint", "us-east-1")];
-        let b = vec![ok("GetBucketLocation").with_field("location_constraint", "eu-west-1")];
-        let differences = compare(&a, &b);
-        assert_eq!(fields(&differences), ["body.location_constraint"]);
-        assert_eq!((differences[0].a.as_str(), differences[0].b.as_str()), ("us-east-1", "eu-west-1"));
-    }
-
-    #[test]
-    fn a_body_field_on_one_side_only_is_reported() {
-        let a = vec![ok("ListObjectsV2").with_field("keys", "[]")];
-        let b = vec![ok("ListObjectsV2")];
-        assert_eq!(fields(&compare(&a, &b)), ["body.keys"]);
-    }
-
-    #[test]
-    fn error_messages_are_never_compared() {
-        let mut a = Observation::new("GetObject", "negative", 404, Some("NoSuchKey".into()), []);
-        let mut b = a.clone();
-        a.message = Some("The specified key does not exist.".into());
-        b.message = Some("Object not found".into());
-        assert_eq!(compare(&[a], &[b]), Vec::new());
-    }
-
-    #[test]
-    fn a_case_observed_on_one_side_only_is_reported() {
-        let a = vec![ok("HeadBucket"), ok("ListBuckets")];
-        let b = vec![ok("HeadBucket")];
-        let differences = compare(&a, &b);
-        assert_eq!(fields(&differences), ["observation"]);
-        assert_eq!(differences[0].op, "ListBuckets");
-        assert_eq!(compared_ops(&a, &b).into_iter().collect::<Vec<_>>(), ["HeadBucket"]);
-    }
-
-    #[test]
-    fn a_case_recorded_twice_is_reported() {
-        let a = vec![ok("HeadBucket"), ok("HeadBucket")];
-        let b = vec![ok("HeadBucket")];
-        assert_eq!(fields(&compare(&a, &b)), ["duplicate_case"]);
-    }
-
-    #[test]
-    fn compared_ops_counts_operations_not_cases() {
-        let negative = Observation::new("HeadBucket", "negative", 404, Some("NotFound".into()), []);
-        let a = vec![ok("HeadBucket"), negative, ok("ListBuckets")];
-        let b = a.clone();
-        assert_eq!(compared_ops(&a, &b).len(), 2);
-    }
-
-    #[test]
-    fn the_report_lists_each_difference_as_op_field_a_b() {
-        let directory = std::env::temp_dir().join(format!("dual-stack-report-{}", uuid::Uuid::new_v4()));
-        let report = Report {
-            schema: 2,
-            run: "unit".into(),
-            stack_a: "legacy".into(),
-            stack_b: "legacy".into(),
-            reference_side: Some("a"),
-            version_a: "rustfs 1.0.4".into(),
-            version_b: "rustfs 1.1.0".into(),
-            region_a: None,
-            region_b: Some("eu-west-1".into()),
-            compared_ops: 1,
-            compared_cases: 1,
-            differences: compare(
-                &[ok("GetBucketLocation").with_field("location_constraint", "us-east-1")],
-                &[ok("GetBucketLocation").with_field("location_constraint", "eu-west-1")],
-            ),
-        };
-        let path = report.write_to(&directory).expect("write the report");
-        let json: serde_json::Value = serde_json::from_slice(&std::fs::read(&path).expect("read the report")).expect("parse");
-        let _ = std::fs::remove_dir_all(&directory);
-        assert_eq!(path.file_name().and_then(|name| name.to_str()), Some("unit.json"));
-        assert_eq!(json["compared_ops"], 1);
-        assert_eq!(json["reference_side"], "a");
-        assert_eq!(json["version_a"], "rustfs 1.0.4");
-        assert_eq!(json["version_b"], "rustfs 1.1.0");
-        assert_eq!(
-            json["differences"],
-            serde_json::json!([{
-                "op": "GetBucketLocation",
-                "case": "normal",
-                "field": "body.location_constraint",
-                "a": "us-east-1",
-                "b": "eu-west-1",
-            }])
-        );
-    }
-}

crates/e2e_test/src/dual_stack_differential/mod.rs

@@ -1,257 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Dual-stack differential: one `rustfs` binary, two processes, one SDK script (rustfs/backlog#2740).
-//!
-//! Stack A runs `RUSTFS_S3_STACK=legacy` of the binary under test, unless `RUSTFS_E2E_REFERENCE_BINARY`
-//! names a released binary: then A is that binary, started without `RUSTFS_S3_STACK` (older
-//! releases do not know it), and a bad path fails the run instead of falling back (see
-//! `reference`). The report names which side is the reference and the `--version` each side ran. Stack B runs the value of `RUSTFS_E2E_STACK_B`
-//! (default `legacy` until the gateway stack is assembled), and `RUSTFS_E2E_STACK_B_REGION`, when
-//! set, starts B in another region so that a difference can be injected by hand. Both servers
-//! answer the script in `scenarios`, which covers every operation of `impl S3 for FS`; `compare`
-//! reports each `(op, field, a, b)` on which the answers differ, and every run writes its report
-//! to `<target>/dual-stack/<run>.json`. Two processes, not two embedded servers: bucket metadata
-//! is process-global, so two stacks in one process would read each other's buckets.
-
-mod compare;
-mod reference;
-mod scenarios;
-
-use crate::common::{RustFSTestEnvironment, init_logging, rustfs_binary_path, workspace_root};
-use compare::{Difference, Observation, Report, compare, compared_cases, compared_ops, render};
-use reference::{SideA, binary_version};
-use std::path::{Path, PathBuf};
-use std::time::{SystemTime, UNIX_EPOCH};
-
-type BoxError = Box<dyn std::error::Error + Send + Sync>;
-
-const STACK_A: &str = "legacy";
-/// Label of side A in the report when it is the released reference binary.
-const STACK_A_REFERENCE: &str = "reference";
-const ENV_STACK_B: &str = "RUSTFS_E2E_STACK_B";
-const ENV_STACK_B_REGION: &str = "RUSTFS_E2E_STACK_B_REGION";
-/// Becomes `gateway` once rustfs/backlog#2734 T2.5 assembles the gateway stack.
-const DEFAULT_STACK_B: &str = "legacy";
-/// The region the negative control gives stack A explicitly, so an inherited `RUSTFS_REGION`
-/// cannot erase the injected difference. Not `us-east-1`: that region answers GetBucketLocation
-/// with an empty LocationConstraint and re-creating an owned bucket with 200, so it would not
-/// report its own name and would add CreateBucket differences to the control.
-const CONTROL_REGION_A: &str = "us-west-2";
-const CONTROL_REGION_B: &str = "eu-west-1";
-/// `normal` cases the legacy stack must answer with a 2xx. The comparison alone cannot tell a
-/// script that exercises real behavior from one in which both stacks fail the same way. Five of
-/// the 73 fail on legacy by design of this script: PutBucketReplication (no registered remote
-/// target), GetBucketReplication (so no configuration), PutBucketNotificationConfiguration (no
-/// notification target configured), RestoreObject (the object is not archived) and
-/// GetObjectTorrent (legacy answers `NoSuchKey`).
-const MIN_NORMAL_SUCCESSES: usize = 68;
-
-struct PairConfig {
-    side_a: SideA,
-    stack_b: String,
-    region_a: Option<String>,
-    region_b: Option<String>,
-}
-
-impl PairConfig {
-    fn from_env() -> Result<Self, BoxError> {
-        Ok(Self {
-            side_a: SideA::from_env()?,
-            stack_b: std::env::var(ENV_STACK_B).unwrap_or_else(|_| DEFAULT_STACK_B.to_owned()),
-            region_a: None,
-            region_b: std::env::var(ENV_STACK_B_REGION).ok(),
-        })
-    }
-
-    fn stack_a_label(&self) -> &'static str {
-        match self.side_a {
-            SideA::SameBinary => STACK_A,
-            SideA::Reference(_) => STACK_A_REFERENCE,
-        }
-    }
-}
-
-/// Starts one server of the binary under test on `stack`, overriding its region only when asked.
-async fn start_stack(stack: &str, region: Option<&str>) -> Result<RustFSTestEnvironment, BoxError> {
-    let mut env = RustFSTestEnvironment::new().await?;
-    let mut vars = vec![("RUSTFS_S3_STACK", stack)];
-    if let Some(region) = region {
-        vars.push(("RUSTFS_REGION", region));
-    }
-    env.start_rustfs_server_without_cleanup_with_env(&vars).await?;
-    Ok(env)
-}
-
-/// Starts one server of a released binary. `RUSTFS_S3_STACK` is not passed: older releases do not
-/// know it and have exactly one stack.
-async fn start_reference(binary: &Path, region: Option<&str>) -> Result<RustFSTestEnvironment, BoxError> {
-    let mut env = RustFSTestEnvironment::new().await?;
-    let mut vars = Vec::new();
-    if let Some(region) = region {
-        vars.push(("RUSTFS_REGION", region));
-    }
-    env.start_rustfs_server_from_binary_without_cleanup(binary, vec![], &vars)
-        .await?;
-    Ok(env)
-}
-
-/// Starts stack A and stack B side by side, each with its own port and data directory.
-async fn spawn_pair(config: &PairConfig) -> Result<(RustFSTestEnvironment, RustFSTestEnvironment), BoxError> {
-    let side_a = async {
-        match &config.side_a {
-            SideA::SameBinary => start_stack(STACK_A, config.region_a.as_deref()).await,
-            SideA::Reference(binary) => start_reference(binary, config.region_a.as_deref()).await,
-        }
-    };
-    tokio::try_join!(side_a, start_stack(&config.stack_b, config.region_b.as_deref()))
-}
-
-fn report_directory() -> PathBuf {
-    let target = std::env::var_os("CARGO_TARGET_DIR").map_or_else(|| PathBuf::from("target"), PathBuf::from);
-    let target = if target.is_absolute() {
-        target
-    } else {
-        workspace_root().join(target)
-    };
-    target.join("dual-stack")
-}
-
-struct Run {
-    report: Report,
-    path: PathBuf,
-    a: Vec<Observation>,
-}
-
-/// Runs the script against both stacks concurrently and writes the report.
-async fn run_differential(label: &str, config: &PairConfig) -> Run {
-    let binary_under_test = rustfs_binary_path();
-    let (version_a, version_b) = match &config.side_a {
-        SideA::SameBinary => {
-            let version = binary_version(&binary_under_test)
-                .await
-                .expect("capture the binary under test version");
-            (version.clone(), version)
-        }
-        SideA::Reference(binary) => (
-            binary_version(binary).await.expect("capture the reference binary version"),
-            binary_version(&binary_under_test)
-                .await
-                .expect("capture the binary under test version"),
-        ),
-    };
-    let (server_a, server_b) = spawn_pair(config).await.expect("start stack A and stack B");
-    let (a, b) = tokio::join!(Box::pin(scenarios::run(&server_a)), Box::pin(scenarios::run(&server_b)));
-    let millis = SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map_or(0, |elapsed| elapsed.as_millis());
-    let report = Report {
-        schema: 2,
-        run: format!("{label}-{millis}-{}", std::process::id()),
-        stack_a: config.stack_a_label().to_owned(),
-        stack_b: config.stack_b.clone(),
-        reference_side: matches!(config.side_a, SideA::Reference(_)).then_some("a"),
-        version_a,
-        version_b,
-        region_a: config.region_a.clone(),
-        region_b: config.region_b.clone(),
-        compared_ops: compared_ops(&a, &b).len(),
-        compared_cases: compared_cases(&a, &b),
-        differences: compare(&a, &b),
-    };
-    let path = report.write_to(&report_directory()).expect("write the dual-stack report");
-    Run { report, path, a }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[tokio::test]
-    async fn both_stacks_answer_every_operation_identically() {
-        init_logging();
-        let config = PairConfig::from_env().expect("RUSTFS_E2E_REFERENCE_BINARY must be valid when set");
-        let run = run_differential("self-comparison", &config).await;
-        let report = &run.report;
-
-        let mut observed: Vec<_> = run.a.iter().map(|observation| observation.op).collect();
-        observed.sort_unstable();
-        observed.dedup();
-        assert_eq!(
-            observed,
-            scenarios::OPERATIONS,
-            "the script must drive exactly the operations of impl S3 for FS"
-        );
-        assert_eq!(report.compared_ops, scenarios::OPERATIONS.len(), "report: {}", run.path.display());
-        assert!(
-            report.differences.is_empty(),
-            "stack {} ({}) and stack {} ({}) differ on {} of {} cases (report: {}):\n{}",
-            report.stack_a,
-            report.version_a,
-            report.stack_b,
-            report.version_b,
-            report.differences.len(),
-            report.compared_cases,
-            run.path.display(),
-            render(&report.differences)
-        );
-
-        let not_4xx: Vec<_> = run
-            .a
-            .iter()
-            .filter(|observation| observation.case == "negative" && !(400..500).contains(&observation.status))
-            .collect();
-        assert!(
-            not_4xx.is_empty(),
-            "negative cases must fail with a 4xx on side A ({}): {not_4xx:#?}",
-            report.version_a
-        );
-        let successes = run
-            .a
-            .iter()
-            .filter(|observation| observation.case == "normal" && observation.is_success())
-            .count();
-        assert!(
-            successes >= MIN_NORMAL_SUCCESSES,
-            "only {successes} normal cases succeeded on side A ({}): {:#?}",
-            report.version_a,
-            run.a
-        );
-    }
-
-    #[tokio::test]
-    async fn differential_detects_an_injected_difference() {
-        init_logging();
-        let config = PairConfig {
-            side_a: SideA::SameBinary,
-            stack_b: STACK_A.to_owned(),
-            region_a: Some(CONTROL_REGION_A.to_owned()),
-            region_b: Some(CONTROL_REGION_B.to_owned()),
-        };
-        let run = run_differential("injected-region", &config).await;
-        let expected = Difference {
-            op: "GetBucketLocation".to_owned(),
-            case: "normal".to_owned(),
-            field: "body.location_constraint".to_owned(),
-            a: CONTROL_REGION_A.to_owned(),
-            b: CONTROL_REGION_B.to_owned(),
-        };
-        assert!(
-            run.report.differences.contains(&expected),
-            "B started in {CONTROL_REGION_B} but GetBucketLocation was not reported (report: {}):\n{}",
-            run.path.display(),
-            render(&run.report.differences)
-        );
-    }
-}

crates/e2e_test/src/dual_stack_differential/reference.rs

@@ -1,163 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Which binary side A of the differential runs, and what it reports about itself.
-//!
-//! `RUSTFS_E2E_REFERENCE_BINARY` names a released `rustfs` binary to use as the reference. Unset,
-//! side A is the binary under test on `RUSTFS_S3_STACK=legacy`. Set, it must resolve to an
-//! executable file or the run fails: a reference that was asked for and silently replaced by the
-//! binary under test would report an agreement with itself as agreement with the release.
-
-use std::ffi::OsString;
-use std::path::{Path, PathBuf};
-
-type BoxError = Box<dyn std::error::Error + Send + Sync>;
-
-pub(super) const ENV_REFERENCE_BINARY: &str = "RUSTFS_E2E_REFERENCE_BINARY";
-
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub(super) enum SideA {
-    /// Both sides are the binary under test; A runs `RUSTFS_S3_STACK=legacy`.
-    SameBinary,
-    /// A is this released binary, started without `RUSTFS_S3_STACK`.
-    Reference(PathBuf),
-}
-
-impl SideA {
-    pub(super) fn from_env() -> Result<Self, BoxError> {
-        Self::resolve(std::env::var_os(ENV_REFERENCE_BINARY))
-    }
-
-    /// `None` is the only value that selects same-binary mode; every other value must validate.
-    pub(super) fn resolve(value: Option<OsString>) -> Result<Self, BoxError> {
-        let Some(value) = value else {
-            return Ok(Self::SameBinary);
-        };
-        let path = PathBuf::from(value);
-        validate_executable(&path)?;
-        Ok(Self::Reference(path))
-    }
-}
-
-fn validate_executable(path: &Path) -> Result<(), BoxError> {
-    if path.as_os_str().is_empty() {
-        return Err(format!("{ENV_REFERENCE_BINARY} is set but empty").into());
-    }
-    let metadata = std::fs::metadata(path)
-        .map_err(|error| format!("{ENV_REFERENCE_BINARY} points to {}, which cannot be read: {error}", path.display()))?;
-    if !metadata.is_file() {
-        return Err(format!("{ENV_REFERENCE_BINARY} points to {}, which is not a file", path.display()).into());
-    }
-    if !is_executable(&metadata) {
-        return Err(format!("{ENV_REFERENCE_BINARY} points to {}, which is not executable", path.display()).into());
-    }
-    Ok(())
-}
-
-#[cfg(unix)]
-fn is_executable(metadata: &std::fs::Metadata) -> bool {
-    use std::os::unix::fs::PermissionsExt;
-    metadata.permissions().mode() & 0o111 != 0
-}
-
-#[cfg(not(unix))]
-fn is_executable(_metadata: &std::fs::Metadata) -> bool {
-    true
-}
-
-/// What `<binary> --version` printed, trimmed. Fails when the binary does not run, exits
-/// non-zero, or prints nothing, because an empty version would report nothing as observed.
-pub(super) async fn binary_version(binary: &Path) -> Result<String, BoxError> {
-    let output = tokio::process::Command::new(binary).arg("--version").output().await?;
-    if !output.status.success() {
-        return Err(format!("{} --version failed with {}", binary.display(), output.status).into());
-    }
-    let version = String::from_utf8_lossy(&output.stdout).trim().to_owned();
-    if version.is_empty() {
-        return Err(format!("{} --version printed nothing", binary.display()).into());
-    }
-    Ok(version)
-}
-
-#[cfg(all(test, unix))]
-mod tests {
-    use super::*;
-    use std::os::unix::fs::PermissionsExt;
-
-    fn script(dir: &Path, name: &str, body: &str, mode: u32) -> PathBuf {
-        let path = dir.join(name);
-        std::fs::write(&path, body).expect("write the stand-in");
-        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(mode)).expect("chmod");
-        path
-    }
-
-    #[test]
-    fn missing_path_is_an_error_not_a_fallback() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let error = SideA::resolve(Some(dir.path().join("absent").into_os_string())).expect_err("must fail closed");
-        assert!(error.to_string().contains("cannot be read"), "{error}");
-    }
-
-    #[test]
-    fn non_executable_file_is_an_error() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = script(dir.path(), "rustfs", "#!/bin/sh\necho v\n", 0o644);
-        let error = SideA::resolve(Some(path.into_os_string())).expect_err("must fail closed");
-        assert!(error.to_string().contains("not executable"), "{error}");
-    }
-
-    #[test]
-    fn directory_is_an_error() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let error = SideA::resolve(Some(dir.path().as_os_str().to_owned())).expect_err("must fail closed");
-        assert!(error.to_string().contains("not a file"), "{error}");
-    }
-
-    #[test]
-    fn empty_value_is_an_error() {
-        let error = SideA::resolve(Some(OsString::new())).expect_err("must fail closed");
-        assert!(error.to_string().contains("empty"), "{error}");
-    }
-
-    #[test]
-    fn unset_selects_same_binary_mode() {
-        assert_eq!(SideA::resolve(None).expect("unset is valid"), SideA::SameBinary);
-    }
-
-    #[test]
-    fn executable_file_selects_reference_mode() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = script(dir.path(), "rustfs", "#!/bin/sh\necho v\n", 0o755);
-        assert_eq!(
-            SideA::resolve(Some(path.clone().into_os_string())).expect("valid"),
-            SideA::Reference(path)
-        );
-    }
-
-    #[tokio::test]
-    async fn version_output_is_captured_from_the_binary() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = script(dir.path(), "rustfs", "#!/bin/sh\necho 'rustfs 1.0.4 (abc123)'\n", 0o755);
-        assert_eq!(binary_version(&path).await.expect("version"), "rustfs 1.0.4 (abc123)");
-    }
-
-    #[tokio::test]
-    async fn failing_or_silent_version_is_an_error() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let failing = script(dir.path(), "failing", "#!/bin/sh\nexit 3\n", 0o755);
-        assert!(binary_version(&failing).await.is_err());
-        let silent = script(dir.path(), "silent", "#!/bin/sh\nexit 0\n", 0o755);
-        assert!(binary_version(&silent).await.is_err());
-    }
-}

crates/e2e_test/src/kms/kms_fault_recovery_test.rs

@@ -586,18 +586,7 @@ async fn test_reads_under_a_deleted_kms_key_report_key_not_found() -> Result<(),
         .await?;
     assert_eq!(put.ssekms_key_id(), Some(doomed_key_id.as_str()));
 
-    // Destruction is two requests: schedule the deletion, then destroy the
-    // pending key without waiting out its window.
-    info!("🗑️ scheduling {doomed_key_id} for deletion, then destroying it");
-    kms_admin_request(
-        &base.url,
-        http::Method::DELETE,
-        "/rustfs/admin/v3/kms/keys/delete",
-        Some(&serde_json::json!({ "key_id": doomed_key_id }).to_string()),
-        &base.access_key,
-        &base.secret_key,
-    )
-    .await?;
+    info!("🗑️ deleting {doomed_key_id} immediately");
     kms_admin_request(
         &base.url,
         http::Method::DELETE,

crates/e2e_test/src/lib.rs

@@ -31,12 +31,6 @@ pub mod chaos;
 #[cfg(test)]
 pub mod fake_s3_target;
 
-// Dual-stack differential (rustfs/backlog#2740): one binary, two processes on
-// different RUSTFS_S3_STACK values, the same SDK script for every S3 operation,
-// compared on status, error code, allowlisted headers and typed body fields.
-#[cfg(test)]
-mod dual_stack_differential;
-
 // On-demand migration (backlog#2147): shared two-server environment, admin
 // wrappers, and the harness self-test (backlog#2151). Behavior scenarios are
 // added by later ODM tasks.

crates/e2e_test/src/protocols/webdav_core.rs

@@ -32,9 +32,7 @@
 //! Advisory: <https://github.com/rustfs/rustfs/security/advisories/GHSA-3p3x-734c-h5vx>
 
 use crate::common::rustfs_binary_path_with_features;
-use crate::common::{
-    AdminTransport, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via, signed_s3_request,
-};
+use crate::common::{AdminTransport, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via};
 use crate::common::{FAST_DATA_USAGE_SCANNER_ENV, admin_request};
 use crate::protocols::test_env::{DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY, ProtocolTestEnvironment};
 use anyhow::Result;
@@ -776,81 +774,6 @@ async fn test_webdav_core_operations_direct() -> Result<()> {
     test_webdav_core_operations().await
 }
 
-#[tokio::test]
-async fn test_webdav_content_type_directory_marker() -> Result<()> {
-    let env = ProtocolTestEnvironment::new().map_err(|e| anyhow::anyhow!("{}", e))?;
-    let admin_base_url = format!("http://{}", S3_TEST_ADDRESS);
-    let binary_path = rustfs_binary_path_with_features(Some("webdav"));
-    let mut server_process = Command::new(&binary_path)
-        .arg("--address")
-        .arg(S3_TEST_ADDRESS)
-        .env("RUSTFS_CONSOLE_ENABLE", "false")
-        .env("RUSTFS_WEBDAV_ENABLE", "true")
-        .env("RUSTFS_WEBDAV_ADDRESS", WEBDAV_ADDRESS)
-        .env("RUSTFS_WEBDAV_TLS_ENABLED", "false")
-        .arg(&env.temp_dir)
-        .spawn()?;
-
-    let result = async {
-        ProtocolTestEnvironment::wait_for_port_ready(WEBDAV_PORT, 30)
-            .await
-            .map_err(|e| anyhow::anyhow!("{}", e))?;
-
-        let client = create_client();
-        let bucket_name = "webdav-content-type-bucket";
-        let directory_name = "content-type-directory";
-        let webdav_base_url = format!("http://{}", WEBDAV_ADDRESS);
-        let mkcol_bucket = client
-            .request(
-                reqwest::Method::from_bytes(b"MKCOL").expect("MKCOL is a valid HTTP method"),
-                format!("{}/{}", webdav_base_url, bucket_name),
-            )
-            .header("Authorization", basic_auth_header())
-            .send()
-            .await?;
-        anyhow::ensure!(
-            mkcol_bucket.status().is_success() || mkcol_bucket.status().as_u16() == 201,
-            "MKCOL bucket should succeed, got: {}",
-            mkcol_bucket.status()
-        );
-
-        let mkcol_directory = client
-            .request(
-                reqwest::Method::from_bytes(b"MKCOL").expect("MKCOL is a valid HTTP method"),
-                format!("{}/{}/{}", webdav_base_url, bucket_name, directory_name),
-            )
-            .header("Authorization", basic_auth_header())
-            .send()
-            .await?;
-        anyhow::ensure!(
-            mkcol_directory.status().is_success() || mkcol_directory.status().as_u16() == 201,
-            "MKCOL directory should succeed, got: {}",
-            mkcol_directory.status()
-        );
-
-        let head_url = format!("{}/{}/{}/", admin_base_url, bucket_name, directory_name);
-        let head = signed_s3_request(http::Method::HEAD, &head_url, None, None, DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY)
-            .await
-            .map_err(|error| anyhow::anyhow!("{error}"))?;
-        anyhow::ensure!(head.status().is_success(), "HEAD directory marker should succeed, got: {}", head.status());
-        let content_type = head
-            .headers()
-            .get("content-type")
-            .and_then(|value| value.to_str().ok())
-            .unwrap_or_default();
-        anyhow::ensure!(
-            content_type == "application/x-directory",
-            "WebDAV directory marker must preserve its content type, got: {content_type}"
-        );
-        Ok(())
-    }
-    .await;
-
-    let _ = server_process.kill().await;
-    let _ = server_process.wait().await;
-    result
-}
-
 /// Extract the numeric value of the first occurrence of a DAV property in a
 /// PROPFIND multistatus body. Namespace-prefix agnostic; a self-closing
 /// (unreported) property yields None.

crates/e2e_test/src/sts_query_compat_test.rs

@@ -400,9 +400,6 @@ async fn test_sts_query_responses_are_aws_sdk_compatible() -> TestResult {
     init_logging();
 
     let mut env = RustFSTestEnvironment::new().await?;
-    // Exercise the minimum root secret length accepted at startup.
-    env.secret_key.truncate(8);
-    assert_eq!(env.secret_key.len(), 8);
     env.start_rustfs_server(vec![]).await?;
 
     let assumed = sts_client(&env.url, &env.access_key, &env.secret_key, None)

crates/ecstore/Cargo.toml

@@ -30,7 +30,6 @@ documentation = "https://docs.rs/rustfs-ecstore/latest/rustfs_ecstore/"
 workspace = true
 
 [features]
-internode-transport = []
 default = []
 fips = ["rustfs-s3-client/fips", "rustfs-utils/fips", "rustfs-tls-runtime/fips"]
 diagnostic-read-version-caller = ["rustfs-io-metrics/diagnostic-read-version-caller"]
@@ -142,7 +141,6 @@ rustfs-lifecycle.workspace = true
 rustfs-s3-client = { workspace = true }
 rustfs-s3-types = { workspace = true }
 rustfs-data-usage.workspace = true
-rustfs-gateway-types.workspace = true
 rustfs-object-capacity.workspace = true
 rustfs-object-data-cache = { workspace = true, features = ["runtime-memory"] }
 arc-swap.workspace = true
@@ -161,6 +159,7 @@ serde = { workspace = true, features = ["derive"] }
 time = { workspace = true, features = ["parsing", "formatting", "macros", "serde"] }
 bytesize.workspace = true
 serde_json = { workspace = true, features = ["raw_value"] }
+s3s = { workspace = true, features = ["minio"] }
 http.workspace = true
 opentelemetry.workspace = true
 http-body = { workspace = true }
@@ -254,7 +253,6 @@ windows-sys = { workspace = true, features = [
 windows-sys = { workspace = true, features = ["Win32_System_Ioctl"] }
 
 [dev-dependencies]
-s3s = { workspace = true, features = ["minio"] }
 aws-smithy-async.workspace = true
 rustfs-s3-ops.workspace = true
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "test-util", "fs"] }

crates/ecstore/src/api/mod.rs

@@ -66,8 +66,6 @@ pub mod bucket {
         }
 
         pub mod bucket_lifecycle_ops {
-            pub use rustfs_lifecycle::{RestoreOutputLocation, RestoreRequest, RestoreS3Location, RestoreTag, RestoreTagging};
-
             pub use crate::bucket::lifecycle::bucket_lifecycle_ops::{
                 ExpiryState, LifecycleOps, ManualTransitionCancelCheck, ManualTransitionProgressSink,
                 ManualTransitionQueueSnapshot, ManualTransitionRunExecution, ManualTransitionRunOptions,
@@ -139,7 +137,7 @@ pub mod bucket {
             pub use crate::bucket::lifecycle::lifecycle::{
                 Event, ExpirationOptions, IlmAction, LIFECYCLE_MALFORMED_XML_ERROR_KIND, Lifecycle, LifecycleCalculate,
                 ObjectOpts, RuleValidate, TRANSITION_COMPLETE, TRANSITION_PENDING, TransitionOptions, expected_expiry_time,
-                format_lifecycle_date, object_opts_from_object_info, parse_lifecycle_date,
+                object_opts_from_object_info,
             };
         }
 
@@ -242,7 +240,7 @@ pub mod bucket {
     }
 
     pub mod object_lock {
-        pub use crate::bucket::object_lock::ObjectLockApi;
+        pub use crate::bucket::object_lock::{ObjectLockApi, ObjectLockStatusExt};
 
         pub mod types {
             pub use crate::bucket::object_lock::types::{
@@ -337,9 +335,9 @@ pub mod bucket {
 
     pub mod utils {
         pub use crate::bucket::utils::{
-            BucketConfigXml, BucketConfigXmlError, check_bucket_and_object_names, check_list_objs_args,
-            check_object_name_for_length_and_slash, check_valid_bucket_name_strict, deserialize, has_bad_path_component,
-            has_xml_invalid_control_characters, is_meta_bucketname, is_valid_object_prefix, serialize,
+            check_bucket_and_object_names, check_list_objs_args, check_object_name_for_length_and_slash,
+            check_valid_bucket_name_strict, deserialize, has_bad_path_component, has_xml_invalid_control_characters,
+            is_meta_bucketname, is_valid_object_prefix, serialize,
         };
     }
 
@@ -366,7 +364,7 @@ pub mod capacity {
 }
 
 pub mod object_api_utils {
-    pub use crate::object_api::object_api_utils::{ObjReaderFn, PutObjReader, get_raw_etag, new_getobjectreader};
+    pub use crate::object_api::object_api_utils::{ObjReaderFn, PutObjReader, get_raw_etag, new_getobjectreader, to_s3s_etag};
 }
 
 pub mod cluster {
@@ -638,14 +636,7 @@ pub mod rio {
 }
 
 pub mod rpc {
-    #[cfg(feature = "internode-transport")]
-    pub use crate::cluster::rpc::http_auth::ExternalStreamAuth;
     pub use crate::cluster::rpc::http_auth::with_rpc_background_request;
-    #[cfg(feature = "internode-transport")]
-    pub use crate::cluster::rpc::internode_data_transport::{
-        InternodeDataTransport, InternodeDataTransportCapabilities, NsScannerCapabilityRequest, NsScannerStreamRequest,
-        ReadStreamRequest, TcpHttpInternodeDataTransport, WalkDirStreamRequest, WriteStreamRequest,
-    };
     pub use crate::cluster::rpc::{
         AuthenticatedChannel, KMS_SIGNAL_SUBSYSTEM, LocalPeerS3Client, MAX_NETWORK_PROBE_BYTES, MAX_NETWORK_PROBE_DURATION,
         NetworkPeerProbeClient, NetworkPeerProbeError, NetworkPeerProbeMeasurement, NetworkPeerTarget, PEER_RESTDRY_RUN,
@@ -706,8 +697,6 @@ pub mod store_list {
 pub mod storage {
     pub use crate::core::pools::{HealLifecycleExpiryContext, POOL_META_NAME};
     pub use crate::store::HealWalkVersion;
-    #[cfg(feature = "internode-transport")]
-    pub use crate::store::external_rpc_disk;
     pub use crate::store::{
         BootstrapLocalTarget, ECStore, SCANNER_PUBLICATION_LEASE_TTL_MS, ScannerDataMovementPauseStatus, all_local_disk,
         all_local_disk_path, find_local_disk_by_ref, find_local_disk_by_ref_for_rpc, init_local_disks,

crates/ecstore/src/bucket/bucket_target_sys.rs

@@ -1189,7 +1189,6 @@ impl BucketTargetSys {
             disable_proxy: target.disable_proxy,
             arn: target.arn.clone(),
             reset_id: target.reset_id.clone(),
-            site_peer_deployment_id: target.deployment_id.trim().to_string(),
             secure: target.secure,
             health_check_duration: target.health_check_duration,
             replicate_sync: target.replication_sync,
@@ -2012,9 +2011,6 @@ pub struct TargetClient {
     pub disable_proxy: bool,
     pub arn: String,
     pub reset_id: String,
-    /// Deployment id of the site-replication peer this target was derived
-    /// for; empty for an operator-configured bucket-replication target.
-    pub site_peer_deployment_id: String,
     pub secure: bool,
     pub health_check_duration: Duration,
     pub replicate_sync: bool,
@@ -2023,13 +2019,6 @@ pub struct TargetClient {
 }
 
 impl TargetClient {
-    /// Whether the target is a site-replication peer. Peers share bucket
-    /// configuration and IAM, and are required to hold KMS keys under the
-    /// same names; an operator-configured target promises neither.
-    pub fn is_site_replication_peer(&self) -> bool {
-        !self.site_peer_deployment_id.is_empty()
-    }
-
     fn credentials_expired_at(&self, now: jiff::Timestamp) -> bool {
         self.credentials
             .as_ref()
@@ -3061,7 +3050,6 @@ mod tests {
                 disable_proxy: false,
                 arn: "arn:rustfs:replication:us-east-1:target:bucket".to_string(),
                 reset_id: String::new(),
-                site_peer_deployment_id: String::new(),
                 secure: true,
                 health_check_duration: Duration::from_secs(5),
                 replicate_sync: false,
@@ -3605,7 +3593,6 @@ mod tests {
                 disable_proxy: false,
                 arn: "arn:rustfs:replication:us-east-1:target:bucket".to_string(),
                 reset_id: String::new(),
-                site_peer_deployment_id: String::new(),
                 secure: true,
                 health_check_duration: Duration::from_secs(5),
                 replicate_sync: false,
@@ -3919,7 +3906,6 @@ mod tests {
             disable_proxy: false,
             arn: arn.to_string(),
             reset_id: String::new(),
-            site_peer_deployment_id: String::new(),
             secure: true,
             health_check_duration: Duration::from_secs(5),
             replicate_sync: false,

crates/ecstore/src/bucket/lifecycle/bucket_lifecycle_ops.rs

@@ -88,14 +88,12 @@ use rustfs_filemeta::{
     FileInfo, FileInfoOpts, NULL_VERSION_ID, RestoreStatus, RestoreStatusOps, TRANSITION_COMPLETE, get_file_info,
     is_restored_object_on_disk,
 };
-use rustfs_gateway_types::persistence::PersistedObjectLockConfiguration as ObjectLockConfiguration;
-use rustfs_gateway_types::persistence::{PersistedLifecycleConfiguration, PersistedLifecycleFilter};
-use rustfs_lifecycle::{RestoreRequest, RestoreS3Location};
 use rustfs_lock::{NamespaceLockGuard, error::LockError};
 use rustfs_scanner_metrics::metrics::{
     IlmAction, Metrics, ScannerLifecycleExpiryStateUpdate, ScannerLifecycleTransitionStateUpdate, global_metrics,
 };
 use rustfs_utils::{get_env_i64, get_env_usize, path::encode_dir_object, string::parse_bool};
+use s3s::dto::{BucketLifecycleConfiguration, ExpirationStatus, ObjectLockConfiguration, RestoreRequest, RestoreRequestType};
 use sha2::{Digest, Sha256};
 use std::any::Any;
 use std::collections::{BTreeMap, HashMap, HashSet};
@@ -302,7 +300,7 @@ impl LifecycleSys {
         Arc::new(Self)
     }
 
-    pub async fn get(&self, bucket: &str) -> Option<PersistedLifecycleConfiguration> {
+    pub async fn get(&self, bucket: &str) -> Option<BucketLifecycleConfiguration> {
         match metadata_boundary::get_lifecycle_config(bucket).await {
             Ok((lc, _)) => Some(lc),
             Err(Error::ConfigNotFound) => None,
@@ -3559,7 +3557,7 @@ async fn stale_upload_lifecycle_due(
         Err(_) => return None,
     };
 
-    let has_size_filter = |filter: &PersistedLifecycleFilter| {
+    let has_size_filter = |filter: &s3s::dto::LifecycleRuleFilter| {
         filter.object_size_greater_than.is_some()
             || filter.object_size_less_than.is_some()
             || filter
@@ -3568,7 +3566,7 @@ async fn stale_upload_lifecycle_due(
                 .is_some_and(|and| and.object_size_greater_than.is_some() || and.object_size_less_than.is_some())
     };
     let needs_size = lifecycle.rules.iter().any(|rule| {
-        rule.status.as_str() != "Disabled"
+        rule.status.as_str() != ExpirationStatus::DISABLED
             && rule.abort_incomplete_multipart_upload.is_some()
             && rule.filter.as_ref().is_some_and(has_size_filter)
     });
@@ -4002,7 +4000,7 @@ pub fn init_background_stale_multipart_upload_cleanup(api: Arc<ECStore>) {
     });
 }
 
-pub async fn validate_transition_tier(lc: &PersistedLifecycleConfiguration) -> Result<(), std::io::Error> {
+pub async fn validate_transition_tier(lc: &BucketLifecycleConfiguration) -> Result<(), std::io::Error> {
     for rule in &lc.rules {
         if let Some(transitions) = &rule.transitions {
             for transition in transitions {
@@ -4119,9 +4117,8 @@ pub(crate) async fn enqueue_immediate_expiry(api: Arc<ECStore>, oi: &ObjectInfo,
         .map(lifecycle::object_opts_from_object_info)
         .collect::<Vec<ObjectOpts>>();
     let lock_config = configs.object_lock;
-    let evaluator_lock_config = lock_config.clone();
     let events = match Evaluator::new(lifecycle)
-        .with_lock_retention(evaluator_lock_config)
+        .with_lock_retention(lock_config.clone())
         .eval(&object_opts)
         .await
     {
@@ -4601,26 +4598,19 @@ pub async fn enqueue_transition_for_existing_objects_scoped(
     }
 }
 
-fn lifecycle_rule_has_date_expiration(lc: &PersistedLifecycleConfiguration, rule_id: &str) -> bool {
+fn lifecycle_rule_has_date_expiration(lc: &BucketLifecycleConfiguration, rule_id: &str) -> bool {
     lc.rules.iter().any(|rule| {
-        rule.status == "Enabled"
+        rule.status == ExpirationStatus::from_static(ExpirationStatus::ENABLED)
             && rule.id.as_deref() == Some(rule_id)
             && rule.expiration.as_ref().is_some_and(|expiration| expiration.date.is_some())
     })
 }
 
-fn should_defer_date_expiry_for_recent_config_update(lc: &PersistedLifecycleConfiguration, now: OffsetDateTime) -> bool {
-    lc.expiry_updated_at
-        .as_ref()
-        .is_some_and(|updated_at| match rustfs_lifecycle::parse_lifecycle_date(updated_at) {
-            Ok(updated_at) => {
-                now.unix_timestamp().saturating_sub(updated_at.unix_timestamp()) < DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS
-            }
-            Err(error) => {
-                warn!(error = %error, "Deferring date expiry with an unreadable update timestamp");
-                true
-            }
-        })
+fn should_defer_date_expiry_for_recent_config_update(lc: &BucketLifecycleConfiguration, now: OffsetDateTime) -> bool {
+    lc.expiry_updated_at.as_ref().is_some_and(|updated_at| {
+        let updated_at = OffsetDateTime::from(updated_at.clone());
+        now.unix_timestamp().saturating_sub(updated_at.unix_timestamp()) < DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS
+    })
 }
 
 async fn apply_existing_object_expiry(
@@ -4640,7 +4630,7 @@ async fn apply_existing_object_expiry(
 struct ExistingObjectExpiryContext<'a> {
     api: Arc<ECStore>,
     bucket: &'a str,
-    lc: Arc<PersistedLifecycleConfiguration>,
+    lc: Arc<BucketLifecycleConfiguration>,
     lock_config: Option<Arc<ObjectLockConfiguration>>,
     bucket_incarnation_id: Uuid,
     src: &'a LcEventSrc,
@@ -4660,9 +4650,8 @@ async fn enqueue_expiry_for_existing_object_group(
         .iter()
         .map(lifecycle::object_opts_from_object_info)
         .collect::<Vec<ObjectOpts>>();
-    let evaluator_lock_config = context.lock_config.clone();
     let events = match Evaluator::new(context.lc.clone())
-        .with_lock_retention(evaluator_lock_config)
+        .with_lock_retention(context.lock_config.clone())
         .eval(&object_opts)
         .await
     {
@@ -4856,7 +4845,7 @@ fn manual_transition_version_marker(oi: &ObjectInfo) -> String {
 async fn enqueue_transition_with_lifecycle_report(
     api: Option<Arc<ECStore>>,
     oi: &ObjectInfo,
-    lc: &PersistedLifecycleConfiguration,
+    lc: &BucketLifecycleConfiguration,
     src: &LcEventSrc,
     options: &ManualTransitionRunOptions,
     report: &mut ManualTransitionRunReport,
@@ -4922,7 +4911,7 @@ async fn enqueue_transition_with_lifecycle_report(
     false
 }
 
-async fn enqueue_transition_with_lifecycle(oi: &ObjectInfo, lc: &PersistedLifecycleConfiguration, src: &LcEventSrc) -> bool {
+async fn enqueue_transition_with_lifecycle(oi: &ObjectInfo, lc: &BucketLifecycleConfiguration, src: &LcEventSrc) -> bool {
     let event = lc.eval(&oi.to_lifecycle_opts()).await;
     match event.action {
         IlmAction::TransitionAction | IlmAction::TransitionVersionAction => {
@@ -5436,8 +5425,12 @@ pub async fn post_restore_opts(version_id: &str, bucket: &str, object: &str) ->
     })
 }
 
-fn select_restore_s3_location(rreq: &RestoreRequest) -> Result<Option<&RestoreS3Location>, std::io::Error> {
-    if rreq.type_.as_ref().is_none_or(|type_| type_.as_str() != "SELECT") {
+fn select_restore_s3_location(rreq: &RestoreRequest) -> Result<Option<&s3s::dto::S3Location>, std::io::Error> {
+    if rreq
+        .type_
+        .as_ref()
+        .is_none_or(|type_| type_.as_str() != RestoreRequestType::SELECT)
+    {
         return Ok(None);
     }
     let output_location = rreq
@@ -5479,20 +5472,21 @@ pub async fn put_restore_opts(
     // the OutputLocation metadata instead of a write to `OutputLocation.S3`
     // (backlog#1341). RestoreObject rejects SELECT at the API boundary; this
     // is the fail-closed backstop for any other caller.
-    if rreq.type_.as_ref().is_some_and(|type_| type_.as_str() == "SELECT") {
+    if rreq
+        .type_
+        .as_ref()
+        .is_some_and(|type_| type_.as_str() == RestoreRequestType::SELECT)
+    {
         return Err(std::io::Error::other("SELECT restore requests are not supported"));
     }
     for (k, v) in oi.user_defined.iter() {
         meta.insert(k.to_string(), v.clone());
     }
-    // The fleet capability gate guarantees physical copy-back support. Keep
-    // the completed transition identity for orphan recovery and remote cleanup.
     rustfs_utils::http::metadata_compat::remove_str(&mut meta, rustfs_utils::http::metadata_compat::SUFFIX_RESTORE_OPERATION_ID);
+    rustfs_utils::http::metadata_compat::remove_str(&mut meta, rustfs_utils::http::metadata_compat::SUFFIX_RESTORE_WORKER_LOCK);
     if !oi.user_tags.is_empty() {
         meta.insert(AMZ_OBJECT_TAGGING.to_string(), (*oi.user_tags).clone());
     }
-    // Finalization publishes completion and its expiry under the object lock.
-    // The local copy-back commit must not make unfinished work eligible for expiry.
     if let Some(expires) = oi.expires {
         meta.insert(
             "expires".to_string(),
@@ -5501,11 +5495,12 @@ pub async fn put_restore_opts(
                 .map_err(std::io::Error::other)?,
         );
     }
+    let restore_expiry = lifecycle::expected_expiry_time(OffsetDateTime::now_utc(), rreq.days.unwrap_or(1));
     meta.insert(
         metadata_keys::RESTORE.to_string(),
         RestoreStatus {
-            is_restore_in_progress: Some(true),
-            restore_expiry_date: None,
+            is_restore_in_progress: Some(false),
+            restore_expiry_date: Some(restore_expiry),
         }
         .to_string(),
     );
@@ -5519,7 +5514,6 @@ pub async fn put_restore_opts(
         // computed MD5 is not the object's public plaintext ETag.
         preserve_etag: oi.etag.clone(),
         shard_integrity_write_mode: Some(oi.shard_integrity_write_mode()),
-        restore_copyback: true,
         ..Default::default()
     })
 }
@@ -5538,18 +5532,6 @@ impl LifecycleOps for ObjectInfo {
         if self.transitioned_object.status != lifecycle::TRANSITION_COMPLETE {
             return false;
         }
-        if rustfs_utils::http::metadata_compat::get_consistent_str(
-            &self.user_defined,
-            rustfs_utils::http::metadata_compat::SUFFIX_RESTORE_COPYBACK,
-        ) == Some(rustfs_utils::http::metadata_compat::RESTORE_COPYBACK_PROTOCOL_V1)
-            && self
-                .user_defined
-                .get(metadata_keys::RESTORE)
-                .and_then(|value| rustfs_filemeta::parse_restore_obj_status(value).ok())
-                .is_some_and(|status| status.is_restore_in_progress == Some(true))
-        {
-            return false;
-        }
         !is_restored_object_on_disk(&self.user_defined)
     }
 }
@@ -5561,25 +5543,25 @@ pub trait RestoreRequestOps {
 impl RestoreRequestOps for RestoreRequest {
     fn validate(&self, _api: Arc<ECStore>) -> Result<(), std::io::Error> {
         // SELECT type requires select_parameters, and vice versa
-        if self.type_.as_ref().is_none_or(|t| t.as_str() != "SELECT") && self.select_parameters.is_some() {
+        if self.type_.as_ref().is_none_or(|t| t.as_str() != RestoreRequestType::SELECT) && self.select_parameters.is_some() {
             return Err(std::io::Error::other("Select parameters can only be specified with SELECT request type"));
         }
         if let Some(type_) = &self.type_
-            && type_.as_str() == "SELECT"
+            && type_.as_str() == RestoreRequestType::SELECT
             && self.select_parameters.is_none()
         {
             return Err(std::io::Error::other("SELECT restore request requires select parameters to be specified"));
         }
 
         // OutputLocation is only valid for SELECT requests
-        if self.type_.as_ref().is_none_or(|t| t.as_str() != "SELECT") && self.output_location.is_some() {
+        if self.type_.as_ref().is_none_or(|t| t.as_str() != RestoreRequestType::SELECT) && self.output_location.is_some() {
             return Err(std::io::Error::other("OutputLocation can only be specified with SELECT request type"));
         }
         select_restore_s3_location(self)?;
 
         // Days must not be specified with SELECT requests
         if let Some(type_) = &self.type_
-            && type_.as_str() == "SELECT"
+            && type_.as_str() == RestoreRequestType::SELECT
             && self.days.is_some_and(|d| d > 0)
         {
             return Err(std::io::Error::other("Days cannot be specified with SELECT restore request"));
@@ -5621,7 +5603,7 @@ pub fn lifecycle_version_delete_target(oi: &ObjectInfo) -> Option<ObjectToDelete
 }
 
 pub async fn eval_action_from_lifecycle(
-    lc: &PersistedLifecycleConfiguration,
+    lc: &BucketLifecycleConfiguration,
     lock_config: Option<&ObjectLockConfiguration>,
     oi: &ObjectInfo,
 ) -> lifecycle::Event {
@@ -6326,19 +6308,14 @@ mod tests {
     use rustfs_data_usage::TierStats;
     use rustfs_filemeta::metadata_keys;
     use rustfs_filemeta::{FileInfo, FileMeta};
-    use rustfs_gateway_types::dto::MetadataEntry;
-    use rustfs_gateway_types::persistence::{
-        PersistedDefaultRetention as DefaultRetention, PersistedObjectLockConfiguration as ObjectLockConfiguration,
-        PersistedObjectLockRule as ObjectLockRule,
-    };
-    use rustfs_gateway_types::persistence::{
-        PersistedLifecycleConfiguration, PersistedLifecycleExpiration, PersistedLifecycleRule,
-        PersistedNoncurrentVersionExpiration, PersistedTransition,
-    };
-    use rustfs_lifecycle::{RestoreOutputLocation as OutputLocation, RestoreRequest, RestoreS3Location as S3Location};
     #[cfg(feature = "test-util")]
     use rustfs_s3_client::transition_api::ReaderImpl;
     use rustfs_scanner_metrics::metrics::{IlmAction, global_metrics};
+    use s3s::dto::{
+        BucketLifecycleConfiguration, DefaultRetention, ExpirationStatus, LifecycleExpiration, LifecycleRule, MetadataEntry,
+        NoncurrentVersionExpiration, ObjectLockConfiguration, ObjectLockEnabled, ObjectLockRetentionMode, ObjectLockRule,
+        OutputLocation, RestoreRequest, RestoreRequestType, S3Location, Timestamp, Transition, TransitionStorageClass,
+    };
     use serial_test::serial;
     use sha2::{Digest, Sha256};
     use std::collections::HashMap;
@@ -9364,7 +9341,7 @@ mod tests {
             output_location,
             select_parameters: None,
             tier: None,
-            type_: Some("SELECT".to_owned()),
+            type_: Some(RestoreRequestType::from_static(RestoreRequestType::SELECT)),
         }
     }
 
@@ -9681,12 +9658,12 @@ mod tests {
 
     #[test]
     fn lifecycle_rule_has_date_expiration_detects_enabled_date_rule() {
-        let lc = PersistedLifecycleConfiguration {
+        let lc = BucketLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![PersistedLifecycleRule {
-                status: "Enabled".to_owned(),
-                expiration: Some(PersistedLifecycleExpiration {
-                    date: Some(lifecycle::format_lifecycle_date(OffsetDateTime::now_utc()).unwrap()),
+            rules: vec![LifecycleRule {
+                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
+                expiration: Some(LifecycleExpiration {
+                    date: Some(Timestamp::from(OffsetDateTime::now_utc())),
                     ..Default::default()
                 }),
                 id: Some("rule-date".to_string()),
@@ -10203,15 +10180,14 @@ mod tests {
     #[test]
     fn should_defer_date_expiry_for_recent_config_update_respects_grace_window() {
         let now = OffsetDateTime::now_utc();
-        let recent = PersistedLifecycleConfiguration {
-            expiry_updated_at: Some(lifecycle::format_lifecycle_date(now - time::Duration::seconds(1)).unwrap()),
+        let recent = BucketLifecycleConfiguration {
+            expiry_updated_at: Some(Timestamp::from(now - time::Duration::seconds(1))),
             rules: Vec::new(),
         };
-        let stale = PersistedLifecycleConfiguration {
-            expiry_updated_at: Some(
-                lifecycle::format_lifecycle_date(now - time::Duration::seconds(DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS + 1))
-                    .unwrap(),
-            ),
+        let stale = BucketLifecycleConfiguration {
+            expiry_updated_at: Some(Timestamp::from(
+                now - time::Duration::seconds(DATE_EXPIRY_EXISTING_OBJECTS_GRACE_SECS + 1),
+            )),
             rules: Vec::new(),
         };
 
@@ -10339,12 +10315,12 @@ mod tests {
         assert_eq!(deleted.version_id, None);
     }
 
-    fn expired_delete_marker_lifecycle() -> PersistedLifecycleConfiguration {
-        PersistedLifecycleConfiguration {
+    fn expired_delete_marker_lifecycle() -> BucketLifecycleConfiguration {
+        BucketLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![PersistedLifecycleRule {
-                status: "Enabled".to_owned(),
-                expiration: Some(PersistedLifecycleExpiration {
+            rules: vec![LifecycleRule {
+                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
+                expiration: Some(LifecycleExpiration {
                     expired_object_delete_marker: Some(true),
                     ..Default::default()
                 }),
@@ -10360,12 +10336,12 @@ mod tests {
         }
     }
 
-    fn latest_expiration_lifecycle() -> PersistedLifecycleConfiguration {
-        PersistedLifecycleConfiguration {
+    fn latest_expiration_lifecycle() -> BucketLifecycleConfiguration {
+        BucketLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![PersistedLifecycleRule {
-                status: "Enabled".to_owned(),
-                expiration: Some(PersistedLifecycleExpiration {
+            rules: vec![LifecycleRule {
+                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
+                expiration: Some(LifecycleExpiration {
                     days: Some(1),
                     ..Default::default()
                 }),
@@ -10381,12 +10357,12 @@ mod tests {
         }
     }
 
-    fn current_and_noncurrent_expiration_lifecycle() -> PersistedLifecycleConfiguration {
-        PersistedLifecycleConfiguration {
+    fn current_and_noncurrent_expiration_lifecycle() -> BucketLifecycleConfiguration {
+        BucketLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![PersistedLifecycleRule {
-                status: "Enabled".to_owned(),
-                expiration: Some(PersistedLifecycleExpiration {
+            rules: vec![LifecycleRule {
+                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
+                expiration: Some(LifecycleExpiration {
                     days: Some(30),
                     ..Default::default()
                 }),
@@ -10394,7 +10370,7 @@ mod tests {
                 del_marker_expiration: None,
                 filter: None,
                 id: Some("expire-current-and-noncurrent".to_string()),
-                noncurrent_version_expiration: Some(PersistedNoncurrentVersionExpiration {
+                noncurrent_version_expiration: Some(NoncurrentVersionExpiration {
                     noncurrent_days: Some(1),
                     newer_noncurrent_versions: None,
                 }),
@@ -10405,12 +10381,12 @@ mod tests {
         }
     }
 
-    fn all_versions_expiration_lifecycle() -> PersistedLifecycleConfiguration {
-        PersistedLifecycleConfiguration {
+    fn all_versions_expiration_lifecycle() -> BucketLifecycleConfiguration {
+        BucketLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![PersistedLifecycleRule {
-                status: "Enabled".to_owned(),
-                expiration: Some(PersistedLifecycleExpiration {
+            rules: vec![LifecycleRule {
+                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
+                expiration: Some(LifecycleExpiration {
                     days: Some(1),
                     expired_object_all_versions: Some(true),
                     ..Default::default()
@@ -10429,29 +10405,29 @@ mod tests {
 
     fn lock_enabled_without_default_retention() -> ObjectLockConfiguration {
         ObjectLockConfiguration {
-            object_lock_enabled: Some("Enabled".to_owned()),
+            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
             rule: None,
         }
     }
 
     fn lock_enabled_with_default_retention() -> ObjectLockConfiguration {
         ObjectLockConfiguration {
-            object_lock_enabled: Some("Enabled".to_owned()),
+            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
             rule: Some(ObjectLockRule {
                 default_retention: Some(DefaultRetention {
                     days: Some(30),
-                    mode: Some("COMPLIANCE".to_owned()),
+                    mode: Some(ObjectLockRetentionMode::from_static(ObjectLockRetentionMode::COMPLIANCE)),
                     years: None,
                 }),
             }),
         }
     }
 
-    fn latest_transition_lifecycle() -> PersistedLifecycleConfiguration {
-        PersistedLifecycleConfiguration {
+    fn latest_transition_lifecycle() -> BucketLifecycleConfiguration {
+        BucketLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![PersistedLifecycleRule {
-                status: "Enabled".to_owned(),
+            rules: vec![LifecycleRule {
+                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
                 expiration: None,
                 abort_incomplete_multipart_upload: None,
                 del_marker_expiration: None,
@@ -10460,10 +10436,10 @@ mod tests {
                 noncurrent_version_expiration: None,
                 noncurrent_version_transitions: None,
                 prefix: None,
-                transitions: Some(vec![PersistedTransition {
+                transitions: Some(vec![Transition {
                     days: Some(1),
                     date: None,
-                    storage_class: Some("WARM".to_owned()),
+                    storage_class: Some(TransitionStorageClass::from_static("WARM")),
                 }]),
             }],
         }
@@ -13000,9 +12976,8 @@ mod tests {
 
         for (name, object, lock_config, expected) in cases {
             let object_opts = lifecycle::object_opts_from_object_info(&object);
-            let evaluator_lock_config = lock_config.clone().map(Arc::new);
             let batch_event = Evaluator::new(Arc::new(lifecycle.clone()))
-                .with_lock_retention(evaluator_lock_config)
+                .with_lock_retention(lock_config.clone().map(Arc::new))
                 .eval(&[object_opts])
                 .await
                 .expect("batch lifecycle evaluation should succeed")
@@ -14259,7 +14234,10 @@ mod tests {
         let object = current_object_with_metadata(
             ReplicationStatusType::Completed,
             HashMap::from([
-                (metadata_keys::OBJECT_LOCK_MODE.to_string(), "COMPLIANCE".to_string()),
+                (
+                    metadata_keys::OBJECT_LOCK_MODE.to_string(),
+                    s3s::dto::ObjectLockRetentionMode::COMPLIANCE.to_string(),
+                ),
                 (metadata_keys::OBJECT_LOCK_RETAIN_UNTIL_DATE.to_string(), retain_until),
             ]),
         );
@@ -14271,7 +14249,7 @@ mod tests {
 
     #[tokio::test]
     async fn restored_copy_expiry_is_not_blocked_by_retention() {
-        let lifecycle = PersistedLifecycleConfiguration {
+        let lifecycle = BucketLifecycleConfiguration {
             expiry_updated_at: None,
             rules: Vec::new(),
         };
@@ -14281,7 +14259,10 @@ mod tests {
         let mut object = current_object_with_metadata(
             ReplicationStatusType::Completed,
             HashMap::from([
-                (metadata_keys::OBJECT_LOCK_MODE.to_string(), "COMPLIANCE".to_string()),
+                (
+                    metadata_keys::OBJECT_LOCK_MODE.to_string(),
+                    ObjectLockRetentionMode::COMPLIANCE.to_string(),
+                ),
                 (metadata_keys::OBJECT_LOCK_RETAIN_UNTIL_DATE.to_string(), retain_until),
             ]),
         );
@@ -14498,7 +14479,7 @@ mod tests {
                 "removed" => {
                     metadata_sys::delete(&bucket, BUCKET_LIFECYCLE_CONFIG).await.unwrap();
                 }
-                "disabled" => changed.rules[0].status = "Disabled".to_owned(),
+                "disabled" => changed.rules[0].status = ExpirationStatus::from_static(ExpirationStatus::DISABLED),
                 "longer-days" => {
                     changed.rules[0]
                         .noncurrent_version_expiration
@@ -14614,7 +14595,7 @@ mod tests {
         );
     }
 
-    async fn install_test_expiry_policy(ecstore: &Arc<ECStore>, bucket: &str) -> Arc<PersistedLifecycleConfiguration> {
+    async fn install_test_expiry_policy(ecstore: &Arc<ECStore>, bucket: &str) -> Arc<BucketLifecycleConfiguration> {
         let xml = br#"<LifecycleConfiguration><Rule><ID>expire</ID><Status>Enabled</Status><Filter><Prefix></Prefix></Filter><Expiration><Days>0</Days></Expiration><NoncurrentVersionExpiration><NoncurrentDays>0</NoncurrentDays></NoncurrentVersionExpiration></Rule></LifecycleConfiguration>"#;
         metadata_sys::update_in(&ecstore.ctx, bucket, BUCKET_LIFECYCLE_CONFIG, xml.to_vec())
             .await
@@ -15307,11 +15288,7 @@ mod tests {
     #[tokio::test]
     #[serial]
     async fn tier_free_version_recovery_production_entrypoint_enqueues_seeded_item() {
-        let (disk_paths, ecstore) =
-            temp_env::async_with_vars([(super::ENV_TIER_FREE_VERSION_RECOVERY_ENABLED, Some("false"))], async {
-                setup_test_env().await
-            })
-            .await;
+        let (disk_paths, ecstore) = setup_test_env().await;
         let tier = format!("RECOVERY{}", Uuid::new_v4().simple()).to_uppercase();
         crate::services::tier::test_util::register_mock_tier(&ecstore.tier_config_mgr(), &tier).await;
         let runtime_state = install_unconsumed_runtime_expiry_worker(&ecstore, 1).await;

crates/ecstore/src/bucket/lifecycle/core.rs

@@ -17,7 +17,7 @@ use crate::object_api::ObjectInfo;
 pub use rustfs_lifecycle::{
     Event, ExpirationOptions, IlmAction, LIFECYCLE_MALFORMED_XML_ERROR_KIND, Lifecycle, LifecycleCalculate, ObjectOpts,
     RuleValidate, TRANSITION_COMPLETE, TRANSITION_PENDING, TransitionOptions, abort_incomplete_multipart_upload_due,
-    expected_expiry_time, expiration_action_has_valid_target, format_lifecycle_date, parse_lifecycle_date,
+    expected_expiry_time, expiration_action_has_valid_target,
 };
 
 pub fn object_opts_from_object_info(oi: &ObjectInfo) -> ObjectOpts {

crates/ecstore/src/bucket/lifecycle/metadata_boundary.rs

@@ -14,8 +14,7 @@
 
 use std::sync::Arc;
 
-use rustfs_gateway_types::persistence::PersistedLifecycleConfiguration;
-use rustfs_gateway_types::persistence::PersistedObjectLockConfiguration as ObjectLockConfiguration;
+use s3s::dto::{BucketLifecycleConfiguration, ObjectLockConfiguration};
 use time::OffsetDateTime;
 use uuid::Uuid;
 
@@ -25,7 +24,7 @@ use crate::error::{Error, Result};
 
 #[derive(Debug)]
 pub(crate) struct LifecycleExpiryConfigs {
-    pub(crate) lifecycle: Option<Arc<PersistedLifecycleConfiguration>>,
+    pub(crate) lifecycle: Option<Arc<BucketLifecycleConfiguration>>,
     pub(crate) object_lock: Option<Arc<ObjectLockConfiguration>>,
     pub(crate) bucket_incarnation_id: Uuid,
     pub(crate) table_bucket_enabled: bool,
@@ -101,7 +100,7 @@ pub(crate) async fn get_expiry_configs_for_options(
     })
 }
 
-pub(crate) async fn get_lifecycle_config(bucket: &str) -> Result<(PersistedLifecycleConfiguration, OffsetDateTime)> {
+pub(crate) async fn get_lifecycle_config(bucket: &str) -> Result<(BucketLifecycleConfiguration, OffsetDateTime)> {
     metadata_sys::get_lifecycle_config(bucket).await
 }
 
@@ -111,15 +110,15 @@ mod tests {
     use crate::bucket::metadata::BucketMetadata;
     use crate::bucket::metadata_sys::{self, test_support::isolated_store_over_temp_disks};
     use crate::storage_api_contracts::bucket::MakeBucketOptions;
-    use rustfs_gateway_types::persistence::{PersistedLifecycleExpiration, PersistedLifecycleRule};
+    use s3s::dto::{ExpirationStatus, LifecycleExpiration, LifecycleRule};
     use serial_test::serial;
 
-    fn lifecycle_config() -> PersistedLifecycleConfiguration {
-        PersistedLifecycleConfiguration {
+    fn lifecycle_config() -> BucketLifecycleConfiguration {
+        BucketLifecycleConfiguration {
             expiry_updated_at: None,
-            rules: vec![PersistedLifecycleRule {
-                status: "Enabled".to_owned(),
-                expiration: Some(PersistedLifecycleExpiration {
+            rules: vec![LifecycleRule {
+                status: ExpirationStatus::from_static(ExpirationStatus::ENABLED),
+                expiration: Some(LifecycleExpiration {
                     days: Some(1),
                     ..Default::default()
                 }),

crates/ecstore/src/bucket/lifecycle/object_lock_boundary.rs

@@ -22,7 +22,7 @@ pub(crate) fn is_object_locked_by_metadata(user_defined: &HashMap<String, String
 }
 
 pub(crate) fn check_object_lock_for_deletion_with_config(
-    config: Option<&rustfs_gateway_types::persistence::PersistedObjectLockConfiguration>,
+    config: Option<&s3s::dto::ObjectLockConfiguration>,
     obj_info: &ObjectInfo,
     bypass_governance: bool,
 ) -> crate::error::Result<Option<ObjectLockBlockReason>> {

crates/ecstore/src/bucket/lifecycle/replication_sink.rs

@@ -82,13 +82,12 @@ mod tests {
     use crate::bucket::replication::{DeleteReplicationConfigSnapshot, ReplicationObjectBridge};
     use crate::object_api::{ObjectInfo, ObjectOptions};
     use crate::storage_api_contracts::object::ObjectToDelete;
-    use rustfs_gateway_types::dto::Status;
-    use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
-    use rustfs_gateway_types::persistence::{
-        PersistedOptionalReplicationStatus, PersistedReplicationConfiguration, PersistedReplicationDestination,
-        PersistedReplicationRule, PersistedReplicationStatus,
-    };
     use rustfs_scanner_metrics::metrics::IlmAction;
+    use s3s::dto::{
+        BucketVersioningStatus, DeleteMarkerReplication, DeleteMarkerReplicationStatus, DeleteReplication,
+        DeleteReplicationStatus, Destination, ReplicationConfiguration, ReplicationRule, ReplicationRuleStatus,
+        VersioningConfiguration,
+    };
     use uuid::Uuid;
 
     use super::*;
@@ -161,27 +160,27 @@ mod tests {
             for purge_enabled in [false, true] {
                 let snapshot = DeleteReplicationConfigSnapshot::from_configs_for_test(
                     VersioningConfiguration {
-                        status: Some("Enabled".to_owned()),
+                        status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
                         ..Default::default()
                     },
-                    Some(PersistedReplicationConfiguration {
+                    Some(ReplicationConfiguration {
                         role: String::new(),
-                        rules: vec![PersistedReplicationRule {
-                            delete_marker_replication: Some(PersistedOptionalReplicationStatus {
+                        rules: vec![ReplicationRule {
+                            delete_marker_replication: Some(DeleteMarkerReplication {
                                 status: Some(if marker_enabled {
-                                    Status::ENABLED.to_string()
+                                    DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::ENABLED)
                                 } else {
-                                    Status::DISABLED.to_string()
+                                    DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::DISABLED)
                                 }),
                             }),
-                            delete_replication: Some(PersistedReplicationStatus {
+                            delete_replication: Some(DeleteReplication {
                                 status: if purge_enabled {
-                                    Status::ENABLED.to_string()
+                                    DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED)
                                 } else {
-                                    Status::DISABLED.to_string()
+                                    DeleteReplicationStatus::from_static(DeleteReplicationStatus::DISABLED)
                                 },
                             }),
-                            destination: PersistedReplicationDestination {
+                            destination: Destination {
                                 bucket: "arn:rustfs:replication:target".to_string(),
                                 ..Default::default()
                             },
@@ -191,7 +190,7 @@ mod tests {
                             prefix: Some(String::new()),
                             priority: Some(1),
                             source_selection_criteria: None,
-                            status: Status::ENABLED.to_string(),
+                            status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
                         }],
                     }),
                 );

crates/ecstore/src/bucket/lifecycle/runtime_boundary.rs

@@ -14,7 +14,7 @@
 
 use std::sync::Arc;
 
-use rustfs_gateway_types::persistence::PersistedLifecycleConfiguration;
+use s3s::dto::BucketLifecycleConfiguration;
 use tokio::sync::RwLock;
 use tokio_util::sync::CancellationToken;
 
@@ -52,7 +52,7 @@ pub(crate) fn deployment_id() -> Option<String> {
     sources::deployment_id()
 }
 
-pub(crate) async fn bucket_lifecycle_config(bucket: &str) -> Option<PersistedLifecycleConfiguration> {
+pub(crate) async fn bucket_lifecycle_config(bucket: &str) -> Option<BucketLifecycleConfiguration> {
     sources::bucket_lifecycle_config(bucket).await
 }
 

crates/ecstore/src/bucket/metadata.rs

@@ -13,7 +13,7 @@
 // limitations under the License.
 
 use super::msgp_decode::{read_msgp_ext8_time, skip_msgp_value, write_msgp_time};
-use super::object_lock::ObjectLockApi;
+use super::object_lock::{ObjectLockApi, ObjectLockStatusExt};
 use super::versioning::VersioningApi;
 use super::{quota::BucketQuota, target::BucketTargets};
 use crate::bucket::replication::invalid_replication_config_status_field;
@@ -25,17 +25,12 @@ use crate::object_api::WriteCompletion;
 use crate::runtime::sources as runtime_sources;
 use crate::store::ECStore;
 use byteorder::{BigEndian, ByteOrder, LittleEndian};
-use rustfs_gateway_types::cors_tagging::{PersistedCorsConfiguration as CORSConfiguration, PersistedTagging as Tagging};
-use rustfs_gateway_types::persistence::{
-    PersistedAccelerateConfiguration as AccelerateConfiguration,
-    PersistedBucketEncryptionConfiguration as ServerSideEncryptionConfiguration,
-    PersistedBucketLoggingStatus as BucketLoggingStatus, PersistedLifecycleConfiguration,
-    PersistedNotificationConfiguration as NotificationConfiguration, PersistedObjectLockConfiguration as ObjectLockConfiguration,
-    PersistedPublicAccessBlockConfiguration as PublicAccessBlockConfiguration, PersistedReplicationConfiguration,
-    PersistedRequestPaymentConfiguration as RequestPaymentConfiguration,
-    PersistedVersioningConfiguration as VersioningConfiguration, PersistedWebsiteConfiguration as WebsiteConfiguration,
-};
 use rustfs_policy::policy::BucketPolicy;
+use s3s::dto::{
+    AccelerateConfiguration, BucketLifecycleConfiguration, BucketLoggingStatus, BucketVersioningStatus, CORSConfiguration,
+    NotificationConfiguration, ObjectLockConfiguration, PublicAccessBlockConfiguration, ReplicationConfiguration,
+    RequestPaymentConfiguration, ServerSideEncryptionConfiguration, Tagging, VersioningConfiguration, WebsiteConfiguration,
+};
 use serde::Serializer;
 use sha2::{Digest, Sha256};
 use std::collections::HashMap;
@@ -45,11 +40,23 @@ use time::{Date, OffsetDateTime, PrimitiveDateTime, Time as CivilTime, UtcOffset
 use tracing::error;
 use uuid::Uuid;
 
-// The persisted Object Lock configuration answers the storage-level trait
-// here because this module owns the persisted `ObjectLockConfiguration`.
+// The serving-layer DTO impls for the storage-level Object Lock traits live
+// here because this module owns the persisted `ObjectLockConfiguration`
+// during the s3s ratchet migration (rustfs/backlog#1842).
 impl ObjectLockApi for ObjectLockConfiguration {
     fn enabled(&self) -> bool {
-        self.object_lock_enabled.as_deref() == Some("Enabled")
+        self.object_lock_enabled
+            .as_ref()
+            .is_some_and(|v| v.as_str() == s3s::dto::ObjectLockEnabled::ENABLED)
+    }
+}
+
+impl ObjectLockStatusExt for s3s::dto::ObjectLockLegalHoldStatus {
+    fn valid(&self) -> bool {
+        matches!(
+            self.as_str(),
+            s3s::dto::ObjectLockLegalHoldStatus::ON | s3s::dto::ObjectLockLegalHoldStatus::OFF
+        )
     }
 }
 
@@ -250,14 +257,12 @@ pub const BUCKET_NOTIFICATION_CONFIG: &str = "notification.xml";
 pub const BUCKET_LIFECYCLE_CONFIG: &str = "lifecycle.xml";
 pub const BUCKET_SSECONFIG: &str = "bucket-encryption.xml";
 /// Validate tag entries supplied to the S3 API.
-pub fn validate_tag_set_entries(
-    tag_set: &[rustfs_gateway_types::cors_tagging::PersistedTag],
-) -> std::result::Result<(), &'static str> {
+pub fn validate_tag_set_entries(tag_set: &[s3s::dto::Tag]) -> std::result::Result<(), &'static str> {
     validate_tag_entries(tag_set, validate_s3_tag_entry)
 }
 
 fn validate_tag_entries(
-    tag_set: &[rustfs_gateway_types::cors_tagging::PersistedTag],
+    tag_set: &[s3s::dto::Tag],
     mut validate_entry: impl FnMut(&str, &str) -> std::result::Result<(), &'static str>,
 ) -> std::result::Result<(), &'static str> {
     let mut keys = std::collections::HashSet::with_capacity(tag_set.len());
@@ -318,9 +323,7 @@ pub fn is_swift_bucket_metadata_tag_key(key: &str) -> bool {
         || key.starts_with(SWIFT_CONTAINER_META_TAG_PREFIX)
 }
 
-fn validate_persisted_bucket_tags(
-    tags: &[rustfs_gateway_types::cors_tagging::PersistedTag],
-) -> std::result::Result<(), &'static str> {
+fn validate_persisted_bucket_tags(tags: &[s3s::dto::Tag]) -> std::result::Result<(), &'static str> {
     const SWIFT_ACL_MAX_BYTES: usize = 8192;
     const SWIFT_META_NAME_MAX_BYTES: usize = 128;
     const MAX_PERSISTED_TAGS: usize = MAX_BUCKET_TAGS + 2 * MAX_SWIFT_METADATA_COUNT + 4;
@@ -558,8 +561,6 @@ pub struct BucketMetadata {
     pub bucket_incarnation_id: Uuid,
     pub(crate) bucket_incarnation_sidecar: bool,
     pub(crate) bucket_creation_committed: bool,
-    // A legacy default is not proof of an interrupted creation.
-    pub(crate) bucket_creation_commit_record_present: bool,
     pub policy_config_json: Vec<u8>,
     pub notification_config_xml: Vec<u8>,
     pub lifecycle_config_xml: Vec<u8>,
@@ -608,13 +609,13 @@ pub struct BucketMetadata {
 
     pub policy_config: Option<BucketPolicy>,
     pub notification_config: Option<NotificationConfiguration>,
-    pub lifecycle_config: Option<PersistedLifecycleConfiguration>,
+    pub lifecycle_config: Option<BucketLifecycleConfiguration>,
     pub object_lock_config: Option<ObjectLockConfiguration>,
     pub versioning_config: Option<VersioningConfiguration>,
     pub sse_config: Option<ServerSideEncryptionConfiguration>,
     pub tagging_config: Option<Tagging>,
     pub quota_config: Option<BucketQuota>,
-    pub replication_config: Option<PersistedReplicationConfiguration>,
+    pub replication_config: Option<ReplicationConfiguration>,
     pub bucket_target_config: Option<BucketTargets>,
     pub bucket_target_config_meta: Option<HashMap<String, String>>,
     pub cors_config: Option<CORSConfiguration>,
@@ -635,7 +636,6 @@ impl Default for BucketMetadata {
             bucket_incarnation_id: Uuid::nil(),
             bucket_incarnation_sidecar: false,
             bucket_creation_committed: false,
-            bucket_creation_commit_record_present: false,
             policy_config_json: Default::default(),
             notification_config_xml: Default::default(),
             lifecycle_config_xml: Default::default(),
@@ -874,10 +874,7 @@ impl BucketMetadata {
                 "TableBucketConfigUpdatedAt" => self.table_bucket_config_updated_at = read_msgp_time_value(rd)?,
                 "DurabilityConfigUpdatedAt" => self.durability_config_updated_at = read_msgp_time_value(rd)?,
                 "OnDemandMigrationConfigUpdatedAt" => self.on_demand_migration_config_updated_at = read_msgp_time_value(rd)?,
-                "BucketCreationCommitted" => {
-                    self.bucket_creation_committed = read_msgp_bool(rd)?;
-                    self.bucket_creation_commit_record_present = true;
-                }
+                "BucketCreationCommitted" => self.bucket_creation_committed = read_msgp_bool(rd)?,
                 other => {
                     tracing::debug!(field = %other, "BucketMetadata decode_from: skipping unknown field");
                     skip_msgp_value(rd)?;
@@ -890,10 +887,8 @@ impl BucketMetadata {
 
     /// Encode to msgp bytes. Field order follows MinIO BucketMetadata for compatibility.
     pub fn encode_to<W: Write>(&self, wr: &mut W) -> Result<()> {
-        // Preserve the absence of a legacy commit record across config rewrites.
-        let commit_record_present = self.bucket_creation_commit_record_present || self.bucket_creation_committed;
-        // Map size: MinIO fields (25) + RustFS extensions (21) + optional commit record.
-        let map_len: u32 = 46 + u32::from(commit_record_present);
+        // Map size: MinIO fields (25) + RustFS extensions (22)
+        let map_len: u32 = 47;
         rmp::encode::write_map_len(wr, map_len)?;
 
         // MinIO field order (same as Go struct)
@@ -974,10 +969,8 @@ impl BucketMetadata {
         write_msgp_time(wr, self.durability_config_updated_at)?;
         rmp::encode::write_str(wr, "OnDemandMigrationConfigUpdatedAt")?;
         write_msgp_time(wr, self.on_demand_migration_config_updated_at)?;
-        if commit_record_present {
-            rmp::encode::write_str(wr, "BucketCreationCommitted")?;
-            rmp::encode::write_bool(wr, self.bucket_creation_committed)?;
-        }
+        rmp::encode::write_str(wr, "BucketCreationCommitted")?;
+        rmp::encode::write_bool(wr, self.bucket_creation_committed)?;
 
         Ok(())
     }
@@ -1154,11 +1147,9 @@ impl BucketMetadata {
                     None
                 } else {
                     let config = deserialize::<VersioningConfiguration>(&data)?;
-                    if config
-                        .status
-                        .as_ref()
-                        .is_some_and(|status| !matches!(status.as_str(), "Enabled" | "Suspended"))
-                    {
+                    if config.status.as_ref().is_some_and(|status| {
+                        !matches!(status.as_str(), BucketVersioningStatus::ENABLED | BucketVersioningStatus::SUSPENDED)
+                    }) {
                         return Err(Error::other("bucket versioning configuration has an invalid status"));
                     }
                     Some(config)
@@ -1171,7 +1162,7 @@ impl BucketMetadata {
                 let config = if data.is_empty() {
                     None
                 } else {
-                    let config = deserialize::<PersistedReplicationConfiguration>(&data)?;
+                    let config = deserialize::<ReplicationConfiguration>(&data)?;
                     if let Some(field) = invalid_replication_config_status_field(&config) {
                         return Err(Error::other(format!("replication field {field} has an invalid status")));
                     }
@@ -1365,8 +1356,8 @@ impl BucketMetadata {
         }
         self.lifecycle_config = None;
         if !self.lifecycle_config_xml.is_empty()
-            && let Err(e) = deserialize::<PersistedLifecycleConfiguration>(&self.lifecycle_config_xml)
-                .map(|c| self.lifecycle_config = Some(c))
+            && let Err(e) =
+                deserialize::<BucketLifecycleConfiguration>(&self.lifecycle_config_xml).map(|c| self.lifecycle_config = Some(c))
         {
             tracing::warn!(
                 event = "bucket_metadata_parse_failed",
@@ -1452,8 +1443,8 @@ impl BucketMetadata {
         }
         self.replication_config = None;
         if !self.replication_config_xml.is_empty()
-            && let Err(e) = deserialize::<PersistedReplicationConfiguration>(&self.replication_config_xml)
-                .map(|c| self.replication_config = Some(c))
+            && let Err(e) =
+                deserialize::<ReplicationConfiguration>(&self.replication_config_xml).map(|c| self.replication_config = Some(c))
         {
             tracing::warn!(
                 event = "bucket_metadata_parse_failed",
@@ -1833,13 +1824,6 @@ mod test {
         let mut bm = BucketMetadata::unmarshal(&body[4..]).expect("unmarshal recovered blob");
         assert_eq!(bm.name, "interop");
         assert!(!bm.bucket_creation_committed, "legacy metadata must default to uncommitted");
-        assert!(!bm.bucket_creation_commit_record_present, "legacy metadata has no creation-commit record");
-        let rewritten = BucketMetadata::unmarshal(&bm.marshal_msg().expect("rewrite legacy metadata"))
-            .expect("read rewritten legacy metadata");
-        assert!(
-            !rewritten.bucket_creation_commit_record_present,
-            "rewriting legacy metadata must not fabricate a creation intent"
-        );
         bm.parse_all_configs().expect("parse recovered configs");
         assert!(bm.lifecycle_config.is_some());
     }
@@ -1857,7 +1841,6 @@ mod test {
 
         assert_eq!(bm.name, new.name);
         assert!(new.bucket_creation_committed);
-        assert!(new.bucket_creation_commit_record_present);
         assert!(!bm.bucket_incarnation_id.is_nil());
         assert_eq!(bm.bucket_incarnation_id, new.bucket_incarnation_id);
     }
@@ -1929,7 +1912,7 @@ mod test {
 
     #[test]
     fn persisted_bucket_tags_keep_separate_s3_and_swift_limits() {
-        use rustfs_gateway_types::cors_tagging::PersistedTag as Tag;
+        use s3s::dto::Tag;
 
         let tag = |key: String, value: &str| Tag {
             key: Some(key),
@@ -2021,15 +2004,17 @@ mod test {
 
     #[test]
     fn object_locking_requires_lock_metadata_not_plain_versioning() {
+        use s3s::dto::ObjectLockEnabled;
+
         let mut bm = BucketMetadata::new("test-bucket");
         bm.versioning_config = Some(VersioningConfiguration {
-            status: Some("Enabled".to_owned()),
+            status: Some(s3s::dto::BucketVersioningStatus::from_static("Enabled")),
             ..Default::default()
         });
         assert!(!bm.object_locking());
 
         bm.object_lock_config = Some(ObjectLockConfiguration {
-            object_lock_enabled: Some("Enabled".to_owned()),
+            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
             ..Default::default()
         });
         assert!(bm.object_locking());

crates/ecstore/src/bucket/metadata_sys.rs

@@ -31,18 +31,14 @@ use crate::storage_api_contracts::heal::HealOperations as _;
 use crate::storage_api_contracts::namespace::NamespaceLocking as _;
 use crate::store::{ECStore, await_bucket_namespace_operation};
 use futures::future::join_all;
-use rustfs_gateway_types::cors_tagging::{PersistedCorsConfiguration as CORSConfiguration, PersistedTagging as Tagging};
-use rustfs_gateway_types::persistence::{
-    PersistedAccelerateConfiguration as AccelerateConfiguration,
-    PersistedBucketEncryptionConfiguration as ServerSideEncryptionConfiguration,
-    PersistedBucketLoggingStatus as BucketLoggingStatus, PersistedLifecycleConfiguration,
-    PersistedNotificationConfiguration as NotificationConfiguration, PersistedObjectLockConfiguration as ObjectLockConfiguration,
-    PersistedPublicAccessBlockConfiguration as PublicAccessBlockConfiguration, PersistedReplicationConfiguration,
-    PersistedRequestPaymentConfiguration as RequestPaymentConfiguration,
-    PersistedVersioningConfiguration as VersioningConfiguration, PersistedWebsiteConfiguration as WebsiteConfiguration,
-};
 use rustfs_heal_contracts::heal_channel::HealOpts;
 use rustfs_policy::policy::BucketPolicy;
+use s3s::dto::ReplicationConfiguration;
+use s3s::dto::{
+    AccelerateConfiguration, BucketLifecycleConfiguration, BucketLoggingStatus, CORSConfiguration, NotificationConfiguration,
+    ObjectLockConfiguration, ObjectLockEnabled, ObjectLockRetentionMode, PublicAccessBlockConfiguration,
+    RequestPaymentConfiguration, ServerSideEncryptionConfiguration, Tagging, VersioningConfiguration, WebsiteConfiguration,
+};
 use std::collections::HashSet;
 use std::time::Duration;
 use std::{
@@ -173,7 +169,7 @@ pub(crate) fn object_lock_config_state_from_authoritative_metadata(bm: &BucketMe
     if bm.lock_enabled {
         return Ok(ObjectLockConfigState::Configured {
             config: ObjectLockConfiguration {
-                object_lock_enabled: Some("Enabled".to_owned()),
+                object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
                 rule: None,
             },
             updated_at: bm.object_lock_config_updated_at,
@@ -217,10 +213,17 @@ pub(crate) fn configured_object_lock_state_for_tests(
 ) -> ObjectLockConfigState {
     ObjectLockConfigState::Configured {
         config: ObjectLockConfiguration {
-            object_lock_enabled: Some("Enabled".to_owned()),
-            rule: Some(rustfs_gateway_types::persistence::PersistedObjectLockRule {
-                default_retention: Some(rustfs_gateway_types::persistence::PersistedDefaultRetention {
-                    mode: Some(mode.as_str().to_owned()),
+            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
+            rule: Some(s3s::dto::ObjectLockRule {
+                default_retention: Some(s3s::dto::DefaultRetention {
+                    mode: Some(s3s::dto::ObjectLockRetentionMode::from_static(match mode {
+                        crate::bucket::object_lock::types::RetentionMode::Governance => {
+                            s3s::dto::ObjectLockRetentionMode::GOVERNANCE
+                        }
+                        crate::bucket::object_lock::types::RetentionMode::Compliance => {
+                            s3s::dto::ObjectLockRetentionMode::COMPLIANCE
+                        }
+                    })),
                     days: Some(days),
                     years: None,
                 }),
@@ -231,7 +234,7 @@ pub(crate) fn configured_object_lock_state_for_tests(
 }
 
 fn validate_authoritative_object_lock_config(config: &ObjectLockConfiguration) -> Result<()> {
-    if config.object_lock_enabled.as_deref() != Some("Enabled") {
+    if config.object_lock_enabled.as_ref().map(ObjectLockEnabled::as_str) != Some(ObjectLockEnabled::ENABLED) {
         return Err(Error::other("persisted bucket Object Lock enabled state is invalid"));
     }
 
@@ -244,7 +247,7 @@ fn validate_authoritative_object_lock_config(config: &ObjectLockConfiguration) -
     if !retention
         .mode
         .as_ref()
-        .is_some_and(|mode| matches!(mode.as_str(), "COMPLIANCE" | "GOVERNANCE"))
+        .is_some_and(|mode| matches!(mode.as_str(), ObjectLockRetentionMode::COMPLIANCE | ObjectLockRetentionMode::GOVERNANCE))
     {
         return Err(Error::other("persisted bucket Object Lock retention mode is invalid"));
     }
@@ -1638,7 +1641,7 @@ pub async fn get_public_access_block_config(bucket: &str) -> Result<(PublicAcces
     bucket_meta_sys.get_public_access_block_config(bucket).await
 }
 
-pub async fn get_lifecycle_config(bucket: &str) -> Result<(PersistedLifecycleConfiguration, OffsetDateTime)> {
+pub async fn get_lifecycle_config(bucket: &str) -> Result<(BucketLifecycleConfiguration, OffsetDateTime)> {
     let bucket_meta_sys_lock = get_bucket_metadata_sys()?;
     let bucket_meta_sys = bucket_meta_sys_lock.read().await;
 
@@ -1914,7 +1917,7 @@ pub(crate) async fn get_cached_quota_config_and_incarnation_in(
     bucket_meta_sys.cached_quota_config_and_incarnation(bucket).await
 }
 
-pub async fn get_replication_config(bucket: &str) -> Result<(PersistedReplicationConfiguration, OffsetDateTime)> {
+pub async fn get_replication_config(bucket: &str) -> Result<(ReplicationConfiguration, OffsetDateTime)> {
     let bucket_meta_sys_lock = get_bucket_metadata_sys()?;
     let bucket_meta_sys = bucket_meta_sys_lock.read().await;
 
@@ -1924,7 +1927,7 @@ pub async fn get_replication_config(bucket: &str) -> Result<(PersistedReplicatio
 pub(crate) async fn get_replication_config_in(
     ctx: &crate::runtime::instance::InstanceContext,
     bucket: &str,
-) -> Result<(PersistedReplicationConfiguration, OffsetDateTime)> {
+) -> Result<(ReplicationConfiguration, OffsetDateTime)> {
     let bucket_meta_sys_lock = bucket_metadata_sys_of(ctx)?;
     let bucket_meta_sys = bucket_meta_sys_lock.read().await;
 
@@ -2062,27 +2065,9 @@ pub(crate) fn current_local_meta_mutation_gen() -> u64 {
 
 type LocalAuthorityCache = Arc<StdMutex<HashMap<String, (u64, Arc<BucketMetadata>)>>>;
 
-#[derive(Debug, Clone)]
-pub(crate) struct PendingBucketCreationProof {
-    pub(crate) generation: Uuid,
-    pub(crate) intent: Vec<u8>,
-    pub(crate) versioning_requested: bool,
-    pub(crate) witnesses: Vec<crate::disk::os::NativeBucketCreationWitness>,
-}
-
-impl PendingBucketCreationProof {
-    pub(crate) fn matches_metadata(&self, metadata: &BucketMetadata) -> Result<bool> {
-        Ok(!metadata.bucket_creation_committed
-            && metadata.bucket_incarnation_sidecar
-            && metadata.bucket_incarnation_id == self.generation
-            && metadata.marshal_msg()? == self.intent)
-    }
-}
-
 #[derive(Debug, Clone)]
 pub struct BucketMetadataSys {
     metadata_map: Arc<RwLock<HashMap<String, Arc<BucketMetadata>>>>,
-    pending_bucket_creations: Arc<RwLock<HashMap<String, PendingBucketCreationProof>>>,
     local_authority_cache: LocalAuthorityCache,
     /// Serializes metadata-map commits and their derived cache updates for one
     /// bucket. Namespace locks, when present, are acquired before this lock.
@@ -2127,7 +2112,6 @@ impl BucketMetadataSys {
     pub fn new(api: Arc<ECStore>) -> Self {
         Self {
             metadata_map: Arc::new(RwLock::new(HashMap::new())),
-            pending_bucket_creations: Arc::new(RwLock::new(HashMap::new())),
             local_authority_cache: Arc::new(StdMutex::new(HashMap::new())),
             metadata_publish_locks: Arc::new(MetadataPublishLockRegistry {
                 locks: StdMutex::new(HashMap::new()),
@@ -2159,81 +2143,6 @@ impl BucketMetadataSys {
             .expect("bucket metadata object store should still be live")
     }
 
-    pub(crate) async fn pending_bucket_creation(&self, bucket: &str) -> Option<PendingBucketCreationProof> {
-        self.pending_bucket_creations.read().await.get(bucket).cloned()
-    }
-
-    pub(crate) async fn grant_pending_bucket_creation(&self, bucket: &str, proof: PendingBucketCreationProof) {
-        self.pending_bucket_creations.write().await.insert(bucket.to_owned(), proof);
-    }
-
-    pub(crate) async fn revoke_pending_bucket_creation(&self, bucket: &str) {
-        self.pending_bucket_creations.write().await.remove(bucket);
-    }
-
-    pub(crate) async fn consume_pending_bucket_creation(
-        &self,
-        bucket: &str,
-        metadata: &BucketMetadata,
-        witnesses: &[crate::disk::os::NativeBucketCreationWitness],
-    ) -> Result<bool> {
-        let mut pending = self.pending_bucket_creations.write().await;
-        let Some(proof) = pending.get(bucket) else {
-            return Ok(false);
-        };
-        if !proof.matches_metadata(metadata)?
-            || proof.witnesses.len() != witnesses.len()
-            || !proof
-                .witnesses
-                .iter()
-                .zip(witnesses)
-                .all(|(old, current)| old.matches(current))
-            || !crate::disk::os::consume_native_creation_witnesses(witnesses)
-        {
-            return Ok(false);
-        }
-        pending.remove(bucket);
-        Ok(true)
-    }
-
-    #[cfg(test)]
-    pub(crate) async fn refresh_bucket_for_test(&self, bucket: &str) -> Result<()> {
-        let expected = self.metadata_map.read().await.get(bucket).cloned();
-        let lock = self.object_store().new_ns_lock(bucket, bucket).await?;
-        let guard = lock.get_read_lock(crate::set_disk::get_lock_acquire_timeout()).await?;
-        self.load_bucket_under_namespace(bucket, MetadataLoadMode::Refresh, expected.as_ref(), &guard)
-            .await
-    }
-
-    #[cfg(test)]
-    pub(crate) async fn publish_persisted_metadata_for_test(&self, bucket: &str) -> Result<()> {
-        let expected = self.metadata_map.read().await.get(bucket).cloned();
-        let lock = self.object_store().new_ns_lock(bucket, bucket).await?;
-        let guard = lock.get_read_lock(crate::set_disk::get_lock_acquire_timeout()).await?;
-        let (metadata, persisted) = await_bucket_namespace_operation(
-            Some(&guard),
-            bucket,
-            "test cached metadata load",
-            load_bucket_metadata_parse_with_presence(self.object_store(), bucket, true),
-        )
-        .await?;
-        self.publish_if_unchanged(bucket, expected.as_ref(), metadata, persisted, &guard)
-            .await
-    }
-
-    #[cfg(test)]
-    pub(crate) async fn migrate_bucket_creation_commit_for_test(&self, bucket: &str) -> Result<()> {
-        self.migrate_bucket_creation_commit(bucket).await.map(|_| ())
-    }
-
-    #[cfg(test)]
-    pub(crate) async fn legacy_migration_reports_missing_bucket_for_test(&self, bucket: &str) -> Result<bool> {
-        Ok(matches!(
-            self.migrate_legacy_metadata(bucket).await?,
-            BucketMetadataAuthority::MissingBucket
-        ))
-    }
-
     fn object_store_if_live(&self) -> Option<Arc<ECStore>> {
         self.api.upgrade()
     }
@@ -2433,7 +2342,6 @@ impl BucketMetadataSys {
         expected: Option<&Arc<BucketMetadata>>,
         namespace_guard: &rustfs_lock::NamespaceLockGuard,
     ) -> Result<()> {
-        self.revoke_pending_bucket_creation(bucket).await;
         if !await_bucket_namespace_operation(
             Some(namespace_guard),
             bucket,
@@ -2517,7 +2425,6 @@ impl BucketMetadataSys {
         persisted: bool,
         namespace_guard: &rustfs_lock::NamespaceLockGuard,
     ) -> Result<()> {
-        self.revoke_pending_bucket_creation(bucket).await;
         if !persisted {
             let _publish_guard = self
                 .lock_metadata_publish(bucket, namespace_guard, "refreshed bucket metadata absence publish")
@@ -2579,7 +2486,6 @@ impl BucketMetadataSys {
     }
 
     pub async fn set(&self, bucket: String, bm: Arc<BucketMetadata>) {
-        self.revoke_pending_bucket_creation(&bucket).await;
         bump_local_meta_mutation_gen();
         if !is_meta_bucketname(&bucket) {
             let publish_lock = self.metadata_publish_lock(&bucket);
@@ -2603,7 +2509,6 @@ impl BucketMetadataSys {
         if is_meta_bucketname(bucket) {
             return false;
         }
-        self.revoke_pending_bucket_creation(bucket).await;
         let publish_lock = self.metadata_publish_lock(bucket);
         let _publish_guard = publish_lock.lock().await;
         let mut map = self.metadata_map.write().await;
@@ -2621,7 +2526,6 @@ impl BucketMetadataSys {
     }
 
     async fn _reset(&mut self) {
-        self.pending_bucket_creations.write().await.clear();
         bump_local_meta_mutation_gen();
         let mut map = self.metadata_map.write().await;
         map.clear();
@@ -2761,7 +2665,6 @@ impl BucketMetadataSys {
     /// server's metadata never leaks into the ambient (first) instance.
     pub(crate) async fn persist_and_set(&self, bm: BucketMetadata) -> Result<()> {
         let mut bm = bm;
-        self.revoke_pending_bucket_creation(&bm.name).await;
         bm.save_with_store(self.object_store()).await?;
 
         self.set(bm.name.clone(), Arc::new(bm)).await;
@@ -2770,7 +2673,6 @@ impl BucketMetadataSys {
     }
 
     async fn persist_new_and_set(&self, mut bm: BucketMetadata) -> Result<()> {
-        self.revoke_pending_bucket_creation(&bm.name).await;
         bm.bucket_creation_committed = true;
         bm.save_with_store_committed(self.object_store()).await?;
         save_bucket_incarnation(self.object_store(), &bm.name, bm.bucket_incarnation_id).await?;
@@ -2780,9 +2682,7 @@ impl BucketMetadataSys {
     }
 
     async fn persist_new_bucket_metadata_intent(&self, mut bm: BucketMetadata) -> Result<()> {
-        self.revoke_pending_bucket_creation(&bm.name).await;
         bm.bucket_creation_committed = false;
-        bm.bucket_creation_commit_record_present = true;
         bm.save_with_store(self.object_store()).await?;
         save_bucket_incarnation(self.object_store(), &bm.name, bm.bucket_incarnation_id).await?;
         bm.bucket_incarnation_sidecar = true;
@@ -2792,7 +2692,6 @@ impl BucketMetadataSys {
     }
 
     async fn commit_bucket_metadata(&self, mut bm: BucketMetadata) -> Result<()> {
-        self.revoke_pending_bucket_creation(&bm.name).await;
         bm.parse_all_configs()?;
         bm.bucket_incarnation_sidecar = true;
         // The caller holds the full bucket creation fence (lifecycle, metadata
@@ -2841,7 +2740,6 @@ impl BucketMetadataSys {
         bucket: &str,
         namespace_guard: &rustfs_lock::NamespaceLockGuard,
     ) -> Result<()> {
-        self.revoke_pending_bucket_creation(bucket).await;
         let expected = self.metadata_map.read().await.get(bucket).cloned();
         if !self
             .bucket_exists(bucket, namespace_guard, "peer bucket metadata existence check")
@@ -2898,7 +2796,6 @@ impl BucketMetadataSys {
             #[cfg(test)]
             self.lazy_disk_loads.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
 
-            self.revoke_pending_bucket_creation(bucket).await;
             let lock = self.object_store().new_ns_lock(bucket, bucket).await?;
             let guard = lock.get_read_lock(crate::set_disk::get_lock_acquire_timeout()).await?;
             #[cfg(test)]
@@ -3224,7 +3121,6 @@ impl BucketMetadataSys {
     /// revalidated at write quorum, so a stale snapshot can neither revert an
     /// acknowledged configuration update nor outlive a delete/recreate.
     async fn migrate_bucket_creation_commit(&self, bucket: &str) -> Result<BucketMetadataAuthority> {
-        self.revoke_pending_bucket_creation(bucket).await;
         let transaction_guard = acquire_metadata_transaction_guard(
             self.object_store(),
             bucket,
@@ -3302,7 +3198,6 @@ impl BucketMetadataSys {
         &self,
         bucket: &str,
     ) -> Result<BucketMetadataAuthority> {
-        self.revoke_pending_bucket_creation(bucket).await;
         #[cfg(test)]
         if self.object_lock_disk_read_errors.write().await.remove(bucket) {
             return Err(Error::other(format!("injected Object Lock metadata disk read failure: {bucket}")));
@@ -3525,7 +3420,7 @@ impl BucketMetadataSys {
         }
     }
 
-    pub async fn get_lifecycle_config(&self, bucket: &str) -> Result<(PersistedLifecycleConfiguration, OffsetDateTime)> {
+    pub async fn get_lifecycle_config(&self, bucket: &str) -> Result<(BucketLifecycleConfiguration, OffsetDateTime)> {
         let (bm, _) = self.get_config(bucket).await?;
 
         match ConfigState::of(&bm.lifecycle_config_xml, &bm.lifecycle_config).require(bucket, BUCKET_LIFECYCLE_CONFIG)? {
@@ -3648,7 +3543,7 @@ impl BucketMetadataSys {
         }))
     }
 
-    pub async fn get_replication_config(&self, bucket: &str) -> Result<(PersistedReplicationConfiguration, OffsetDateTime)> {
+    pub async fn get_replication_config(&self, bucket: &str) -> Result<(ReplicationConfiguration, OffsetDateTime)> {
         let (bm, _) = self.get_config(bucket).await?;
 
         if !bm.replication_config_xml.is_empty() && bm.replication_config.is_none() {
@@ -3750,7 +3645,6 @@ mod tests {
     };
     use crate::bucket::target::{BucketTarget, BucketTargetType, Credentials};
     use crate::config::com::read_config;
-    use crate::disk::{DiskAPI as _, RUSTFS_META_TMP_BUCKET};
     use crate::storage_api_contracts::bucket::{BucketOperations as _, DeleteBucketOptions, MakeBucketOptions};
     use byteorder::{ByteOrder as _, LittleEndian};
     use serial_test::serial;
@@ -3805,180 +3699,6 @@ mod tests {
         ),
     ];
 
-    #[tokio::test]
-    #[serial(storage_class_env)]
-    async fn persistence_entry_failures_revoke_pending_creation_before_cache_publish() {
-        let (dirs, store) = isolated_store_over_temp_disks().await;
-        init_bucket_metadata_sys(store.clone(), Vec::new()).await;
-        let sys = bucket_metadata_sys_of(&store.ctx).expect("instance metadata system");
-        let sys = sys.read().await.clone();
-        let options = MakeBucketOptions {
-            lock_enabled: true,
-            ..Default::default()
-        };
-        for entry in ["save", "persist", "persist-new", "commit"] {
-            let bucket = format!("revoke-{entry}-{}", Uuid::new_v4());
-            store.fail_next_bucket_creation_after_intent_for_test(&bucket);
-            store
-                .make_bucket(&bucket, &options)
-                .await
-                .expect_err("stop the real producer before physical publication");
-            sys.pending_bucket_creation(&bucket)
-                .await
-                .expect("the producer must leave a real live creation permission");
-            let (intent, persisted) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
-                .await
-                .expect("read the original producer intent");
-            assert!(persisted, "{entry}: the complete original intent must be persisted");
-            let original_intent = intent.marshal_msg().expect("encode the original intent");
-
-            // Keep the creation fence order used by the real producer.
-            let lifecycle_guard = store
-                .acquire_bucket_lifecycle_write_lock(&bucket)
-                .await
-                .expect("hold the bucket lifecycle fence");
-            let transaction_guard = acquire_bucket_metadata_transaction_lock_in(&store.ctx, &bucket)
-                .await
-                .expect("hold the metadata transaction fence");
-            let namespace_lock = store
-                .new_ns_lock(&bucket, &bucket)
-                .await
-                .expect("create the exact bucket namespace lock");
-            let namespace_guard = namespace_lock
-                .get_write_lock(crate::set_disk::get_lock_acquire_timeout())
-                .await
-                .expect("hold the exact bucket namespace fence");
-
-            // A file at each native staging root causes actual IO to fail before
-            // metadata can reach the cache-publishing set call. Preserve the
-            // original staging directories so no fixture data is discarded.
-            for dir in &dirs {
-                let staging = dir.path().join(RUSTFS_META_TMP_BUCKET);
-                let saved = dir.path().join(".rustfs.sys/revocation-saved-tmp");
-                std::fs::rename(&staging, &saved).expect("preserve the native staging directory");
-                std::fs::write(&staging, b"block metadata staging with a non-directory")
-                    .expect("install an actual non-directory IO obstruction");
-            }
-            let result = match entry {
-                "save" => sys.save(intent).await,
-                "persist" => sys.persist_and_set(intent).await,
-                "persist-new" => sys.persist_new_and_set(intent).await,
-                "commit" => sys.commit_bucket_metadata(intent).await,
-                _ => unreachable!(),
-            };
-            for dir in &dirs {
-                let staging = dir.path().join(RUSTFS_META_TMP_BUCKET);
-                let saved = dir.path().join(".rustfs.sys/revocation-saved-tmp");
-                std::fs::remove_file(&staging).expect("remove only the fixture's staging obstruction");
-                std::fs::rename(&saved, &staging).expect("restore the complete original staging directory");
-            }
-            drop((namespace_guard, transaction_guard, lifecycle_guard));
-            result.expect_err("native persistence must fail before its downstream cache set");
-            assert!(
-                sys.pending_bucket_creation(&bucket).await.is_none(),
-                "{entry}: the entry revoker must retire live permission even when persistence fails"
-            );
-            let (after_failure, present) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
-                .await
-                .expect("read the intent after the failed persistence entry");
-            assert!(present, "{entry}: a failed persistence entry must retain the original metadata");
-            assert_eq!(
-                after_failure
-                    .marshal_msg()
-                    .expect("encode the original intent after persistence failure"),
-                original_intent,
-                "{entry}: native IO failure must not change the original generation or complete intent"
-            );
-            let error = store
-                .make_bucket(&bucket, &options)
-                .await
-                .expect_err("a failed ordinary persistence entry cannot preserve creation permission");
-            assert!(error.to_string().contains("administrator recovery"), "{entry}: {error}");
-            let (after_retry, _) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
-                .await
-                .expect("read the original intent after the rejected retry");
-            assert_eq!(
-                after_retry.marshal_msg().expect("encode the intent after the rejected retry"),
-                original_intent,
-                "{entry}: the rejected retry must preserve the complete original intent"
-            );
-            for disk in store.pools[0].disk_set[0].disks.read().await.iter() {
-                assert!(
-                    matches!(
-                        disk.as_ref().expect("native disk").stat_volume(&bucket).await,
-                        Err(crate::disk::error::DiskError::VolumeNotFound)
-                    ),
-                    "{entry}: failed persistence and the rejected retry must not publish a physical volume"
-                );
-            }
-        }
-    }
-
-    #[tokio::test]
-    #[serial(storage_class_env)]
-    async fn metadata_reset_revokes_real_pending_creation_without_changing_persisted_intent() {
-        let (_dirs, store) = isolated_store_over_temp_disks().await;
-        init_bucket_metadata_sys(store.clone(), Vec::new()).await;
-        let bucket = format!("revoke-reset-{}", Uuid::new_v4());
-        let options = MakeBucketOptions {
-            lock_enabled: true,
-            ..Default::default()
-        };
-        store.fail_next_bucket_creation_after_intent_for_test(&bucket);
-        store
-            .make_bucket(&bucket, &options)
-            .await
-            .expect_err("stop the real producer before physical publication");
-        let sys = bucket_metadata_sys_of(&store.ctx).expect("instance metadata system");
-        let mut sys = sys.read().await.clone();
-        sys.pending_bucket_creation(&bucket)
-            .await
-            .expect("the real producer must leave live creation permission before reset");
-        let (intent, persisted) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
-            .await
-            .expect("read the original intent before cache reset");
-        assert!(persisted, "cache reset starts from a complete real persisted intent");
-        let original_intent = intent.marshal_msg().expect("encode the original reset intent");
-        sys._reset().await;
-        assert!(
-            sys.pending_bucket_creation(&bucket).await.is_none(),
-            "reset must revoke the producer-issued permission shared with the instance metadata system"
-        );
-        let (after_reset, present) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
-            .await
-            .expect("read the original intent after cache reset");
-        assert!(present, "cache reset must retain the persisted intent");
-        assert_eq!(
-            after_reset.marshal_msg().expect("encode the intent after cache reset"),
-            original_intent,
-            "cache reset must leave the original generation and complete persisted intent unchanged"
-        );
-        let error = store
-            .make_bucket(&bucket, &options)
-            .await
-            .expect_err("reset cannot regrant the producer's old creation permission");
-        assert!(error.to_string().contains("administrator recovery"), "{error}");
-        let (after_retry, _) = get_config_from_disk_with_presence_in(&store.ctx, &bucket)
-            .await
-            .expect("read the intent after the reset-induced retry rejection");
-        assert_eq!(
-            after_retry
-                .marshal_msg()
-                .expect("encode the intent after the rejected reset retry"),
-            original_intent,
-            "the reset-induced rejection must preserve the original complete intent"
-        );
-        for disk in store.pools[0].disk_set[0].disks.read().await.iter() {
-            assert!(
-                matches!(
-                    disk.as_ref().expect("native disk").stat_volume(&bucket).await,
-                    Err(crate::disk::error::DiskError::VolumeNotFound)
-                ),
-                "cache reset and the rejected retry must not publish a physical volume"
-            );
-        }
-    }
-
     #[tokio::test]
     async fn g_d3_003_new_writer_replication_loads_without_fail_closed_state() {
         let (dirs, store) = isolated_store_over_temp_disks().await;
@@ -4167,7 +3887,7 @@ mod tests {
         let mut versioned = BucketMetadata::new("authoritative-versioned");
         versioned.versioning_config_xml = b"<VersioningConfiguration><Status>Enabled</Status></VersioningConfiguration>".to_vec();
         versioned.versioning_config = Some(VersioningConfiguration {
-            status: Some("Enabled".to_owned()),
+            status: Some(s3s::dto::BucketVersioningStatus::from_static(s3s::dto::BucketVersioningStatus::ENABLED)),
             ..Default::default()
         });
         sys.set("authoritative-versioned".to_string(), Arc::new(versioned)).await;
@@ -4290,24 +4010,25 @@ mod tests {
         else {
             panic!("legacy lock-enabled metadata must remain configured");
         };
-        assert_eq!(config.object_lock_enabled.as_deref(), Some("Enabled"));
+        assert_eq!(
+            config.object_lock_enabled.as_ref().map(|value| value.as_str()),
+            Some(ObjectLockEnabled::ENABLED)
+        );
         assert!(config.rule.is_none());
     }
 
     #[test]
     fn authoritative_object_lock_state_rejects_invalid_retention_periods() {
-        use rustfs_gateway_types::persistence::{
-            PersistedDefaultRetention as DefaultRetention, PersistedObjectLockRule as ObjectLockRule,
-        };
+        use s3s::dto::{DefaultRetention, ObjectLockRule};
 
         for (days, years) in [(Some(0), None), (Some(-1), None), (Some(1), Some(1)), (None, None)] {
             let mut metadata = BucketMetadata::new("invalid-object-lock");
             metadata.object_lock_config = Some(ObjectLockConfiguration {
-                object_lock_enabled: Some("Enabled".to_owned()),
+                object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
                 rule: Some(ObjectLockRule {
                     default_retention: Some(DefaultRetention {
                         days,
-                        mode: Some("COMPLIANCE".to_owned()),
+                        mode: Some(ObjectLockRetentionMode::from_static(ObjectLockRetentionMode::COMPLIANCE)),
                         years,
                     }),
                 }),
@@ -4322,11 +4043,9 @@ mod tests {
 
     #[test]
     fn authoritative_object_lock_state_rejects_invalid_enabled_mode_and_rule() {
-        use rustfs_gateway_types::persistence::{
-            PersistedDefaultRetention as DefaultRetention, PersistedObjectLockRule as ObjectLockRule,
-        };
+        use s3s::dto::{DefaultRetention, ObjectLockRule};
 
-        for enabled in [None, Some("Disabled".to_string())] {
+        for enabled in [None, Some(ObjectLockEnabled::from("Disabled".to_string()))] {
             let mut metadata = BucketMetadata::new("invalid-object-lock-enabled");
             metadata.lock_enabled = true;
             metadata.object_lock_config = Some(ObjectLockConfiguration {
@@ -4338,11 +4057,11 @@ mod tests {
 
         let mut invalid_mode = BucketMetadata::new("invalid-object-lock-mode");
         invalid_mode.object_lock_config = Some(ObjectLockConfiguration {
-            object_lock_enabled: Some("Enabled".to_owned()),
+            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
             rule: Some(ObjectLockRule {
                 default_retention: Some(DefaultRetention {
                     days: Some(1),
-                    mode: Some("invalid".to_string()),
+                    mode: Some(ObjectLockRetentionMode::from("invalid".to_string())),
                     years: None,
                 }),
             }),
@@ -4351,7 +4070,7 @@ mod tests {
 
         let mut missing_retention = BucketMetadata::new("missing-object-lock-retention");
         missing_retention.object_lock_config = Some(ObjectLockConfiguration {
-            object_lock_enabled: Some("Enabled".to_owned()),
+            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
             rule: Some(ObjectLockRule { default_retention: None }),
         });
         assert!(object_lock_config_state_from_authoritative_metadata(&missing_retention).is_err());
@@ -4361,7 +4080,7 @@ mod tests {
     fn object_lock_ever_enabled_marker_survives_config_removal() {
         let mut metadata = BucketMetadata::new("lock-config-removed");
         let config = ObjectLockConfiguration {
-            object_lock_enabled: Some("Enabled".to_owned()),
+            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
             rule: None,
         };
         metadata
@@ -4379,7 +4098,10 @@ mod tests {
         else {
             panic!("an ever-enabled bucket must remain Object Lock configured");
         };
-        assert_eq!(config.object_lock_enabled.as_deref(), Some("Enabled"));
+        assert_eq!(
+            config.object_lock_enabled.as_ref().map(ObjectLockEnabled::as_str),
+            Some(ObjectLockEnabled::ENABLED)
+        );
     }
 
     #[tokio::test]
@@ -4395,7 +4117,7 @@ mod tests {
 
         let node = Arc::new(RwLock::new(BucketMetadataSys::new(ecstore.clone())));
         let config = ObjectLockConfiguration {
-            object_lock_enabled: Some("Enabled".to_owned()),
+            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
             rule: None,
         };
         update_with_sys(
@@ -5509,7 +5231,7 @@ mod tests {
     #[tokio::test]
     async fn update_config_with_persists_tagging_rewrite_across_disk_reload() {
         use crate::bucket::metadata::BUCKET_TAGGING_CONFIG;
-        use rustfs_gateway_types::cors_tagging::PersistedTag as Tag;
+        use s3s::dto::Tag;
 
         let (dirs, ecstore) = isolated_store_over_temp_disks().await;
 
@@ -5673,7 +5395,7 @@ mod tests {
     #[tokio::test]
     async fn concurrent_update_config_with_calls_do_not_lose_writes() {
         use crate::bucket::metadata::BUCKET_TAGGING_CONFIG;
-        use rustfs_gateway_types::cors_tagging::PersistedTag as Tag;
+        use s3s::dto::Tag;
 
         let (dirs, ecstore) = isolated_store_over_temp_disks().await;
         let sys = Arc::new(RwLock::new(BucketMetadataSys::new(ecstore)));
@@ -5773,7 +5495,7 @@ mod tests {
         let mut persisted = BucketMetadata::new("reload-bucket");
         persisted.policy_config_json = b"persisted-marker".to_vec();
         let lock_config = ObjectLockConfiguration {
-            object_lock_enabled: Some("Enabled".to_owned()),
+            object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
             rule: None,
         };
         persisted
@@ -6107,7 +5829,7 @@ mod tests {
     #[serial]
     async fn bucket_delete_waits_for_config_mutation_fence() {
         use crate::bucket::metadata::BUCKET_TAGGING_CONFIG;
-        use rustfs_gateway_types::cors_tagging::PersistedTag as Tag;
+        use s3s::dto::Tag;
 
         let (_dirs, store) = isolated_store_over_temp_disks().await;
         init_bucket_metadata_sys(store.clone(), Vec::new()).await;

crates/ecstore/src/bucket/migration.rs

@@ -17,7 +17,7 @@
 use crate::bucket::metadata::BUCKET_METADATA_FILE;
 use crate::bucket::replication::ReplicationMigrationBridge;
 use crate::disk::{BUCKET_META_PREFIX, MIGRATING_META_BUCKET, RUSTFS_META_BUCKET};
-use crate::error::{Error, Result, is_err_strict_not_found, is_err_strict_volume_not_found, to_object_err};
+use crate::error::{Error, Result, is_err_strict_not_found, is_err_strict_volume_not_found};
 use crate::object_api::{GetObjectReader, ObjectInfo, ObjectOptions, PutObjReader};
 use crate::storage_api_contracts::{
     bucket::{BucketInfo, BucketOperations, BucketOptions},
@@ -334,14 +334,6 @@ async fn migration_target_exists<S: EcstoreObjectOperations>(store: &S, path: &s
     }
 }
 
-/// Names the target record in a failed migration write, as the existence
-/// probe's error already does. The commit path returns bare disk errors, and on
-/// Windows a blocked record is first seen here: reading through a regular-file
-/// ancestor reports the record missing instead of refusing access to it.
-fn migration_write_error(err: Error, path: &str) -> Error {
-    to_object_err(err, vec![RUSTFS_META_BUCKET, path])
-}
-
 async fn migrate_one_if_missing<S>(
     store: Arc<S>,
     opts: &ObjectOptions,
@@ -377,10 +369,7 @@ where
         .unwrap_or(data);
 
     let mut put_data = PutObjReader::from_vec(data);
-    store
-        .put_object(RUSTFS_META_BUCKET, path, &mut put_data, opts)
-        .await
-        .map_err(|err| migration_write_error(err, path))?;
+    store.put_object(RUSTFS_META_BUCKET, path, &mut put_data, opts).await?;
     info!("Migrated {label}");
     Ok(())
 }
@@ -492,10 +481,7 @@ where
                 Err(_) => return Err(MigrationMetadataError::Incompatible(path.to_owned()).into()),
             };
             let mut put_data = PutObjReader::from_vec(data);
-            store
-                .put_object(RUSTFS_META_BUCKET, path, &mut put_data, &opts)
-                .await
-                .map_err(|err| migration_write_error(err, path))?;
+            store.put_object(RUSTFS_META_BUCKET, path, &mut put_data, &opts).await?;
             info!("Migrated IAM config: {path}");
             total_migrated += 1;
         }
@@ -545,27 +531,6 @@ mod tests {
         ));
     }
 
-    #[test]
-    fn migration_write_errors_name_the_target_record_without_fragmenting_groups() {
-        use super::{Error, migration_write_error};
-
-        let first = migration_write_error(Error::FileAccessDenied, "buckets/first/.metadata.bin");
-        let second = migration_write_error(Error::FileAccessDenied, "config/iam/format.json");
-        assert!(matches!(first, Error::PrefixAccessDenied(..)), "unexpected error: {first:?}");
-        assert!(
-            first.to_string().contains(".rustfs.sys/buckets/first/.metadata.bin"),
-            "the startup error must name the blocked record: {first}"
-        );
-        assert_eq!(first, second, "record paths must not fragment error grouping");
-
-        let unrelated = migration_write_error(Error::other("disk offline"), "buckets/first/.metadata.bin");
-        assert_eq!(
-            unrelated,
-            Error::other("disk offline"),
-            "errors without a record form pass through unchanged"
-        );
-    }
-
     #[test]
     fn migration_errors_group_by_cause_and_retain_typed_record_context() {
         use super::{Error, MigrationMetadataError};

crates/ecstore/src/bucket/object_lock/mod.rs

@@ -17,8 +17,15 @@ pub mod objectlock_sys;
 pub mod types;
 
 /// Whether a bucket Object Lock configuration has locking enabled. The
-/// persisted `ObjectLockConfiguration` implements this in the bucket-metadata
-/// module, which owns the persisted configuration type.
+/// serving-layer `ObjectLockConfiguration` DTO implements this in
+/// the bucket-metadata module, which owns the persisted configuration type
+/// during the s3s ratchet migration (rustfs/backlog#1842).
 pub trait ObjectLockApi {
     fn enabled(&self) -> bool;
 }
+
+/// Whether a legal-hold status value is one of the two valid wire values.
+/// Implemented for the serving-layer DTO in the bucket-metadata module.
+pub trait ObjectLockStatusExt {
+    fn valid(&self) -> bool;
+}

crates/ecstore/src/bucket/replication/replication_config_boundary.rs

@@ -12,7 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-pub use rustfs_replication::config_cache_serde;
 pub use rustfs_replication::{
     ObjectOpts, OperatorRuleContract, REMOTE_TARGET_CAPABILITY_CONTRACT_VERSION, REMOTE_TARGET_READ_ONLY_HISTORICAL_FIELDS,
     REMOTE_TARGET_UNSUPPORTED_FIELDS, REMOTE_TARGET_WRITABLE_FIELDS, REPLICATION_CAPABILITY_CONTRACT_VERSION,

crates/ecstore/src/bucket/replication/replication_lifecycle_bridge.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
+use s3s::dto::ReplicationConfiguration;
 
 use super::replication_config_boundary::ReplicationConfigurationExt as _;
 use super::replication_filemeta_boundary::{
@@ -42,7 +42,7 @@ impl ReplicationLifecycleBridge {
         dead_code,
         reason = "declared boundary surface for the ECStore replication split plan; no caller in this port (backlog#1823)"
     )]
-    pub(crate) fn new_config(config: PersistedReplicationConfiguration) -> ReplicationLifecycleConfig {
+    pub(crate) fn new_config(config: ReplicationConfiguration) -> ReplicationLifecycleConfig {
         ReplicationConfig::new(Some(config), None)
     }
 
@@ -118,17 +118,16 @@ impl ReplicationLifecycleBridge {
 
 #[cfg(test)]
 mod tests {
-    use rustfs_gateway_types::dto::Status;
-    use rustfs_gateway_types::persistence::{PersistedReplicationDestination, PersistedReplicationRule};
+    use s3s::dto::{Destination, ReplicationRule, ReplicationRuleStatus};
 
     use super::super::replication_filemeta_boundary::{ReplicateTargetDecision, VersionPurgeStatusType};
     use super::*;
 
-    fn replication_rule() -> PersistedReplicationRule {
-        PersistedReplicationRule {
+    fn replication_rule() -> ReplicationRule {
+        ReplicationRule {
             delete_marker_replication: None,
             delete_replication: None,
-            destination: PersistedReplicationDestination {
+            destination: Destination {
                 bucket: "arn:aws:s3:::target-bucket".to_string(),
                 ..Default::default()
             },
@@ -138,13 +137,13 @@ mod tests {
             prefix: Some(String::new()),
             priority: Some(1),
             source_selection_criteria: None,
-            status: Status::ENABLED.to_string(),
+            status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
         }
     }
 
     #[test]
     fn has_pending_version_purge_preserves_replication_active_rule_behavior() {
-        let config = ReplicationLifecycleBridge::new_config(PersistedReplicationConfiguration {
+        let config = ReplicationLifecycleBridge::new_config(ReplicationConfiguration {
             role: String::new(),
             rules: vec![replication_rule()],
         });

crates/ecstore/src/bucket/replication/replication_metadata_boundary.rs

@@ -17,8 +17,8 @@ use std::sync::Arc;
 use crate::bucket::{metadata::BucketMetadata, metadata_sys};
 use crate::disk::{BUCKET_META_PREFIX, RUSTFS_META_BUCKET};
 use crate::runtime::instance::InstanceContext;
-use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
 use rustfs_utils::path::path_join_buf;
+use s3s::dto::ReplicationConfiguration;
 use time::OffsetDateTime;
 
 use super::replication_error_boundary::{Error, Result};
@@ -37,11 +37,11 @@ impl ReplicationMetadataStore {
     pub(crate) const FORCE_DELETE_REPLICATION_FILE: &'static str = "config/replication/force-delete.bin";
     pub(crate) const FORCE_DELETE_REPLICATION_TRANSACTION_LOCK: &'static str = "config/replication/force-delete.bin.transaction";
 
-    pub(crate) async fn replication_config(bucket: &str) -> Result<(PersistedReplicationConfiguration, OffsetDateTime)> {
+    pub(crate) async fn replication_config(bucket: &str) -> Result<(ReplicationConfiguration, OffsetDateTime)> {
         metadata_sys::get_replication_config(bucket).await
     }
 
-    pub(crate) async fn optional_replication_config(bucket: &str) -> Result<Option<PersistedReplicationConfiguration>> {
+    pub(crate) async fn optional_replication_config(bucket: &str) -> Result<Option<ReplicationConfiguration>> {
         let config = match Self::replication_config(bucket).await {
             Ok((config, _)) => Some(config),
             Err(err) => {

crates/ecstore/src/bucket/replication/replication_object_config.rs

@@ -16,9 +16,7 @@ use std::{collections::HashMap, fmt, sync::Arc};
 
 use super::replication_filemeta_boundary::metadata_keys;
 use crate::bucket::metadata::BucketMetadata;
-use rustfs_gateway_types::dto::Status;
-use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
-use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
+use s3s::dto::{BucketVersioningStatus, ReplicationConfiguration, ReplicationRuleStatus, VersioningConfiguration};
 use serde::{Deserialize, Serialize};
 use time::OffsetDateTime;
 use tracing::error;
@@ -41,7 +39,7 @@ use super::replication_target_boundary::{BucketTargets, ReplicationTargetStore};
 use super::replication_versioning_boundary::ReplicationVersioningStore;
 use super::runtime_boundary as runtime_sources;
 
-pub(crate) async fn get_replication_config(bucket: &str) -> Result<Option<PersistedReplicationConfiguration>> {
+pub(crate) async fn get_replication_config(bucket: &str) -> Result<Option<ReplicationConfiguration>> {
     let config = ReplicationMetadataStore::optional_replication_config(bucket).await?;
     validate_delete_replication_config(&VersioningConfiguration::default(), config.as_ref())?;
     Ok(config)
@@ -66,7 +64,7 @@ impl DeleteReplicationConfigSnapshot {
     #[cfg(test)]
     pub(crate) fn from_configs_for_test(
         versioning: VersioningConfiguration,
-        replication: Option<PersistedReplicationConfiguration>,
+        replication: Option<ReplicationConfiguration>,
     ) -> Self {
         let metadata = replication.map(|config| {
             let mut metadata = BucketMetadata::new("test-bucket");
@@ -80,7 +78,7 @@ impl DeleteReplicationConfigSnapshot {
         &self.versioning
     }
 
-    pub fn replication_config(&self) -> Option<&PersistedReplicationConfiguration> {
+    pub fn replication_config(&self) -> Option<&ReplicationConfiguration> {
         self.metadata
             .as_ref()
             .and_then(|metadata| metadata.replication_config.as_ref())
@@ -103,7 +101,7 @@ impl DeleteReplicationConfigSnapshot {
     pub(crate) fn active_delete_marker_rules_require_tags(&self, object: &str) -> bool {
         self.replication_config().is_some_and(|config| {
             config.rules.iter().any(|rule| {
-                if rule.status == Status::DISABLED.as_str() {
+                if rule.status == ReplicationRuleStatus::from_static(ReplicationRuleStatus::DISABLED) {
                     return false;
                 }
                 if !object.starts_with(rule.prefix()) {
@@ -124,12 +122,12 @@ impl DeleteReplicationConfigSnapshot {
 
 fn validate_delete_replication_config(
     versioning: &VersioningConfiguration,
-    config: Option<&PersistedReplicationConfiguration>,
+    config: Option<&ReplicationConfiguration>,
 ) -> Result<()> {
     if versioning
         .status
         .as_ref()
-        .is_some_and(|status| !matches!(status.as_str(), "Enabled" | "Suspended"))
+        .is_some_and(|status| !matches!(status.as_str(), BucketVersioningStatus::ENABLED | BucketVersioningStatus::SUSPENDED))
     {
         return Err(super::replication_error_boundary::Error::other(
             "bucket versioning configuration has an invalid status",
@@ -146,7 +144,7 @@ fn validate_delete_replication_config(
         let role = config.role.trim();
         let mut role_destination = None;
         for rule in &config.rules {
-            if rule.status.as_str() == Status::ENABLED.as_str() {
+            if rule.status.as_str() == ReplicationRuleStatus::ENABLED {
                 let destination = rule.destination.bucket.trim();
                 if role.is_empty() && destination.is_empty() {
                     return Err(super::replication_error_boundary::Error::other(
@@ -171,7 +169,7 @@ fn validate_delete_replication_config(
     Ok(())
 }
 
-fn replication_config_from_metadata(metadata: &BucketMetadata) -> Result<Option<&PersistedReplicationConfiguration>> {
+fn replication_config_from_metadata(metadata: &BucketMetadata) -> Result<Option<&ReplicationConfiguration>> {
     if !metadata.replication_config_xml.is_empty() && metadata.replication_config.is_none() {
         return Err(super::replication_error_boundary::Error::other(
             "persisted bucket replication configuration is invalid",
@@ -252,15 +250,12 @@ pub(crate) async fn load_delete_replication_config_in(
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct ReplicationConfig {
-    /// Carried in the scanner's persisted data usage cache, so its serde form
-    /// is the one the s3s DTO wrote there (see `config_cache_serde` in the replication crate).
-    #[serde(with = "super::replication_config_boundary::config_cache_serde")]
-    pub config: Option<PersistedReplicationConfiguration>,
+    pub config: Option<ReplicationConfiguration>,
     pub remotes: Option<BucketTargets>,
 }
 
 impl ReplicationConfig {
-    pub fn new(config: Option<PersistedReplicationConfiguration>, remotes: Option<BucketTargets>) -> Self {
+    pub fn new(config: Option<ReplicationConfiguration>, remotes: Option<BucketTargets>) -> Self {
         Self { config, remotes }
     }
 
@@ -473,7 +468,7 @@ fn check_replicate_delete_with_config(
     oi: &ObjectInfo,
     del_opts: &ObjectOptions,
     source_error: bool,
-    config: Option<&PersistedReplicationConfiguration>,
+    config: Option<&ReplicationConfiguration>,
     existing_delete_marker: bool,
     trust_persisted_replica_status: bool,
 ) -> ReplicateDecision {
@@ -592,7 +587,7 @@ pub(crate) async fn must_replicate(bucket: &str, object: &str, mopts: MustReplic
 }
 
 fn metadata_target_should_replicate(
-    cfg: &PersistedReplicationConfiguration,
+    cfg: &ReplicationConfiguration,
     opts: &ObjectOpts,
     mopts: &MustReplicateOptions,
     arn: &str,
@@ -602,21 +597,20 @@ fn metadata_target_should_replicate(
 
 #[cfg(test)]
 mod tests {
-    use rustfs_gateway_types::dto::Status;
-    use rustfs_gateway_types::persistence::{
-        PersistedOptionalReplicationStatus, PersistedReplicationDestination, PersistedReplicationFilter,
-        PersistedReplicationRule, PersistedReplicationStatus, PersistedReplicationTag, PersistedSourceSelectionCriteria,
+    use s3s::dto::{
+        DeleteMarkerReplication, DeleteMarkerReplicationStatus, DeleteReplication, DeleteReplicationStatus, Destination,
+        ReplicaModifications, ReplicationRule, ReplicationRuleFilter, ReplicationRuleStatus, SourceSelectionCriteria, Tag,
     };
 
     use super::super::replication_filemeta_boundary::VersionPurgeStatusType;
     use super::super::replication_target_boundary::BucketTarget;
     use super::*;
 
-    fn replication_rule() -> PersistedReplicationRule {
-        PersistedReplicationRule {
+    fn replication_rule() -> ReplicationRule {
+        ReplicationRule {
             delete_marker_replication: None,
             delete_replication: None,
-            destination: PersistedReplicationDestination {
+            destination: Destination {
                 bucket: "arn:aws:s3:::target-bucket".to_string(),
                 ..Default::default()
             },
@@ -626,7 +620,7 @@ mod tests {
             prefix: Some(String::new()),
             priority: Some(1),
             source_selection_criteria: None,
-            status: Status::ENABLED.to_string(),
+            status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
         }
     }
 
@@ -635,11 +629,11 @@ mod tests {
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
         let mut rule = replication_rule();
         rule.destination.bucket = arn.to_string();
-        rule.filter = Some(PersistedReplicationFilter {
+        rule.filter = Some(ReplicationRuleFilter {
             prefix: Some("admitted/".to_string()),
             ..Default::default()
         });
-        let cfg = PersistedReplicationConfiguration {
+        let cfg = ReplicationConfiguration {
             role: String::new(),
             rules: vec![rule],
         };
@@ -677,7 +671,7 @@ mod tests {
         assert!(!empty.replicate(&ObjectOpts::default()));
 
         let config = ReplicationConfig::new(
-            Some(PersistedReplicationConfiguration {
+            Some(ReplicationConfiguration {
                 role: String::new(),
                 rules: vec![replication_rule()],
             }),
@@ -731,7 +725,7 @@ mod tests {
     fn delete_snapshot_rejects_enabled_rules_without_a_destination() {
         let mut rule = replication_rule();
         rule.destination.bucket.clear();
-        let config = PersistedReplicationConfiguration {
+        let config = ReplicationConfiguration {
             role: String::new(),
             rules: vec![rule],
         };
@@ -747,7 +741,7 @@ mod tests {
         let first = replication_rule();
         let mut second = replication_rule();
         second.destination.bucket = "arn:aws:s3:::other-target".to_string();
-        let config = PersistedReplicationConfiguration {
+        let config = ReplicationConfiguration {
             role: "arn:aws:s3:::role-target".to_string(),
             rules: vec![first, second],
         };
@@ -758,47 +752,47 @@ mod tests {
     #[test]
     fn delete_snapshot_rejects_unknown_status_values() {
         let invalid_versioning = VersioningConfiguration {
-            status: Some("Enabld".to_string()),
+            status: Some("Enabld".to_string().into()),
             ..Default::default()
         };
         assert!(validate_delete_replication_config(&invalid_versioning, None).is_err());
 
         let mut invalid_rule = replication_rule();
-        invalid_rule.status = "Enabld".to_string();
-        let config = PersistedReplicationConfiguration {
+        invalid_rule.status = "Enabld".to_string().into();
+        let config = ReplicationConfiguration {
             role: String::new(),
             rules: vec![invalid_rule],
         };
         assert!(validate_delete_replication_config(&VersioningConfiguration::default(), Some(&config)).is_err());
 
         let mut invalid_delete = replication_rule();
-        invalid_delete.delete_replication = Some(PersistedReplicationStatus {
-            status: "Enabld".to_string(),
+        invalid_delete.delete_replication = Some(DeleteReplication {
+            status: "Enabld".to_string().into(),
         });
-        let config = PersistedReplicationConfiguration {
+        let config = ReplicationConfiguration {
             role: String::new(),
             rules: vec![invalid_delete],
         };
         assert!(validate_delete_replication_config(&VersioningConfiguration::default(), Some(&config)).is_err());
 
         let mut invalid_delete_marker = replication_rule();
-        invalid_delete_marker.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
-            status: Some("Enabld".to_string()),
+        invalid_delete_marker.delete_marker_replication = Some(DeleteMarkerReplication {
+            status: Some("Enabld".to_string().into()),
         });
-        let config = PersistedReplicationConfiguration {
+        let config = ReplicationConfiguration {
             role: String::new(),
             rules: vec![invalid_delete_marker],
         };
         assert!(validate_delete_replication_config(&VersioningConfiguration::default(), Some(&config)).is_err());
 
         let mut invalid_replica_modifications = replication_rule();
-        invalid_replica_modifications.source_selection_criteria = Some(PersistedSourceSelectionCriteria {
-            replica_modifications: Some(PersistedReplicationStatus {
-                status: "Enabld".to_string(),
+        invalid_replica_modifications.source_selection_criteria = Some(SourceSelectionCriteria {
+            replica_modifications: Some(ReplicaModifications {
+                status: "Enabld".to_string().into(),
             }),
             sse_kms_encrypted_objects: None,
         });
-        let config = PersistedReplicationConfiguration {
+        let config = ReplicationConfiguration {
             role: String::new(),
             rules: vec![invalid_replica_modifications],
         };
@@ -810,11 +804,11 @@ mod tests {
         let mut metadata = BucketMetadata::new("bucket");
         metadata.versioning_config_xml = b"configured".to_vec();
         metadata.versioning_config = Some(VersioningConfiguration {
-            status: Some("Enabled".to_owned()),
+            status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
             ..Default::default()
         });
         metadata.replication_config_xml = b"configured".to_vec();
-        metadata.replication_config = Some(PersistedReplicationConfiguration {
+        metadata.replication_config = Some(ReplicationConfiguration {
             role: String::new(),
             rules: vec![replication_rule()],
         });
@@ -854,7 +848,7 @@ mod tests {
         );
 
         let mut inconsistent = BucketMetadata::new("bucket");
-        inconsistent.replication_config = Some(PersistedReplicationConfiguration {
+        inconsistent.replication_config = Some(ReplicationConfiguration {
             role: String::new(),
             rules: vec![replication_rule()],
         });
@@ -869,11 +863,11 @@ mod tests {
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
         let mut rule = replication_rule();
         rule.destination.bucket = arn.to_string();
-        rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
-            status: Some(Status::ENABLED.to_string()),
+        rule.delete_marker_replication = Some(DeleteMarkerReplication {
+            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::ENABLED)),
         });
         let mut metadata = BucketMetadata::new("bucket");
-        metadata.replication_config = Some(PersistedReplicationConfiguration {
+        metadata.replication_config = Some(ReplicationConfiguration {
             role: String::new(),
             rules: vec![rule],
         });
@@ -904,27 +898,27 @@ mod tests {
     fn delete_marker_source_read_is_required_only_for_tag_filtered_rules() {
         let mut prefix_rule = replication_rule();
         prefix_rule.prefix = Some("logs/".to_string());
-        prefix_rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
-            status: Some(Status::ENABLED.to_string()),
+        prefix_rule.delete_marker_replication = Some(DeleteMarkerReplication {
+            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::ENABLED)),
         });
 
         let prefix_snapshot = DeleteReplicationConfigSnapshot::from_configs_for_test(
             VersioningConfiguration {
-                status: Some("Enabled".to_owned()),
+                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
                 ..Default::default()
             },
-            Some(PersistedReplicationConfiguration {
+            Some(ReplicationConfiguration {
                 role: String::new(),
                 rules: vec![prefix_rule],
             }),
         );
 
         let mut tag_rule = replication_rule();
-        tag_rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
-            status: Some(Status::ENABLED.to_string()),
+        tag_rule.delete_marker_replication = Some(DeleteMarkerReplication {
+            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::ENABLED)),
         });
-        tag_rule.filter = Some(PersistedReplicationFilter {
-            tag: Some(PersistedReplicationTag {
+        tag_rule.filter = Some(ReplicationRuleFilter {
+            tag: Some(Tag {
                 key: Some("class".to_string()),
                 value: Some("audit".to_string()),
             }),
@@ -932,10 +926,10 @@ mod tests {
         });
         let tag_snapshot = DeleteReplicationConfigSnapshot::from_configs_for_test(
             VersioningConfiguration {
-                status: Some("Enabled".to_owned()),
+                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
                 ..Default::default()
             },
-            Some(PersistedReplicationConfiguration {
+            Some(ReplicationConfiguration {
                 role: String::new(),
                 rules: vec![tag_rule],
             }),
@@ -950,14 +944,14 @@ mod tests {
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
         let mut rule = replication_rule();
         rule.destination.bucket = arn.to_string();
-        rule.delete_replication = Some(PersistedReplicationStatus {
-            status: Status::ENABLED.to_string(),
+        rule.delete_replication = Some(DeleteReplication {
+            status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
         });
-        rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
-            status: Some(Status::DISABLED.to_string()),
+        rule.delete_marker_replication = Some(DeleteMarkerReplication {
+            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::DISABLED)),
         });
         let config = ReplicationConfig::new(
-            Some(PersistedReplicationConfiguration {
+            Some(ReplicationConfiguration {
                 role: String::new(),
                 rules: vec![rule],
             }),
@@ -991,22 +985,22 @@ mod tests {
     #[test]
     fn live_delete_does_not_trust_persisted_replica_status() {
         let mut rule = replication_rule();
-        rule.delete_replication = Some(PersistedReplicationStatus {
-            status: Status::ENABLED.to_string(),
+        rule.delete_replication = Some(DeleteReplication {
+            status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
         });
-        rule.source_selection_criteria = Some(PersistedSourceSelectionCriteria {
-            replica_modifications: Some(PersistedReplicationStatus {
-                status: Status::DISABLED.to_string(),
+        rule.source_selection_criteria = Some(SourceSelectionCriteria {
+            replica_modifications: Some(ReplicaModifications {
+                status: s3s::dto::ReplicaModificationsStatus::from_static(s3s::dto::ReplicaModificationsStatus::DISABLED),
             }),
             sse_kms_encrypted_objects: None,
         });
-        let replication = PersistedReplicationConfiguration {
+        let replication = ReplicationConfiguration {
             role: String::new(),
             rules: vec![rule],
         };
         let snapshot = DeleteReplicationConfigSnapshot::from_configs_for_test(
             VersioningConfiguration {
-                status: Some("Enabled".to_owned()),
+                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
                 ..Default::default()
             },
             Some(replication.clone()),
@@ -1042,14 +1036,14 @@ mod tests {
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
         let mut rule = replication_rule();
         rule.destination.bucket = arn.to_string();
-        rule.delete_replication = Some(PersistedReplicationStatus {
-            status: Status::ENABLED.to_string(),
+        rule.delete_replication = Some(DeleteReplication {
+            status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
         });
-        rule.delete_marker_replication = Some(PersistedOptionalReplicationStatus {
-            status: Some(Status::DISABLED.to_string()),
+        rule.delete_marker_replication = Some(DeleteMarkerReplication {
+            status: Some(DeleteMarkerReplicationStatus::from_static(DeleteMarkerReplicationStatus::DISABLED)),
         });
         let config = ReplicationConfig::new(
-            Some(PersistedReplicationConfiguration {
+            Some(ReplicationConfiguration {
                 role: String::new(),
                 rules: vec![rule],
             }),

crates/ecstore/src/bucket/replication/replication_pool.rs

@@ -5074,10 +5074,9 @@ mod tests {
     #[tokio::test]
     async fn heal_queue_marks_missing_versioning_state_as_missed() {
         use super::super::replication_target_boundary::BucketTargets;
-        use rustfs_gateway_types::dto::Status;
-        use rustfs_gateway_types::persistence::{
-            PersistedReplicationConfiguration, PersistedReplicationDestination, PersistedReplicationRule,
-            PersistedReplicationStatus,
+        use s3s::dto::{
+            DeleteReplication, DeleteReplicationStatus, Destination, ReplicationConfiguration, ReplicationRule,
+            ReplicationRuleStatus,
         };
 
         let arn = "arn:rustfs:replication:us-east-1:target:bucket";
@@ -5092,14 +5091,14 @@ mod tests {
                 ..Default::default()
             },
             ReplicationConfig::new(
-                Some(PersistedReplicationConfiguration {
+                Some(ReplicationConfiguration {
                     role: String::new(),
-                    rules: vec![PersistedReplicationRule {
+                    rules: vec![ReplicationRule {
                         delete_marker_replication: None,
-                        delete_replication: Some(PersistedReplicationStatus {
-                            status: Status::ENABLED.to_string(),
+                        delete_replication: Some(DeleteReplication {
+                            status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
                         }),
-                        destination: PersistedReplicationDestination {
+                        destination: Destination {
                             bucket: arn.to_string(),
                             ..Default::default()
                         },
@@ -5109,7 +5108,7 @@ mod tests {
                         prefix: Some(String::new()),
                         priority: Some(1),
                         source_selection_criteria: None,
-                        status: Status::ENABLED.to_string(),
+                        status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
                     }],
                 }),
                 Some(BucketTargets::default()),

crates/ecstore/src/bucket/replication/replication_resyncer.rs

@@ -66,9 +66,9 @@ use super::replication_target_boundary::{
     VersionIdentityCapability, is_replication_target_offline_error, replication_action_for_target_head,
     replication_complete_multipart_options, replication_delete_marker_purge_remove_options, replication_delete_remove_options,
     replication_force_delete_remove_options, replication_object_is_ssec_encrypted, replication_put_object_header_size,
-    replication_put_object_options_for_target, replication_source_etag_is_comparable,
-    replication_target_head_is_newer_null_version, resolve_read_api_version_id, ssec_passthrough_evidence_present,
-    ssec_passthrough_gate, version_identity_capability_from_put, version_identity_drifted,
+    replication_put_object_options, replication_source_etag_is_comparable, replication_target_head_is_newer_null_version,
+    resolve_read_api_version_id, ssec_passthrough_evidence_present, ssec_passthrough_gate, version_identity_capability_from_put,
+    version_identity_drifted,
 };
 use super::replication_versioning_boundary::ReplicationVersioningStore;
 use super::runtime_boundary as runtime_sources;
@@ -85,8 +85,6 @@ use http_body_util::StreamBody;
 use metrics::counter;
 #[cfg(test)]
 use rmp_serde;
-#[cfg(test)]
-use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
 use rustfs_s3_types::EventName;
 use rustfs_utils::http::{
     AMZ_OBJECT_LOCK_LEGAL_HOLD, AMZ_OBJECT_LOCK_MODE, AMZ_OBJECT_LOCK_RETAIN_UNTIL_DATE, AMZ_TAGGING_DIRECTIVE,
@@ -94,6 +92,8 @@ use rustfs_utils::http::{
     insert_str, replication_target_versions,
 };
 use rustfs_utils::{DEFAULT_SIP_HASH_KEY, get_env_usize, sip_hash};
+#[cfg(test)]
+use s3s::dto::ReplicationConfiguration;
 use std::collections::{HashMap, HashSet};
 use std::fmt::Display;
 use std::pin::Pin;
@@ -4813,7 +4813,7 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
         rinfo.size = size;
         rinfo.replication_action = replication_action;
 
-        let (put_opts, is_multipart) = match replication_put_object_options_for_target(&tgt_client, &object_info) {
+        let (put_opts, is_multipart) = match replication_put_object_options(&tgt_client.storage_class, &object_info) {
             Ok((put_opts, is_mp)) => (put_opts, is_mp),
             Err(e) => {
                 // Unsupported source metadata (e.g. managed SSE) is a fail-closed
@@ -5046,7 +5046,7 @@ impl ReplicateObjectInfoExt for ReplicateObjectInfo {
         // The target client has no metadata-only operation. Reuse the existing
         // object transport so metadata changes carry tags and object-lock state
         // atomically with the source version.
-        let (put_opts, is_multipart) = match replication_put_object_options_for_target(&tgt_client, &object_info) {
+        let (put_opts, is_multipart) = match replication_put_object_options(&tgt_client.storage_class, &object_info) {
             Ok((put_opts, is_mp)) => (put_opts, is_mp),
             Err(e) => {
                 fail_replicate_all_put_options(&mut rinfo, &tgt_client, &bucket, object_info, &e, start_time);
@@ -6577,50 +6577,16 @@ mod tests {
         assert_eq!(persisted.targets_map["arn:same"].resync_status, ResyncStatusType::ResyncCompleted);
     }
 
-    use super::super::replication_target_boundary::{BucketTarget, BucketTargets, replication_put_object_options};
+    use super::super::replication_target_boundary::{BucketTarget, BucketTargets};
     use super::*;
-    use rustfs_gateway_types::dto::Status;
-    use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
-    use rustfs_gateway_types::persistence::{
-        PersistedReplicationDestination, PersistedReplicationRule, PersistedReplicationStatus,
+    use s3s::dto::{
+        BucketVersioningStatus, DeleteReplication, DeleteReplicationStatus, Destination, ExcludedPrefix, ReplicationRule,
+        ReplicationRuleStatus, VersioningConfiguration,
     };
     use std::collections::HashMap;
     use time::OffsetDateTime;
     use uuid::Uuid;
 
-    /// Only a site-replication peer is told the source object's KMS key
-    /// name; an operator-configured target gets the `aws:kms` intent alone.
-    #[test]
-    fn replica_write_names_the_kms_key_for_site_replication_peers_only() {
-        use rustfs_utils::http::{AMZ_SERVER_SIDE_ENCRYPTION, AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID};
-
-        let object_info = ObjectInfo {
-            user_defined: HashMap::from([
-                (AMZ_SERVER_SIDE_ENCRYPTION.to_string(), "aws:kms".to_string()),
-                (AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID.to_string(), "finance-key".to_string()),
-            ])
-            .into(),
-            ..Default::default()
-        };
-
-        let mut operator_target = test_target_client("http://127.0.0.1:1".to_string());
-        let (options, _) =
-            replication_put_object_options_for_target(&operator_target, &object_info).expect("put options must build");
-        assert_eq!(options.user_metadata.get(AMZ_SERVER_SIDE_ENCRYPTION), Some(&"aws:kms".to_string()));
-        assert!(!options.user_metadata.contains_key(AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID));
-
-        Arc::get_mut(&mut operator_target)
-            .expect("test target is uniquely owned")
-            .site_peer_deployment_id = "peer-deployment".to_string();
-        let site_peer = operator_target;
-        let (options, _) = replication_put_object_options_for_target(&site_peer, &object_info).expect("put options must build");
-        assert_eq!(options.user_metadata.get(AMZ_SERVER_SIDE_ENCRYPTION), Some(&"aws:kms".to_string()));
-        assert_eq!(
-            options.user_metadata.get(AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID),
-            Some(&"finance-key".to_string())
-        );
-    }
-
     fn test_target_client(endpoint: String) -> Arc<TargetClient> {
         let config = aws_sdk_s3::Config::builder()
             .endpoint_url(endpoint.clone())
@@ -6639,7 +6605,6 @@ mod tests {
             disable_proxy: false,
             arn: format!("arn:rustfs:replication:us-east-1:target:{}", Uuid::new_v4()),
             reset_id: String::new(),
-            site_peer_deployment_id: String::new(),
             secure: false,
             health_check_duration: std::time::Duration::from_secs(5),
             replicate_sync: false,
@@ -8728,7 +8693,7 @@ mod tests {
             ..Default::default()
         };
         let rcfg = ReplicationConfig::new(
-            Some(PersistedReplicationConfiguration {
+            Some(ReplicationConfiguration {
                 role: role.to_string(),
                 rules: vec![],
             }),
@@ -8754,7 +8719,7 @@ mod tests {
         ReplicationVersioningStore::install_prefix_state_test_config(
             &bucket,
             VersioningConfiguration {
-                status: Some("Enabled".to_owned()),
+                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
                 ..Default::default()
             },
         );
@@ -8787,20 +8752,22 @@ mod tests {
         ReplicationVersioningStore::install_prefix_state_test_config(
             &bucket,
             VersioningConfiguration {
-                status: Some("Enabled".to_owned()),
-                excluded_prefixes: Some(vec![Some("archive/".to_string())]),
+                status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
+                excluded_prefixes: Some(vec![ExcludedPrefix {
+                    prefix: Some("archive/".to_string()),
+                }]),
                 ..Default::default()
             },
         );
         let rcfg = ReplicationConfig::new(
-            Some(PersistedReplicationConfiguration {
+            Some(ReplicationConfiguration {
                 role: String::new(),
-                rules: vec![PersistedReplicationRule {
+                rules: vec![ReplicationRule {
                     delete_marker_replication: None,
-                    delete_replication: Some(PersistedReplicationStatus {
-                        status: Status::ENABLED.to_string(),
+                    delete_replication: Some(DeleteReplication {
+                        status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::ENABLED),
                     }),
-                    destination: PersistedReplicationDestination {
+                    destination: Destination {
                         bucket: arn.to_string(),
                         ..Default::default()
                     },
@@ -8810,7 +8777,7 @@ mod tests {
                     prefix: Some(String::new()),
                     priority: Some(1),
                     source_selection_criteria: None,
-                    status: Status::ENABLED.to_string(),
+                    status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
                 }],
             }),
             Some(BucketTargets {
@@ -8846,14 +8813,14 @@ mod tests {
         let admitted_arn = "arn:rustfs:replication:us-east-1:target:admitted";
         let current_role = "arn:rustfs:replication:us-east-1:target:current";
         let rcfg = ReplicationConfig::new(
-            Some(PersistedReplicationConfiguration {
+            Some(ReplicationConfiguration {
                 role: current_role.to_string(),
-                rules: vec![PersistedReplicationRule {
+                rules: vec![ReplicationRule {
                     delete_marker_replication: None,
-                    delete_replication: Some(PersistedReplicationStatus {
-                        status: Status::DISABLED.to_string(),
+                    delete_replication: Some(DeleteReplication {
+                        status: DeleteReplicationStatus::from_static(DeleteReplicationStatus::DISABLED),
                     }),
-                    destination: PersistedReplicationDestination {
+                    destination: Destination {
                         bucket: current_role.to_string(),
                         ..Default::default()
                     },
@@ -8863,7 +8830,7 @@ mod tests {
                     prefix: Some(String::new()),
                     priority: Some(1),
                     source_selection_criteria: None,
-                    status: Status::ENABLED.to_string(),
+                    status: ReplicationRuleStatus::from_static(ReplicationRuleStatus::ENABLED),
                 }],
             }),
             Some(BucketTargets {
@@ -8911,12 +8878,12 @@ mod tests {
     #[tokio::test]
     async fn heal_rejects_semantically_invalid_replication_config() {
         let rcfg = ReplicationConfig::new(
-            Some(PersistedReplicationConfiguration {
+            Some(ReplicationConfiguration {
                 role: String::new(),
-                rules: vec![PersistedReplicationRule {
+                rules: vec![ReplicationRule {
                     delete_marker_replication: None,
                     delete_replication: None,
-                    destination: PersistedReplicationDestination {
+                    destination: Destination {
                         bucket: "arn:rustfs:replication:us-east-1:target:bucket".to_string(),
                         ..Default::default()
                     },
@@ -8926,7 +8893,7 @@ mod tests {
                     prefix: Some(String::new()),
                     priority: Some(1),
                     source_selection_criteria: None,
-                    status: "Enabld".to_owned(),
+                    status: ReplicationRuleStatus::from_static("Enabld"),
                 }],
             }),
             Some(BucketTargets::default()),

crates/ecstore/src/bucket/replication/replication_target_boundary.rs

@@ -225,50 +225,6 @@ impl ReplicationTargetStore {
     }
 }
 
-/// Name the source object's KMS key on a replica write to a site-replication
-/// peer, so the peer seals the replica under its key of the same name.
-///
-/// Sites share bucket default-encryption key names and key-scoped IAM
-/// policies verbatim and are required to hold every key under the same name.
-/// With only the `aws:kms` intent the peer falls back to its bucket or site
-/// default, and an object written under an explicitly named key ends up
-/// sealed under a different key on each site: a caller scoped to the named
-/// key can then read the object on one site and not on the other. Only the
-/// name travels; the envelope and the encryption context stay on the source.
-///
-/// Must not be applied to an operator-configured target, whose KMS has no
-/// reason to hold a key of that name.
-fn name_source_kms_key_for_site_peer(options: &mut PutObjectOptions, object_info: &ObjectInfo) {
-    if !matches!(
-        classify_replication_source_encryption(&object_info.user_defined),
-        ReplicationSourceEncryption::SseKms
-    ) {
-        return;
-    }
-    if let Some(key_id) = metadata_value(&object_info.user_defined, AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID)
-        .map(str::trim)
-        .filter(|key_id| !key_id.is_empty())
-    {
-        options
-            .user_metadata
-            .insert(AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID.to_string(), key_id.to_string());
-    }
-}
-
-/// Put options for replicating `object_info` to `target`: the transport
-/// options every target gets, plus the source KMS key name when the target is
-/// a site-replication peer.
-pub(crate) fn replication_put_object_options_for_target(
-    target: &TargetClient,
-    object_info: &ObjectInfo,
-) -> Result<(PutObjectOptions, bool)> {
-    let (mut options, is_multipart) = replication_put_object_options(&target.storage_class, object_info)?;
-    if target.is_site_replication_peer() {
-        name_source_kms_key_for_site_peer(&mut options, object_info);
-    }
-    Ok((options, is_multipart))
-}
-
 pub(crate) fn replication_put_object_options(sc: &str, object_info: &ObjectInfo) -> Result<(PutObjectOptions, bool)> {
     use base64_simd::STANDARD as BASE64_STANDARD;
     use rustfs_utils::http::{AMZ_CHECKSUM_TYPE, AMZ_CHECKSUM_TYPE_FULL_OBJECT};
@@ -325,9 +281,8 @@ pub(crate) fn replication_put_object_options(sc: &str, object_info: &ObjectInfo)
 
     // Managed SSE replicates as plaintext (the replication reader decrypts via
     // the object-encryption resolver) and re-encrypts on the target with the
-    // target's own KMS. Send only the encryption intent: a key id means
-    // nothing to an arbitrary target's KMS. Site-replication peers are the
-    // exception and get the key name from `name_source_kms_key_for_site_peer`.
+    // target's own KMS. Send only the encryption intent — never the source
+    // key id, whose meaning is local to the source site's KMS.
     if matches!(source_encryption, ReplicationSourceEncryption::SseS3) {
         meta.insert(AMZ_SERVER_SIDE_ENCRYPTION.to_string(), "AES256".to_string());
     } else if matches!(source_encryption, ReplicationSourceEncryption::SseKms) {
@@ -1635,80 +1590,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn site_peer_replica_write_names_the_source_kms_key_only() {
-        use rustfs_utils::http::object_encryption_keys::{
-            INTERNAL_ENCRYPTION_KEY_HEADER, MINIO_INTERNAL_ENCRYPTION_KMS_CONTEXT_HEADER,
-        };
-
-        let object_info = ObjectInfo {
-            user_defined: Arc::new(HashMap::from([
-                (AMZ_SERVER_SIDE_ENCRYPTION.to_string(), "aws:kms".to_string()),
-                (AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID.to_string(), "finance-key".to_string()),
-                (INTERNAL_ENCRYPTION_KEY_HEADER.to_string(), "sealed-envelope".to_string()),
-                (MINIO_INTERNAL_ENCRYPTION_KMS_CONTEXT_HEADER.to_string(), "ctx".to_string()),
-            ])),
-            ..Default::default()
-        };
-
-        let (mut options, _) = replication_put_object_options("", &object_info).expect("managed SSE-KMS must build put options");
-        name_source_kms_key_for_site_peer(&mut options, &object_info);
-
-        assert_eq!(options.user_metadata.get(AMZ_SERVER_SIDE_ENCRYPTION), Some(&"aws:kms".to_string()));
-        assert_eq!(
-            options.user_metadata.get(AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID),
-            Some(&"finance-key".to_string())
-        );
-        // The name is all that travels: no envelope, no encryption context.
-        assert!(!options.user_metadata.contains_key(INTERNAL_ENCRYPTION_KEY_HEADER));
-        assert!(
-            !options
-                .user_metadata
-                .contains_key(MINIO_INTERNAL_ENCRYPTION_KMS_CONTEXT_HEADER)
-        );
-        assert!(!options.user_metadata.values().any(|value| value.contains("sealed-envelope")));
-    }
-
-    #[test]
-    fn site_peer_replica_write_names_no_key_for_other_encryption() {
-        use rustfs_utils::http::object_encryption_keys::INTERNAL_ENCRYPTION_KEY_ID_HEADER;
-
-        for (label, user_defined) in [
-            ("plaintext", HashMap::from([("x-user-meta".to_string(), "value".to_string())])),
-            (
-                // SSE-S3 wraps its data key under the site default key; that
-                // key is internal and is not a name the peer was asked to use.
-                "sse-s3",
-                HashMap::from([
-                    (AMZ_SERVER_SIDE_ENCRYPTION.to_string(), "AES256".to_string()),
-                    (INTERNAL_ENCRYPTION_KEY_ID_HEADER.to_string(), "site-default".to_string()),
-                ]),
-            ),
-            (
-                "sse-kms without a recorded key id",
-                HashMap::from([(AMZ_SERVER_SIDE_ENCRYPTION.to_string(), "aws:kms".to_string())]),
-            ),
-            (
-                "sse-kms with a blank key id",
-                HashMap::from([
-                    (AMZ_SERVER_SIDE_ENCRYPTION.to_string(), "aws:kms".to_string()),
-                    (AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID.to_string(), "  ".to_string()),
-                ]),
-            ),
-        ] {
-            let object_info = ObjectInfo {
-                user_defined: Arc::new(user_defined),
-                ..Default::default()
-            };
-            let (mut options, _) = replication_put_object_options("", &object_info).expect("put options must build");
-            name_source_kms_key_for_site_peer(&mut options, &object_info);
-            assert!(
-                !options.user_metadata.contains_key(AMZ_SERVER_SIDE_ENCRYPTION_KMS_ID),
-                "{label}: no key id may be sent"
-            );
-        }
-    }
-
     #[test]
     fn replication_put_options_rejects_unknown_encryption_without_echoing_metadata() {
         let secret_like_value = "opaque-context-that-must-not-be-logged";

crates/ecstore/src/bucket/replication/replication_target_config_bridge.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use rustfs_gateway_types::persistence::PersistedReplicationConfiguration;
+use s3s::dto::ReplicationConfiguration;
 
 use super::replication_config_boundary::{ObjectOpts, ReplicationConfigurationExt};
 use super::replication_filemeta_boundary::ReplicationType;
@@ -20,7 +20,7 @@ use super::replication_filemeta_boundary::ReplicationType;
 pub(crate) struct ReplicationTargetConfigBridge;
 
 impl ReplicationTargetConfigBridge {
-    pub(crate) fn target_is_used_by_rules(config: &PersistedReplicationConfiguration, arn: &str) -> bool {
+    pub(crate) fn target_is_used_by_rules(config: &ReplicationConfiguration, arn: &str) -> bool {
         config
             .filter_target_arns(&ObjectOpts {
                 op_type: ReplicationType::All,
@@ -37,7 +37,7 @@ mod tests {
 
     #[test]
     fn target_config_bridge_matches_role_target() {
-        let config = PersistedReplicationConfiguration {
+        let config = ReplicationConfiguration {
             role: " arn:target ".to_string(),
             rules: Vec::new(),
         };

crates/ecstore/src/bucket/replication/replication_versioning_boundary.rs

@@ -15,7 +15,7 @@
 use super::replication_error_boundary::Result;
 use crate::bucket::{versioning::VersioningApi as _, versioning_sys::BucketVersioningSys};
 #[cfg(test)]
-use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
+use s3s::dto::VersioningConfiguration;
 #[cfg(test)]
 use std::{collections::HashMap, sync::LazyLock, sync::Mutex};
 

crates/ecstore/src/bucket/tagging/mod.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use rustfs_gateway_types::cors_tagging::PersistedTag as Tag;
+use s3s::dto::Tag;
 use std::cmp::Ordering;
 use std::collections::HashMap;
 use url::form_urlencoded;

crates/ecstore/src/bucket/utils.rs

@@ -15,23 +15,9 @@
 use crate::disk::{MIGRATING_META_BUCKET, RUSTFS_META_BUCKET};
 use crate::error::{Error, Result, StorageError};
 use regex::Regex;
-use rustfs_gateway_types::cors_tagging::{
-    CorsTaggingCodecError, PersistedCorsConfiguration, PersistedTagging, parse_cors, parse_tagging, serialize_cors,
-    serialize_tagging,
-};
-use rustfs_gateway_types::persistence::{
-    PersistedAccelerateConfiguration, PersistedBucketEncryptionConfiguration, PersistedBucketLoggingStatus,
-    PersistedLifecycleConfiguration, PersistedNotificationConfiguration, PersistedObjectLockConfiguration,
-    PersistedPublicAccessBlockConfiguration, PersistedReplicationConfiguration, PersistedRequestPaymentConfiguration,
-    PersistedVersioningConfiguration, PersistedWebsiteConfiguration, PersistenceCodecError, parse_accelerate,
-    parse_bucket_encryption, parse_bucket_logging, parse_lifecycle_legacy_dates, parse_notification, parse_object_lock,
-    parse_public_access_block, parse_replication, parse_request_payment, parse_versioning, parse_website, serialize_accelerate,
-    serialize_bucket_encryption, serialize_bucket_logging, serialize_lifecycle_legacy_dates, serialize_notification,
-    serialize_object_lock, serialize_public_access_block, serialize_replication, serialize_request_payment, serialize_versioning,
-    serialize_website,
-};
 use rustfs_utils::WindowsFileNameError;
 use rustfs_utils::path::SLASH_SEPARATOR;
+use s3s::xml;
 use tracing::instrument;
 
 pub fn is_meta_bucketname(name: &str) -> bool {
@@ -88,173 +74,37 @@ pub fn check_valid_bucket_name_strict(bucket_name: &str) -> Result<()> {
     check_bucket_name_common(bucket_name, true)
 }
 
-/// A bucket configuration persisted as XML in the bucket metadata, together
-/// with the codec that reads and writes its stored bytes.
-///
-/// Every family reads and writes its stored bytes through the gateway
-/// persistence codecs (`rustfs_gateway_types::persistence` and
-/// `rustfs_gateway_types::cors_tagging`, rustfs/backlog#2745). The codecs keep
-/// the persisted bytes the `bucket_config_goldens` pin, so a document the old
-/// s3s codec wrote reads back and re-encodes unchanged.
-pub trait BucketConfigXml: Sized {
-    /// Decodes the stored bytes of one configuration document.
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError>;
-
-    /// Encodes the value as RustFS stores it.
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError>;
+// RUSTFS_COMPAT_TODO(s3gate-metadata-xml): the s3s codec reads persisted XML during migration. Remove after every supported writer uses the gateway codec and every retained metadata object and backup archive is verified or rewritten.
+pub fn deserialize<T>(input: &[u8]) -> xml::DeResult<T>
+where
+    T: for<'xml> xml::Deserialize<'xml>,
+{
+    let mut d = xml::Deserializer::new(input);
+    let ans = T::deserialize(&mut d)?;
+    d.expect_eof()?;
+    Ok(ans)
 }
 
-/// Why a persisted bucket configuration could not be decoded or encoded.
-#[derive(Debug, thiserror::Error)]
-pub enum BucketConfigXmlError {
-    /// A gateway persistence codec refused the bytes or the value.
-    #[error(transparent)]
-    Persisted(#[from] PersistenceCodecError),
-    /// The gateway CORS or Tagging codec refused the bytes or the value.
-    #[error(transparent)]
-    CorsTagging(#[from] CorsTaggingCodecError),
+#[allow(
+    dead_code,
+    reason = "xml serialize helper with no caller in this port; the live sibling is deserialize (backlog#1823)"
+)]
+pub fn serialize_content<T: xml::SerializeContent>(val: &T) -> xml::SerResult<String> {
+    let mut buf = Vec::with_capacity(256);
+    {
+        let mut ser = xml::Serializer::new(&mut buf);
+        val.serialize_content(&mut ser)?;
+    }
+    Ok(String::from_utf8(buf).unwrap())
 }
 
-/// Decodes one persisted bucket configuration document.
-pub fn deserialize<T: BucketConfigXml>(input: &[u8]) -> std::result::Result<T, BucketConfigXmlError> {
-    T::decode_config_xml(input)
-}
-
-/// Encodes one bucket configuration as RustFS persists it.
-pub fn serialize<T: BucketConfigXml>(val: &T) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-    val.encode_config_xml()
-}
-
-impl BucketConfigXml for PersistedReplicationConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_replication(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_replication(self)?)
-    }
-}
-
-impl BucketConfigXml for PersistedLifecycleConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_lifecycle_legacy_dates(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_lifecycle_legacy_dates(self)?)
-    }
-}
-
-// The gateway writers of these families are infallible: a value that exists is
-// always encodable, so only the readers can refuse bytes.
-impl BucketConfigXml for PersistedAccelerateConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_accelerate(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_accelerate(self))
-    }
-}
-
-impl BucketConfigXml for PersistedBucketLoggingStatus {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_bucket_logging(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_bucket_logging(self))
-    }
-}
-
-impl BucketConfigXml for PersistedCorsConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_cors(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_cors(self))
-    }
-}
-
-impl BucketConfigXml for PersistedNotificationConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_notification(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_notification(self))
-    }
-}
-
-impl BucketConfigXml for PersistedObjectLockConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_object_lock(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_object_lock(self))
-    }
-}
-
-impl BucketConfigXml for PersistedPublicAccessBlockConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_public_access_block(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_public_access_block(self))
-    }
-}
-
-impl BucketConfigXml for PersistedRequestPaymentConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_request_payment(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_request_payment(self))
-    }
-}
-
-impl BucketConfigXml for PersistedBucketEncryptionConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_bucket_encryption(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_bucket_encryption(self))
-    }
-}
-
-impl BucketConfigXml for PersistedTagging {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_tagging(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_tagging(self))
-    }
-}
-
-impl BucketConfigXml for PersistedVersioningConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_versioning(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_versioning(self))
-    }
-}
-
-impl BucketConfigXml for PersistedWebsiteConfiguration {
-    fn decode_config_xml(input: &[u8]) -> std::result::Result<Self, BucketConfigXmlError> {
-        Ok(parse_website(input)?)
-    }
-
-    fn encode_config_xml(&self) -> std::result::Result<Vec<u8>, BucketConfigXmlError> {
-        Ok(serialize_website(self))
+pub fn serialize<T: xml::Serialize>(val: &T) -> xml::SerResult<Vec<u8>> {
+    let mut buf = Vec::with_capacity(256);
+    {
+        let mut ser = xml::Serializer::new(&mut buf);
+        val.serialize(&mut ser)?;
     }
+    Ok(buf)
 }
 
 pub fn has_bad_path_component(path: &str) -> bool {
@@ -596,40 +446,6 @@ mod tests {
     use super::*;
     use proptest::prelude::*;
 
-    /// Every bucket-configuration family reads and writes through its own
-    /// gateway codec (rustfs/backlog#2745): the family's golden document
-    /// decodes and re-encodes to the same bytes, and a document of another
-    /// family is refused instead of decoding into an empty configuration.
-    #[test]
-    fn every_bucket_config_family_uses_its_own_gateway_codec() {
-        fn assert_family<T: BucketConfigXml>(family: &str, own: &[u8], foreign: &[u8]) {
-            let value = deserialize::<T>(own).unwrap_or_else(|err| panic!("{family}: own document must decode: {err}"));
-            let encoded = serialize(&value).unwrap_or_else(|err| panic!("{family}: value must encode: {err}"));
-            assert_eq!(encoded, own, "{family}: re-encoding must keep the persisted bytes");
-            assert!(deserialize::<T>(foreign).is_err(), "{family}: a foreign root element must be refused");
-        }
-
-        macro_rules! golden {
-            ($family:literal) => {
-                include_bytes!(concat!("../../tests/fixtures/bucket-config-goldens/", $family, "/minio.out.xml"))
-            };
-        }
-        let tagging = golden!("tagging");
-        let versioning = golden!("versioning");
-
-        assert_family::<PersistedAccelerateConfiguration>("accelerate", golden!("accelerate"), tagging);
-        assert_family::<PersistedBucketLoggingStatus>("logging", golden!("logging"), tagging);
-        assert_family::<PersistedCorsConfiguration>("cors", golden!("cors"), tagging);
-        assert_family::<PersistedNotificationConfiguration>("notification", golden!("notification"), tagging);
-        assert_family::<PersistedObjectLockConfiguration>("object_lock", golden!("object_lock"), tagging);
-        assert_family::<PersistedPublicAccessBlockConfiguration>("public_access_block", golden!("public_access_block"), tagging);
-        assert_family::<PersistedRequestPaymentConfiguration>("request_payment", golden!("request_payment"), tagging);
-        assert_family::<PersistedBucketEncryptionConfiguration>("encryption", golden!("encryption"), tagging);
-        assert_family::<PersistedTagging>("tagging", tagging, versioning);
-        assert_family::<PersistedVersioningConfiguration>("versioning", versioning, tagging);
-        assert_family::<PersistedWebsiteConfiguration>("website", golden!("website"), tagging);
-    }
-
     /// rustfs#5785: keys whose path segments exceed the on-disk NAME_MAX
     /// budget must be rejected up front as ObjectNameInvalid (4xx), not leak
     /// ENAMETOOLONG as InternalError 500 from the disk layer.

crates/ecstore/src/bucket/versioning/mod.rs

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
 use rustfs_utils::string::match_simple;
+use s3s::dto::{BucketVersioningStatus, VersioningConfiguration};
 
 pub trait VersioningApi {
     fn enabled(&self) -> bool;
@@ -28,10 +28,10 @@ pub trait VersioningApi {
 
 impl VersioningApi for VersioningConfiguration {
     fn enabled(&self) -> bool {
-        self.status.as_deref() == Some("Enabled")
+        self.status == Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED))
     }
     fn prefix_enabled(&self, prefix: &str) -> bool {
-        if self.status.as_deref() != Some("Enabled") {
+        if self.status != Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)) {
             return false;
         }
 
@@ -44,10 +44,12 @@ impl VersioningApi for VersioningConfiguration {
         }
 
         if let Some(ref excluded_prefixes) = self.excluded_prefixes {
-            for sprefix in excluded_prefixes.iter().flatten() {
-                let pattern = format!("{sprefix}*");
-                if match_simple(&pattern, prefix) {
-                    return false;
+            for p in excluded_prefixes.iter() {
+                if let Some(ref sprefix) = p.prefix {
+                    let pattern = format!("{sprefix}*");
+                    if match_simple(&pattern, prefix) {
+                        return false;
+                    }
                 }
             }
         }
@@ -56,11 +58,11 @@ impl VersioningApi for VersioningConfiguration {
     }
 
     fn prefix_suspended(&self, prefix: &str) -> bool {
-        if self.status.as_deref() == Some("Suspended") {
+        if self.status == Some(BucketVersioningStatus::from_static(BucketVersioningStatus::SUSPENDED)) {
             return true;
         }
 
-        if self.status.as_deref() == Some("Enabled") {
+        if self.status == Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)) {
             if prefix.is_empty() {
                 return false;
             }
@@ -73,10 +75,12 @@ impl VersioningApi for VersioningConfiguration {
             }
 
             if let Some(ref excluded_prefixes) = self.excluded_prefixes {
-                for sprefix in excluded_prefixes.iter().flatten() {
-                    let pattern = format!("{sprefix}*");
-                    if match_simple(&pattern, prefix) {
-                        return true;
+                for p in excluded_prefixes.iter() {
+                    if let Some(ref sprefix) = p.prefix {
+                        let pattern = format!("{sprefix}*");
+                        if match_simple(&pattern, prefix) {
+                            return true;
+                        }
                     }
                 }
             }
@@ -88,12 +92,14 @@ impl VersioningApi for VersioningConfiguration {
         self.prefix_enabled(prefix) || self.prefix_suspended(prefix)
     }
     fn suspended(&self) -> bool {
-        self.status.as_deref() == Some("Suspended")
+        self.status == Some(BucketVersioningStatus::from_static(BucketVersioningStatus::SUSPENDED))
     }
 }
 
 #[cfg(test)]
 mod tests {
+    use s3s::dto::{BucketVersioningStatus, ExcludedPrefix};
+
     use super::*;
 
     struct LegacyVersioning;
@@ -128,8 +134,10 @@ mod tests {
     #[test]
     fn delete_state_treats_excluded_prefixes_as_unversioned() {
         let config = VersioningConfiguration {
-            status: Some("Enabled".to_owned()),
-            excluded_prefixes: Some(vec![Some("archive/".to_string())]),
+            status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
+            excluded_prefixes: Some(vec![ExcludedPrefix {
+                prefix: Some("archive/".to_string()),
+            }]),
             ..Default::default()
         };
 
@@ -138,7 +146,7 @@ mod tests {
         assert_eq!(config.delete_state("live/object"), (true, false));
 
         let suspended = VersioningConfiguration {
-            status: Some("Suspended".to_owned()),
+            status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::SUSPENDED)),
             ..Default::default()
         };
         assert_eq!(suspended.delete_state("archive/object"), (false, true));

crates/ecstore/src/bucket/versioning_sys.rs

@@ -17,7 +17,7 @@ use super::metadata::unreadable_config_refusal;
 use super::{metadata_sys::get_bucket_metadata_sys, versioning::VersioningApi};
 use crate::disk::RUSTFS_META_BUCKET;
 use crate::error::Result;
-use rustfs_gateway_types::persistence::PersistedVersioningConfiguration as VersioningConfiguration;
+use s3s::dto::VersioningConfiguration;
 use tracing::{error, warn};
 
 pub struct BucketVersioningSys {}
@@ -163,7 +163,7 @@ mod tests {
 
     fn enabled() -> VersioningConfiguration {
         VersioningConfiguration {
-            status: Some("Enabled".to_owned()),
+            status: Some(s3s::dto::BucketVersioningStatus::from_static(s3s::dto::BucketVersioningStatus::ENABLED)),
             ..Default::default()
         }
     }

crates/ecstore/src/cluster/rpc/client.rs

@@ -41,12 +41,8 @@ use std::{
     future::Future,
     io::ErrorKind,
     pin::Pin,
-    sync::{
-        Arc, LazyLock, Mutex,
-        atomic::{AtomicU8, Ordering},
-    },
+    sync::{LazyLock, Mutex},
     task::{Context, Poll},
-    time::Duration,
 };
 use tonic::{service::interceptor::InterceptedService, transport::Channel};
 use tower::Service;
@@ -74,7 +70,7 @@ pub(crate) async fn scanner_control_time_out_client(
     let channel = get_channel_for_class(addr, ChannelClass::Control)
         .await
         .map_err(|err| crate::error::Error::other(err.to_string()))?;
-    let channel = ReplayScopeChannel::new(BatchLockDeadlineChannel::new(channel), interceptor.replay_scope_audience());
+    let channel = ReplayScopeChannel::new(channel, interceptor.replay_scope_audience());
     let limit = rustfs_protos::scoped_dirty_usage::SCOPED_DIRTY_USAGE_MAX_REQUEST_BYTES as usize;
     Ok(ScannerControlServiceClient::with_interceptor(channel, interceptor)
         .max_decoding_message_size(limit)
@@ -88,7 +84,7 @@ pub async fn heal_control_time_out_client(
     let interceptor = interceptor.with_rpc_audience(addr)?;
     let channel = get_channel_for_class(addr, ChannelClass::Control).await?;
     let max_message_size = rustfs_protos::HEAL_CONTROL_RPC_MAX_MESSAGE_SIZE;
-    let channel = ReplayScopeChannel::new(BatchLockDeadlineChannel::new(channel), interceptor.replay_scope_audience());
+    let channel = ReplayScopeChannel::new(channel, interceptor.replay_scope_audience());
     Ok(HealControlServiceClient::with_interceptor(channel, interceptor)
         .max_decoding_message_size(max_message_size)
         .max_encoding_message_size(max_message_size))
@@ -101,7 +97,7 @@ pub async fn tier_mutation_control_time_out_client(
     let interceptor = interceptor.with_rpc_audience(addr)?;
     let channel = get_channel_for_class(addr, ChannelClass::Control).await?;
     let max_message_size = rustfs_protos::TIER_MUTATION_RPC_MAX_MESSAGE_SIZE;
-    let channel = ReplayScopeChannel::new(BatchLockDeadlineChannel::new(channel), interceptor.replay_scope_audience());
+    let channel = ReplayScopeChannel::new(channel, interceptor.replay_scope_audience());
     Ok(TierMutationControlServiceClient::with_interceptor(channel, interceptor)
         .max_decoding_message_size(max_message_size)
         .max_encoding_message_size(max_message_size))
@@ -122,7 +118,7 @@ pub async fn node_service_time_out_client_for_class(
     let channel = get_channel_for_class(addr, class).await?;
 
     let max_message_size = rustfs_protos::internode_rpc_max_message_size();
-    let channel = ReplayScopeChannel::new(BatchLockDeadlineChannel::new(channel), interceptor.replay_scope_audience());
+    let channel = ReplayScopeChannel::new(channel, interceptor.replay_scope_audience());
     Ok(NodeServiceClient::with_interceptor(channel, interceptor)
         .max_decoding_message_size(max_message_size)
         .max_encoding_message_size(max_message_size))
@@ -137,7 +133,7 @@ pub(crate) async fn node_service_delete_recovery_client(
     let channel = rustfs_protos::create_channel_with_timeout(addr, timeout)
         .await
         .map_err(|error| DiskError::RemoteClientUnavailable(error.to_string()))?;
-    let channel = ReplayScopeChannel::new(BatchLockDeadlineChannel::new(channel), interceptor.replay_scope_audience());
+    let channel = ReplayScopeChannel::new(channel, interceptor.replay_scope_audience());
     let max_message_size = rustfs_protos::internode_rpc_max_message_size();
     Ok(NodeServiceClient::with_interceptor(channel, interceptor)
         .max_decoding_message_size(max_message_size)
@@ -253,95 +249,7 @@ pub struct ReplayScopeChannel<S> {
 }
 
 /// The channel type used by internode clients after v2 authentication and replay-scope handling.
-pub type AuthenticatedChannel = ReplayScopeChannel<BatchLockDeadlineChannel<Channel>>;
-
-/// Gate lock-batch payloads after the transport's internal readiness queues.
-/// Other RPC bodies pass through without an additional wrapper.
-#[derive(Clone, Debug)]
-pub struct BatchLockDeadlineChannel<S> {
-    inner: S,
-}
-
-impl<S> BatchLockDeadlineChannel<S> {
-    fn new(inner: S) -> Self {
-        Self { inner }
-    }
-}
-
-impl<S> Service<HttpRequest<tonic::body::Body>> for BatchLockDeadlineChannel<S>
-where
-    S: Service<HttpRequest<tonic::body::Body>>,
-{
-    type Response = S::Response;
-    type Error = S::Error;
-    type Future = S::Future;
-
-    fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
-        self.inner.poll_ready(cx)
-    }
-
-    fn call(&mut self, mut request: HttpRequest<tonic::body::Body>) -> Self::Future {
-        if let Some(deadline) = request.extensions().get::<BatchLockRpcDeadline>().cloned() {
-            let body = std::mem::replace(request.body_mut(), tonic::body::Body::empty());
-            *request.body_mut() = tonic::body::Body::new(BatchLockDeadlineBody {
-                inner: body,
-                deadline,
-                dispatched: false,
-                failed: false,
-            });
-        }
-        self.inner.call(request)
-    }
-}
-
-struct BatchLockDeadlineBody {
-    inner: tonic::body::Body,
-    deadline: BatchLockRpcDeadline,
-    dispatched: bool,
-    failed: bool,
-}
-
-impl http_body::Body for BatchLockDeadlineBody {
-    type Data = bytes::Bytes;
-    type Error = tonic::Status;
-
-    fn poll_frame(
-        mut self: Pin<&mut Self>,
-        cx: &mut Context<'_>,
-    ) -> Poll<Option<Result<http_body::Frame<Self::Data>, Self::Error>>> {
-        if self.failed {
-            return Poll::Ready(None);
-        }
-        if !self.dispatched
-            && let Err(error) = self.deadline.remaining_before_dispatch()
-        {
-            self.failed = true;
-            return Poll::Ready(Some(Err(error)));
-        }
-        let frame = std::task::ready!(Pin::new(&mut self.inner).poll_frame(cx));
-        if let Some(Ok(frame)) = &frame
-            && frame.is_data()
-            && !self.dispatched
-        {
-            // Codec work can consume the deadline in this poll. Arbitrate only
-            // after encoding, immediately before any payload leaves the body.
-            if let Err(error) = self.deadline.mark_dispatched() {
-                self.failed = true;
-                return Poll::Ready(Some(Err(error)));
-            }
-            self.dispatched = true;
-        }
-        Poll::Ready(frame)
-    }
-
-    fn is_end_stream(&self) -> bool {
-        self.failed || self.inner.is_end_stream()
-    }
-
-    fn size_hint(&self) -> http_body::SizeHint {
-        self.inner.size_hint()
-    }
-}
+pub type AuthenticatedChannel = ReplayScopeChannel<Channel>;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 enum PeerReplayCapability {
@@ -518,9 +426,7 @@ where
                     )
                 }) {
                     Ok(headers) => request.headers_mut().extend(headers),
-                    Err(error) => {
-                        debug!(error = %error, "could not attach replay-scoped RPC signature")
-                    }
+                    Err(error) => debug!(error = %error, "could not attach replay-scoped RPC signature"),
                 }
             }
         }
@@ -582,82 +488,6 @@ where
     }
 }
 
-/// A batch may leave local readiness queues only while its original budget is live.
-/// Cancellation and submission arbitrate once so a cancelled caller cannot send later.
-#[derive(Clone, Debug)]
-pub(crate) struct BatchLockRpcDeadline {
-    deadline: tokio::time::Instant,
-    max_acquire_wait: Duration,
-    dispatch: Arc<AtomicU8>,
-}
-
-impl BatchLockRpcDeadline {
-    const PENDING: u8 = 0;
-    const DISPATCHED: u8 = 1;
-    const CANCELLED: u8 = 2;
-
-    pub(crate) fn new(deadline: tokio::time::Instant, max_acquire_wait: Duration) -> Self {
-        Self {
-            deadline,
-            max_acquire_wait,
-            dispatch: Arc::new(AtomicU8::new(Self::PENDING)),
-        }
-    }
-
-    /// True proves that this batch cannot send payload or enter the server lock handler.
-    /// Transport headers may already have left an internal channel queue.
-    pub(crate) fn cancel_before_dispatch(&self) -> bool {
-        match self
-            .dispatch
-            .compare_exchange(Self::PENDING, Self::CANCELLED, Ordering::AcqRel, Ordering::Acquire)
-        {
-            Ok(_) => true,
-            Err(state) => state == Self::CANCELLED,
-        }
-    }
-
-    pub(crate) fn was_dispatched(&self) -> bool {
-        self.dispatch.load(Ordering::Acquire) == Self::DISPATCHED
-    }
-
-    fn remaining_before_dispatch(&self) -> Result<Duration, tonic::Status> {
-        let remaining = self.deadline.saturating_duration_since(tokio::time::Instant::now());
-        if remaining <= self.max_acquire_wait || self.dispatch.load(Ordering::Acquire) == Self::CANCELLED {
-            return Err(tonic::Status::deadline_exceeded("Lock batch budget exhausted before payload dispatch"));
-        }
-        Ok(remaining)
-    }
-
-    fn update_timeout(&self, request: &mut tonic::Request<()>) -> Result<(), tonic::Status> {
-        request.set_timeout(self.remaining_before_dispatch()?);
-        Ok(())
-    }
-
-    fn mark_dispatched(&self) -> Result<(), tonic::Status> {
-        self.remaining_before_dispatch()?;
-        self.dispatch
-            .compare_exchange(Self::PENDING, Self::DISPATCHED, Ordering::AcqRel, Ordering::Acquire)
-            .map(|_| ())
-            .map_err(|_| tonic::Status::deadline_exceeded("Lock batch cancelled before dispatch"))
-    }
-
-    #[cfg(test)]
-    pub(super) async fn dispatch_payload_for_test(&self) -> Result<(), tonic::Status> {
-        use http_body_util::BodyExt as _;
-        let mut body = BatchLockDeadlineBody {
-            inner: tonic::body::Body::new(http_body_util::Full::new(bytes::Bytes::from_static(b"payload"))),
-            deadline: self.clone(),
-            dispatched: false,
-            failed: false,
-        };
-        match body.frame().await {
-            Some(Ok(frame)) if frame.is_data() => Ok(()),
-            Some(Err(error)) => Err(error),
-            _ => Err(tonic::Status::internal("test lock payload did not produce a data frame")),
-        }
-    }
-}
-
 pub struct TonicSignatureInterceptor {
     audience: Option<String>,
     body_digest_strict: bool,
@@ -752,21 +582,11 @@ impl TonicInterceptor {
 }
 
 impl tonic::service::Interceptor for TonicInterceptor {
-    fn call(&mut self, mut req: tonic::Request<()>) -> Result<tonic::Request<()>, tonic::Status> {
-        let batch_deadline = req.extensions().get::<BatchLockRpcDeadline>().cloned();
-        if let Some(deadline) = &batch_deadline {
-            deadline.update_timeout(&mut req)?;
-        }
-        let mut req = match self {
+    fn call(&mut self, req: tonic::Request<()>) -> Result<tonic::Request<()>, tonic::Status> {
+        match self {
             TonicInterceptor::Signature(interceptor) => interceptor.call(req),
             TonicInterceptor::NoOp(interceptor) => interceptor.call(req),
-        }?;
-        if let Some(deadline) = batch_deadline {
-            // Signing consumes budget, but Channel readiness only reserves a
-            // queue slot. The payload body arbitrates actual dispatch later.
-            deadline.update_timeout(&mut req)?;
         }
-        Ok(req)
     }
 }
 
@@ -962,136 +782,6 @@ mod tests {
         test_request_for("Ping")
     }
 
-    #[test]
-    fn batch_dispatch_and_cancellation_have_one_winner() {
-        for _ in 0..100 {
-            let deadline = BatchLockRpcDeadline::new(tokio::time::Instant::now() + Duration::from_secs(1), Duration::ZERO);
-            let other = deadline.clone();
-            let barrier = Arc::new(std::sync::Barrier::new(2));
-            let other_barrier = barrier.clone();
-            let submit = std::thread::spawn(move || {
-                other_barrier.wait();
-                other.mark_dispatched().is_ok()
-            });
-            barrier.wait();
-            let cancelled = deadline.cancel_before_dispatch();
-            let submitted = submit.join().expect("submission thread");
-            assert_ne!(cancelled, submitted);
-            assert_eq!(deadline.was_dispatched(), submitted);
-            assert!(deadline.mark_dispatched().is_err());
-        }
-    }
-
-    #[test]
-    fn batch_interceptor_rejects_exhausted_wait_reserve_before_submission() {
-        let deadline =
-            BatchLockRpcDeadline::new(tokio::time::Instant::now() + Duration::from_millis(20), Duration::from_millis(30));
-        let mut request = tonic::Request::new(());
-        request.extensions_mut().insert(deadline.clone());
-        let status = TonicInterceptor::NoOp(NoOpInterceptor)
-            .call(request)
-            .expect_err("insufficient wait reserve");
-        assert_eq!(status.code(), tonic::Code::DeadlineExceeded);
-        assert!(!deadline.was_dispatched());
-        assert!(deadline.cancel_before_dispatch());
-    }
-
-    #[test]
-    fn batch_interceptor_rejects_cancelled_ready_request_and_accepts_live_budget() {
-        let deadline = BatchLockRpcDeadline::new(tokio::time::Instant::now() + Duration::from_secs(2), Duration::from_millis(1));
-        let mut request = tonic::Request::new(());
-        request.extensions_mut().insert(deadline.clone());
-        assert!(deadline.cancel_before_dispatch());
-        assert!(TonicInterceptor::NoOp(NoOpInterceptor).call(request).is_err());
-        assert!(!deadline.was_dispatched());
-
-        let deadline = BatchLockRpcDeadline::new(tokio::time::Instant::now() + Duration::from_secs(2), Duration::from_millis(1));
-        let mut request = tonic::Request::new(());
-        request.extensions_mut().insert(deadline.clone());
-        let request = TonicInterceptor::NoOp(NoOpInterceptor).call(request).expect("live budget");
-        assert!(!deadline.was_dispatched(), "interceptor completion does not bypass the transport queue");
-        assert!(request.metadata().contains_key("grpc-timeout"));
-        assert!(deadline.cancel_before_dispatch());
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn batch_body_rejects_payload_after_channel_queue_deadline() {
-        let deadline = BatchLockRpcDeadline::new(tokio::time::Instant::now() + Duration::from_millis(20), Duration::ZERO);
-        tokio::time::advance(Duration::from_millis(21)).await;
-        let error = deadline
-            .dispatch_payload_for_test()
-            .await
-            .expect_err("queued payload expired");
-        assert_eq!(error.code(), tonic::Code::DeadlineExceeded);
-        assert!(!deadline.was_dispatched());
-        assert!(deadline.cancel_before_dispatch());
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn batch_body_rejects_payload_when_encoding_crosses_deadline_in_one_poll() {
-        use http_body_util::BodyExt as _;
-        struct SlowEncodingBody {
-            deadline: tokio::time::Instant,
-        }
-        impl http_body::Body for SlowEncodingBody {
-            type Data = bytes::Bytes;
-            type Error = tonic::Status;
-
-            fn poll_frame(
-                self: Pin<&mut Self>,
-                _cx: &mut Context<'_>,
-            ) -> Poll<Option<Result<http_body::Frame<Self::Data>, Self::Error>>> {
-                // Model codec work that begins before the deadline but blocks
-                // this single poll until the original budget has expired.
-                tokio::time::resume();
-                std::thread::sleep(
-                    self.deadline.saturating_duration_since(tokio::time::Instant::now()) + Duration::from_millis(1),
-                );
-                Poll::Ready(Some(Ok(http_body::Frame::data(bytes::Bytes::from_static(b"encoded payload")))))
-            }
-        }
-        let expires = tokio::time::Instant::now() + Duration::from_millis(20);
-        let deadline = BatchLockRpcDeadline::new(expires, Duration::ZERO);
-        let mut body = BatchLockDeadlineBody {
-            inner: tonic::body::Body::new(SlowEncodingBody { deadline: expires }),
-            deadline: deadline.clone(),
-            dispatched: false,
-            failed: false,
-        };
-        let error = body
-            .frame()
-            .await
-            .expect("first frame result")
-            .expect_err("late encoded payload");
-        assert_eq!(error.code(), tonic::Code::DeadlineExceeded);
-        assert!(!deadline.was_dispatched());
-        assert!(deadline.cancel_before_dispatch());
-        assert!(body.frame().await.is_none(), "failed body must not expose a later frame");
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn batch_body_keeps_cleanup_responsibility_after_first_payload() {
-        use http_body_util::BodyExt as _;
-        let deadline = BatchLockRpcDeadline::new(tokio::time::Instant::now() + Duration::from_millis(20), Duration::ZERO);
-        let frames = futures::stream::iter([
-            Ok::<_, tonic::Status>(http_body::Frame::data(bytes::Bytes::from_static(b"first"))),
-            Ok(http_body::Frame::data(bytes::Bytes::from_static(b"last"))),
-        ]);
-        let mut body = BatchLockDeadlineBody {
-            inner: tonic::body::Body::new(http_body_util::StreamBody::new(frames)),
-            deadline: deadline.clone(),
-            dispatched: false,
-            failed: false,
-        };
-        assert!(body.frame().await.expect("first frame").expect("live payload").is_data());
-        assert!(deadline.was_dispatched());
-        assert!(!deadline.cancel_before_dispatch());
-        tokio::time::advance(Duration::from_millis(21)).await;
-        assert!(body.frame().await.expect("last frame").expect("late drain").is_data());
-        assert!(body.frame().await.is_none());
-        assert!(!deadline.cancel_before_dispatch(), "a sent payload requires late cleanup ownership");
-    }
-
     fn test_request_for(method: &'static str) -> tonic::Request<()> {
         let mut request = tonic::Request::new(());
         request

crates/ecstore/src/cluster/rpc/http_auth.rs

@@ -1399,73 +1399,6 @@ pub fn build_auth_headers(url: &str, method: &Method, headers: &mut HeaderMap) -
     Ok(())
 }
 
-/// Signs only external stream controls targeting members of this instance's topology.
-#[cfg(feature = "internode-transport")]
-#[derive(Clone)]
-pub struct ExternalStreamAuth {
-    peers: std::sync::Arc<std::collections::HashSet<url::Origin>>,
-}
-
-#[cfg(feature = "internode-transport")]
-impl ExternalStreamAuth {
-    /// The authenticated HTTP route used by peer stream controls.
-    pub const PATH: &'static str = "/rustfs/rpc/external_stream";
-
-    /// Capture the topology already configured for this host; a missing topology has no peers.
-    pub fn new(instance: &crate::runtime::instance::InstanceContext) -> Self {
-        let mut peers = std::collections::HashSet::new();
-        if let Some(topology) = instance.endpoints() {
-            for pool in topology.0 {
-                for endpoint in pool.endpoints.as_ref() {
-                    if matches!(endpoint.url.scheme(), "http" | "https") {
-                        peers.insert(endpoint.url.origin());
-                    }
-                }
-            }
-        }
-        Self {
-            peers: std::sync::Arc::new(peers),
-        }
-    }
-
-    /// Sign a fresh POST for one configured origin, request body digest and replay nonce.
-    /// The caller must send it to the returned URL without redirects or resubmission.
-    pub fn sign_control(&self, endpoint: &str, digest: &[u8; 32]) -> std::io::Result<(String, HeaderMap)> {
-        let mut url = url::Url::parse(endpoint).map_err(|error| std::io::Error::new(std::io::ErrorKind::InvalidInput, error))?;
-        if !url.username().is_empty()
-            || url.password().is_some()
-            || !self.peers.contains(&url.origin())
-            || url.path() != "/"
-            || url.query().is_some()
-            || url.fragment().is_some()
-        {
-            return Err(std::io::Error::new(
-                std::io::ErrorKind::PermissionDenied,
-                "invalid internode control endpoint",
-            ));
-        }
-        url.set_path(Self::PATH);
-        url.query_pairs_mut()
-            .append_pair("body_sha256", &hex_simd::encode_to_string(digest, hex_simd::AsciiCase::Lower))
-            .append_pair("request_nonce", &Uuid::new_v4().to_string());
-        let url = url.to_string();
-        let mut headers = HeaderMap::new();
-        headers.insert(http::header::CONTENT_TYPE, HeaderValue::from_static("application/octet-stream"));
-        build_auth_headers(&url, &Method::POST, &mut headers)?;
-        Ok((url, headers))
-    }
-
-    /// Derive the operation key for this stream protocol and exact request digest.
-    /// The shared RPC signing credential is never exposed to the stream provider.
-    pub fn transfer_key(&self, request_digest: &[u8; 32]) -> std::io::Result<[u8; 32]> {
-        let secret = get_shared_secret()?;
-        let mut mac = <HmacSha256 as KeyInit>::new_from_slice(secret.as_bytes()).map_err(std::io::Error::other)?;
-        mac.update(b"rustfs-external-stream-key-v1\0");
-        mac.update(request_digest);
-        Ok(mac.finalize().into_bytes().into())
-    }
-}
-
 pub fn gen_signature_headers(url: &str, method: &Method) -> std::io::Result<HeaderMap> {
     let secret = get_shared_secret()?;
     let timestamp = OffsetDateTime::now_utc().unix_timestamp();

crates/ecstore/src/cluster/rpc/internode_data_transport.rs

@@ -220,11 +220,6 @@ impl InternodeDataTransportCapabilities {
 }
 
 #[derive(Debug, Clone)]
-#[cfg_attr(
-    feature = "internode-transport",
-    derive(serde::Serialize, serde::Deserialize),
-    serde(deny_unknown_fields)
-)]
 pub struct ReadStreamRequest {
     pub endpoint: String,
     pub disk: String,
@@ -236,11 +231,6 @@ pub struct ReadStreamRequest {
 }
 
 #[derive(Debug, Clone)]
-#[cfg_attr(
-    feature = "internode-transport",
-    derive(serde::Serialize, serde::Deserialize),
-    serde(deny_unknown_fields)
-)]
 pub struct WriteStreamRequest {
     pub endpoint: String,
     pub disk: String,
@@ -1253,38 +1243,6 @@ mod tests {
         }
     }
 
-    #[cfg(feature = "internode-transport")]
-    #[test]
-    fn peer_transport_is_selected_once_per_instance() {
-        use crate::runtime::instance::InstanceContext;
-        let first = InstanceContext::new();
-        let second = InstanceContext::new();
-        let provider: Arc<dyn InternodeDataTransport> = Arc::new(LegacyTestTransport);
-        first
-            .select_internode_data_transport(provider.clone(), Some(" LEGACY-TEST "))
-            .expect("select external transport");
-        let selected = first.internode_data_transport().expect("first instance selection");
-        assert!(Arc::ptr_eq(selected, &provider));
-        assert!(second.internode_data_transport().is_none());
-        assert_eq!(
-            first
-                .select_internode_data_transport(provider.clone(), Some("tcp"))
-                .expect_err("already configured")
-                .kind(),
-            io::ErrorKind::AlreadyExists
-        );
-        second
-            .select_internode_data_transport(provider.clone(), None)
-            .expect("ordinary TCP");
-        assert_eq!(
-            second.internode_data_transport().expect("ordinary selection").name(),
-            DEFAULT_INTERNODE_DATA_TRANSPORT
-        );
-        let invalid = InstanceContext::new();
-        assert!(invalid.select_internode_data_transport(provider, Some("unknown")).is_err());
-        assert!(invalid.internode_data_transport().is_none());
-    }
-
     #[tokio::test]
     async fn legacy_transport_defaults_namespace_scanner_to_unsupported() {
         let transport = LegacyTestTransport;

crates/ecstore/src/cluster/rpc/peer_rest_client.rs

@@ -1965,15 +1965,6 @@ impl PeerRestClient {
         Ok((self.topology_member.clone(), epoch))
     }
 
-    pub async fn probe_restore_copyback_capability(&self, topology_fingerprint: String) -> Result<(String, Uuid)> {
-        let probe = rustfs_protos::restore_copyback_capability_probe(Uuid::new_v4().as_bytes());
-        let result = self
-            .heal_control(rustfs_protos::HEAL_CONTROL_PROTOCOL_VERSION, topology_fingerprint, probe)
-            .await?;
-        let epoch = decode_remote_version_state_capability(&self.topology_member, &result)?;
-        Ok((self.topology_member.clone(), epoch))
-    }
-
     pub async fn probe_cross_pool_fence(&self, topology_fingerprint: String) -> Result<(String, u32, Uuid)> {
         let mut probe = rustfs_protos::CROSS_POOL_FENCE_CAPABILITY_PROBE_PREFIX.to_vec();
         probe.extend_from_slice(Uuid::new_v4().as_bytes());

crates/ecstore/src/cluster/rpc/remote_disk.rs

@@ -169,72 +169,6 @@ fn decode_delete_recovery_batch_errors(codes: Vec<Option<u32>>, expected_len: us
         .collect()
 }
 
-fn log_delete_recovery_batch_result(
-    endpoint: &Endpoint,
-    expected_len: usize,
-    started: Instant,
-    result: &Result<Vec<Option<DiskError>>>,
-) {
-    let elapsed_ms = started.elapsed().as_millis();
-    let mut disk_error_counts = std::collections::BTreeMap::<u32, usize>::new();
-    let (failure_scope, rpc_status) = match result {
-        Ok(errors) => {
-            for error in errors.iter().flatten() {
-                *disk_error_counts.entry(error.to_u32()).or_default() += 1;
-            }
-            ("object_group", None)
-        }
-        Err(error) => {
-            disk_error_counts.insert(error.to_u32(), expected_len);
-            let rpc_status = match error {
-                DiskError::Io(source) => crate::cluster::rpc::client::embedded_tonic_status(source).map(tonic::Status::code),
-                _ => None,
-            };
-            ("rpc_or_reply", rpc_status)
-        }
-    };
-    let failed_group_count = disk_error_counts.values().sum::<usize>();
-    let result = if result.is_err() || failed_group_count > 0 {
-        "failed"
-    } else {
-        "ok"
-    };
-    if result == "failed" || elapsed_ms >= 1_000 {
-        warn!(
-            event = EVENT_REMOTE_DISK_RPC,
-            component = LOG_COMPONENT_ECSTORE,
-            subsystem = LOG_SUBSYSTEM_REMOTE_DISK,
-            result,
-            operation = "apply_versions",
-            failure_scope,
-            pool_index = endpoint.pool_idx,
-            set_index = endpoint.set_idx,
-            disk_index = endpoint.disk_idx,
-            attempted_group_count = expected_len,
-            failed_group_count,
-            disk_error_counts = ?disk_error_counts,
-            rpc_status = ?rpc_status,
-            elapsed_ms,
-            "Recoverable batch delete RPC completed"
-        );
-    } else {
-        debug!(
-            event = EVENT_REMOTE_DISK_RPC,
-            component = LOG_COMPONENT_ECSTORE,
-            subsystem = LOG_SUBSYSTEM_REMOTE_DISK,
-            result,
-            operation = "apply_versions",
-            pool_index = endpoint.pool_idx,
-            set_index = endpoint.set_idx,
-            disk_index = endpoint.disk_idx,
-            attempted_group_count = expected_len,
-            failed_group_count,
-            elapsed_ms,
-            "Recoverable batch delete RPC completed"
-        );
-    }
-}
-
 fn validate_delete_recovery_inspection(
     volume: &str,
     object: &str,
@@ -997,18 +931,8 @@ pub struct RemoteDisk {
     #[cfg(test)]
     recovery_monitor_teardown_hook: Arc<tokio::sync::Mutex<Option<Arc<RecoveryMonitorTeardownHook>>>>,
     data_transport: Arc<dyn InternodeDataTransport>,
-    #[cfg(feature = "internode-transport")]
-    external_streams: bool,
-    /// Bound the per-operation failure warnings of this peer. An unreachable
-    /// peer fails every in-flight shard operation; the counters keep the exact
-    /// numbers per operation. Per handle, so one peer cannot hide another's.
-    timeout_logs: rustfs_utils::LogThrottle,
-    network_error_logs: rustfs_utils::LogThrottle,
 }
 
-/// Shortest gap between two failure warnings of one kind from one remote disk.
-const REMOTE_DISK_RPC_FAILURE_LOG_INTERVAL_MS: u64 = 5_000;
-
 struct RecoveryMonitorLease {
     active: Arc<AtomicBool>,
 }
@@ -1440,10 +1364,6 @@ impl RemoteDisk {
             #[cfg(test)]
             recovery_monitor_teardown_hook: Arc::new(tokio::sync::Mutex::new(None)),
             data_transport,
-            #[cfg(feature = "internode-transport")]
-            external_streams: false,
-            timeout_logs: rustfs_utils::LogThrottle::new(REMOTE_DISK_RPC_FAILURE_LOG_INTERVAL_MS),
-            network_error_logs: rustfs_utils::LogThrottle::new(REMOTE_DISK_RPC_FAILURE_LOG_INTERVAL_MS),
         };
         record_drive_runtime_state(ep, RuntimeDriveHealthState::Online);
 
@@ -1456,14 +1376,6 @@ impl RemoteDisk {
         Ok(disk)
     }
 
-    #[cfg(feature = "internode-transport")]
-    pub(crate) fn with_instance_transport(mut self) -> Self {
-        // Built-in names are reserved by the instance registration API. A host provider
-        // owns its open, data verification and cancellation as one operation.
-        self.external_streams = !rustfs_config::KNOWN_INTERNODE_DATA_TRANSPORT_BACKENDS.contains(&self.data_transport.name());
-        self
-    }
-
     pub fn runtime_state(&self) -> RuntimeDriveHealthState {
         self.health.runtime_state()
     }
@@ -1487,10 +1399,6 @@ impl RemoteDisk {
     }
 
     async fn open_write_with_retry(&self, request: WriteStreamRequest) -> Result<FileWriter> {
-        #[cfg(feature = "internode-transport")]
-        if self.external_streams {
-            return self.data_transport.open_write(request).await;
-        }
         let mut attempt = 1;
         let mut last_retry_classification = None;
         loop {
@@ -2182,20 +2090,17 @@ impl RemoteDisk {
             "op" => op.to_string()
         )
         .increment(1);
-        if let Some(suppressed) = self.timeout_logs.claim() {
-            warn!(
-                event = EVENT_REMOTE_DISK_RPC,
-                component = LOG_COMPONENT_ECSTORE,
-                subsystem = LOG_SUBSYSTEM_REMOTE_DISK,
-                endpoint = %self.endpoint,
-                addr = %self.addr,
-                op,
-                timeout_ms = timeout_duration.as_millis(),
-                suppressed,
-                state = "timeout",
-                "Remote disk operation timed out"
-            );
-        }
+        warn!(
+            event = EVENT_REMOTE_DISK_RPC,
+            component = LOG_COMPONENT_ECSTORE,
+            subsystem = LOG_SUBSYSTEM_REMOTE_DISK,
+            endpoint = %self.endpoint,
+            addr = %self.addr,
+            op,
+            timeout_ms = timeout_duration.as_millis(),
+            state = "timeout",
+            "Remote disk operation timed out"
+        );
     }
 
     async fn handle_network_like_error<T>(
@@ -2215,20 +2120,17 @@ impl RemoteDisk {
                 "op" => op.to_string()
             )
             .increment(1);
-            if let Some(suppressed) = self.network_error_logs.claim() {
-                warn!(
-                    event = EVENT_REMOTE_DISK_RPC,
-                    component = LOG_COMPONENT_ECSTORE,
-                    subsystem = LOG_SUBSYSTEM_REMOTE_DISK,
-                    endpoint = %self.endpoint,
-                    addr = %self.addr,
-                    op,
-                    timeout_ms = timeout_duration.as_millis(),
-                    suppressed,
-                    state = "network_like_error",
-                    "Remote disk operation returned network-like error"
-                );
-            }
+            warn!(
+                event = EVENT_REMOTE_DISK_RPC,
+                component = LOG_COMPONENT_ECSTORE,
+                subsystem = LOG_SUBSYSTEM_REMOTE_DISK,
+                endpoint = %self.endpoint,
+                addr = %self.addr,
+                op,
+                timeout_ms = timeout_duration.as_millis(),
+                state = "network_like_error",
+                "Remote disk operation returned network-like error"
+            );
             if failure_health_action == FailureHealthAction::MarkFailure {
                 self.mark_faulty_and_evict("operation_network_error").await;
             }
@@ -4222,10 +4124,6 @@ impl DiskAPI for RemoteDisk {
             length,
             stall_timeout: timeouts.body_stall,
         };
-        #[cfg(feature = "internode-transport")]
-        if self.external_streams {
-            return self.data_transport.open_read(request).await;
-        }
         let reader = self.open_read_with_retry(request.clone()).await?;
         Ok(Box::new(RetryingRemoteReader::new_with_timeouts(
             reader,
@@ -4257,10 +4155,6 @@ impl DiskAPI for RemoteDisk {
             length,
             stall_timeout: timeouts.body_stall,
         };
-        #[cfg(feature = "internode-transport")]
-        if self.external_streams {
-            return self.data_transport.open_read_chunks(request).await;
-        }
         let reader = self.open_read_chunks_with_retry(request.clone()).await?;
         Ok(reader.map(|reader| {
             Box::new(RetryingRemoteChunkReader::new_with_timeouts(
@@ -4479,7 +4373,6 @@ impl DiskAPI for RemoteDisk {
         opts: DeleteOptions,
     ) -> Vec<Option<DiskError>> {
         let expected_len = versions.len();
-        let started = Instant::now();
         let result = match self
             .recover_delete_transaction(volume, DeleteRecoveryRpcOperation::ApplyVersions { versions, opts })
             .await
@@ -4488,7 +4381,6 @@ impl DiskAPI for RemoteDisk {
             Ok(_) => Err(Error::other("unexpected recoverable batch delete reply")),
             Err(error) => Err(error),
         };
-        log_delete_recovery_batch_result(&self.endpoint, expected_len, started, &result);
         match result {
             Ok(errors) => errors,
             Err(error) => vec![Some(error); expected_len],
@@ -5781,62 +5673,6 @@ mod tests {
         assert!(decode_delete_recovery_batch_errors(vec![Some(u32::MAX)], 1).is_err());
     }
 
-    #[test]
-    fn recoverable_batch_delete_diagnostics_preserve_context_and_redact_error_details() {
-        let logs = CapturedLogs::default();
-        let subscriber = Registry::default().with(
-            tracing_subscriber::fmt::layer()
-                .with_writer(logs.clone())
-                .with_ansi(false)
-                .without_time()
-                .json()
-                .flatten_event(true)
-                .with_span_list(true),
-        );
-        let _guard = tracing::subscriber::set_default(subscriber);
-        let _callsite_pin = crate::test_tracing::pin_callsite_interest_for_test();
-        let endpoint = Endpoint {
-            url: url::Url::parse("http://127.0.0.1:9000/private-disk-path").expect("valid diagnostic endpoint"),
-            is_local: false,
-            pool_idx: 1,
-            set_idx: 2,
-            disk_idx: 3,
-        };
-        let rpc_failure = Err(DiskError::from(Status::deadline_exceeded("private-error-detail")));
-        let group_failures = Ok(vec![None, Some(DiskError::FileNotFound), Some(DiskError::FileNotFound)]);
-        tracing::info_span!("request-span", request_id = "req-batch-delete-diagnostics").in_scope(|| {
-            log_delete_recovery_batch_result(&endpoint, 1000, Instant::now(), &rpc_failure);
-            log_delete_recovery_batch_result(&endpoint, 3, Instant::now(), &group_failures);
-        });
-        let entries = logs.lines();
-        assert_eq!(entries.len(), 2, "one summary per disk batch, never per object");
-        assert_eq!(entries[0]["failure_scope"], "rpc_or_reply");
-        assert_eq!(entries[0]["failed_group_count"], 1000);
-        assert_eq!(entries[0]["rpc_status"], "Some(DeadlineExceeded)");
-        assert_eq!(entries[1]["failure_scope"], "object_group");
-        assert_eq!(entries[1]["failed_group_count"], 2);
-        for entry in entries {
-            assert_eq!(entry["pool_index"], 1);
-            assert_eq!(entry["set_index"], 2);
-            assert_eq!(entry["disk_index"], 3);
-            assert!(
-                entry["spans"]
-                    .as_array()
-                    .expect("request spans recorded")
-                    .iter()
-                    .any(|span| { span["request_id"] == "req-batch-delete-diagnostics" })
-            );
-            let text = entry.to_string();
-            assert!(!text.contains("private-error-detail"));
-            assert!(!text.contains("private-disk-path"));
-        }
-        assert!(rpc_failure.is_err(), "diagnostics borrow and preserve the original failure");
-        assert_eq!(
-            group_failures,
-            Ok(vec![None, Some(DiskError::FileNotFound), Some(DiskError::FileNotFound)])
-        );
-    }
-
     #[test]
     fn delete_recovery_inspection_rejects_wrong_transaction_object_and_protocol() {
         let transaction = Uuid::new_v4();
@@ -10418,81 +10254,6 @@ mod tests {
         }
     }
 
-    #[cfg(feature = "internode-transport")]
-    #[tokio::test]
-    async fn peer_transport_open_returns_the_original_error_after_one_attempt() {
-        let failure = || {
-            OpenWriteTestStep::Error(DiskError::from(rustfs_rio::new_test_internode_http_io_error(
-                rustfs_rio::InternodeHttpErrorKind::HttpStatus(reqwest::StatusCode::SERVICE_UNAVAILABLE),
-            )))
-        };
-        let writer = RetryingOpenWriteInternodeDataTransport::with_steps(vec![failure(), OpenWriteTestStep::Success]);
-        let disk = new_remote_disk_with_transport(Arc::new(writer.clone()))
-            .await
-            .with_instance_transport();
-        let error = disk
-            .create_file("", "bucket", "shard", 3)
-            .await
-            .err()
-            .expect("provider write failure");
-        assert_eq!(
-            error.internode_http_error_kind(),
-            Some(rustfs_rio::InternodeHttpErrorKind::HttpStatus(reqwest::StatusCode::SERVICE_UNAVAILABLE))
-        );
-        assert_eq!(writer.calls().len(), 1);
-        let reader = RetryingOpenReadInternodeDataTransport::with_steps(vec![failure(), OpenWriteTestStep::Success]);
-        let disk = new_remote_disk_with_transport(Arc::new(reader.clone()))
-            .await
-            .with_instance_transport();
-        let error = disk
-            .read_file_stream("bucket", "shard", 0, 3)
-            .await
-            .err()
-            .expect("provider read failure");
-        assert_eq!(
-            error.internode_http_error_kind(),
-            Some(rustfs_rio::InternodeHttpErrorKind::HttpStatus(reqwest::StatusCode::SERVICE_UNAVAILABLE))
-        );
-        assert_eq!(reader.calls().len(), 1);
-    }
-
-    #[cfg(feature = "internode-transport")]
-    #[tokio::test]
-    async fn peer_transport_body_failures_never_open_a_fresh_stream() {
-        let provider = Arc::new(ResumeTransport::with_read_steps(vec![ResumeReadStep::PartialThenReset(b"x".to_vec())]));
-        let disk = new_remote_disk_with_transport(provider.clone())
-            .await
-            .with_instance_transport();
-        let mut reader = disk.read_file_stream("bucket", "shard", 0, 3).await.expect("reader");
-        let mut bytes = Vec::new();
-        let error = tokio::io::AsyncReadExt::read_to_end(&mut reader, &mut bytes)
-            .await
-            .expect_err("stream reset");
-        assert_eq!(error.kind(), std_io::ErrorKind::ConnectionReset);
-        assert_eq!(bytes, b"x");
-        assert_eq!(provider.read_requests.lock().expect("recorded transport calls").len(), 1);
-        assert!(provider.fresh_read_requests.lock().expect("recorded fresh calls").is_empty());
-        let provider = Arc::new(ResumeTransport::with_chunk_steps(vec![ResumeReadStep::PartialThenReset(b"x".to_vec())]));
-        let disk = new_remote_disk_with_transport(provider.clone())
-            .await
-            .with_instance_transport();
-        let mut reader = disk
-            .read_file_stream_chunks("bucket", "shard", 0, 3)
-            .await
-            .expect("chunked stream")
-            .expect("supported");
-        let chunk = std::future::poll_fn(|cx| Pin::new(reader.as_mut()).poll_read_chunk(cx, 16))
-            .await
-            .expect("first chunk");
-        assert_eq!(chunk, Some(Bytes::from_static(b"x")));
-        let error = std::future::poll_fn(|cx| Pin::new(reader.as_mut()).poll_read_chunk(cx, 16))
-            .await
-            .expect_err("chunk stream reset");
-        assert_eq!(error.kind(), std_io::ErrorKind::ConnectionReset);
-        assert_eq!(provider.chunk_requests.lock().expect("recorded transport calls").len(), 1);
-        assert!(provider.fresh_chunk_requests.lock().expect("recorded fresh calls").is_empty());
-    }
-
     #[tokio::test]
     #[serial(internode_metrics)]
     async fn test_remote_disk_create_file_retries_once_on_retryable_open_write_error() {
@@ -11927,66 +11688,6 @@ mod tests {
         );
     }
 
-    /// A peer that fails every operation logs one warning per interval, each
-    /// operation still gets its own error, and another peer's first warning is
-    /// not held back by the noisy one.
-    #[tokio::test]
-    async fn rpc_failure_warnings_are_bounded_per_remote_disk() {
-        async fn remote_disk(port: u16) -> RemoteDisk {
-            let url = url::Url::parse(&format!("http://127.0.0.1:{port}/data")).expect("endpoint url");
-            let endpoint = Endpoint {
-                url,
-                is_local: false,
-                pool_idx: 0,
-                set_idx: 0,
-                disk_idx: 0,
-            };
-            RemoteDisk::new(
-                &endpoint,
-                &DiskOption {
-                    cleanup: false,
-                    health_check: false,
-                },
-                Arc::new(TcpHttpInternodeDataTransport),
-            )
-            .await
-            .expect("remote disk handle")
-        }
-        let noisy = remote_disk(59981).await;
-        let quiet = remote_disk(59982).await;
-
-        for _ in 0..50 {
-            let error = noisy
-                .execute_with_timeout_for_op_and_health_action(
-                    "read_all",
-                    || async {
-                        Err::<(), Error>(DiskError::Io(std::io::Error::new(
-                            std::io::ErrorKind::ConnectionRefused,
-                            "connection refused",
-                        )))
-                    },
-                    Duration::from_secs(1),
-                    FailureHealthAction::IgnoreFailure,
-                )
-                .await
-                .expect_err("every failing operation still fails");
-            assert!(matches!(error, DiskError::Io(io) if io.kind() == std::io::ErrorKind::ConnectionRefused));
-            noisy.record_timeout("read_all", Duration::from_secs(1));
-        }
-
-        assert!(
-            noisy.network_error_logs.claim().is_none(),
-            "the burst used this peer's network-error window"
-        );
-        assert!(noisy.timeout_logs.claim().is_none(), "the burst used this peer's timeout window");
-        assert_eq!(
-            quiet.network_error_logs.claim(),
-            Some(0),
-            "another peer's first warning is not suppressed"
-        );
-        assert_eq!(quiet.timeout_logs.claim(), Some(0));
-    }
-
     #[tokio::test]
     async fn test_execute_with_timeout_keeps_remote_disk_online_for_business_error() {
         let addr = "http://127.0.0.1:59994".to_string();

crates/ecstore/src/core/pools.rs

@@ -84,13 +84,12 @@ use rand::RngExt as _;
 use rmp_serde::Deserializer;
 use rmp_serde::Serializer;
 use rustfs_filemeta::{FileInfo, FileInfoVersions, MetaCacheEntries, MetaCacheEntry, MetadataResolutionParams};
-use rustfs_gateway_types::persistence::PersistedObjectLockConfiguration as ObjectLockConfiguration;
-use rustfs_gateway_types::persistence::{PersistedLifecycleConfiguration, PersistedReplicationConfiguration};
 use rustfs_heal_contracts::heal_channel::HealOpts;
 use rustfs_utils::crypto::{hex_sha256, is_sha256_checksum};
 use rustfs_utils::path::{
     decode_dir_object, encode_dir_object, path_join, path_to_bucket_object, path_to_bucket_object_with_base_path,
 };
+use s3s::dto::{BucketLifecycleConfiguration, ObjectLockConfiguration, ReplicationConfiguration};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::{HashMap, HashSet};
@@ -13116,7 +13115,7 @@ pub(crate) async fn should_skip_lifecycle_for_data_movement(
     store: Arc<ECStore>,
     bucket: &str,
     version: &rustfs_filemeta::FileInfo,
-    lifecycle_config: Option<&PersistedLifecycleConfiguration>,
+    lifecycle_config: Option<&BucketLifecycleConfiguration>,
     object_lock_config: Option<&ObjectLockConfiguration>,
     apply_actions: bool,
     event_source: &LcEventSrc,
@@ -17047,9 +17046,9 @@ impl ECStore {
         generation: OffsetDateTime,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<PersistedLifecycleConfiguration>,
+        lifecycle_config: Option<BucketLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         source_changed_exhaustions: Arc<AtomicUsize>,
         entry_budget: Arc<Semaphore>,
@@ -17221,9 +17220,9 @@ impl ECStore {
         mut deferred_entry: DeferredDecommissionEntry,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<PersistedLifecycleConfiguration>,
+        lifecycle_config: Option<BucketLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         source_changed_exhaustions: Arc<AtomicUsize>,
         entry_budget: Arc<Semaphore>,
@@ -17330,9 +17329,9 @@ impl ECStore {
         generation: OffsetDateTime,
         set: Arc<SetDisks>,
         bi: DecomBucketInfo,
-        lifecycle_config: Option<PersistedLifecycleConfiguration>,
+        lifecycle_config: Option<BucketLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         source_changed_exhaustions: Arc<AtomicUsize>,
         entry_budget: Arc<Semaphore>,
@@ -18017,9 +18016,9 @@ impl ECStore {
         entry: MetaCacheEntry,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<PersistedLifecycleConfiguration>,
+        lifecycle_config: Option<BucketLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         source_changed_exhaustions: Arc<AtomicUsize>,
         attempts: &mut usize,
@@ -18203,9 +18202,9 @@ impl ECStore {
         entry: MetaCacheEntry,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<PersistedLifecycleConfiguration>,
+        lifecycle_config: Option<BucketLifecycleConfiguration>,
         object_lock_config: Option<ObjectLockConfiguration>,
-        replication_config: Option<(PersistedReplicationConfiguration, OffsetDateTime)>,
+        replication_config: Option<(ReplicationConfiguration, OffsetDateTime)>,
         expected_bucket_incarnation_id: Option<uuid::Uuid>,
         entry_attempt: usize,
         scanner_backlog_handoff_attempt: usize,
@@ -19491,7 +19490,7 @@ impl ECStore {
         entry: MetaCacheEntry,
         bucket: String,
         set: Arc<SetDisks>,
-        lifecycle_config: Option<PersistedLifecycleConfiguration>,
+        lifecycle_config: Option<BucketLifecycleConfiguration>,
     ) -> Result<()> {
         let expected_bucket_incarnation_id = if is_meta_bucketname(&bucket) {
             None

crates/ecstore/src/core/sets.rs

@@ -14,8 +14,6 @@
 // limitations under the License.
 
 use crate::disk::error_reduce::count_errs;
-#[cfg(any(test, feature = "test-util"))]
-use crate::disk::new_disk;
 use crate::error::{Error, Result, is_all_volume_not_found, is_err_object_not_found, is_err_strict_volume_not_found};
 use crate::layout::set_heal::{formats_to_drives_info, new_heal_format_sets};
 use crate::multipart_listing::paginate_multipart_listing;
@@ -30,6 +28,7 @@ use crate::{
         DiskAPI, DiskOption, DiskStore,
         error::DiskError,
         format::{DistributionAlgoVersion, FormatV3},
+        new_disk,
     },
     error::StorageError,
     layout::endpoints::{Endpoints, PoolEndpoints},
@@ -66,38 +65,6 @@ use uuid::Uuid;
 
 const LIST_MULTIPART_SETS_CONCURRENCY: usize = 4;
 
-#[cfg(test)]
-type TestSetLockers = HashMap<usize, Vec<Arc<dyn rustfs_lock::LockClient>>>;
-
-#[cfg(test)]
-static TEST_SET_LOCKERS: std::sync::LazyLock<std::sync::Mutex<TestSetLockers>> =
-    std::sync::LazyLock::new(|| std::sync::Mutex::new(HashMap::new()));
-
-/// Keep a fixture's real locker domain scoped to its owning instance.
-#[cfg(test)]
-pub(crate) struct ScopedSetLockers(Arc<InstanceContext>);
-
-#[cfg(test)]
-impl ScopedSetLockers {
-    pub(crate) fn install(ctx: Arc<InstanceContext>, lockers: Vec<Arc<dyn rustfs_lock::LockClient>>) -> Self {
-        let key = Arc::as_ptr(&ctx) as usize;
-        let mut domains = TEST_SET_LOCKERS.lock().expect("test set lockers mutex");
-        assert!(!domains.contains_key(&key), "the instance already owns a test locker domain");
-        domains.insert(key, lockers);
-        Self(ctx)
-    }
-}
-
-#[cfg(test)]
-impl Drop for ScopedSetLockers {
-    fn drop(&mut self) {
-        TEST_SET_LOCKERS
-            .lock()
-            .expect("test set lockers mutex")
-            .remove(&(Arc::as_ptr(&self.0) as usize));
-    }
-}
-
 fn is_idempotent_delete_prefix_error(err: &Error) -> bool {
     is_err_object_not_found(err) || is_err_strict_volume_not_found(err)
 }
@@ -299,14 +266,6 @@ impl Sets {
                 }
             }
 
-            #[cfg(test)]
-            let pool_lockers = TEST_SET_LOCKERS
-                .lock()
-                .expect("test set lockers mutex")
-                .get(&(Arc::as_ptr(&instance_ctx) as usize))
-                .cloned()
-                .unwrap_or_else(|| pool_lockers.clone());
-
             let set_disks = SetDisks::new_with_instance_ctx(
                 runtime_sources::local_node_name().await,
                 Arc::new(RwLock::new(set_drive)),
@@ -1106,7 +1065,6 @@ impl Sets {
         F: FnMut() -> bool + Send,
     {
         let (disks, init_errs) = init_storage_disks_with_errors(
-            &self.ctx,
             &self.endpoints.endpoints,
             &DiskOption {
                 cleanup: false,
@@ -1312,7 +1270,6 @@ async fn _close_storage_disks(disks: &[Option<DiskStore>]) {
 }
 
 async fn init_storage_disks_with_errors(
-    instance: &InstanceContext,
     endpoints: &Endpoints,
     opts: &DiskOption,
 ) -> (Vec<Option<DiskStore>>, Vec<Option<DiskError>>) {
@@ -1321,7 +1278,7 @@ async fn init_storage_disks_with_errors(
     // let errs = Arc::new(RwLock::new(vec![None; endpoints.as_ref().len()]));
     let mut futures = Vec::with_capacity(endpoints.as_ref().len());
     for endpoint in endpoints.as_ref().iter() {
-        futures.push(crate::disk::new_disk_for_instance(instance, endpoint, opts));
+        futures.push(new_disk(endpoint, opts));
 
         // let ep = endpoint.clone();
         // let opt = opts.clone();

crates/ecstore/src/disk/disk_store.rs

@@ -124,7 +124,7 @@ where
     Box::pin(operation(io_permit))
 }
 
-pub(crate) struct SlowDiskWriter {
+struct SlowDiskWriter {
     inner: crate::disk::FileWriter,
     endpoint: Endpoint,
     pending: Option<(&'static str, time::Instant)>,
@@ -143,10 +143,6 @@ impl SlowDiskWriter {
         }
     }
 
-    pub(crate) fn inner_mut(&mut self) -> &mut dyn crate::disk::DiskFileWriter {
-        &mut *self.inner
-    }
-
     fn observe<T>(&mut self, cx: &mut Context<'_>, op: &'static str, result: Poll<T>) -> Poll<T> {
         if result.is_ready() {
             self.pending = None;
@@ -3057,15 +3053,6 @@ impl DiskAPI for LocalDiskWrapper {
         })
     }
 
-    async fn bucket_creation_witness(&self, volume: &str) -> Result<Option<super::os::NativeBucketCreationWitness>> {
-        self.track_disk_health_with_op(
-            "bucket_creation_witness",
-            || async { self.disk.bucket_creation_witness(volume).await },
-            Duration::ZERO,
-        )
-        .await
-    }
-
     async fn make_volume(&self, volume: &str) -> Result<()> {
         // Scoped heal must drain directory creation before releasing its lifecycle owner.
         let timeout = if crate::store::bucket_heal_scope(volume).is_some() {

crates/ecstore/src/disk/fs.rs

@@ -92,9 +92,6 @@ pub const O_APPEND: FileMode = 0x00400;
 //     create_new: bool,
 
 pub async fn open_file(path: impl AsRef<Path>, mode: FileMode) -> io::Result<File> {
-    if mode & O_CREATE != 0 {
-        super::os::record_native_publication(path.as_ref());
-    }
     let path = path.as_ref().to_path_buf();
     native_io(move || {
         let mut options = std::fs::OpenOptions::new();
@@ -147,7 +144,6 @@ pub fn create_dir_all_std(path: &Path) -> io::Result<()> {
 }
 
 pub async fn make_dir_all(path: impl AsRef<Path>) -> io::Result<()> {
-    super::os::record_native_publication(path.as_ref());
     let path = path.as_ref().to_path_buf();
     native_io(move || create_dir_all_std(&path)).await
 }
@@ -220,13 +216,11 @@ pub fn remove_all_std(path: impl AsRef<Path>) -> io::Result<()> {
 
 #[cfg(test)]
 pub async fn mkdir(path: impl AsRef<Path>) -> io::Result<()> {
-    super::os::record_native_publication(path.as_ref());
     let path = path.as_ref().to_path_buf();
     native_io(move || std::fs::create_dir(path)).await
 }
 
 pub async fn rename(from: impl AsRef<Path>, to: impl AsRef<Path>) -> io::Result<()> {
-    super::os::record_native_publication(to.as_ref());
     let from = from.as_ref().to_path_buf();
     let to = to.as_ref().to_path_buf();
     native_io(move || std::fs::rename(from, to)).await
@@ -234,7 +228,6 @@ pub async fn rename(from: impl AsRef<Path>, to: impl AsRef<Path>) -> io::Result<
 
 #[cfg(any(not(windows), test))]
 pub fn rename_std(from: impl AsRef<Path>, to: impl AsRef<Path>) -> io::Result<()> {
-    super::os::record_native_publication(to.as_ref());
     std::fs::rename(from, to)
 }
 

crates/ecstore/src/disk/local.rs

@@ -76,8 +76,8 @@ use crate::disk::{
     error_conv::{to_access_error, to_file_error, to_unformatted_disk_error, to_volume_error},
     format::FormatV3,
     fs::{
-        O_APPEND, O_CREATE, O_RDONLY, O_TRUNC, O_WRONLY, access, cached_access, invalidate_bucket_cache, lstat, lstat_std,
-        remove, remove_all_std, remove_std, rename,
+        O_APPEND, O_CREATE, O_RDONLY, O_WRONLY, access, cached_access, invalidate_bucket_cache, lstat, lstat_std, remove,
+        remove_all_std, remove_std, rename,
     },
     is_quota_mutation_fence_path, os,
     os::{check_path_length, is_dir_not_empty_error, is_empty_dir, is_root_disk, rename_all, rename_all_ignore_missing_source},
@@ -616,7 +616,6 @@ fn take_published_part_txn_receipt(transaction_path: &Path) -> Option<PublishedP
 }
 
 fn restore_part_transaction_file(current: &Path, backup: &Path, absent: &Path, restore: &Path) -> std::io::Result<()> {
-    os::record_native_publication(current);
     match std::fs::symlink_metadata(backup) {
         Ok(metadata) if metadata.is_file() => {
             remove_file_if_exists(restore)?;
@@ -669,7 +668,6 @@ async fn write_delete_rollback_files(
     namespace_owner: Option<Arc<dyn Send + Sync>>,
 ) -> Result<Option<crate::disk::DeleteRecoveryInspection>> {
     let backup_dir = object_dir.join(rollback_dir.to_string());
-    os::record_native_publication(&backup_dir);
     let mut removed_entries = Vec::with_capacity(remove_before_publish.len());
     for &name in remove_before_publish {
         let path = backup_dir.join(name);
@@ -2839,9 +2837,6 @@ fn open_direct_writer(
 ) -> Result<Option<DirectWriter>> {
     use std::os::unix::fs::OpenOptionsExt;
 
-    #[cfg(test)]
-    os::prepared_publication_test_hooks::run(os::prepared_publication_test_hooks::Stage::DirectWriteOpen, file_path);
-    os::record_native_publication(file_path);
     #[cfg(test)]
     run_owned_file_before_open(file_path);
 
@@ -4325,28 +4320,20 @@ fn take_presynced_tmp_file(file: &Path) -> bool {
     PRESYNCED_TMP_FILES.remove(file).is_some()
 }
 
-fn open_lazy_local_file_std(
-    file_path: &Path,
-    volume_dir: &Path,
-    _reclaim_on_shutdown: bool,
-    parent_exists: bool,
-) -> std::io::Result<std::fs::File> {
-    let mut open_opts = std::fs::OpenOptions::new();
-    open_opts.write(true).create(true).truncate(true);
-    let file = match parent_exists.then(|| open_opts.open(file_path)) {
-        Some(Ok(file)) => file,
-        Some(Err(err)) if err.kind() != std::io::ErrorKind::NotFound => return Err(to_file_error(err)),
-        _ => {
-            if let Some(parent) = file_path.parent()
-                && (volume_dir.as_os_str().is_empty() || !volume_dir.starts_with(parent))
-                && let Err(err) = super::fs::create_dir_all_std(parent)
-                && err.kind() != std::io::ErrorKind::AlreadyExists
-            {
-                return Err(to_file_error(err));
-            }
-            open_opts.open(file_path).map_err(to_file_error)?
-        }
-    };
+fn open_lazy_local_file_std(file_path: &Path, volume_dir: &Path, _reclaim_on_shutdown: bool) -> std::io::Result<std::fs::File> {
+    if let Some(parent) = file_path.parent()
+        && (volume_dir.as_os_str().is_empty() || !volume_dir.starts_with(parent))
+        && let Err(err) = super::fs::create_dir_all_std(parent)
+        && err.kind() != std::io::ErrorKind::AlreadyExists
+    {
+        return Err(to_file_error(err));
+    }
+    let file = std::fs::OpenOptions::new()
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .open(file_path)
+        .map_err(to_file_error)?;
     #[cfg(target_os = "macos")]
     if _reclaim_on_shutdown {
         let _ = set_std_fd_nocache(&file);
@@ -4354,57 +4341,20 @@ fn open_lazy_local_file_std(
     Ok(file)
 }
 
-fn write_all_prefix_and_body_std(file: &mut std::fs::File, prefix: &[u8], body: &[u8]) -> std::io::Result<()> {
-    if prefix.is_empty() {
-        return std::io::Write::write_all(file, body);
-    }
-    let mut prefix_off = 0;
-    let mut body_off = 0;
-    while prefix_off < prefix.len() {
-        let slices = [
-            std::io::IoSlice::new(&prefix[prefix_off..]),
-            std::io::IoSlice::new(&body[body_off..]),
-        ];
-        let n = match std::io::Write::write_vectored(file, &slices) {
-            Ok(n) => n,
-            Err(ref err) if err.kind() == std::io::ErrorKind::Interrupted => continue,
-            Err(err) => return Err(err),
-        };
-        if n == 0 {
-            return Err(std::io::Error::new(std::io::ErrorKind::WriteZero, "failed to write whole buffer"));
-        }
-        let prefix_rem = prefix.len() - prefix_off;
-        if n < prefix_rem {
-            prefix_off += n;
-        } else {
-            prefix_off = prefix.len();
-            body_off += n - prefix_rem;
-        }
-    }
-    if body_off < body.len() {
-        std::io::Write::write_all(file, &body[body_off..])?;
-    }
-    Ok(())
-}
-
-pub(crate) struct LazyLocalFileWriter {
+struct LazyLocalFileWriter {
     file_path: PathBuf,
     volume_dir: PathBuf,
     reclaim_len: usize,
     reclaim_on_shutdown: bool,
     sync_on_close: bool,
     mark_dir_presynced: bool,
-    parent_exists: bool,
     bytes_written: usize,
-    last_integrity_digest: Option<[u8; 32]>,
     state: LazyLocalFileWriterState,
 }
 
-type LazyWriteResult = std::io::Result<(Option<std::fs::File>, usize, Option<[u8; 32]>)>;
-
 enum LazyLocalFileWriterState {
     Unopened,
-    Writing(tokio::task::JoinHandle<LazyWriteResult>),
+    Writing(tokio::task::JoinHandle<std::io::Result<(Option<std::fs::File>, usize)>>),
     Open(std::fs::File),
     Closing(tokio::task::JoinHandle<std::io::Result<()>>),
     Closed,
@@ -4418,7 +4368,6 @@ impl LazyLocalFileWriter {
         reclaim_on_shutdown: bool,
         sync_on_close: bool,
         mark_dir_presynced: bool,
-        parent_exists: bool,
     ) -> Self {
         Self {
             file_path,
@@ -4427,118 +4376,69 @@ impl LazyLocalFileWriter {
             reclaim_on_shutdown,
             sync_on_close,
             mark_dir_presynced,
-            parent_exists,
             bytes_written: 0,
-            last_integrity_digest: None,
             state: LazyLocalFileWriterState::Unopened,
         }
     }
 
-    fn start_write_payload(
-        &mut self,
-        payload: Bytes,
-        hash_algo: Option<rustfs_utils::HashAlgorithm>,
-        integrity_spec: Option<(rustfs_filemeta::shard_integrity::PartIntegrity, u32, usize)>,
-    ) {
-        let hash_len = hash_algo.as_ref().map_or(0, rustfs_utils::HashAlgorithm::size);
-        let wire_len = hash_len.saturating_add(payload.len());
-        let close_after = self.reclaim_len > 0 && self.bytes_written.saturating_add(wire_len) >= self.reclaim_len;
-        let reclaim_len = self.bytes_written.saturating_add(wire_len).max(self.reclaim_len);
+    fn start_write_payload(&mut self, payload: Vec<u8>) {
+        let len = payload.len();
+        let close_after = self.reclaim_len > 0 && self.bytes_written.saturating_add(len) >= self.reclaim_len;
+        let reclaim_len = self.bytes_written.saturating_add(len).max(self.reclaim_len);
         let reclaim_on_shutdown = self.reclaim_on_shutdown;
         let sync_on_close = self.sync_on_close;
         let mark_dir_presynced = self.mark_dir_presynced;
-        let parent_exists = self.parent_exists;
-        self.last_integrity_digest = None;
-        let write_and_finish = move |mut file: std::fs::File, file_path: PathBuf| {
-            let digest = match integrity_spec {
-                Some((part, stripe, coding_index)) => {
-                    Some(part.shard_digest(stripe, coding_index, &payload).map_err(|_| {
-                        std::io::Error::new(std::io::ErrorKind::InvalidData, "shard integrity verification failed")
-                    })?)
-                }
-                None => None,
-            };
-            if hash_len > 0
-                && let Some(algo) = hash_algo
-            {
-                let hash = algo.hash_encode(&payload);
-                if hash.as_ref().is_empty() {
-                    return Err(std::io::Error::new(std::io::ErrorKind::InvalidInput, "hash is empty"));
-                }
-                write_all_prefix_and_body_std(&mut file, hash.as_ref(), &payload).map_err(to_file_error)?;
-            } else {
-                std::io::Write::write_all(&mut file, &payload).map_err(to_file_error)?;
-            }
-            if close_after {
-                if sync_on_close {
-                    file.sync_data().map_err(to_file_error)?;
-                }
-                reclaim_std_file_cache(&file, reclaim_len, reclaim_on_shutdown);
-                drop(file);
-                if sync_on_close {
-                    if mark_dir_presynced && let Some(parent) = file_path.parent() {
-                        mark_presynced_tmp_data_dir(parent);
-                    }
-                    mark_presynced_tmp_file(file_path);
-                }
-                Ok((None, wire_len, digest))
-            } else {
-                Ok((Some(file), wire_len, digest))
-            }
-        };
         match std::mem::replace(&mut self.state, LazyLocalFileWriterState::Closed) {
             LazyLocalFileWriterState::Unopened => {
                 let file_path = self.file_path.clone();
                 let volume_dir = self.volume_dir.clone();
                 self.state = LazyLocalFileWriterState::Writing(tokio::task::spawn_blocking(move || {
-                    let file = open_lazy_local_file_std(&file_path, &volume_dir, reclaim_on_shutdown, parent_exists)?;
-                    write_and_finish(file, file_path)
+                    let mut file = open_lazy_local_file_std(&file_path, &volume_dir, reclaim_on_shutdown)?;
+                    std::io::Write::write_all(&mut file, &payload).map_err(to_file_error)?;
+                    if close_after {
+                        if sync_on_close {
+                            file.sync_data().map_err(to_file_error)?;
+                        }
+                        reclaim_std_file_cache(&file, reclaim_len, reclaim_on_shutdown);
+                        drop(file);
+                        if sync_on_close {
+                            if mark_dir_presynced && let Some(parent) = file_path.parent() {
+                                mark_presynced_tmp_data_dir(parent);
+                            }
+                            mark_presynced_tmp_file(file_path);
+                        }
+                        Ok((None, len))
+                    } else {
+                        Ok((Some(file), len))
+                    }
                 }));
             }
-            LazyLocalFileWriterState::Open(file) => {
+            LazyLocalFileWriterState::Open(mut file) => {
                 let file_path = self.file_path.clone();
-                self.state =
-                    LazyLocalFileWriterState::Writing(tokio::task::spawn_blocking(move || write_and_finish(file, file_path)));
+                self.state = LazyLocalFileWriterState::Writing(tokio::task::spawn_blocking(move || {
+                    std::io::Write::write_all(&mut file, &payload).map_err(to_file_error)?;
+                    if close_after {
+                        if sync_on_close {
+                            file.sync_data().map_err(to_file_error)?;
+                        }
+                        reclaim_std_file_cache(&file, reclaim_len, reclaim_on_shutdown);
+                        drop(file);
+                        if sync_on_close {
+                            if mark_dir_presynced && let Some(parent) = file_path.parent() {
+                                mark_presynced_tmp_data_dir(parent);
+                            }
+                            mark_presynced_tmp_file(file_path);
+                        }
+                        Ok((None, len))
+                    } else {
+                        Ok((Some(file), len))
+                    }
+                }));
             }
             other => self.state = other,
         }
     }
 
-    pub(crate) async fn write_all_bytes(&mut self, payload: Bytes) -> std::io::Result<()> {
-        if matches!(self.state, LazyLocalFileWriterState::Writing(_)) {
-            std::future::poll_fn(|cx| self.poll_in_flight_write(cx)).await?;
-        }
-        if payload.is_empty() {
-            return Ok(());
-        }
-        if matches!(self.state, LazyLocalFileWriterState::Closed | LazyLocalFileWriterState::Closing(_)) {
-            return Err(std::io::Error::new(std::io::ErrorKind::BrokenPipe, "local file writer is already closed"));
-        }
-        self.start_write_payload(payload, None, None);
-        std::future::poll_fn(|cx| self.poll_in_flight_write(cx)).await.map(|_| ())
-    }
-
-    pub(crate) async fn write_bitrot_shard(
-        &mut self,
-        shard: Bytes,
-        hash_algo: rustfs_utils::HashAlgorithm,
-        integrity_spec: Option<(rustfs_filemeta::shard_integrity::PartIntegrity, u32, usize)>,
-    ) -> std::io::Result<(usize, Option<[u8; 32]>)> {
-        if matches!(self.state, LazyLocalFileWriterState::Writing(_)) {
-            std::future::poll_fn(|cx| self.poll_in_flight_write(cx)).await?;
-        }
-        let shard_len = shard.len();
-        if shard_len == 0 {
-            return Ok((0, None));
-        }
-        if matches!(self.state, LazyLocalFileWriterState::Closed | LazyLocalFileWriterState::Closing(_)) {
-            return Err(std::io::Error::new(std::io::ErrorKind::BrokenPipe, "local file writer is already closed"));
-        }
-        self.start_write_payload(shard, Some(hash_algo), integrity_spec);
-        std::future::poll_fn(|cx| self.poll_in_flight_write(cx)).await?;
-        Ok((shard_len, self.last_integrity_digest.take()))
-    }
-
     fn poll_in_flight_write(&mut self, cx: &mut std::task::Context<'_>) -> std::task::Poll<std::io::Result<usize>> {
         let LazyLocalFileWriterState::Writing(fut) = &mut self.state else {
             return std::task::Poll::Ready(Ok(0));
@@ -4553,9 +4453,8 @@ impl LazyLocalFileWriter {
                 self.state = LazyLocalFileWriterState::Closed;
                 std::task::Poll::Ready(Err(err))
             }
-            std::task::Poll::Ready(Ok(Ok((maybe_file, written, digest)))) => {
+            std::task::Poll::Ready(Ok(Ok((maybe_file, written)))) => {
                 self.bytes_written = self.bytes_written.saturating_add(written);
-                self.last_integrity_digest = digest;
                 self.state = maybe_file.map_or(LazyLocalFileWriterState::Closed, LazyLocalFileWriterState::Open);
                 std::task::Poll::Ready(Ok(written))
             }
@@ -4581,7 +4480,7 @@ impl AsyncWrite for LazyLocalFileWriter {
                 "local file writer is already closed",
             )));
         }
-        self.start_write_payload(Bytes::copy_from_slice(buf), None, None);
+        self.start_write_payload(buf.to_vec());
         self.poll_in_flight_write(cx)
     }
 
@@ -4607,7 +4506,7 @@ impl AsyncWrite for LazyLocalFileWriter {
         for slice in bufs {
             payload.extend_from_slice(slice);
         }
-        self.start_write_payload(Bytes::from(payload), None, None);
+        self.start_write_payload(payload);
         self.poll_in_flight_write(cx)
     }
 
@@ -4636,9 +4535,8 @@ impl AsyncWrite for LazyLocalFileWriter {
                     let file_path = self.file_path.clone();
                     let volume_dir = self.volume_dir.clone();
                     let reclaim_on_shutdown = self.reclaim_on_shutdown;
-                    let parent_exists = self.parent_exists;
                     self.state = LazyLocalFileWriterState::Closing(tokio::task::spawn_blocking(move || {
-                        open_lazy_local_file_std(&file_path, &volume_dir, reclaim_on_shutdown, parent_exists).map(drop)
+                        open_lazy_local_file_std(&file_path, &volume_dir, reclaim_on_shutdown).map(drop)
                     }));
                 }
                 LazyLocalFileWriterState::Open(file) => {
@@ -4958,9 +4856,6 @@ impl StdBackend {
     }
 
     async fn open_file(&self, path: impl AsRef<Path>, mode: usize, skip_parent: impl AsRef<Path>) -> Result<File> {
-        if mode == O_CREATE | O_WRONLY | O_TRUNC {
-            os::record_native_publication(path.as_ref());
-        }
         let mut skip_parent = skip_parent.as_ref();
         if skip_parent.as_os_str().is_empty() {
             skip_parent = self.io_root();
@@ -5690,14 +5585,11 @@ impl LocalIoBackend for StdBackend {
                 let file_path = local_disk_object_path(self.io_root(), volume, path)?;
                 check_path_length(file_path.to_string_lossy().as_ref())?;
                 let mut mark_dir_presynced = false;
-                let mut parent_exists = false;
                 if let Some(parent) = file_path.parent() {
                     check_path_length(parent.to_string_lossy().as_ref())?;
-                    parent_exists = parent == volume_dir;
                     if volume == RUSTFS_META_TMP_BUCKET {
                         unmark_presynced_tmp_file(&file_path);
                         let parent_was_presynced = unmark_presynced_tmp_data_dir(parent);
-                        parent_exists |= parent_was_presynced;
                         let file_name = file_path.file_name().and_then(|n| n.to_str()).unwrap_or_default();
                         mark_dir_presynced = sync_on_close
                             && (file_name == "part.1"
@@ -5720,7 +5612,6 @@ impl LocalIoBackend for StdBackend {
                     }
                     let write_state = self.direct_io_write.clone();
                     let direct_path = file_path.clone();
-                    os::record_native_publication(&direct_path);
                     let resource_unit = current_resource_unit();
                     let mount_lease = self.mount_lease.clone();
                     let direct = tokio::task::spawn_blocking(move || {
@@ -5734,8 +5625,6 @@ impl LocalIoBackend for StdBackend {
                     }
                 }
 
-                // The writer opens on first use, outside the fs helpers that record.
-                os::record_native_publication(&file_path);
                 if let Some(resources) = current_resource_unit() {
                     if let Some(parent) = file_path.parent() {
                         os::make_dir_all(parent, &volume_dir).await?;
@@ -5751,7 +5640,6 @@ impl LocalIoBackend for StdBackend {
                     reclaim_on_shutdown,
                     sync_on_close,
                     mark_dir_presynced,
-                    parent_exists,
                 )))
             }
             WriteMode::Append => {
@@ -7700,7 +7588,6 @@ async fn build_local_io_backend(
 pub struct LocalDisk {
     pub root: PathBuf,
     publication_root: os::PublicationRoot,
-    publication_history: Option<os::NativePublicationRegistration>,
     multipart_proof_authority: OnceLock<crate::disk::multipart_source::ProofVerificationContext>,
     multipart_index: Arc<multipart_index::IndexOwner>,
     /// I/O root pinned to the mount instance that was opened while the disk
@@ -8110,11 +7997,6 @@ impl LocalDisk {
         multipart_source_state::invalidate_active_multipart_sources_under(&io_root);
         multipart_source_state::invalidate_active_multipart_sources_under(&root);
 
-        let publication_history = os::register_native_publication_root(&root, &io_root);
-
-        #[cfg(all(test, target_os = "linux"))]
-        os::prepared_publication_test_hooks::run(os::prepared_publication_test_hooks::Stage::BeforeDataUsageLayout, &root);
-
         ensure_data_usage_layout(&io_root)
             .await
             .map_err(|e| e.narrow_to_disk().unwrap_or_else(DiskError::other))
@@ -8256,7 +8138,6 @@ impl LocalDisk {
             multipart_index,
             root: root.clone(),
             publication_root,
-            publication_history,
             multipart_proof_authority: OnceLock::new(),
             io_root: io_root.clone(),
             #[cfg(target_os = "linux")]
@@ -11188,7 +11069,6 @@ impl LocalDisk {
                     || should_fail_after_delete_data_staged(path))
             {
                 let rollback_path = object_dir.join(rollback_dir.to_string());
-                os::record_native_publication(&rollback_path);
                 if let Err(err) = fs::create_dir_all(&rollback_path).await {
                     let err: DiskError = to_file_error(err).into();
                     if reserved_version_delete {
@@ -11625,14 +11505,11 @@ impl LocalDisk {
     ) -> Result<()> {
         multipart_staging::reject_reserved_anchor(path)?;
         let fuse_with_admission = admission.is_some() && !crash_inject::is_armed(CrashPoint::MetaWriteAfterTmpBeforeRename, path);
-        // Held until the staging root is published, by the filesystem work
-        // itself, so a concurrent listing cannot prune the marker in between.
-        let mut index_pin = None;
         let prepared_index = if volume == RUSTFS_META_MULTIPART_BUCKET {
             if fuse_with_admission {
                 self.multipart_index.prepare_record_head(path, &buf).await
             } else {
-                index_pin = self.multipart_index.record_head(path, &buf).await?;
+                self.multipart_index.record_head(path, &buf).await?;
                 None
             }
         } else {
@@ -11658,10 +11535,8 @@ impl LocalDisk {
             let root = self.publication_root.clone();
             let lease = os::acquire_namespace_mutation_lease_with_owner(&file_path, namespace_owner).await;
             os::run_blocking_namespace_operation_with_sync(lease, do_sync, move || {
-                let _index_pin = prepared_index.map(|record| record.run_std()).transpose()?;
-                #[cfg(test)]
-                if let Some(pin) = &_index_pin {
-                    pin.pause_for_test();
+                if let Some(record) = prepared_index {
+                    record.run_std()?;
                 }
                 super::fs::create_dir_all_std(&tmp_volume_dir)?;
                 #[cfg(test)]
@@ -11705,16 +11580,12 @@ impl LocalDisk {
             return Err(DiskError::Unexpected);
         }
 
-        let publication_owner: Option<Arc<dyn Send + Sync>> = match index_pin {
-            Some(pin) => Some(Arc::new((namespace_owner.clone(), pin))),
-            None => namespace_owner.clone(),
-        };
         os::rename_all_with_precondition_and_parent_sync(
             &tmp_file_path,
             &file_path,
             &volume_dir,
             &self.publication_root,
-            publication_owner,
+            namespace_owner.clone(),
             admission.as_ref().map(|admission| admission.precondition()),
             admission.is_some() && sync && durability.syncs_commit_metadata(),
         )
@@ -11791,7 +11662,6 @@ impl LocalDisk {
         };
 
         let path = file_path.to_path_buf();
-        os::record_native_publication(&path);
         let create_parent = if let Some(parent) = path.parent()
             && parent != skip_parent
         {
@@ -11806,7 +11676,6 @@ impl LocalDisk {
             if is_cancelled() {
                 return Err(std::io::Error::other("blocking namespace operation cancelled"));
             }
-            os::record_native_publication(&path);
             if create_parent && let Some(parent) = path.parent() {
                 super::fs::create_dir_all_std(parent)?;
             }
@@ -14144,9 +14013,6 @@ impl DiskAPI for LocalDisk {
     }
 
     async fn close(&self) -> Result<()> {
-        if let Some(history) = self.publication_history.as_ref() {
-            history.invalidate();
-        }
         // This disk instance is being retired (e.g. replaced by renew_disk on
         // reconnect). Drop its cached descriptors so a replacement instance's
         // invalidations are never defeated by this one continuing to serve stale
@@ -14323,7 +14189,6 @@ impl DiskAPI for LocalDisk {
             let file_path = self.io_get_object_path(volume, path)?;
             let path = path.to_string();
             let sync_metadata = effective_durability(volume).syncs_commit_metadata();
-            os::record_native_publication(&file_path);
             #[cfg(target_os = "linux")]
             let mount_lease = self.mount_lease.clone();
             return Ok(spawn_blocking_with_disk_io_permit(None, move || {
@@ -14763,7 +14628,6 @@ impl DiskAPI for LocalDisk {
         if let Some(ref source) = admission_source {
             multipart_source_state::begin_active_multipart_part_transaction(source, part.number);
         }
-        os::record_native_publication(&transaction_path);
         let lease = os::acquire_namespace_mutation_lease_with_owner(&transaction_path, source_owner).await;
         let res = os::run_blocking_namespace_operation_with_sync(lease, sync, move || -> std::io::Result<Result<()>> {
             if let Some(ref admission) = admission
@@ -14974,7 +14838,6 @@ impl DiskAPI for LocalDisk {
             .and_then(|num| num.parse::<usize>().ok());
         let lease = os::acquire_namespace_mutation_lease_with_owner(&transaction_path, source_owner).await;
 
-        os::record_native_publication(&current_data_path);
         let res = os::run_blocking_namespace_operation_with_sync(lease, sync, move || -> std::io::Result<Result<bool>> {
             match std::fs::symlink_metadata(&transaction_path) {
                 Ok(metadata) if metadata.is_dir() => {}
@@ -15840,27 +15703,12 @@ impl DiskAPI for LocalDisk {
     }
 
     #[tracing::instrument(level = "trace", skip_all)]
-    async fn bucket_creation_witness(&self, volume: &str) -> Result<Option<os::NativeBucketCreationWitness>> {
-        let Some(history) = self.publication_history.as_ref() else {
-            return Ok(None);
-        };
-        let Some(disk_id) = self.get_disk_id().await? else {
-            return Ok(None);
-        };
-        Ok(history.witness(volume, disk_id, Arc::clone(&self.io_backend)))
-    }
-
     async fn make_volume(&self, volume: &str) -> Result<()> {
         if !Self::is_valid_volname(volume) {
             return Err(Error::other("Invalid arguments specified"));
         }
 
         let volume_dir = self.io_get_bucket_path(volume)?;
-        #[cfg(all(test, not(windows)))]
-        os::prepared_publication_test_hooks::run(
-            os::prepared_publication_test_hooks::Stage::CreateDirectory,
-            &self.root.join(volume),
-        );
 
         // Volume creation is a mutation boundary, so it must observe the live
         // filesystem rather than a potentially stale existence-cache entry.
@@ -16729,280 +16577,6 @@ mod test {
     use tokio::io::{AsyncReadExt, AsyncWrite, AsyncWriteExt, ReadBuf};
     use tracing_subscriber::fmt::MakeWriter;
 
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn owned_direct_child_open_attempt_consumes_native_history() {
-        let dir = tempfile::tempdir().expect("native disk directory");
-        let endpoint = Endpoint::try_from(dir.path().to_str().expect("UTF-8 disk path")).expect("disk endpoint");
-        let disk = LocalDisk::new(&endpoint, false).await.expect("native local disk");
-        let bucket = format!("owned-open-attempt-{}", Uuid::new_v4());
-        let witness = disk
-            .publication_history
-            .as_ref()
-            .expect("native registration")
-            .witness(&bucket, Uuid::new_v4(), Arc::clone(&disk.io_backend))
-            .expect("fresh history");
-
-        disk.write_all_public(&bucket, "direct-child", Bytes::from_static(b"payload"))
-            .await
-            .expect_err("the direct child has no bucket parent");
-        assert!(
-            !os::validate_native_creation_witnesses(&[witness]),
-            "even a failed O_CREATE in the real owned executor must permanently consume native history"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn lazy_truncate_writer_consumes_native_history_before_first_open() {
-        let dir = tempfile::tempdir().expect("native disk directory");
-        let endpoint = Endpoint::try_from(dir.path().to_str().expect("UTF-8 disk path")).expect("disk endpoint");
-        let disk = LocalDisk::new(&endpoint, false).await.expect("native local disk");
-        let bucket = format!("lazy-open-attempt-{}", Uuid::new_v4());
-        let witness = disk
-            .publication_history
-            .as_ref()
-            .expect("native registration")
-            .witness(&bucket, Uuid::new_v4(), Arc::clone(&disk.io_backend))
-            .expect("fresh history");
-
-        let writer = disk
-            .io_backend
-            .open_write(&bucket, "object/part.1", WriteMode::Truncate { size_hint: 1 })
-            .await
-            .expect("the lazy writer defers its open");
-        assert!(
-            !os::validate_native_creation_witnesses(&[witness]),
-            "a deferred truncate open must consume native history when it is admitted"
-        );
-        drop(writer);
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn borrowed_open_cancellation_retains_started_history_before_execution() {
-        use std::sync::mpsc;
-
-        let runtime = tokio::runtime::Builder::new_current_thread()
-            .enable_all()
-            .max_blocking_threads(1)
-            .build()
-            .expect("single blocking worker runtime");
-        runtime.block_on(async {
-            let dir = tempfile::tempdir().expect("native disk directory");
-            let endpoint = Endpoint::try_from(dir.path().to_str().expect("UTF-8 disk path")).expect("disk endpoint");
-            let disk = LocalDisk::new(&endpoint, false).await.expect("native local disk");
-            let history = disk.publication_history.as_ref().expect("native registration");
-            let bucket = format!("borrowed-queued-open-{}", Uuid::new_v4());
-            let disk_id = Uuid::new_v4();
-            let witness = history
-                .witness(&bucket, disk_id, Arc::clone(&disk.io_backend))
-                .expect("fresh native history");
-            let path = disk.io_root().join(&bucket);
-            let (entered_tx, entered_rx) = mpsc::channel();
-            let (release_tx, release_rx) = mpsc::channel();
-            let blocker = tokio::task::spawn_blocking(move || {
-                entered_tx.send(()).expect("signal occupied blocking worker");
-                let _ = release_rx.recv();
-            });
-            entered_rx
-                .recv_timeout(Duration::from_secs(30))
-                .expect("the only blocking worker must be occupied");
-
-            let mut operation =
-                Box::pin(disk.write_all_internal(&path, Bytes::from_static(b"payload"), SyncMode::None, disk.io_root()));
-            let queued = futures::poll!(operation.as_mut()).is_pending();
-            let started_before_execution = !os::validate_native_creation_witnesses(std::slice::from_ref(&witness));
-            let absent_before_execution = !path.exists();
-            drop(operation);
-            release_tx.send(()).expect("release the blocking worker");
-            blocker.await.expect("blocking worker must drain");
-            tokio::task::spawn_blocking(|| ())
-                .await
-                .expect("queued native open must drain before assertions");
-
-            assert!(queued, "the borrowed write must queue behind the occupied worker");
-            assert!(
-                absent_before_execution,
-                "the real open must not run before the blocking worker is released"
-            );
-            assert!(
-                started_before_execution,
-                "the borrowed write must consume native history before queueing its open"
-            );
-            // The disk blocking queue skips an operation once its waiter is gone
-            // (`run_cancellable` observes the closed result channel), so the open
-            // never runs. The Started record taken before queueing must survive
-            // that cancellation: the proof stays conservatively consumed.
-            assert!(!path.exists(), "a cancelled borrowed write must not run its queued open");
-            assert!(
-                history.witness(&bucket, disk_id, Arc::clone(&disk.io_backend)).is_none(),
-                "executor drain must not regrant native history to a cancelled publication"
-            );
-        });
-    }
-
-    #[cfg(target_os = "linux")]
-    #[tokio::test]
-    async fn synchronous_direct_open_attempt_consumes_native_history() {
-        let dir = tempfile::tempdir().expect("native disk directory");
-        let endpoint = Endpoint::try_from(dir.path().to_str().expect("UTF-8 disk path")).expect("disk endpoint");
-        let disk = LocalDisk::new(&endpoint, false).await.expect("native local disk");
-        let bucket = format!("direct-io-open-attempt-{}", Uuid::new_v4());
-        let witness = disk
-            .publication_history
-            .as_ref()
-            .expect("native registration")
-            .witness(&bucket, Uuid::new_v4(), Arc::clone(&disk.io_backend))
-            .expect("fresh history");
-        let path = disk.io_get_object_path(&bucket, "direct-child").expect("direct I/O path");
-
-        assert!(
-            open_direct_writer(&path, &DirectIoWriteState::new(), None).is_err(),
-            "the actual synchronous O_DIRECT entry must observe the missing bucket parent"
-        );
-        assert!(
-            !os::validate_native_creation_witnesses(&[witness]),
-            "a directly callable O_CREATE helper cannot retain retry permission after a failed publication attempt"
-        );
-    }
-
-    #[cfg(target_os = "linux")]
-    #[tokio::test]
-    async fn linux_queued_direct_open_cancellation_retains_started_history() {
-        use crate::disk::os::prepared_publication_test_hooks as hooks;
-        use std::sync::mpsc;
-
-        let dir = tempfile::tempdir().expect("native disk directory");
-        let endpoint = Endpoint::try_from(dir.path().to_str().expect("UTF-8 disk path")).expect("disk endpoint");
-        let disk = LocalDisk::new(&endpoint, false).await.expect("native local disk");
-        let backend = Arc::new(StdBackend::new_without_fd_cache(disk.io_root().to_path_buf()));
-        let actual_backend: Arc<dyn LocalIoBackend> = backend.clone();
-        let history = disk.publication_history.as_ref().expect("native registration");
-        let bucket = format!("native-queued-dio-{}", Uuid::new_v4());
-        let disk_id = Uuid::new_v4();
-        let witness = history
-            .witness(&bucket, disk_id, Arc::clone(&actual_backend))
-            .expect("fresh native history");
-        let path = local_disk_object_path(disk.io_root(), "", &bucket).expect("first-level DIO path");
-        let write_state = Arc::clone(&backend.direct_io_write);
-        let idle_state_owners = Arc::strong_count(&write_state);
-        let (entered_tx, entered_rx) = mpsc::channel();
-        let (release_tx, release_rx) = mpsc::channel();
-        let _hook = hooks::install_at(hooks::Stage::DirectWriteOpen, &path, move || {
-            entered_tx.send(()).expect("signal real DIO executor entry");
-            let _ = release_rx.recv();
-        });
-
-        temp_env::async_with_vars([(ENV_RUSTFS_OBJECT_DIRECT_IO_WRITE_ENABLE, Some("true"))], async {
-            let operation_backend = Arc::clone(&backend);
-            let operation_bucket = bucket.clone();
-            let operation = tokio::spawn(async move {
-                operation_backend
-                    .open_write("", &operation_bucket, WriteMode::Truncate { size_hint: 0 })
-                    .await
-            });
-            tokio::task::spawn_blocking(move || entered_rx.recv_timeout(Duration::from_secs(30)))
-                .await
-                .expect("DIO entry waiter")
-                .expect("the real blocking executor must enter");
-            assert!(
-                !os::validate_native_creation_witnesses(std::slice::from_ref(&witness)),
-                "Started must be recorded before the queued DIO worker performs its own history lookup"
-            );
-            assert!(!path.exists(), "the keyed pause must precede the actual O_DIRECT open");
-            operation.abort();
-            match operation.await {
-                Err(error) if error.is_cancelled() => {}
-                Err(error) => panic!("DIO waiter failed instead of cancelling: {error}"),
-                Ok(_) => panic!("the paused DIO waiter must be cancelled"),
-            }
-            release_tx.send(()).expect("release the real DIO open");
-            timeout(Duration::from_secs(30), async {
-                while Arc::strong_count(&write_state) > idle_state_owners {
-                    tokio::task::yield_now().await;
-                }
-            })
-            .await
-            .expect("the detached DIO executor must drain");
-        })
-        .await;
-
-        assert!(path.is_file(), "cancelling the waiter must not discard the queued native open");
-        std::fs::remove_file(&path).expect("remove the file published by the cancelled DIO waiter");
-        assert!(
-            history.witness(&bucket, disk_id, actual_backend).is_none(),
-            "executor drain and physical removal must not regrant native history"
-        );
-    }
-
-    #[cfg(target_os = "linux")]
-    #[tokio::test]
-    async fn linux_mount_lease_alias_publication_consumes_same_history() {
-        let dir = tempfile::tempdir().expect("native disk directory");
-        let endpoint = Endpoint::try_from(dir.path().to_str().expect("UTF-8 disk path")).expect("disk endpoint");
-        let disk = LocalDisk::new(&endpoint, false).await.expect("native local disk");
-        let history = disk.publication_history.as_ref().expect("native registration");
-        let disk_id = Uuid::new_v4();
-        for (alias, root) in [("root", disk.root.as_path()), ("io", disk.io_root())] {
-            let bucket = format!("native-alias-{alias}-{}", Uuid::new_v4());
-            let witness = history
-                .witness(&bucket, disk_id, Arc::clone(&disk.io_backend))
-                .expect("fresh native history through both real root aliases");
-            super::super::fs::mkdir(root.join(&bucket))
-                .await
-                .expect("publish through the actual directory entry");
-            assert!(
-                !os::validate_native_creation_witnesses(std::slice::from_ref(&witness)),
-                "{alias}: publication through either physical-root alias must consume the same history"
-            );
-            std::fs::remove_dir(disk.root.join(&bucket)).expect("remove the physically published directory");
-            assert!(
-                history.witness(&bucket, disk_id, Arc::clone(&disk.io_backend)).is_none(),
-                "{alias}: removal through the other alias must not regrant native history"
-            );
-        }
-    }
-
-    #[cfg(target_os = "linux")]
-    #[tokio::test]
-    async fn linux_native_history_is_registered_before_data_usage_layout() {
-        use crate::disk::os::prepared_publication_test_hooks as hooks;
-
-        let dir = tempfile::tempdir().expect("native disk directory");
-        let root = std::fs::canonicalize(dir.path()).expect("canonical disk root");
-        let bucket = format!("native-before-layout-{}", Uuid::new_v4());
-        let source = root.join(format!("layout-source-{}", Uuid::new_v4()));
-        std::fs::create_dir(&source).expect("prepare an actual directory for publication");
-        let destination = root.join(&bucket);
-        let publication_path = destination.clone();
-        let _hook = hooks::install_at(hooks::Stage::BeforeDataUsageLayout, &root, move || {
-            super::super::fs::rename_std(&source, &publication_path)
-                .expect("publish through the native entry before data usage layout");
-        });
-        let endpoint = Endpoint::try_from(root.to_str().expect("UTF-8 disk path")).expect("disk endpoint");
-        let disk = LocalDisk::new(&endpoint, false)
-            .await
-            .expect("native local disk with real startup layout");
-        let history = disk.publication_history.as_ref().expect("native registration");
-        let disk_id = Uuid::new_v4();
-
-        let untouched = format!("native-layout-untouched-{}", Uuid::new_v4());
-        assert!(
-            history.witness(&untouched, disk_id, Arc::clone(&disk.io_backend)).is_some(),
-            "startup layout must keep an untouched bucket's native history known"
-        );
-        assert!(
-            history.witness(&bucket, disk_id, Arc::clone(&disk.io_backend)).is_none(),
-            "registration must capture real publication before startup layout finishes"
-        );
-        std::fs::remove_dir(destination).expect("remove the physically published directory");
-        assert!(
-            history.witness(&bucket, disk_id, Arc::clone(&disk.io_backend)).is_none(),
-            "startup completion and physical removal must retain Started"
-        );
-    }
-
     #[cfg(unix)]
     #[tokio::test]
     async fn read_dir_entries_skip_symlinks_without_truncating_listing() {
@@ -20661,109 +20235,6 @@ mod test {
         );
     }
 
-    #[tokio::test]
-    async fn rename_data_pending_restore_requires_parts_only_from_multipart_staging() {
-        let dir = tempfile::tempdir().expect("disk directory should be created");
-        let endpoint =
-            Endpoint::try_from(dir.path().to_str().expect("disk path should be UTF-8")).expect("disk endpoint should parse");
-        let disk = LocalDisk::new(&endpoint, false).await.expect("local disk should be created");
-        let bucket = "restore-rename-controls";
-        ensure_test_volume(&disk, bucket).await;
-        for (case, source_volume, pending, requires_parts) in [
-            ("remote", RUSTFS_META_TMP_BUCKET, false, false),
-            ("pending-remote", RUSTFS_META_TMP_BUCKET, true, false),
-            ("pending-multipart", crate::disk::RUSTFS_META_MULTIPART_BUCKET, true, true),
-        ] {
-            ensure_test_volume(&disk, source_volume).await;
-            let staging = dir.path().join(source_volume).join(case);
-            fs::create_dir_all(&staging).await.expect("staging parent should be created");
-            let data_dir = Uuid::new_v4();
-            let mut fi = test_file_info(case, Uuid::nil(), Some(data_dir), None);
-            fi.transition_status = rustfs_filemeta::TRANSITION_COMPLETE.to_string();
-            fi.transition_tier = "WARM".to_string();
-            fi.transitioned_objname = "remote/object".to_string();
-            if pending {
-                fi.metadata.insert(
-                    rustfs_filemeta::metadata_keys::RESTORE.to_string(),
-                    "ongoing-request=\"true\"".to_string(),
-                );
-            }
-            let result = disk.rename_data(source_volume, case, fi, bucket, case).await;
-            let destination = dir.path().join(bucket).join(case);
-            if requires_parts {
-                assert!(result.is_err(), "missing multipart restore parts must reject the physical commit");
-                assert!(
-                    !destination.join(STORAGE_FORMAT_FILE).exists(),
-                    "failed multipart restore must not publish metadata for absent local parts"
-                );
-            } else {
-                result.expect("remote-only metadata commits must not require local staged parts");
-                let stored = fs::read(destination.join(STORAGE_FORMAT_FILE))
-                    .await
-                    .expect("remote-only metadata should be committed");
-                let restored = FileMeta::load(&stored)
-                    .expect("committed metadata should decode")
-                    .into_fileinfo(bucket, case, "", false, false, false)
-                    .expect("committed version should decode");
-                assert!(restored.is_remote(), "remote-only commits must retain remote read routing");
-                assert!(
-                    !destination.join(data_dir.to_string()).exists(),
-                    "remote-only metadata commit must not create a local payload directory"
-                );
-            }
-        }
-    }
-
-    #[tokio::test]
-    async fn rename_data_pending_multipart_restore_rejects_absent_data_directory() {
-        assert_pending_multipart_restore_rejects_directory(None).await;
-    }
-
-    #[tokio::test]
-    async fn rename_data_pending_multipart_restore_rejects_nil_data_directory() {
-        assert_pending_multipart_restore_rejects_directory(Some(Uuid::nil())).await;
-    }
-
-    async fn assert_pending_multipart_restore_rejects_directory(data_dir: Option<Uuid>) {
-        let dir = tempfile::tempdir().expect("disk directory should be created");
-        let endpoint =
-            Endpoint::try_from(dir.path().to_str().expect("disk path should be UTF-8")).expect("disk endpoint should parse");
-        let disk = LocalDisk::new(&endpoint, false).await.expect("local disk should be created");
-        let source_volume = crate::disk::RUSTFS_META_MULTIPART_BUCKET;
-        let bucket = "restore-invalid-directory";
-        let object = "object.bin";
-        ensure_test_volume(&disk, source_volume).await;
-        ensure_test_volume(&disk, bucket).await;
-        let staging = dir.path().join(source_volume).join(object);
-        fs::create_dir_all(&staging).await.expect("staging parent should be created");
-        if let Some(data_dir) = data_dir {
-            let data_path = staging.join(data_dir.to_string());
-            fs::create_dir_all(&data_path)
-                .await
-                .expect("invalid staging directory should be created");
-            fs::write(data_path.join("part.1"), b"x")
-                .await
-                .expect("nil directory fixture must contain a real part");
-        }
-        let mut fi = test_file_info(object, Uuid::nil(), data_dir, None);
-        fi.transition_status = rustfs_filemeta::TRANSITION_COMPLETE.to_string();
-        fi.transition_tier = "WARM".to_string();
-        fi.transitioned_objname = "remote/object".to_string();
-        fi.metadata.insert(
-            rustfs_filemeta::metadata_keys::RESTORE.to_string(),
-            "ongoing-request=\"true\"".to_string(),
-        );
-        let result = disk.rename_data(source_volume, object, fi, bucket, object).await;
-        assert!(
-            matches!(result, Err(DiskError::FileCorrupt)),
-            "pending multipart restore must reject absent or nil staging identity as corrupt: {result:?}"
-        );
-        assert!(
-            !dir.path().join(bucket).join(object).join(STORAGE_FORMAT_FILE).exists(),
-            "invalid staging identity must fail before metadata publication"
-        );
-    }
-
     #[cfg(target_os = "linux")]
     #[tokio::test]
     #[serial_test::serial(dst_dir_fsync_group_commit, file_fdatasync_group_commit)]
@@ -38563,45 +38034,4 @@ mod test {
             "cached child under renamed-from directory must be invalidated"
         );
     }
-
-    #[tokio::test]
-    async fn disk_store_create_file_downcasts_and_writes_bitrot_shard_with_integrity() {
-        use tokio::io::AsyncWriteExt as _;
-
-        let dir = tempfile::tempdir().expect("tempdir");
-        let endpoint = Endpoint::try_from(dir.path().to_str().expect("utf8 path")).expect("endpoint");
-        let disk_store = crate::disk::new_disk(&endpoint, &crate::disk::DiskOption::default())
-            .await
-            .expect("disk store");
-        let volume = "bitrot-fast-path-test";
-        disk_store.make_volume(volume).await.expect("make_volume");
-
-        let payload = Bytes::from(vec![0x5Au8; 4096]);
-        let algo = rustfs_utils::HashAlgorithm::HighwayHash256S;
-        let wire_len = (algo.size() + payload.len()) as i64;
-        let mut writer = disk_store
-            .create_file(volume, volume, "obj/part.1", wire_len)
-            .await
-            .expect("create_file");
-        let local = crate::disk::as_lazy_local_file_writer_mut(&mut *writer)
-            .expect("SlowDiskWriter wrapping LazyLocalFileWriter must downcast");
-
-        let layout = rustfs_filemeta::shard_integrity::IntegrityLayout::new(4, 4, 16384, false).expect("layout");
-        let part = rustfs_filemeta::shard_integrity::PartIntegrity::new(layout, 1).expect("part");
-        let expected_digest = part.shard_digest(0, 2, &payload).expect("expected digest");
-
-        let (written, digest) = local
-            .write_bitrot_shard(payload.clone(), algo.clone(), Some((part, 0, 2)))
-            .await
-            .expect("write_bitrot_shard");
-        writer.shutdown().await.expect("shutdown");
-
-        assert_eq!(written, payload.len());
-        assert_eq!(digest, Some(expected_digest));
-
-        let on_disk = disk_store.read_all(volume, "obj/part.1").await.expect("read_all");
-        let expected_hash = algo.hash_encode(&payload);
-        assert_eq!(&on_disk[..expected_hash.as_ref().len()], expected_hash.as_ref());
-        assert_eq!(&on_disk[expected_hash.as_ref().len()..], payload.as_ref());
-    }
 }

crates/ecstore/src/disk/local/commit.rs

@@ -286,15 +286,12 @@ pub(super) fn fsync_inline_commit_std(
 
     if destination_was_absent {
         let mut ancestor = dst.parent().and_then(Path::parent);
-        let mut ancestor_step = 0usize;
         while let Some(ancestor_dir) = ancestor {
             if !ancestor_dir.starts_with(dst_volume_dir) {
                 break;
             }
             let fsync_started = rustfs_io_metrics::put_stage_timer();
-            if let Err(err) =
-                os::fsync_commit_ancestor_directory_limited_std(ancestor_dir, dst_volume_dir, ancestor_step, commit_guard)
-            {
+            if let Err(err) = os::fsync_dir_limited_std(ancestor_dir) {
                 rustfs_io_metrics::record_put_object_stage_duration_from(
                     rustfs_io_metrics::PUT_STAGE_SET_DISK_RENAME_ANCESTOR_DIR_FSYNC,
                     fsync_started,
@@ -313,7 +310,6 @@ pub(super) fn fsync_inline_commit_std(
                 break;
             }
             ancestor = ancestor_dir.parent();
-            ancestor_step += 1;
         }
     }
     Ok(())
@@ -521,12 +517,8 @@ impl LocalDisk {
             state.preflight_rejection = Some(LocalRenamePreflightRejection(()));
         })?;
         crate::hp_guard!("LocalDisk::rename_data");
-        if dst_volume == super::super::RUSTFS_META_MULTIPART_BUCKET
-            && let Some(pin) = self.multipart_index.record_info(dst_path, &fi).await?
-        {
-            // The owner chain reaches every lease this rename publishes under,
-            // so the index marker stays pinned until that work has returned.
-            state.namespace_owner = Some(Arc::new((state.namespace_owner.take(), pin)));
+        if dst_volume == super::super::RUSTFS_META_MULTIPART_BUCKET {
+            self.multipart_index.record_info(dst_path, &fi).await?;
         }
         #[cfg(feature = "e2e-test-hooks")]
         if fi.is_healing() {
@@ -760,20 +752,8 @@ impl LocalDisk {
         };
         let dst_file_path = self.io_get_object_open_path(dst_volume, format!("{}/{}", dst_path, STORAGE_FORMAT_FILE).as_str())?;
 
-        // Multipart restore completion has validated staged local parts,
-        // while its public status stays pending until finalization.
-        let pending_multipart_restore = src_volume == crate::disk::RUSTFS_META_MULTIPART_BUCKET
-            && fi
-                .metadata
-                .get(rustfs_filemeta::metadata_keys::RESTORE)
-                .and_then(|value| rustfs_filemeta::parse_restore_obj_status(value).ok())
-                .is_some_and(|status| status.is_restore_in_progress == Some(true));
-        if pending_multipart_restore && fi.data_dir.is_none_or(|dir| dir.is_nil()) {
-            return Err(DiskError::FileCorrupt);
-        }
-
         // data_dir path (only used by the non-inline commit branch)
-        let has_data_dir_path = if no_inline && (!fi.is_remote() || pending_multipart_restore) {
+        let has_data_dir_path = if no_inline && !fi.is_remote() {
             if let Some(data_dir) = fi
                 .data_dir
                 .map(|dir| rustfs_utils::path::retain_slash(dir.to_string().as_str()))
@@ -1106,7 +1086,7 @@ impl LocalDisk {
                     if let Err(err) = os::rename_all_with_precondition_and_parent_sync_std(
                         staged_backup,
                         &backup_path,
-                        &skip_parent,
+                        &dst_volume_dir_owned,
                         &publication_root_owned,
                         None,
                         sync_commit_metadata,
@@ -1464,17 +1444,11 @@ impl LocalDisk {
                         }
                         if has_dst_buf_owned.is_none() {
                             let mut ancestor = dst_file_path_owned.parent().and_then(|object_dir| object_dir.parent());
-                            let mut ancestor_step = 0usize;
                             while let Some(dir) = ancestor {
                                 if !dir.starts_with(&dst_volume_dir_owned) {
                                     break;
                                 }
-                                if let Err(err) = os::fsync_commit_ancestor_directory_limited_std(
-                                    dir,
-                                    &dst_volume_dir_owned,
-                                    ancestor_step,
-                                    &directory_guard_owned,
-                                ) {
+                                if let Err(err) = os::fsync_dir_limited_std(dir) {
                                     return Ok(MultipartFusedCommitOutcome::RestoreTargetAfterError(
                                         to_file_error(err).into(),
                                         true,
@@ -1484,7 +1458,6 @@ impl LocalDisk {
                                     break;
                                 }
                                 ancestor = dir.parent();
-                                ancestor_step += 1;
                             }
                         }
                     }

crates/ecstore/src/disk/local/delete_recovery.rs

@@ -41,53 +41,19 @@ struct DiscoverySession {
     touched: Instant,
 }
 
-/// Names an object-scoped scan skips without a stat (plain children of the
-/// key's directory, and entries of a UUID child that cannot be delete evidence)
-/// cost one budget entry per this many names: enough to bound a hostile prefix
-/// without making a real folder prefix undeletable.
+/// Plain (non-transaction) children of an object-scoped discovery root cost one
+/// budget entry per this many names: enough to bound a hostile prefix without
+/// making a real folder prefix undeletable.
 const PLAIN_CHILDREN_PER_BUDGET_ENTRY: u32 = 64;
 
-/// Entries one step of the resumable (background) discovery may visit. The
-/// foreground bounded protocol has its own, larger per-call allowance.
-const DISCOVERY_STEP_ENTRIES: u32 = 4096;
-
-/// Wall-clock allowance of one bounded discovery call: a third of the drive
-/// timeout that wraps the call (including its wait for a lane worker), capped at
-/// ten seconds, so an incomplete walk returns before the call can time out.
-fn bounded_discovery_time_limit() -> std::time::Duration {
-    (crate::disk::disk_store::get_max_timeout_duration() / 3).min(std::time::Duration::from_secs(10))
-}
-
-/// Whether an entry inside a UUID child of an object-scoped root can name one
-/// of the key's delete transactions: a journal file of a rollback directory or
-/// a data-directory marker. Every other name is inert to discovery.
-fn may_be_delete_evidence(name: &str) -> bool {
-    [PREPARED, STORAGE_FORMAT_FILE_BACKUP, DELETE_QUORUM_COMMITTED_FILE].contains(&name)
-        || [
-            DELETE_DATA_DIR_MARKER_PREFIX,
-            RESERVED_DELETE_DATA_DIR_MARKER_PREFIX,
-            RECOVERY_DELETE_DATA_DIR_MARKER_PREFIX,
-        ]
-        .iter()
-        .any(|prefix| delete_transaction_marker_id(name, prefix).is_some())
-}
-
 impl DiscoverySession {
     /// Consume one bounded step, returning ownership only when traversal remains.
     fn advance(self, limit: u32) -> std::io::Result<(Vec<DeleteTransactionId>, Option<Self>)> {
-        self.advance_bounded(limit, DISCOVERY_STEP_ENTRIES, &|| false)
+        self.advance_bounded(limit, super::super::DELETE_RECOVERY_MAX_DISCOVERY_ENTRIES)
             .map(|(transactions, next, _)| (transactions, next))
     }
 
-    /// Walk until `limit` transactions, `max_entries` charged entries, the end
-    /// of the scope, or `should_stop` (checked before every entry); any early
-    /// stop returns the remaining traversal as continuation state.
-    fn advance_bounded(
-        mut self,
-        limit: u32,
-        max_entries: u32,
-        should_stop: &dyn Fn() -> bool,
-    ) -> std::io::Result<(Vec<DeleteTransactionId>, Option<Self>, u32)> {
+    fn advance_bounded(mut self, limit: u32, max_entries: u32) -> std::io::Result<(Vec<DeleteTransactionId>, Option<Self>, u32)> {
         if self.frames.is_empty() {
             match std::fs::read_dir(&self.root) {
                 Ok(entries) => self.frames.push((String::new(), entries)),
@@ -100,11 +66,10 @@ impl DiscoverySession {
         let mut transactions = BTreeSet::new();
         let mut seen_candidates = HashSet::new();
         let mut visited = 0u32;
-        let mut skipped_by_name = 0u32;
+        let mut plain_children = 0u32;
         while !self.frames.is_empty()
             && transactions.len() < usize::try_from(limit).map_err(|_| std::io::Error::from(ErrorKind::InvalidInput))?
             && visited < max_entries
-            && !should_stop()
         {
             let (parent, entries) = self
                 .frames
@@ -125,22 +90,13 @@ impl DiscoverySession {
                 return Err(std::io::Error::from(ErrorKind::InvalidData));
             }
             // An object-scoped scan only ever descends into transaction (UUID)
-            // directories at the root, and inside them only journal files and
-            // data-directory markers can be evidence. Every other name (plain
-            // child keys of a prefix directory, and the `xl.meta`, data
-            // directories or children of a UUID-named child key) is skipped by
-            // name without a stat and charged at one entry per readdir batch, so
-            // the work stays bounded while deleting a missing key that names a
-            // folder prefix with many children, UUID-named or not, can complete.
-            if self.object.is_some()
-                && if parent.is_empty() {
-                    !canonical_uuid(&name).is_some_and(|id| !id.is_nil())
-                } else {
-                    !may_be_delete_evidence(&name)
-                }
-            {
-                skipped_by_name += 1;
-                if skipped_by_name.is_multiple_of(PLAIN_CHILDREN_PER_BUDGET_ENTRY) {
+            // directories at the root. Plain child keys of a prefix directory are
+            // skipped by name without a stat; they are charged at one entry per
+            // readdir batch so the work stays bounded while deleting a missing key
+            // that names a prefix with thousands of children can still complete.
+            if self.object.is_some() && parent.is_empty() && !canonical_uuid(&name).is_some_and(|id| !id.is_nil()) {
+                plain_children += 1;
+                if plain_children.is_multiple_of(PLAIN_CHILDREN_PER_BUDGET_ENTRY) {
                     visited += 1;
                 }
                 continue;
@@ -1172,8 +1128,6 @@ struct PreparedDeleteReceiptEntry {
     journal_raw: Vec<u8>,
     journal: DeleteRecoveryJournal,
     sole_transaction: bool,
-    had_old_data_dir: bool,
-    rollback_dir_fd: Option<Arc<std::fs::File>>,
 }
 
 #[derive(Clone)]
@@ -1183,8 +1137,6 @@ struct PublishedDeleteReceiptEntry {
     file_path: PathBuf,
     staging_root: PathBuf,
     journal_raw: Vec<u8>,
-    had_old_data_dir: bool,
-    rollback_dir_fd: Option<Arc<std::fs::File>>,
 }
 
 const PREPARED_DELETE_RECEIPTS_PER_SHARD: usize = 64;
@@ -1435,16 +1387,8 @@ impl LocalDisk {
         self.validate_delete_discovery_owner(&session)?;
         // The blocking owner drops every directory handle even if the RPC waiter disappears.
         // A partial inventory is never evidence of absence and never enters DISCOVERY_SESSIONS.
-        // A large folder prefix may take a while to walk, so the probe rides the
-        // durable-mutation lane like bounded inspection, never the one-worker
-        // foreground lane that every other mutation on the drive queues behind.
-        // It also stops, incomplete, when its waiter goes away or well before the
-        // drive timeout, so a slow walk answers SlowDown instead of marking the
-        // drive failed or holding a lane worker after the request is gone.
-        let deadline = Instant::now() + bounded_discovery_time_limit();
-        os::run_cancellable_blocking_namespace_operation_with_sync(lease, true, move |is_cancelled| {
-            let should_stop = || is_cancelled() || Instant::now() >= deadline;
-            let (transactions, next, visited) = session.advance_bounded(256, max_entries, &should_stop)?;
+        os::run_blocking_namespace_operation(lease, move || {
+            let (transactions, next, visited) = session.advance_bounded(256, max_entries)?;
             Ok(super::super::BoundedDeleteRecoveryDiscovery {
                 transactions: if next.is_none() { transactions } else { Vec::new() },
                 visited,
@@ -2551,9 +2495,8 @@ impl LocalDisk {
                     Err(err) if err.kind() == ErrorKind::NotFound => return Ok(Ok(None)),
                     Err(err) => return Err(err),
                 };
-                type PreparedDeleteTuple =
-                    (Option<Uuid>, Option<Vec<u8>>, Vec<u8>, DeleteRecoveryJournal, bool, bool, Option<bool>);
-                let (old_dir, target, journal_raw, journal, sole_transaction, destination_missing, old_data_dir_state) =
+                type PreparedDeleteTuple = (Option<Uuid>, Option<Vec<u8>>, Vec<u8>, DeleteRecoveryJournal, bool, bool, bool);
+                let (old_dir, target, journal_raw, journal, sole_transaction, destination_missing, old_data_dir_present) =
                     match (|| -> Result<Option<PreparedDeleteTuple>> {
                         let mut meta = FileMeta::load(&buf)?;
                         let mut deleted_headers: Vec<_> = meta
@@ -2570,12 +2513,13 @@ impl LocalDisk {
                         if old_dir.is_some_and(|dir| dir == transaction || dir.is_nil()) {
                             return Err(DiskError::FileCorrupt);
                         }
-                        let mut old_path_to_verify = None;
                         if let Some(uuid) = old_dir {
                             meta.data.remove(vec![fi_clone.version_id.unwrap_or_default(), uuid])?;
                             let old_path = path_join(&[file_path.as_path(), Path::new(uuid.to_string().as_str())]);
                             check_path_length(old_path.to_string_lossy().as_ref())?;
-                            old_path_to_verify = Some(old_path);
+                            if old_path.join(STORAGE_FORMAT_FILE).exists() {
+                                return Ok(None);
+                            }
                         }
                         let surviving: HashSet<_> = meta
                             .versions
@@ -2657,12 +2601,6 @@ impl LocalDisk {
                                 }
                             }
                         }
-                        if let Some(old_path) = old_path_to_verify
-                            && (!scanned_file_path || old_data_dir_exists)
-                            && old_path.join(STORAGE_FORMAT_FILE).exists()
-                        {
-                            return Ok(None);
-                        }
                         sole_transaction &= predecessors.is_empty();
                         let mut sparse = fi_clone;
                         sparse.data = None;
@@ -2688,21 +2626,15 @@ impl LocalDisk {
                             journal,
                             sole_transaction,
                             scanned_file_path && !destination_exists,
-                            scanned_file_path.then_some(old_data_dir_exists),
+                            scanned_file_path && old_data_dir_exists,
                         )))
                     })() {
                         Ok(Some(tuple)) => tuple,
                         Ok(None) => return Ok(Ok(None)),
                         Err(err) => return Ok(Err(err)),
                     };
-                let staged = match tempfile::Builder::new().prefix("delete-prep-").tempdir_in(&staging_root) {
-                    Ok(dir) => dir,
-                    Err(err) if err.kind() == ErrorKind::NotFound => {
-                        std::fs::create_dir_all(&staging_root)?;
-                        tempfile::Builder::new().prefix("delete-prep-").tempdir_in(&staging_root)?
-                    }
-                    Err(err) => return Err(err),
-                };
+                std::fs::create_dir_all(&staging_root)?;
+                let staged = tempfile::Builder::new().prefix("delete-prep-").tempdir_in(&staging_root)?;
                 let staged_dir = staged.path().to_path_buf();
                 let backup_path = staged_dir.join(STORAGE_FORMAT_FILE_BACKUP);
                 if std::fs::hard_link(&xl_path, &backup_path).is_err() {
@@ -2726,12 +2658,8 @@ impl LocalDisk {
                 for file in written_files {
                     file.sync_data()?;
                 }
-                #[cfg(unix)]
-                let rollback_dir_fd = sync.then(|| std::fs::File::open(&staged_dir).ok().map(Arc::new)).flatten();
-                #[cfg(not(unix))]
-                let rollback_dir_fd: Option<Arc<std::fs::File>> = None;
                 if sync {
-                    os::fsync_directory_handle_std(&staged_dir, rollback_dir_fd.as_deref())?;
+                    os::fsync_dir_std(&staged_dir)?;
                 }
                 if !destination_missing {
                     match std::fs::symlink_metadata(&destination) {
@@ -2747,19 +2675,14 @@ impl LocalDisk {
                     }
                 }
                 let staged_dir = staged.keep();
-                os::record_native_publication(&destination);
                 if let Err(err) = std::fs::rename(&staged_dir, &destination) {
                     let _ = std::fs::remove_dir_all(&staged_dir);
                     return Err(err);
                 }
                 let old_data_path = old_dir
                     .map(|uuid| file_path.join(uuid.to_string()))
-                    .filter(|p| old_data_dir_state.unwrap_or_else(|| p.is_dir()));
-                #[cfg(unix)]
-                let file_path_dir = sync.then(|| std::fs::File::open(&file_path).ok()).flatten();
-                #[cfg(not(unix))]
-                let file_path_dir: Option<std::fs::File> = None;
-                if sync && let Err(err) = os::fsync_directory_handle_std(&file_path, file_path_dir.as_ref()) {
+                    .filter(|p| old_data_dir_present || p.is_dir());
+                if sync && let Err(err) = os::fsync_dir_std(&file_path) {
                     let _ = std::fs::remove_dir_all(&destination);
                     return Err(err);
                 }
@@ -2768,15 +2691,11 @@ impl LocalDisk {
                 let mut reserved_data_path = None;
                 if let Some(old_path) = old_data_path {
                     let reserved_marker = old_path.join(format!("{RESERVED_DELETE_DATA_DIR_MARKER_PREFIX}{transaction}"));
-                    #[cfg(unix)]
-                    let old_dir_file = sync.then(|| std::fs::File::open(&old_path).ok()).flatten();
-                    #[cfg(not(unix))]
-                    let old_dir_file: Option<std::fs::File> = None;
                     let reserve_res = (|| -> std::io::Result<()> {
                         let marker = std::fs::File::create(&reserved_marker)?;
                         if sync {
                             marker.sync_all()?;
-                            os::fsync_directory_handle_std(&old_path, old_dir_file.as_ref())?;
+                            os::fsync_dir_std(&old_path)?;
                         }
                         Ok(())
                     })();
@@ -2785,13 +2704,12 @@ impl LocalDisk {
                         let _ = std::fs::remove_dir_all(&destination);
                         return Err(err);
                     }
-                    reserved_data_path = Some((old_path, reserved_marker, old_dir_file));
+                    reserved_data_path = Some((old_path, reserved_marker));
                 }
                 if let Some(ref target_bytes) = target {
                     // A provisional head must stay outside the published recovery transaction.
                     let target_in_rollback = destination.join(TARGET);
                     let linked_xl = staging_root.join(format!("delete-xl-{transaction}"));
-                    os::record_native_publication(&xl_path);
                     let linked = match std::fs::hard_link(&target_in_rollback, &linked_xl) {
                         Ok(()) => true,
                         Err(err) if err.kind() == ErrorKind::AlreadyExists => {
@@ -2817,7 +2735,7 @@ impl LocalDisk {
                         })()
                     };
                     if let Err(err) = write_res {
-                        if let Some((_, reserved_marker, _)) = &reserved_data_path {
+                        if let Some((_, reserved_marker)) = &reserved_data_path {
                             let _ = std::fs::remove_file(reserved_marker);
                         }
                         let _ = std::fs::remove_dir_all(&destination);
@@ -2826,20 +2744,19 @@ impl LocalDisk {
                 } else if let Err(err) = std::fs::remove_file(&xl_path)
                     && err.kind() != ErrorKind::NotFound
                 {
-                    if let Some((_, reserved_marker, _)) = &reserved_data_path {
+                    if let Some((_, reserved_marker)) = &reserved_data_path {
                         let _ = std::fs::remove_file(reserved_marker);
                     }
                     let _ = std::fs::remove_dir_all(&destination);
                     return Err(err);
                 }
                 if sync {
-                    os::fsync_directory_handle_std(&file_path, file_path_dir.as_ref())?;
+                    os::fsync_dir_std(&file_path)?;
                 }
-                let had_old_data_dir = reserved_data_path.is_some();
-                if let Some((old_path, reserved_marker, old_dir_file)) = reserved_data_path {
+                if let Some((old_path, reserved_marker)) = reserved_data_path {
                     let recovery_marker = old_path.join(format!("{RECOVERY_DELETE_DATA_DIR_MARKER_PREFIX}{transaction}"));
                     match std::fs::rename(&reserved_marker, &recovery_marker) {
-                        Ok(()) if sync => os::fsync_directory_handle_std(&old_path, old_dir_file.as_ref())?,
+                        Ok(()) if sync => os::fsync_dir_std(&old_path)?,
                         Ok(()) => {}
                         Err(err) if err.kind() == ErrorKind::NotFound => {}
                         Err(err) => return Err(err),
@@ -2855,11 +2772,9 @@ impl LocalDisk {
                         journal_raw,
                         journal,
                         sole_transaction,
-                        had_old_data_dir,
-                        rollback_dir_fd,
                     },
                 );
-                Ok(Ok(Some(old_dir.filter(|_| had_old_data_dir))))
+                Ok(Ok(Some(old_dir)))
             },
         )
         .await
@@ -2912,13 +2827,7 @@ impl LocalDisk {
                 Some(entry.bucket_path),
                 entry.file_path,
                 entry.staging_root,
-                Some((
-                    entry.journal_raw,
-                    entry.journal,
-                    entry.sole_transaction,
-                    entry.had_old_data_dir,
-                    entry.rollback_dir_fd,
-                )),
+                Some((entry.journal_raw, entry.journal, entry.sole_transaction)),
             ),
             None => {
                 self.reject_multipart_delete_recovery_mutation(volume, object)?;
@@ -2949,7 +2858,7 @@ impl LocalDisk {
             lease,
             sync,
             move || -> std::io::Result<Result<Option<(DeleteRecoveryJournal, bool, bool)>>> {
-                if let Some((journal_raw, journal, sole_transaction, had_old_data_dir, rollback_dir_fd)) = cached_receipt
+                if let Some((journal_raw, journal, sole_transaction)) = cached_receipt
                     && rollback.join(PREPARED).is_file()
                 {
                     let tmp_receipt = staging_root.join(format!("receipt-{transaction}.tmp"));
@@ -2960,10 +2869,9 @@ impl LocalDisk {
                         if sync && !receipt_bytes.is_empty() {
                             file.sync_data()?;
                         }
-                        os::record_native_publication(&receipt_path);
                         std::fs::rename(&tmp_receipt, &receipt_path)?;
                         if sync {
-                            os::fsync_directory_handle_std(&rollback, rollback_dir_fd.as_deref())?;
+                            os::fsync_dir_std(&rollback)?;
                         }
                         Ok(())
                     })();
@@ -2980,8 +2888,6 @@ impl LocalDisk {
                                 file_path: root,
                                 staging_root,
                                 journal_raw,
-                                had_old_data_dir,
-                                rollback_dir_fd,
                             },
                         );
                     }
@@ -3059,7 +2965,6 @@ impl LocalDisk {
                 if sync && !receipt_bytes.is_empty() {
                     staged.as_file().sync_data()?;
                 }
-                os::record_native_publication(&receipt_path);
                 std::fs::rename(staged.path(), &receipt_path)?;
                 if sync {
                     os::fsync_dir_std(&rollback)?;
@@ -3118,34 +3023,29 @@ impl LocalDisk {
             None
         };
         let cached_published = rollback_open_path.as_deref().and_then(take_published_delete_receipt);
-        let (object_path, bucket_path, staging_root, root, cached_journal_raw, cached_had_old_data_dir, mut rollback_dir_fd) =
-            match cached_published {
-                Some(entry) => (
-                    entry.object_path,
-                    entry.bucket_path,
-                    entry.staging_root,
-                    entry.file_path,
-                    Some(entry.journal_raw),
-                    Some(entry.had_old_data_dir),
-                    entry.rollback_dir_fd,
-                ),
-                None => {
-                    self.reject_multipart_delete_recovery_mutation(volume, object)?;
-                    if !safe_path(object, false) {
-                        return Err(DiskError::InvalidPath);
-                    }
-                    let obj_path = self.get_object_path(volume, object)?;
-                    (
-                        obj_path,
-                        self.io_get_bucket_path(volume)?,
-                        self.io_get_bucket_path(RUSTFS_META_TMP_BUCKET)?,
-                        self.io_get_object_path(volume, object)?,
-                        None,
-                        None,
-                        None,
-                    )
+        let (object_path, bucket_path, staging_root, root, cached_journal_raw) = match cached_published {
+            Some(entry) => (
+                entry.object_path,
+                entry.bucket_path,
+                entry.staging_root,
+                entry.file_path,
+                Some(entry.journal_raw),
+            ),
+            None => {
+                self.reject_multipart_delete_recovery_mutation(volume, object)?;
+                if !safe_path(object, false) {
+                    return Err(DiskError::InvalidPath);
                 }
-            };
+                let obj_path = self.get_object_path(volume, object)?;
+                (
+                    obj_path,
+                    self.io_get_bucket_path(volume)?,
+                    self.io_get_bucket_path(RUSTFS_META_TMP_BUCKET)?,
+                    self.io_get_object_path(volume, object)?,
+                    None,
+                )
+            }
+        };
         let metadata_owner = os::acquire_metadata_mutation_lease(&object_path, namespace_owner).await;
         let volume_guard = os::disk_volume_mutation_lock(&self.root, volume).read_owned().await;
         let owner: Option<Arc<dyn Send + Sync>> = Some(Arc::new((metadata_owner, volume_guard)));
@@ -3208,7 +3108,6 @@ impl LocalDisk {
                 if sync && !receipt_bytes.is_empty() {
                     staged_receipt.as_file().sync_data()?;
                 }
-                os::record_native_publication(&receipt_path);
                 std::fs::rename(staged_receipt.path(), &receipt_path)?;
                 if sync {
                     let _ = os::fsync_dir_std(&rollback);
@@ -3219,61 +3118,56 @@ impl LocalDisk {
             let recovery_committed = format!("{RECOVERY_DELETE_DATA_DIR_MARKER_PREFIX}{transaction}");
             let reserved = format!("{RESERVED_DELETE_DATA_DIR_MARKER_PREFIX}{transaction}");
             let mut had_physical_data_dirs = false;
-            let fast_cleanup = cached_journal_raw.is_some();
-            if cached_had_old_data_dir != Some(false) {
-                let bases: &[&Path] = if fast_cleanup { &[&root] } else { &[&root, &rollback] };
-                for data_dir in &data_dirs {
-                    for base in bases {
-                        let dir_path = base.join(data_dir.to_string());
-                        match std::fs::read_dir(&dir_path) {
-                            Ok(entries) => {
-                                had_physical_data_dirs = true;
-                                let mut removable = Vec::new();
-                                let mut preserve_dir = false;
-                                for entry in recovery_entries(entries, work_budget.as_deref()) {
-                                    let entry = entry?;
-                                    let name = entry.file_name();
-                                    let Some(name) = name.to_str() else {
-                                        preserve_dir = true;
-                                        continue;
-                                    };
-                                    if entry.file_type()?.is_file()
-                                        && (delete_recovery_part_file(name)
-                                            || name == committed
-                                            || name == recovery_committed
-                                            || name == reserved
-                                            || is_delete_transaction_marker(name, RESERVED_DELETE_DATA_DIR_MARKER_PREFIX))
-                                    {
-                                        removable.push(entry.path());
-                                    } else {
-                                        preserve_dir = true;
-                                    }
-                                }
-                                for path in removable {
-                                    ignore_not_found(std::fs::remove_file(path))?;
-                                }
-                                let mut dir_removed = false;
-                                if !preserve_dir {
-                                    match std::fs::remove_dir(&dir_path) {
-                                        Ok(()) => dir_removed = true,
-                                        Err(err) if err.kind() == ErrorKind::NotFound => dir_removed = true,
-                                        Err(err) if is_dir_not_empty_error(&err) => {}
-                                        Err(err) => return Err(err),
-                                    }
-                                }
-                                if !dir_removed && sync {
-                                    os::fsync_dir_std(&dir_path)?;
+            for data_dir in &data_dirs {
+                for base in [&root, &rollback] {
+                    let dir_path = base.join(data_dir.to_string());
+                    match std::fs::read_dir(&dir_path) {
+                        Ok(entries) => {
+                            had_physical_data_dirs = true;
+                            let mut removable = Vec::new();
+                            let mut preserve_dir = false;
+                            for entry in recovery_entries(entries, work_budget.as_deref()) {
+                                let entry = entry?;
+                                let name = entry.file_name();
+                                let Some(name) = name.to_str() else {
+                                    preserve_dir = true;
+                                    continue;
+                                };
+                                if entry.file_type()?.is_file()
+                                    && (delete_recovery_part_file(name)
+                                        || name == committed
+                                        || name == recovery_committed
+                                        || name == reserved
+                                        || is_delete_transaction_marker(name, RESERVED_DELETE_DATA_DIR_MARKER_PREFIX))
+                                {
+                                    removable.push(entry.path());
+                                } else {
+                                    preserve_dir = true;
+                                }
+                            }
+                            for path in removable {
+                                ignore_not_found(std::fs::remove_file(path))?;
+                            }
+                            if sync {
+                                os::fsync_dir_std(&dir_path)?;
+                            }
+                            if !preserve_dir {
+                                match std::fs::remove_dir(&dir_path) {
+                                    Ok(()) => {}
+                                    Err(err) if err.kind() == ErrorKind::NotFound || is_dir_not_empty_error(&err) => {}
+                                    Err(err) => return Err(err),
                                 }
                             }
-                            Err(err) if err.kind() == ErrorKind::NotFound => {}
-                            Err(err) => return Err(err),
                         }
+                        Err(err) if err.kind() == ErrorKind::NotFound => {}
+                        Err(err) => return Err(err),
                     }
                 }
             }
             if had_physical_data_dirs && sync && root.is_dir() {
                 os::fsync_dir_std(&root)?;
             }
+            let fast_cleanup = cached_journal_raw.is_some();
             if fast_cleanup {
                 let backup_or_marker = if has_original {
                     Some(STORAGE_FORMAT_FILE_BACKUP)
@@ -3322,15 +3216,12 @@ impl LocalDisk {
                     }
                 }
             }
-            let rollback_sync = rollback_dir_fd.take();
-            if sync && let Err(err) = os::fsync_directory_handle_std(&rollback, rollback_sync.as_deref()) {
-                drop(rollback_sync);
+            if sync && let Err(err) = os::fsync_dir_std(&rollback) {
                 if has_target || had_physical_data_dirs {
                     let _ = persist_receipt(true);
                 }
                 return Err(err);
             }
-            drop(rollback_sync);
             #[cfg(all(any(test, feature = "test-util"), not(windows)))]
             os::prepared_publication_test_hooks::run(os::prepared_publication_test_hooks::Stage::Remove, &receipt_path);
             if let Err(err) = ignore_not_found(std::fs::remove_file(&receipt_path)) {
@@ -6613,93 +6504,6 @@ mod tests {
         }
     }
 
-    #[tokio::test]
-    async fn delete_recovery_bounded_discovery_charges_uuid_named_children_once_and_keeps_evidence() {
-        let (_temp, disk, _, _) = fixture().await;
-        let path = disk.delete_discovery_path("recovery", Some("prefix")).expect("prefix path");
-        std::fs::create_dir_all(&path).expect("physical prefix");
-        // UUID-named child keys of the folder: each holds its own `xl.meta` and a
-        // data directory, neither of which can be evidence for the folder's key.
-        const CHILDREN: u32 = 2000;
-        for _ in 0..CHILDREN {
-            let child = path.join(Uuid::new_v4().to_string());
-            std::fs::create_dir_all(child.join(Uuid::new_v4().to_string())).expect("child key data dir");
-            std::fs::write(child.join(STORAGE_FORMAT_FILE), b"meta").expect("child key metadata");
-        }
-        // A UUID-named sub-prefix with children of its own.
-        const SUB_PREFIX_CHILDREN: u32 = 640;
-        let sub_prefix = path.join(Uuid::new_v4().to_string());
-        for index in 0..SUB_PREFIX_CHILDREN {
-            std::fs::create_dir_all(sub_prefix.join(format!("child-{index}"))).expect("sub-prefix child");
-        }
-        // Evidence of two interrupted transactions of the key itself: a journaled
-        // rollback directory, and a data-directory marker whose rollback is gone.
-        let journaled = Uuid::new_v4();
-        std::fs::create_dir_all(path.join(journaled.to_string())).expect("rollback directory");
-        std::fs::write(path.join(journaled.to_string()).join(PREPARED), b"{}").expect("journal");
-        let marker_only = Uuid::new_v4();
-        let data_dir = path.join(Uuid::new_v4().to_string());
-        std::fs::create_dir_all(&data_dir).expect("residual data directory");
-        std::fs::write(data_dir.join(format!("{RESERVED_DELETE_DATA_DIR_MARKER_PREFIX}{marker_only}")), [])
-            .expect("reservation marker");
-
-        let page = disk
-            .discover_delete_transactions_bounded(
-                "recovery",
-                "prefix",
-                super::super::super::DELETE_RECOVERY_MAX_DISCOVERY_ENTRIES,
-            )
-            .await
-            .expect("bounded probe");
-        assert!(page.complete, "a folder of UUID-named keys is a complete inventory");
-        // One entry per descent (children, sub-prefix, rollback and data
-        // directory) and per evidence file; inert names at 1/64.
-        let inert = 2 * CHILDREN + SUB_PREFIX_CHILDREN;
-        assert_eq!(page.visited, CHILDREN + 3 + 2 + inert / PLAIN_CHILDREN_PER_BUDGET_ENTRY);
-        let found = page.transactions.iter().map(|id| id.transaction).collect::<BTreeSet<_>>();
-        assert!(found.contains(&journaled), "a journaled rollback directory is evidence");
-        assert!(found.contains(&marker_only), "a marker-only residue is evidence");
-        assert_eq!(found.len(), 2, "no child key is mistaken for a transaction");
-    }
-
-    #[tokio::test]
-    async fn delete_recovery_bounded_discovery_stops_on_request_and_skips_only_inert_irregular_entries() {
-        let (_temp, disk, _, _) = fixture().await;
-        let path = disk.delete_discovery_path("recovery", Some("prefix")).expect("prefix path");
-        let child = path.join(Uuid::new_v4().to_string());
-        std::fs::create_dir_all(&child).expect("UUID-named child key");
-        // A stop request (cancellation or the wall-clock limit) ends the walk
-        // before any entry, leaving continuation state: never evidence of absence.
-        let session = disk
-            .new_delete_discovery_session("recovery", Some("prefix"), &path)
-            .expect("private session");
-        let (transactions, next, visited) = session
-            .advance_bounded(256, super::super::super::DELETE_RECOVERY_MAX_DISCOVERY_ENTRIES, &|| true)
-            .expect("stopped walk");
-        assert!(transactions.is_empty());
-        assert_eq!(visited, 0);
-        assert!(next.is_some(), "a stopped walk is incomplete");
-        drop(next);
-        #[cfg(unix)]
-        {
-            // An irregular entry whose name cannot be evidence is skipped unread.
-            std::os::unix::fs::symlink(&path, child.join("inert-link")).expect("inert symlink");
-            let page = disk
-                .discover_delete_transactions_bounded("recovery", "prefix", 4096)
-                .await
-                .expect("inert irregular entries are not evidence");
-            assert!(page.complete && page.transactions.is_empty());
-            // One with an evidence name still fails closed.
-            std::os::unix::fs::symlink(&path, child.join(PREPARED)).expect("evidence-named symlink");
-            assert!(
-                disk.discover_delete_transactions_bounded("recovery", "prefix", 4096)
-                    .await
-                    .is_err(),
-                "an evidence-named symlink is corruption, not a skipped name"
-            );
-        }
-    }
-
     #[tokio::test]
     async fn delete_recovery_bounded_discovery_refuses_partial_inventory_without_public_cursor() {
         let (_temp, disk, _, _) = fixture().await;
@@ -6802,11 +6606,8 @@ mod tests {
         let filler_id = Uuid::new_v4().to_string();
         let filler = path.join(&filler_id);
         fs::create_dir_all(&filler).await.expect("non-evidence directory");
-        // Inert names are skipped at 1/64, so fill the step with entries that
-        // pass the evidence-name filter but are directories: each costs a full
-        // budget entry and names no transaction.
-        for _ in 0..5000 {
-            fs::create_dir(filler.join(format!("{DELETE_DATA_DIR_MARKER_PREFIX}{}", Uuid::new_v4())))
+        for index in 0..5000 {
+            fs::write(filler.join(format!("part-{index:04}")), [])
                 .await
                 .expect("non-evidence entry");
         }

crates/ecstore/src/disk/local/multipart_index.rs

@@ -4,11 +4,6 @@
 //! Bucket-to-staging-root candidates: one marker per staging root, recorded
 //! before the root is published and pruned once the root is gone. Source
 //! metadata stays authoritative.
-//!
-//! A marker without a staging root is either a leftover or an upload whose
-//! root is still being published. The publisher proves the second case by
-//! holding a [`PublicationPin`] from before it records the marker until its
-//! filesystem work has returned; no elapsed time is taken as that proof.
 
 use super::{LocalDisk, read_metadata_only_std};
 use crate::disk::{
@@ -34,6 +29,9 @@ use uuid::Uuid;
 
 const INDEX: &str = ".rustfs.sys/multipart-index-v1";
 const REBUILD_DIRENTS_PER_JOB: usize = 64;
+/// A marker is recorded before its staging root is published. A marker younger
+/// than this without a root is an upload in flight, never a leftover to prune.
+const MULTIPART_INDEX_PRUNE_GRACE: std::time::Duration = std::time::Duration::from_secs(300);
 type DirectoryEntries = Box<dyn Iterator<Item = io::Result<String>> + Send>;
 type PhysicalRoot = (u64, [u8; 16]);
 static OWNERS: LazyLock<parking_lot::Mutex<HashMap<PhysicalRoot, Weak<IndexOwner>>>> =
@@ -58,15 +56,9 @@ pub(super) struct IndexOwner {
     // drop so a cancelled scan can be resumed by the next caller.
     driving: AtomicBool,
     disabled: AtomicBool,
-    // Markers whose staging root some publisher is creating right now, with
-    // the number of publishers. Boot-local like the index itself: every writer
-    // of this physical drive in this process shares this owner.
-    publishing: parking_lot::Mutex<HashMap<PathBuf, usize>>,
     #[cfg(test)]
     rebuild_head_pause: parking_lot::Mutex<Option<RebuildHeadPause>>,
     #[cfg(test)]
-    publication_pause: parking_lot::Mutex<Option<RebuildHeadPause>>,
-    #[cfg(test)]
     observed_rebuild_queue: parking_lot::Mutex<Option<Arc<os::DiskBlockingQueue>>>,
     #[cfg(test)]
     rebuild_single_job: AtomicBool,
@@ -128,6 +120,23 @@ impl IndexDirectory {
             std::fs::File::open(self.path.join(name))
         }
     }
+    fn modified(&self, name: &str) -> io::Result<std::time::SystemTime> {
+        #[cfg(unix)]
+        {
+            self.open_file(name)?.metadata()?.modified()
+        }
+        #[cfg(not(unix))]
+        {
+            std::fs::metadata(self.path.join(name))?.modified()
+        }
+    }
+    /// Whether the marker is still inside the publication grace period. A
+    /// marker dated in the future (clock stepped back) is never a leftover.
+    fn marker_is_young(&self, name: &str) -> bool {
+        self.modified(name)
+            .ok()
+            .is_some_and(|modified| modified.elapsed().map_or(true, |age| age < MULTIPART_INDEX_PRUNE_GRACE))
+    }
     fn remove_file(&self, name: &str) -> io::Result<()> {
         #[cfg(unix)]
         {
@@ -183,10 +192,6 @@ impl RebuildCursor {
                     Err(error) if error.kind() == io::ErrorKind::NotFound => continue,
                     Err(error) => return Err(error),
                 };
-                // The head is decoded; release the source pin before indexing. On
-                // Windows the pin denies delete sharing, so holding it would make a
-                // concurrent abort of this upload fail with a sharing violation.
-                drop(source);
                 let source_root = relative
                     .file_name()
                     .and_then(|name| name.to_str())
@@ -275,12 +280,9 @@ impl IndexOwner {
             initialized: OnceLock::new(),
             driving: AtomicBool::new(false),
             disabled: AtomicBool::new(false),
-            publishing: parking_lot::Mutex::new(HashMap::new()),
             #[cfg(test)]
             rebuild_head_pause: parking_lot::Mutex::new(None),
             #[cfg(test)]
-            publication_pause: parking_lot::Mutex::new(None),
-            #[cfg(test)]
             observed_rebuild_queue: parking_lot::Mutex::new(None),
             #[cfg(test)]
             rebuild_single_job: AtomicBool::new(false),
@@ -392,8 +394,8 @@ impl IndexOwner {
             // The index is boot-local: every start rescans the staging area
             // before serving it, so a marker lost to a crash is recreated before
             // it can be consulted. Creation is enough; no fsync of the marker or
-            // its ancestors. An existing marker needs nothing: the caller's
-            // publication pin, not the marker's age, keeps it from being pruned.
+            // its ancestors. An existing marker is touched so pruning sees the
+            // new upload's age, not the previous one's.
             match openat(
                 &parent,
                 source_root,
@@ -405,7 +407,16 @@ impl IndexOwner {
                         return Err(io::Error::other("index marker is not a file"));
                     }
                 }
-                Err(rustix::io::Errno::EXIST) => {}
+                Err(rustix::io::Errno::EXIST) => {
+                    // Best effort: a filesystem that refuses to set times keeps
+                    // the previous upload's age, which only shortens the prune
+                    // grace for this key; index completeness does not depend on it.
+                    if let Ok(marker) =
+                        openat(&parent, source_root, OFlags::WRONLY | OFlags::NOFOLLOW | OFlags::CLOEXEC, Mode::empty())
+                    {
+                        let _ = std::fs::File::from(marker).set_modified(std::time::SystemTime::now());
+                    }
+                }
                 Err(error) => return Err(error.into()),
             }
         }
@@ -421,22 +432,6 @@ impl IndexOwner {
         Ok(())
     }
 
-    /// Declare that the caller is about to publish the staging root of
-    /// `marker`. Must precede the marker lease the caller records under, so a
-    /// prune that found no pin has released that lease before the marker is
-    /// (re)created.
-    fn pin_publication(self: &Arc<Self>, marker: PathBuf) -> PublicationPin {
-        *self.publishing.lock().entry(marker.clone()).or_default() += 1;
-        PublicationPin {
-            owner: Arc::clone(self),
-            marker,
-        }
-    }
-
-    fn is_publishing(&self, marker: &Path) -> bool {
-        self.publishing.lock().contains_key(marker)
-    }
-
     fn ensure_current_root(&self) -> io::Result<()> {
         #[cfg(unix)]
         let current = {
@@ -518,12 +513,9 @@ impl IndexOwner {
         }
     }
 
-    /// Record the marker of `path`'s staging root. The returned pin must stay
-    /// alive until the filesystem work that publishes the root has returned,
-    /// including work that outlives a cancelled caller.
-    pub(super) async fn record_info(self: &Arc<Self>, path: &str, info: &FileInfo) -> Result<Option<PublicationPin>> {
+    pub(super) async fn record_info(self: &Arc<Self>, path: &str, info: &FileInfo) -> Result<()> {
         if canonical_upload(path).is_none() {
-            return Ok(None);
+            return Ok(());
         }
         let owner = self.clone();
         let path = path.to_owned();
@@ -539,7 +531,6 @@ impl IndexOwner {
                     .join(path.split('/').next().unwrap_or_default())
             })
             .unwrap_or_else(|| owner.base.join(INDEX));
-        let pin = self.pin_publication(marker.clone());
         let lease = os::acquire_namespace_mutation_lease_with_owner(&marker, None).await;
         os::run_blocking_namespace_operation_with_sync(lease, true, move || {
             match owner.record(&path, &info) {
@@ -553,7 +544,7 @@ impl IndexOwner {
             }
         })
         .await?;
-        Ok(Some(pin))
+        Ok(())
     }
 
     pub(super) async fn prepare_record_head(self: &Arc<Self>, path: &str, bytes: &[u8]) -> Option<PreparedHeadRecord> {
@@ -587,23 +578,20 @@ impl IndexOwner {
                     .join(upload.split('/').next().unwrap_or_default())
             })
             .unwrap_or_else(|| self.base.join(INDEX));
-        let pin = self.pin_publication(marker.clone());
         let lease = os::acquire_namespace_mutation_lease_with_owner(&marker, None).await;
         Some(PreparedHeadRecord {
+            owner: Arc::clone(self),
             upload: upload.to_owned(),
             info,
-            pin,
             _lease: lease,
         })
     }
 
-    /// Record the marker of the staging root that `path` belongs to. See
-    /// [`Self::record_info`] for how long the returned pin must live.
-    pub(super) async fn record_head(self: &Arc<Self>, path: &str, bytes: &[u8]) -> Result<Option<PublicationPin>> {
+    pub(super) async fn record_head(self: &Arc<Self>, path: &str, bytes: &[u8]) -> Result<()> {
         let Some(prepared) = self.prepare_record_head(path, bytes).await else {
-            return Ok(None);
+            return Ok(());
         };
-        prepared.run().await.map(Some)
+        prepared.run().await
     }
 
     async fn page(self: &Arc<Self>, bucket: &str, marker: Option<&str>, disk_id: Uuid) -> Result<MultipartIndexPage> {
@@ -654,20 +642,17 @@ impl IndexOwner {
             // to every key ever multipart-initiated on this drive.
             let mut live = Vec::with_capacity(roots.len());
             let mut stale = Vec::new();
-            let markers = owner.base.join(INDEX).join(sha(&bucket));
             for root in roots {
-                // The marker precedes its staging root: a pinned one is an
-                // upload in flight and stays a candidate. The pin is read
-                // before the root, so a publisher that finished in between has
-                // already made its root visible.
-                if owner.is_publishing(&markers.join(&root)) {
-                    live.push(root);
-                    continue;
-                }
                 match owner.directory(&Path::new(RUSTFS_META_MULTIPART_BUCKET).join(&root)) {
                     Ok(_) => live.push(root),
                     Err(error) if matches!(error.kind(), io::ErrorKind::NotFound | io::ErrorKind::NotADirectory) => {
-                        stale.push(root);
+                        // The marker precedes its staging root; a young one is an
+                        // upload in flight and stays a candidate.
+                        if directory.as_ref().is_some_and(|index| index.marker_is_young(&root)) {
+                            live.push(root);
+                        } else {
+                            stale.push(root);
+                        }
                     }
                     Err(error) => return Err(DiskError::from(error)),
                 }
@@ -692,11 +677,9 @@ impl IndexOwner {
     }
 
     /// Remove one marker whose staging root was gone when a page examined it.
-    /// The marker's own namespace lease serializes this with recording. Under
-    /// that lease the publication pin is read first and the staging root
-    /// second: a publisher pinned before the read keeps the marker, one that
-    /// already finished has made its root visible, and one that pins later
-    /// records its marker only after this lease is released.
+    /// The marker's own namespace lease serializes this with `record_info`; the
+    /// staging root and the marker's age are re-checked under that lease, so an
+    /// upload recorded in between keeps its marker.
     async fn prune_marker(self: &Arc<Self>, bucket: &str, root: &str) -> Result<()> {
         let owner = self.clone();
         let bucket_directory = Path::new(INDEX).join(sha(bucket));
@@ -707,9 +690,6 @@ impl IndexOwner {
         // not queue behind every other mutation on the one-worker foreground lane.
         os::run_blocking_namespace_operation_with_sync(lease, true, move || {
             owner.ensure_current_root()?;
-            if owner.is_publishing(&marker) {
-                return Ok(());
-            }
             match owner.directory(&Path::new(RUSTFS_META_MULTIPART_BUCKET).join(&root)) {
                 Ok(_) => return Ok(()),
                 Err(error) if matches!(error.kind(), io::ErrorKind::NotFound | io::ErrorKind::NotADirectory) => {}
@@ -720,6 +700,9 @@ impl IndexOwner {
                 Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(()),
                 Err(error) => return Err(error),
             };
+            if directory.marker_is_young(&root) {
+                return Ok(());
+            }
             match directory.remove_file(&root) {
                 Err(error) if error.kind() != io::ErrorKind::NotFound => Err(error),
                 _ => Ok(()),
@@ -730,69 +713,34 @@ impl IndexOwner {
     }
 }
 
-/// Proof that the staging root of one marker is being published. While any pin
-/// for a marker is alive, pruning leaves that marker alone.
-#[must_use = "dropping the pin lets a concurrent listing prune the marker before its staging root exists"]
-pub(super) struct PublicationPin {
-    owner: Arc<IndexOwner>,
-    marker: PathBuf,
-}
-
-impl PublicationPin {
-    /// Test seam between recording the marker and publishing the staging root.
-    #[cfg(test)]
-    pub(super) fn pause_for_test(&self) {
-        let pause = self.owner.publication_pause.lock().take();
-        if let Some(pause) = pause {
-            let _pause = os::enter_blocking_test_hook();
-            let _ = pause.started.send(());
-            let _ = pause.release.recv_timeout(std::time::Duration::from_secs(10));
-        }
-    }
-}
-
-impl Drop for PublicationPin {
-    fn drop(&mut self) {
-        let mut publishing = self.owner.publishing.lock();
-        if let Some(count) = publishing.get_mut(&self.marker) {
-            *count -= 1;
-            if *count == 0 {
-                publishing.remove(&self.marker);
-            }
-        }
-    }
-}
-
 pub(super) struct PreparedHeadRecord {
+    owner: Arc<IndexOwner>,
     upload: String,
     info: FileInfo,
-    pin: PublicationPin,
     _lease: Arc<os::NamespaceMutationLease>,
 }
 
 impl PreparedHeadRecord {
-    /// Record the marker and release its lease. The caller publishes the
-    /// staging root while it holds the returned pin.
-    pub(super) fn run_std(self) -> io::Result<PublicationPin> {
+    pub(super) fn run_std(self) -> io::Result<()> {
         let Self {
+            owner,
             upload,
             info,
-            pin,
             _lease,
         } = self;
-        match pin.owner.record(&upload, &info) {
+        match owner.record(&upload, &info) {
             Err(error) if error.kind() == io::ErrorKind::InvalidData => {
-                pin.owner.disabled.store(true, Ordering::Release);
-                Ok(pin)
+                owner.disabled.store(true, Ordering::Release);
+                Ok(())
             }
-            Err(error) => Err(error),
-            Ok(()) => Ok(pin),
+            result => result,
         }
     }
 
-    async fn run(self) -> Result<PublicationPin> {
+    async fn run(self) -> Result<()> {
         let lease = Arc::clone(&self._lease);
-        Ok(os::run_blocking_namespace_operation_with_sync(lease, true, move || self.run_std()).await?)
+        os::run_blocking_namespace_operation_with_sync(lease, true, move || self.run_std()).await?;
+        Ok(())
     }
 }
 
@@ -1010,274 +958,47 @@ mod tests {
         let live = format!("{:064x}", 1);
         let finished = format!("{:064x}", 2);
         let in_flight = format!("{:064x}", 3);
-        for name in [&live, &finished, &in_flight] {
+        let clock_stepped = format!("{:064x}", 4);
+        for name in [&live, &finished, &in_flight, &clock_stepped] {
             std::fs::write(directory.join(name), b"1").expect("marker");
         }
         // Completion and abort remove the staging root and leave the marker.
         std::fs::create_dir_all(root.path().join(RUSTFS_META_MULTIPART_BUCKET).join(&live)).expect("live staging root");
-        let owner = &disk.multipart_index;
-        let publishing = owner.pin_publication(owner.base.join(INDEX).join(sha("bucket")).join(&in_flight));
-        let second_publisher = owner.pin_publication(owner.base.join(INDEX).join(sha("bucket")).join(&in_flight));
-        let page = owner.page("bucket", None, Uuid::new_v4()).await.expect("page");
-        // The in-flight marker has no staging root yet but is pinned: a candidate, not a leftover.
-        assert_eq!(page.roots, vec![live.clone(), in_flight.clone()]);
+        set_marker_modified(&directory.join(&finished), std::time::SystemTime::now() - MULTIPART_INDEX_PRUNE_GRACE * 2);
+        // A marker dated after a backwards clock step is never a leftover.
+        set_marker_modified(
+            &directory.join(&clock_stepped),
+            std::time::SystemTime::now() + MULTIPART_INDEX_PRUNE_GRACE * 2,
+        );
+        let page = disk.multipart_index.page("bucket", None, Uuid::new_v4()).await.expect("page");
+        // The in-flight marker has no staging root yet but is young: a candidate, not a leftover.
+        assert_eq!(page.roots, vec![live.clone(), in_flight.clone(), clock_stepped.clone()]);
         assert!(page.next_marker.is_none());
         assert!(directory.join(&live).exists(), "a live root keeps its marker");
-        assert!(directory.join(&in_flight).exists(), "a pinned marker is kept");
-        assert!(!directory.join(&finished).exists(), "a finished root's marker is pruned at once");
-        // One of two publishers of the same root finishing does not unpin it.
-        drop(publishing);
-        let page = owner
+        assert!(directory.join(&in_flight).exists(), "a marker inside the grace period is kept");
+        assert!(directory.join(&clock_stepped).exists(), "a future-dated marker is kept");
+        assert!(!directory.join(&finished).exists(), "a finished root's marker is pruned");
+        // The next page no longer pays for the pruned marker.
+        let page = disk
+            .multipart_index
             .page("bucket", None, Uuid::new_v4())
             .await
-            .expect("page with one publisher left");
-        assert_eq!(page.roots, vec![live.clone(), in_flight.clone()]);
-        assert!(directory.join(&in_flight).exists(), "the remaining publisher keeps the marker");
-        // A publication that ended without a staging root leaves a leftover.
-        drop(second_publisher);
-        let page = owner
-            .page("bucket", None, Uuid::new_v4())
-            .await
-            .expect("page after the failed publication");
-        assert_eq!(page.roots, vec![live]);
-        assert!(!directory.join(&in_flight).exists(), "an unpinned marker without a root is pruned");
-        assert!(owner.publishing.lock().is_empty(), "finished publishers leave no pin behind");
+            .expect("page after pruning");
+        assert_eq!(page.roots, vec![live, in_flight, clock_stepped]);
     }
 
-    fn pause_next_publication(owner: &IndexOwner) -> (tokio::sync::oneshot::Receiver<()>, std::sync::mpsc::Sender<()>) {
-        let (started, waiting) = tokio::sync::oneshot::channel();
-        let (release, released) = std::sync::mpsc::channel();
-        *owner.publication_pause.lock() = Some(RebuildHeadPause {
-            started,
-            release: released,
-        });
-        (waiting, release)
+    /// Move a marker's modification time outside the publication grace period.
+    fn age_marker(marker: &Path) {
+        set_marker_modified(marker, std::time::SystemTime::now() - MULTIPART_INDEX_PRUNE_GRACE * 2);
     }
 
-    /// The window the pin closes: the marker is recorded and its lease is
-    /// released, the staging root is not published yet, and a listing examines
-    /// the bucket. The marker is dated a day back so that no grace period could
-    /// be what keeps it.
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn multipart_index_listing_during_source_publication_keeps_the_new_upload_listed() {
-        let root = tempfile::tempdir().expect("disk root");
-        let disk = Arc::new(open(root.path()).await);
-        let (path, info) = upload("bucket", "published-while-listed");
-        let source_root = path.split('/').next().expect("source sha").to_owned();
-        let marker = root.path().join(INDEX).join(sha("bucket")).join(&source_root);
-        let source_head = root
-            .path()
-            .join(RUSTFS_META_MULTIPART_BUCKET)
-            .join(&path)
-            .join(STORAGE_FORMAT_FILE);
-        let (paused, release) = pause_next_publication(&disk.multipart_index);
-        let writer = tokio::spawn({
-            let disk = Arc::clone(&disk);
-            let path = path.clone();
-            async move { disk.write_metadata("bucket", RUSTFS_META_MULTIPART_BUCKET, &path, info).await }
-        });
-        tokio::time::timeout(std::time::Duration::from_secs(5), paused)
-            .await
-            .expect("the publication reaches the pause")
-            .expect("pause sender");
-        assert!(marker.exists(), "the marker precedes the staging root");
-        assert!(!source_head.exists(), "the staging root is not published yet");
+    fn set_marker_modified(marker: &Path, modified: std::time::SystemTime) {
         std::fs::File::options()
             .write(true)
-            .open(&marker)
+            .open(marker)
             .expect("marker")
-            .set_modified(std::time::SystemTime::now() - std::time::Duration::from_secs(86_400))
-            .expect("age the marker");
-
-        let identity = Uuid::new_v4();
-        let page = disk
-            .multipart_index
-            .page("bucket", None, identity)
-            .await
-            .expect("page during publication");
-        assert_eq!(page.roots, vec![source_root.clone()], "an upload in flight stays a candidate");
-        assert!(marker.exists(), "a listing must not prune the marker of an upload in flight");
-
-        release.send(()).expect("resume the publication");
-        writer.await.expect("writer task").expect("the upload metadata is published");
-        assert!(source_head.exists());
-        let page = disk
-            .multipart_index
-            .page("bucket", None, identity)
-            .await
-            .expect("page after publication");
-        assert_eq!(page.roots, vec![source_root], "the published upload is listed");
-        assert!(marker.exists());
-        assert!(disk.multipart_index.publishing.lock().is_empty());
-    }
-
-    /// A timed-out caller drops its future while the filesystem work goes on.
-    /// The pin belongs to that work, so the marker survives until the staging
-    /// root the detached work publishes is visible.
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn multipart_index_cancelled_publisher_keeps_its_marker_until_the_detached_work_returns() {
-        let root = tempfile::tempdir().expect("disk root");
-        let disk = Arc::new(open(root.path()).await);
-        let (path, info) = upload("bucket", "caller-timed-out");
-        let source_root = path.split('/').next().expect("source sha").to_owned();
-        let marker = root.path().join(INDEX).join(sha("bucket")).join(&source_root);
-        let source_head = root
-            .path()
-            .join(RUSTFS_META_MULTIPART_BUCKET)
-            .join(&path)
-            .join(STORAGE_FORMAT_FILE);
-        let (paused, release) = pause_next_publication(&disk.multipart_index);
-        let writer = tokio::spawn({
-            let disk = Arc::clone(&disk);
-            let path = path.clone();
-            async move { disk.write_metadata("bucket", RUSTFS_META_MULTIPART_BUCKET, &path, info).await }
-        });
-        tokio::time::timeout(std::time::Duration::from_secs(5), paused)
-            .await
-            .expect("the publication reaches the pause")
-            .expect("pause sender");
-        writer.abort();
-        assert!(writer.await.expect_err("the caller is gone").is_cancelled());
-
-        let identity = Uuid::new_v4();
-        let page = disk
-            .multipart_index
-            .page("bucket", None, identity)
-            .await
-            .expect("page after the caller left");
-        assert_eq!(page.roots, vec![source_root.clone()]);
-        assert!(marker.exists(), "the detached publication still owns the marker");
-
-        release.send(()).expect("resume the detached publication");
-        tokio::time::timeout(std::time::Duration::from_secs(10), async {
-            while !source_head.exists() || !disk.multipart_index.publishing.lock().is_empty() {
-                tokio::time::sleep(std::time::Duration::from_millis(5)).await;
-            }
-        })
-        .await
-        .expect("the detached publication completes");
-        let page = disk
-            .multipart_index
-            .page("bucket", None, identity)
-            .await
-            .expect("page after the detached publication");
-        assert_eq!(page.roots, vec![source_root], "the upload the detached work published is listed");
-        assert!(marker.exists());
-    }
-
-    /// A page classifies a marker as stale before the publisher pins it; the
-    /// prune that follows must read the pin again under the marker lease.
-    #[tokio::test]
-    async fn multipart_index_prune_rechecks_the_pin_under_the_marker_lease() {
-        let root = tempfile::tempdir().expect("disk root");
-        let disk = open(root.path()).await;
-        let owner = &disk.multipart_index;
-        let directory = root.path().join(INDEX).join(sha("bucket"));
-        std::fs::create_dir_all(&directory).expect("marker directory");
-        let name = format!("{:064x}", 9);
-        std::fs::write(directory.join(&name), b"1").expect("marker");
-
-        let pin = owner.pin_publication(owner.base.join(INDEX).join(sha("bucket")).join(&name));
-        owner.prune_marker("bucket", &name).await.expect("prune of a pinned marker");
-        assert!(directory.join(&name).exists(), "a publisher that pinned after the page keeps its marker");
-
-        drop(pin);
-        owner.prune_marker("bucket", &name).await.expect("prune of a leftover");
-        assert!(!directory.join(&name).exists(), "the same marker is a leftover once nobody publishes it");
-    }
-
-    /// The publisher pins before it queues on the marker lease. A prune that
-    /// holds the lease and found no pin has therefore unlinked the marker
-    /// before the publisher records it, and the record recreates it.
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn multipart_index_publisher_pins_before_it_waits_for_the_marker_lease() {
-        let root = tempfile::tempdir().expect("disk root");
-        let disk = Arc::new(open(root.path()).await);
-        let owner = Arc::clone(&disk.multipart_index);
-        let (path, info) = upload("bucket", "queued-behind-a-prune");
-        let source_root = path.split('/').next().expect("source sha").to_owned();
-        let marker = owner.base.join(INDEX).join(sha("bucket")).join(&source_root);
-        let visible_marker = root.path().join(INDEX).join(sha("bucket")).join(&source_root);
-
-        // Stand in for a prune that owns the marker lease and already read "no pin".
-        let prune_lease = os::acquire_namespace_mutation_lease_with_owner(&marker, None).await;
-        assert!(!owner.is_publishing(&marker));
-        let writer = tokio::spawn({
-            let disk = Arc::clone(&disk);
-            let path = path.clone();
-            async move { disk.write_metadata("bucket", RUSTFS_META_MULTIPART_BUCKET, &path, info).await }
-        });
-        tokio::time::timeout(std::time::Duration::from_secs(5), async {
-            while !owner.is_publishing(&marker) {
-                tokio::time::sleep(std::time::Duration::from_millis(2)).await;
-            }
-        })
-        .await
-        .expect("the publisher pins while the marker lease is still held by the prune");
-        assert!(!visible_marker.exists(), "the marker is recorded only under the lease");
-
-        drop(prune_lease);
-        writer.await.expect("writer task").expect("the upload metadata is published");
-        assert!(visible_marker.exists(), "the record after the prune recreates the marker");
-        let page = owner.page("bucket", None, Uuid::new_v4()).await.expect("page");
-        assert_eq!(page.roots, vec![source_root]);
-    }
-
-    /// Stale markers at the start of a page, at its cursor, and filling a whole
-    /// page: every page still satisfies the receiver's contract and advances.
-    #[tokio::test]
-    async fn multipart_index_pages_of_stale_markers_keep_valid_cursors() {
-        let root = tempfile::tempdir().expect("disk root");
-        let disk = open(root.path()).await;
-        let directory = root.path().join(INDEX).join(sha("bucket"));
-        std::fs::create_dir_all(&directory).expect("marker directory");
-        // Page one is entirely stale. Page two is live except its first name
-        // and the name its cursor lands on. Two live names follow.
-        let total = MULTIPART_INDEX_PAGE_SIZE * 2 + 2;
-        let stale = |i: usize| i <= MULTIPART_INDEX_PAGE_SIZE || i == MULTIPART_INDEX_PAGE_SIZE * 2 - 1;
-        for i in 0..total {
-            let name = format!("{i:064x}");
-            std::fs::write(directory.join(&name), b"1").expect("marker");
-            if !stale(i) {
-                std::fs::create_dir_all(root.path().join(RUSTFS_META_MULTIPART_BUCKET).join(&name)).expect("staging root");
-            }
-        }
-        let disk_id = Uuid::new_v4();
-        let first = disk.multipart_index.page("bucket", None, disk_id).await.expect("first page");
-        first
-            .validate("bucket", None, disk_id)
-            .expect("an empty page with a cursor validates");
-        assert!(first.roots.is_empty(), "a fully stale page has no roots");
-        let cursor = first.next_marker.clone().expect("more markers follow a fully stale page");
-        assert_eq!(cursor, format!("{:064x}", MULTIPART_INDEX_PAGE_SIZE - 1));
-
-        let second = disk
-            .multipart_index
-            .page("bucket", Some(&cursor), disk_id)
-            .await
-            .expect("second page");
-        second
-            .validate("bucket", Some(&cursor), disk_id)
-            .expect("stale first and cursor names validate");
-        assert_eq!(second.roots.len(), MULTIPART_INDEX_PAGE_SIZE - 2);
-        assert_eq!(second.roots.first(), Some(&format!("{:064x}", MULTIPART_INDEX_PAGE_SIZE + 1)));
-        let cursor = second
-            .next_marker
-            .clone()
-            .expect("the cursor is the stale last examined name");
-        assert_eq!(cursor, format!("{:064x}", MULTIPART_INDEX_PAGE_SIZE * 2 - 1));
-        assert!(second.roots.last() < Some(&cursor));
-
-        let third = disk
-            .multipart_index
-            .page("bucket", Some(&cursor), disk_id)
-            .await
-            .expect("third page");
-        third.validate("bucket", Some(&cursor), disk_id).expect("last page validates");
-        assert_eq!(third.roots.len(), 2);
-        assert!(third.next_marker.is_none());
-        let remaining = std::fs::read_dir(&directory).expect("marker directory").count();
-        assert_eq!(remaining, total - MULTIPART_INDEX_PAGE_SIZE - 2, "every stale marker is pruned");
+            .set_modified(modified)
+            .expect("set marker time");
     }
 
     #[tokio::test]
@@ -1294,6 +1015,7 @@ mod tests {
                 std::fs::create_dir_all(root.path().join(RUSTFS_META_MULTIPART_BUCKET).join(&name)).expect("staging root");
             }
         }
+        age_marker(&directory.join(&stale));
         let disk_id = Uuid::new_v4();
         let first = disk.multipart_index.page("bucket", None, disk_id).await.expect("first page");
         first

crates/ecstore/src/disk/local/multipart_source_state.rs

@@ -776,20 +776,15 @@ impl SourceStore {
         } else {
             original_path(source, owner)
         };
-        #[cfg(not(target_os = "linux"))]
         let _pin = if source_already_pinned {
             None
         } else {
             Some(os::pin_multipart_source_directory(source, base, root)?)
         };
-        #[cfg(target_os = "linux")]
-        let _ = source_already_pinned;
         let parent = path
             .parent()
             .ok_or_else(|| std::io::Error::other("source backup has no parent"))?;
-        os::existing_base_directory_suffix(source, base)?;
-        #[cfg_attr(not(unix), allow(unused_mut))]
-        let mut parents = os::mkdir_all_below_existing_base_std(parent, source, root)?;
+        let _parents = os::mkdir_all_below_existing_base_std(parent, base, root)?;
         let existed = if fresh_owner {
             false
         } else if target {
@@ -810,37 +805,15 @@ impl SourceStore {
             false
         };
         if !existed {
-            #[cfg(target_os = "linux")]
-            let leaf_fd = parents.pop();
-            #[cfg(all(unix, not(target_os = "linux")))]
-            let leaf_fd = None;
-            os::replace_multipart_source_metadata_with_leaf_fd(
-                &path,
-                bytes,
-                base,
-                root,
-                #[cfg(unix)]
-                leaf_fd,
-            )?;
-            #[cfg(all(unix, not(target_os = "linux")))]
-            let _ = parents.pop();
+            os::replace_multipart_source_metadata(&path, bytes, base, root)?;
         }
         if sync_parents {
-            os::sync_multipart_owned_record_parents_options(
-                source,
-                parent,
-                existed,
-                sync_source_root,
-                base,
-                root,
-                Some(parents),
-            )?;
+            os::sync_multipart_owned_record_parents_options(source, parent, existed, sync_source_root, base, root)?;
         }
         Ok(())
     }
     pub async fn replace_head(&self, bytes: &[u8]) -> Result<()> {
-        let index_pin = self
-            .multipart_index
+        self.multipart_index
             .record_head(&format!("{}/xl.meta", self.path), bytes)
             .await?;
         invalidate_active_multipart_source_head(&self.source);
@@ -849,7 +822,6 @@ impl SourceStore {
         let root = self.publication_root.clone();
         let bytes = bytes.to_vec();
         os::run_blocking_namespace_operation(self.lease.clone(), move || {
-            let _index_pin = index_pin;
             os::replace_multipart_source_metadata(&path, &bytes, &base, &root)
         })
         .await
@@ -953,12 +925,9 @@ impl SourceStore {
         let base = self.base.clone();
         let root = self.publication_root.clone();
         os::run_blocking_namespace_operation(self.lease.clone(), move || {
-            #[cfg(not(target_os = "linux"))]
             let _pin = os::pin_multipart_source_directory(&source, &base, &root)?;
             let parent = path.parent().ok_or_else(|| IoError::other("certificate has no parent"))?;
-            os::existing_base_directory_suffix(&source, &base)?;
-            #[cfg_attr(not(unix), allow(unused_mut))]
-            let mut parents = os::mkdir_all_below_existing_base_std(parent, &source, &root)?;
+            let _parents = os::mkdir_all_below_existing_base_std(parent, &base, &root)?;
             let existed = if let Some(previous) = read_optional(&path, &base, &root).map_err(IoError::other)? {
                 if previous.as_ref() != raw.as_slice() {
                     return Err(IoError::new(std::io::ErrorKind::AlreadyExists, "immutable recovery certificate changed"));
@@ -968,22 +937,9 @@ impl SourceStore {
                 false
             };
             if !existed {
-                #[cfg(target_os = "linux")]
-                let leaf_fd = parents.pop();
-                #[cfg(all(unix, not(target_os = "linux")))]
-                let leaf_fd = None;
-                os::replace_multipart_source_metadata_with_leaf_fd(
-                    &path,
-                    &raw,
-                    &base,
-                    &root,
-                    #[cfg(unix)]
-                    leaf_fd,
-                )?;
-                #[cfg(all(unix, not(target_os = "linux")))]
-                let _ = parents.pop();
+                os::replace_multipart_source_metadata(&path, &raw, &base, &root)?;
             }
-            os::sync_multipart_owned_record_parents_options(&source, parent, existed, true, &base, &root, Some(parents))
+            os::sync_multipart_owned_record_parents(&source, parent, existed, &base, &root)
         })
         .await?;
         Ok(digest)
@@ -1947,14 +1903,8 @@ impl LocalDisk {
             os::run_blocking_namespace_operation_with_sync(staging.lease.clone(), true, move || {
                 SourceStore::write_owned_backup_std(&source_dir, &base_dir, &pub_root, owner, false, &original_bytes, false)?;
                 SourceStore::persist_state_std(&source_dir, &base_dir, &pub_root, &state_raw, terminal.as_deref(), false)?;
-                let staging_base = directory.parent().filter(|p| p.starts_with(&base_dir)).unwrap_or(&base_dir);
-                os::replace_multipart_source_metadata_creating_parent(
-                    &directory.join(RETIREMENT_ANCHOR),
-                    &anchor_bytes,
-                    staging_base,
-                    &base_dir,
-                    &pub_root,
-                )?;
+                let _parent = os::mkdir_all_below_existing_base_std(&directory, &base_dir, &pub_root)?;
+                os::replace_multipart_source_metadata(&directory.join(RETIREMENT_ANCHOR), &anchor_bytes, &base_dir, &pub_root)?;
                 #[cfg(target_os = "linux")]
                 if can_mark_presynced {
                     super::mark_presynced_tmp_data_dir(directory);
@@ -2165,14 +2115,8 @@ impl NativeMultipartPublication {
                         false,
                         Some(directory_guard),
                     )?;
-                    let staging_base = directory.parent().filter(|p| p.starts_with(base)).unwrap_or(base);
-                    os::replace_multipart_source_metadata_creating_parent(
-                        &directory.join(RETIREMENT_ANCHOR),
-                        &anchor_bytes,
-                        staging_base,
-                        base,
-                        root,
-                    )?;
+                    let _parent = os::mkdir_all_below_existing_base_std(&directory, base, root)?;
+                    os::replace_multipart_source_metadata(&directory.join(RETIREMENT_ANCHOR), &anchor_bytes, base, root)?;
                     #[cfg(target_os = "linux")]
                     if can_mark_presynced {
                         super::mark_presynced_tmp_data_dir(directory);
@@ -2299,14 +2243,8 @@ impl NativeMultipartPublication {
                     SourceStore::write_owned_backup_std(&source, &base, &root, backup_owner, true, previous, false)?;
                 }
                 SourceStore::persist_state_std(&source, &base, &root, &next_state_raw, terminal.as_deref(), false)?;
-                let staging_base = directory.parent().filter(|p| p.starts_with(&base)).unwrap_or(&base);
-                os::replace_multipart_source_metadata_creating_parent(
-                    &directory.join(RETIREMENT_ANCHOR),
-                    &anchor_bytes,
-                    staging_base,
-                    &base,
-                    &root,
-                )?;
+                let _parent = os::mkdir_all_below_existing_base_std(&directory, &base, &root)?;
+                os::replace_multipart_source_metadata(&directory.join(RETIREMENT_ANCHOR), &anchor_bytes, &base, &root)?;
                 #[cfg(target_os = "linux")]
                 if can_mark_presynced {
                     super::mark_presynced_tmp_data_dir(directory);

crates/ecstore/src/disk/local/multipart_staging.rs

@@ -444,6 +444,7 @@ impl LocalDisk {
             {
                 return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "multipart source layout changed"));
             }
+            let _attempt = os::mkdir_all_below_existing_base_std(&private_object, &base, &publication_root)?;
             if incoming.data.is_none() && !incoming.is_remote() {
                 let source_data_dir = source_object.join(source_dir.to_string());
                 let mut pinned_source_data = None;
@@ -508,8 +509,6 @@ impl LocalDisk {
                     sync_directory,
                     cancelled,
                 )?;
-            } else {
-                let _attempt = os::mkdir_all_below_existing_base_std(&private_object, &base, &publication_root)?;
             }
             let has_state = !from_active_cache
                 && (source_object.join(".mpu-source-state").exists()

crates/ecstore/src/disk/mod.rs

@@ -223,21 +223,8 @@ pub enum PoolMetaNativeRecoveryResponse {
 
 pub type DiskStore = Arc<Disk>;
 
-pub trait DiskFileWriter: AsyncWrite + Send + Sync + Unpin + std::any::Any {}
-impl<T: AsyncWrite + Send + Sync + Unpin + 'static> DiskFileWriter for T {}
-
 pub type FileReader = Box<dyn AsyncRead + Send + Sync + Unpin>;
-pub type FileWriter = Box<dyn DiskFileWriter>;
-
-pub(crate) fn as_lazy_local_file_writer_mut(writer: &mut dyn DiskFileWriter) -> Option<&mut local::LazyLocalFileWriter> {
-    let any: &mut dyn std::any::Any = writer;
-    if any.is::<local::LazyLocalFileWriter>() {
-        return any.downcast_mut::<local::LazyLocalFileWriter>();
-    }
-    let slow = any.downcast_mut::<disk_store::SlowDiskWriter>()?;
-    let inner_any: &mut dyn std::any::Any = slow.inner_mut();
-    inner_any.downcast_mut::<local::LazyLocalFileWriter>()
-}
+pub type FileWriter = Box<dyn AsyncWrite + Send + Sync + Unpin>;
 
 #[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, Serialize, Deserialize)]
 pub struct SnapshotLeaseToken(Uuid);
@@ -745,13 +732,6 @@ impl DiskAPI for Disk {
         }
     }
 
-    async fn bucket_creation_witness(&self, volume: &str) -> Result<Option<os::NativeBucketCreationWitness>> {
-        match self {
-            Disk::Local(local_disk) => local_disk.bucket_creation_witness(volume).await,
-            Disk::Remote(_) => Ok(None),
-        }
-    }
-
     #[tracing::instrument(level = "trace", skip_all)]
     async fn make_volume(&self, volume: &str) -> Result<()> {
         match self {
@@ -1567,36 +1547,13 @@ impl Disk {
 }
 
 pub async fn new_disk(ep: &Endpoint, opt: &DiskOption) -> Result<DiskStore> {
-    new_disk_with_health_tracker(
-        ep,
-        opt,
-        None,
-        #[cfg(feature = "internode-transport")]
-        None,
-    )
-    .await
-}
-
-pub(crate) async fn new_disk_for_instance(
-    _instance: &crate::runtime::instance::InstanceContext,
-    ep: &Endpoint,
-    opt: &DiskOption,
-) -> Result<DiskStore> {
-    new_disk_with_health_tracker(
-        ep,
-        opt,
-        None,
-        #[cfg(feature = "internode-transport")]
-        Some(_instance),
-    )
-    .await
+    new_disk_with_health_tracker(ep, opt, None).await
 }
 
 pub(crate) async fn new_disk_with_health_tracker(
     ep: &Endpoint,
     opt: &DiskOption,
     reconnect: Option<disk_store::ReconnectDiskHealthState>,
-    #[cfg(feature = "internode-transport")] instance: Option<&crate::runtime::instance::InstanceContext>,
 ) -> Result<DiskStore> {
     if ep.is_local {
         let s = LocalDisk::new(ep, opt.cleanup).await?;
@@ -1606,15 +1563,8 @@ pub(crate) async fn new_disk_with_health_tracker(
             reconnect,
         )))))
     } else {
-        #[cfg(feature = "internode-transport")]
-        let remote_disk = match instance.and_then(|ctx| ctx.internode_data_transport()) {
-            Some(transport) => RemoteDisk::new(ep, opt, Arc::clone(transport))
-                .await?
-                .with_instance_transport(),
-            None => RemoteDisk::new(ep, opt, build_internode_data_transport_from_env()?).await?,
-        };
-        #[cfg(not(feature = "internode-transport"))]
-        let remote_disk = RemoteDisk::new(ep, opt, build_internode_data_transport_from_env()?).await?;
+        let data_transport = build_internode_data_transport_from_env();
+        let remote_disk = RemoteDisk::new(ep, opt, data_transport?).await?;
         Ok(Arc::new(Disk::Remote(Box::new(remote_disk))))
     }
 }
@@ -1648,11 +1598,6 @@ pub trait DiskAPI: Debug + Send + Sync + 'static {
     // NSScanner
 
     // Volume operations.
-    /// Unknown or remote backends cannot attest process-local publication history.
-    async fn bucket_creation_witness(&self, _volume: &str) -> Result<Option<os::NativeBucketCreationWitness>> {
-        Ok(None)
-    }
-
     async fn make_volume(&self, volume: &str) -> Result<()>;
     async fn make_volumes(&self, volume: Vec<&str>) -> Result<()>;
     async fn list_volumes(&self) -> Result<Vec<VolumeInfo>>;
@@ -2508,7 +2453,7 @@ impl DeleteRecoveryJournal {
             }
             let id = request.version_id.unwrap_or_default();
             let Some(original) = originals.get(&id) else {
-                return !id.is_nil() && !locals.contains_key(&id);
+                return false;
             };
             match locals.get(&id) {
                 Some(local) => local == original,
@@ -2558,10 +2503,7 @@ impl DeleteRecoveryJournal {
             };
             match (local, remote) {
                 (Some(local), Some(remote)) => local == remote,
-                (None, None) => {
-                    (!(request.deleted && request.mark_deleted) && request.version_id.is_some_and(|id| !id.is_nil()))
-                        || (self.original_digest.is_none() && authority.original_digest.is_none())
-                }
+                (None, None) => self.original_digest.is_none() && authority.original_digest.is_none(),
                 _ => false,
             }
         })
@@ -2628,13 +2570,7 @@ pub struct BoundedDeleteRecoveryDiscovery {
     pub complete: bool,
 }
 
-/// Entries one bounded discovery call may charge on one drive. Object-scoped
-/// discovery charges each transaction-shaped (UUID) child of the key's
-/// directory once and every name that cannot be delete evidence at
-/// 1/`PLAIN_CHILDREN_PER_BUDGET_ENTRY`, so this admits a missing-key delete of a
-/// folder prefix with this many UUID-named children per drive. The request
-/// budget (`DeleteRecoveryWorkBudget`) still bounds the total across keys.
-pub const DELETE_RECOVERY_MAX_DISCOVERY_ENTRIES: u32 = 262_144;
+pub const DELETE_RECOVERY_MAX_DISCOVERY_ENTRIES: u32 = 4096;
 pub const DELETE_RECOVERY_MAX_INSPECTION_ENTRIES: u32 = 65536;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -4045,46 +3981,6 @@ mod delete_recovery_adoption_tests {
         };
         assert!(journal.matches_adoption_source(&[]), "certified non-null removal can already be absent");
         assert!(journal.matches_adoption_source(std::slice::from_ref(&source)));
-        let missing = Uuid::new_v4();
-        journal.requests.push(FileInfo {
-            version_id: Some(missing),
-            ..Default::default()
-        });
-        journal.original_digest = Some([3; 32]);
-        assert!(
-            journal.matches_prepared_authority(&journal),
-            "an explicit UUID absent from both prepared sources remains a no-op with original metadata"
-        );
-        assert!(journal.matches_adoption_source(&[]), "both non-null versions can remain absent");
-        assert!(
-            journal.matches_adoption_source(std::slice::from_ref(&source)),
-            "a missing non-null version in the batch remains a no-op"
-        );
-        let mut unexpected = source.clone();
-        unexpected.version_id = Some(missing);
-        let mut foreign_preparation = journal.clone();
-        foreign_preparation.original_versions.push(unexpected.clone());
-        assert!(
-            !journal.matches_prepared_authority(&foreign_preparation)
-                && !foreign_preparation.matches_prepared_authority(&journal),
-            "absence from only one prepared source cannot establish a generation"
-        );
-        assert!(
-            !journal.matches_adoption_source(&[source.clone(), unexpected]),
-            "a version absent from the authority cannot be deleted locally"
-        );
-        for version_id in [None, Some(Uuid::nil())] {
-            journal.requests.last_mut().expect("missing-version request").version_id = version_id;
-            assert!(
-                !journal.matches_prepared_authority(&journal),
-                "a missing null version with original metadata cannot establish its generation"
-            );
-            assert!(
-                !journal.matches_adoption_source(std::slice::from_ref(&source)),
-                "a missing null version cannot establish its generation"
-            );
-        }
-        journal.requests.pop();
         let mut foreign = source.clone();
         foreign.metadata_digest = [2; 32];
         assert!(!journal.matches_adoption_source(std::slice::from_ref(&foreign)));
@@ -4100,25 +3996,6 @@ mod delete_recovery_adoption_tests {
         assert!(journal.matches_adoption_source(std::slice::from_ref(&journal.original_versions[0])));
         journal.requests.clear();
         assert!(!journal.matches_adoption_source(&journal.original_versions));
-
-        let mut marker = journal.clone();
-        marker.requests = vec![FileInfo {
-            version_id: Some(id),
-            deleted: true,
-            mark_deleted: true,
-            ..Default::default()
-        }];
-        marker.original_versions.clear();
-        marker.original_digest = Some([3; 32]);
-        assert!(
-            !marker.matches_prepared_authority(&marker),
-            "a marker with original metadata requires a source generation"
-        );
-        marker.original_digest = None;
-        assert!(
-            marker.matches_prepared_authority(&marker),
-            "marker preparation without original metadata retains the existing allowance"
-        );
     }
 }
 

crates/ecstore/src/erasure/coding/bitrot.rs

@@ -15,7 +15,7 @@
 use crate::disk::error::Error as DiskError;
 use crate::erasure::codec::buffer_pool::{get_ec_buffer, return_ec_buffer};
 use pin_project_lite::pin_project;
-use rustfs_utils::{HashAlgorithm, LogThrottle};
+use rustfs_utils::HashAlgorithm;
 use std::future::poll_fn;
 use std::io::IoSlice;
 use std::pin::Pin;
@@ -28,13 +28,6 @@ const LOG_COMPONENT_ECSTORE: &str = "ecstore";
 const LOG_SUBSYSTEM_ERASURE: &str = "erasure";
 const EVENT_BITROT_SHORT_SHARD_READ: &str = "bitrot_short_shard_read";
 const EVENT_BITROT_HASH_MISMATCH: &str = "bitrot_hash_mismatch";
-/// A failing drive raises these once per shard block of every read it serves.
-/// The events carry no object identity (the caller logs that), so one line per
-/// interval with the suppressed count loses nothing but repetition.
-const BITROT_FAILURE_LOG_INTERVAL_MS: u64 = 5_000;
-static BITROT_SHORT_SHARD_READ_LOGS: LogThrottle = LogThrottle::new(BITROT_FAILURE_LOG_INTERVAL_MS);
-static BITROT_HASH_MISMATCH_LOGS: LogThrottle = LogThrottle::new(BITROT_FAILURE_LOG_INTERVAL_MS);
-static BITROT_READ_ERROR_LOGS: LogThrottle = LogThrottle::new(BITROT_FAILURE_LOG_INTERVAL_MS);
 const MAX_RETAINED_CHUNKS_PER_BLOCK: usize = 64;
 const MAX_CHUNK_POLLS_PER_YIELD: usize = MAX_RETAINED_CHUNKS_PER_BLOCK + 1;
 
@@ -266,41 +259,18 @@ fn reserve_bitrot_scratch(
 
 /// A truncated shard is `UnexpectedEof`, not a short success (backlog#799 B2).
 fn short_shard_read(got: usize, want: usize) -> std::io::Error {
-    if let Some(suppressed) = BITROT_SHORT_SHARD_READ_LOGS.claim() {
-        error!(
-            event = EVENT_BITROT_SHORT_SHARD_READ,
-            component = LOG_COMPONENT_ECSTORE,
-            subsystem = LOG_SUBSYSTEM_ERASURE,
-            state = "failed",
-            got,
-            want,
-            suppressed,
-            "short shard read: got {got} of {want} bytes"
-        );
-    }
+    error!(
+        event = EVENT_BITROT_SHORT_SHARD_READ,
+        component = LOG_COMPONENT_ECSTORE,
+        subsystem = LOG_SUBSYSTEM_ERASURE,
+        state = "failed",
+        got,
+        want,
+        "short shard read: got {got} of {want} bytes"
+    );
     std::io::Error::new(std::io::ErrorKind::UnexpectedEof, DiskError::FileCorrupt)
 }
 
-fn log_hash_mismatch(data_len: usize) {
-    if let Some(suppressed) = BITROT_HASH_MISMATCH_LOGS.claim() {
-        error!(
-            event = EVENT_BITROT_HASH_MISMATCH,
-            component = LOG_COMPONENT_ECSTORE,
-            subsystem = LOG_SUBSYSTEM_ERASURE,
-            state = "failed",
-            data_len,
-            suppressed,
-            "bitrot hash mismatch"
-        );
-    }
-}
-
-fn log_read_error(error: &std::io::Error) {
-    if let Some(suppressed) = BITROT_READ_ERROR_LOGS.claim() {
-        error!(suppressed, "bitrot reader read error: {error}");
-    }
-}
-
 /// Split a `[hash][data]` block, verify the hash (unless `skip_verify`), and
 /// return the data slice plus the time spent hashing. The caller writes `data`
 /// into its sink **only after** this returns `Ok`, so a shard that fails the
@@ -316,7 +286,14 @@ fn split_and_verify<'a>(hash_algo: &HashAlgorithm, skip_verify: bool, block: &'a
     let actual_hash = hash_algo.hash_encode(data);
     let verify = verify_start.elapsed();
     if actual_hash.as_ref() != hash {
-        log_hash_mismatch(data.len());
+        error!(
+            event = EVENT_BITROT_HASH_MISMATCH,
+            component = LOG_COMPONENT_ECSTORE,
+            subsystem = LOG_SUBSYSTEM_ERASURE,
+            state = "failed",
+            data_len = data.len(),
+            "bitrot hash mismatch"
+        );
         return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, DiskError::FileCorrupt));
     }
     Ok((data, verify))
@@ -368,7 +345,7 @@ where
                     .inner
                     .read_buf(&mut (&mut *out).limit(remaining))
                     .await
-                    .inspect_err(log_read_error)?;
+                    .inspect_err(|e| error!("bitrot reader read error: {e}"))?;
                 if n == 0 {
                     break;
                 }
@@ -482,7 +459,14 @@ where
                 for chunk in block_chunks() {
                     let take = remaining.min(chunk.len());
                     if actual_hash.as_ref()[hash_offset..hash_offset + take] != chunk[..take] {
-                        log_hash_mismatch(want);
+                        error!(
+                            event = EVENT_BITROT_HASH_MISMATCH,
+                            component = LOG_COMPONENT_ECSTORE,
+                            subsystem = LOG_SUBSYSTEM_ERASURE,
+                            state = "failed",
+                            data_len = want,
+                            "bitrot hash mismatch"
+                        );
                         return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, DiskError::FileCorrupt));
                     }
                     hash_offset += take;
@@ -600,27 +584,6 @@ where
     }
 }
 
-impl BitrotWriter<CustomWriter> {
-    pub(crate) async fn write_shard_bytes(
-        &mut self,
-        buf: bytes::Bytes,
-        integrity_spec: Option<(rustfs_filemeta::shard_integrity::PartIntegrity, u32, usize)>,
-    ) -> std::io::Result<(usize, Option<[u8; 32]>)> {
-        if !buf.is_empty()
-            && !self.finished
-            && buf.len() <= self.shard_size
-            && let Some(local) = self.inner.as_lazy_local_file_writer_mut()
-        {
-            if buf.len() < self.shard_size {
-                self.finished = true;
-            }
-            let hash_algo = self.hash_algo.clone();
-            return local.write_bitrot_shard(buf, hash_algo, integrity_spec).await;
-        }
-        self.write(&buf).await.map(|n| (n, None))
-    }
-}
-
 /// Read into `buf` until it is full or the reader hits EOF, returning the number
 /// of bytes actually read. A raw tokio File typically satisfies this in one
 /// `read` (one spawn_blocking round-trip); the loop only re-enters on a genuine
@@ -631,7 +594,10 @@ where
 {
     let mut filled = 0;
     while filled < buf.len() {
-        let n = reader.read(&mut buf[filled..]).await.inspect_err(log_read_error)?;
+        let n = reader.read(&mut buf[filled..]).await.map_err(|e| {
+            error!("bitrot reader read error: {}", e);
+            e
+        })?;
         if n == 0 {
             break;
         }
@@ -780,7 +746,7 @@ pub enum CustomWriter {
     /// Inline buffer writer - stores data in memory
     InlineBuffer(InlineBuffer),
     /// Disk-based writer using tokio file
-    Other(crate::disk::FileWriter),
+    Other(Box<dyn AsyncWrite + Unpin + Send + Sync>),
 }
 
 /// Inline payload storage retains its background allocation through export.
@@ -856,17 +822,6 @@ impl CustomWriter {
         Self::Other(Box::new(writer))
     }
 
-    pub fn from_file_writer(writer: crate::disk::FileWriter) -> Self {
-        Self::Other(writer)
-    }
-
-    pub(crate) fn as_lazy_local_file_writer_mut(&mut self) -> Option<&mut crate::disk::local::LazyLocalFileWriter> {
-        match self {
-            Self::InlineBuffer(_) => None,
-            Self::Other(writer) => crate::disk::as_lazy_local_file_writer_mut(&mut **writer),
-        }
-    }
-
     /// Get the inline buffer data if this is an inline buffer writer
     pub fn get_inline_data(&self) -> Option<&[u8]> {
         match self {
@@ -991,17 +946,6 @@ impl BitrotWriterWrapper {
         self.bitrot_writer.write(buf).await
     }
 
-    pub(crate) async fn write_shard_bytes(
-        &mut self,
-        buf: bytes::Bytes,
-        integrity_spec: Option<(rustfs_filemeta::shard_integrity::PartIntegrity, u32, usize)>,
-    ) -> std::io::Result<(usize, Option<[u8; 32]>)> {
-        if let Some(integrity) = &mut self.integrity {
-            integrity.verify(&buf).await?;
-        }
-        self.bitrot_writer.write_shard_bytes(buf, integrity_spec).await
-    }
-
     pub(crate) fn set_integrity(&mut self, verifier: crate::io_support::shard_integrity::ShardVerifier) {
         self.integrity = Some(verifier);
     }
@@ -1314,34 +1258,6 @@ mod tests {
         ));
     }
 
-    /// The log line is bounded; the rejection is not. Every damaged block is
-    /// refused with the same typed error however many came before it.
-    #[test]
-    fn repeated_bitrot_failures_are_all_rejected_while_their_log_is_bounded() {
-        use crate::disk::error::Error as DiskError;
-        let algo = HashAlgorithm::HighwayHash256;
-        let data = b"one of many damaged blocks";
-        let mut frame = algo.hash_encode(data).as_ref().to_vec();
-        frame.extend_from_slice(data);
-        *frame.last_mut().expect("test frame has payload") ^= 1;
-
-        for _ in 0..1_000 {
-            let error = super::split_and_verify(&algo, false, &frame).expect_err("every mismatch rejects its shard");
-            assert_eq!(error.kind(), io::ErrorKind::InvalidData);
-            assert_eq!(DiskError::from(error), DiskError::FileCorrupt);
-            let error = super::short_shard_read(3, 4);
-            assert_eq!(error.kind(), io::ErrorKind::UnexpectedEof);
-            assert_eq!(DiskError::from(error), DiskError::FileCorrupt);
-            super::log_read_error(&io::Error::other("drive read failed"));
-        }
-
-        // Each burst used its own window, so a further event of the same kind
-        // inside the interval is suppressed.
-        assert!(super::BITROT_HASH_MISMATCH_LOGS.claim().is_none());
-        assert!(super::BITROT_SHORT_SHARD_READ_LOGS.claim().is_none());
-        assert!(super::BITROT_READ_ERROR_LOGS.claim().is_none());
-    }
-
     struct FragmentedSource {
         chunks: VecDeque<Bytes>,
     }

crates/ecstore/src/erasure/coding/decode.rs

@@ -894,13 +894,6 @@ fn record_shard_read_result(
     }
 }
 
-/// A slow or misaligned shard reader is retired once per stripe of every read
-/// it lags on. The lines name only a shard index, so one per interval with the
-/// suppressed count is enough.
-const RETIRED_READER_LOG_INTERVAL_MS: u64 = 5_000;
-static ABANDONED_READER_LOGS: rustfs_utils::LogThrottle = rustfs_utils::LogThrottle::new(RETIRED_READER_LOG_INTERVAL_MS);
-static UNALIGNED_PARITY_READER_LOGS: rustfs_utils::LogThrottle = rustfs_utils::LogThrottle::new(RETIRED_READER_LOG_INTERVAL_MS);
-
 fn retire_abandoned_readers(errs: &mut [Option<Error>], retire_readers: &mut ShardIndexes, active_readers: &[bool]) {
     for (i, active) in active_readers.iter().enumerate() {
         if !*active {
@@ -911,9 +904,7 @@ fn retire_abandoned_readers(errs: &mut [Option<Error>], retire_readers: &mut Sha
             errs[i] = Some(Error::from(io::Error::new(ErrorKind::TimedOut, "shard read abandoned after read quorum")));
         }
         retire_readers.push(i);
-        if let Some(suppressed) = ABANDONED_READER_LOGS.claim() {
-            warn!(shard_index = i, suppressed, "retiring in-flight shard reader after read quorum");
-        }
+        warn!(shard_index = i, "retiring in-flight shard reader after read quorum");
     }
 }
 
@@ -2033,12 +2024,10 @@ where
             self.engaged[idx] = true;
             true
         } else {
-            if let Some(suppressed) = UNALIGNED_PARITY_READER_LOGS.claim() {
-                warn!(
-                    shard_index = idx,
-                    stripe_index, suppressed, "retiring parity reader that cannot be aligned to the current stripe"
-                );
-            }
+            warn!(
+                shard_index = idx,
+                stripe_index, "retiring parity reader that cannot be aligned to the current stripe"
+            );
             self.readers[idx] = None;
             false
         }
@@ -2855,29 +2844,6 @@ impl Erasure {
 #[cfg(test)]
 mod tests {
     use super::*;
-
-    /// The warning is bounded; the retirement is not. Every call retires every
-    /// reader still in flight and records why, however many calls came before.
-    #[test]
-    fn abandoned_readers_are_retired_on_every_call_while_their_log_is_bounded() {
-        let active_readers = [true, false, true, true];
-        for _ in 0..1_000 {
-            let mut errs: Vec<Option<Error>> = vec![None, None, Some(Error::other("already failed")), None];
-            let mut retire_readers = ShardIndexes::new();
-            retire_abandoned_readers(&mut errs, &mut retire_readers, &active_readers);
-
-            assert_eq!(retire_readers.as_slice(), &[0, 2, 3]);
-            assert!(errs[1].is_none(), "an inactive reader is left alone");
-            assert!(errs[0].is_some() && errs[3].is_some(), "an abandoned reader gets its timeout error");
-            assert!(
-                errs[2]
-                    .as_ref()
-                    .is_some_and(|error| error.to_string().contains("already failed")),
-                "an existing error is kept"
-            );
-        }
-        assert!(ABANDONED_READER_LOGS.claim().is_none(), "the burst used the window");
-    }
     use crate::{
         disk::error::DiskError,
         erasure::coding::{BitrotReader, BitrotWriter},

crates/ecstore/src/erasure/coding/encode.rs

@@ -496,30 +496,24 @@ impl<'a> MultiWriter<'a> {
         }
     }
 
-    async fn write_shard_bytes(
-        writer_opt: &mut Option<BitrotWriterWrapper>,
-        err: &mut Option<Error>,
-        digest_slot: &mut Option<[u8; 32]>,
-        shard: Bytes,
-        integrity_spec: Option<(rustfs_filemeta::shard_integrity::PartIntegrity, u32, usize)>,
-    ) {
-        let shard_len = shard.len();
+    async fn write_shard(writer_opt: &mut Option<BitrotWriterWrapper>, err: &mut Option<Error>, shard: &[u8]) {
         match writer_opt {
-            Some(writer) => match writer.write_shard_bytes(shard, integrity_spec).await {
-                Ok((n, digest)) => {
-                    *digest_slot = digest;
-                    if n < shard_len {
-                        *err = Some(Error::ShortWrite);
-                        *writer_opt = None; // Mark as failed
-                    } else {
-                        *err = None;
+            Some(writer) => {
+                match writer.write(shard).await {
+                    Ok(n) => {
+                        if n < shard.len() {
+                            *err = Some(Error::ShortWrite);
+                            *writer_opt = None; // Mark as failed
+                        } else {
+                            *err = None;
+                        }
+                    }
+                    Err(e) => {
+                        *err = Some(Error::from(e));
+                        *writer_opt = None; // Mark as failed so the caller drops this disk before commit
                     }
                 }
-                Err(e) => {
-                    *err = Some(Error::from(e));
-                    *writer_opt = None; // Mark as failed so the caller drops this disk before commit
-                }
-            },
+            }
             None => {
                 *err = Some(Error::DiskNotFound);
             }
@@ -527,39 +521,19 @@ impl<'a> MultiWriter<'a> {
     }
 
     pub async fn write(&mut self, data: Vec<Bytes>) -> std::io::Result<()> {
-        let mut digests = vec![None; self.writers.len()];
-        self.write_shards_bytes(data.into_iter(), &mut digests, None).await
+        self.write_shards(data.iter().map(Bytes::as_ref)).await
     }
 
     async fn write_block(&mut self, block: &EncodedBlock) -> std::io::Result<()> {
-        if let Some(integrity) = &self.integrity
-            && block.shards().len() != integrity.part().layout.shards()
-        {
-            return Err(std::io::Error::new(
-                std::io::ErrorKind::InvalidData,
-                "shard integrity verification failed",
-            ));
-        }
-        let mut digests = vec![None; self.writers.len()];
-        let integrity_part = self.integrity.as_ref().map(|b| b.part().clone());
-        let write_res = self
-            .write_shards_bytes(block.shards_bytes(), &mut digests, integrity_part.as_ref())
-            .await;
         if let Some(integrity) = &mut self.integrity {
             // Commit every coding index, including disks absent from the write.
-            integrity.push_with_precomputed(block.shards(), &digests).await?;
+            integrity.push(block.shards()).await?;
         }
-        write_res
+        self.write_shards(block.shards()).await
     }
 
-    async fn write_shards_bytes(
-        &mut self,
-        shards: impl ExactSizeIterator<Item = Bytes>,
-        digests: &mut [Option<[u8; 32]>],
-        integrity_part: Option<&rustfs_filemeta::shard_integrity::PartIntegrity>,
-    ) -> std::io::Result<()> {
+    async fn write_shards<'b>(&mut self, shards: impl ExactSizeIterator<Item = &'b [u8]>) -> std::io::Result<()> {
         assert_eq!(shards.len(), self.writers.len());
-        assert_eq!(digests.len(), self.writers.len());
 
         let budget = self.next_progress_budget();
         let stall_timeout = self.policy.stall_timeout;
@@ -567,18 +541,10 @@ impl<'a> MultiWriter<'a> {
         let slot_count = self.writers.len();
         let saw = {
             let futures = FuturesUnordered::new();
-            for (index, (((writer_opt, err), digest_slot), shard)) in self
-                .writers
-                .iter_mut()
-                .zip(self.errs.iter_mut())
-                .zip(digests.iter_mut())
-                .zip(shards)
-                .enumerate()
-            {
+            for (index, ((writer_opt, err), shard)) in self.writers.iter_mut().zip(self.errs.iter_mut()).zip(shards).enumerate() {
                 if err.is_some() {
                     continue; // Skip if we already have an error for this writer
                 }
-                let integrity_spec = integrity_part.map(|part| (part.clone(), part.stripes, index));
                 // A shard write that makes no forward progress within `budget` is
                 // failed and its disk dropped, so a stalled peer cannot pin an
                 // otherwise-healthy write quorum (rustfs/backlog#1319). `budget`
@@ -587,21 +553,14 @@ impl<'a> MultiWriter<'a> {
                 // post-quorum grace; multipart preserves this operation budget.
                 futures.push(async move {
                     match budget {
-                        Some(budget) => {
-                            match tokio::time::timeout(
-                                budget,
-                                Self::write_shard_bytes(writer_opt, err, digest_slot, shard, integrity_spec),
-                            )
-                            .await
-                            {
-                                Ok(()) => {}
-                                Err(_elapsed) => {
-                                    *err = Some(Error::Timeout);
-                                    *writer_opt = None;
-                                }
+                        Some(budget) => match tokio::time::timeout(budget, Self::write_shard(writer_opt, err, shard)).await {
+                            Ok(()) => {}
+                            Err(_elapsed) => {
+                                *err = Some(Error::Timeout);
+                                *writer_opt = None;
                             }
-                        }
-                        None => Self::write_shard_bytes(writer_opt, err, digest_slot, shard, integrity_spec).await,
+                        },
+                        None => Self::write_shard(writer_opt, err, shard).await,
                     }
                     let succeeded = err.is_none() && writer_opt.is_some();
                     (index, succeeded)
@@ -907,14 +866,13 @@ impl Erasure {
         if let Some(integrity) = integrity {
             integrity.push(block.shards()).await?;
         }
-        let shard_count = block.shards().len();
-        let mut encoded = BytesMut::with_capacity(shard_count * 32 + block.queued_bytes());
-        let mut inline_shards = Vec::with_capacity(shard_count);
+        let mut inline_shards = Vec::with_capacity(block.shards().len());
         for shard in block.shards() {
             let hash = HashAlgorithm::HighwayHash256S.hash_encode(shard);
+            let mut encoded = BytesMut::with_capacity(hash.as_ref().len() + shard.len());
             encoded.extend_from_slice(hash.as_ref());
             encoded.extend_from_slice(shard);
-            inline_shards.push(encoded.split().freeze());
+            inline_shards.push(encoded.freeze());
         }
 
         Ok((reader, total, inline_shards))

crates/ecstore/src/erasure/coding/erasure.rs

@@ -58,13 +58,6 @@ impl EncodedBlock {
         self.data.chunks_exact(self.shard_size)
     }
 
-    pub(crate) fn shards_bytes(&self) -> impl ExactSizeIterator<Item = Bytes> + '_ {
-        debug_assert!(self.shard_size > 0, "only non-empty encoded blocks reach shard writers");
-        debug_assert_eq!(self.data.len() % self.shard_size, 0);
-        let count = self.data.len() / self.shard_size;
-        (0..count).map(move |i| self.data.slice(i * self.shard_size..(i + 1) * self.shard_size))
-    }
-
     fn into_shards(mut self, shard_count: usize) -> Vec<Bytes> {
         if self.shard_size == 0 {
             return vec![Bytes::new(); shard_count];

crates/ecstore/src/error/mod.rs

@@ -17,8 +17,8 @@
 use crate::bucket::error::BucketMetadataError;
 use crate::disk::error::DiskError;
 use crate::storage_api_contracts::{error::StorageErrorCode, range::HTTPRangeError};
-use rustfs_s3_types::S3ErrorCode;
 use rustfs_utils::path::decode_dir_object;
+use s3s::S3ErrorCode;
 
 pub type Error = StorageError;
 pub type Result<T> = core::result::Result<T, Error>;
@@ -1096,8 +1096,14 @@ impl From<rmp_serde::decode::Error> for Error {
     }
 }
 
-impl From<crate::bucket::utils::BucketConfigXmlError> for Error {
-    fn from(e: crate::bucket::utils::BucketConfigXmlError) -> Self {
+impl From<s3s::xml::SerError> for Error {
+    fn from(e: s3s::xml::SerError) -> Self {
+        Error::other(e)
+    }
+}
+
+impl From<s3s::xml::DeError> for Error {
+    fn from(e: s3s::xml::DeError) -> Self {
         Error::other(e)
     }
 }

crates/ecstore/src/io_support/bitrot.rs

@@ -851,7 +851,7 @@ pub async fn create_bitrot_writer_with_orig_volume(
         let file = disk.create_file(origvolume, volume, path, length).await?;
         #[cfg(feature = "hotpath")]
         let file = instrument_raw_shard_writer(file, disk.is_local());
-        CustomWriter::from_file_writer(file)
+        CustomWriter::new_tokio_writer(file)
     } else {
         return Err(DiskError::DiskNotFound);
     };

crates/ecstore/src/io_support/shard_integrity.rs

@@ -50,32 +50,18 @@ impl IntegrityBuilder {
         })
     }
 
-    pub(crate) fn part(&self) -> &PartIntegrity {
-        &self.part
-    }
-
     pub(crate) async fn push<'a>(&mut self, shards: impl ExactSizeIterator<Item = &'a [u8]>) -> io::Result<()> {
-        self.push_with_precomputed(shards, &[]).await
-    }
-
-    pub(crate) async fn push_with_precomputed<'a>(
-        &mut self,
-        shards: impl ExactSizeIterator<Item = &'a [u8]>,
-        precomputed: &[Option<[u8; 32]>],
-    ) -> io::Result<()> {
         if shards.len() != self.part.layout.shards() {
             return Err(corrupt());
         }
         let mut row = Vec::with_capacity(shards.len() * 32);
         for (index, payload) in shards.enumerate() {
-            let digest = match precomputed.get(index).copied().flatten() {
-                Some(digest) => digest,
-                None => self
+            row.extend_from_slice(
+                &self
                     .part
                     .shard_digest(self.part.stripes, index, payload)
                     .map_err(|_| corrupt())?,
-            };
-            row.extend_from_slice(&digest);
+            );
         }
         self.append(&row).await?;
         self.part.stripes = self.part.stripes.checked_add(1).ok_or_else(corrupt)?;
@@ -262,45 +248,11 @@ impl PreparedIntegrity {
         directory: &str,
     ) -> io::Result<PartIntegrity> {
         let length = self.part.index_size().map_err(|_| corrupt())?;
-        let length_i64 = i64::try_from(length).map_err(|_| corrupt())?;
         let path = format!("{directory}/{}", self.part.file_name());
-        let mut file = match self.index {
-            Spool::Memory(bytes) => {
-                let payload = Bytes::from(bytes);
-                futures::future::join_all(disks.iter_mut().map(|disk_opt| {
-                    let path = &path;
-                    let payload = payload.clone();
-                    async move {
-                        let Some(disk) = disk_opt.as_ref() else {
-                            return;
-                        };
-                        let res = tokio::time::timeout(std::time::Duration::from_secs(60), async {
-                            let mut writer = disk
-                                .create_file(original_volume, volume, path, length_i64)
-                                .await
-                                .map_err(io::Error::other)?;
-                            if let Some(local) = crate::disk::as_lazy_local_file_writer_mut(&mut *writer) {
-                                local.write_all_bytes(payload).await?;
-                            } else {
-                                writer.write_all(&payload).await?;
-                            }
-                            writer.shutdown().await
-                        })
-                        .await;
-                        if !matches!(res, Ok(Ok(()))) {
-                            *disk_opt = None;
-                        }
-                    }
-                }))
-                .await;
-                return Ok(self.part);
-            }
-            Spool::File(file) => file,
-        };
         let mut writers = futures::future::join_all(disks.iter().map(|disk| async {
             match disk {
                 Some(disk) => disk
-                    .create_file(original_volume, volume, &path, length_i64)
+                    .create_file(original_volume, volume, &path, i64::try_from(length).map_err(|_| corrupt())?)
                     .await
                     .map(Some)
                     .map_err(io::Error::other),
@@ -312,14 +264,19 @@ impl PreparedIntegrity {
         .map(Result::ok)
         .map(Option::flatten)
         .collect::<Vec<_>>();
-        // The file has a single owner; duplicated descriptors share offsets.
-        file = tokio::task::spawn_blocking(move || {
-            file.seek(SeekFrom::Start(0))?;
-            io::Result::Ok(file)
-        })
-        .await
-        .map_err(io::Error::other)??;
-        let mut source = tokio::fs::File::from_std(file);
+        let mut source: Box<dyn tokio::io::AsyncRead + Unpin + Send> = match self.index {
+            Spool::Memory(bytes) => Box::new(std::io::Cursor::new(bytes)),
+            Spool::File(mut file) => {
+                // The file has a single owner; duplicated descriptors share offsets.
+                file = tokio::task::spawn_blocking(move || {
+                    file.seek(SeekFrom::Start(0))?;
+                    io::Result::Ok(file)
+                })
+                .await
+                .map_err(io::Error::other)??;
+                Box::new(tokio::fs::File::from_std(file))
+            }
+        };
         let mut buffer = vec![0; COPY_CHUNK_SIZE.min(length)];
         loop {
             let n = source.read(&mut buffer).await?;

crates/ecstore/src/layout/endpoints.rs

@@ -2149,15 +2149,6 @@ mod test {
         }
     }
 
-    /// Runs endpoint parsing cases whose local paths do not exist. Unix leaves
-    /// missing paths out of the physical-disk independence check, but Windows
-    /// resolves them to their volume, so paths such as `/d1` and `/d2` count as
-    /// one shared device there. These cases cover parsing, not disk
-    /// independence, which has its own tests below.
-    async fn with_disk_independence_check_bypassed<F: std::future::Future<Output = ()>>(cases: F) {
-        async_with_vars([(ENV_UNSAFE_BYPASS_DISK_CHECK, Some("true"))], cases).await;
-    }
-
     #[test]
     fn endpoint_parse_errors_do_not_echo_url_credentials() {
         let err = Endpoints::try_from(["http://:topsecret@server/path"].as_slice()).unwrap_err();
@@ -2166,13 +2157,8 @@ mod test {
         assert!(!err.to_string().contains("topsecret"));
     }
 
-    #[serial]
     #[tokio::test]
     async fn explicit_local_endpoint_host_selects_only_exact_host_and_server_port() {
-        with_disk_independence_check_bypassed(explicit_local_endpoint_host_selects_only_exact_host_and_server_port_cases()).await;
-    }
-
-    async fn explicit_local_endpoint_host_selects_only_exact_host_and_server_port_cases() {
         let args = vec![
             "http://rustfs-0.rustfs-headless.ns.svc.cluster.local./data0",
             "http://rustfs-0.rustfs-headless.ns.svc.cluster.local.:9443/data1",
@@ -2935,13 +2921,8 @@ mod test {
         }
     }
 
-    #[serial]
     #[tokio::test]
     async fn test_create_pool_endpoints() {
-        with_disk_independence_check_bypassed(test_create_pool_endpoints_cases()).await;
-    }
-
-    async fn test_create_pool_endpoints_cases() {
         #[derive(Default)]
         struct TestCase<'a> {
             num: usize,
@@ -3560,13 +3541,8 @@ mod test {
         (urls, local_flags)
     }
 
-    #[serial]
     #[tokio::test]
     async fn test_create_server_endpoints() {
-        with_disk_independence_check_bypassed(test_create_server_endpoints_cases()).await;
-    }
-
-    async fn test_create_server_endpoints_cases() {
         let test_cases = [
             // Invalid input.
             ("", vec![], false),

crates/ecstore/src/object_api/object_api_utils.rs

@@ -20,6 +20,7 @@
 #![allow(clippy::all)]
 
 use http::HeaderMap;
+use s3s::dto::ETag;
 use std::{collections::HashMap, io::Cursor, sync::Arc};
 use tokio::io::BufReader;
 
@@ -28,7 +29,7 @@ use crate::object_api::{GetObjectReader, ObjectInfo, ObjectOptions};
 use crate::storage_api_contracts::range::HTTPRangeSpec;
 use rustfs_filemeta::ObjectPartInfo;
 use rustfs_rio::HashReader;
-use rustfs_s3_types::S3ErrorCode;
+use s3s::S3ErrorCode;
 
 //#[derive(Clone)]
 pub struct PutObjReader {
@@ -149,6 +150,24 @@ pub fn new_getobjectreader<'a>(
     })
 }
 
+/// Convert a raw stored ETag into the strongly-typed `s3s::dto::ETag`.
+///
+/// Supports already quoted (`"abc"`), weak (`W/"abc"`), or plain (`abc`) values.
+pub fn to_s3s_etag(etag: &str) -> ETag {
+    if let Some(rest) = etag.strip_prefix("W/\"") {
+        if let Some(body) = rest.strip_suffix('"') {
+            return ETag::Weak(body.to_string());
+        }
+        return ETag::Weak(rest.to_string());
+    }
+
+    if let Some(body) = etag.strip_prefix('"').and_then(|rest| rest.strip_suffix('"')) {
+        return ETag::Strong(body.to_string());
+    }
+
+    ETag::Strong(etag.to_string())
+}
+
 pub fn get_raw_etag(metadata: &HashMap<String, String>) -> String {
     metadata
         .get("etag")
@@ -213,42 +232,28 @@ mod tests {
     }
 
     #[test]
-    fn test_new_getobjectreader_rejects_a_range_past_the_object_as_invalid_range() {
-        let oi = multipart_object_info();
-        let past_the_end = Some(HTTPRangeSpec {
-            is_suffix_length: false,
-            start: oi.size,
-            end: oi.size + 10,
-        });
+    fn test_to_s3s_etag() {
+        // Test unquoted ETag - should become strong etag
+        assert_eq!(
+            to_s3s_etag("6af8d12c0c74b78094884349f3c8a079"),
+            ETag::Strong("6af8d12c0c74b78094884349f3c8a079".to_string())
+        );
 
-        let err = new_getobjectreader(&past_the_end, &oi, &ObjectOptions::default(), &HeaderMap::new())
-            .err()
-            .expect("a range starting at the object size must be rejected");
+        assert_eq!(
+            to_s3s_etag("\"6af8d12c0c74b78094884349f3c8a079\""),
+            ETag::Strong("6af8d12c0c74b78094884349f3c8a079".to_string())
+        );
 
-        assert_eq!(err.code, S3ErrorCode::InvalidRange);
-        assert_eq!(err.code.as_str(), "InvalidRange");
-        assert_eq!(err.key, None);
-        assert_eq!(err.bucket_name, None);
-    }
+        assert_eq!(
+            to_s3s_etag("W/\"6af8d12c0c74b78094884349f3c8a079\""),
+            ETag::Weak("6af8d12c0c74b78094884349f3c8a079".to_string())
+        );
 
-    #[test]
-    fn test_new_getobjectreader_rejects_an_unknown_size_without_a_range_as_invalid_range() {
-        let oi = ObjectInfo {
-            bucket: "bucket".to_string(),
-            name: "object".to_string(),
-            size: -1,
-            ..Default::default()
-        };
+        assert_eq!(to_s3s_etag(""), ETag::Strong(String::new()));
 
-        let err = new_getobjectreader(&None, &oi, &ObjectOptions::default(), &HeaderMap::new())
-            .err()
-            .expect("an object of unknown size cannot be read without a range");
+        assert_eq!(to_s3s_etag("\"incomplete"), ETag::Strong("\"incomplete".to_string()));
 
-        assert_eq!(err.code, S3ErrorCode::InvalidRange);
-        assert_eq!(err.code.as_str(), "InvalidRange");
-        assert_eq!(err.message, "Invalid range");
-        assert_eq!(err.key.as_deref(), Some("object"));
-        assert_eq!(err.bucket_name.as_deref(), Some("bucket"));
+        assert_eq!(to_s3s_etag("incomplete\""), ETag::Strong("incomplete\"".to_string()));
     }
 
     #[test]