Run scoped multipart lock diagnostics on Windows

.agents/references/adversarial-validation.md

@@ -27,4 +27,7 @@ Risk and review shape:
   and list verified and unverified target classes in the PR Impact section.
 
 Available domain lenses are security, concurrency/durability, compatibility,
-and performance; select only those matched by the change.
+and performance. Select `.agents/skills/adversarial-validation/SKILL.md` for an
+explicit adversarial request, a high-risk change, or a substantial PR review;
+then read only its matching role references. A routine standard pass does not
+load the playbook unless the reviewer needs a RustFS-specific probe.

.agents/skills/adversarial-validation/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: adversarial-validation
+description: Review RustFS diffs or designs for explicit adversarial requests, high-risk changes under the repository review policy, or substantial PR reviews. Skip ordinary questions, diagnosis, planning, status, routine low-risk implementation, and prose with no execution effect.
+---
+
+# RustFS Adversarial Validation
+
+Use the [repository risk tiers and review shape](../../references/adversarial-validation.md). This skill
+routes a review to RustFS-specific probes without loading unrelated domains.
+
+## Select Lenses
+
+Read only the references required by the diff:
+
+| Lens | When to read |
+|---|---|
+| [Correctness](references/correctness.md) | Every non-exempt adversarial review |
+| [Simplicity](references/simplicity.md) | Mechanical/standard changes and production growth |
+| [Test coverage](references/test-coverage.md) | Behavior or test changes |
+| [Security](references/security.md) | Authn/authz, IAM, RPC trust, paths, secrets, parsing, browser, encryption |
+| [Concurrency/durability](references/concurrency-durability.md) | Async shared state, locks, storage commit, cancellation, persisted queues |
+| [Compatibility](references/compatibility.md) | S3 surface, MinIO interop, metadata, wire/disk formats, mixed versions |
+| [Performance](references/performance.md) | Request/object hot paths, allocation, blocking work, fsync, fan-out |
+
+Do not read all references as a precaution. A path name alone is insufficient;
+the changed behavior must touch the lens's domain.
+
+For a dedicated security audit or advisory analysis, use
+`security-advisory-lessons` instead of loading it automatically during every
+adversarial review.
+
+## Review Protocol
+
+1. Freeze the exact final diff/head (or the design under review) and list the
+   selected lenses.
+2. Run the review shape required by the repository risk tier.
+3. For each selected lens, either report a concrete finding or a null verdict
+   naming the attacks performed.
+4. Apply root `AGENTS.md`'s finding standard. Test each candidate against callers,
+   existing coverage, and invariants before accepting it; an adversarial role
+   does not have to produce a defect.
+5. Fix or rebut supported findings with code-path, test, or invariant evidence.
+6. After a non-trivial edit, rerun only lenses affected by that edit against the
+   new exact diff.
+
+Do not turn a null verdict into a long checklist. Record concise evidence that
+the relevant failure classes were attacked, then stop under the root completion
+rule. Keep the required per-lens verdicts for high-risk PRs.

.agents/skills/adversarial-validation/references/compatibility.md

@@ -0,0 +1,38 @@
+# Compatibility Lens
+
+- Internal metadata uses `metadata_compat` helpers for dual RustFS/MinIO keys,
+  including mixed casing and removal of both twins.
+- Binary UUID metadata treats absent, empty, and nil as no value. Unversioned
+  remote tiers receive no `versionId`; versioned purge requests retain the real
+  version ID.
+- `xl.meta` changes preserve supported header/meta versions, recompute
+  signatures, decode legacy fixtures, and remain readable by old RustFS/MinIO.
+- Foreign/corrupt metadata validates parallel array lengths and missing fields;
+  it returns a decode error rather than indexing, panicking, or fabricating data.
+- Do not “correct” byte-for-byte MinIO ports without legacy fixture evidence.
+  Bitrot framing, shard math, distribution, and inline prefixes are contracts.
+- Client-visible metadata/events strip both internal prefixes
+  case-insensitively.
+- Proto fields are appended, never reused/renumbered; FlatBuffers tables extend
+  compatibly and absent new fields fail closed where authorization/quorum is
+  involved.
+- Replay real client request shapes and exact pagination boundaries for S3
+  handler changes.
+- Bucket metadata/IAM/config parsing remains compatible with pinned real MinIO
+  fixtures and encrypted migration data.
+- Compatibility shims use `RUSTFS_COMPAT_TODO(<task-id>)`, have a removal
+  condition, and default toward reading old data safely.
+
+## Outbound targets
+
+- A change to what the replication or migration client sends by default
+  (checksum policy, payload framing, headers, version-id addressing) is judged
+  against every target class, not the one it fixes. Name each target-side rule
+  the current default satisfies — checksum required with Object Lock
+  parameters, `aws-chunked` decoding, version-id adoption, ETag equals content
+  MD5 — and show which cell of
+  `crates/e2e_test/src/replication_target_matrix_test.rs` covers each.
+- A test that asserts the fix ("no trailer header") is not evidence; the
+  matrix cell that asserts the target accepted and stored the object is.
+- Every new environment escape hatch appears in
+  `docs/operations/replication-outbound-transport.md` in the same diff.

.agents/skills/adversarial-validation/references/concurrency-durability.md

@@ -0,0 +1,27 @@
+# Concurrency and Durability Lens
+
+- For every changed lock, enumerate overlapping lock sets and construct the
+  ABBA interleaving. Multiple-lock order must be documented and consistent.
+- Mark guard lifetimes and every `.await`, disk,
+  and RPC call; estimate contention/timeouts. Tokio read/write guards across
+  `.await` need bounded hold time; long-lived reads can wedge writers (#4195).
+  Keep `std::sync::Mutex` holds brief and never across `.await`.
+- Use direct `fetch_*` for unconditional atomic read-modify-write and
+  `compare_exchange` for conditional updates.
+- Object commits remain fenced if the distributed lock is lost after shard
+  writes and before metadata rename.
+- For write/rename changes, trace `write tmp -> sync tmp -> rename -> sync parent
+  -> sync required ancestors`; simulate a crash after each step and honor the
+  configured durability gate.
+- Multi-disk fan-out counts every result. Quorum-minus-one cannot become success;
+  heal remains best-effort per target where that is the established contract.
+- At every new cancellable await between mutation and cleanup/commit, drop the
+  future and inspect leftover files, counters, permits, and replay state.
+- Multipart operations on the same upload ID are serialized where required;
+  abort/complete/list races cannot delete parts before durable commit.
+- Post-commit cleanup is best-effort, retry-safe, and cannot fail an already
+  committed write or delete the last surviving copy.
+- Persisted read-modify-write uses serialization/CAS. Queue replay is crash-safe
+  and duplicate delivery has an idempotency contract.
+- Streaming reconstruction failures after partial output surface as errors, not
+  successful EOF.

.agents/skills/adversarial-validation/references/correctness.md

@@ -0,0 +1,31 @@
+# Correctness Lens
+
+Attack the changed behavior, not every subsystem in the repository.
+
+- Trace new error paths to the caller. Inject the ignored/wildcard variants and
+  verify they cannot become success, not-found, or a plausible default.
+- Exercise zero/empty/missing, maximum, and exact-boundary inputs for every
+  changed count, size, index, page limit, or optional value.
+- For aggregation/quorum changes, test exactly quorum and quorum-minus-one with
+  mixed disk errors and nil/placeholder entries.
+- For listing/pagination, test `n == max`, `n == max + 1`, delimiter folding,
+  continuation markers, and object/prefix name collisions.
+- For EC/read/streaming changes, inject failure after partial output and verify
+  the client receives an error rather than a clean truncated body. Assert exact
+  bytes and length.
+- For multipart/object commits, fail before/after rename and cleanup; committed
+  data must remain readable and pre-commit cleanup must not destroy parts.
+- Bound recursion over untrusted or persisted input; handle corrupted/cyclic
+  tree and cache traversals safely.
+- For version/index ordering, test `len - 1`, `len`, equal timestamps, missing
+  versions, and deterministic tie-breaking.
+- For directory-object behavior, trace `__XLDIR__` at the store layer; branches
+  below the layer that sees trailing slashes are dead.
+- For binary UUID metadata, absent, empty, and nil all mean no value. Never send
+  nil/empty `versionId` to an unversioned tier.
+- For agent rules/skill routers, test a trigger matrix covering ordinary
+  inquiry, low-risk implementation, explicit review, high-risk code, PR
+  creation, release, and post-PR monitoring. Each case must select only the
+  intended workflow and retain required safety/authorization boundaries.
+
+Null verdicts name only the probes relevant to the diff.

.agents/skills/adversarial-validation/references/performance.md

@@ -0,0 +1,34 @@
+# Performance Lens
+
+- For added clones/allocations on request/object/block paths, quantify copied
+  data and frequency. Recommend borrowing, move, `Bytes`/`Arc`, `Cow`, or
+  capacity reservation only for a concrete repeated cost.
+- Route every new sync/flush through the durability-mode and bucket override
+  gates; mode `none` must not pay the new fsync.
+- Keep blocking filesystem/CPU work off async runtime threads, but do not split
+  one small operation into many `spawn_blocking` round trips; coalesce `open`,
+  `read`/`write`, `fsync`, and `close` into one blocking closure per disk. When
+  coalescing steps across execution lanes, route the combined closure to the
+  dedicated fsync lane whenever any step performs file or directory sync so
+  stalled syncs cannot starve foreground metadata reads.
+- Check for per-disk syscall amplification (`disks × parts/files`): pin a
+  directory once (`openat2` on Linux) and reuse the handle across sibling reads
+  or same-directory renames instead of re-walking ancestor components per file
+  or re-opening the same parent directory twice.
+- When the file size is already known from `fstat` metadata, pre-size the
+  destination buffer (`len + 1`) before reading to EOF so small metadata reads
+  complete in a single `read()` + EOF check rather than exponential-growth
+  reallocations and syscalls.
+- Avoid redundant disk re-reads or existence checks under the same exclusive
+  lock when the state or raw bytes were just loaded or persisted.
+- Measure lock hold time across I/O and compare acquisition order for ABBA.
+- Keep cleanup, extra stat/rename, and diagnostics out of the PUT commit critical
+  section when they need not be there.
+- Detect per-item serial I/O/RPC in batch APIs and accidental quadratic scans;
+  use a gate or bounded concurrency when the concrete fan-out warrants it.
+- Count buffer growth and byte copies in EC/bitrot paths; preserve pool gauge
+  balance and avoid repeated metadata decode/fetch per object.
+- Repetitive success logs stay at `trace`; metrics/instrumentation on hot paths
+  require an existing gate.
+- Claims of no impact on PUT/GET/commit/erasure paths need relevant benchmark or
+  A/B evidence, especially for 4 KiB objects.

.agents/skills/adversarial-validation/references/security.md

@@ -0,0 +1,31 @@
+# Security Lens
+
+Use `security-advisory-lessons` only for a dedicated advisory/security audit.
+For an ordinary matched diff, attack these boundaries:
+
+- Admin routes: route registration, whitelist, handler authn, and the exact
+  `AdminAction` must agree. Read-only diagnostics still require admin authz.
+- IAM/service accounts: treat parent, claims, keys, groups, status, and policy
+  names as attacker-controlled; prove ownership/root authority before writes.
+- Protocol frontends: every changed/sibling command authorizes the matching S3
+  action before reaching storage.
+- Secrets/signatures: use constant-time comparison, normalize public failures,
+  keep RPC/root/STS keys independent, and fail closed when secrets are absent.
+- RPC: bind signatures to the exact method/path and timestamp; reject replay,
+  stale, malformed, truncated, and invalid-enum payloads without panic.
+- Paths/object/archive entries: reject traversal, absolute/platform escapes,
+  and normalization differences between authz and storage.
+- Copy/multipart/presigned POST: enforce source, destination, version-aware
+  actions, copy-source conditions, and every signed policy condition.
+- Logging/errors: never expose credentials, tokens, expected signatures, raw
+  secret-bearing input, or merged configs—including via `Debug` and parse errors.
+- Untrusted serde: reject unknown fields where compatible and validate
+  security-critical defaults/ranges before numeric conversion.
+- SSE/browser/CORS/trusted proxy: inspect stored ciphertext and wrapper order;
+  isolate user content; never reflect credentialed arbitrary origins or trust
+  forwarded identity from direct clients.
+- Object Lock: unreadable/fabricated/unparsable metadata fails closed across
+  foreground, lifecycle, scanner, and force-delete paths.
+
+Security findings distinguish unauthenticated compromise from a
+low-privileged authenticated bypass.

.agents/skills/adversarial-validation/references/simplicity.md

@@ -0,0 +1,22 @@
+# Simplicity Lens
+
+- Compare the production diff with the smallest equivalent local edit. Fewer
+  lines alone are not evidence; the replacement must preserve correctness,
+  compatibility, readability, and real boundaries.
+- Search the touched crate, domain owner, `crates/utils`, `crates/common`, and
+  relevant dependencies for each new helper, constant, wrapper, or fixture.
+- Reject forced reuse when normalization, error, deadline, or durability
+  semantics differ.
+- Require a concrete trigger for every new defensive branch. Keep boundary
+  checks for disk/RPC/version data and checks immediately before destructive
+  actions.
+- Flag one-caller helpers only when they merely forward or split a short linear
+  flow without adding domain naming, invariant isolation, or useful context.
+- Ensure a replacement removes the superseded in-scope path or keeps one
+  canonical core behind a documented compatibility adapter.
+- Remove narration/change-history comments; preserve concise safety, lock,
+  durability, and compatibility invariants.
+- Treat tests, fixtures, generated code, and documentation separately from
+  production growth. Do not optimize away meaningful regression coverage.
+
+A finding must include a concrete smaller design, not a style preference.

.agents/skills/adversarial-validation/references/test-coverage.md

@@ -0,0 +1,26 @@
+# Test-Coverage Lens
+
+- For every behavior claim, name the focused test/check that fails if the
+  changed hunk is reverted. If none is practical, require the reason and
+  residual risk.
+- Confirm tests exercise the real production path and distinguish the intended
+  behavior from the named regression. A success, `is_err()`, or no-panic check
+  can be sufficient when that is the actual contract; require exact values,
+  bytes, state, or error variants when those distinctions matter to the change.
+- For new flags/modes, verify each branch and ask which test fails if the branch
+  is inverted.
+- For new error propagation, inject the failure and assert the caller observes
+  it; mentally replacing `?`/`return Err` with success must break a test.
+- Streaming GET tests assert the complete body and length under degraded reads.
+- Disk/wire-format tests use pinned foreign/legacy fixtures; same-code
+  round-trips are insufficient for compatibility.
+- Concurrency tests use readiness polling, isolate global state, and avoid fixed
+  sleeps or unrealistically short timeouts. Use nextest groups when process-level
+  serialization is required.
+- Internal metadata tests assert both RustFS and MinIO keys, not only read-back
+  through a helper that prefers one key.
+- Avoid duplicate tests of the same production path and poison-value class.
+  Boundary companions are distinct coverage: `n == max` vs `max + 1`, and
+  absent vs empty vs nil UUID.
+- A focused test proves only the targets/features it builds. Add compilation or
+  Clippy only for uncovered changed targets.

.agents/skills/pr-review/SKILL.md

@@ -13,7 +13,7 @@ description: Review a GitHub PR using its exact base/head and repository risk po
    ```
 
    Record both SHAs; refresh if either moved during fetching. Follow relevant [implementation boundaries](../../references/implementation.md).
-2. Apply the [risk policy](../../references/adversarial-validation.md). Ordinary reviews use the root finding standard directly. File count does not authorize delegation; use exactly two independent reviewers only when authorized, otherwise two fresh sequential passes for that risk tier. Reviewers do not spawn further agents.
+2. Apply the [risk policy](../../references/adversarial-validation.md). Ordinary reviews use the root finding standard directly. For explicit adversarial, substantial, or high-risk reviews, use [the domain probes](../adversarial-validation/SKILL.md). File count does not authorize delegation; use exactly two independent reviewers only when authorized, otherwise two fresh sequential passes for that risk tier. Reviewers do not spawn further agents.
 3. Check `gh pr checks <N> --repo <owner/repo>`. Investigate failures when relevant to a finding or a requested CI/readiness diagnosis. Distinguish pending, unavailable, pre-existing, flaky, and PR-caused states using evidence; a code review does not authorize unrelated repairs.
 4. Report the reviewed SHAs, risk tier, supported findings or `No findings`, material verification limits, check state, and verdict. P0/P1 findings block approval. Severity: P0 = demonstrated data loss, security breach, remote crash, or deadlock; P1 = correctness, compatibility, or material hot-path regression; P2 = a concrete maintainability defect; P3 = optional style, only when requested.
 5. When posting is authorized, follow [Git and PR rules](../../references/pull-requests.md), recheck the remote head, and review any delta before submitting. Use `gh pr review` with `--approve`, `--request-changes`, or `--comment` and `--body-file`; use [the API example](references/posting.md) for authorized inline comments. Reuse existing authorization.

.agents/skills/security-advisory-lessons/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: security-advisory-lessons
+description: Perform a dedicated RustFS security/advisory review for authn/authz, IAM, RPC trust, paths, secrets, browser isolation, encryption, Object Lock, or other security boundaries. Use only when the user requests a security/advisory review or an adversarial review explicitly escalates to the full advisory map; do not auto-load solely because code touches a sensitive path.
+---
+
+# RustFS Security Advisory Lessons
+
+Use this skill as the deep security lens. For a normal adversarial review with a
+matched security surface, the concise security reference under
+`adversarial-validation` is sufficient.
+
+## Workflow
+
+1. Freeze the exact diff/head and identify the changed trust boundaries.
+2. Inspect the headings in [advisory-patterns.md](references/advisory-patterns.md),
+   then read the matching sections. Read the full map only for a broad security
+   audit. Useful headings are
+   auth/admin, IAM/STS/OIDC, policy/plugins, S3/copy/multipart, protocols, paths,
+   secrets/logging/RPC, browser/CORS/proxy, SSE, Object Lock, and serde.
+3. Trace unauthenticated, low-privilege, wrong-action/owner/bucket, malformed,
+   and default-config cases. Security decisions must fail closed.
+4. Require a focused negative regression test for the bypass/exploit form, not
+   only the intended success path. State residual risk when a test is impractical.
+5. Report proven vulnerabilities separately from defense-in-depth hardening.
+
+When advisory currentness matters, fetch the live inventory instead of treating
+the reference as a status mirror:
+
+```bash
+gh api repos/rustfs/rustfs/security-advisories --paginate \
+  --jq '.[] | {ghsa_id,state,severity,summary,updated_at}'
+```
+
+Fetch an individual advisory only when the live summary indicates a new or
+changed lesson.
+
+## Finding Standard
+
+Every candidate names the lower-trust principal, the boundary it crosses, the
+affected resource, and the observable result. A best-practice gap or an impact
+confined to the caller's own principal is hardening, not a candidate.
+
+Report each candidate under exactly one verdict:
+
+- `confirmed`: a complete `file:line` source trace and a bounded observed
+  result. Only confirmed findings carry severity; each also states attacker
+  prerequisites, concrete input/path, impact, smallest safe fix, and a
+  regression check.
+- `needs_validation`: the trace is blocked on one exact unresolved fact, such
+  as deployment or infrastructure behavior. State that fact; assign no severity
+  and do not substitute an assumption.
+- `rejected`: a disproved candidate, with the caller, invariant, or test that
+  disproves it.
+
+Do not exaggerate unauthenticated impact when the actual issue requires
+authenticated low privilege.

.agents/skills/security-advisory-lessons/references/advisory-patterns.md

@@ -0,0 +1,158 @@
+# RustFS Advisory Pattern Map
+
+This file is a lesson map, not an advisory inventory mirror. It keeps durable security patterns distilled from RustFS GitHub Security Advisories.
+
+When current advisory state, severity, URLs, or full text matters, fetch it live:
+
+```bash
+gh api repos/rustfs/rustfs/security-advisories --paginate \
+  --jq '.[] | {ghsa_id,state,severity,summary,updated_at}'
+gh api repos/rustfs/rustfs/security-advisories/<GHSA_ID>
+```
+
+Update this file only when an advisory adds or changes a reusable lesson, affected surface, validation pattern, or regression-test expectation. Do not update it for state-only, URL-only, count-only, or timestamp-only changes.
+
+## Pattern Index
+
+### Admin authorization and route exposure
+
+- `GHSA-pfcq-4gjr-6gjm`: notification target endpoints accepted authenticated users but skipped admin authorization. Lesson: distinguish authn from authz; admin target CRUD must call the operation-specific admin authorization path.
+- `GHSA-mm2q-qcmx-gw4w`: `ListServiceAccount` used `UpdateServiceAccountAdminAction`, while update lacked target ownership checks. Lesson: exact action constants and ownership checks are both required; information disclosure can chain into secret rotation and takeover.
+- `GHSA-vcwh-pff9-64cc`: `ImportIam` checked `ExportIAMAction` for an import/write operation. Lesson: every admin handler must authorize the action it actually performs.
+- `GHSA-jqmc-mg33-v45g` and `GHSA-8784-9m7f-c6p6`: `/profile/cpu` and `/profile/memory` were whitelisted from auth and allowed expensive diagnostics plus path disclosure. Lesson: profiling/debug endpoints need admin auth, opt-in, rate limits, and non-sensitive responses.
+- `GHSA-f5cv-v44x-2xgf`: `/rustfs/admin/v3/metrics` accepted any authenticated IAM user and skipped admin authorization. Lesson: read-only metrics and diagnostic admin endpoints still require an operation-specific admin action check.
+- `GHSA-796f-j7xp-hwf4`: `/rustfs/admin/v3/list-remote-targets` checked only that credentials existed and leaked replication target credentials. Lesson: replication target reads are privileged admin operations, and stored remote credentials require strict authz plus response redaction review.
+- `GHSA-xp32-gxq2-3v52`: console license metadata endpoint was public and exposed subject and expiration fields. Lesson: management metadata endpoints should require admin auth or return only coarse public status.
+
+### IAM import, service accounts, and privilege boundaries
+
+- `GHSA-566f-q62r-wcr8`: `ImportIam` accepted attacker-controlled service account `parent`, `claims`, `accessKey`, and `secretKey`, enabling persistent backdoor accounts under root. Lesson: imported IAM payloads are untrusted data and must be validated against privilege boundaries.
+- `GHSA-3495-h8r9-gfqg`: `ExportIAM` wrote regular-user and service-account secret keys into exported ZIP data. Lesson: IAM export is a credential-disclosure boundary; redact, seal, or strictly justify every exported secret before treating export permission as safe.
+- `GHSA-5354-r3w2-34m8`: `AddServiceAccount` checked `CreateServiceAccountAdminAction` but trusted caller-supplied `target_user`, allowing service accounts under the root parent. Lesson: service-account create paths must validate parent ownership or root/admin authority, not only the create action.
+- `GHSA-xgr5-qc6w-vcg9`: `deny_only=true` skipped allow checks and let restricted service accounts mint unrestricted children. Lesson: deny-only logic must never become implicit allow for privilege creation.
+- `GHSA-mm2q-qcmx-gw4w`: leaked service account access keys plus update-without-ownership formed an escalation chain. Lesson: service-account identifiers are security-sensitive because update APIs consume them.
+
+### STS, OIDC, and federation flows
+
+- `GHSA-5qfg-mf7r-jp3w` and `GHSA-3473-5353-xhwh`: `AssumeRoleWithWebIdentity` was reachable through unauthenticated `POST /` routing and could issue temporary credentials from crafted web identity input. Lesson: every STS route needs explicit SigV4 or trusted identity-provider validation before role assumption, and unauthenticated exemptions must be narrowed to the exact action with uniform failure responses.
+- `GHSA-jxrr-r6pv-h958`: unsigned JWT issuer data was decoded before verification to select an OIDC provider, and distinguishable failures could expose provider configuration. Lesson: web-identity routing may be unauthenticated, but pre-verification claims are untrusted routing hints; bound and rate-limit the request, normalize public errors, and verify signature, issuer, audience, and expiration before issuing credentials.
+- `GHSA-ccrv-v8v9-ch9q`, `GHSA-48rf-7j3q-3hfv`, and `GHSA-xvfh-7c9g-hpw2`: service-account-controlled material could self-sign JWT session tokens with forged policy claims, and missing `exp` was accepted for service-account tokens. Lesson: session tokens must be signed by a trusted issuer/key path, enforce required claims and expiration, and reject self-signed or principal-controlled tokens.
+- `GHSA-9pjf-w3c2-m32r`, `GHSA-4x2q-cpx9-9h26`, and `GHSA-xvpm-p3f7-34c3`: public OIDC authorize/callback flows trusted request `Host` or forwarded scheme when building credential-bearing redirects. Lesson: OIDC redirects must use configured allowlisted origins and trusted-proxy handling; never derive the post-login credential destination from direct client headers.
+- `GHSA-m479-9x88-94w6`, `GHSA-frwq-mfqx-83p8`, `GHSA-q9q8-rf9r-fg9f`, and `GHSA-j5c2-hhf7-6gf5`: OIDC validation accepted attacker-controlled discovery URLs because hostname checks rejected only literal forbidden IPs, allowing DNS rebinding SSRF. Lesson: outbound federation URL validation must resolve and classify hostnames at the connection boundary and reject loopback, private, link-local, and rebound addresses.
+
+### IAM policy conditions and external policy plugins
+
+- `GHSA-6r96-hmgc-726c`: request headers collided with lowercase server-derived condition keys such as `userid`, `groups`, `versionid`, and JWT/LDAP claims. Lesson: never let caller-controlled headers append to or replace server-derived policy context; reserve trusted condition keys and keep intentional request-header keys separate.
+- `GHSA-v9cp-qfw9-9pfp`: quantified negated string conditions applied negation after aggregation, transposing `ForAllValues` and `ForAnyValue` semantics. Lesson: push negation into the per-value predicate for quantified operators and test partially overlapping multi-value sets.
+- `GHSA-5w8r-p896-6vq2`: OPA policy mode skipped `ExistingObjectTag/*` loading, so tagged objects looked untagged to external policies. Lesson: external authorization plugins need the same object-tag and request context as built-in policy evaluation before they decide.
+- `GHSA-9wgh-5r68-49p7`: substituted policy-variable values could recreate `${...}` and loop inside a single resolution pass, never reaching the outer iteration limit. Lesson: bound substitutions within each pass and test cycles formed across otherwise literal resolver values; confirm whether attacker-controlled claims can reach those values before assigning remote impact.
+
+### S3 object actions, copy, multipart, and upload policy validation
+
+- `GHSA-g8w9-qw9q-fghr` and `GHSA-xm99-m3gq-83g8`: a valid presigned `PutObject` accepted extra `x-amz-*` headers omitted from `SignedHeaders`; `x-amz-copy-source` could turn that upload capability into a cross-bucket read performed as the signer. Lesson: a presigned URL is a bounded capability; inspect all received security-sensitive headers and reject unsigned ones before selecting the S3 operation or reaching storage.
+- `GHSA-3ppv-fx5m-m749`: explicit `versionId` reads and copy sources authorized `s3:GetObject` instead of `s3:GetObjectVersion`. Lesson: version-specific object access must select version-specific actions for direct reads, `CopyObject`, and `UploadPartCopy`, with tests proving the backend is not reached on denial.
+- `GHSA-cg33-pxfp-qcj3` and `GHSA-65wq-gjw8-xr9w`: `HeadObject` and object-tagging paths authorized current-object actions while operating on an explicit historical `versionId`. Lesson: select the corresponding version action for metadata and tag reads and writes too; audit every operation that accepts a version ID.
+- `GHSA-gjph-xcgw-4p7w`: `PutObject` and browser POST accepted a caller-supplied `versionId` and replaced an unlocked historical version with only `s3:PutObject`. Lesson: only replication-authorized writes may choose an existing version ID; ordinary uploads must not rewrite version history.
+- `GHSA-x298-9x87-fvjq`: anonymous `ListObjectVersions` fell back to `ListBucket` and returned before public-access-block gates. Lesson: compatibility fallbacks must converge on the same post-authorization checks as direct grants, especially `RestrictPublicBuckets` and anonymous data-plane denies.
+- `GHSA-mx42-j6wv-px98`: `UploadPartCopy` missed source authorization and allowed cross-bucket object exfiltration. Lesson: multipart copy must enforce the same source and destination contract as `CopyObject`.
+- `GHSA-wfxj-ph3v-7mjf`: `UploadPartCopy` checked source and destination independently but missed destination copy-source policy constraints. Lesson: source read and destination write checks are not sufficient when policy constrains allowed copy sources.
+- `GHSA-w5fh-f8xh-5x3p`: presigned POST accepted uploads without enforcing signed policy conditions. Lesson: parse and enforce all POST policy constraints server-side, including size, key prefix, and content type.
+
+### Protocol frontends and IAM parity
+
+- `GHSA-3g29-xff2-92vp`: FTP `RETR` and `SIZE`/`MDTM` read paths authenticated the user but skipped IAM before calling storage. Lesson: non-HTTP protocol frontends must enforce the same per-operation authorization as the S3 API before backend access.
+- `GHSA-g3vq-vv42-f647`: FTPS `MKD` called `create_bucket` without checking `s3:CreateBucket`. Lesson: protocol command handlers need action-specific checks even when sibling handlers already authorize correctly.
+- `GHSA-3p3x-734c-h5vx`: FTPS and WebDAV compared secret keys with early-return string equality, while FTPS also returned distinguishable invalid-user and invalid-password failures. Lesson: password-style protocol auth needs constant-time secret comparison, indistinguishable failures where practical, and rate limiting.
+- `GHSA-rhg6-jrf2-29c4`: WebDAV, FTP/FTPS, and SFTP used identity-policy checks with empty conditions and bypassed S3 bucket-policy explicit denies and condition-key denies. Lesson: alternate listeners must evaluate the same effective policy and trustworthy request context before storage access.
+
+### Filesystem paths and object key traversal
+
+- `GHSA-pq29-69jg-9mxc`: RPC `read_file_stream` joined untrusted paths under a volume directory without canonical boundary checks. Lesson: `PathBuf::join` plus length checks are not path security.
+- `GHSA-8r6f-hmq2-28rg`: object keys containing traversal sequences bypassed bucket/object authorization when mapped to filesystem paths. Lesson: reject traversal at object-key parsing and verify final storage paths remain under the expected bucket/key root.
+- `GHSA-f4vq-9ffr-m8m3`: Snowball auto-extract accepted archive entries such as `../victim-bucket/object`, authorized the raw attacker-bucket path, then storage path cleaning crossed bucket boundaries. Lesson: archive entries become object keys and need traversal rejection plus consistent authz/storage normalization before writes.
+- `GHSA-g7fq-6xjm-mxf4`: versioned `DeleteObjects` accepted dot-segment keys, authorized the literal prefix, then wrote delete markers under a resolved sibling prefix. Lesson: validate each batch key before authorization and storage normalization, using the same object-name rules as single delete.
+
+### Secrets, defaults, and cryptographic misuse
+
+- `GHSA-j59h-h7q5-q348`, `GHSA-3wm5-wpm5-hmfm`, `GHSA-6wc8-xm48-qhmx`, `GHSA-9gf3-jx4p-4xxf`, `GHSA-63xc-c3w3-m2cf`, and `GHSA-ch63-6q4v-hwp5`: RustFS shipped known default root credentials that could authenticate to S3, admin APIs, IAM, KMS, console, and token-signing surfaces. Lesson: root credentials must be operator-provided or generated per install; known defaults and warnings are not acceptable for network-reachable deployments.
+- `GHSA-h956-rh7x-ppgj`: gRPC used the hard-coded token `rustfs rpc` on both client and server. Lesson: source-visible shared tokens are authentication bypasses.
+- `GHSA-r5qv-rc46-hv8q`: internode RPC HMAC secret fell back to the public default `rustfsadmin`. Lesson: RPC/internode auth must fail closed instead of silently using public defaults.
+- `GHSA-75fx-qg6f-8rm7` and `GHSA-68cw-96m3-h2cf`: internode RPC secrets were derivable from known root credentials, making raw storage RPC signatures forgeable when explicit RPC secrets were unset. Lesson: RPC auth keys must be independent random secrets, never derived from S3 root credentials, and raw storage RPC should not share the public S3 listener without an internode-only boundary.
+- `GHSA-m77q-r63m-pj89`: STS JWTs used the root secret key as the shared token signing key, allowing token forgery when the root secret was known. Lesson: STS signing keys need key separation, rotation, and key IDs; do not reuse root credentials for JWT/HMAC signing.
+- `GHSA-923g-jp7v-f97f`: license verification embedded a production RSA private key and used private-key decryption as authenticity. Lesson: ship verifying/public keys only and use real signature verification.
+
+### Sensitive logging and debug output
+
+- `GHSA-r54g-49rx-98cr`: STS credentials were logged at info level. Lesson: generated credentials must never be logged in plaintext.
+- `GHSA-8cm2-h255-v749`: debug logs leaked session tokens, secret keys, JWT claims, and raw STS response bodies. Lesson: redaction must cover custom `Debug` implementations and dependency response-body logging.
+- `GHSA-333v-68xh-8mmq`: invalid RPC signature logging included the shared HMAC secret and expected signature. Lesson: error paths often leak secrets; never log raw secrets or derived authenticators.
+
+### RPC input validation and panic safety
+
+- `GHSA-gw2x-q739-qhcr`: malformed gRPC `GetMetrics` payloads reached `unwrap()` on deserialization and caused remote DoS. Lesson: every network/RPC deserialization failure returns an error, not a panic.
+- `GHSA-h956-rh7x-ppgj` and `GHSA-r5qv-rc46-hv8q`: weak RPC auth increased reachability of otherwise internal handlers. Lesson: panic bugs become more severe when internode auth is weak or defaulted.
+- `GHSA-c667-rgrv-99vj`: NodeService authentication signed the service prefix instead of the concrete generated method path, so valid metadata for one RPC could be replayed to another method during the timestamp window. Lesson: RPC HMAC payloads must bind exact gRPC method path, HTTP method surrogate, timestamp, and secret.
+
+### Browser, CORS, and console isolation
+
+- `GHSA-v9fg-3cr2-277j`: object preview rendered attacker-controlled HTML in a same-origin iframe, exposing console credentials stored in `localStorage`. Lesson: user content must be origin-isolated from the console and protected with `nosniff`, CSP, and strict content-type handling.
+- `GHSA-7gcx-wg4x-q9x6`: an incomplete preview fix reintroduced extension-based PDF detection and bypassed the sandboxed fallback for attacker-controlled content. Lesson: browser-surface fixes need regression tests for alternate viewers and file-type branches, and preview trust must come from validated content type plus sandboxing rather than object names.
+- `GHSA-x5xv-223c-8vm7`: default CORS reflected arbitrary origins with credentials. Lesson: never combine reflected origins with `Access-Control-Allow-Credentials: true`; default should be fail-closed.
+
+### Trusted proxy and source IP conditions
+
+- `GHSA-fc6g-2gcp-2qrq`: `aws:SourceIp` trusted client-supplied `X-Forwarded-For` or `X-Real-IP`. Lesson: forwarded IP headers are valid only behind configured trusted proxies; direct clients use socket peer IP.
+
+### SSE and on-disk storage invariants
+
+- `GHSA-xrrf-67jm-3c2r`: SSE metadata reported encryption while reader composition bypassed `EncryptReader` and stored plaintext. Lesson: test actual bytes on disk and wrapper order, not only API metadata.
+- `GHSA-wqmc-vjgv-jrpw`: SSE-C persisted and listed the plaintext MD5 as the ETag, allowing list-only users to confirm or brute-force low-entropy content and correlate equal plaintext across keys. Lesson: encrypted-object ETags must not expose deterministic plaintext fingerprints; protect them with per-object key material and keep listing, conditional, copy, and multipart semantics consistent.
+
+### Object Lock and retention invariants
+
+- `GHSA-j548-9grx-fh4f`: Object Lock enforcement treated unreadable, fabricated, or unparsable bucket metadata as absent configuration and allowed retained objects to be deleted or expired. Lesson: retention must fail closed unless Object Lock absence is authoritative, and every delete, lifecycle, scanner, force-delete, and default-retention path needs the same state distinction.
+- `GHSA-28w4-rp2p-636w` and `GHSA-c7hx-vr97-45rg`: an authorized `DeleteBucket` with `x-rustfs-force-delete: true` removed active COMPLIANCE-retained versions even though ordinary version deletion was denied. Lesson: bucket force-delete must enforce retention across every version, including against root/owner callers.
+- `GHSA-q23w-fp7p-472v`: `PutObjectRetention` policy conditions read `x-amz-object-lock-*` headers while the handler applied mode and date from the XML body. Lesson: authorize the parsed retention that will be stored, or reject mismatched header/body values; compare retention dates as instants so offsets cannot change the applied bound.
+
+### Serde deserialization and input validation
+
+- Reject unknown fields in untrusted S3 API XML/JSON, lifecycle, policy, and replication input where compatibility permits. Check the current type and supported payload fixtures; do not infer the repository's current coverage from an older audit. Where extra fields are part of the compatibility contract, validate security-critical values explicitly.
+- `#[serde(default)]` on security-critical fields silently accepts missing values as zero/empty. Lesson: when a field has security implications (retention days, permissions, limits), validate the deserialized value explicitly rather than relying on defaults.
+- Integer fields deserialized from user input and cast with `as` (e.g., `i32 as u32`) can wrap negative values to large positives. Lesson: validate ranges before casting; use `try_into()` with a typed error, or clamp only when the domain explicitly requires saturation.
+- XML config typos (e.g., `"NoncurentDays"` instead of `"NoncurrentDays"`) are silently accepted when `deny_unknown_fields` is absent. Lesson: strict deserialization prevents silent misconfiguration that could cause data loss or unexpected retention behavior.
+
+## Useful Search Seeds
+
+Use these targeted searches when a diff touches security-sensitive code:
+
+```bash
+rg -n "validate_admin_request|check_permissions|AdminAction::|deny_only|is_allowed" rustfs crates
+rg -n "authorize_operation|FtpsDriver|SftpDriver|RETR|MKD|SIZE|MDTM|CreateBucket|GetObject|HeadObject" crates/protocols rustfs
+rg -n "UploadPartCopy|upload_part_copy|CompleteMultipart|PostObject|presign|SignedHeaders|x-amz-copy-source|collect_signed_headers|content-length-range|starts-with" rustfs crates
+rg -n "ListBucketVersions|GetObjectVersion|versionId|VersionId|ExistingObjectTag|ForAllValues|ForAnyValue|POLICY_PLUGIN|opa" rustfs crates
+rg -n "normalize_extract_entry_key|Snowball|auto-extract|PathBuf::join|canonicalize|\\.\\.|x-forwarded-for|x-real-ip|SourceIp" rustfs crates
+rg -n "DEFAULT_SECRET|DEFAULT_ACCESS|TEST_PRIVATE_KEY|rustfs rpc|RUSTFS_RPC_SECRET" rustfs crates
+rg -n "TONIC_RPC_PREFIX|verify_rpc_signature|check_auth|NodeServiceServer|x-rustfs-signature" rustfs crates
+rg -n "debug!|trace!|info!|error!|\\?resp|\\?merged_config|session_token|secret_key" rustfs crates
+rg -n "HashReader|EncryptReader|try_resolve_etag|ETag|SSE|server-side encryption|Access-Control-Allow-Credentials|Origin" rustfs crates
+rg -n "ObjectLock|object_lock|retention|COMPLIANCE|GOVERNANCE|delete_prefix|lifecycle|scanner" rustfs crates
+rg -n "deny_unknown_fields|serde.default|as u32|as usize|as i32" rustfs crates
+```
+
+## Minimum Regression Test Expectations
+
+- Authz fixes: include unauthenticated, valid low-privilege, wrong-action, correct-action, owner, non-owner, and root/admin cases as applicable.
+- Protocol frontend authz fixes: include denied `RETR`, `SIZE`/`MDTM`, `MKD`, bucket probe, and sibling allowed-operation cases; test bucket-policy explicit denies and condition-key denies on each enabled listener against an S3 control, and assert denied paths do not reach storage.
+- IAM fixes: include import/update/list service-account cases with attacker-controlled parent, claims, access key, secret key, and policy.
+- Copy/upload fixes: include cross-bucket, cross-user, source-denied, destination-denied, copy-source-condition, and multipart completion cases.
+- Presigned upload fixes: include a valid presign with extra unsigned tagging, redirect, storage-class, and cross-bucket copy-source headers; require rejection before source or destination storage access, and verify explicitly signed equivalents still work.
+- Version-action fixes: include historical UUID, explicit current version, `null`, range, partNumber, presigned, STS/session, service-account, anonymous bucket-policy, copy source, multipart-copy source, `HeadObject`, and tag read/write cases.
+- Version-write fixes: a `PutObject`-only principal must not replace an existing version through `PutObject` or browser POST `?versionId=`; verify replication-authorized writes and versioned, suspended, and unversioned buckets separately.
+- Policy-condition fixes: include reserved-key header collisions, missing keys, partially overlapping multi-value sets, cyclic variable substitutions, plugin mode, and built-in policy mode.
+- Path fixes: include encoded traversal, absolute path, nested traversal, archive entries with `..`, valid object keys that resemble traversal text but should be rejected, and canonical bucket/prefix boundary checks; test per-key `DeleteObjects` errors and prefix-scoped denials on versioned buckets.
+- Logging fixes: assert redacted output for structs and response bodies that may contain credentials.
+- IAM export fixes: assert exported archives omit plaintext user and service-account secrets unless the format deliberately encrypts or seals them.
+- RPC auth fixes: include captured metadata replay across two concrete methods, stale timestamps, wrong path, wrong method surrogate, wrong secret, and valid same-method calls.
+- Browser/CORS fixes: assert no credentials on reflected/default origins, correct behavior for explicit allowlists, and no same-origin script execution for previewed object content.
+- SSE fixes: inspect stored bytes and verify API metadata, read-back behavior, and on-disk ciphertext together; for ETags, upload equal plaintext under different keys and assert list-only callers cannot derive or correlate the plaintext digest, including multipart objects.
+- Object Lock fixes: include unreadable metadata, fabricated metadata defaults, unparsable config, confirmed absent config, COMPLIANCE/GOVERNANCE retention, lifecycle expiry, scanner sweeps, and force-delete paths; an authorized force-delete must preserve active COMPLIANCE versions. For `PutObjectRetention`, test conflicting header/body values and offset dates against policy bounds and read-back retention.

.config/nextest.toml

@@ -128,7 +128,7 @@ setup = 'ecstore-large-stack'
 # path on a real store; measured with RUST_MIN_STACK on 2026-10-15 they need
 # 2016-2040 KiB of the 2 MiB libtest default and overflowed on Linux CI.
 [[profile.default.scripts]]
-filter = '(package(rustfs) & test(/^(admin::handlers::replication::target_repair_tests::[a-z_]+|admin::handlers::plugin_attempt::v2_tests::delegation_v2_persists_and_vends_with_real_parent_intersection|admin::handlers::site_replication::tests::durable_iam_state_apply_iam_item_rejects_a_stale_recreate_after_a_replicated_delete|admin::service::federated_identity::tests::(binding_keeps_explicit_iam_mapping_strict|markerless_legacy_oidc_session_crosses_auth_and_iam_deletion_boundaries)|storage::scanner_dirty_journal::tests::(clear_callback_keeps_unknown_coverage_until_all_pending_work_is_confirmed|owned_journals_keep_peer_records_after_interleaved_writes_and_clear))$/)) | (package(rustfs-heal) & ((binary(heal_b5_versioned_regression_test) & test(/^serial_tests::(test_heal_unversioned_bucket_e2e|test_historical_null_recursive_heal_restores_physical_versions|test_recursive_deep_heal_reports_stale_delete_marker_repair)$/)) | (binary(usage_observation_read_repair_test) & test(=usage_observation_read_repair_survives_snapshot_cleanup)))) | (package(rustfs-test-utils) & test(=data_usage_snapshot_tests::data_usage_snapshot_recovery_wires_primary_backup_and_negative_cache))'
+filter = '(package(rustfs) & test(/^(admin::handlers::replication::target_repair_tests::[a-z_]+|admin::handlers::site_replication::tests::durable_iam_state_apply_iam_item_rejects_a_stale_recreate_after_a_replicated_delete|admin::service::federated_identity::tests::(binding_keeps_explicit_iam_mapping_strict|markerless_legacy_oidc_session_crosses_auth_and_iam_deletion_boundaries)|storage::scanner_dirty_journal::tests::(clear_callback_keeps_unknown_coverage_until_all_pending_work_is_confirmed|owned_journals_keep_peer_records_after_interleaved_writes_and_clear))$/)) | (package(rustfs-heal) & ((binary(heal_b5_versioned_regression_test) & test(/^serial_tests::(test_heal_unversioned_bucket_e2e|test_historical_null_recursive_heal_restores_physical_versions|test_recursive_deep_heal_reports_stale_delete_marker_repair)$/)) | (binary(usage_observation_read_repair_test) & test(=usage_observation_read_repair_survives_snapshot_cleanup)))) | (package(rustfs-test-utils) & test(=data_usage_snapshot_tests::data_usage_snapshot_recovery_wires_primary_backup_and_negative_cache))'
 setup = 'ecstore-base-stack'
 
 [[profile.default.scripts]]
@@ -419,7 +419,7 @@ setup = 'ecstore-large-stack'
 
 # These cross-crate real-storage fixtures need the same bounded stack as ECStore tests.
 [[profile.ci.scripts]]
-filter = '(package(rustfs) & test(/^(admin::handlers::replication::target_repair_tests::[a-z_]+|admin::handlers::plugin_attempt::v2_tests::delegation_v2_persists_and_vends_with_real_parent_intersection|admin::handlers::site_replication::tests::durable_iam_state_apply_iam_item_rejects_a_stale_recreate_after_a_replicated_delete|admin::service::federated_identity::tests::(binding_keeps_explicit_iam_mapping_strict|markerless_legacy_oidc_session_crosses_auth_and_iam_deletion_boundaries)|storage::scanner_dirty_journal::tests::(clear_callback_keeps_unknown_coverage_until_all_pending_work_is_confirmed|owned_journals_keep_peer_records_after_interleaved_writes_and_clear))$/)) | (package(rustfs-heal) & ((binary(heal_b5_versioned_regression_test) & test(/^serial_tests::(test_heal_unversioned_bucket_e2e|test_historical_null_recursive_heal_restores_physical_versions|test_recursive_deep_heal_reports_stale_delete_marker_repair)$/)) | (binary(usage_observation_read_repair_test) & test(=usage_observation_read_repair_survives_snapshot_cleanup)))) | (package(rustfs-test-utils) & test(=data_usage_snapshot_tests::data_usage_snapshot_recovery_wires_primary_backup_and_negative_cache))'
+filter = '(package(rustfs) & test(/^(admin::handlers::replication::target_repair_tests::[a-z_]+|admin::handlers::site_replication::tests::durable_iam_state_apply_iam_item_rejects_a_stale_recreate_after_a_replicated_delete|admin::service::federated_identity::tests::(binding_keeps_explicit_iam_mapping_strict|markerless_legacy_oidc_session_crosses_auth_and_iam_deletion_boundaries)|storage::scanner_dirty_journal::tests::(clear_callback_keeps_unknown_coverage_until_all_pending_work_is_confirmed|owned_journals_keep_peer_records_after_interleaved_writes_and_clear))$/)) | (package(rustfs-heal) & ((binary(heal_b5_versioned_regression_test) & test(/^serial_tests::(test_heal_unversioned_bucket_e2e|test_historical_null_recursive_heal_restores_physical_versions|test_recursive_deep_heal_reports_stale_delete_marker_repair)$/)) | (binary(usage_observation_read_repair_test) & test(=usage_observation_read_repair_survives_snapshot_cleanup)))) | (package(rustfs-test-utils) & test(=data_usage_snapshot_tests::data_usage_snapshot_recovery_wires_primary_backup_and_negative_cache))'
 setup = 'ecstore-base-stack'
 
 [[profile.ci.scripts]]

.github/workflows/README.md

@@ -16,7 +16,7 @@ Every other label in this repository is capacity RustFS pays for. ARC pods and l
 | `sm-standard-2` | RustFS | ARC pod, Ubuntu 24.04, minimal image: no `gh`, no C toolchain; Docker only on the `dind-` label | only a job that a hosted runner cannot run (see the placement rule) |
 | `sm-standard-4` | RustFS | ARC pod, Ubuntu 24.04, 14 CPUs and 28 GB (the label is not the core count), large disk | workspace-scale Cargo builds |
 | `ubicloud-standard-16-arm` | RustFS | Ubicloud VM, alias of `ubicloud-standard-16-arm-ubuntu-2404`: Ubuntu 24.04 arm64, 16 vCPU, 48 GB, 300 GB disk. Reached through the `build.yml` matrix, so `actionlint.yaml` does not list it | native aarch64 release builds (`linux-aarch64-musl`, `linux-aarch64-gnu`) |
-| `dind-sm-standard-2` | RustFS | ARC pod with Docker-in-Docker | Docker workloads with a measured resource or environment requirement beyond the hosted runner |
+| `dind-sm-standard-2` | RustFS | ARC pod with Docker-in-Docker | image builds that need `buildx` and a registry push |
 | `smoke-testing`, `pf-testing` | RustFS | long-lived lab machines | the packaged functional chain and performance suites |
 
 The self-hosted pods and the hosted image are both Ubuntu 24.04, so a binary built on one runs on the other; `ci.yml` builds the debug binary on `sm-standard-4` and runs it on both pools.
@@ -27,15 +27,11 @@ A job runs on `ubuntu-latest` unless it has one of these reasons, and the reason
 
 1. **Disk.** It restores or produces the workspace `target/`: `cargo build` or `cargo test` with `--all-targets`, `cargo nextest run --all`, or any reader of the `ci-dev` / `ci-feat-*` caches. The workspace test build leaves about 64 GB in `target/`; a hosted runner has about 14 GB.
 2. **Critical-path CPU.** It is a build that several downstream lanes wait on and would blow its timeout at 4 vCPU (`build-rustfs-debug-binary` gates the e2e and s3-tests lanes).
-3. **Hardware or environment.** Native aarch64 or access to the lab machines. Docker alone is not a reason: hosted Ubuntu ships Docker and supports the QEMU and Buildx setup actions.
+3. **Hardware.** Native aarch64, Docker-in-Docker, or the lab machines.
 4. **Cache ownership.** It reads a `rust-cache` key that a self-hosted job writes (see the cache rule below).
 
 Jobs that do only the following have no reason to be self-hosted: shell or Python scripts, `cargo fmt`, `cargo deny`, typos, actionlint, API calls (`gh`, dependency review, issue and stale bots, CLA checks), downloading an artifact and running a prebuilt binary, or a `cargo build -p rustfs` with its own cache key. `e2e-distributed.yml` and `e2e-upgrade.yml` build the server and the `e2e_test` harness on `ubuntu-latest` inside their budgets, so "it compiles something" alone is not a reason.
 
-The functional chain's `prepare` and `complete-chain` jobs, the performance runner availability check, and runner hygiene use `ubuntu-latest`: they inspect APIs or artifacts, not the lab hosts. The actual functional and performance suites remain on their lab runners. Functional-chain health collection stays on the operator-managed `smoke-testing` runner as part of the automation environment. Docker image packaging also uses `ubuntu-latest` for both musl and glibc variants; it downloads release binaries rather than compiling the workspace, and still sets up QEMU and Buildx explicitly.
-
-Moving these jobs off AKS reduces capacity demand, not necessarily the Azure bill immediately. VM costs fall only when nodes scale down or smaller capacity replaces them.
-
 A hosted runner is also the only choice for a few things the pods cannot do: `mount -o loop` and `mount -t tmpfs` fail inside the ARC pods, and a container runtime cannot guarantee that `io_uring_setup` is allowed. `uring-integration` and `e2e-distributed` are on `ubuntu-latest` for that reason, not for cost.
 
 ## Cache rule

.github/workflows/docker.yml

@@ -337,7 +337,7 @@ jobs:
     name: Build Docker Images
     needs: build-check
     if: needs.build-check.outputs.should_build == 'true'
-    runs-on: ubuntu-latest
+    runs-on: dind-sm-standard-2
     timeout-minutes: 60
     strategy:
       fail-fast: false

.github/workflows/runner-hygiene.yml

@@ -44,7 +44,7 @@ jobs:
   check-ephemerality:
     if: github.repository == 'rustfs/rustfs'
     name: Check runner ephemerality
-    runs-on: ubuntu-latest
+    runs-on: sm-standard-2
     timeout-minutes: 15
     steps:
       - name: Checkout repository

.github/workflows/rustfs-functional-chain.yml

@@ -42,7 +42,7 @@ concurrency:
 jobs:
   prepare:
     if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.event == 'schedule' }}
-    runs-on: ubuntu-latest
+    runs-on: smoke-testing
     timeout-minutes: 10
     outputs:
       manifest: ${{ steps.candidate.outputs.manifest }}
@@ -188,7 +188,7 @@ jobs:
   complete-chain:
     needs: [prepare, upgrade, s3, kms, tier, storage, heal, pool, security, replication, fault-tolerance, table, performance]
     if: ${{ always() && needs.prepare.result != 'skipped' }}
-    runs-on: ubuntu-latest
+    runs-on: smoke-testing
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7

.github/workflows/rustfs-performance-test.yml

@@ -90,7 +90,7 @@ env:
 jobs:
   runner-check:
     if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    runs-on: ubuntu-latest
+    runs-on: sm-standard-2
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7

.github/workflows/windows-filesystem.yml

@@ -1,172 +1,26 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Windows Filesystem Tests
-
+name: Multipart Lock Windows Preflight
 on:
-  push:
-    branches: [ main ]
-    paths:
-      - "crates/ecstore/src/disk/**"
-      - "crates/ecstore/src/layout/**"
-      - "crates/ecstore/src/store/init_format.rs"
-      - "crates/ecstore/src/set_disk/ops/locking.rs"
-      - "crates/ecstore/src/object_api/write_commit_context.rs"
-      - "crates/ecstore/src/bucket/utils.rs"
-      - "crates/ecstore/Cargo.toml"
-      - "crates/utils/src/dunce.rs"
-      - "crates/utils/src/os/**"
-      - "crates/utils/Cargo.toml"
-      - "crates/utils/src/path.rs"
-      - "rustfs/build.rs"
-      - "rustfs/Cargo.toml"
-      - "rustfs/src/main.rs"
-      - "rustfs/src/server/runtime.rs"
-      - "rustfs/src/startup_*.rs"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/actions/setup/**"
-      - ".github/workflows/windows-filesystem.yml"
-  pull_request:
-    branches: [ main ]
-    paths:
-      - "crates/ecstore/src/disk/**"
-      - "crates/ecstore/src/layout/**"
-      - "crates/ecstore/src/store/init_format.rs"
-      - "crates/ecstore/src/set_disk/ops/locking.rs"
-      - "crates/ecstore/src/object_api/write_commit_context.rs"
-      - "crates/ecstore/src/bucket/utils.rs"
-      - "crates/ecstore/Cargo.toml"
-      - "crates/utils/src/dunce.rs"
-      - "crates/utils/src/os/**"
-      - "crates/utils/Cargo.toml"
-      - "crates/utils/src/path.rs"
-      - "rustfs/build.rs"
-      - "rustfs/Cargo.toml"
-      - "rustfs/src/main.rs"
-      - "rustfs/src/server/runtime.rs"
-      - "rustfs/src/startup_*.rs"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/actions/setup/**"
-      - ".github/workflows/windows-filesystem.yml"
   workflow_dispatch:
-
 permissions:
   contents: read
-
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
+  group: multipart-lock-windows-${{ github.ref }}
+  cancel-in-progress: false
 env:
-  CARGO_TERM_COLOR: always
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  CARGO_TERM_COLOR: never
   RUST_BACKTRACE: 1
-
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+  NO_PROXY: 127.0.0.1,localhost
 jobs:
-  rename-safety:
-    name: Rename Safety
-    runs-on: windows-latest
-    timeout-minutes: 60
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: stable
-          cache-shared-key: build-x86_64-pc-windows-msvc
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
-          install-test-tools: 'false'
-
-      - name: Check production Windows dependencies
-        shell: pwsh
-        run: cargo check -p rustfs-ecstore --lib
-
-      - name: Test guarded rename publication
-        shell: pwsh
-        run: cargo test -p rustfs-ecstore --lib rename_all_ -- --nocapture
-
-      - name: Test multipart parent durability barriers
-        shell: pwsh
-        run: cargo test -p rustfs-ecstore --lib multipart_owned_record_parent_barriers_ -- --nocapture
-
-      - name: Test Windows path conversion
-        shell: pwsh
-        run: "cargo test -p rustfs-utils --no-default-features --features path --lib dunce:: -- --nocapture"
-
-      - name: Test Windows volume and disk-space probes
-        shell: pwsh
-        run: |
-          # Map a drive letter to the temp drive's administrative share so the
-          # remote-volume probe also covers mapped network drives.
-          $drive = (Split-Path -Qualifier ([System.IO.Path]::GetTempPath())).TrimEnd(':')
-          net use R: "\\localhost\$drive`$" /persistent:no
-          if ($LASTEXITCODE -eq 0) {
-            $env:RUSTFS_TEST_WINDOWS_MAPPED_DRIVE = 'R:'
-          } else {
-            Write-Output "::warning::could not map R: to \\localhost\$drive`$; mapped-drive test will skip"
-          }
-          cargo test -p rustfs-utils --features os --lib os:: -- --nocapture
-          $status = $LASTEXITCODE
-          if ($env:RUSTFS_TEST_WINDOWS_MAPPED_DRIVE) { net use R: /delete /y | Out-Null }
-          exit $status
-
-      - name: Test Windows handle guards
-        shell: pwsh
-        run: cargo test -p rustfs-ecstore --lib windows_ -- --nocapture
-
-      - name: Test endpoint path parsing
-        shell: pwsh
-        run: "cargo test -p rustfs-ecstore --lib layout::endpoint:: -- --nocapture"
-
-      - name: Test startup temporary-directory cleanup
-        shell: pwsh
-        run: cargo test -p rustfs-ecstore --lib cleanup_tmp_on_startup_ -- --nocapture
-
-      - name: Test object key Windows admission
-        shell: pwsh
-        run: "cargo test -p rustfs-ecstore --lib bucket::utils:: -- --nocapture"
-
-      - name: Test Windows file-name rules
-        shell: pwsh
-        run: "cargo test -p rustfs-utils --no-default-features --features path --lib dunce:: -- --nocapture"
-
-      - name: Test fresh format publication
-        shell: pwsh
-        run: cargo test -p rustfs-ecstore --lib fresh_format_load_initializes_all_disks -- --nocapture
-
-  # The native Windows main thread only gets the 1 MiB PE stack reserve, while
-  # Linux and macOS hand out 8 MiB. Startup runs the whole root future on the
-  # thread that calls `block_on`, so a debug server once overflowed before it
-  # listened on Windows only. Start a real server to keep that covered.
-  startup-smoke:
-    name: Startup Smoke
+  scoped-tests:
     runs-on: windows-latest
     timeout-minutes: 90
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - name: Checkout candidate
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
         with:
           persist-credentials: false
-
-      - name: Setup Rust environment
+      - name: Setup Rust
         uses: ./.github/actions/setup
         with:
           rust-version: stable
@@ -174,51 +28,21 @@ jobs:
           cache-save-if: 'false'
           install-build-packaging-tools: 'false'
           install-test-tools: 'false'
-
-      - name: Build debug server binary
-        shell: pwsh
-        run: cargo build --locked -p rustfs --bin rustfs
-
-      - name: Print version
-        shell: pwsh
+      - name: Run only the named diagnostic unit tests
+        shell: bash
         run: |
-          & .\target\debug\rustfs.exe --version
-          if ($LASTEXITCODE -ne 0) { throw "rustfs --version exited with $LASTEXITCODE" }
-
-      - name: Start server and wait for readiness
-        shell: pwsh
-        env:
-          RUSTFS_ACCESS_KEY: rustfsadmin
-          RUSTFS_SECRET_KEY: rustfsadmin
-        run: |
-          $volume = Join-Path $env:RUNNER_TEMP 'rustfs-startup-smoke'
-          $stdout = Join-Path $env:RUNNER_TEMP 'rustfs-startup-smoke.out.log'
-          $stderr = Join-Path $env:RUNNER_TEMP 'rustfs-startup-smoke.err.log'
-          New-Item -ItemType Directory -Force -Path $volume | Out-Null
-          $server = Start-Process -FilePath .\target\debug\rustfs.exe `
-            -ArgumentList @('--address', '127.0.0.1:9000', "`"$volume`"") `
-            -RedirectStandardOutput $stdout -RedirectStandardError $stderr `
-            -NoNewWindow -PassThru
-          # Cache the process handle now; otherwise ExitCode reads back empty.
-          $null = $server.Handle
-          $ready = $false
-          try {
-            for ($i = 0; $i -lt 180; $i++) {
-              if ($server.HasExited) { break }
-              try {
-                $response = Invoke-WebRequest -Uri 'http://127.0.0.1:9000/health/ready' -UseBasicParsing -NoProxy -TimeoutSec 2
-                if ($response.StatusCode -eq 200) { $ready = $true; break }
-              } catch {}
-              Start-Sleep -Seconds 1
-            }
-          } finally {
-            if (-not $server.HasExited) { Stop-Process -Id $server.Id -Force }
-            $server.WaitForExit()
-            Write-Host '--- server stdout (tail) ---'
-            Get-Content $stdout -Tail 100 -ErrorAction SilentlyContinue
-            Write-Host '--- server stderr (tail) ---'
-            Get-Content $stderr -Tail 100 -ErrorAction SilentlyContinue
-          }
-          if (-not $ready) {
-            throw ("rustfs did not report ready on /health/ready (exit code: {0})" -f $server.ExitCode)
+          set -euo pipefail
+          run_one() {
+            local package="$1"
+            local test_name="$2"
+            cargo test --locked -p "$package" --lib -- --exact "$test_name" --nocapture 2>&1 | tee scanner-proof-test.log
+            grep -F 'test result: ok. 1 passed; 0 failed;' scanner-proof-test.log
           }
+          run_one rustfs-obs telemetry::local::tests::multipart_timeout_event_does_not_inherit_verbose_span_fields
+          run_one rustfs-obs telemetry::local::tests::multipart_timeout_target_keeps_the_existing_error_module_filter
+          run_one rustfs-obs telemetry::local::tests::multipart_timeout_root_event_does_not_inherit_otlp_span_fields
+          run_one rustfs error::tests::multipart_create_timeout_classifies_only_the_exact_known_resources
+          run_one rustfs error::tests::multipart_create_timeout_keeps_nested_and_untrusted_sources_distinct
+          run_one rustfs error::tests::multipart_create_timeout_event_is_visible_at_warn_and_does_not_expose_source
+          run_one rustfs storage::access::tests::multipart_timeout_observes_only_the_authorized_final_error
+          run_one rustfs app::multipart_usecase::tests::create_multipart_observes_the_actual_object_lock_timeout

AGENTS.md

@@ -158,7 +158,9 @@ requested adversarial/design reviews, and agent-instruction changes that alter
 execution. Ordinary questions, diagnoses, status reports, non-adversarial code
 reviews, and low-risk planning do not trigger it.
 
-For applicable work and substantial PR reviews, follow the [risk tiers and review shape](.agents/references/adversarial-validation.md) and check changed trust boundaries and relevant correctness, security, concurrency, durability, compatibility, performance, and negative regression coverage.
+For applicable work and substantial PR reviews, read the [risk tiers and review shape](.agents/references/adversarial-validation.md).
+Load only the matching domain probes; ordinary reviews do not become adversarial
+merely because this reference exists.
 
 A review has no finding quota; `No findings` is a complete outcome. A request to
 find problems is not evidence that a defect exists. Before reporting a candidate,

crates/concurrency/Cargo.toml

@@ -26,7 +26,7 @@ rustfs-io-core = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 
 # Async runtime
-tokio = { workspace = true, features = ["sync", "fs", "rt-multi-thread", "time"] }
+tokio = { workspace = true, features = ["sync", "fs", "rt-multi-thread"] }
 
 # Logging
 tracing = { workspace = true }

crates/ecstore/src/api/mod.rs

@@ -371,15 +371,6 @@ pub mod compression {
 
 pub mod config {
     pub mod com {
-        /// Preserve empty existing objects so callers can distinguish corruption from absence.
-        pub async fn read_config_preserve_empty_with_metadata_opts(
-            api: std::sync::Arc<crate::store::ECStore>,
-            file: &str,
-            opts: &crate::object_api::ObjectOptions,
-        ) -> crate::error::Result<(Vec<u8>, crate::object_api::ObjectInfo)> {
-            crate::config::com::read_config_preserve_empty_with_metadata_opts(api, file, opts).await
-        }
-
         pub use crate::config::com::{
             COMMA_SEPARATED_LISTS, CONFIG_PREFIX, ENV_CONFIG_RECOVER_ON_CORRUPTION, STORAGE_CLASS_SUB_SYS,
             ServerConfigCorruptError, ServerConfigSaveResult, ServerConfigSnapshot, delete_config, delete_config_no_lock,

crates/ecstore/src/bucket/lifecycle/bucket_lifecycle_ops.rs

@@ -1086,9 +1086,8 @@ impl ExpiryState {
         }))
     }
 
-    #[cfg(any(test, feature = "test-util"))]
-    #[doc(hidden)]
-    pub fn new_with_unconsumed_worker_channel(capacity: usize) -> Arc<RwLock<Self>> {
+    #[cfg(test)]
+    fn new_with_unconsumed_worker_channel(capacity: usize) -> Arc<RwLock<Self>> {
         let (tx, rx) = mpsc::channel(capacity);
         Arc::new(RwLock::new(Self {
             tasks_tx: vec![tx],
@@ -3517,21 +3516,13 @@ async fn stale_upload_current_size_with_opts(
         .await
         .ok()?;
 
-    stale_upload_size_from_parts(&parts)
-}
-
-fn stale_upload_size_from_parts(parts: &crate::storage_api_contracts::multipart::ListPartsInfo) -> Option<usize> {
-    if parts.is_truncated {
-        return None;
-    }
-    parts.parts.iter().try_fold(0usize, |total, part| {
-        // ListParts represents a quorum-confirmed missing part with an empty ETag.
-        if part.etag.as_deref().is_none_or(str::is_empty) {
-            return None;
-        }
-        let actual_size = usize::try_from(part.actual_size.max(0)).ok()?;
-        total.checked_add(part.size.max(actual_size))
-    })
+    Some(
+        parts
+            .parts
+            .iter()
+            .map(|part| part.actual_size.max(part.size as i64).max(0) as usize)
+            .sum(),
+    )
 }
 
 async fn stale_upload_lifecycle_due(
@@ -3548,43 +3539,18 @@ async fn stale_upload_lifecycle_due(
     let bucket = metadata.get(RUSTFS_MULTIPART_BUCKET_KEY)?;
     let object = metadata.get(RUSTFS_MULTIPART_OBJECT_KEY)?;
 
-    let mut lifecycle = match metadata_boundary::get_lifecycle_config(bucket).await {
+    let lifecycle = match metadata_boundary::get_lifecycle_config(bucket).await {
         Ok((lifecycle, _)) => lifecycle,
         Err(_) => return None,
     };
 
-    let has_size_filter = |filter: &s3s::dto::LifecycleRuleFilter| {
-        filter.object_size_greater_than.is_some()
-            || filter.object_size_less_than.is_some()
-            || filter
-                .and
-                .as_ref()
-                .is_some_and(|and| and.object_size_greater_than.is_some() || and.object_size_less_than.is_some())
-    };
-    let needs_size = lifecycle
-        .rules
-        .iter()
-        .any(|rule| rule.abort_incomplete_multipart_upload.is_some() && rule.filter.as_ref().is_some_and(has_size_filter));
-    let size = if needs_size {
-        match stale_upload_current_size_with_opts(set, metadata, upload_dir, no_lock).await {
-            Some(size) => size,
-            None => {
-                // An unknown size cannot authorize a size-filtered abort.
-                // Unrelated rules can still be evaluated independently.
-                lifecycle
-                    .rules
-                    .retain(|rule| !rule.filter.as_ref().is_some_and(has_size_filter));
-                0
-            }
-        }
-    } else {
-        0
-    };
     let object_opts = ObjectOpts {
         name: object.clone(),
         user_tags: metadata.get(AMZ_OBJECT_TAGGING).cloned().unwrap_or_default(),
         mod_time: Some(initiated),
-        size,
+        size: stale_upload_current_size_with_opts(set, metadata, upload_dir, no_lock)
+            .await
+            .unwrap_or_default(),
         is_latest: true,
         delete_marker: false,
         user_defined: metadata.clone(),
@@ -3837,8 +3803,7 @@ async fn cleanup_stale_multipart_uploads_in_set(set: &Arc<SetDisks>, now: Offset
     for candidate in candidates.into_values() {
         let upload_dir = candidate.path.rsplit('/').next().unwrap_or_default().to_string();
         let mut due = stale_upload_default_due(candidate.initiated, default_expiry);
-        if now < due
-            && let Some(metadata) = candidate.metadata.as_ref()
+        if let Some(metadata) = candidate.metadata.as_ref()
             && let Some(lifecycle_due) = stale_upload_lifecycle_due(set, metadata, candidate.initiated, &upload_dir, false).await
             && lifecycle_due < due
         {
@@ -3867,9 +3832,8 @@ async fn cleanup_stale_multipart_uploads_in_set(set: &Arc<SetDisks>, now: Offset
         let current_metadata = cleanup_guard.file_info().metadata.clone();
         let current_initiated = initiated_from_upload_dir(&upload_dir, cleanup_guard.file_info().mod_time);
         let mut current_due = stale_upload_default_due(current_initiated, default_expiry);
-        if now < current_due
-            && let Some(lifecycle_due) =
-                stale_upload_lifecycle_due(set, &current_metadata, current_initiated, &upload_dir, true).await
+        if let Some(lifecycle_due) =
+            stale_upload_lifecycle_due(set, &current_metadata, current_initiated, &upload_dir, true).await
             && lifecycle_due < current_due
         {
             current_due = lifecycle_due;
@@ -15904,261 +15868,6 @@ mod tests {
         assert!(ecstore.is_ok(), "fresh local ECStore boot should succeed, got {ecstore:?}");
     }
 
-    #[tokio::test(flavor = "current_thread")]
-    #[serial]
-    async fn stale_multipart_cleanup_preserves_partial_metadata_without_upload_part_warning() {
-        use tracing::instrument::WithSubscriber as _;
-        #[derive(Clone, Default)]
-        struct CapturedLogs(Arc<StdMutex<Vec<u8>>>);
-        struct LogWriter(Arc<StdMutex<Vec<u8>>>);
-        impl std::io::Write for LogWriter {
-            fn write(&mut self, bytes: &[u8]) -> std::io::Result<usize> {
-                self.0.lock().unwrap().extend_from_slice(bytes);
-                Ok(bytes.len())
-            }
-            fn flush(&mut self) -> std::io::Result<()> {
-                Ok(())
-            }
-        }
-        impl<'a> tracing_subscriber::fmt::MakeWriter<'a> for CapturedLogs {
-            type Writer = LogWriter;
-            fn make_writer(&'a self) -> Self::Writer {
-                LogWriter(self.0.clone())
-            }
-        }
-
-        let (paths, ecstore) = setup_test_env().await;
-        let bucket = format!("stale-partial-{}", Uuid::new_v4().simple());
-        create_test_bucket(&ecstore, &bucket).await;
-        for copies in [1, 2] {
-            let object = format!("partial-{copies}.bin");
-            let initiated = OffsetDateTime::now_utc() - time::Duration::hours(30);
-            let upload = ecstore
-                .new_multipart_upload(
-                    &bucket,
-                    &object,
-                    &ObjectOptions {
-                        mod_time: Some(initiated),
-                        max_parity: true,
-                        ..Default::default()
-                    },
-                )
-                .await
-                .expect("multipart upload should be created");
-            let decoded = base64_simd::URL_SAFE_NO_PAD
-                .decode_to_vec(upload.upload_id.as_bytes())
-                .unwrap();
-            let decoded = String::from_utf8(decoded).unwrap();
-            let (_, upload_dir) = decoded.split_once('.').expect("deployment-prefixed upload id");
-            let upload_path = format!("{}/{upload_dir}", multipart_sha_dir(&bucket, &object));
-            let physical_paths: Vec<_> = paths
-                .iter()
-                .map(|path| path.join(RUSTFS_META_MULTIPART_BUCKET).join(&upload_path))
-                .collect();
-            let original: Vec<_> = physical_paths
-                .iter()
-                .take(copies)
-                .map(|path| std::fs::read(path.join(STORAGE_FORMAT_FILE)).unwrap())
-                .collect();
-            let info = super::get_file_info(
-                &original[0],
-                RUSTFS_META_MULTIPART_BUCKET,
-                &upload_path,
-                "",
-                super::FileInfoOpts {
-                    data: false,
-                    include_free_versions: false,
-                    include_part_checksums: false,
-                },
-            )
-            .unwrap();
-            assert_eq!((info.erasure.data_blocks, info.erasure.parity_blocks), (2, 2));
-            for path in physical_paths.iter().skip(copies) {
-                fs::remove_dir_all(path).await.expect("remove selected metadata copies");
-            }
-            if copies == 2 {
-                ecstore
-                    .get_multipart_info(&bucket, &object, &upload.upload_id, &ObjectOptions::default())
-                    .await
-                    .expect("two metadata copies must meet read quorum");
-            }
-
-            let logs = CapturedLogs::default();
-            let subscriber = tracing_subscriber::fmt()
-                .with_max_level(tracing::Level::DEBUG)
-                .with_writer(logs.clone())
-                .with_ansi(false)
-                .without_time()
-                .finish();
-            cleanup_stale_multipart_uploads_once_at(
-                ecstore.clone(),
-                OffsetDateTime::now_utc(),
-                StdDuration::from_secs(24 * 60 * 60),
-            )
-            .with_subscriber(subscriber)
-            .await;
-
-            for (path, expected) in physical_paths.iter().zip(&original) {
-                assert_eq!(fs::read(path.join(STORAGE_FORMAT_FILE)).await.unwrap(), *expected);
-            }
-            let log_output = String::from_utf8(logs.0.lock().unwrap().clone()).unwrap();
-            assert!(
-                log_output.contains(&upload_path),
-                "missing background diagnostic for {upload_path}: {log_output}"
-            );
-            assert!(log_output.contains("multipart_cleanup_lock_or_recheck_failed"), "{log_output}");
-            assert!(!log_output.contains("op=\"upload_part\""), "unexpected upload-part warning: {log_output}");
-            for path in physical_paths.iter().take(copies) {
-                fs::remove_dir_all(path).await.unwrap();
-            }
-        }
-    }
-
-    #[tokio::test(flavor = "current_thread")]
-    #[serial]
-    async fn stale_multipart_cleanup_lists_parts_only_when_size_is_needed() {
-        use std::sync::atomic::{AtomicUsize, Ordering};
-        use tracing::instrument::WithSubscriber as _;
-        use tracing_subscriber::prelude::*;
-
-        struct PartListCounter(Arc<AtomicUsize>);
-        impl<S: tracing::Subscriber> tracing_subscriber::Layer<S> for PartListCounter {
-            fn on_new_span(
-                &self,
-                attrs: &tracing::span::Attributes<'_>,
-                _id: &tracing::span::Id,
-                _ctx: tracing_subscriber::layer::Context<'_, S>,
-            ) {
-                if attrs.metadata().name() == "list_object_parts" {
-                    self.0.fetch_add(1, Ordering::Relaxed);
-                }
-            }
-        }
-
-        let (_, ecstore) = setup_test_env().await;
-        let bucket = format!("stale-list-parts-{}", Uuid::new_v4().simple());
-        create_test_bucket(&ecstore, &bucket).await;
-        set_abort_incomplete_lifecycle(&bucket, "logs/", 0).await;
-        let now = OffsetDateTime::now_utc();
-        for (object, age, size_filter, should_list) in [
-            ("logs/default-expired", time::Duration::hours(30), false, false),
-            ("logs/lifecycle-only", time::Duration::minutes(5), false, false),
-            ("logs/size-filter", time::Duration::minutes(5), true, true),
-        ] {
-            if size_filter {
-                set_abort_incomplete_lifecycle_with_size(&bucket, "logs/", 0, 0).await;
-            }
-            let upload = ecstore
-                .new_multipart_upload(
-                    &bucket,
-                    object,
-                    &ObjectOptions {
-                        mod_time: Some(now - age),
-                        ..Default::default()
-                    },
-                )
-                .await
-                .expect("create multipart upload");
-            if size_filter {
-                let mut data = PutObjReader::from_vec(vec![1, 2, 3, 4]);
-                ecstore
-                    .put_object_part(&bucket, object, &upload.upload_id, 1, &mut data, &ObjectOptions::default())
-                    .await
-                    .expect("upload a part for size filtering");
-            }
-            let calls = Arc::new(AtomicUsize::new(0));
-            let subscriber = tracing_subscriber::registry().with(PartListCounter(Arc::clone(&calls)));
-            cleanup_stale_multipart_uploads_once_at(ecstore.clone(), now, StdDuration::from_secs(24 * 60 * 60))
-                .with_subscriber(subscriber)
-                .await;
-            let listed = calls.load(Ordering::Relaxed);
-            assert_eq!(listed > 0, should_list, "unexpected ListParts calls for {object}: {listed}");
-            let result = ecstore
-                .get_multipart_info(&bucket, object, &upload.upload_id, &ObjectOptions::default())
-                .await;
-            assert!(
-                matches!(result, Err(ref err) if is_err_invalid_upload_id(err)),
-                "upload must be removed: {result:?}"
-            );
-        }
-    }
-
-    #[test]
-    fn stale_multipart_cleanup_rejects_incomplete_or_overflowing_part_sizes() {
-        use crate::storage_api_contracts::multipart::{ListPartsInfo, PartInfo};
-
-        let part = |size, actual_size, etag: &str| PartInfo {
-            size,
-            actual_size,
-            etag: Some(etag.to_owned()),
-            ..Default::default()
-        };
-        let mut parts = ListPartsInfo {
-            parts: vec![part(4, 6, "valid")],
-            ..Default::default()
-        };
-        assert_eq!(super::stale_upload_size_from_parts(&parts), Some(6));
-        parts.is_truncated = true;
-        assert_eq!(super::stale_upload_size_from_parts(&parts), None);
-        parts.is_truncated = false;
-        parts.parts = vec![part(0, 0, "")];
-        assert_eq!(super::stale_upload_size_from_parts(&parts), None);
-        parts.parts = vec![part(usize::MAX, 0, "valid"), part(1, 1, "valid")];
-        assert_eq!(super::stale_upload_size_from_parts(&parts), None);
-    }
-
-    #[tokio::test]
-    #[serial]
-    async fn stale_multipart_cleanup_handles_unknown_size_without_false_abort() {
-        let (_, ecstore) = setup_test_env().await;
-        let bucket = format!("stale-unknown-size-{}", Uuid::new_v4().simple());
-        let object = "logs/object";
-        create_test_bucket(&ecstore, &bucket).await;
-        let size_rule = r#"<Rule><ID>size</ID><Status>Enabled</Status><Filter><ObjectSizeLessThan>5</ObjectSizeLessThan></Filter><AbortIncompleteMultipartUpload><DaysAfterInitiation>0</DaysAfterInitiation></AbortIncompleteMultipartUpload></Rule>"#;
-        let independent_rule = r#"<Rule><ID>prefix</ID><Status>Enabled</Status><Filter><Prefix>logs/</Prefix></Filter><AbortIncompleteMultipartUpload><DaysAfterInitiation>0</DaysAfterInitiation></AbortIncompleteMultipartUpload></Rule>"#;
-        let lifecycle = |rules: &str| format!("<LifecycleConfiguration>{rules}</LifecycleConfiguration>").into_bytes();
-        metadata_sys::update(&bucket, BUCKET_LIFECYCLE_CONFIG, lifecycle(size_rule))
-            .await
-            .expect("install upper-size lifecycle rule");
-        let metadata = HashMap::from([
-            (super::RUSTFS_MULTIPART_BUCKET_KEY.to_owned(), bucket.clone()),
-            (super::RUSTFS_MULTIPART_OBJECT_KEY.to_owned(), object.to_owned()),
-        ]);
-        let initiated = OffsetDateTime::now_utc() - time::Duration::hours(1);
-        let set = &ecstore.pools[0].disk_set[0];
-        let upload = ecstore
-            .new_multipart_upload(&bucket, object, &ObjectOptions::default())
-            .await
-            .expect("create empty multipart upload");
-        let decoded = base64_simd::URL_SAFE_NO_PAD
-            .decode_to_vec(upload.upload_id.as_bytes())
-            .expect("decode upload ID");
-        let decoded = String::from_utf8(decoded).expect("upload ID must be UTF-8");
-        let (_, upload_dir) = decoded.split_once('.').expect("deployment-prefixed upload ID");
-        assert!(
-            super::stale_upload_lifecycle_due(set, &metadata, initiated, upload_dir, false)
-                .await
-                .is_some(),
-            "a known empty upload must match the upper-size rule"
-        );
-        let missing_upload = format!("{}x{}", Uuid::new_v4(), initiated.unix_timestamp_nanos());
-        assert!(
-            super::stale_upload_lifecycle_due(set, &metadata, initiated, &missing_upload, false)
-                .await
-                .is_none(),
-            "an unreadable size must not match the upper-size rule"
-        );
-        metadata_sys::update(&bucket, BUCKET_LIFECYCLE_CONFIG, lifecycle(&format!("{size_rule}{independent_rule}")))
-            .await
-            .expect("install size-independent lifecycle rule");
-        assert!(
-            super::stale_upload_lifecycle_due(set, &metadata, initiated, &missing_upload, false)
-                .await
-                .is_some(),
-            "a size-independent rule remains eligible when size is unknown"
-        );
-    }
-
     #[tokio::test]
     #[serial]
     async fn stale_multipart_cleanup_uses_default_expiry_without_lifecycle() {

crates/ecstore/src/config/com.rs

@@ -488,18 +488,6 @@ where
     Ok(data)
 }
 
-/// Read config bytes and metadata while preserving an existing empty payload.
-pub(crate) async fn read_config_preserve_empty_with_metadata_opts<S>(
-    api: Arc<S>,
-    file: &str,
-    opts: &ObjectOptions,
-) -> Result<(Vec<u8>, ObjectInfo)>
-where
-    S: EcstoreObjectIO,
-{
-    read_config_with_metadata_inner(api, file, opts, true, None).await
-}
-
 pub async fn read_config_no_lock<S>(api: Arc<S>, file: &str) -> Result<Vec<u8>>
 where
     S: ObjectIO<

crates/ecstore/src/core/pools.rs

@@ -28300,167 +28300,6 @@ mod tests {
         );
     }
 
-    /// One version commits, then every in-place attempt to copy the next one
-    /// times out on the target namespace lock. The entry is deferred, not
-    /// failed, with both source versions retained; the resumed entry finds the
-    /// committed version and moves both with their exact bytes.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn decommission_defers_target_lookup_lock_timeout_and_retries_without_losing_source() {
-        use tokio::io::AsyncReadExt as _;
-
-        let fixture = NullVersionDecommission::new(NullVersionTop::NewerVersion).await;
-        let object = fixture.object;
-        let injected = Arc::new(AtomicUsize::new(0));
-        let attempted = Arc::new(AtomicUsize::new(0));
-        let fault = DecommissionTestFaultGuard::install_with_error(
-            Arc::new({
-                let injected = Arc::clone(&injected);
-                let attempted = Arc::clone(&attempted);
-                move |stage, _, faulted, _, success| {
-                    let target = stage == "before_target_commit" && faulted == object && success;
-                    let should_inject = target && attempted.fetch_add(1, Ordering::SeqCst) > 0;
-                    if should_inject {
-                        injected.fetch_add(1, Ordering::SeqCst);
-                    }
-                    should_inject
-                }
-            }),
-            Some(Arc::new(|_, bucket, object| {
-                data_movement::data_movement_stage_error_for_test(
-                    "decommission_object",
-                    "prepare_put_object",
-                    bucket,
-                    object,
-                    Error::Lock(rustfs_lock::LockError::timeout(
-                        format!("{bucket}/{object}@latest"),
-                        std::time::Duration::from_secs(5),
-                    )),
-                )
-            })),
-        );
-        let (outcome, _) = fixture.run_entry().await;
-        assert_eq!(injected.load(Ordering::SeqCst), DECOMMISSION_VERSION_COPY_ATTEMPTS);
-        fixture.assert_source_retained().await;
-        assert_eq!(
-            fixture
-                .target_versions()
-                .await
-                .expect("the first version was copied")
-                .versions
-                .len(),
-            1,
-            "one version must commit before the next version times out"
-        );
-        assert!(
-            matches!(&outcome, DecommissionEntryOutcome::Deferred(err) if is_decommission_copy_lock_timeout_deferral(err)),
-            "{outcome:?}"
-        );
-        assert_eq!(
-            fixture.store.pool_meta.read().await.pools[0]
-                .decommission
-                .as_ref()
-                .expect("active decommission")
-                .items_decommission_failed,
-            0,
-            "a deferred entry must not be counted as a permanent failure"
-        );
-        drop(fault);
-        let (outcome, _) = fixture.run_entry().await;
-        assert!(matches!(outcome, DecommissionEntryOutcome::Complete), "{outcome:?}");
-        fixture.assert_moved().await;
-        let mut reader = fixture.store.pools[1]
-            .get_object_reader(
-                fixture.bucket,
-                fixture.object,
-                None,
-                HeaderMap::new(),
-                &ObjectOptions {
-                    version_id: Some(fixture.seeded.versions[0].version_id.expect("newer version").to_string()),
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("the newer version must remain readable");
-        let mut actual = Vec::new();
-        reader.stream.read_to_end(&mut actual).await.expect("read the newer version");
-        assert_eq!(actual, b"written after versioning was enabled");
-    }
-
-    /// A namespace lock still held on the target key, as by a copy whose node
-    /// was killed mid-write, makes target selection fail with a typed
-    /// object-lock timeout. A real held lock, not an injected error, must defer
-    /// the entry rather than fail it; once the lock is released selection
-    /// recovers and the resumed entry moves both versions.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn decommission_target_selection_returns_timeout_for_a_held_object_lock() {
-        temp_env::async_with_vars([(rustfs_config::ENV_OBJECT_LOCK_ACQUIRE_TIMEOUT, Some("1"))], async {
-            let fixture = NullVersionDecommission::new(NullVersionTop::NewerVersion).await;
-            let target_set = fixture.store.pools[1].get_disks_by_key(fixture.object);
-            let lock = target_set
-                .new_ns_lock(fixture.bucket, fixture.object)
-                .await
-                .expect("target lock");
-            let guard = lock
-                .get_write_lock(std::time::Duration::from_secs(30))
-                .await
-                .expect("hold target lock");
-            let opts = ObjectOptions {
-                data_movement: true,
-                src_pool_idx: 0,
-                version_id: Some(uuid::Uuid::nil().to_string()),
-                ..Default::default()
-            };
-            let select = || {
-                fixture
-                    .store
-                    .select_data_movement_pool_idx(fixture.bucket, fixture.object, 1, &opts, false)
-            };
-            let result = tokio::time::timeout(get_lock_acquire_timeout() + std::time::Duration::from_secs(15), select())
-                .await
-                .expect("target selection must terminate");
-            match result {
-                Err(Error::Lock(rustfs_lock::LockError::Timeout { resource, .. })) => {
-                    assert!(resource.contains(fixture.bucket) && resource.contains(fixture.object), "{resource}");
-                }
-                other => panic!("expected an object lock timeout, got {other:?}"),
-            }
-
-            let (outcome, _) = fixture.run_entry().await;
-            assert!(
-                matches!(&outcome, DecommissionEntryOutcome::Deferred(err) if is_decommission_copy_lock_timeout_deferral(err)),
-                "{outcome:?}"
-            );
-            assert_eq!(
-                fixture.store.pool_meta.read().await.pools[0]
-                    .decommission
-                    .as_ref()
-                    .expect("active decommission")
-                    .items_decommission_failed,
-                0,
-                "a held target lock must not be counted as a permanent failure"
-            );
-            fixture.assert_source_retained().await;
-            assert!(
-                fixture.target_versions().await.is_none(),
-                "no version may commit while the target lock is held"
-            );
-
-            drop(guard);
-            assert_eq!(
-                select()
-                    .await
-                    .expect("target selection must recover once the lock is released"),
-                1
-            );
-            let (outcome, _) = fixture.run_entry().await;
-            assert!(matches!(outcome, DecommissionEntryOutcome::Complete), "{outcome:?}");
-            fixture.assert_moved().await;
-        })
-        .await;
-    }
-
     #[test]
     fn decommission_object_attempt_metric_keeps_the_peak() {
         let mut attempts = 0;

crates/ecstore/src/disk/local.rs

@@ -8450,23 +8450,6 @@ impl LocalDisk {
                     return Err(std::io::Error::other("metadata read worker cancelled"));
                 }
                 let _io_permit = io_permit;
-                #[cfg(all(any(test, feature = "test-util"), not(windows)))]
-                {
-                    let opened = root.open_readonly(&path);
-                    if opened.is_ok() {
-                        os::prepared_publication_test_hooks::run(
-                            os::prepared_publication_test_hooks::Stage::MetadataReadAfterOpen,
-                            &path,
-                        );
-                    }
-                    let result = read_fn(opened);
-                    os::prepared_publication_test_hooks::run(
-                        os::prepared_publication_test_hooks::Stage::MetadataReadAfterRead,
-                        &path,
-                    );
-                    Ok(result)
-                }
-                #[cfg(not(all(any(test, feature = "test-util"), not(windows))))]
                 Ok(read_fn(root.open_readonly(&path)))
             })
             .await
@@ -11326,57 +11309,34 @@ impl LocalDisk {
 #[cfg(unix)]
 pub(crate) async fn batch_shard_pread(requests: Vec<(std::path::PathBuf, usize, usize)>) -> Vec<Result<Bytes>> {
     let n = requests.len();
-    let metrics = rustfs_io_metrics::LocalBatchReadMetrics::capture();
-    let submitted = metrics.as_ref().map(|_| std::time::Instant::now());
     tokio::task::spawn_blocking(move || {
-        use rustfs_io_metrics::LocalBatchReadStage;
         use std::os::unix::fs::FileExt;
 
-        let execution_started = metrics.as_ref().map(|_| std::time::Instant::now());
-        if let (Some(metrics), Some(submitted)) = (&metrics, submitted) {
-            metrics.record_stage(LocalBatchReadStage::QueueWait, true, submitted.elapsed());
-            metrics.record_batch(n);
-        }
         let mut results = Vec::with_capacity(n);
         for (file_path, offset, length) in requests {
-            let mut bytes_read = 0;
             let r = (|| -> Result<Bytes> {
-                let meta = measure_local_batch_stage(metrics.as_deref(), LocalBatchReadStage::Metadata, || {
-                    std::fs::metadata(&file_path).map_err(DiskError::from)
-                })?;
+                let meta = std::fs::metadata(&file_path).map_err(DiskError::from)?;
                 let end = offset.checked_add(length).ok_or(DiskError::FileCorrupt)?;
                 if meta.len() < u64::try_from(end).unwrap_or(u64::MAX) {
                     return Err(DiskError::FileCorrupt);
                 }
 
-                let file = measure_local_batch_stage(metrics.as_deref(), LocalBatchReadStage::Open, || {
-                    std::fs::File::open(&file_path).map_err(DiskError::from)
-                })?;
+                let file = std::fs::File::open(&file_path).map_err(DiskError::from)?;
                 let mut buf = vec![0u8; length];
-                if length > 0 {
-                    measure_local_batch_stage(metrics.as_deref(), LocalBatchReadStage::Read, || {
-                        while bytes_read < length {
-                            let nbytes = file
-                                .read_at(&mut buf[bytes_read..], u64::try_from(offset + bytes_read).unwrap_or(u64::MAX))
-                                .map_err(DiskError::from)?;
-                            if nbytes == 0 {
-                                return Err(DiskError::FileCorrupt);
-                            }
-                            bytes_read += nbytes;
-                        }
-                        Ok(())
-                    })?;
+                let mut total = 0usize;
+                while total < length {
+                    let nbytes = file
+                        .read_at(&mut buf[total..], u64::try_from(offset + total).unwrap_or(u64::MAX))
+                        .map_err(DiskError::from)?;
+                    if nbytes == 0 {
+                        return Err(DiskError::FileCorrupt);
+                    }
+                    total += nbytes;
                 }
                 Ok(Bytes::from(buf))
             })();
-            if let Some(metrics) = &metrics {
-                metrics.record_shard(r.is_ok(), length, bytes_read);
-            }
             results.push(r);
         }
-        if let (Some(metrics), Some(started)) = (&metrics, execution_started) {
-            metrics.record_stage(LocalBatchReadStage::Execution, results.iter().all(Result::is_ok), started.elapsed());
-        }
         results
     })
     .await
@@ -11386,20 +11346,6 @@ pub(crate) async fn batch_shard_pread(requests: Vec<(std::path::PathBuf, usize,
     })
 }
 
-#[cfg(unix)]
-fn measure_local_batch_stage<T>(
-    metrics: Option<&rustfs_io_metrics::LocalBatchReadMetrics>,
-    stage: rustfs_io_metrics::LocalBatchReadStage,
-    operation: impl FnOnce() -> Result<T>,
-) -> Result<T> {
-    let started = metrics.map(|_| std::time::Instant::now());
-    let result = operation();
-    if let (Some(metrics), Some(started)) = (metrics, started) {
-        metrics.record_stage(stage, result.is_ok(), started.elapsed());
-    }
-    result
-}
-
 #[async_trait::async_trait]
 impl DiskAPI for LocalDisk {
     async fn supports_guarded_delete_versions(&self) -> Result<()> {
@@ -31011,109 +30957,6 @@ mod test {
         );
     }
 
-    #[cfg(unix)]
-    #[test]
-    fn local_batch_read_metrics_cover_success_and_unattempted_failure_stages() {
-        use crate::test_metrics::CapturingRecorder;
-
-        let dir = tempfile::tempdir().expect("batch metrics directory");
-        let good = dir.path().join("good.bin");
-        std::fs::write(&good, b"good data").expect("write batch metrics payload");
-        let runtime = tokio::runtime::Builder::new_current_thread()
-            .enable_all()
-            .build()
-            .expect("batch metrics runtime");
-        let recorder = CapturingRecorder::default();
-        let previous = rustfs_io_metrics::get_stage_metrics_enabled();
-        rustfs_io_metrics::set_get_stage_metrics_enabled(true);
-        let results = metrics::with_local_recorder(&recorder, || {
-            runtime.block_on(batch_shard_pread(vec![
-                (good.clone(), 0, 9),
-                (dir.path().join("missing.bin"), 0, 4),
-                (good.clone(), 0, 1024),
-                (good, 0, 0),
-            ]))
-        });
-        rustfs_io_metrics::set_get_stage_metrics_enabled(previous);
-
-        assert_eq!(results[0].as_ref().expect("valid shard read").as_ref(), b"good data");
-        assert!(results[1].is_err(), "missing shard must remain an error");
-        assert!(matches!(results[2], Err(DiskError::FileCorrupt)), "range failure must preserve its error");
-        assert!(results[3].as_ref().expect("empty range succeeds").is_empty());
-        let counter = "rustfs_io_get_object_local_batch_shards_total";
-        assert_eq!(recorder.counter_value(counter, &[("outcome", "success")]), 2);
-        assert_eq!(recorder.counter_value(counter, &[("outcome", "error")]), 2);
-        assert_eq!(recorder.counter_value("rustfs_io_get_object_local_batch_read_bytes_total", &[]), 9);
-        let stages = "rustfs_io_get_object_local_batch_stage_seconds";
-        for (stage, success, errors) in [("metadata", 3, 1), ("open", 2, 0), ("read", 1, 0), ("execution", 0, 1)] {
-            assert_eq!(
-                recorder
-                    .histogram_values(stages, &[("stage", stage), ("outcome", "success")])
-                    .len(),
-                success
-            );
-            assert_eq!(
-                recorder
-                    .histogram_values(stages, &[("stage", stage), ("outcome", "error")])
-                    .len(),
-                errors
-            );
-        }
-        assert_eq!(recorder.histogram_values(stages, &[("stage", "queue_wait")]).len(), 1);
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn local_batch_read_metrics_survive_caller_cancellation() {
-        use crate::test_metrics::CapturingRecorder;
-
-        let dir = tempfile::tempdir().expect("cancelled batch directory");
-        let path = dir.path().join("shard");
-        std::fs::write(&path, b"data").expect("write cancellation fixture");
-        let runtime = tokio::runtime::Builder::new_current_thread()
-            .max_blocking_threads(1)
-            .enable_all()
-            .build()
-            .expect("single blocking-worker runtime");
-        let recorder = CapturingRecorder::default();
-        let previous = rustfs_io_metrics::get_stage_metrics_enabled();
-        rustfs_io_metrics::set_get_stage_metrics_enabled(true);
-        metrics::with_local_recorder(&recorder, || {
-            runtime.block_on(async {
-                let (started_tx, started_rx) = tokio::sync::oneshot::channel();
-                let (release_tx, release_rx) = std::sync::mpsc::channel();
-                let blocker = tokio::task::spawn_blocking(move || {
-                    started_tx.send(()).expect("signal occupied blocking worker");
-                    release_rx.recv().expect("release occupied blocking worker");
-                });
-                started_rx.await.expect("blocking worker has started");
-                let mut batch = Box::pin(batch_shard_pread(vec![(path, 0, 4)]));
-                let pending = futures::FutureExt::now_or_never(&mut batch).is_none();
-                drop(batch);
-                rustfs_io_metrics::set_get_stage_metrics_enabled(false);
-                release_tx.send(()).expect("release worker after dropping caller");
-                blocker.await.expect("blocking worker finishes");
-                assert!(pending, "batch must have been submitted while the worker was occupied");
-                tokio::time::timeout(Duration::from_secs(5), async {
-                    while recorder
-                        .histogram_values("rustfs_io_get_object_local_batch_stage_seconds", &[("stage", "execution")])
-                        .is_empty()
-                    {
-                        tokio::task::yield_now().await;
-                    }
-                })
-                .await
-                .expect("detached batch must still record completion");
-            });
-        });
-        rustfs_io_metrics::set_get_stage_metrics_enabled(previous);
-        assert_eq!(
-            recorder.counter_value("rustfs_io_get_object_local_batch_shards_total", &[("outcome", "success")]),
-            1
-        );
-        assert_eq!(recorder.counter_value("rustfs_io_get_object_local_batch_read_bytes_total", &[]), 4);
-    }
-
     #[cfg(unix)]
     #[tokio::test]
     async fn test_batch_shard_pread_basic() {

crates/ecstore/src/disk/os.rs

@@ -333,8 +333,6 @@ pub(crate) mod prepared_publication_test_hooks {
         PreparedRename,
         Rename,
         Remove,
-        MetadataReadAfterOpen,
-        MetadataReadAfterRead,
         #[cfg(test)]
         Rollback,
         #[cfg(test)]
@@ -459,8 +457,6 @@ pub enum LocalPublicationStage {
     PreparedRename,
     Rename,
     Remove,
-    MetadataReadAfterOpen,
-    MetadataReadAfterRead,
 }
 
 #[cfg(all(feature = "test-util", not(windows)))]
@@ -473,8 +469,6 @@ impl LocalPublicationPause {
             LocalPublicationStage::PreparedRename => prepared_publication_test_hooks::Stage::PreparedRename,
             LocalPublicationStage::Rename => prepared_publication_test_hooks::Stage::Rename,
             LocalPublicationStage::Remove => prepared_publication_test_hooks::Stage::Remove,
-            LocalPublicationStage::MetadataReadAfterOpen => prepared_publication_test_hooks::Stage::MetadataReadAfterOpen,
-            LocalPublicationStage::MetadataReadAfterRead => prepared_publication_test_hooks::Stage::MetadataReadAfterRead,
         };
         let (entered_tx, entered) = oneshot::channel();
         let (release, release_rx) = std::sync::mpsc::channel::<()>();

crates/ecstore/src/services/rebalance/entry.rs

@@ -1782,285 +1782,6 @@ mod tests {
         fixture.assert_moved().await;
     }
 
-    /// Each drive's copy of `version_id` of `object` on `pool`.
-    #[cfg(feature = "test-util")]
-    async fn drive_copies(store: &ECStore, pool: usize, bucket: &str, object: &str, version_id: uuid::Uuid) -> Vec<FileInfo> {
-        use crate::disk::DiskAPI as _;
-        let set = store.pools[pool].get_disks_by_key(object);
-        let mut copies = Vec::new();
-        for disk in set.disks.read().await.iter().flatten() {
-            let path = disk.path().join(bucket).join(object).join(crate::disk::STORAGE_FORMAT_FILE);
-            let Ok(bytes) = tokio::fs::read(&path).await else {
-                continue;
-            };
-            let meta = FileMeta::load(&bytes).expect("drive metadata should decode");
-            if meta.find_version(Some(version_id)).is_ok() {
-                copies.push(
-                    meta.into_fileinfo(bucket, object, &version_id.to_string(), false, false, false)
-                        .expect("drive copy should decode"),
-                );
-            }
-        }
-        copies
-    }
-
-    #[cfg(feature = "test-util")]
-    fn drive_space(total: u64, used: u64) -> crate::disk::DiskInfo {
-        crate::disk::DiskInfo {
-            total,
-            used,
-            free: total - used,
-            free_inodes: 1 << 20,
-            ..Default::default()
-        }
-    }
-
-    #[cfg(feature = "test-util")]
-    const DANGLING_COPY_REBALANCE_ID: &str = "rebalance-dangling-target-copy";
-
-    /// A delete marker over one object version on pool 0 of three four-drive
-    /// pools, plus what an earlier attempt that lost write quorum left on one
-    /// drive of pool 1: both version ids, with older modification times and
-    /// different bytes. Object reads report such copies as absent. Pool 2
-    /// reports far more free space than pool 1, so a free-space choice picks
-    /// pool 2 (the kill-resume e2e case ended with the marker on two pools).
-    #[cfg(feature = "test-util")]
-    struct DanglingTargetCopy {
-        _temp_dirs: Vec<tempfile::TempDir>,
-        store: Arc<ECStore>,
-        _space: crate::store::PoolSpaceForTest,
-        bucket: &'static str,
-        object: &'static str,
-        incarnation: uuid::Uuid,
-        source_set: Arc<SetDisks>,
-        marker: FileInfo,
-        version: FileInfo,
-        payload: Vec<u8>,
-    }
-
-    #[cfg(feature = "test-util")]
-    impl DanglingTargetCopy {
-        async fn new(holder_space: crate::disk::DiskInfo) -> Self {
-            let (temp_dirs, store, _peer) =
-                crate::services::rebalance::test_three_pool_stores_with_four_disk_sets_with_isolated_node_contexts(None).await;
-            let space = crate::store::PoolSpaceForTest::install(store.id, &[(1, holder_space), (2, drive_space(1 << 50, 0))]);
-            let bucket = "rebalance-dangling-target";
-            let object = "versioned/06.bin";
-            Box::pin(store.make_bucket(bucket, &MakeBucketOptions::default()))
-                .await
-                .expect("create bucket");
-            let incarnation = store.bucket_incarnation_id(bucket).await.expect("bucket incarnation");
-            let mut rebalance_meta = active_rebalance_meta(DANGLING_COPY_REBALANCE_ID);
-            rebalance_meta.pool_stats.push(RebalanceStats::default());
-            rebalance_meta
-                .save(Arc::clone(&store.pools[0]))
-                .await
-                .expect("persist the active rebalance run");
-            *store.rebalance_meta.write().await = Some(rebalance_meta);
-            let versioned = ObjectOptions {
-                versioned: true,
-                expected_bucket_incarnation_id: Some(incarnation),
-                ..Default::default()
-            };
-
-            let payload = vec![0x5a; 2048];
-            let source_set = store.pools[0].get_disks_by_key(object);
-            Box::pin(source_set.put_object(bucket, object, &mut PutObjReader::from_vec(payload.clone()), &versioned))
-                .await
-                .expect("seed the object version");
-            let marker = Box::pin(source_set.delete_object(bucket, object, versioned.clone()))
-                .await
-                .expect("seed the delete marker");
-            assert!(marker.delete_marker);
-            let seeded = source_set
-                .load_file_info_versions_exact(bucket, object)
-                .await
-                .expect("read seeded versions")
-                .expect("seeded versions must exist");
-            let [marker, version] = seeded.versions.as_slice() else {
-                panic!("expected a delete marker over one version: {seeded:?}");
-            };
-            let (marker, version) = (marker.clone(), version.clone());
-            let marker_id = marker.version_id.expect("the marker has a version id");
-            let version_id = version.version_id.expect("the object version has a version id");
-            let earlier = |time: Option<OffsetDateTime>| time.map(|time| time - time::Duration::hours(1));
-
-            let holder = store.pools[1].get_disks_by_key(object);
-            let mut marker_opts =
-                super::super::migration::rebalance_delete_marker_opts(&marker, Some(marker_id.to_string()), 0, Some(incarnation));
-            marker_opts.mod_time = earlier(marker.mod_time);
-            Box::pin(holder.delete_object(bucket, object, marker_opts))
-                .await
-                .expect("publish the earlier marker copy");
-            Box::pin(holder.put_object(
-                bucket,
-                object,
-                &mut PutObjReader::from_vec(vec![0x11; 4096]),
-                &ObjectOptions {
-                    version_id: Some(version_id.to_string()),
-                    mod_time: earlier(version.mod_time),
-                    ..versioned
-                },
-            ))
-            .await
-            .expect("publish the earlier object version copy");
-            {
-                use crate::disk::DiskAPI as _;
-                for disk in holder.disks.read().await.iter().flatten().skip(1) {
-                    tokio::fs::remove_dir_all(disk.path().join(bucket).join(object))
-                        .await
-                        .expect("drop the copies from the drives the attempt missed");
-                }
-            }
-            for version_id in [marker_id, version_id] {
-                assert_eq!(drive_copies(&store, 1, bucket, object, version_id).await.len(), 1);
-            }
-
-            Self {
-                _temp_dirs: temp_dirs,
-                store,
-                _space: space,
-                bucket,
-                object,
-                incarnation,
-                source_set,
-                marker,
-                version,
-                payload,
-            }
-        }
-
-        async fn run_entry(&self) -> RebalanceEntryOutcome {
-            let entry = metacache_entry_from_source(&self.source_set, self.bucket, self.object).await;
-            Box::pin(Arc::clone(&self.store).rebalance_entry(
-                RebalanceEntryTarget {
-                    bucket: self.bucket.to_string(),
-                    pool_index: 0,
-                },
-                entry,
-                Arc::clone(&self.source_set),
-                Arc::new(RebalanceBucketConfigs {
-                    bucket_incarnation_id: Some(self.incarnation),
-                    ..Default::default()
-                }),
-                Arc::from(DANGLING_COPY_REBALANCE_ID),
-                CancellationToken::new(),
-            ))
-            .await
-            .expect("rebalance entry")
-        }
-
-        /// Pools whose drives hold `version_id`, with the number of drives.
-        async fn holders(&self, version_id: uuid::Uuid) -> Vec<(usize, usize)> {
-            let mut holders = Vec::new();
-            for pool in 0..self.store.pools.len() {
-                let drives = drive_copies(&self.store, pool, self.bucket, self.object, version_id)
-                    .await
-                    .len();
-                if drives > 0 {
-                    holders.push((pool, drives));
-                }
-            }
-            holders
-        }
-
-        /// The source entry is gone and `pool` serves both versions as the
-        /// source wrote them, on every drive.
-        async fn assert_moved_to(&self, pool: usize) {
-            assert!(
-                self.source_set
-                    .load_file_info_versions_exact(self.bucket, self.object)
-                    .await
-                    .expect("read source versions")
-                    .is_none(),
-                "the source entry must be cleaned up"
-            );
-            let target = self.store.pools[pool]
-                .get_disks_by_key(self.object)
-                .load_file_info_versions_exact(self.bucket, self.object)
-                .await
-                .expect("read target versions")
-                .expect("both versions must reach the target pool");
-            let moved = |id| {
-                target
-                    .versions
-                    .iter()
-                    .find(|version| version.version_id == id)
-                    .unwrap_or_else(|| panic!("version {id:?} must reach pool {pool}: {target:?}"))
-            };
-            let marker = moved(self.marker.version_id);
-            assert!(marker.deleted, "the marker must stay a delete marker");
-            assert_eq!(marker.mod_time, self.marker.mod_time);
-            let version = moved(self.version.version_id);
-            assert!(!version.deleted);
-            assert_eq!(version.mod_time, self.version.mod_time);
-
-            let version_id = self.version.version_id.expect("object version id");
-            let copies = drive_copies(&self.store, pool, self.bucket, self.object, version_id).await;
-            assert_eq!(copies.len(), 4, "the object version must be on every drive of pool {pool}");
-            for copy in &copies {
-                assert_eq!(copy.mod_time, self.version.mod_time, "an earlier copy must be replaced, not kept");
-                assert_eq!(copy.data_dir, copies[0].data_dir, "every drive must hold the same data");
-            }
-            let marker_id = self.marker.version_id.expect("marker version id");
-            let markers = drive_copies(&self.store, pool, self.bucket, self.object, marker_id).await;
-            assert_eq!(markers.len(), 4, "the marker must be on every drive of pool {pool}");
-            assert!(markers.iter().all(|copy| copy.deleted));
-
-            let mut reader = self.store.pools[pool]
-                .get_object_reader(
-                    self.bucket,
-                    self.object,
-                    None,
-                    HeaderMap::new(),
-                    &ObjectOptions {
-                        version_id: Some(version_id.to_string()),
-                        ..Default::default()
-                    },
-                )
-                .await
-                .expect("the moved version must be readable");
-            let mut actual = Vec::new();
-            reader.stream.read_to_end(&mut actual).await.expect("drain the moved version");
-            assert_eq!(actual, self.payload, "the moved version must carry the source bytes");
-        }
-    }
-
-    /// A retry reuses the pool that holds an earlier attempt's copy, even
-    /// though free space favours another pool, and rewrites that copy from
-    /// the source instead of leaving the version in two pools.
-    #[cfg(feature = "test-util")]
-    #[test]
-    #[serial_test::serial]
-    fn real_rebalance_retry_reuses_the_pool_holding_a_dangling_copy() {
-        run_large_stack_async_test("rebalance-dangling-target-copy", || async {
-            let fixture = DanglingTargetCopy::new(drive_space(64 << 20, 0)).await;
-            assert_eq!(fixture.run_entry().await, RebalanceEntryOutcome::Completed);
-            for version in [&fixture.marker, &fixture.version] {
-                let id = version.version_id.expect("version id");
-                assert_eq!(fixture.holders(id).await, vec![(1, 4)], "version {id} must be in one pool");
-            }
-            fixture.assert_moved_to(1).await;
-        });
-    }
-
-    /// A full pool holding an earlier copy must not pin the retry: placement
-    /// falls back to the free-space choice, and the stale copy stays for heal.
-    #[cfg(feature = "test-util")]
-    #[test]
-    #[serial_test::serial]
-    fn real_rebalance_retry_skips_a_full_pool_holding_a_dangling_copy() {
-        run_large_stack_async_test("rebalance-dangling-full-holder", || async {
-            let fixture = DanglingTargetCopy::new(drive_space(1 << 30, 1 << 30)).await;
-            assert_eq!(fixture.run_entry().await, RebalanceEntryOutcome::Completed);
-            for version in [&fixture.marker, &fixture.version] {
-                let id = version.version_id.expect("version id");
-                assert_eq!(fixture.holders(id).await, vec![(1, 1), (2, 4)], "version {id}");
-            }
-            fixture.assert_moved_to(2).await;
-        });
-    }
-
     /// An `ExpiredObjectAllVersions` expiry is a prefix delete that takes the
     /// bucket lifecycle write lock, while the entry holds that lock for read
     /// through its bucket incarnation fence. Applied inline, it waited out the

crates/ecstore/src/set_disk/core/io_primitives.rs

@@ -1234,23 +1234,16 @@ async fn try_create_bitrot_readers_via_batch_pread(
     skip_verify_bitrot: bool,
 ) -> Option<BitrotReaderSetup> {
     use crate::disk::local::batch_shard_pread;
-    use rustfs_io_metrics::{LocalBatchReadDecision, record_local_batch_read_decision};
     use std::io::Cursor;
 
-    let prepare_started = rustfs_io_metrics::get_stage_metrics_enabled().then(std::time::Instant::now);
-    let record_decision = |decision| {
-        record_local_batch_read_decision(decision, prepare_started.map(|started| started.elapsed()));
-    };
     let (adj_off, adj_len) = adjust_shard_read_params(read_offset, read_length, shard_size, &checksum_algo);
     if adj_len > object_mmap_read_max_length() {
-        record_decision(LocalBatchReadDecision::ReadCapExceeded);
         return None;
     }
 
     let mut batch_items: Vec<(usize, std::path::PathBuf, usize, usize)> = Vec::new();
     for (idx, disk_op) in disks.iter().enumerate() {
         if files.get(idx).is_some_and(|fi| fi.data.is_some()) {
-            record_decision(LocalBatchReadDecision::InlineData);
             return None;
         }
         if let Some(disk) = disk_op.as_ref() {
@@ -1258,20 +1251,12 @@ async fn try_create_bitrot_readers_via_batch_pread(
             let path_str = format!("{object}/{data_dir}/part.{part_number}");
             match disk.get_object_path_for_io_if_local(bucket, &path_str) {
                 Some(Ok(p)) => batch_items.push((idx, p, adj_off, adj_len)),
-                Some(Err(_)) => {
-                    record_decision(LocalBatchReadDecision::InvalidPath);
-                    return None;
-                }
-                None => {
-                    record_decision(LocalBatchReadDecision::NonLocalShard);
-                    return None;
-                }
+                _ => return None,
             }
         }
     }
 
     if batch_items.is_empty() {
-        record_decision(LocalBatchReadDecision::NoLocalShards);
         return None;
     }
 
@@ -1280,7 +1265,6 @@ async fn try_create_bitrot_readers_via_batch_pread(
     for (disk_index, _, _, _) in &batch_items {
         disk_call_counters::record(object, disk_call_counters::KIND_DISK_SHARD_OPEN, *disk_index);
     }
-    record_decision(LocalBatchReadDecision::Selected);
     let batch_results = batch_shard_pread(requests).await;
 
     let mut setup = BitrotReaderSetup::new(disks.len());
@@ -1329,7 +1313,6 @@ async fn try_create_bitrot_readers_via_batch_pread(
     _checksum_algo: HashAlgorithm,
     _skip_verify_bitrot: bool,
 ) -> Option<BitrotReaderSetup> {
-    rustfs_io_metrics::record_local_batch_read_decision(rustfs_io_metrics::LocalBatchReadDecision::UnsupportedPlatform, None);
     None
 }
 
@@ -1493,19 +1476,11 @@ pub(in crate::set_disk) async fn create_bitrot_readers_until_quorum_with_prefere
 ) -> BitrotReaderSetup {
     let strategy = get_bitrot_reader_setup_strategy(mode, prefer_data_blocks_first);
 
-    let batch_read_enabled = if !use_mmap_read {
-        rustfs_io_metrics::record_local_batch_read_decision(rustfs_io_metrics::LocalBatchReadDecision::MmapDisabled, None);
-        false
-    } else if matches!(
-        crate::set_disk::get_object_read_policy(),
-        crate::set_disk::GetObjectReadPolicy::CopySource
-    ) {
-        rustfs_io_metrics::record_local_batch_read_decision(rustfs_io_metrics::LocalBatchReadDecision::CopySource, None);
-        false
-    } else {
-        true
-    };
-    if batch_read_enabled
+    if use_mmap_read
+        && !matches!(
+            crate::set_disk::get_object_read_policy(),
+            crate::set_disk::GetObjectReadPolicy::CopySource
+        )
         && let Some(mut setup) = try_create_bitrot_readers_via_batch_pread(
             files,
             disks,
@@ -7889,228 +7864,6 @@ mod tests {
         (dirs, disks)
     }
 
-    #[cfg(unix)]
-    #[test]
-    fn local_batch_read_decisions_follow_the_actual_reader_setup_entry() {
-        use crate::test_metrics::CapturingRecorder;
-
-        let runtime = tokio::runtime::Builder::new_current_thread()
-            .enable_all()
-            .build()
-            .expect("reader setup validation runtime");
-        let recorder = CapturingRecorder::default();
-        let previous = rustfs_io_metrics::get_stage_metrics_enabled();
-        rustfs_io_metrics::set_get_stage_metrics_enabled(true);
-        metrics::with_local_recorder(&recorder, || {
-            runtime.block_on(temp_env::async_with_vars(
-                [
-                    (rustfs_config::ENV_OBJECT_MMAP_READ_MAX_LENGTH, Some("4")),
-                    (rustfs_config::ENV_INTERNODE_PREWARM, Some("false")),
-                ],
-                async {
-                    let bucket = "batch-path-attribution";
-                    let object = "object";
-                    let (_dirs, disks) = call_counter_local_disks(bucket, 2).await;
-                    let data_dir = Uuid::new_v4();
-                    let mut files = vec![FileInfo::new(object, 1, 1); 2];
-                    for (file, disk) in files.iter_mut().zip(&disks) {
-                        file.data_dir = Some(data_dir);
-                        disk.as_ref()
-                            .expect("local disk")
-                            .write_all(bucket, &format!("{object}/{data_dir}/part.1"), Bytes::from_static(b"data"))
-                            .await
-                            .expect("write batch fixture");
-                    }
-                    assert_eq!(object_mmap_read_max_length(), 4, "cap must be controlled by this test");
-                    for length in [3, 4] {
-                        let setup = create_bitrot_readers_until_quorum_with_preference(
-                            &files,
-                            &disks,
-                            bucket,
-                            object,
-                            1,
-                            0,
-                            length,
-                            4,
-                            HashAlgorithm::None,
-                            false,
-                            true,
-                            1,
-                            1,
-                            BitrotReaderSetupMode::ReadQuorum,
-                            false,
-                            None,
-                            None,
-                        )
-                        .await;
-                        assert_eq!(setup.readers.iter().flatten().count(), 2);
-                    }
-                    assert!(
-                        try_create_bitrot_readers_via_batch_pread(
-                            &files,
-                            &disks,
-                            bucket,
-                            object,
-                            1,
-                            0,
-                            5,
-                            4,
-                            HashAlgorithm::None,
-                            false,
-                        )
-                        .await
-                        .is_none(),
-                        "a read above the adjusted-length cap must fall back"
-                    );
-                    assert!(
-                        try_create_bitrot_readers_via_batch_pread(
-                            &files,
-                            &disks,
-                            bucket,
-                            object,
-                            1,
-                            0,
-                            4,
-                            4,
-                            HashAlgorithm::HighwayHash256S,
-                            false,
-                        )
-                        .await
-                        .is_none(),
-                        "checksum overhead must be included in the read cap"
-                    );
-                    let mut inline_files = files.clone();
-                    inline_files[0].data = Some(Bytes::from_static(b"data"));
-                    assert!(
-                        try_create_bitrot_readers_via_batch_pread(
-                            &inline_files,
-                            &disks,
-                            bucket,
-                            object,
-                            1,
-                            0,
-                            4,
-                            4,
-                            HashAlgorithm::None,
-                            false,
-                        )
-                        .await
-                        .is_none()
-                    );
-                    let mut endpoint = Endpoint::try_from("http://127.0.0.1:1/disk").expect("remote placeholder endpoint");
-                    endpoint.is_local = false;
-                    let remote = new_disk(
-                        &endpoint,
-                        &DiskOption {
-                            cleanup: false,
-                            health_check: false,
-                        },
-                    )
-                    .await
-                    .expect("remote placeholder must initialize without a connection");
-                    assert!(
-                        try_create_bitrot_readers_via_batch_pread(
-                            &files,
-                            &[Some(remote), None],
-                            bucket,
-                            object,
-                            1,
-                            0,
-                            4,
-                            4,
-                            HashAlgorithm::None,
-                            false,
-                        )
-                        .await
-                        .is_none(),
-                        "any remote shard must keep the setup out of the local batch path"
-                    );
-                    assert!(
-                        try_create_bitrot_readers_via_batch_pread(
-                            &files,
-                            &disks,
-                            bucket,
-                            "../outside",
-                            1,
-                            0,
-                            4,
-                            4,
-                            HashAlgorithm::None,
-                            false,
-                        )
-                        .await
-                        .is_none()
-                    );
-                    let missing = vec![None, None];
-                    assert!(
-                        try_create_bitrot_readers_via_batch_pread(
-                            &files,
-                            &missing,
-                            bucket,
-                            object,
-                            1,
-                            0,
-                            4,
-                            4,
-                            HashAlgorithm::None,
-                            false,
-                        )
-                        .await
-                        .is_none()
-                    );
-                    for (use_mmap, policy) in [
-                        (false, crate::set_disk::GetObjectReadPolicy::Default),
-                        (true, crate::set_disk::GetObjectReadPolicy::CopySource),
-                    ] {
-                        crate::set_disk::with_get_object_read_policy(policy, async {
-                            create_bitrot_readers_until_quorum_with_preference(
-                                &files,
-                                &missing,
-                                bucket,
-                                object,
-                                1,
-                                0,
-                                4,
-                                4,
-                                HashAlgorithm::None,
-                                false,
-                                use_mmap,
-                                1,
-                                1,
-                                BitrotReaderSetupMode::ReadQuorum,
-                                false,
-                                None,
-                                None,
-                            )
-                            .await;
-                        })
-                        .await;
-                    }
-                },
-            ));
-        });
-        rustfs_io_metrics::set_get_stage_metrics_enabled(previous);
-        let metric = "rustfs_io_get_object_local_batch_decisions_total";
-        for (decision, expected) in [
-            ("selected", 2),
-            ("read_cap_exceeded", 2),
-            ("inline_data", 1),
-            ("invalid_path", 1),
-            ("non_local_shard", 1),
-            ("no_local_shards", 1),
-            ("mmap_disabled", 1),
-            ("copy_source", 1),
-        ] {
-            assert_eq!(recorder.counter_value(metric, &[("decision", decision)]), expected, "{decision}");
-        }
-        assert_eq!(
-            recorder.counter_value("rustfs_io_get_object_local_batch_shards_total", &[("outcome", "success")]),
-            4
-        );
-        assert_eq!(recorder.counter_value("rustfs_io_get_object_local_batch_read_bytes_total", &[]), 14);
-        assert_eq!(recorder.histogram_sample_count("rustfs_io_get_object_local_batch_prepare_seconds"), 8);
-    }
-
     async fn reopen_local_disk(dir: &TempDir) -> DiskStore {
         let endpoint =
             Endpoint::try_from(dir.path().to_str().expect("tempdir path should be utf8")).expect("endpoint should parse");

crates/ecstore/src/set_disk/mod.rs

@@ -1024,19 +1024,6 @@ impl GetObjectFileInfo {
         self.as_parts().0
     }
 
-    /// Marks an exact-version selection as the object's latest version after
-    /// the versions above it were skipped as dangling.
-    fn mark_selected_as_latest(&mut self) {
-        if let Some(OwnedGetObjectFileInfo {
-            payload: OwnedGetObjectFileInfoPayload::Direct { fi, .. },
-            ..
-        }) = self.owned.as_mut()
-        {
-            fi.is_latest = true;
-            fi.successor_mod_time = None;
-        }
-    }
-
     fn parts_metadata(&self) -> &[FileInfo] {
         self.as_parts().1
     }
@@ -4245,23 +4232,14 @@ pub(super) struct MultipartWriteQuorumContext<'a> {
     part_number: Option<usize>,
 }
 
-fn record_multipart_write_quorum_failure(
-    stage: &'static str,
-    errs: &[Option<DiskError>],
-    write_quorum: usize,
-) -> crate::disk::error_reduce::WriteQuorumFailureSummary {
-    let summary = build_write_quorum_failure_summary(errs, OBJECT_OP_IGNORED_ERRS, write_quorum);
-    runtime_sources::record_erasure_write_quorum_failure(stage, summary.dominant_error_label);
-    summary
-}
-
 fn log_multipart_write_quorum_failure(
     context: MultipartWriteQuorumContext<'_>,
     errs: &[Option<DiskError>],
     write_quorum: usize,
     returned_error: &DiskError,
 ) {
-    let summary = record_multipart_write_quorum_failure(context.stage, errs, write_quorum);
+    let summary = build_write_quorum_failure_summary(errs, OBJECT_OP_IGNORED_ERRS, write_quorum);
+    runtime_sources::record_erasure_write_quorum_failure(context.stage, summary.dominant_error_label);
     warn!(
         target: "rustfs_ecstore::set_disk",
         event = EVENT_SET_DISK_MULTIPART,
@@ -6863,17 +6841,6 @@ impl SetDisks {
         Ok(())
     }
 
-    /// Whether any drive holds `version_id` of the key, including a copy on
-    /// fewer drives than read quorum that object reads report as absent.
-    pub(crate) async fn holds_version_on_any_drive(&self, bucket: &str, object: &str, version_id: Uuid) -> bool {
-        let disks = self.disk_inventory().await;
-        let (copies, _) = Self::read_all_raw_file_info(&disks, bucket, object, false).await;
-        copies
-            .iter()
-            .flatten()
-            .any(|copy| FileMeta::load(&copy.buf).is_ok_and(|meta| meta.find_version(Some(version_id)).is_ok()))
-    }
-
     /// Publish an internal tier free-version record without changing its
     /// delete-marker shape or remote-tier identity. The caller holds the
     /// source and target object locks; a write quorum is required before the

crates/ecstore/src/set_disk/ops/multipart.rs

@@ -44,9 +44,9 @@ use super::super::{
     create_bitrot_writer, debug, disk, error, file_info_is_valid_for_metadata, get_complete_multipart_md5, get_header_map,
     get_str, insert_str, is_err_object_not_found, is_err_version_not_found, is_min_allowed_part_size,
     log_multipart_write_quorum_failure, parts_after_marker, path_join_buf, prepare_complete_multipart_parts,
-    record_compression_total_memory, record_multipart_write_quorum_failure, reduce_read_quorum_errs, reduce_write_quorum_errs,
-    remove_header_map, resolve_write_layout, restore_commit_operation_id_from_metadata, should_persist_encryption_original_size,
-    strip_internal_multipart_metadata, to_object_err, warn,
+    record_compression_total_memory, reduce_read_quorum_errs, reduce_write_quorum_errs, remove_header_map, resolve_write_layout,
+    restore_commit_operation_id_from_metadata, should_persist_encryption_original_size, strip_internal_multipart_metadata,
+    to_object_err, warn,
 };
 use super::bitrot_self_verify::{BitrotSelfVerifyTarget, drop_failed_writer_disks, verify_written_bitrot_shards};
 #[cfg(test)]
@@ -233,19 +233,6 @@ fn admitted_multipart_size(current: u64, candidate: u64, limit: u64) -> Result<u
     Ok(total)
 }
 
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum MultipartMetadataQuorum {
-    Read,
-    Write,
-    Cleanup,
-}
-
-impl From<bool> for MultipartMetadataQuorum {
-    fn from(write: bool) -> Self {
-        if write { Self::Write } else { Self::Read }
-    }
-}
-
 pub(crate) struct StaleMultipartCleanupGuard {
     file_info: FileInfo,
     upload_path: String,
@@ -1152,7 +1139,7 @@ impl SetDisks {
             }
             let upload_id = runtime_sources::deployment_upload_id(raw_upload_id);
             let file_info = match self
-                .check_multipart_upload_path_exists(bucket, object, &upload_id, &upload_path, MultipartMetadataQuorum::Read, true)
+                .check_multipart_upload_path_exists(bucket, object, &upload_id, &upload_path, false, true)
                 .await
             {
                 Ok((file_info, _)) => file_info,
@@ -1239,7 +1226,7 @@ impl SetDisks {
             .acquire_write_lock_diag("abort_data_movement_multipart", RUSTFS_META_MULTIPART_BUCKET, &upload_path)
             .await?;
         let file_info = match self
-            .check_multipart_upload_path_exists(bucket, object, upload_id, &upload_path, MultipartMetadataQuorum::Write, true)
+            .check_multipart_upload_path_exists(bucket, object, upload_id, &upload_path, true, true)
             .await
         {
             Ok((file_info, _)) => file_info,
@@ -1346,7 +1333,7 @@ impl SetDisks {
         data_movement: bool,
     ) -> Result<(FileInfo, Vec<FileInfo>)> {
         let upload_id_path = Self::validated_multipart_upload_path(bucket, object, upload_id, data_movement)?;
-        self.check_multipart_upload_path_exists(bucket, object, upload_id, &upload_id_path, write.into(), false)
+        self.check_multipart_upload_path_exists(bucket, object, upload_id, &upload_id_path, write, false)
             .await
     }
 
@@ -1386,7 +1373,7 @@ impl SetDisks {
         object: &str,
         upload_id: &str,
         upload_id_path: &str,
-        quorum_mode: MultipartMetadataQuorum,
+        write: bool,
         include_recovery: bool,
     ) -> Result<(FileInfo, Vec<FileInfo>)> {
         // Slow metadata I/O must not hold the topology registry's read lock.
@@ -1502,26 +1489,22 @@ impl SetDisks {
         }
 
         let mut quorum = read_quorum as usize;
-        if quorum_mode != MultipartMetadataQuorum::Read {
+        if write {
             quorum = write_quorum as usize;
 
             if let Some(err) = reduce_write_quorum_errs(&errs, OBJECT_OP_IGNORED_ERRS, quorum) {
-                if quorum_mode == MultipartMetadataQuorum::Write {
-                    log_multipart_write_quorum_failure(
-                        MultipartWriteQuorumContext {
-                            stage: MULTIPART_WRITE_QUORUM_UPLOAD_METADATA,
-                            bucket,
-                            object,
-                            upload_id,
-                            part_number: None,
-                        },
-                        &errs,
-                        quorum,
-                        &err,
-                    );
-                } else {
-                    record_multipart_write_quorum_failure(MULTIPART_WRITE_QUORUM_UPLOAD_METADATA, &errs, quorum);
-                }
+                log_multipart_write_quorum_failure(
+                    MultipartWriteQuorumContext {
+                        stage: MULTIPART_WRITE_QUORUM_UPLOAD_METADATA,
+                        bucket,
+                        object,
+                        upload_id,
+                        part_number: None,
+                    },
+                    &errs,
+                    quorum,
+                    &err,
+                );
                 return Err(map_error(err));
             }
         } else if let Some(err) = reduce_read_quorum_errs(&errs, OBJECT_OP_IGNORED_ERRS, quorum) {
@@ -1540,7 +1523,7 @@ impl SetDisks {
             .acquire_write_lock_diag("stale_multipart_cleanup", RUSTFS_META_MULTIPART_BUCKET, upload_path)
             .await?;
         let (file_info, _) = self
-            .check_multipart_upload_path_exists("", "", "", upload_path, MultipartMetadataQuorum::Cleanup, true)
+            .check_multipart_upload_path_exists("", "", "", upload_path, true, true)
             .await?;
         let write_quorum = file_info.write_quorum(self.default_write_quorum());
         Ok(StaleMultipartCleanupGuard {
@@ -3049,7 +3032,7 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for SetDisks {
         // its full write quorum and the upload's incarnation/lifecycle fences.
         let upload_id_path = Self::validated_multipart_upload_path(bucket, object, upload_id, opts.data_movement)?;
         let (fi, _) = self
-            .check_multipart_upload_path_exists(bucket, object, upload_id, &upload_id_path, MultipartMetadataQuorum::Read, true)
+            .check_multipart_upload_path_exists(bucket, object, upload_id, &upload_id_path, false, true)
             .await?;
         ensure_data_movement_upload_access(&fi, bucket, object, upload_id, opts)?;
         ensure_multipart_bucket_incarnation(&self.ctx, &fi, bucket, object, upload_id, opts.expected_bucket_incarnation_id)
@@ -3209,14 +3192,7 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for SetDisks {
                     }
                     SourceRecovery::Missing => {
                         return match self
-                            .check_multipart_upload_path_exists(
-                                bucket,
-                                object,
-                                upload_id,
-                                &upload_id_path,
-                                MultipartMetadataQuorum::Read,
-                                true,
-                            )
+                            .check_multipart_upload_path_exists(bucket, object, upload_id, &upload_id_path, false, true)
                             .await
                         {
                             Ok(_) => Err(Error::ErasureWriteQuorum),
@@ -11157,7 +11133,7 @@ mod tests {
             *disk = None;
         }
         let (info, _) = set
-            .check_multipart_upload_path_exists(bucket, object, &upload, &path, MultipartMetadataQuorum::Read, true)
+            .check_multipart_upload_path_exists(bucket, object, &upload, &path, false, true)
             .await
             .expect("four primary plus four recovery copies reach metadata read quorum");
         assert_eq!(info.name, path);
@@ -11178,7 +11154,7 @@ mod tests {
             *disk = None;
         }
         assert!(
-            set.check_multipart_upload_path_exists(bucket, object, &upload, &path, MultipartMetadataQuorum::Read, true)
+            set.check_multipart_upload_path_exists(bucket, object, &upload, &path, false, true)
                 .await
                 .is_err(),
             "two files on each of four disks must not count as eight voters"
@@ -14495,7 +14471,7 @@ mod tests {
                     object,
                     &u_new,
                     &SetDisks::get_upload_id_dir(bucket, object, &u_new),
-                    MultipartMetadataQuorum::Write,
+                    true,
                     true,
                 )
                 .await
@@ -14540,7 +14516,7 @@ mod tests {
                 object,
                 &upload,
                 &SetDisks::get_upload_id_dir(bucket, object, &upload),
-                MultipartMetadataQuorum::Write,
+                true,
                 true,
             )
             .await
@@ -14623,7 +14599,7 @@ mod tests {
                     assert_completion_files_preserved(&disk_stores, RUSTFS_META_MULTIPART_BUCKET, &source_files).await;
                     set_disks
                         .check_multipart_upload_path_exists(
-                            bucket, object, &u_new, &SetDisks::get_upload_id_dir(bucket, object, &u_new), MultipartMetadataQuorum::Write, true,
+                            bucket, object, &u_new, &SetDisks::get_upload_id_dir(bucket, object, &u_new), true, true,
                         )
                         .await
                         .expect("upload authority must survive the post-commit crash");

crates/ecstore/src/set_disk/ops/multipart_abort_tests.rs

@@ -507,7 +507,7 @@ mod native_abort_closure_tests {
         let path = SetDisks::get_upload_id_dir(bucket, object, &upload);
         pin_historical_unmarked_upload(&disks, bucket, &path).await;
         let before = originals(&disks, &path).await;
-        set.check_multipart_upload_path_exists(bucket, object, &upload, &path, MultipartMetadataQuorum::Read, true)
+        set.check_multipart_upload_path_exists(bucket, object, &upload, &path, false, true)
             .await
             .expect("readonly legacy cleanup identity lookup");
         assert_eq!(
@@ -786,7 +786,7 @@ mod native_abort_closure_tests {
             "known orphan native evidence remains unknown: {inspected:?}"
         );
         let readonly = set
-            .check_multipart_upload_path_exists(bucket, object, &upload, &path, MultipartMetadataQuorum::Read, true)
+            .check_multipart_upload_path_exists(bucket, object, &upload, &path, false, true)
             .await;
         assert!(
             matches!(

crates/ecstore/src/set_disk/ops/object.rs

@@ -8839,7 +8839,7 @@ impl SetDisks {
         // quorum, failing write quorum on update_object_meta (backlog#872).
         let read_opts = opts.as_read_opts();
         let (mut fi, _, disks) = self
-            .get_object_fileinfo_for_metadata_update(bucket, object, &read_opts)
+            .get_object_fileinfo_gated(bucket, object, &read_opts, false, false)
             .await?
             .into_owned();
 
@@ -9294,56 +9294,36 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
             }
         };
 
-        let src_version_id = src_opts.version_id.as_deref().unwrap_or_default();
-        let quorum = Self::object_quorum_from_meta(&metas, &errs, self.default_parity_count);
-        let selection = match &quorum {
-            Ok((read_quorum, write_quorum)) => {
-                let read_quorum = usize::try_from(*read_quorum)
-                    .map_err(|_| to_object_err(DiskError::ErasureReadQuorum.into(), vec![src_bucket, src_object]))?;
-                let write_quorum = usize::try_from(*write_quorum)
-                    .map_err(|_| to_object_err(DiskError::ErasureWriteQuorum.into(), vec![src_bucket, src_object]))?;
-                Self::select_fileinfo_for_read(src_bucket, &disks, &metas, &errs, src_version_id, read_quorum, write_quorum)
-                    .map(|(online_disks, fi)| (online_disks, fi, write_quorum))
-            }
-            Err(err) => Err(err.clone()),
-        };
-        let (online_disks, mut fi, write_quorum) = match selection {
-            Ok(selection) => selection,
+        let (read_quorum, write_quorum) = match Self::object_quorum_from_meta(&metas, &errs, self.default_parity_count) {
+            Ok((r, w)) => (
+                usize::try_from(r)
+                    .map_err(|_| to_object_err(DiskError::ErasureReadQuorum.into(), vec![src_bucket, src_object]))?,
+                usize::try_from(w)
+                    .map_err(|_| to_object_err(DiskError::ErasureWriteQuorum.into(), vec![src_bucket, src_object]))?,
+            ),
             Err(mut err) => {
-                // The merged latest version can be one a failed PUT left below
-                // quorum; resolve it like a latest GET before the dangling
-                // cleanup below can report a key with a committed version absent.
-                if let Some(snapshot) = self
-                    .select_latest_past_dangling_versions(src_bucket, src_object, src_opts, true, &disks, &err)
-                    .await
+                if err == DiskError::ErasureReadQuorum
+                    && !src_bucket.starts_with(RUSTFS_META_BUCKET)
+                    && self
+                        .delete_if_dangling(src_bucket, src_object, &metas, &errs, &HashMap::new(), src_opts.clone())
+                        .await
+                        .is_ok()
                 {
-                    // A version-only copy writes the served version's own
-                    // copies, so they and its write quorum replace the latest
-                    // read's.
-                    let (fi, parts_metadata, online_disks) = snapshot.into_owned();
-                    metas = parts_metadata;
-                    let write_quorum = fi.write_quorum(self.default_write_quorum());
-                    (online_disks, fi, write_quorum)
-                } else {
-                    if quorum.is_err()
-                        && err == DiskError::ErasureReadQuorum
-                        && !src_bucket.starts_with(RUSTFS_META_BUCKET)
-                        && self
-                            .delete_if_dangling(src_bucket, src_object, &metas, &errs, &HashMap::new(), src_opts.clone())
-                            .await
-                            .is_ok()
-                    {
-                        if src_opts.version_id.is_some() {
-                            err = DiskError::FileVersionNotFound
-                        } else {
-                            err = DiskError::FileNotFound
-                        }
+                    if src_opts.version_id.is_some() {
+                        err = DiskError::FileVersionNotFound
+                    } else {
+                        err = DiskError::FileNotFound
                     }
-                    return Err(to_object_err(err.into(), vec![src_bucket, src_object]));
                 }
+                return Err(to_object_err(err.into(), vec![src_bucket, src_object]));
             }
         };
 
+        let src_version_id = src_opts.version_id.as_deref().unwrap_or_default();
+        let (online_disks, mut fi) =
+            Self::select_fileinfo_for_read(src_bucket, &disks, &metas, &errs, src_version_id, read_quorum, write_quorum)
+                .map_err(|e| to_object_err(e.into(), vec![src_bucket, src_object]))?;
+
         if fi.deleted {
             if src_opts.version_id.is_none() {
                 return Err(to_object_err(Error::FileNotFound, vec![src_bucket, src_object]));
@@ -9481,16 +9461,6 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
                 }
             }
 
-            // A version-only copy writes and then reverts on a quorum miss;
-            // refuse it before writing when the served version's disks cannot
-            // reach its write quorum even if every write succeeds.
-            let reachable = online_disks
-                .iter()
-                .map(|disk| disk.is_none().then_some(DiskError::DiskNotFound))
-                .collect::<Vec<_>>();
-            if let Some(err) = reduce_write_quorum_errs(&reachable, OBJECT_OP_IGNORED_ERRS, write_quorum) {
-                return Err(to_object_err(err.into(), vec![src_bucket, src_object]));
-            }
             Self::write_unique_file_info(&online_disks, "", src_bucket, src_object, &metas, write_quorum)
                 .await
                 .map_err(|e| to_object_err(e.into(), vec![src_bucket, src_object]))?;
@@ -11177,63 +11147,45 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
             }
         };
 
-        let version_id = opts.version_id.as_deref().unwrap_or_default();
-        let quorum = Self::object_quorum_from_meta(&metas, &errs, self.default_parity_count);
-        let selection = match &quorum {
-            Ok((read_quorum, write_quorum)) => {
-                let read_quorum = usize::try_from(*read_quorum)
-                    .map_err(|_| to_object_err(DiskError::ErasureReadQuorum.into(), vec![bucket, object]))?;
-                let write_quorum = usize::try_from(*write_quorum)
-                    .map_err(|_| to_object_err(DiskError::ErasureWriteQuorum.into(), vec![bucket, object]))?;
-                Self::select_fileinfo_for_read(bucket, &disks, &metas, &errs, version_id, read_quorum, write_quorum)
-            }
-            Err(err) => Err(err.clone()),
-        };
-        let (online_disks, mut fi) = match selection {
-            Ok(selection) => selection,
+        let (read_quorum, write_quorum) = match Self::object_quorum_from_meta(&metas, &errs, self.default_parity_count) {
+            Ok((read_quorum, write_quorum)) => (read_quorum, write_quorum),
             Err(mut err) => {
-                // The merged latest version can be one a failed PUT left below
-                // quorum; resolve it like a latest GET before the dangling
-                // cleanup below can report a key with a committed version absent.
-                // A replication terminal CAS stays side-effect free: the walk
-                // queues heal for the versions it skips, so it does not run.
-                let resolved = if opts.replication_status_writeback.is_none() {
-                    self.select_latest_past_dangling_versions(bucket, object, opts, false, &disks, &err)
-                        .await
-                } else {
-                    None
-                };
-                if let Some(snapshot) = resolved {
-                    let (fi, _, online_disks) = snapshot.into_owned();
-                    (online_disks, fi)
-                } else {
-                    // A replication terminal CAS is a validation/write-back
-                    // attempt, never a heal operation. In particular,
-                    // ValidateOnly must remain zero-write, and a worker whose
-                    // outer replication lease is already lost must not delete
-                    // the surviving xl.meta copies before the namespace fence
-                    // below can reject it. Leave dangling cleanup to
-                    // heal/scanner.
-                    if quorum.is_err()
-                        && opts.replication_status_writeback.is_none()
-                        && err == DiskError::ErasureReadQuorum
-                        && !bucket.starts_with(RUSTFS_META_BUCKET)
-                        && self
-                            .delete_if_dangling(bucket, object, &metas, &errs, &HashMap::new(), opts.clone())
-                            .await
-                            .is_ok()
-                    {
-                        if opts.version_id.is_some() {
-                            err = DiskError::FileVersionNotFound
-                        } else {
-                            err = DiskError::FileNotFound
-                        }
-                    }
+                // A replication terminal CAS is a validation/write-back
+                // attempt, never a heal operation. In particular,
+                // ValidateOnly must remain zero-write, and a worker whose
+                // outer replication lease is already lost must not delete the
+                // surviving xl.meta copies before the namespace fence below
+                // can reject it. Leave dangling cleanup to heal/scanner.
+                if opts.replication_status_writeback.is_some() {
                     return Err(to_object_err(err.into(), vec![bucket, object]));
                 }
+                if err == DiskError::ErasureReadQuorum
+                    && !bucket.starts_with(RUSTFS_META_BUCKET)
+                    && self
+                        .delete_if_dangling(bucket, object, &metas, &errs, &HashMap::new(), opts.clone())
+                        .await
+                        .is_ok()
+                {
+                    if opts.version_id.is_some() {
+                        err = DiskError::FileVersionNotFound
+                    } else {
+                        err = DiskError::FileNotFound
+                    }
+                }
+                return Err(to_object_err(err.into(), vec![bucket, object]));
             }
         };
 
+        let read_quorum =
+            usize::try_from(read_quorum).map_err(|_| to_object_err(DiskError::ErasureReadQuorum.into(), vec![bucket, object]))?;
+        let write_quorum = usize::try_from(write_quorum)
+            .map_err(|_| to_object_err(DiskError::ErasureWriteQuorum.into(), vec![bucket, object]))?;
+
+        let version_id = opts.version_id.as_deref().unwrap_or_default();
+        let (online_disks, mut fi) =
+            Self::select_fileinfo_for_read(bucket, &disks, &metas, &errs, version_id, read_quorum, write_quorum)
+                .map_err(|e| to_object_err(e.into(), vec![bucket, object]))?;
+
         if fi.deleted {
             return Err(to_object_err(Error::MethodNotAllowed, vec![bucket, object]));
         }

crates/ecstore/src/set_disk/read.rs

@@ -264,11 +264,6 @@ enum MetadataReadPurpose {
     GetObjectReader,
 }
 
-/// Upper bound on exact-version reads a latest read spends looking past
-/// dangling versions before it keeps the read-quorum error; each read is one
-/// metadata fan-out.
-const MAX_DANGLING_LATEST_VERSIONS: usize = 8;
-
 /// How a metadata read-quorum failure is reported when the replies prove the
 /// object or version dangling. Only the object read entry points
 /// (`get_object_info`, `get_object_reader` and prepared GET metadata) report
@@ -278,10 +273,6 @@ const MAX_DANGLING_LATEST_VERSIONS: usize = 8;
 #[derive(Clone, Copy, PartialEq, Eq)]
 enum DanglingRead {
     KeepQuorumError,
-    /// Metadata updates of the latest version keep the quorum error but, like
-    /// object reads, look past newer versions proven dangling
-    /// (`read_latest_past_dangling_versions`).
-    SkipDanglingVersions,
     ReportNotFound,
 }
 
@@ -733,10 +724,9 @@ impl SetDisks {
     }
 
     /// Like `get_object_fileinfo`, but `allow_early_stop=false` forces the full
-    /// quorum fanout. Read-before-write callers must use this or
-    /// `get_object_fileinfo_for_metadata_update`: the returned online-disk set
-    /// is the write target, and the early-stop subset would fail write quorum
-    /// (backlog#872 regression fix).
+    /// quorum fanout. Read-before-write callers (object tagging) must use this:
+    /// the returned online-disk set is the write target, and the early-stop
+    /// subset would fail write quorum (backlog#872 regression fix).
     #[tracing::instrument(level = "debug", skip(self))]
     pub(in crate::set_disk) async fn get_object_fileinfo_gated(
         &self,
@@ -758,64 +748,6 @@ impl SetDisks {
         .await
     }
 
-    /// The full-fanout read behind a metadata update such as object tagging.
-    /// A latest read whose newest versions never committed resolves to the
-    /// version a latest GET serves, while a dangling key keeps the quorum
-    /// error. The returned online disks are the write target.
-    #[tracing::instrument(level = "debug", skip(self))]
-    pub(in crate::set_disk) async fn get_object_fileinfo_for_metadata_update(
-        &self,
-        bucket: &str,
-        object: &str,
-        opts: &ObjectOptions,
-    ) -> Result<GetObjectFileInfo> {
-        self.get_object_fileinfo_gated_inner(
-            bucket,
-            object,
-            opts,
-            false,
-            false,
-            MetadataReadPurpose::FullLayout,
-            DanglingRead::SkipDanglingVersions,
-        )
-        .await
-    }
-
-    /// Recovers a failed latest selection in read-before-write callers that
-    /// read and select metadata themselves (`put_object_metadata` and the
-    /// CopyObject source) the way a latest GET does. `None` keeps the caller's
-    /// error: a failure other than read quorum, an explicit version, the
-    /// system bucket's commit-proof rule, or a walk that finds no readable
-    /// version or cannot read every drive. The selected metadata keeps its
-    /// part checksums because a version-only copy carries them into the new
-    /// version.
-    pub(in crate::set_disk) async fn select_latest_past_dangling_versions(
-        &self,
-        bucket: &str,
-        object: &str,
-        opts: &ObjectOptions,
-        read_data: bool,
-        disks: &[Option<DiskStore>],
-        err: &DiskError,
-    ) -> Option<GetObjectFileInfo> {
-        if *err != DiskError::ErasureReadQuorum || opts.version_id.is_some() || crate::bucket::utils::is_meta_bucketname(bucket) {
-            return None;
-        }
-        let opts = ObjectOptions {
-            include_part_checksums: true,
-            ..opts.clone()
-        };
-        Box::pin(self.read_latest_past_dangling_versions(
-            bucket,
-            object,
-            &opts,
-            read_data,
-            MetadataReadPurpose::FullLayout,
-            disks,
-        ))
-        .await
-    }
-
     #[allow(clippy::too_many_arguments)]
     async fn get_object_fileinfo_gated_inner(
         &self,
@@ -1039,18 +971,6 @@ impl SetDisks {
             {
                 Ok(selection) => selection,
                 Err(err) => {
-                    if err == DiskError::ErasureReadQuorum
-                        && vid.is_empty()
-                        && dangling_read != DanglingRead::KeepQuorumError
-                        && metadata_fanout_complete
-                        && !crate::bucket::utils::is_meta_bucketname(bucket)
-                        && let Some(snapshot) =
-                            Box::pin(self.read_latest_past_dangling_versions(bucket, object, opts, read_data, purpose, &disks))
-                                .await
-                    {
-                        rustfs_io_metrics::record_get_object_metadata_quorum_result(metadata_metrics_path, "reached");
-                        return Ok(snapshot);
-                    }
                     let err = StorageError::from(err);
                     rustfs_io_metrics::record_get_object_metadata_quorum_result(
                         metadata_metrics_path,
@@ -1131,168 +1051,6 @@ impl SetDisks {
         Ok(snapshot)
     }
 
-    /// A latest read whose split cannot reach read quorum may still have a
-    /// readable older version under newer versions that never committed;
-    /// MinIO resolves this in `pickLatestQuorumFilesInfo`. With every drive
-    /// answering, try versions newest first through exact-version reads and
-    /// serve the readable one with the newest selected modification time. A
-    /// version whose exact read proves it dangling (the NoSuchVersion an
-    /// explicit GET reports) is skipped and queued for heal, which owns its
-    /// cleanup; any other outcome keeps the read-quorum error.
-    async fn read_latest_past_dangling_versions(
-        &self,
-        bucket: &str,
-        object: &str,
-        opts: &ObjectOptions,
-        read_data: bool,
-        purpose: MetadataReadPurpose,
-        disks: &[Option<DiskStore>],
-    ) -> Option<GetObjectFileInfo> {
-        let disk_object = rustfs_utils::path::encode_dir_object(object);
-        let (raw, errs) = Self::read_all_raw_file_info(disks, bucket, &disk_object, false).await;
-        if errs
-            .iter()
-            .any(|err| err.as_ref().is_some_and(|err| !matches!(err, DiskError::FileNotFound)))
-        {
-            return None;
-        }
-        // Stacks are newest first, so only each drive's first few headers can
-        // matter. Keep a version's newest modification time across drives: a
-        // rewritten null version can carry different times on different drives.
-        let mut newest = std::collections::HashMap::<Option<uuid::Uuid>, Option<time::OffsetDateTime>>::new();
-        let mut truncated = false;
-        let mut metadata = Vec::with_capacity(raw.len());
-        for raw in raw.into_iter().flatten() {
-            let mut meta = rustfs_filemeta::FileMeta::load(&raw.buf).ok()?;
-            let mut versions = meta
-                .versions
-                .iter()
-                .enumerate()
-                .filter(|(_, version)| !version.header.free_version());
-            let mut retained_end = 0;
-            for (index, version) in versions.by_ref().take(MAX_DANGLING_LATEST_VERSIONS) {
-                let mod_time = newest.entry(version.header.version_id).or_insert(version.header.mod_time);
-                *mod_time = (*mod_time).max(version.header.mod_time);
-                retained_end = index + 1;
-            }
-            truncated |= versions.next().is_some();
-            meta.versions.truncate(retained_end);
-            metadata.push(meta);
-        }
-        let mut candidates = newest.into_iter().collect::<Vec<_>>();
-        candidates.sort_by(|left, right| right.1.cmp(&left.1).then_with(|| left.0.cmp(&right.0)));
-
-        // Use the stored header for equal-time ordering: re-encoding a selected
-        // FileInfo can change legacy signatures or omit part-checksum metadata.
-        let selected_header = |snapshot: &GetObjectFileInfo| {
-            let mut selected = snapshot.fi().clone();
-            selected.data = None;
-            let version_id = selected.version_id.unwrap_or_else(uuid::Uuid::nil).to_string();
-            let include_part_checksums =
-                opts.include_part_checksums || opts.part_number.is_some() || opts.data_movement || opts.raw_data_movement_read;
-            metadata.iter().find_map(|meta| {
-                let version = meta
-                    .versions
-                    .iter()
-                    .filter(|version| !version.header.free_version())
-                    .take(MAX_DANGLING_LATEST_VERSIONS)
-                    .find(|version| {
-                        version.header.version_id.unwrap_or_else(uuid::Uuid::nil)
-                            == selected.version_id.unwrap_or_else(uuid::Uuid::nil)
-                            && version.header.mod_time == selected.mod_time
-                    })?;
-                let mut original = if include_part_checksums {
-                    meta.into_fileinfo(&selected.volume, &selected.name, &version_id, false, opts.incl_free_versions, true)
-                } else {
-                    meta.into_fileinfo_without_part_checksums(
-                        &selected.volume,
-                        &selected.name,
-                        &version_id,
-                        false,
-                        opts.incl_free_versions,
-                    )
-                }
-                .ok()?;
-                if !include_part_checksums {
-                    rustfs_utils::http::remove_str(&mut original.metadata, rustfs_utils::http::SUFFIX_PART_CHECKSUMS);
-                }
-                original.data = None;
-                original.is_latest = selected.is_latest;
-                original.successor_mod_time = selected.successor_mod_time;
-                original.num_versions = selected.num_versions;
-                (original == selected).then_some(version.header.clone())
-            })
-        };
-
-        let mut best: Option<(Option<time::OffsetDateTime>, GetObjectFileInfo)> = None;
-        let mut skipped = Vec::new();
-        let mut settled = false;
-        for (reads, (version_id, newest_mod_time)) in candidates.into_iter().enumerate() {
-            if best.as_ref().is_some_and(|(selected, _)| newest_mod_time < *selected) {
-                settled = true;
-                break;
-            }
-            if reads == MAX_DANGLING_LATEST_VERSIONS {
-                return None;
-            }
-            // The nil UUID addresses the null version slot at this layer.
-            let version_id = version_id.unwrap_or_else(uuid::Uuid::nil).to_string();
-            let exact = ObjectOptions {
-                version_id: Some(version_id.clone()),
-                ..opts.clone()
-            };
-            match Box::pin(self.get_object_fileinfo_gated_inner(
-                bucket,
-                object,
-                &exact,
-                read_data,
-                false,
-                purpose,
-                DanglingRead::ReportNotFound,
-            ))
-            .await
-            {
-                Ok(snapshot) => {
-                    let selected = snapshot.fi().mod_time;
-                    let replace = match best.as_ref() {
-                        Some((current, previous)) if selected == *current => {
-                            selected_header(&snapshot)?.sorts_before(&selected_header(previous)?)
-                        }
-                        Some((current, _)) => selected > *current,
-                        None => true,
-                    };
-                    if replace {
-                        best = Some((selected, snapshot));
-                    }
-                }
-                Err(StorageError::VersionNotFound(..)) => skipped.push(version_id),
-                Err(_) => return None,
-            }
-        }
-        // Headers past each drive's first few were not compared; only a walk
-        // that proved no remaining candidate can be newer may stop early.
-        if !settled && truncated {
-            return None;
-        }
-        let (_, mut snapshot) = best?;
-        snapshot.mark_selected_as_latest();
-        if !opts.suppress_read_repair {
-            for version_id in &skipped {
-                submit_read_repair_heal(
-                    bucket,
-                    object,
-                    Some(version_id),
-                    self.pool_index,
-                    self.set_index,
-                    None,
-                    "dangling_latest_version",
-                )
-                .await;
-            }
-        }
-        Some(snapshot)
-    }
-
     #[hotpath::measure(impl_type = "SetDisks")]
     pub(super) async fn get_object_info_fileinfo_and_quorum(
         &self,
@@ -9993,7 +9751,6 @@ mod dangling_read_tests {
     use crate::storage_api_contracts::bucket::{BucketOperations, MakeBucketOptions};
     use crate::storage_api_contracts::object::ObjectOperations;
     use http::HeaderMap;
-    use std::collections::HashMap;
     use std::path::PathBuf;
     use tempfile::TempDir;
     use tokio::io::AsyncReadExt;
@@ -10004,13 +9761,9 @@ mod dangling_read_tests {
     const PARITY: usize = 2;
 
     async fn dangling_test_set(bucket: &str) -> (Vec<TempDir>, Arc<SetDisks>) {
-        dangling_test_set_with(bucket, DRIVES, PARITY).await
-    }
-
-    async fn dangling_test_set_with(bucket: &str, drives: usize, parity: usize) -> (Vec<TempDir>, Arc<SetDisks>) {
         let ctx = Arc::new(crate::runtime::instance::InstanceContext::new());
         ctx.update_erasure_type(crate::layout::endpoints::SetupType::Erasure).await;
-        let (dirs, set) = crate::ecstore_validation_blackbox::make_local_set_disks_with_ctx(drives, parity, ctx).await;
+        let (dirs, set) = crate::ecstore_validation_blackbox::make_local_set_disks_with_ctx(DRIVES, PARITY, ctx).await;
         set.make_bucket(bucket, &MakeBucketOptions::default())
             .await
             .expect("test bucket should be created on every drive");
@@ -10024,9 +9777,6 @@ mod dangling_read_tests {
             &mut PutObjReader::from_vec(body.to_vec()),
             &ObjectOptions {
                 versioned,
-                // Wait for every drive so tests that edit one drive's metadata
-                // do not race the PUT's background tail writes.
-                write_completion: crate::object_api::WriteCompletion::TailDrained,
                 ..Default::default()
             },
         )
@@ -10046,25 +9796,6 @@ mod dangling_read_tests {
         }
     }
 
-    /// Drops `version_id` from `disks`, modelling drives a failed PUT never
-    /// reached while the older versions below it stay intact.
-    async fn drop_version_from(set: &SetDisks, bucket: &str, object: &str, version_id: Uuid, disks: std::ops::Range<usize>) {
-        let all = set.disks.read().await.clone();
-        for disk in &all[disks] {
-            let disk = disk.as_ref().expect("every drive should be online");
-            let mut remove = FileInfo {
-                volume: bucket.to_string(),
-                name: object.to_string(),
-                version_id: Some(version_id),
-                ..Default::default()
-            };
-            remove.set_skip_tier_free_version();
-            disk.delete_version(bucket, object, remove, false, DeleteOptions::default())
-                .await
-                .expect("dropping the version should model a drive that never received it");
-        }
-    }
-
     fn read_opts(version_id: Option<&str>) -> ObjectOptions {
         ObjectOptions {
             version_id: version_id.map(str::to_owned),
@@ -10224,642 +9955,12 @@ mod dangling_read_tests {
         head(&set, bucket, object, Some(&v1))
             .await
             .expect("HEAD of the committed version must succeed");
-        // The latest read sees version two on three drives and version one on
-        // the rest. Version two's exact read proves it dangling, so the latest
-        // read serves version one, the newest version an exact read can serve.
-        let latest = head(&set, bucket, object, None)
-            .await
-            .expect("the latest read must serve the newest readable version");
-        assert_eq!(latest.version_id.map(|id| id.to_string()).as_deref(), Some(v1.as_str()));
-        assert_eq!(get(&set, bucket, object, None).await.expect("latest GET"), b"version one");
-    }
-
-    #[tokio::test]
-    async fn latest_read_skips_dangling_versions_above_a_committed_version() {
-        // EC 12+4: a failed PUT that left version two on 5..=11 drives keeps
-        // version one, present in every stack, below its read quorum of twelve
-        // when only the top of each stack is read. Up to seven copies the
-        // listing quorum already shows version one; from eight it lists the
-        // dangling version two.
-        let bucket = "dangling-latest-12-4";
-        let (_dirs, set) = dangling_test_set_with(bucket, 16, 4).await;
-        for copies in 5..=11 {
-            let object = format!("torn/latest-{copies:02}");
-            let v1 = put(&set, bucket, &object, b"committed version", true)
-                .await
-                .version_id
-                .expect("versioned PUT should assign a version id");
-            let v2 = put(&set, bucket, &object, b"failed overwrite", true)
-                .await
-                .version_id
-                .expect("versioned PUT should assign a version id");
-            drop_version_from(&set, bucket, &object, v2, copies..16).await;
-
-            let context = format!("version two on {copies} of 16 drives");
-            let latest = head(&set, bucket, &object, None)
-                .await
-                .unwrap_or_else(|err| panic!("{context}: HEAD must serve version one: {err:?}"));
-            assert_eq!(latest.version_id, Some(v1), "{context}");
-            assert!(latest.is_latest, "{context}: the served version is the latest one");
-            assert_eq!(
-                get(&set, bucket, &object, None)
-                    .await
-                    .unwrap_or_else(|err| panic!("{context}: GET must serve version one: {err:?}")),
-                b"committed version",
-                "{context}"
-            );
-            let Err(err) = head(&set, bucket, &object, Some(&v2.to_string())).await else {
-                panic!("{context}: the dangling version must not be served");
-            };
-            assert!(matches!(err, StorageError::VersionNotFound(..)), "{context}: {err:?}");
-        }
-    }
-
-    #[tokio::test]
-    async fn latest_read_keeps_quorum_error_when_the_newest_version_is_uncertain() {
-        // Version two is on every drive, but a torn metadata update left two
-        // identities at one modification time, three copies each. Its exact
-        // read fails with a quorum error rather than NoSuchVersion, so the
-        // walk must not fall through to version one.
-        let bucket = "dangling-latest-uncertain";
-        let object = "torn/latest";
-        let (_dirs, set) = dangling_test_set(bucket).await;
-        put(&set, bucket, object, b"version one", true).await;
-        let v2 = put(&set, bucket, object, b"version two", true)
-            .await
-            .version_id
-            .expect("versioned PUT should assign a version id")
-            .to_string();
-        let disks = set.disks.read().await.clone();
-        for disk in disks.iter().take(3) {
-            let disk = disk.as_ref().expect("every drive should be online");
-            let mut fi = disk
-                .read_version("", bucket, object, &v2, &ReadOptions::default())
-                .await
-                .expect("version two should be on every drive");
-            fi.metadata.insert("x-amz-meta-torn".to_string(), "half-applied".to_string());
-            disk.update_metadata(bucket, object, fi, &crate::disk::UpdateMetadataOpts::default())
-                .await
-                .expect("a half-applied metadata update should be stored");
-        }
-
-        assert_get_and_head_keep_read_quorum_error(&set, bucket, object, "torn metadata update on version two").await;
-    }
-
-    #[tokio::test]
-    async fn latest_read_serves_a_committed_null_version_below_a_dangling_version() {
-        // A null version written while versioning was suspended sits between
-        // version one and a dangling version three. The walk reaches the null
-        // slot through the nil UUID and serves it, not version one.
-        let bucket = "dangling-latest-null";
-        let object = "torn/latest";
-        let (_dirs, set) = dangling_test_set(bucket).await;
-        let v1 = put(&set, bucket, object, b"version one", true)
-            .await
-            .version_id
-            .expect("versioned PUT should assign a version id");
-        set.put_object(
-            bucket,
-            object,
-            &mut PutObjReader::from_vec(b"null version".to_vec()),
-            &ObjectOptions {
-                version_suspended: true,
-                write_completion: crate::object_api::WriteCompletion::TailDrained,
-                ..Default::default()
-            },
-        )
-        .await
-        .expect("a suspended-versioning PUT should commit the null version");
-        let v3 = put(&set, bucket, object, b"version three", true)
-            .await
-            .version_id
-            .expect("versioned PUT should assign a version id");
-        drop_version_from(&set, bucket, object, v3, 3..DRIVES).await;
-
-        let latest = head(&set, bucket, object, None)
-            .await
-            .expect("the committed null version must be served");
-        assert_ne!(latest.version_id, Some(v1));
-        assert_ne!(latest.version_id, Some(v3));
-        assert!(latest.is_latest);
-        assert_eq!(get(&set, bucket, object, None).await.expect("latest GET"), b"null version");
-    }
-
-    #[tokio::test]
-    async fn latest_read_orders_versions_by_their_newest_modification_time() {
-        // Drive 0 missed the suspended-versioning rewrite of the null version,
-        // so its null copy predates version one while every other drive holds
-        // the committed rewrite. Ordering by the first drive's time would try
-        // version one before the null version and serve it.
-        let bucket = "dangling-latest-order";
-        let object = "torn/latest";
-        let (dirs, set) = dangling_test_set(bucket).await;
-        let suspended = ObjectOptions {
-            version_suspended: true,
-            write_completion: crate::object_api::WriteCompletion::TailDrained,
-            ..Default::default()
+        // The latest read sees two generations (version two on three drives,
+        // version one on the rest), which is not proof of absence.
+        let Err(err) = head(&set, bucket, object, None).await else {
+            panic!("a split latest version must not resolve without quorum");
         };
-        set.put_object(bucket, object, &mut PutObjReader::from_vec(b"stale null".to_vec()), &suspended)
-            .await
-            .expect("the first null version should commit");
-        let v1 = put(&set, bucket, object, b"version one", true)
-            .await
-            .version_id
-            .expect("versioned PUT should assign a version id");
-        let drive_zero = object_dir(&dirs, 0, bucket, object).join(STORAGE_FORMAT_FILE);
-        let stale = tokio::fs::read(&drive_zero)
-            .await
-            .expect("drive zero metadata should be readable");
-        set.put_object(bucket, object, &mut PutObjReader::from_vec(b"committed null".to_vec()), &suspended)
-            .await
-            .expect("the null rewrite should commit");
-        tokio::fs::write(&drive_zero, stale)
-            .await
-            .expect("drive zero should keep the pre-rewrite stack");
-        let v5 = put(&set, bucket, object, b"version five", true)
-            .await
-            .version_id
-            .expect("versioned PUT should assign a version id");
-        drop_version_from(&set, bucket, object, v5, 3..DRIVES).await;
-
-        let latest = head(&set, bucket, object, None)
-            .await
-            .expect("the committed null rewrite must be served");
-        assert_ne!(latest.version_id, Some(v1));
-        assert_eq!(get(&set, bucket, object, None).await.expect("latest GET"), b"committed null");
-    }
-
-    #[tokio::test]
-    async fn latest_read_preserves_object_before_equal_time_marker() {
-        let bucket = "dangling-latest-equal-time-marker";
-        let (_dirs, set) = dangling_test_set(bucket).await;
-        let same_time = time::OffsetDateTime::from_unix_timestamp(1_700_000_000).expect("fixed source mtime");
-        for suspended in [false, true] {
-            let object = if suspended {
-                "torn/equal-time-null"
-            } else {
-                "torn/equal-time-versioned"
-            };
-            let object_id = if suspended { Uuid::nil() } else { Uuid::from_u128(2) };
-            set.put_object(
-                bucket,
-                object,
-                &mut PutObjReader::from_vec(b"committed object".to_vec()),
-                &ObjectOptions {
-                    versioned: !suspended,
-                    version_suspended: suspended,
-                    replication_request: true,
-                    version_id: Some(object_id.to_string()),
-                    mod_time: Some(same_time),
-                    write_completion: crate::object_api::WriteCompletion::TailDrained,
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("commit object version");
-            set.delete_object(
-                bucket,
-                object,
-                ObjectOptions {
-                    versioned: true,
-                    version_id: Some(Uuid::from_u128(1).to_string()),
-                    mod_time: Some(same_time),
-                    data_movement: true,
-                    delete_marker: true,
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("recreate source delete marker during data movement");
-            let expected = head(&set, bucket, object, None)
-                .await
-                .expect("canonical latest before dangling write");
-            assert_eq!(expected.version_id, (!suspended).then_some(object_id));
-            assert!(!expected.delete_marker, "canonical header order prefers object to equal-time marker");
-            assert_eq!(get(&set, bucket, object, None).await.expect("canonical GET"), b"committed object");
-            let dangling_id = Uuid::from_u128(3);
-            set.put_object(
-                bucket,
-                object,
-                &mut PutObjReader::from_vec(b"failed newer version".to_vec()),
-                &ObjectOptions {
-                    versioned: true,
-                    replication_request: true,
-                    version_id: Some(dangling_id.to_string()),
-                    mod_time: Some(same_time + time::Duration::seconds(1)),
-                    write_completion: crate::object_api::WriteCompletion::TailDrained,
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("commit newer version before modeling failed rollback");
-            drop_version_from(&set, bucket, object, dangling_id, 3..DRIVES).await;
-            let actual = head(&set, bucket, object, None)
-                .await
-                .expect("latest HEAD past dangling version");
-            let actual_get = get(&set, bucket, object, None).await;
-            assert_eq!(
-                actual.version_id, expected.version_id,
-                "{object}: unreadable newer version must preserve canonical equal-time latest; GET result: {actual_get:?}"
-            );
-            assert!(
-                !actual.delete_marker,
-                "{object}: fallback must preserve the object before its equal-time marker"
-            );
-            assert_eq!(actual_get.expect("latest GET"), b"committed object");
-
-            let checksum_opts = ObjectOptions {
-                include_part_checksums: true,
-                ..Default::default()
-            };
-            let checksum_head = set
-                .get_object_info(bucket, object, &checksum_opts)
-                .await
-                .expect("latest HEAD with part checksums");
-            assert_eq!(checksum_head.version_id, expected.version_id, "{object}: checksum HEAD version");
-            assert!(!checksum_head.delete_marker, "{object}: checksum HEAD must return the object");
-            let mut checksum_reader = set
-                .get_object_reader(bucket, object, None, HeaderMap::new(), &checksum_opts)
-                .await
-                .expect("latest GET with part checksums");
-            let mut checksum_body = Vec::new();
-            checksum_reader
-                .stream
-                .read_to_end(&mut checksum_body)
-                .await
-                .expect("checksum GET should stream the committed bytes");
-            assert_eq!(checksum_body, b"committed object", "{object}: checksum GET bytes");
-        }
-    }
-
-    #[tokio::test]
-    async fn latest_read_past_dangling_versions_requires_every_drive_to_answer() {
-        let bucket = "dangling-latest-offline";
-        let object = "torn/latest";
-        let (_dirs, set) = dangling_test_set(bucket).await;
-        put(&set, bucket, object, b"version one", true).await;
-        let v2 = put(&set, bucket, object, b"version two", true)
-            .await
-            .version_id
-            .expect("versioned PUT should assign a version id");
-        drop_version_from(&set, bucket, object, v2, 3..DRIVES).await;
-        // The offline drive may hold the copy that makes version two readable.
-        let offline = set.disks.write().await[5].take().expect("drive five should start online");
-
-        assert_get_and_head_keep_read_quorum_error(&set, bucket, object, "one drive offline").await;
-
-        set.disks.write().await[5] = Some(offline);
-        let latest = head(&set, bucket, object, None)
-            .await
-            .expect("with every drive answering the dangling version is skipped");
-        assert_ne!(latest.version_id, Some(v2));
-    }
-
-    /// Version one on every drive under a version two that a failed PUT left
-    /// on drives `0..3`, below the read quorum of four.
-    async fn put_committed_below_dangling(set: &SetDisks, bucket: &str, object: &str) -> (Uuid, Uuid) {
-        let v1 = put(set, bucket, object, b"version one", true)
-            .await
-            .version_id
-            .expect("versioned PUT should assign a version id");
-        let v2 = put(set, bucket, object, b"version two", true)
-            .await
-            .version_id
-            .expect("versioned PUT should assign a version id");
-        drop_version_from(set, bucket, object, v2, 3..DRIVES).await;
-        (v1, v2)
-    }
-
-    /// Each drive's copy of `version_id`, or `None` where the drive lacks it.
-    async fn version_metadata(
-        set: &SetDisks,
-        bucket: &str,
-        object: &str,
-        version_id: Uuid,
-    ) -> Vec<Option<HashMap<String, String>>> {
-        let disks = set.disks.read().await.clone();
-        let mut copies = Vec::with_capacity(disks.len());
-        for disk in &disks {
-            let disk = disk.as_ref().expect("every drive should be online");
-            copies.push(
-                disk.read_version("", bucket, object, &version_id.to_string(), &ReadOptions::default())
-                    .await
-                    .ok()
-                    .map(|fi| fi.metadata),
-            );
-        }
-        copies
-    }
-
-    #[tokio::test]
-    async fn latest_tagging_skips_dangling_versions_above_a_committed_version() {
-        let bucket = "dangling-latest-tagging";
-        let object = "torn/latest";
-        let (_dirs, set) = dangling_test_set(bucket).await;
-        let (v1, v2) = put_committed_below_dangling(&set, bucket, object).await;
-        let tag_of = |metadata: &Option<HashMap<String, String>>| {
-            metadata
-                .as_ref()
-                .and_then(|metadata| metadata.get(rustfs_utils::http::headers::AMZ_OBJECT_TAGGING).cloned())
-        };
-
-        let tagged = set
-            .put_object_tags(bucket, object, "stage=committed", &ObjectOptions::default())
-            .await
-            .expect("PutObjectTagging must update the version a latest GET serves");
-        assert_eq!(tagged.version_id, Some(v1));
-        for (disk, metadata) in version_metadata(&set, bucket, object, v1).await.iter().enumerate() {
-            assert_eq!(
-                tag_of(metadata).as_deref(),
-                Some("stage=committed"),
-                "drive {disk} must carry the tag on version one"
-            );
-        }
-        for (disk, metadata) in version_metadata(&set, bucket, object, v2).await.iter().enumerate() {
-            assert_eq!(tag_of(metadata), None, "drive {disk} must leave the dangling version untouched");
-        }
-        assert_eq!(*head(&set, bucket, object, None).await.expect("latest HEAD").user_tags, "stage=committed");
-
-        let untagged = set
-            .delete_object_tags(bucket, object, &ObjectOptions::default())
-            .await
-            .expect("DeleteObjectTagging must update the version a latest GET serves");
-        assert_eq!(untagged.version_id, Some(v1));
-        for (disk, metadata) in version_metadata(&set, bucket, object, v1).await.iter().enumerate() {
-            assert_eq!(tag_of(metadata).as_deref(), Some(""), "drive {disk} must clear the tag on version one");
-        }
-    }
-
-    #[tokio::test]
-    async fn latest_metadata_update_skips_dangling_versions_above_a_committed_version() {
-        let bucket = "dangling-latest-metadata";
-        let object = "torn/latest";
-        let (_dirs, set) = dangling_test_set(bucket).await;
-        let (v1, v2) = put_committed_below_dangling(&set, bucket, object).await;
-
-        let updated = set
-            .put_object_metadata(
-                bucket,
-                object,
-                &ObjectOptions {
-                    versioned: true,
-                    eval_metadata: Some(HashMap::from([("x-amz-meta-probe".to_string(), "updated".to_string())])),
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("a latest metadata update must target the version a latest GET serves");
-        assert_eq!(updated.version_id, Some(v1));
-        assert!(updated.is_latest, "the updated version is the latest one");
-        for (disk, metadata) in version_metadata(&set, bucket, object, v1).await.iter().enumerate() {
-            let metadata = metadata.as_ref().expect("version one is on every drive");
-            assert_eq!(metadata.get("x-amz-meta-probe").map(String::as_str), Some("updated"), "drive {disk}");
-        }
-        for (disk, metadata) in version_metadata(&set, bucket, object, v2).await.iter().enumerate() {
-            assert!(
-                metadata
-                    .as_ref()
-                    .is_none_or(|metadata| !metadata.contains_key("x-amz-meta-probe")),
-                "drive {disk} must leave the dangling version untouched"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn latest_copy_source_skips_dangling_versions_above_a_committed_version() {
-        let bucket = "dangling-latest-copy";
-        let (_dirs, set) = dangling_test_set(bucket).await;
-
-        // A metadata-only self-copy rewrites the latest version in place.
-        let object = "torn/in-place";
-        let (v1, _) = put_committed_below_dangling(&set, bucket, object).await;
-        let mut source = head(&set, bucket, object, None).await.expect("latest HEAD");
-        assert_eq!(source.version_id, Some(v1));
-        source.metadata_only = true;
-        source.user_defined = Arc::new(HashMap::from([("x-amz-meta-copied".to_string(), "in-place".to_string())]));
-        let copied = set
-            .copy_object(
-                bucket,
-                object,
-                bucket,
-                object,
-                &mut source,
-                &ObjectOptions::default(),
-                &ObjectOptions::default(),
-            )
-            .await
-            .expect("a CopyObject source without a version id must resolve like a latest GET");
-        assert_eq!(copied.version_id, Some(v1));
-        for (disk, metadata) in version_metadata(&set, bucket, object, v1).await.iter().enumerate() {
-            let metadata = metadata.as_ref().expect("version one is on every drive");
-            assert_eq!(metadata.get("x-amz-meta-copied").map(String::as_str), Some("in-place"), "drive {disk}");
-        }
-
-        // A version-only self-copy commits a new version that shares the
-        // served version's data.
-        let object = "torn/new-version";
-        let (_, v2) = put_committed_below_dangling(&set, bucket, object).await;
-        let v3 = Uuid::new_v4();
-        let mut source = head(&set, bucket, object, None).await.expect("latest HEAD");
-        source.version_only = true;
-        let copied = set
-            .copy_object(
-                bucket,
-                object,
-                bucket,
-                object,
-                &mut source,
-                &ObjectOptions {
-                    versioned: true,
-                    ..Default::default()
-                },
-                &ObjectOptions {
-                    version_id: Some(v3.to_string()),
-                    versioned: true,
-                    object_lock_config_snapshot: Some(Arc::new(crate::object_api::ObjectLockConfigSnapshot::new(
-                        crate::bucket::metadata_sys::ObjectLockConfigState::ConfirmedAbsent,
-                    ))),
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("a version-only CopyObject source without a version id must resolve like a latest GET");
-        assert_eq!(copied.version_id, Some(v3));
-        let latest = head(&set, bucket, object, None).await.expect("latest HEAD");
-        assert_eq!(latest.version_id, Some(v3));
-        assert_eq!(get(&set, bucket, object, None).await.expect("latest GET"), b"version one");
-        assert!(
-            version_metadata(&set, bucket, object, v2).await[..3]
-                .iter()
-                .all(Option::is_some),
-            "the copy must not remove the dangling version; heal owns its cleanup"
-        );
-    }
-
-    #[tokio::test]
-    async fn latest_metadata_update_past_dangling_versions_keeps_write_quorum() {
-        // EC 3+3: read quorum three, write quorum four. Version one reached
-        // three drives, so it is readable but below write quorum; versions two
-        // and three are dangling on two drives each. A latest read serves
-        // version one, and a metadata update of it is refused before writing.
-        let bucket = "dangling-latest-write-quorum";
-        let object = "torn/latest";
-        let (_dirs, set) = dangling_test_set_with(bucket, 6, 3).await;
-        let mut versions = Vec::new();
-        for body in [b"version zero".as_slice(), b"version one", b"version two", b"version three"] {
-            versions.push(
-                put(&set, bucket, object, body, true)
-                    .await
-                    .version_id
-                    .expect("versioned PUT should assign a version id"),
-            );
-        }
-        let [_, v1, v2, v3] = versions[..] else {
-            unreachable!("four versions were written");
-        };
-        drop_version_from(&set, bucket, object, v1, 3..6).await;
-        drop_version_from(&set, bucket, object, v2, 2..6).await;
-        drop_version_from(&set, bucket, object, v3, 0..3).await;
-        drop_version_from(&set, bucket, object, v3, 5..6).await;
-
-        let latest = head(&set, bucket, object, None)
-            .await
-            .expect("version one is readable at read quorum");
-        assert_eq!(latest.version_id, Some(v1));
-
-        let is_write_quorum_error =
-            |err: &StorageError| matches!(err, StorageError::ErasureWriteQuorum | StorageError::InsufficientWriteQuorum(_, _));
-        let Err(err) = set
-            .put_object_tags(bucket, object, "stage=refused", &ObjectOptions::default())
-            .await
-        else {
-            panic!("tagging a version below write quorum must be refused");
-        };
-        assert!(is_write_quorum_error(&err), "tagging keeps the write-quorum error: {err:?}");
-        let Err(err) = set
-            .put_object_metadata(
-                bucket,
-                object,
-                &ObjectOptions {
-                    versioned: true,
-                    eval_metadata: Some(HashMap::from([("x-amz-meta-probe".to_string(), "refused".to_string())])),
-                    ..Default::default()
-                },
-            )
-            .await
-        else {
-            panic!("a metadata update of a version below write quorum must be refused");
-        };
-        assert!(is_write_quorum_error(&err), "the metadata update keeps the write-quorum error: {err:?}");
-        let v4 = Uuid::new_v4();
-        let mut source = head(&set, bucket, object, None).await.expect("latest HEAD");
-        source.version_only = true;
-        let Err(err) = set
-            .copy_object(
-                bucket,
-                object,
-                bucket,
-                object,
-                &mut source,
-                &ObjectOptions {
-                    versioned: true,
-                    ..Default::default()
-                },
-                &ObjectOptions {
-                    version_id: Some(v4.to_string()),
-                    versioned: true,
-                    object_lock_config_snapshot: Some(Arc::new(crate::object_api::ObjectLockConfigSnapshot::new(
-                        crate::bucket::metadata_sys::ObjectLockConfigState::ConfirmedAbsent,
-                    ))),
-                    ..Default::default()
-                },
-            )
-            .await
-        else {
-            panic!("a version-only copy of a version below write quorum must be refused");
-        };
-        assert!(is_write_quorum_error(&err), "the version-only copy keeps the write-quorum error: {err:?}");
-        assert!(
-            version_metadata(&set, bucket, object, v4).await.iter().all(Option::is_none),
-            "a refused version-only copy must not write the new version to any drive"
-        );
-        for (disk, metadata) in version_metadata(&set, bucket, object, v1).await.iter().enumerate() {
-            assert!(
-                metadata.as_ref().is_none_or(|metadata| {
-                    !metadata.contains_key(rustfs_utils::http::headers::AMZ_OBJECT_TAGGING)
-                        && !metadata.contains_key("x-amz-meta-probe")
-                }),
-                "drive {disk} must not be written by a refused update"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn replication_status_writeback_never_walks_past_dangling_versions() {
-        // A replication terminal CAS stays side-effect free: it keeps the
-        // read-quorum error instead of resolving the latest version, so it
-        // neither queues heal for the dangling version nor writes version one.
-        let bucket = "dangling-latest-replication-cas";
-        let object = "torn/latest";
-        let (_dirs, set) = dangling_test_set(bucket).await;
-        let (v1, _) = put_committed_below_dangling(&set, bucket, object).await;
-
-        let Err(err) = set
-            .put_object_metadata(
-                bucket,
-                object,
-                &ObjectOptions {
-                    versioned: true,
-                    eval_metadata: Some(HashMap::from([("x-amz-meta-probe".to_string(), "written".to_string())])),
-                    replication_status_writeback: Some(Box::new(crate::object_api::ReplicationStatusWritebackCondition {
-                        mode: crate::object_api::ReplicationStatusWritebackMode::ValidateOnly,
-                        ..Default::default()
-                    })),
-                    ..Default::default()
-                },
-            )
-            .await
-        else {
-            panic!("a replication terminal CAS must not resolve past a dangling version");
-        };
-        assert!(is_read_quorum_error(&err), "the CAS keeps the read-quorum error: {err:?}");
-        for (disk, metadata) in version_metadata(&set, bucket, object, v1).await.iter().enumerate() {
-            let metadata = metadata.as_ref().expect("version one is on every drive");
-            assert!(!metadata.contains_key("x-amz-meta-probe"), "drive {disk} must not be written");
-        }
-    }
-
-    #[tokio::test]
-    async fn latest_metadata_updates_past_dangling_versions_require_every_drive_to_answer() {
-        let bucket = "dangling-latest-update-offline";
-        let object = "torn/latest";
-        let (_dirs, set) = dangling_test_set(bucket).await;
-        put_committed_below_dangling(&set, bucket, object).await;
-        let offline = set.disks.write().await[5].take().expect("drive five should start online");
-
-        let Err(err) = set
-            .put_object_tags(bucket, object, "stage=uncertain", &ObjectOptions::default())
-            .await
-        else {
-            panic!("tagging must not resolve past a version an offline drive may commit");
-        };
-        assert!(is_read_quorum_error(&err), "tagging keeps the read-quorum error: {err:?}");
-        let Err(err) = set
-            .put_object_metadata(
-                bucket,
-                object,
-                &ObjectOptions {
-                    versioned: true,
-                    eval_metadata: Some(HashMap::from([("x-amz-meta-probe".to_string(), "uncertain".to_string())])),
-                    ..Default::default()
-                },
-            )
-            .await
-        else {
-            panic!("a metadata update must not resolve past a version an offline drive may commit");
-        };
-        assert!(is_read_quorum_error(&err), "the metadata update keeps the read-quorum error: {err:?}");
-        set.disks.write().await[5] = Some(offline);
+        assert!(is_read_quorum_error(&err), "a split latest version keeps the quorum error: {err:?}");
     }
 
     #[tokio::test]

crates/ecstore/src/store/mod.rs

@@ -452,8 +452,6 @@ pub use object::{
 };
 mod peer;
 mod rebalance;
-#[cfg(test)]
-pub(crate) use rebalance::PoolSpaceForTest;
 pub(crate) mod utils;
 
 use peer::init_local_peer;

crates/ecstore/src/store/object.rs

@@ -4291,40 +4291,8 @@ impl ECStore {
                 .select_decommission_capacity_target_pool(owner, expected_data_bytes)
                 .await;
         }
-        let holder = self
-            .data_movement_pool_holding_version(bucket, object, opts.version_id.as_deref(), opts.src_pool_idx)
-            .await;
-        self.get_available_pool_idx_preferring(bucket, object, size, None, holder)
-            .await
-            .ok_or(Error::DiskFull)
-    }
 
-    /// The target pool that already holds a copy of the exact version being
-    /// moved. An attempt that lost write quorum can leave that copy on fewer
-    /// drives than read quorum, which the pool lookup reports as absent; a
-    /// retry that placed the version on another pool would leave it in two.
-    /// Callers still subject the holder to the free-space checks, so a full
-    /// holder cannot pin every retry of a deferred entry.
-    async fn data_movement_pool_holding_version(
-        &self,
-        bucket: &str,
-        object: &str,
-        version_id: Option<&str>,
-        src_pool_idx: usize,
-    ) -> Option<usize> {
-        let version_id = Uuid::parse_str(version_id?).ok()?;
-        let holders = join_all(self.pools.iter().enumerate().map(|(pool_idx, pool)| async move {
-            // Match the pools the free-space choice can return.
-            if pool_idx == src_pool_idx || self.is_suspended(pool_idx).await || self.is_pool_rebalancing(pool_idx).await {
-                return None;
-            }
-            pool.get_disks_by_key(object)
-                .holds_version_on_any_drive(bucket, object, version_id)
-                .await
-                .then_some(pool_idx)
-        }))
-        .await;
-        holders.into_iter().flatten().next()
+        self.get_available_pool_idx(bucket, object, size).await.ok_or(Error::DiskFull)
     }
 
     async fn find_data_movement_target_info(
@@ -5452,10 +5420,7 @@ impl ECStore {
                         if let Some(owner) = DecommissionCapacityOwner::from_options(&opts) {
                             self.select_decommission_capacity_target_pool(owner, 0).await?
                         } else {
-                            let holder = self
-                                .data_movement_pool_holding_version(bucket, object, opts.version_id.as_deref(), opts.src_pool_idx)
-                                .await;
-                            self.get_available_pool_idx_preferring(bucket, object, 0, Some(opts.src_pool_idx), holder)
+                            self.get_available_pool_idx_excluding(bucket, object, 0, opts.src_pool_idx)
                                 .await
                                 .ok_or(Error::DiskFull)?
                         }

crates/ecstore/src/store/rebalance.rs

@@ -122,51 +122,6 @@ async fn pause_prepared_pool_read_before_refetch(object: &str) {
         state.refetch_release.notified().await;
     }
 }
-/// Capacity that every online drive of one pool reports to free-space target
-/// selection, per store, until the guard drops.
-#[cfg(test)]
-static POOL_SPACE_FOR_TEST: std::sync::Mutex<Vec<(Uuid, usize, crate::disk::DiskInfo)>> = std::sync::Mutex::new(Vec::new());
-
-#[cfg(test)]
-pub(crate) struct PoolSpaceForTest(Uuid);
-
-#[cfg(test)]
-impl PoolSpaceForTest {
-    pub(crate) fn install(store: Uuid, pools: &[(usize, crate::disk::DiskInfo)]) -> Self {
-        POOL_SPACE_FOR_TEST
-            .lock()
-            .expect("pool space override must not be poisoned")
-            .extend(pools.iter().map(|(pool, info)| (store, *pool, info.clone())));
-        Self(store)
-    }
-}
-
-#[cfg(test)]
-impl Drop for PoolSpaceForTest {
-    fn drop(&mut self) {
-        POOL_SPACE_FOR_TEST
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .retain(|(store, _, _)| *store != self.0);
-    }
-}
-
-#[cfg(test)]
-fn pool_space_for_test(
-    store: Uuid,
-    pool: usize,
-    infos: Vec<Option<crate::disk::DiskInfo>>,
-) -> Vec<Option<crate::disk::DiskInfo>> {
-    let overrides = POOL_SPACE_FOR_TEST.lock().expect("pool space override must not be poisoned");
-    let Some((_, _, info)) = overrides
-        .iter()
-        .find(|(override_store, override_pool, _)| *override_store == store && *override_pool == pool)
-    else {
-        return infos;
-    };
-    infos.into_iter().map(|disk| disk.map(|_| info.clone())).collect()
-}
-
 #[cfg(test)]
 use support::resolve_latest_object_info_candidates;
 use support::{
@@ -483,7 +438,30 @@ impl ECStore {
     }
 
     pub(super) async fn get_available_pool_idx(&self, bucket: &str, object: &str, size: i64) -> Option<usize> {
-        self.get_available_pool_idx_preferring(bucket, object, size, None, None).await
+        // // Return a random one first
+
+        let mut server_pools = self.get_server_pools_available_space(bucket, object, size).await;
+        server_pools.filter_max_used(100 - (100_f64 * DISK_RESERVE_FRACTION) as u64);
+        let total = server_pools.total_available();
+
+        if total == 0 {
+            return None;
+        }
+
+        let mut rng = rand::rng();
+        let random_u64: u64 = rng.random_range(0..total);
+
+        let choose = random_u64 % total;
+        let mut at_total = 0;
+
+        for pool in server_pools.iter() {
+            at_total += pool.available;
+            if at_total > choose && pool.available > 0 {
+                return Some(pool.index);
+            }
+        }
+
+        None
     }
 
     pub(super) async fn get_available_pool_idx_excluding(
@@ -492,33 +470,13 @@ impl ECStore {
         object: &str,
         size: i64,
         excluded_pool_idx: usize,
-    ) -> Option<usize> {
-        self.get_available_pool_idx_preferring(bucket, object, size, Some(excluded_pool_idx), None)
-            .await
-    }
-
-    /// Free-space choice among the pools that can take `size` more bytes,
-    /// weighted by available space. `preferred_pool_idx` is returned whenever
-    /// it passes the same checks, so a full or excluded pool is never forced.
-    pub(super) async fn get_available_pool_idx_preferring(
-        &self,
-        bucket: &str,
-        object: &str,
-        size: i64,
-        excluded_pool_idx: Option<usize>,
-        preferred_pool_idx: Option<usize>,
     ) -> Option<usize> {
         let mut server_pools = self.get_server_pools_available_space(bucket, object, size).await;
         server_pools.filter_max_used(100 - (100_f64 * DISK_RESERVE_FRACTION) as u64);
 
-        if let Some(pool) = excluded_pool_idx.and_then(|idx| server_pools.0.get_mut(idx)) {
+        if let Some(pool) = server_pools.0.get_mut(excluded_pool_idx) {
             pool.available = 0;
         }
-        if let Some(pool_idx) = preferred_pool_idx
-            && server_pools.0.get(pool_idx).is_some_and(|pool| pool.available > 0)
-        {
-            return Some(pool_idx);
-        }
 
         let total = server_pools.total_available();
         if total == 0 {
@@ -551,8 +509,6 @@ impl ECStore {
 
             let disks = pool.get_disks_by_key(object).disk_inventory().await;
             let disk_infos = get_disk_infos(&disks).await;
-            #[cfg(test)]
-            let disk_infos = pool_space_for_test(self.id, idx, disk_infos);
 
             (idx, pool.set_count, disk_infos)
         }))

crates/iam/src/delegation.rs

@@ -1,313 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-//! Durable restrictions owned by an authenticated user. A record is not an IAM
-//! grant or credential; issuing credentials still requires current IAM checks.
-use crate::{error::is_err_config_not_found, store::Store};
-use serde::{Deserialize, Serialize};
-
-const PREFIX: &str = "config/iam/plugin-delegations/v1";
-
-#[derive(Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct Restrictions {
-    #[serde(default, skip_serializing_if = "Option::is_none", deserialize_with = "present_value")]
-    pub version: Option<u32>,
-    #[serde(default, skip_serializing_if = "Option::is_none", deserialize_with = "present_value")]
-    pub output_bucket: Option<String>,
-    pub deployment: String,
-    pub bucket: String,
-    pub input_prefix: String,
-    pub output_prefix: String,
-    pub expires_at_unix_seconds: u64,
-}
-
-// An absent v1 field is compatible; an explicitly null v2 field is invalid.
-fn present_value<'de, T: Deserialize<'de>, D: serde::Deserializer<'de>>(deserializer: D) -> Result<Option<T>, D::Error> {
-    T::deserialize(deserializer).map(Some)
-}
-
-impl Restrictions {
-    pub fn output_bucket(&self) -> Result<&str, DelegationError> {
-        match (self.version, self.output_bucket.as_deref()) {
-            (None, None) => Ok(&self.bucket),
-            (Some(2), Some(output)) => Ok(output),
-            _ => Err(DelegationError::Invalid),
-        }
-    }
-
-    pub fn validate(&self, now: u64) -> Result<(), DelegationError> {
-        let output_bucket = self.output_bucket()?;
-        let names: [&str; 5] = [
-            &self.deployment,
-            &self.bucket,
-            &self.input_prefix,
-            &self.output_prefix,
-            output_bucket,
-        ];
-        if names
-            .iter()
-            .any(|s| s.is_empty() || s.len() > 1024 || s.contains("${") || s.chars().any(char::is_control))
-            || self.bucket.contains('/')
-            || self.bucket.contains('*')
-            || self.bucket.contains('?')
-            || output_bucket.contains('/')
-            || output_bucket.contains('*')
-            || output_bucket.contains('?')
-            || self.input_prefix.contains('*')
-            || self.input_prefix.contains('?')
-            || self.output_prefix.contains('*')
-            || self.output_prefix.contains('?')
-            || self.expires_at_unix_seconds <= now
-            || self.expires_at_unix_seconds.saturating_sub(now) > 86400
-        {
-            return Err(DelegationError::Invalid);
-        }
-        Ok(())
-    }
-}
-
-#[derive(Clone, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-pub struct Delegation {
-    pub version: u32,
-    pub id: String,
-    pub revision: String,
-    pub owner_access_key: String,
-    pub created_at_unix_seconds: u64,
-    pub restrictions: Restrictions,
-}
-
-#[derive(Serialize, Deserialize, PartialEq, Eq)]
-#[serde(deny_unknown_fields)]
-struct Tombstone {
-    version: u32,
-    id: String,
-    revision: String,
-    owner_access_key: String,
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum DelegationError {
-    #[error("invalid delegation restriction")]
-    Invalid,
-    #[error("delegation not found")]
-    NotFound,
-    #[error("delegation owner rejected")]
-    OwnerRejected,
-    #[error("delegation unavailable")]
-    Unavailable,
-    #[error("delegation revoked")]
-    Revoked,
-    #[error("delegation expired")]
-    Expired,
-}
-
-fn record_path(id: &str) -> Result<String, DelegationError> {
-    if id.len() != 32 || !id.bytes().all(|c| c.is_ascii_hexdigit()) {
-        return Err(DelegationError::Invalid);
-    }
-    Ok(format!("{PREFIX}/{id}/record.json"))
-}
-
-async fn load<T: Store>(store: &T, id: &str) -> Result<Delegation, DelegationError> {
-    let record: Delegation = store.load_iam_config_strict(record_path(id)?).await.map_err(|error| {
-        if is_err_config_not_found(&error) {
-            DelegationError::NotFound
-        } else {
-            DelegationError::Unavailable
-        }
-    })?;
-    if !matches!(record.version, 1 | 2)
-        || record.version != record.restrictions.version.unwrap_or(1)
-        || record.id != id
-        || record.revision != id
-        || record.owner_access_key.is_empty()
-    {
-        return Err(DelegationError::Unavailable);
-    }
-    record
-        .restrictions
-        .validate(record.created_at_unix_seconds)
-        .map_err(|_| DelegationError::Unavailable)?;
-    Ok(record)
-}
-
-pub(crate) async fn create<T: Store>(
-    store: &T,
-    owner: &str,
-    restrictions: Restrictions,
-    now: u64,
-) -> Result<Delegation, DelegationError> {
-    restrictions.validate(now)?;
-    if owner.is_empty() {
-        return Err(DelegationError::OwnerRejected);
-    }
-    // IDs are generated exclusively here; no update operation accepts an ID.
-    let id = format!("{:032x}", rand::random::<u128>());
-    let path = record_path(&id)?;
-    match store.load_iam_config_strict::<Delegation>(&path).await {
-        Err(error) if is_err_config_not_found(&error) => {}
-        _ => return Err(DelegationError::Unavailable),
-    }
-    let record = Delegation {
-        version: restrictions.version.unwrap_or(1),
-        revision: id.clone(),
-        id,
-        owner_access_key: owner.to_owned(),
-        created_at_unix_seconds: now,
-        restrictions,
-    };
-    store
-        .save_iam_config(&record, path)
-        .await
-        .map_err(|_| DelegationError::Unavailable)?;
-    if load(store, &record.id).await? != record {
-        return Err(DelegationError::Unavailable);
-    }
-    Ok(record)
-}
-
-pub(crate) async fn revoke<T: Store>(store: &T, owner: &str, id: &str) -> Result<(), DelegationError> {
-    let record = load(store, id).await?;
-    if record.owner_access_key != owner {
-        return Err(DelegationError::OwnerRejected);
-    }
-    let tombstone = Tombstone {
-        version: 1,
-        id: record.id,
-        revision: record.revision,
-        owner_access_key: record.owner_access_key,
-    };
-    let path = format!("{PREFIX}/{id}/revoked.json");
-    // Every retry writes exactly the same revocation; active records never change.
-    store
-        .save_iam_config(&tombstone, &path)
-        .await
-        .map_err(|_| DelegationError::Unavailable)?;
-    let saved: Tombstone = store
-        .load_iam_config_strict(path)
-        .await
-        .map_err(|_| DelegationError::Unavailable)?;
-    if saved != tombstone {
-        return Err(DelegationError::Unavailable);
-    }
-    Ok(())
-}
-
-pub(crate) async fn read_active<T: Store>(store: &T, owner: &str, id: &str, now: u64) -> Result<Delegation, DelegationError> {
-    let record = load(store, id).await?;
-    if record.owner_access_key != owner {
-        return Err(DelegationError::OwnerRejected);
-    }
-    check_active(store, record, now).await
-}
-
-pub(crate) async fn read_owned<T: Store>(store: &T, owner: &str, id: &str) -> Result<Delegation, DelegationError> {
-    let record = load(store, id).await?;
-    if record.owner_access_key != owner {
-        return Err(DelegationError::OwnerRejected);
-    }
-    Ok(record)
-}
-
-pub(crate) async fn read_active_for_broker<T: Store>(store: &T, id: &str, now: u64) -> Result<Delegation, DelegationError> {
-    let record = load(store, id).await?;
-    check_active(store, record, now).await
-}
-async fn check_active<T: Store>(store: &T, record: Delegation, now: u64) -> Result<Delegation, DelegationError> {
-    let id = &record.id;
-    match store
-        .load_iam_config_strict::<Tombstone>(format!("{PREFIX}/{id}/revoked.json"))
-        .await
-    {
-        Ok(_) => return Err(DelegationError::Revoked),
-        Err(error) if is_err_config_not_found(&error) => {}
-        Err(_) => return Err(DelegationError::Unavailable),
-    }
-    if now >= record.restrictions.expires_at_unix_seconds {
-        return Err(DelegationError::Expired);
-    }
-    Ok(record)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    #[test]
-    fn delegation_v1_json_remains_compatible() {
-        let legacy = serde_json::json!({"deployment":"runner-a","bucket":"photos",
-            "input_prefix":"inputs/","output_prefix":"outputs/","expires_at_unix_seconds":200});
-        let restriction: Restrictions = serde_json::from_value(legacy.clone()).expect("legacy restriction");
-        restriction.validate(100).expect("legacy validation");
-        assert_eq!(restriction.output_bucket().expect("v1 output"), "photos");
-        assert_eq!(serde_json::to_value(restriction).expect("legacy serialization"), legacy);
-        let record = serde_json::json!({"version":1,"id":"a".repeat(32),"revision":"a".repeat(32),
-            "owner_access_key":"owner","created_at_unix_seconds":100,"restrictions":legacy});
-        let decoded: Delegation = serde_json::from_value(record.clone()).expect("legacy record");
-        assert_eq!(serde_json::to_value(decoded).expect("legacy record serialization"), record);
-    }
-
-    #[test]
-    fn delegation_v2_requires_explicit_output_bucket() {
-        let valid = serde_json::json!({"version":2,"deployment":"runner-a","bucket":"photos",
-            "input_prefix":"inputs/","output_bucket":"artifacts","output_prefix":"outputs/",
-            "expires_at_unix_seconds":200});
-        let restriction: Restrictions = serde_json::from_value(valid.clone()).expect("v2 restriction");
-        restriction.validate(100).expect("explicit output bucket");
-        assert_eq!(restriction.output_bucket().expect("v2 output"), "artifacts");
-        assert_eq!(serde_json::to_value(restriction).expect("v2 serialization"), valid);
-        for key in ["version", "output_bucket"] {
-            let mut bad = valid.clone();
-            bad.as_object_mut().expect("object").remove(key);
-            assert!(
-                serde_json::from_value::<Restrictions>(bad).map_or(true, |r| r.validate(100).is_err()),
-                "v2 required {key}"
-            );
-        }
-        for (key, value) in [
-            ("version", serde_json::json!(1)),
-            ("version", serde_json::json!(3)),
-            ("version", serde_json::Value::Null),
-            ("output_bucket", serde_json::Value::Null),
-            ("output_bucket", serde_json::json!("")),
-            ("output_bucket", serde_json::json!("other/*")),
-            ("output_bucket", serde_json::json!("${aws:username}")),
-            ("output_bucket", serde_json::json!("other?")),
-            ("output_bucket", serde_json::json!("other\n")),
-            ("unknown", serde_json::json!(true)),
-        ] {
-            let mut bad = valid.clone();
-            bad[key] = value;
-            assert!(
-                serde_json::from_value::<Restrictions>(bad).map_or(true, |r| r.validate(100).is_err()),
-                "invalid v2 {key}"
-            );
-        }
-    }
-
-    #[test]
-    fn restrictions_are_literal_bounded_and_expiring() {
-        let mut restriction = Restrictions {
-            version: None,
-            output_bucket: None,
-            deployment: "runner-a".into(),
-            bucket: "photos".into(),
-            input_prefix: "inputs/".into(),
-            output_prefix: "outputs/".into(),
-            expires_at_unix_seconds: 200,
-        };
-        assert!(restriction.validate(100).is_ok());
-        restriction.output_prefix = "outputs/*".into();
-        assert!(matches!(restriction.validate(100), Err(DelegationError::Invalid)));
-        restriction.output_prefix = "outputs/".into();
-        assert!(matches!(restriction.validate(200), Err(DelegationError::Invalid)));
-        restriction.expires_at_unix_seconds = 200;
-        restriction.input_prefix = "inputs/${aws:username}/".into();
-        assert!(
-            matches!(restriction.validate(100), Err(DelegationError::Invalid)),
-            "C07_LITERAL_SCOPE_BOUND: policy variables are not literal restrictions"
-        );
-        assert!(record_path("../../users").is_err());
-    }
-}

crates/iam/src/lib.rs

@@ -28,7 +28,6 @@ pub(crate) const EVENT_OIDC_DIAGNOSTICS: &str = "oidc_diagnostics";
 const EVENT_OIDC_STATE: &str = "oidc_state";
 
 pub mod cache;
-pub mod delegation;
 pub mod error;
 pub mod federation;
 pub mod keyring;

crates/iam/src/storage_api.rs

@@ -91,7 +91,6 @@ pub(crate) mod crate_boundary {
 
 pub(crate) mod object_store {
     pub(crate) use super::storage_contracts::{HTTPPreconditions, ListOperations, ObjectInfoOrErr, ObjectOperations};
-    pub(crate) use rustfs_ecstore::api::config::com::read_config_preserve_empty_with_metadata_opts;
 }
 
 pub(crate) mod runtime {

crates/iam/src/store.rs

@@ -26,11 +26,6 @@ pub trait Store: Clone + Send + Sync + 'static {
     fn has_watcher(&self) -> bool;
     async fn save_iam_config<Item: Serialize + Send>(&self, item: Item, path: impl AsRef<str> + Send) -> Result<()>;
     async fn load_iam_config<Item: DeserializeOwned>(&self, path: impl AsRef<str> + Send) -> Result<Item>;
-    /// Only confirmed storage absence may return ConfigNotFound. Corrupt or
-    /// undecryptable objects must remain errors, especially for revocations.
-    async fn load_iam_config_strict<Item: DeserializeOwned>(&self, _path: impl AsRef<str> + Send) -> Result<Item> {
-        Err(crate::error::Error::IamSysNotInitialized)
-    }
     async fn delete_iam_config(&self, path: impl AsRef<str> + Send) -> Result<()>;
 
     async fn save_user_identity(&self, name: &str, user_type: UserType, item: UserIdentity, ttl: Option<usize>) -> Result<()>;

crates/iam/src/store/object.rs

@@ -42,7 +42,6 @@ use tracing::{debug, error, warn};
 
 use crate::storage_api::object_store::{
     HTTPPreconditions, ListOperations, ObjectInfoOrErr as StorageObjectInfoOrErr, ObjectOperations,
-    read_config_preserve_empty_with_metadata_opts,
 };
 
 pub static IAM_CONFIG_PREFIX: LazyLock<String> = LazyLock::new(|| format!("{IAM_CONFIG_ROOT_PREFIX}/iam"));
@@ -612,11 +611,6 @@ impl ObjectStore {
         Ok(serde_json::from_slice(&outcome.plain)?)
     }
 
-    fn decode_iam_config_strict<Item: DeserializeOwned>(data: &[u8]) -> Result<Item> {
-        let outcome = Self::decrypt_data_with_source(data)?;
-        Ok(serde_json::from_slice(&outcome.plain)?)
-    }
-
     /// Parameterized core of [`Store::load_user_identity`].
     async fn load_user_identity_with(&self, name: &str, user_type: UserType, mode: LoadMode) -> Result<UserIdentity> {
         let mut u: UserIdentity = self
@@ -830,12 +824,6 @@ impl Store for ObjectStore {
     async fn load_iam_config<Item: DeserializeOwned>(&self, path: impl AsRef<str> + Send) -> Result<Item> {
         self.load_iam_config_with(path, LoadMode::Locked).await
     }
-    async fn load_iam_config_strict<Item: DeserializeOwned>(&self, path: impl AsRef<str> + Send) -> Result<Item> {
-        let (data, _) =
-            read_config_preserve_empty_with_metadata_opts(self.object_api.clone(), path.as_ref(), &LoadMode::Locked.read_opts())
-                .await?;
-        Self::decode_iam_config_strict(&data)
-    }
     /// Saves IAM configuration with a retry mechanism on failure.
     ///
     /// Attempts to save the IAM configuration up to 5 times if the storage layer is not ready,
@@ -1470,40 +1458,6 @@ mod tests {
         assert!(result.is_err(), "corrupt stream_io data should fail decrypt");
     }
 
-    #[test]
-    fn strict_revocation_load_keeps_real_crypto_failure_distinct_from_absence() {
-        let cred = test_cred();
-        let key = format!("{}:{}", cred.access_key, cred.secret_key);
-        let plain = br#"{"version":1,"id":"revoked"}"#;
-        let mut encrypted = rustfs_crypto::encrypt_stream_io(key.as_bytes(), plain).expect("real stored ciphertext");
-        // Exercise the exact decoder used after the actual object read.
-        assert!(ObjectStore::decode_iam_config_strict::<serde_json::Value>(&encrypted).is_ok());
-        encrypted[50] ^= 0xFF;
-        let error = ObjectStore::decode_iam_config_strict::<serde_json::Value>(&encrypted)
-            .expect_err("corrupt tombstone must not become missing");
-        assert!(
-            matches!(error, Error::CryptoError(_)),
-            "C07_REVOCATION_FAIL_CLOSED: preserve actual crypto error"
-        );
-        assert!(
-            !crate::error::is_err_config_not_found(&error),
-            "C07_REVOCATION_FAIL_CLOSED: corrupted revocation is not absence"
-        );
-        // The preserve-empty reader keeps an existing zero-byte object as
-        // Ok(empty); ecstore's read_config_preserve_empty_distinguishes_empty_object
-        // covers that storage boundary. Its payload must fail here, not become
-        // ConfigNotFound and reactivate a revoked delegation.
-        let empty =
-            ObjectStore::decode_iam_config_strict::<serde_json::Value>(&[]).expect_err("an existing empty tombstone is corrupt");
-        assert!(
-            !crate::error::is_err_config_not_found(&empty),
-            "C07_REVOCATION_FAIL_CLOSED: empty existing revocation is not absence"
-        );
-        let invalid_json =
-            ObjectStore::decode_iam_config_strict::<serde_json::Value>(br#"{"version": }"#).expect_err("invalid stored JSON");
-        assert!(!crate::error::is_err_config_not_found(&invalid_json));
-    }
-
     #[test]
     fn test_decrypt_data_short_data_fails() {
         let short = &[0x00u8; 40]; // less than 41-byte stream_io header, not valid JSON

crates/iam/src/sys.rs

@@ -75,7 +75,6 @@ pub const STATUS_ENABLED: &str = "enabled";
 pub const STATUS_DISABLED: &str = "disabled";
 
 pub const POLICYNAME: &str = "policy";
-pub const PLUGIN_ATTEMPT_CREDENTIAL_CLAIM: &str = "rustfs:plugin-attempt-v1";
 pub const SESSION_POLICY_NAME: &str = "sessionPolicy";
 pub const SESSION_POLICY_NAME_EXTRACTED: &str = "sessionPolicy-extracted";
 const VERIFIED_FEDERATED_POLICY_CLAIM: &str = "x-rustfs-internal-federated-policy";
@@ -169,12 +168,6 @@ enum PreparedServicePolicyMode {
 
 #[derive(Clone)]
 enum PreparedIamMode {
-    TerminalDeny,
-    PluginAttemptSts {
-        is_owner: bool,
-        combined_policy: Policy,
-        session_policy: PreparedSessionPolicy,
-    },
     Opa,
     Owner,
     Deny,
@@ -209,7 +202,7 @@ impl PreparedIamAuth {
     pub async fn needs_existing_object_tag_for_args(&self, args: &Args<'_>) -> bool {
         match &self.mode {
             PreparedIamMode::Opa => true,
-            PreparedIamMode::Owner | PreparedIamMode::Deny | PreparedIamMode::TerminalDeny => false,
+            PreparedIamMode::Owner | PreparedIamMode::Deny => false,
             PreparedIamMode::Regular { combined_policy } => {
                 policy_needs_existing_object_tag_for_args(combined_policy, args).await
             }
@@ -217,11 +210,6 @@ impl PreparedIamAuth {
                 combined_policy,
                 session_policy,
                 ..
-            }
-            | PreparedIamMode::PluginAttemptSts {
-                combined_policy,
-                session_policy,
-                ..
             } => {
                 policy_needs_existing_object_tag_for_args(combined_policy, args).await
                     || prepared_session_policy_needs_existing_object_tag_for_args(session_policy, args).await
@@ -251,56 +239,14 @@ impl PreparedIamAuth {
     pub fn combined_policy_for_view(&self) -> Option<&Policy> {
         match &self.mode {
             PreparedIamMode::Regular { combined_policy } => Some(combined_policy),
-            PreparedIamMode::Sts { combined_policy, .. } | PreparedIamMode::PluginAttemptSts { combined_policy, .. } => {
-                Some(combined_policy)
-            }
+            PreparedIamMode::Sts { combined_policy, .. } => Some(combined_policy),
             PreparedIamMode::ServiceAccount { combined_policy, .. } => Some(combined_policy),
-            PreparedIamMode::Opa | PreparedIamMode::Owner | PreparedIamMode::Deny | PreparedIamMode::TerminalDeny => None,
+            PreparedIamMode::Opa | PreparedIamMode::Owner | PreparedIamMode::Deny => None,
         }
     }
 }
 
 impl<T: Store> IamSys<T> {
-    /// For the authenticated, explicitly configured broker handler only.
-    pub async fn read_active_plugin_delegation_for_broker(
-        &self,
-        id: &str,
-        now: u64,
-    ) -> std::result::Result<crate::delegation::Delegation, crate::delegation::DelegationError> {
-        crate::delegation::read_active_for_broker(&self.store.api, id, now).await
-    }
-    pub async fn create_plugin_delegation(
-        &self,
-        owner: &str,
-        restrictions: crate::delegation::Restrictions,
-        now: u64,
-    ) -> std::result::Result<crate::delegation::Delegation, crate::delegation::DelegationError> {
-        crate::delegation::create(&self.store.api, owner, restrictions, now).await
-    }
-    pub async fn revoke_plugin_delegation(
-        &self,
-        owner: &str,
-        id: &str,
-    ) -> std::result::Result<(), crate::delegation::DelegationError> {
-        crate::delegation::revoke(&self.store.api, owner, id).await
-    }
-    pub async fn read_active_plugin_delegation(
-        &self,
-        owner: &str,
-        id: &str,
-        now: u64,
-    ) -> std::result::Result<crate::delegation::Delegation, crate::delegation::DelegationError> {
-        crate::delegation::read_active(&self.store.api, owner, id, now).await
-    }
-    /// Reads an owned delegation record for historical lookups, including expired or revoked records.
-    pub async fn read_owned_plugin_delegation(
-        &self,
-        owner: &str,
-        id: &str,
-    ) -> std::result::Result<crate::delegation::Delegation, crate::delegation::DelegationError> {
-        crate::delegation::read_owned(&self.store.api, owner, id).await
-    }
-
     /// Create a new IamSys instance with the given IamCache store
     ///
     /// # Arguments
@@ -335,16 +281,6 @@ impl<T: Store> IamSys<T> {
         *guard = PolicyPluginState::Ready(client);
     }
 
-    /// Restricted credentials require the built-in parent/session intersection.
-    /// External authorization bypasses that path, so only Disabled is supported.
-    pub async fn ensure_restricted_credential_vending() -> Result<()> {
-        if matches!(Self::policy_plugin_state().await, PolicyPluginState::Disabled) {
-            Ok(())
-        } else {
-            Err(Error::IAMActionNotAllowed)
-        }
-    }
-
     pub async fn get_policy_plugin_client() -> Option<rustfs_policy::policy::opa::AuthZPlugin> {
         let policy_plugin_state = get_policy_plugin_state();
         let guard = policy_plugin_state.read().await;
@@ -1447,50 +1383,17 @@ impl<T: Store> IamSys<T> {
     /// 1) know whether policy evaluation may need `s3:ExistingObjectTag`, and
     /// 2) evaluate with final conditions without re-merging identity policies.
     pub async fn prepare_auth(&self, args: &Args<'_>) -> PreparedIamAuth {
-        let marked = args.claims.contains_key(PLUGIN_ATTEMPT_CREDENTIAL_CLAIM);
-        if args.is_owner && !marked {
+        if args.is_owner {
             return PreparedIamAuth {
                 needs_existing_object_tag: false,
                 mode: PreparedIamMode::Owner,
             };
         }
-        // One observed state decides this request's path. Marked credentials
-        // never enter OPA, including after a restart or on another node.
-        let state = Self::policy_plugin_state().await;
-        if marked {
-            if args.is_owner
-                || args.claims.get(PLUGIN_ATTEMPT_CREDENTIAL_CLAIM) != Some(&Value::Bool(true))
-                || !matches!(state, PolicyPluginState::Disabled)
-            {
-                return PreparedIamAuth {
-                    needs_existing_object_tag: false,
-                    mode: PreparedIamMode::TerminalDeny,
-                };
-            }
-            let prepared = self.prepare_builtin_auth(args).await;
-            let mode = match prepared.mode {
-                PreparedIamMode::Sts {
-                    is_owner,
-                    combined_policy,
-                    session_policy,
-                } => PreparedIamMode::PluginAttemptSts {
-                    is_owner,
-                    combined_policy,
-                    session_policy,
-                },
-                _ => PreparedIamMode::TerminalDeny,
-            };
-            return PreparedIamAuth {
-                needs_existing_object_tag: prepared.needs_existing_object_tag,
-                mode,
-            };
-        }
-        if let Some(prepared) = state.prepared_iam_auth() {
+
+        if let Some(prepared) = Self::policy_plugin_state().await.prepared_iam_auth() {
             return prepared;
         }
-        self.prepare_builtin_auth(args).await
-    }
-    async fn prepare_builtin_auth(&self, args: &Args<'_>) -> PreparedIamAuth {
+
         let Ok((is_svc, parent_user)) = self.is_service_account(args.account).await else {
             return PreparedIamAuth {
                 needs_existing_object_tag: false,
@@ -1522,20 +1425,6 @@ impl<T: Store> IamSys<T> {
     /// bucket policies on an IAM denial. An error must not become an implicit deny.
     pub async fn try_eval_prepared(&self, prepared: &PreparedIamAuth, args: &Args<'_>) -> Result<bool> {
         Ok(match &prepared.mode {
-            PreparedIamMode::TerminalDeny => return Err(Error::IAMActionNotAllowed),
-            PreparedIamMode::PluginAttemptSts {
-                is_owner,
-                combined_policy,
-                session_policy,
-            } => {
-                // A false IAM result permits bucket-policy fallback. Restricted
-                // plugin credentials must instead terminate authorization.
-                let session_allowed = evaluate_prepared_session_policy(session_policy, args).await == Some(true);
-                if !session_allowed || !(*is_owner || combined_policy.is_allowed(args).await) {
-                    return Err(Error::IAMActionNotAllowed);
-                }
-                true
-            }
             PreparedIamMode::Opa => {
                 let Some(opa_enable) = Self::get_policy_plugin_client().await else {
                     tracing::warn!("eval_prepared: OPA mode requested but plugin is unavailable");
@@ -2238,145 +2127,6 @@ mod tests {
         assert!(prepared.combined_policy_for_view().is_none());
     }
 
-    #[tokio::test]
-    #[serial]
-    async fn marked_signed_sts_denial_is_terminal_before_public_bucket_fallback() {
-        let iam = IamSys::new(IamCache::new(StsTestMockStore::new(false)).await.unwrap());
-        let previous = IamSys::<StsTestMockStore>::policy_plugin_state().await;
-        let signing_key = "c07-test-token-signing-key";
-        let mut metadata=HashMap::from([
-            ("parent".into(),Value::String("sts-fallback-test-parent".into())),
-            ("exp".into(),serde_json::json!((OffsetDateTime::now_utc()+time::Duration::hours(1)).unix_timestamp())),
-            (SESSION_POLICY_NAME.into(),Value::String(base64_simd::URL_SAFE_NO_PAD.encode_to_string(br#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject"],"Resource":["arn:aws:s3:::mybucket/inside"]}]}"#))),
-        ]);
-        metadata.insert(PLUGIN_ATTEMPT_CREDENTIAL_CLAIM.into(), Value::Bool(true));
-        let mut marked = get_new_credentials_with_metadata(&metadata, signing_key).unwrap();
-        marked.parent_user = "sts-fallback-test-parent".into();
-        let marked_claims: HashMap<String, Value> = rustfs_policy::utils::extract_claims(&marked.session_token, signing_key)
-            .expect("signed test credentials must decode")
-            .claims;
-        let marked_user = UserIdentity::from(marked.clone());
-        iam.store
-            .cache
-            .add_or_update_sts_account(&marked.access_key, &marked_user, OffsetDateTime::now_utc());
-        metadata.remove(PLUGIN_ATTEMPT_CREDENTIAL_CLAIM);
-        let mut ordinary = get_new_credentials_with_metadata(&metadata, signing_key).unwrap();
-        ordinary.parent_user = marked.parent_user.clone();
-        let ordinary_claims: HashMap<String, Value> = rustfs_policy::utils::extract_claims(&ordinary.session_token, signing_key)
-            .expect("signed test credentials must decode")
-            .claims;
-        iam.store.cache.add_or_update_sts_account(
-            &ordinary.access_key,
-            &UserIdentity::from(ordinary.clone()),
-            OffsetDateTime::now_utc(),
-        );
-        let groups = None;
-        let conditions = HashMap::new();
-        let args = Args {
-            account: &marked.access_key,
-            groups: &groups,
-            action: Action::S3Action(S3Action::GetObjectAction),
-            bucket: "mybucket",
-            object: "outside",
-            conditions: &conditions,
-            is_owner: false,
-            claims: &marked_claims,
-            deny_only: false,
-        };
-        *get_policy_plugin_state().write().await = PolicyPluginState::Disabled;
-        let denied = iam.prepare_auth(&args).await;
-        let disabled_terminal = matches!(iam.try_eval_prepared(&denied, &args).await, Err(Error::IAMActionNotAllowed));
-        let inside = Args {
-            object: "inside",
-            ..args.clone()
-        };
-        let allowed = iam.prepare_auth(&inside).await;
-        let inside_allowed = matches!(iam.try_eval_prepared(&allowed, &inside).await, Ok(true));
-        let unmarked_args = Args {
-            account: &ordinary.access_key,
-            claims: &ordinary_claims,
-            ..args.clone()
-        };
-        let unmarked = iam.prepare_auth(&unmarked_args).await;
-        let ordinary_false = matches!(iam.try_eval_prepared(&unmarked, &unmarked_args).await, Ok(false));
-        let public:rustfs_policy::policy::BucketPolicy=serde_json::from_value(serde_json::json!({"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::mybucket/*"]}]})).unwrap();
-        let public_allows = public
-            .is_allowed(&rustfs_policy::policy::BucketPolicyArgs {
-                account: &marked.access_key,
-                groups: &groups,
-                action: args.action,
-                bucket: args.bucket,
-                object: args.object,
-                conditions: &conditions,
-                is_owner: false,
-            })
-            .await;
-        IamSys::<StsTestMockStore>::set_policy_plugin_client(opa::AuthZPlugin::new(opa::Args {
-            url: "http://127.0.0.1:8181/allow".into(),
-            auth_token: String::new(),
-        }))
-        .await;
-        let opa_marked = iam.prepare_auth(&args).await;
-        let ready_terminal = matches!(iam.try_eval_prepared(&opa_marked, &args).await, Err(Error::IAMActionNotAllowed));
-        let opa_ordinary = iam.prepare_auth(&unmarked_args).await;
-        let ordinary_keeps_opa = matches!(opa_ordinary.mode, PreparedIamMode::Opa);
-        // The captured Disabled preparation stays on built-in intersection even
-        // if an external policy client becomes ready before evaluation.
-        let captured_still_terminal = matches!(iam.try_eval_prepared(&denied, &args).await, Err(Error::IAMActionNotAllowed));
-        *get_policy_plugin_state().write().await = PolicyPluginState::Initializing;
-        let pending = iam.prepare_auth(&args).await;
-        let initializing_terminal = matches!(iam.try_eval_prepared(&pending, &args).await, Err(Error::IAMActionNotAllowed));
-        *get_policy_plugin_state().write().await = PolicyPluginState::Failed;
-        let failed = iam.prepare_auth(&args).await;
-        let failed_terminal = matches!(iam.try_eval_prepared(&failed, &args).await, Err(Error::IAMActionNotAllowed));
-        *get_policy_plugin_state().write().await = previous;
-        assert!(public_allows, "C07_PUBLIC_BUCKET_CONTROL: real public policy permits outside object");
-        assert!(
-            disabled_terminal && captured_still_terminal,
-            "C07_SCOPE_TERMINAL_BOUND: bucket policy must not rescue restricted scope denial"
-        );
-        assert!(
-            ready_terminal && initializing_terminal && failed_terminal,
-            "C07_EXTERNAL_POLICY_BOUND: marked persisted STS cannot enter OPA"
-        );
-        assert!(
-            inside_allowed && ordinary_false && ordinary_keeps_opa,
-            "C07_UNMARKED_COMPAT: preserve ordinary STS and valid marked scope"
-        );
-    }
-
-    #[tokio::test]
-    #[serial]
-    async fn restricted_vending_rejects_actual_external_policy_plugin_state() {
-        let previous = IamSys::<StsTestMockStore>::policy_plugin_state().await;
-        IamSys::<StsTestMockStore>::set_policy_plugin_client(opa::AuthZPlugin::new(opa::Args {
-            url: "http://127.0.0.1:8181/v1/data/rustfs/authz/allow".into(),
-            auth_token: String::new(),
-        }))
-        .await;
-        let active_rejected = IamSys::<StsTestMockStore>::ensure_restricted_credential_vending()
-            .await
-            .is_err();
-        *get_policy_plugin_state().write().await = PolicyPluginState::Initializing;
-        let initializing_rejected = IamSys::<StsTestMockStore>::ensure_restricted_credential_vending()
-            .await
-            .is_err();
-        *get_policy_plugin_state().write().await = PolicyPluginState::Failed;
-        let failed_rejected = IamSys::<StsTestMockStore>::ensure_restricted_credential_vending()
-            .await
-            .is_err();
-        *get_policy_plugin_state().write().await = PolicyPluginState::Disabled;
-        let disabled_allowed = IamSys::<StsTestMockStore>::ensure_restricted_credential_vending()
-            .await
-            .is_ok();
-        *get_policy_plugin_state().write().await = previous;
-        assert!(
-            active_rejected && initializing_rejected && failed_rejected,
-            "C07_EXTERNAL_POLICY_BOUND: external authorization cannot bypass minted session scope"
-        );
-        assert!(disabled_allowed);
-    }
-
     #[tokio::test]
     #[serial]
     async fn test_prepare_auth_requests_existing_object_tags_in_opa_mode() {

crates/io-metrics/benches/metrics_pipeline.rs

@@ -1,67 +1,10 @@
 use criterion::{Criterion, criterion_group, criterion_main};
-use metrics_util::debugging::DebuggingRecorder;
-use rustfs_io_metrics::{
-    LocalBatchReadDecision, LocalBatchReadMetrics, LocalBatchReadStage, record_local_batch_read_decision,
-    set_get_stage_metrics_enabled,
-};
 use rustfs_io_metrics::{MetricsCollector, PerformanceMetrics, record_get_object_timeout_operation_start};
 use rustfs_io_metrics::{record_s3_op, s3_http_metrics::S3HttpRequestGuard};
 use rustfs_s3_ops::S3Operation;
 use std::hint::black_box;
 use std::sync::Arc;
-use std::time::{Duration, Instant};
-
-fn local_batch_attribution_sample() {
-    let prepare = rustfs_io_metrics::get_stage_metrics_enabled().then(Instant::now);
-    record_local_batch_read_decision(LocalBatchReadDecision::Selected, prepare.map(|started| started.elapsed()));
-    if let Some(metrics) = LocalBatchReadMetrics::capture() {
-        metrics.record_batch(4);
-        let execution = Instant::now();
-        metrics.record_stage(LocalBatchReadStage::QueueWait, true, execution.elapsed());
-        for _ in 0..4 {
-            for stage in [
-                LocalBatchReadStage::Metadata,
-                LocalBatchReadStage::Open,
-                LocalBatchReadStage::Read,
-            ] {
-                let started = Instant::now();
-                metrics.record_stage(stage, true, started.elapsed());
-            }
-            metrics.record_shard(true, 32 * 1024, 32 * 1024);
-        }
-        metrics.record_stage(LocalBatchReadStage::Execution, true, execution.elapsed());
-    }
-}
-
-fn bench_local_batch_attribution(c: &mut Criterion) {
-    let mut group = c.benchmark_group("local_batch_attribution_4_shards_debug_recorder");
-    for (name, enabled) in [("disabled", false), ("enabled", true)] {
-        set_get_stage_metrics_enabled(enabled);
-        group.bench_function(name, |b| {
-            b.iter_custom(|iterations| {
-                let mut remaining = iterations;
-                let mut elapsed = Duration::ZERO;
-                while remaining > 0 {
-                    // Bound captured histogram storage independently of Criterion's
-                    // iteration count. Recorder setup/teardown is not measured.
-                    let chunk = remaining.min(128);
-                    let recorder = DebuggingRecorder::new();
-                    metrics::with_local_recorder(&recorder, || {
-                        let started = Instant::now();
-                        for _ in 0..chunk {
-                            local_batch_attribution_sample();
-                        }
-                        elapsed += started.elapsed();
-                    });
-                    remaining -= chunk;
-                }
-                elapsed
-            });
-        });
-    }
-    group.finish();
-    set_get_stage_metrics_enabled(false);
-}
+use std::time::Duration;
 
 fn bench_record_get_object_timeout_operation_start(c: &mut Criterion) {
     c.bench_function("record_get_object_timeout_operation_start", |b| {
@@ -111,7 +54,6 @@ criterion_group!(
     bench_record_get_object_timeout_operation_start,
     bench_s3_http_outcomes,
     bench_update_concurrent_requests,
-    bench_metrics_collector_record_io_operation,
-    bench_local_batch_attribution
+    bench_metrics_collector_record_io_operation
 );
 criterion_main!(benches);

crates/io-metrics/src/lib.rs

@@ -49,11 +49,6 @@
 #[macro_use]
 extern crate metrics;
 
-mod local_batch_read;
-pub use local_batch_read::{
-    LocalBatchReadDecision, LocalBatchReadMetrics, LocalBatchReadStage, record_local_batch_read_decision,
-};
-
 use std::collections::HashMap;
 use std::sync::{
     LazyLock, Mutex,

crates/io-metrics/src/local_batch_read.rs

@@ -1,210 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Opt-in attribution for the buffered local shard batch path.
-
-use crate::get_stage_metrics_enabled;
-use metrics::{Counter, Histogram};
-use std::time::Duration;
-
-/// One decision per reader-setup attempt, rather than per S3 request.
-#[derive(Clone, Copy, Debug)]
-pub enum LocalBatchReadDecision {
-    Selected,
-    MmapDisabled,
-    CopySource,
-    ReadCapExceeded,
-    InlineData,
-    NonLocalShard,
-    InvalidPath,
-    NoLocalShards,
-    UnsupportedPlatform,
-}
-
-impl LocalBatchReadDecision {
-    const fn as_str(self) -> &'static str {
-        match self {
-            Self::Selected => "selected",
-            Self::MmapDisabled => "mmap_disabled",
-            Self::CopySource => "copy_source",
-            Self::ReadCapExceeded => "read_cap_exceeded",
-            Self::InlineData => "inline_data",
-            Self::NonLocalShard => "non_local_shard",
-            Self::InvalidPath => "invalid_path",
-            Self::NoLocalShards => "no_local_shards",
-            Self::UnsupportedPlatform => "unsupported_platform",
-        }
-    }
-}
-
-/// Record eligibility, including path preparation only when it actually ran.
-pub fn record_local_batch_read_decision(decision: LocalBatchReadDecision, preparation: Option<Duration>) {
-    if !get_stage_metrics_enabled() {
-        return;
-    }
-    let decision = decision.as_str();
-    counter!("rustfs_io_get_object_local_batch_decisions_total", "decision" => decision).increment(1);
-    if let Some(duration) = preparation {
-        histogram!("rustfs_io_get_object_local_batch_prepare_seconds", "decision" => decision).record(duration.as_secs_f64());
-    }
-}
-
-/// Stages of the existing buffered positioned-read implementation.
-#[derive(Clone, Copy)]
-pub enum LocalBatchReadStage {
-    QueueWait,
-    Execution,
-    Metadata,
-    Open,
-    Read,
-}
-
-impl LocalBatchReadStage {
-    const fn index(self) -> usize {
-        match self {
-            Self::QueueWait => 0,
-            Self::Execution => 1,
-            Self::Metadata => 2,
-            Self::Open => 3,
-            Self::Read => 4,
-        }
-    }
-}
-
-/// Handles captured before dispatch, kept alive by the actual blocking worker.
-///
-/// Capturing the recorder once avoids per-I/O registration and also preserves
-/// completion samples when the caller stops waiting. No timers or handles are
-/// created with GET-stage metrics disabled. The snapshot applies to the whole
-/// submitted batch, including work that finishes after the switch is disabled.
-pub struct LocalBatchReadMetrics {
-    stages: [[Histogram; 2]; 5],
-    shards: [Counter; 2],
-    requested_bytes: [Counter; 2],
-    read_bytes: [Counter; 2],
-    batch_size: Histogram,
-}
-
-fn outcome(success: bool) -> &'static str {
-    if success { "success" } else { "error" }
-}
-
-impl LocalBatchReadMetrics {
-    /// Resolve bounded-label handles only for an explicitly instrumented batch.
-    /// Boxing the enabled state keeps the blocking task small when disabled.
-    pub fn capture() -> Option<Box<Self>> {
-        if !get_stage_metrics_enabled() {
-            return None;
-        }
-        let stages = ["queue_wait", "execution", "metadata", "open", "read"].map(|stage| {
-            [false, true].map(|success| {
-                histogram!("rustfs_io_get_object_local_batch_stage_seconds", "stage" => stage, "outcome" => outcome(success))
-            })
-        });
-        Some(Box::new(Self {
-            stages,
-            shards: [false, true]
-                .map(|success| counter!("rustfs_io_get_object_local_batch_shards_total", "outcome" => outcome(success))),
-            requested_bytes: [false, true]
-                .map(|success| counter!("rustfs_io_get_object_local_batch_requested_bytes_total", "outcome" => outcome(success))),
-            read_bytes: [false, true]
-                .map(|success| counter!("rustfs_io_get_object_local_batch_read_bytes_total", "outcome" => outcome(success))),
-            batch_size: histogram!("rustfs_io_get_object_local_batch_shards"),
-        }))
-    }
-
-    /// Count shards actually submitted to this blocking batch.
-    pub fn record_batch(&self, shards: usize) {
-        self.batch_size.record(crate::shard_read_fanout_to_f64(shards));
-    }
-
-    /// Record an executed stage; unattempted stages receive no sample.
-    ///
-    /// Queue wait succeeds when the worker starts. Execution covers the whole
-    /// batch, while metadata/open/read describe individual I/O operations.
-    /// Read timing excludes buffer allocation; execution timing includes it.
-    pub fn record_stage(&self, stage: LocalBatchReadStage, success: bool, duration: Duration) {
-        self.stages[stage.index()][usize::from(success)].record(duration.as_secs_f64());
-    }
-
-    /// Separate completed shard outcomes and bytes actually returned by read_at.
-    pub fn record_shard(&self, success: bool, requested: usize, read: usize) {
-        let index = usize::from(success);
-        self.shards[index].increment(1);
-        self.requested_bytes[index].increment(u64::try_from(requested).unwrap_or(u64::MAX));
-        self.read_bytes[index].increment(u64::try_from(read).unwrap_or(u64::MAX));
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::set_get_stage_metrics_enabled;
-    use crate::tests::{METRICS_FLAG_LOCK, counter_total, histogram_samples};
-    use metrics_util::debugging::DebuggingRecorder;
-    use std::time::Duration;
-
-    #[test]
-    fn local_batch_read_metrics_are_disabled_without_stage_opt_in() {
-        let _guard = METRICS_FLAG_LOCK.lock().unwrap_or_else(|error| error.into_inner());
-        let recorder = DebuggingRecorder::new();
-        let snapshotter = recorder.snapshotter();
-        metrics::with_local_recorder(&recorder, || {
-            set_get_stage_metrics_enabled(false);
-            assert!(LocalBatchReadMetrics::capture().is_none());
-            record_local_batch_read_decision(LocalBatchReadDecision::Selected, Some(Duration::from_millis(1)));
-        });
-        assert!(snapshotter.snapshot().into_vec().is_empty());
-    }
-
-    #[test]
-    fn local_batch_read_handles_record_worker_costs_and_actual_bytes() {
-        let _guard = METRICS_FLAG_LOCK.lock().unwrap_or_else(|error| error.into_inner());
-        let recorder = DebuggingRecorder::new();
-        let snapshotter = recorder.snapshotter();
-        let observation = metrics::with_local_recorder(&recorder, || {
-            set_get_stage_metrics_enabled(true);
-            record_local_batch_read_decision(LocalBatchReadDecision::Selected, Some(Duration::from_millis(2)));
-            LocalBatchReadMetrics::capture().expect("enabled batch metrics must capture recorder handles")
-        });
-        set_get_stage_metrics_enabled(false);
-        std::thread::spawn(move || {
-            observation.record_stage(LocalBatchReadStage::QueueWait, true, Duration::from_millis(3));
-            observation.record_stage(LocalBatchReadStage::Metadata, false, Duration::from_millis(4));
-            observation.record_shard(false, 1024, 0);
-            observation.record_shard(true, 16, 16);
-            observation.record_batch(2);
-        })
-        .join()
-        .expect("worker should record through the captured handles");
-        set_get_stage_metrics_enabled(false);
-
-        let rows = snapshotter.snapshot().into_vec();
-        assert_eq!(counter_total(&rows, "rustfs_io_get_object_local_batch_decisions_total"), Some(1));
-        assert_eq!(counter_total(&rows, "rustfs_io_get_object_local_batch_shards_total"), Some(2));
-        assert_eq!(counter_total(&rows, "rustfs_io_get_object_local_batch_requested_bytes_total"), Some(1040));
-        assert_eq!(counter_total(&rows, "rustfs_io_get_object_local_batch_read_bytes_total"), Some(16));
-        assert_eq!(histogram_samples(&rows, "rustfs_io_get_object_local_batch_prepare_seconds"), vec![0.002]);
-        assert_eq!(
-            histogram_samples(&rows, "rustfs_io_get_object_local_batch_stage_seconds"),
-            vec![0.003, 0.004]
-        );
-        assert_eq!(histogram_samples(&rows, "rustfs_io_get_object_local_batch_shards"), vec![2.0]);
-        for (key, _, _, _) in rows {
-            for label in key.key().labels() {
-                assert!(matches!(label.key(), "decision" | "stage" | "outcome"));
-            }
-        }
-    }
-}

crates/obs/src/lib.rs

@@ -81,6 +81,10 @@ pub use metrics::{
 };
 pub use telemetry::{HTTP_SERVER_LOG_TARGET, OtelGuard, Recorder};
 
+/// Target reserved for the bounded multipart lock-timeout event.
+/// The local JSON formatter must not attach request span fields to this event.
+pub const MULTIPART_CREATE_TIMEOUT_LOG_TARGET: &str = "rustfs::error::multipart_create_timeout";
+
 // Dial9 Tokio runtime telemetry
 // Re-export dial9 types at crate root level for easier access
 pub use telemetry::dial9;

crates/obs/src/telemetry/local.rs

@@ -181,11 +181,16 @@ fn resolve_log_cleanup_interval_seconds(config: &OtelConfig) -> u64 {
 #[derive(Clone, Debug)]
 struct RequestIdJsonFormat<T> {
     inner: Format<Json, T>,
+    multipart_timeout: Format<Json, T>,
 }
 
-impl<T> RequestIdJsonFormat<T> {
+impl<T: Clone> RequestIdJsonFormat<T> {
     fn new(inner: Format<Json, T>) -> Self {
-        Self { inner }
+        let multipart_timeout = inner.clone().with_current_span(false).with_span_list(false);
+        Self {
+            inner,
+            multipart_timeout,
+        }
     }
 }
 
@@ -201,6 +206,10 @@ where
         event: &tracing::Event<'_>,
     ) -> fmt::Result {
         let mut buffer = String::new();
+        if event.metadata().target() == crate::MULTIPART_CREATE_TIMEOUT_LOG_TARGET {
+            self.multipart_timeout.format_event(ctx, Writer::new(&mut buffer), event)?;
+            return writer.write_str(&buffer);
+        }
         self.inner.format_event(ctx, Writer::new(&mut buffer), event)?;
 
         let request_id = span_scope_request_id(ctx, event);
@@ -858,6 +867,156 @@ mod tests {
         .expect("log output should be valid UTF-8")
     }
 
+    #[test]
+    fn multipart_timeout_event_does_not_inherit_verbose_span_fields() {
+        for (level, span_events) in [
+            ("debug", FmtSpan::NONE),
+            ("debug", FmtSpan::CLOSE),
+            ("debug", FmtSpan::FULL),
+            ("trace", FmtSpan::NONE),
+            ("trace", FmtSpan::CLOSE),
+            ("trace", FmtSpan::FULL),
+        ] {
+            let writer = SharedWriter::default();
+            let layer = build_json_log_layer(writer.clone(), false, span_events, true);
+            let subscriber = Registry::default()
+                .with(tracing_subscriber::EnvFilter::new(level))
+                .with(layer);
+
+            tracing::subscriber::with_default(subscriber, || {
+                let sensitive = tracing::error_span!(
+                    "request",
+                    uri = "/bucket/LEAK-key?X-Amz-Signature=LEAK-signature",
+                    credential = "LEAK-credential"
+                );
+                let _guard = sensitive.enter();
+                tracing::error!(
+                    target: crate::MULTIPART_CREATE_TIMEOUT_LOG_TARGET,
+                    parent: None,
+                    event = "multipart_create_lock_timeout",
+                    request_id = "b8172a15-a428-4b42-9cef-1f4a7b96874e",
+                    resource_class = "request_object",
+                    "lock timeout"
+                );
+                tracing::error!(event = "unrelated_event", "normal logging still has its span");
+            });
+
+            let bytes = writer.inner.lock().expect("shared writer lock").clone();
+            let output = String::from_utf8(bytes).expect("UTF-8 logs");
+            let rows = output
+                .lines()
+                .map(|line| serde_json::from_str::<Value>(line).expect("JSON log"))
+                .collect::<Vec<_>>();
+            let event = rows
+                .iter()
+                .find(|row| row["event"] == "multipart_create_lock_timeout")
+                .expect("timeout event");
+            assert_eq!(event["request_id"], "b8172a15-a428-4b42-9cef-1f4a7b96874e");
+            assert!(event.get("span").is_none());
+            assert!(event.get("spans").is_none());
+            assert!(!event.to_string().contains("LEAK-"));
+            let ordinary = rows
+                .iter()
+                .find(|row| row["event"] == "unrelated_event")
+                .expect("ordinary event");
+            assert!(
+                ordinary.to_string().contains("LEAK-key"),
+                "other events keep their configured span context"
+            );
+        }
+    }
+
+    #[test]
+    fn multipart_timeout_target_keeps_the_existing_error_module_filter() {
+        let writer = SharedWriter::default();
+        let layer = build_json_log_layer(writer.clone(), false, FmtSpan::NONE, true);
+        let subscriber = Registry::default()
+            .with(tracing_subscriber::EnvFilter::new("off,rustfs::error=warn"))
+            .with(layer);
+        tracing::subscriber::with_default(subscriber, || {
+            tracing::error!(
+                target: crate::MULTIPART_CREATE_TIMEOUT_LOG_TARGET,
+                parent: None,
+                event = "multipart_create_lock_timeout",
+                "lock timeout"
+            );
+        });
+        let bytes = writer.inner.lock().expect("shared writer lock").clone();
+        let output = String::from_utf8(bytes).expect("UTF-8 logs");
+        let event: Value = serde_json::from_str(output.trim()).expect("filtered timeout event");
+        assert_eq!(event["event"], "multipart_create_lock_timeout");
+    }
+
+    #[test]
+    fn multipart_timeout_root_event_does_not_inherit_otlp_span_fields() {
+        use opentelemetry::InstrumentationScope;
+        use opentelemetry_appender_tracing::layer::{OpenTelemetryTracingBridge, TracingSpanAttributes};
+        use opentelemetry_sdk::{
+            error::OTelSdkResult,
+            logs::{LogProcessor, SdkLogRecord, SdkLoggerProvider},
+        };
+
+        #[derive(Clone, Debug, Default)]
+        struct Capture(Arc<Mutex<Vec<SdkLogRecord>>>);
+
+        impl LogProcessor for Capture {
+            fn emit(&self, record: &mut SdkLogRecord, _scope: &InstrumentationScope) {
+                self.0.lock().expect("captured records").push(record.clone());
+            }
+
+            fn force_flush(&self) -> OTelSdkResult {
+                Ok(())
+            }
+
+            fn shutdown_with_timeout(&self, _timeout: std::time::Duration) -> OTelSdkResult {
+                Ok(())
+            }
+        }
+
+        for copy_span_fields in [false, true] {
+            let capture = Capture::default();
+            let provider = SdkLoggerProvider::builder().with_log_processor(capture.clone()).build();
+            let bridge = if copy_span_fields {
+                OpenTelemetryTracingBridge::builder(&provider)
+                    .with_tracing_span_attributes(TracingSpanAttributes::all())
+                    .build()
+            } else {
+                OpenTelemetryTracingBridge::new(&provider)
+            };
+            let subscriber = Registry::default().with(bridge);
+            tracing::subscriber::with_default(subscriber, || {
+                let sensitive = tracing::error_span!(
+                    "request",
+                    uri = "/bucket/LEAK-key?X-Amz-Signature=LEAK-signature",
+                    credential = "LEAK-credential"
+                );
+                let _guard = sensitive.enter();
+                tracing::error!(
+                    target: crate::MULTIPART_CREATE_TIMEOUT_LOG_TARGET,
+                    parent: None,
+                    event = "multipart_create_lock_timeout",
+                    request_id = "b8172a15-a428-4b42-9cef-1f4a7b96874e",
+                    resource_class = "request_object",
+                    "lock timeout"
+                );
+                tracing::error!(event = "unrelated_event", "ordinary event");
+            });
+            let records = capture.0.lock().expect("captured records");
+            let timeout = records
+                .iter()
+                .find(|record| record.target().map(|target| target.as_ref()) == Some(crate::MULTIPART_CREATE_TIMEOUT_LOG_TARGET))
+                .expect("timeout event");
+            let output = format!("{timeout:?}");
+            assert!(output.contains("b8172a15-a428-4b42-9cef-1f4a7b96874e"));
+            assert!(!output.contains("LEAK-"));
+            let ordinary = records
+                .iter()
+                .find(|record| record.target().map(|target| target.as_ref()) != Some(crate::MULTIPART_CREATE_TIMEOUT_LOG_TARGET))
+                .expect("ordinary event");
+            assert_eq!(format!("{ordinary:?}").contains("LEAK-key"), copy_span_fields);
+        }
+    }
+
     fn render_json_log_with_request_span() -> Value {
         let writer = SharedWriter::default();
         let layer = build_json_log_layer(writer.clone(), false, FmtSpan::NONE, false);

crates/obs/src/telemetry/otel.rs

@@ -83,16 +83,6 @@ const GET_OBJECT_DURATION_HISTOGRAM_BUCKETS: &[f64] = &[
     0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0,
 ];
 
-const LOCAL_BATCH_DURATION_HISTOGRAM_METRICS: &[&str] = &[
-    "rustfs_io_get_object_local_batch_prepare_seconds",
-    "rustfs_io_get_object_local_batch_stage_seconds",
-];
-
-const LOCAL_BATCH_DURATION_HISTOGRAM_BUCKETS: &[f64] = &[
-    0.0000001, 0.00000025, 0.0000005, 0.000001, 0.0000025, 0.000005, 0.00001, 0.000025, 0.00005, 0.0001, 0.00025, 0.0005, 0.001,
-    0.0025, 0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0,
-];
-
 const DEFAULT_OTLP_HTTP_TIMEOUT: Duration = Duration::from_secs(10);
 const OTEL_EXPORTER_OTLP_TIMEOUT: &str = "OTEL_EXPORTER_OTLP_TIMEOUT";
 const OTEL_EXPORTER_OTLP_TRACES_TIMEOUT: &str = "OTEL_EXPORTER_OTLP_TRACES_TIMEOUT";
@@ -491,25 +481,21 @@ fn build_meter_provider(
 }
 
 fn get_object_duration_histogram_view(instrument: &Instrument) -> Option<Stream> {
-    let boundaries = get_object_duration_histogram_buckets(instrument.name())?;
+    if !is_get_object_duration_histogram_metric(instrument.name()) {
+        return None;
+    }
 
     Stream::builder()
         .with_aggregation(Aggregation::ExplicitBucketHistogram {
-            boundaries: boundaries.to_vec(),
+            boundaries: GET_OBJECT_DURATION_HISTOGRAM_BUCKETS.to_vec(),
             record_min_max: true,
         })
         .build()
         .ok()
 }
 
-fn get_object_duration_histogram_buckets(name: &str) -> Option<&'static [f64]> {
-    if LOCAL_BATCH_DURATION_HISTOGRAM_METRICS.contains(&name) {
-        Some(LOCAL_BATCH_DURATION_HISTOGRAM_BUCKETS)
-    } else if GET_OBJECT_DURATION_HISTOGRAM_METRICS.contains(&name) {
-        Some(GET_OBJECT_DURATION_HISTOGRAM_BUCKETS)
-    } else {
-        None
-    }
+fn is_get_object_duration_histogram_metric(name: &str) -> bool {
+    GET_OBJECT_DURATION_HISTOGRAM_METRICS.contains(&name)
 }
 
 /// Build an optional [`SdkLoggerProvider`] for the given log endpoint.
@@ -1112,22 +1098,10 @@ mod tests {
 
     #[test]
     fn test_get_object_duration_histogram_metric_match_is_scoped() {
-        for name in [
-            "rustfs_io_get_object_stage_duration_seconds",
-            "rustfs_io_get_object_request_duration_seconds",
-        ] {
-            assert_eq!(get_object_duration_histogram_buckets(name), Some(GET_OBJECT_DURATION_HISTOGRAM_BUCKETS));
-        }
-        for name in LOCAL_BATCH_DURATION_HISTOGRAM_METRICS {
-            assert_eq!(get_object_duration_histogram_buckets(name), Some(LOCAL_BATCH_DURATION_HISTOGRAM_BUCKETS));
-        }
-        for name in [
-            "rustfs_io_put_object_request_duration_seconds",
-            "rustfs_io_get_object_response_size_bytes",
-            "rustfs_io_get_object_local_batch_shards",
-        ] {
-            assert!(get_object_duration_histogram_buckets(name).is_none());
-        }
+        assert!(is_get_object_duration_histogram_metric("rustfs_io_get_object_stage_duration_seconds"));
+        assert!(is_get_object_duration_histogram_metric("rustfs_io_get_object_request_duration_seconds"));
+        assert!(!is_get_object_duration_histogram_metric("rustfs_io_put_object_request_duration_seconds"));
+        assert!(!is_get_object_duration_histogram_metric("rustfs_io_get_object_response_size_bytes"));
     }
 
     #[test]
@@ -1137,17 +1111,6 @@ mod tests {
         assert_eq!(GET_OBJECT_DURATION_HISTOGRAM_BUCKETS.last(), Some(&10.0));
     }
 
-    #[test]
-    fn local_batch_duration_buckets_resolve_sub_microsecond_operations() {
-        assert!(
-            LOCAL_BATCH_DURATION_HISTOGRAM_BUCKETS
-                .windows(2)
-                .all(|pair| pair[0] < pair[1])
-        );
-        assert_eq!(LOCAL_BATCH_DURATION_HISTOGRAM_BUCKETS.first(), Some(&0.0000001));
-        assert_eq!(LOCAL_BATCH_DURATION_HISTOGRAM_BUCKETS.last(), Some(&10.0));
-    }
-
     #[cfg(all(
         feature = "pyroscope",
         any(target_os = "macos", all(target_os = "linux", target_env = "gnu", target_arch = "x86_64"))

crates/policy/src/policy/action.rs

@@ -568,24 +568,6 @@ pub enum AdminAction {
     GetTableLifecycleAction,
     #[strum(serialize = "admin:SetTableLifecycle")]
     SetTableLifecycleAction,
-    #[strum(serialize = "admin:CreatePluginDelegation")]
-    CreatePluginDelegationAction,
-    #[strum(serialize = "admin:IssuePluginAttempt")]
-    IssuePluginAttemptAction,
-    #[strum(serialize = "admin:SubmitPluginJob")]
-    SubmitPluginJobAction,
-    #[strum(serialize = "admin:GetPluginRun")]
-    GetPluginRunAction,
-    #[strum(serialize = "admin:CancelPluginRun")]
-    CancelPluginRunAction,
-    #[strum(serialize = "admin:ListPluginRuns")]
-    ListPluginRunsAction,
-    #[strum(serialize = "admin:ReplayPluginRun")]
-    ReplayPluginRunAction,
-    #[strum(serialize = "admin:GetPluginDelegation")]
-    GetPluginDelegationAction,
-    #[strum(serialize = "admin:RevokePluginDelegation")]
-    RevokePluginDelegationAction,
     #[strum(serialize = "admin:GetTableCredentials")]
     GetTableCredentialsAction,
     #[strum(serialize = "admin:RunTableMaintenance")]
@@ -731,15 +713,6 @@ impl AdminAction {
                 | AdminAction::GetTableLifecycleAction
                 | AdminAction::SetTableLifecycleAction
                 | AdminAction::GetTableCredentialsAction
-                | AdminAction::IssuePluginAttemptAction
-                | AdminAction::SubmitPluginJobAction
-                | AdminAction::GetPluginRunAction
-                | AdminAction::CancelPluginRunAction
-                | AdminAction::ListPluginRunsAction
-                | AdminAction::ReplayPluginRunAction
-                | AdminAction::GetPluginDelegationAction
-                | AdminAction::CreatePluginDelegationAction
-                | AdminAction::RevokePluginDelegationAction
                 | AdminAction::RunTableMaintenanceAction
                 | AdminAction::GetTableMetadataLocationAction
                 | AdminAction::SetTableMetadataLocationAction
@@ -940,35 +913,6 @@ mod tests {
         assert_eq!(arr[0].as_str().unwrap(), "s3:*");
     }
 
-    #[test]
-    fn plugin_delegation_actions_are_explicit_and_unscoped() {
-        for (name, expected) in [
-            ("admin:GetPluginDelegation", AdminAction::GetPluginDelegationAction),
-            ("admin:CreatePluginDelegation", AdminAction::CreatePluginDelegationAction),
-            ("admin:RevokePluginDelegation", AdminAction::RevokePluginDelegationAction),
-            ("admin:SubmitPluginJob", AdminAction::SubmitPluginJobAction),
-            ("admin:GetPluginRun", AdminAction::GetPluginRunAction),
-            ("admin:CancelPluginRun", AdminAction::CancelPluginRunAction),
-            ("admin:ListPluginRuns", AdminAction::ListPluginRunsAction),
-            ("admin:ReplayPluginRun", AdminAction::ReplayPluginRunAction),
-        ] {
-            assert_eq!(AdminAction::try_from(name).unwrap(), expected);
-            assert!(expected.is_valid());
-            assert!(!expected.is_table_resource_scoped());
-        }
-        assert_eq!(
-            AdminAction::try_from("admin:IssuePluginAttempt").unwrap(),
-            AdminAction::IssuePluginAttemptAction
-        );
-        assert!(AdminAction::IssuePluginAttemptAction.is_valid());
-        assert!(AdminAction::SubmitPluginJobAction.is_valid());
-        assert!(AdminAction::GetPluginRunAction.is_valid());
-        assert!(AdminAction::CancelPluginRunAction.is_valid());
-        assert!(AdminAction::ListPluginRunsAction.is_valid());
-        assert!(AdminAction::ReplayPluginRunAction.is_valid());
-        assert!(AdminAction::try_from("admin:IssuePluginCredentials").is_err());
-    }
-
     #[test]
     fn test_get_replication_metrics_admin_action_is_valid() {
         assert!(AdminAction::GetReplicationMetricsAction.is_valid());

crates/scanner/src/error.rs

@@ -53,10 +53,6 @@ pub enum ScannerError {
     #[error("Remote namespace scanner disk is already active")]
     RemoteDiskBusy,
 
-    /// Node resource pressure deferred work before its first storage poll.
-    #[error("Scanner node resource admission deferred")]
-    ResourceDeferred,
-
     /// Partial data usage cache produced before the scanner stopped.
     #[error("Scanner stopped with partial data usage cache")]
     PartialCache(Box<DataUsageCache>),

crates/scanner/src/lib.rs

@@ -50,9 +50,9 @@ use storage_api::owner::{
 };
 #[cfg(test)]
 use storage_api::owner::{
-    EcstoreDiskOption, EcstoreDiskStore, EcstoreEndpoint, EcstoreEndpointServerPools, EcstoreEndpoints, EcstoreExpiryState,
-    EcstoreInstanceContext, EcstorePoolEndpoints, ecstore_config_init, ecstore_init_bucket_metadata_sys,
-    ecstore_init_local_disks_with_instance_ctx, ecstore_new_disk,
+    EcstoreDiskOption, EcstoreDiskStore, EcstoreEndpoint, EcstoreEndpointServerPools, EcstoreEndpoints, EcstoreInstanceContext,
+    EcstorePoolEndpoints, ecstore_config_init, ecstore_init_bucket_metadata_sys, ecstore_init_local_disks_with_instance_ctx,
+    ecstore_new_disk,
 };
 use tokio_util::sync::CancellationToken;
 use uuid::Uuid;
@@ -123,7 +123,7 @@ pub use storage_api::scan::{
     SCANNER_DIRTY_USAGE_SNAPSHOT_PROTOCOL_VERSION, SCANNER_DIRTY_USAGE_SNAPSHOT_RPC_MAX_MESSAGE_SIZE,
     SCANNER_SCOPED_DIRTY_USAGE_ACK_MAX_ENTRIES,
 };
-pub use workload_admission::{set_scanner_node_admission, set_scanner_workload_admission_snapshot_provider};
+pub use workload_admission::set_scanner_workload_admission_snapshot_provider;
 
 static SCANNER_ACTIVE_WORK_UNITS: AtomicU64 = AtomicU64::new(0);
 static SCANNER_RUNTIME_INSTANCES: AtomicU64 = AtomicU64::new(0);
@@ -678,37 +678,8 @@ fn reset_tier_name_cache_for_test() {
     TIER_REGISTRY_GENERATION.store(0, Ordering::Relaxed);
 }
 
-// Only a task running an isolated unit test can override these handles.
-#[cfg(test)]
-struct ExpiryLockTestContext {
-    state: Arc<tokio::sync::RwLock<EcstoreExpiryState>>,
-    store: Option<Arc<ECStore>>,
-    completed_incarnation_reads: Arc<std::sync::atomic::AtomicUsize>,
-}
-
-#[cfg(test)]
-tokio::task_local! {
-    static EXPIRY_LOCK_TEST_CONTEXT: ExpiryLockTestContext;
-}
-
-pub(crate) async fn enqueue_runtime_free_version(oi: ScannerObjectInfo, cancellation: Option<&CancellationToken>) {
-    #[cfg(test)]
-    let state = EXPIRY_LOCK_TEST_CONTEXT
-        .try_with(|context| context.state.clone())
-        .unwrap_or_else(|_| ecstore_expiry_state_handle());
-    #[cfg(not(test))]
-    let state = ecstore_expiry_state_handle();
-    let state = match cancellation {
-        Some(cancel) => tokio::select! {
-            biased;
-            _ = cancel.cancelled() => return,
-            state = state.write() => state,
-        },
-        None => state.write().await,
-    };
-    if !cancellation.is_some_and(CancellationToken::is_cancelled) {
-        state.enqueue_free_version(oi);
-    }
+pub(crate) async fn enqueue_runtime_free_version(oi: ScannerObjectInfo) {
+    ecstore_expiry_state_handle().write().await.enqueue_free_version(oi);
 }
 
 pub(crate) async fn enqueue_runtime_newer_noncurrent(
@@ -716,50 +687,20 @@ pub(crate) async fn enqueue_runtime_newer_noncurrent(
     to_delete_objs: Vec<ObjectToDelete>,
     event: Event,
     src: &LcEventSrc,
-    cancellation: Option<&CancellationToken>,
 ) -> bool {
-    if cancellation.is_some_and(CancellationToken::is_cancelled) {
-        return false;
-    }
-    #[cfg(test)]
-    let store = EXPIRY_LOCK_TEST_CONTEXT
-        .try_with(|context| context.store.clone())
-        .unwrap_or_else(|_| ecstore_resolve_object_store_handle());
-    #[cfg(not(test))]
-    let store = ecstore_resolve_object_store_handle();
-    let Some(store) = store else {
+    let Some(store) = ecstore_resolve_object_store_handle() else {
         return false;
     };
     let Ok(bucket_incarnation_id) = store.bucket_incarnation_id(bucket).await else {
         return false;
     };
-    #[cfg(test)]
-    let _ = EXPIRY_LOCK_TEST_CONTEXT.try_with(|context| {
-        context
-            .completed_incarnation_reads
-            .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-    });
-    if cancellation.is_some_and(CancellationToken::is_cancelled) {
-        return false;
-    }
-    #[cfg(test)]
-    let state = EXPIRY_LOCK_TEST_CONTEXT
-        .try_with(|context| context.state.clone())
-        .unwrap_or_else(|_| ecstore_expiry_state_handle());
-    #[cfg(not(test))]
-    let state = ecstore_expiry_state_handle();
-    let mut state = match cancellation {
-        Some(cancel) => tokio::select! {
-            biased;
-            _ = cancel.cancelled() => return false,
-            state = state.write() => state,
-        },
-        None => state.write().await,
-    };
-    if cancellation.is_some_and(CancellationToken::is_cancelled) {
-        return false;
-    }
-    state.enqueue_by_newer_noncurrent(bucket, to_delete_objs, event, src, bucket_incarnation_id)
+    ecstore_expiry_state_handle().write().await.enqueue_by_newer_noncurrent(
+        bucket,
+        to_delete_objs,
+        event,
+        src,
+        bucket_incarnation_id,
+    )
 }
 
 pub(crate) async fn queue_replication_heal(

crates/scanner/src/remote_scanner/stream.rs

@@ -705,7 +705,7 @@ async fn scan_and_persist_local_bucket(
         RemoteScannerServerError::worker("remote namespace scanner cache publication is blocked by data movement")
     })?;
     let cache_name = path_join_buf(&[&bucket, DATA_USAGE_CACHE_NAME]);
-    let mut guard = acquire_scanner_cache_locks(set.as_ref(), &cache_name, source)
+    let guard = acquire_scanner_cache_locks(set.as_ref(), &cache_name, source)
         .await
         .map_err(|err| {
             if err.is_contention() {
@@ -791,23 +791,19 @@ async fn scan_and_persist_local_bucket(
 
     let set_disks = scanner_set_disk_inventory(set.as_ref()).await;
     let (checkpoint_tx, mut checkpoint_rx) = mpsc::channel::<DataUsageCache>(1);
-    let (node_tx, mut node_rx) = crate::workload_admission::scanner_node_request_channel();
     let scan_ctx = ctx.child_token();
-    let scan = crate::workload_admission::with_scanner_node_requests(
-        node_tx,
-        ScannerIODisk::nsscanner_disk(
-            disk.clone(),
-            scan_ctx.clone(),
-            budget,
-            set_disks,
-            cache,
-            None,
-            ScannerDiskScanOptions {
-                scan_mode,
-                prefix_scan_scope: None,
-                checkpoint_tx: Some(checkpoint_tx),
-            },
-        ),
+    let scan = ScannerIODisk::nsscanner_disk(
+        disk.clone(),
+        scan_ctx.clone(),
+        budget,
+        set_disks,
+        cache,
+        None,
+        ScannerDiskScanOptions {
+            scan_mode,
+            prefix_scan_scope: None,
+            checkpoint_tx: Some(checkpoint_tx),
+        },
     );
     tokio::pin!(scan);
     let fence_watch = watch_remote_scanner_request_fence(next_cycle, leader_epoch, store.clone(), NS_SCANNER_FENCE_POLL_INTERVAL);
@@ -817,27 +813,6 @@ async fn scan_and_persist_local_bucket(
     let mut checkpoint_channel_closed = false;
     let outcome = loop {
         tokio::select! {
-            request = async {
-                match node_rx.as_mut() {
-                    Some(receiver) => receiver.recv().await,
-                    None => std::future::pending().await,
-                }
-            } => {
-                let Some(request) = request else {
-                    node_rx = None;
-                    continue;
-                };
-                if let Err(error) = wait_for_remote_node_resumption(
-                    guard.resume_node_operation(set.clone(), &cache_name, source, &revisions, request),
-                    fence_watch.as_mut(),
-                ).await {
-                    scan_ctx.cancel();
-                    let _ = tokio::time::timeout(NS_SCANNER_LOCK_LOSS_SHUTDOWN_TIMEOUT, scan.as_mut()).await;
-                    return Err(RemoteScannerServerError::retry_bucket(format!(
-                        "remote namespace scanner could not resume node admission: {error}",
-                    )));
-                }
-            }
             result = &mut scan => {
                 match result {
                     Ok(outcome) => break outcome,
@@ -1146,22 +1121,6 @@ pub(crate) async fn scan_remote_bucket(
     result
 }
 
-/// Resource waits must keep checking the persisted leader fence.
-async fn wait_for_remote_node_resumption<F, G>(resume: F, fence_watch: Pin<&mut G>) -> Result<(), StorageError>
-where
-    F: Future<Output = Result<(), StorageError>>,
-    G: Future<Output = Result<(), ScannerError>>,
-{
-    tokio::select! {
-        biased;
-        result = fence_watch => Err(match result {
-            Ok(()) => StorageError::other("remote namespace scanner fence watcher stopped unexpectedly"),
-            Err(error) => StorageError::other(error),
-        }),
-        result = resume => result,
-    }
-}
-
 fn finish_remote_scanner_stream(
     result: RemoteScannerStreamResult<RemoteScannerOutcome>,
     budget: &ScannerCycleBudget,

crates/scanner/src/remote_scanner/stream/tests.rs

@@ -1006,58 +1006,6 @@ async fn fence_watcher_stops_work_after_persisted_leader_changes() {
     assert!(err.to_string().contains("requested_epoch=9"));
 }
 
-#[tokio::test]
-async fn node_admission_wait_does_not_hide_replacement_leader() {
-    use rustfs_concurrency::adaptive::{FeedbackController, FeedbackObservation, NodeAdmission, ResourcePressure};
-    use std::num::NonZeroU16;
-
-    let store = Arc::new(MutableCycleStateStore {
-        state: RwLock::new(crate::scanner::encode_scanner_cycle_fence_for_test(7, 9)),
-    });
-    let cache = Mutex::new(None);
-    let refresh = AsyncMutex::new(());
-    let watcher = watch_remote_scanner_request_fence_with_cache(
-        7,
-        9,
-        store.clone(),
-        Duration::from_millis(5),
-        &cache,
-        &refresh,
-        Duration::from_millis(5),
-    );
-    tokio::pin!(watcher);
-    let gate = NodeAdmission::new(NonZeroU16::new(1).expect("one shared node unit"));
-    let storage_polled = AtomicBool::new(false);
-    {
-        let resume = async {
-            let _permit = gate.acquire().await;
-            storage_polled.store(true, Ordering::Relaxed);
-            Ok(())
-        };
-        let waiting = wait_for_remote_node_resumption(resume, watcher.as_mut());
-        tokio::pin!(waiting);
-        assert!(futures::poll!(&mut waiting).is_pending(), "no resource sample grants a node unit");
-        *store.state.write().expect("persist replacement leader") = crate::scanner::encode_scanner_cycle_fence_for_test(7, 10);
-        let error = tokio::time::timeout(Duration::from_millis(100), waiting)
-            .await
-            .expect("resource pause must not hide a changed leader")
-            .expect_err("old leader cannot resume storage work");
-        assert!(error.to_string().contains("requested_epoch=9"));
-    }
-    assert!(!storage_polled.load(Ordering::Relaxed));
-    assert_eq!(gate.snapshot().active, 0);
-    gate.update(
-        &mut FeedbackController::new(),
-        Some(FeedbackObservation {
-            generation: 1,
-            max_concurrency: 1,
-            pressure: ResourcePressure::Unknown,
-            completed_units: None,
-        }),
-    );
-    assert!(gate.try_acquire().is_some(), "failed fencing drops the old node queue ticket");
-}
-
 #[tokio::test]
 async fn concurrent_cycle_cache_misses_share_one_backend_read() {
     let request = RemoteScannerRequest(test_request(Uuid::new_v4()));

crates/scanner/src/scanner_folder.rs

@@ -43,7 +43,6 @@ use crate::storage_api::owner::{
 };
 #[cfg(test)]
 use crate::storage_api::owner::{EcstoreExpirationStatus as ExpirationStatus, EcstoreLifecycleRule as LifecycleRule};
-use crate::workload_admission::run_scanner_node_operation;
 use metrics::{counter, describe_counter};
 use rustfs_common::trace_bus::{TraceEvent, TraceFunc, TraceKind, trace_emit, trace_subscriber_count};
 use rustfs_filemeta::{
@@ -796,7 +795,6 @@ pub struct FolderScanner {
     resolved_failed_object_paths: HashSet<String>,
 
     sleeper: DynamicSleeper,
-    node_admission: Option<Arc<rustfs_concurrency::adaptive::NodeAdmission>>,
     // should_heal: Arc<dyn Fn() -> bool + Send + Sync>,
     disks: Vec<Arc<Disk>>,
     disks_quorum: usize,
@@ -830,8 +828,6 @@ pub struct FolderScanner {
     pending_size_reconciliation_truncated: bool,
     #[cfg(test)]
     list_path_raw_options_observer: Option<mpsc::UnboundedSender<ListPathRawTimeoutSnapshot>>,
-    #[cfg(test)]
-    defer_abandoned_entries_until_finished: bool,
 }
 
 struct RawEnumerationProgress {
@@ -1002,13 +998,12 @@ async fn next_scanner_dir_entry(
     ctx: &CancellationToken,
     sleeper: &DynamicSleeper,
     entries: &mut ScannerDirectory,
-    admission: Option<&Arc<rustfs_concurrency::adaptive::NodeAdmission>>,
 ) -> Result<Option<tokio::fs::DirEntry>, ScannerError> {
     if entries.batch_entries == SCANNER_DIRECTORY_BATCH_ENTRIES {
         wait_for_scanner_io(ctx, tokio::task::yield_now()).await?;
         entries.batch_entries = 0;
     }
-    let entry = wait_for_scanner_io(ctx, run_scanner_node_operation(admission, ctx, entries.next_entry())).await???;
+    let entry = wait_for_scanner_io(ctx, entries.next_entry()).await??;
     if entry.is_some() {
         // Tokio prefetches bounded chunks. Pacing consumption also paces the
         // next refill, without charging an extra entry for EOF.
@@ -1928,12 +1923,7 @@ impl FolderScanner {
             // directory that vanished during iteration instead of failing the
             // whole parent subtree. The bucket root (no parent) still propagates
             // NotFound so namespace removal is detected by the caller.
-            let mut dir_reader = match wait_for_scanner_io(
-                &ctx,
-                run_scanner_node_operation(self.node_admission.as_ref(), &ctx, ScannerDirectory::open(&dir_path)),
-            )
-            .await??
-            {
+            let mut dir_reader = match wait_for_scanner_io(&ctx, ScannerDirectory::open(&dir_path)).await? {
                 Ok(dir_reader) => Some(dir_reader),
                 Err(e)
                     if folder.parent.is_some()
@@ -1971,7 +1961,7 @@ impl FolderScanner {
                 // Hold at most one metadata entry until a candidate reaches
                 // EOF: a later part must not leave object accounting or ILM work.
                 let (entry, replayed_metadata) = if let Some(reader) = dir_reader.as_mut() {
-                    let entry = match next_scanner_dir_entry(&ctx, &self.sleeper, reader, self.node_admission.as_ref()).await {
+                    let entry = match next_scanner_dir_entry(&ctx, &self.sleeper, reader).await {
                         Ok(Some(entry)) => entry,
                         Ok(None) => {
                             raw_enumeration_complete = true;
@@ -2082,12 +2072,7 @@ impl FolderScanner {
 
                 // Ignore entries that disappeared during traversal or hit symlink
                 // loops, but propagate other walk errors.
-                let mut entry_type = match wait_for_scanner_io(
-                    &ctx,
-                    run_scanner_node_operation(self.node_admission.as_ref(), &ctx, entry.file_type()),
-                )
-                .await??
-                {
+                let mut entry_type = match wait_for_scanner_io(&ctx, entry.file_type()).await? {
                     Ok(entry_type) => entry_type,
                     Err(e) if e.kind() == ErrorKind::NotFound => {
                         debug!(
@@ -2138,12 +2123,7 @@ impl FolderScanner {
                 let mut entry_metadata_len = None;
                 if entry_type.is_symlink() {
                     wait_for_scanner_io(&ctx, self.sleeper.admit_disk_io(1, 0)).await?;
-                    let metadata = match wait_for_scanner_io(
-                        &ctx,
-                        run_scanner_node_operation(self.node_admission.as_ref(), &ctx, tokio::fs::metadata(&file_path)),
-                    )
-                    .await??
-                    {
+                    let metadata = match wait_for_scanner_io(&ctx, tokio::fs::metadata(&file_path)).await? {
                         Ok(metadata) => metadata,
                         Err(e) if e.kind() == ErrorKind::NotFound => {
                             debug!(
@@ -2294,30 +2274,22 @@ impl FolderScanner {
                         len
                     } else {
                         wait_for_scanner_io(&ctx, self.sleeper.admit_disk_io(1, 0)).await?;
-                        wait_for_scanner_io(
-                            &ctx,
-                            run_scanner_node_operation(self.node_admission.as_ref(), &ctx, tokio::fs::metadata(&item.path)),
-                        )
-                        .await??
-                        .map(|metadata| metadata.len())
-                        .unwrap_or(0)
+                        wait_for_scanner_io(&ctx, tokio::fs::metadata(&item.path))
+                            .await?
+                            .map(|metadata| metadata.len())
+                            .unwrap_or(0)
                     }
                 } else {
                     0
                 };
                 wait_for_scanner_io(&ctx, self.sleeper.admit_disk_io(1, budgeted_bytes)).await?;
 
-                let size_result = run_scanner_node_operation(self.node_admission.as_ref(), &ctx, async {
-                    self.object_metadata_visits.increment(1);
-                    self.local_disk
-                        .get_size_with_tier_names(item.clone(), &self.tier_registry.names)
-                        .await
-                })
-                .await?;
-                if self.node_admission.is_some() && ctx.is_cancelled() {
-                    return Err(ScannerError::Other("Operation cancelled".to_string()));
-                }
-                let sz = match size_result {
+                self.object_metadata_visits.increment(1);
+                let sz = match self
+                    .local_disk
+                    .get_size_with_tier_names(item.clone(), &self.tier_registry.names)
+                    .await
+                {
                     Ok(sz) => sz,
                     Err(e) => {
                         let failure_action = classify_get_size_failure(&item, &e);
@@ -2634,7 +2606,7 @@ impl FolderScanner {
                     {
                         Ok(outcome) => outcome,
                         Err(e) => {
-                            if ctx.is_cancelled() || matches!(&e, ScannerError::ResourceDeferred) {
+                            if ctx.is_cancelled() {
                                 self.preserve_partial_child_progress(&folder_item.parent, &h, into, &dst)
                                     .await;
                                 return Err(e);
@@ -2875,23 +2847,19 @@ impl FolderScanner {
                 let mut seen_truncated_objects: HashSet<String> = HashSet::new();
 
                 loop {
-                    if child_ctx.is_cancelled() || (agreed_closed && partial_closed && finished_closed) {
+                    if agreed_closed && partial_closed && finished_closed {
                         break;
                     }
-                    #[cfg(test)]
-                    let defer_entries = self.defer_abandoned_entries_until_finished && !finished_closed;
-                    #[cfg(not(test))]
-                    let defer_entries = false;
 
                     select! {
-                        entry_name = agreed_rx.recv(), if !agreed_closed && !defer_entries => {
+                        entry_name = agreed_rx.recv(), if !agreed_closed => {
                             let Some(entry_name) = entry_name else {
                                 agreed_closed = true;
                                 continue;
                             };
                             (self.update_current_path)(&entry_name).await;
                         }
-                        entries = partial_rx.recv(), if !partial_closed && !defer_entries => {
+                        entries = partial_rx.recv(), if !partial_closed => {
                             let Some(entries) = entries else {
                                 partial_closed = true;
                                 continue;
@@ -3017,7 +2985,6 @@ impl FolderScanner {
                                 finished_closed = true;
                                 continue;
                             };
-                            finished_closed = true;
                             if disk_errors_are_only_missing_paths(&errs) {
                                 debug!(
                                     target: "rustfs::scanner::folder",
@@ -3039,9 +3006,7 @@ impl FolderScanner {
                                     "Scanner list_path_raw finished with disk errors"
                                 );
                             }
-                            // The producer awaited callback sends, not their
-                            // consumption. Drain the remaining candidate and
-                            // agreed frames before closing this child walk.
+                            child_ctx.cancel();
                         }
                         _ = child_ctx.cancelled() => {
                             break;
@@ -3059,10 +3024,7 @@ impl FolderScanner {
                     if into.compacted {
                         // In compacted mode child totals are accumulated directly into the parent entry.
                         let fut = Box::pin(self.scan_folder(ctx.clone(), folder_item.clone(), into));
-                        fut.await.map_err(|error| match error {
-                            ScannerError::ResourceDeferred => ScannerError::ResourceDeferred,
-                            other => ScannerError::Other(other.to_string()),
-                        })?;
+                        fut.await.map_err(|e| ScannerError::Other(e.to_string()))?;
                         self.send_update_for_entry(&this_hash, &folder.parent, into).await;
                         tokio::task::yield_now().await;
                     } else {
@@ -3081,7 +3043,7 @@ impl FolderScanner {
                             )
                             .await
                         {
-                            if ctx.is_cancelled() || matches!(&e, ScannerError::ResourceDeferred) {
+                            if ctx.is_cancelled() {
                                 self.preserve_partial_child_progress(&folder_item.parent, &h, into, &dst)
                                     .await;
                                 return Err(e);
@@ -3255,7 +3217,6 @@ pub(crate) async fn scan_data_folder_scoped(
         failed_object_paths_seen: HashSet::new(),
         resolved_failed_object_paths: HashSet::new(),
         sleeper,
-        node_admission: crate::workload_admission::scanner_node_admission(),
         disks,
         disks_quorum,
         usage_updates,
@@ -3283,8 +3244,6 @@ pub(crate) async fn scan_data_folder_scoped(
         pending_size_reconciliation_truncated: false,
         #[cfg(test)]
         list_path_raw_options_observer: None,
-        #[cfg(test)]
-        defer_abandoned_entries_until_finished: false,
     };
 
     let now = FolderScanner::now_secs();
@@ -3374,7 +3333,7 @@ pub(crate) async fn scan_data_folder_scoped(
             }
         }
         Err(e) => {
-            if ctx.is_cancelled() || matches!(&e, ScannerError::ResourceDeferred) {
+            if ctx.is_cancelled() {
                 let root_hash = hash_path(&bucket_name);
                 let root_has_progress = data_usage_root_has_progress(&root);
                 let pending_heals_changed = scanner.pending_heals_changed;
@@ -3449,19 +3408,6 @@ pub(crate) async fn scan_data_folder_scoped(
                 close_disk_guard.close().await;
                 return Err(ScannerError::NamespaceNotFoundCache(Box::new(partial_cache)));
             }
-            if matches!(&e, ScannerError::ResourceDeferred) {
-                // Admission pressure is not disk failure or an empty census.
-                // Keep the previous tree when no new useful progress exists.
-                let mut partial_cache = scanner.old_cache;
-                if partial_cache.cache.is_empty() {
-                    partial_cache
-                        .cache
-                        .insert(hash_path(&bucket_name).0, DataUsageEntry::default());
-                }
-                partial_cache.info.snapshot_complete = false;
-                close_disk_guard.close().await;
-                return Err(ScannerError::PartialCache(Box::new(partial_cache)));
-            }
             close_disk_guard.close().await;
             // No useful information, return original cache
             Err(e)
@@ -3481,15 +3427,3 @@ pub(crate) use tests::checkpoint_fixture::run_checkpoint_fixture;
 
 #[cfg(test)]
 mod tests;
-
-#[cfg(test)]
-tokio::task_local! {
-    pub(crate) static TEST_SIZE_DISPATCH_BOUNDARIES: tokio::sync::mpsc::UnboundedSender<&'static str>;
-}
-
-#[cfg(test)]
-pub(crate) fn observe_test_size_dispatch_boundary(stage: &'static str) -> bool {
-    TEST_SIZE_DISPATCH_BOUNDARIES
-        .try_with(|sender| sender.send(stage).is_ok())
-        .unwrap_or(false)
-}

crates/scanner/src/scanner_folder/item_actions.rs

@@ -628,22 +628,6 @@ impl ScannerItem {
         tier_names: &[String],
         size_summary: &mut SizeSummary,
     ) {
-        self.apply_actions_cancellable(object_infos, lock_retention, versioning_config, tier_names, size_summary, None)
-            .await;
-    }
-
-    pub(crate) async fn apply_actions_cancellable(
-        &mut self,
-        object_infos: Vec<ObjectInfo>,
-        lock_retention: Option<Arc<ObjectLockConfiguration>>,
-        versioning_config: VersioningConfiguration,
-        tier_names: &[String],
-        size_summary: &mut SizeSummary,
-        cancellation: Option<&CancellationToken>,
-    ) {
-        if cancellation.is_some_and(CancellationToken::is_cancelled) {
-            return;
-        }
         let object_path = self.object_path();
         if object_infos.is_empty() {
             debug!(
@@ -687,9 +671,6 @@ impl ScannerItem {
         let Some(lifecycle) = self.lifecycle.clone() else {
             let mut cumulative_size: i64 = 0;
             for (oi, resolved_size) in object_infos.iter().zip(resolved_sizes.iter()) {
-                if cancellation.is_some_and(CancellationToken::is_cancelled) {
-                    return;
-                }
                 let accounting_size = match resolved_size {
                     SizeResolution::Known { logical, .. } => *logical,
                     // A valid compressed legacy sentinel has no logical size,
@@ -697,7 +678,7 @@ impl ScannerItem {
                     // physical size is only an input to those operations; it
                     // is not folded into the logical total below.
                     SizeResolution::Unknown { physical, .. } => {
-                        self.heal_actions(oi, *physical, size_summary, cancellation).await;
+                        self.heal_actions(oi, *physical, size_summary).await;
                         size_summary.actions_accounting_unknown(oi);
                         continue;
                     }
@@ -707,16 +688,13 @@ impl ScannerItem {
                     }
                 };
 
-                let size = self.heal_actions(oi, accounting_size, size_summary, cancellation).await;
+                let size = self.heal_actions(oi, accounting_size, size_summary).await;
 
                 size_summary.actions_accounting(oi, size, accounting_size);
 
                 cumulative_size = cumulative_size.saturating_add(size);
             }
 
-            if cancellation.is_some_and(CancellationToken::is_cancelled) {
-                return;
-            }
             self.alert_excessive_versions(object_infos.len(), cumulative_size);
 
             debug!(
@@ -758,10 +736,6 @@ impl ScannerItem {
             }
         };
 
-        if cancellation.is_some_and(CancellationToken::is_cancelled) {
-            return;
-        }
-
         // Every version handed to the evaluator counts as an ILM-checked
         // version, whether or not a rule matched (NoneAction included). This is
         // reached only for buckets with lifecycle rules; it feeds
@@ -780,9 +754,6 @@ impl ScannerItem {
             .all(|candidate| Self::tier_is_known(candidate, tier_names));
         'eventLoop: {
             for (i, event) in events.iter().enumerate() {
-                if cancellation.is_some_and(CancellationToken::is_cancelled) {
-                    return;
-                }
                 let oi = &object_infos[i];
                 let known_size = resolved_sizes[i].known_size();
                 if has_corrupt_size
@@ -801,7 +772,7 @@ impl ScannerItem {
                     // accounting. Size-filtered or deferred events remain
                     // pending, so retain the version-only physical counters.
                     if let SizeResolution::Unknown { physical, .. } = &resolved_sizes[i] {
-                        self.heal_actions(oi, *physical, size_summary, cancellation).await;
+                        self.heal_actions(oi, *physical, size_summary).await;
                         size_summary.actions_accounting_unknown(oi);
                     }
                     continue;
@@ -858,7 +829,7 @@ impl ScannerItem {
                                     noncurrent_unknown.push(oi);
                                 } else {
                                     if let SizeResolution::Unknown { physical, .. } = &resolved_sizes[i] {
-                                        self.heal_actions(oi, *physical, size_summary, cancellation).await;
+                                        self.heal_actions(oi, *physical, size_summary).await;
                                     }
                                     size_summary.actions_accounting_unknown(oi);
                                 }
@@ -875,7 +846,7 @@ impl ScannerItem {
                             }
                             IlmAction::NoneAction | IlmAction::ActionCount => {
                                 if let SizeResolution::Unknown { physical, .. } = &resolved_sizes[i] {
-                                    self.heal_actions(oi, *physical, size_summary, cancellation).await;
+                                    self.heal_actions(oi, *physical, size_summary).await;
                                 }
                                 size_summary.actions_accounting_unknown(oi);
                             }
@@ -893,7 +864,7 @@ impl ScannerItem {
                 // side-effecting tier actions fail closed until the registry
                 // recognizes the source again.
                 if Self::action_blocked_by_unknown_tier(event.action, oi, all_versions_known, tier_names, &event.storage_class) {
-                    size = self.heal_actions(oi, actual_size, size_summary, cancellation).await;
+                    size = self.heal_actions(oi, actual_size, size_summary).await;
                     size_summary.actions_accounting(oi, size, actual_size);
                     cumulative_size += size;
                     continue;
@@ -1002,7 +973,7 @@ impl ScannerItem {
                     }
 
                     IlmAction::NoneAction | IlmAction::ActionCount => {
-                        size = self.heal_actions(oi, actual_size, size_summary, cancellation).await;
+                        size = self.heal_actions(oi, actual_size, size_summary).await;
                     }
                 }
 
@@ -1013,9 +984,6 @@ impl ScannerItem {
             }
         }
 
-        if cancellation.is_some_and(CancellationToken::is_cancelled) {
-            return;
-        }
         if !to_delete_objs.is_empty()
             && let Some(event) = noncurrent_events.first().cloned()
         {
@@ -1023,8 +991,7 @@ impl ScannerItem {
             let count = u64::try_from(to_delete_objs.len()).unwrap_or(u64::MAX);
             let done_ilm = Metrics::time_ilm(action);
             let trace_started_at = trace_start_instant();
-            let queued =
-                enqueue_runtime_newer_noncurrent(&self.bucket, to_delete_objs, event, &LcEventSrc::Scanner, cancellation).await;
+            let queued = enqueue_runtime_newer_noncurrent(&self.bucket, to_delete_objs, event, &LcEventSrc::Scanner).await;
             if let Some(trace_started_at) = trace_started_at {
                 let state = if queued { "queued" } else { "not_queued" };
                 trace_emit(|| {
@@ -1055,28 +1022,15 @@ impl ScannerItem {
                 }
             }
         }
-        if !cancellation.is_some_and(CancellationToken::is_cancelled) {
-            self.alert_excessive_versions(remaining_versions, cumulative_size);
-        }
+        self.alert_excessive_versions(remaining_versions, cumulative_size);
     }
 
-    pub(super) async fn heal_actions(
-        &mut self,
-        oi: &ObjectInfo,
-        actual_size: i64,
-        size_summary: &mut SizeSummary,
-        cancellation: Option<&CancellationToken>,
-    ) -> i64 {
-        if cancellation.is_some_and(CancellationToken::is_cancelled) {
-            return actual_size;
-        }
+    pub(super) async fn heal_actions(&mut self, oi: &ObjectInfo, actual_size: i64, size_summary: &mut SizeSummary) -> i64 {
         if self.heal_enabled {
             self.enqueue_heal(oi).await;
         }
 
-        if !cancellation.is_some_and(CancellationToken::is_cancelled) {
-            self.heal_replication(oi, size_summary).await;
-        }
+        self.heal_replication(oi, size_summary).await;
 
         actual_size
     }

crates/scanner/src/scanner_folder/tests.rs

@@ -30,9 +30,7 @@ use std::sync::Mutex;
 pub(super) mod checkpoint_fixture;
 pub(super) mod enumeration_restart;
 mod incremental_enumeration;
-mod listing_completion;
 mod metadata_visits;
-mod node_admission;
 mod usage_updates;
 
 /// Reset the process-global alert cooldown map; test-only.
@@ -366,7 +364,6 @@ async fn build_test_scanner() -> (FolderScanner, std::path::PathBuf) {
         failed_object_paths_seen: HashSet::new(),
         resolved_failed_object_paths: HashSet::new(),
         sleeper: SCANNER_SLEEPER.clone(),
-        node_admission: None,
         disks: Vec::new(),
         disks_quorum: 0,
         usage_updates: None,
@@ -397,7 +394,6 @@ async fn build_test_scanner() -> (FolderScanner, std::path::PathBuf) {
         pending_size_reconciliation_scopes: HashSet::new(),
         pending_size_reconciliation_truncated: false,
         list_path_raw_options_observer: None,
-        defer_abandoned_entries_until_finished: false,
     };
 
     (scanner, temp_dir)
@@ -2266,7 +2262,7 @@ async fn test_heal_actions_returns_actual_size_without_inline_heal() {
     };
     let mut size_summary = SizeSummary::default();
 
-    let size = item.heal_actions(&object_info, 123, &mut size_summary, None).await;
+    let size = item.heal_actions(&object_info, 123, &mut size_summary).await;
     assert_eq!(size, 123);
 }
 

crates/scanner/src/scanner_folder/tests/listing_completion.rs

@@ -1,104 +0,0 @@
-// Copyright 2026 RustFS Team
-// Licensed under the Apache License, Version 2.0.
-
-use super::*;
-
-#[tokio::test]
-#[serial]
-async fn abandoned_listing_drains_candidate_buffered_before_finished() {
-    let (mut scanner, root) = build_test_scanner().await;
-    let _guard = TestGuard {
-        temp_dir: Some(root.clone()),
-    };
-    let bucket = "bucket";
-    let object = "abandoned/object";
-    tokio::fs::create_dir_all(root.join(bucket)).await.expect("local bucket");
-    let mut disks = vec![scanner.local_disk.clone()];
-    let mut original_metadata = Vec::new();
-    for (index, version) in [(2, 0x1935), (3, 0x1935), (4, 0x1934)] {
-        let disk_root = root.join(format!("disk-{index}"));
-        let metadata = metadata_for_object_version(bucket, object, Some(Uuid::from_u128(version)));
-        write_test_object_metadata_bytes(&disk_root, bucket, object, &metadata).await;
-        original_metadata.push((disk_root.join(bucket).join(object).join(STORAGE_FORMAT_FILE), metadata));
-        let endpoint = Endpoint::try_from(disk_root.to_string_lossy().as_ref()).expect("listing fixture endpoint");
-        disks.push(
-            new_disk(
-                &endpoint,
-                &DiskOption {
-                    cleanup: false,
-                    health_check: false,
-                },
-            )
-            .await
-            .expect("listing fixture disk"),
-        );
-    }
-    for cache in [&mut scanner.old_cache, &mut scanner.new_cache] {
-        cache.info.name = bucket.to_owned();
-    }
-    scanner.old_cache.replace(
-        "bucket/abandoned/object",
-        bucket,
-        DataUsageEntry {
-            objects: 1,
-            ..Default::default()
-        },
-    );
-    scanner.heal_object_select = 1;
-    scanner.disks = disks;
-    scanner.disks_quorum = 2;
-    scanner.sleeper = DynamicSleeper::new(rustfs_config::ScannerSpeed::Fastest);
-    // Force the valid select ordering that receives terminal errors before the
-    // final candidate. One candidate frame fits in the bounded partial channel.
-    scanner.defer_abandoned_entries_until_finished = true;
-    let (_commands, mut heal_rx) = rustfs_heal_contracts::heal_channel::init_heal_channels().expect("isolated heal channel");
-    let (captured_tx, mut captured_rx) = mpsc::unbounded_channel();
-    let responder = tokio::spawn(async move {
-        while let Some(command) = heal_rx.recv().await {
-            let rustfs_heal_contracts::heal_channel::HealReceiptCommand { request, response_tx } = command;
-            captured_tx
-                .send((request.object_prefix.clone(), request.object_version_id.clone()))
-                .expect("candidate capture remains open");
-            let _ = response_tx.send(Ok(rustfs_heal_contracts::heal_channel::HealAdmissionReceipt {
-                result: HealAdmissionResult::Accepted,
-                task_id: request.id,
-            }));
-        }
-    });
-    let result = tokio::time::timeout(
-        Duration::from_secs(2),
-        scanner.scan_folder(
-            CancellationToken::new(),
-            CachedFolder {
-                name: bucket.to_owned(),
-                parent: None,
-                object_heal_prob_div: 1,
-            },
-            &mut DataUsageEntry::default(),
-        ),
-    )
-    .await;
-    responder.abort();
-    result
-        .expect("listing completion must close every callback channel")
-        .expect("complete folder scan");
-    let mut candidates = HashSet::new();
-    while let Ok((object, version)) = captured_rx.try_recv() {
-        if let (Some(object), Some(version)) = (object, version) {
-            candidates.insert((object, version));
-        }
-    }
-    let expected = [0x1934, 0x1935]
-        .into_iter()
-        // Raw base-object listings include the trailing separator. Preserve
-        // the producer's candidate identity when draining its callback frame.
-        .map(|version| (format!("{object}/"), Uuid::from_u128(version).to_string()))
-        .collect();
-    assert_eq!(
-        candidates, expected,
-        "terminal disk errors must not discard buffered exact-version candidates"
-    );
-    for (path, metadata) in original_metadata {
-        assert_eq!(tokio::fs::read(path).await.expect("retained metadata"), metadata);
-    }
-}

crates/scanner/src/scanner_io/cache.rs

@@ -172,55 +172,12 @@ fn record_checkpoint_save_failure(cache_name: &str, checkpoint: &DataUsageCache,
 
 #[derive(Debug)]
 pub(crate) struct ScannerCacheLockGuards {
-    scoped: Option<NamespaceLockGuard>,
+    scoped: NamespaceLockGuard,
 }
 
 impl ScannerCacheLockGuards {
     pub(crate) fn is_lock_lost(&self) -> bool {
-        self.scoped.as_ref().is_none_or(NamespaceLockGuard::is_lock_lost)
-    }
-
-    /// Suspend the same traversal while yielding its cache lease. Lock order on
-    /// resumption is node admission -> cache lease -> cache revision reads.
-    pub(crate) async fn resume_node_operation(
-        &mut self,
-        store: Arc<SetDisks>,
-        cache_name: &str,
-        source: DataUsageCacheSource,
-        revisions: &DataUsageCacheRevisions,
-        request: crate::workload_admission::ScannerNodeRequest,
-    ) -> Result<()> {
-        if self.is_lock_lost() {
-            return Err(Error::other("scanner cache lock was lost before node admission"));
-        }
-        if request.respond.is_closed() {
-            return Ok(());
-        }
-        let crate::workload_admission::ScannerNodeRequest { owner, respond, cancel } = request;
-        drop(self.scoped.take());
-        let resume = async {
-            let permit = owner.acquire().await;
-            *self = acquire_scanner_cache_locks(store.as_ref(), cache_name, source)
-                .await
-                .map_err(Error::other)?;
-            let current = crate::storage_api::ecstore_with_background_disk_io(
-                cancel.clone(),
-                DataUsageCache::read_revisions(store, cache_name),
-            )
-            .await?;
-            if self.is_lock_lost() || &current != revisions {
-                return Err(Error::other("scanner cache changed while waiting for node admission"));
-            }
-            // If the walk was dropped, send returns ownership and drops the
-            // permit without recording completed work.
-            let _ = respond.send(permit);
-            Ok(())
-        };
-        tokio::select! {
-            biased;
-            _ = cancel.cancelled() => Err(Error::other("scanner node admission cancelled")),
-            result = resume => result,
-        }
+        self.scoped.is_lock_lost()
     }
 }
 
@@ -258,15 +215,6 @@ impl std::fmt::Display for ScannerCacheLockError {
     }
 }
 
-impl std::error::Error for ScannerCacheLockError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::Create { source, .. } => Some(source),
-            Self::Acquire { source, .. } => Some(source),
-        }
-    }
-}
-
 pub(crate) async fn acquire_scanner_cache_locks(
     store: &SetDisks,
     cache_name: &str,
@@ -289,7 +237,7 @@ pub(crate) async fn acquire_scanner_cache_locks(
             source,
         })?;
 
-    Ok(ScannerCacheLockGuards { scoped: Some(scoped) })
+    Ok(ScannerCacheLockGuards { scoped })
 }
 
 pub(super) async fn await_scanner_disk_shutdown<F>(scan: Pin<&mut F>)

crates/scanner/src/scanner_io/io_cache.rs

@@ -1090,7 +1090,7 @@ impl ScannerIOCache for SetDisks {
 
                     // Lock order: scanner leader fence -> set-scoped per-bucket cache lock ->
                     // cache object read/write.
-                    let mut cache_guard = match acquire_scanner_cache_locks(store_clone_clone.as_ref(), &cache_name, source).await {
+                    let cache_guard = match acquire_scanner_cache_locks(store_clone_clone.as_ref(), &cache_name, source).await {
                         Ok(guard) => guard,
                         Err(e) => {
                             if e.is_contention() {
@@ -1320,10 +1320,9 @@ impl ScannerIOCache for SetDisks {
                     );
 
                     let (checkpoint_tx, mut checkpoint_rx) = mpsc::channel::<DataUsageCache>(1);
-                    let (node_tx, mut node_rx) = crate::workload_admission::scanner_node_request_channel();
 
                     let scan_ctx = ctx_clone.child_token();
-                    let scan = crate::workload_admission::with_scanner_node_requests(node_tx, disk.clone().nsscanner_disk(
+                    let scan = disk.clone().nsscanner_disk(
                         scan_ctx.clone(),
                         budget_clone.clone(),
                         set_disk_inventory_clone.as_ref().clone(),
@@ -1334,7 +1333,7 @@ impl ScannerIOCache for SetDisks {
                             prefix_scan_scope,
                             checkpoint_tx: Some(checkpoint_tx),
                         },
-                    ));
+                    );
                     tokio::pin!(scan);
                     let mut lock_watch = tokio::time::interval(SCANNER_CACHE_LOCK_POLL_INTERVAL);
                     lock_watch.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
@@ -1342,24 +1341,6 @@ impl ScannerIOCache for SetDisks {
                     let scan_result = loop {
                         tokio::select! {
                             result = &mut scan => break result,
-                            request = async {
-                                match node_rx.as_mut() {
-                                    Some(receiver) => receiver.recv().await,
-                                    None => std::future::pending().await,
-                                }
-                            } => {
-                                let Some(request) = request else {
-                                    node_rx = None;
-                                    continue;
-                                };
-                                if let Err(error) = cache_guard.resume_node_operation(
-                                    store_clone_clone.clone(), &cache_name, source, &revisions, request,
-                                ).await {
-                                    scan_ctx.cancel();
-                                    await_scanner_disk_shutdown(scan.as_mut()).await;
-                                    break Err(error);
-                                }
-                            }
                             _ = lock_watch.tick() => {
                                 if cache_guard.is_lock_lost() {
                                     scan_ctx.cancel();

crates/scanner/src/scanner_io/io_disk.rs

@@ -38,13 +38,6 @@ pub(super) fn tier_stats_template(tier_names: &[String]) -> HashMap<String, Tier
     tier_stats
 }
 
-fn ensure_scanner_node_operation_active(cancellation: Option<&CancellationToken>) -> Result<()> {
-    if cancellation.is_some_and(CancellationToken::is_cancelled) {
-        return Err(StorageError::other("Scanner operation cancelled"));
-    }
-    Ok(())
-}
-
 #[async_trait::async_trait]
 impl ScannerIODisk for Disk {
     async fn get_size(&self, item: ScannerItem) -> Result<SizeSummary> {
@@ -52,18 +45,14 @@ impl ScannerIODisk for Disk {
     }
 
     async fn get_size_with_tier_names(&self, mut item: ScannerItem, tier_names: &[String]) -> Result<SizeSummary> {
-        let cancellation = crate::workload_admission::scanner_node_operation_cancellation();
         let done_object = Metrics::time(Metric::ScanObject);
 
         if !is_xl_meta_path(&item.path) {
             return Err(StorageError::other(SCANNER_SKIP_FILE_ERROR.to_string()));
         }
 
-        ensure_scanner_node_operation_active(cancellation.as_ref())?;
         let metadata_object_path = item.object_path();
-        let metadata_result = self.read_metadata(&item.bucket, &metadata_object_path).await;
-        ensure_scanner_node_operation_active(cancellation.as_ref())?;
-        let data = match metadata_result {
+        let data = match self.read_metadata(&item.bucket, &metadata_object_path).await {
             Ok(data) => data,
             Err(e) if DiskError::is_err_object_not_found(&e) || DiskError::is_err_version_not_found(&e) => {
                 return Err(StorageError::other(SCANNER_SKIP_FILE_ERROR.to_string()));
@@ -97,10 +86,7 @@ impl ScannerIODisk for Disk {
         // (which used to query it a second time). On failure keep the
         // historical fallback: default configuration (versioned = false) plus
         // the warn that `apply_actions` used to emit.
-        ensure_scanner_node_operation_active(cancellation.as_ref())?;
-        let versioning_result = BucketVersioningSys::get(&item.bucket).await;
-        ensure_scanner_node_operation_active(cancellation.as_ref())?;
-        let versioning_config = match versioning_result {
+        let versioning_config = match BucketVersioningSys::get(&item.bucket).await {
             Ok(versioning_config) => versioning_config,
             Err(_) => {
                 warn!(
@@ -136,9 +122,7 @@ impl ScannerIODisk for Disk {
             ..Default::default()
         };
 
-        ensure_scanner_node_operation_active(cancellation.as_ref())?;
         let lock_config = object_lock_config_for_scanner_item(&item).await;
-        ensure_scanner_node_operation_active(cancellation.as_ref())?;
 
         // Count every version this object contributes to the scan, independent
         // of any lifecycle configuration, so scan-coverage metrics stay honest
@@ -146,33 +130,17 @@ impl ScannerIODisk for Disk {
         // `object_infos`.
         global_metrics().record_scanner_versions_scanned(object_infos.len() as u64);
 
-        #[cfg(test)]
-        let _ = crate::scanner_folder::observe_test_size_dispatch_boundary("apply_actions");
-        item.apply_actions_cancellable(
-            object_infos,
-            lock_config,
-            versioning_config,
-            tier_names,
-            &mut size_summary,
-            cancellation.as_ref(),
-        )
-        .await;
-        ensure_scanner_node_operation_active(cancellation.as_ref())?;
+        item.apply_actions(object_infos, lock_config, versioning_config, tier_names, &mut size_summary)
+            .await;
 
         if !free_version_infos.is_empty() {
             for oi in free_version_infos {
-                ensure_scanner_node_operation_active(cancellation.as_ref())?;
                 if ScannerItem::tier_is_known(&oi, tier_names) {
-                    #[cfg(test)]
-                    if crate::scanner_folder::observe_test_size_dispatch_boundary("free_version_dispatch") {
-                        continue;
-                    }
-                    enqueue_runtime_free_version(oi, cancellation.as_ref()).await;
+                    enqueue_runtime_free_version(oi).await;
                 }
             }
         }
 
-        ensure_scanner_node_operation_active(cancellation.as_ref())?;
         done_object();
 
         Ok(size_summary)

crates/scanner/src/scanner_io/tests.rs

@@ -46,9 +46,7 @@ use uuid::Uuid;
 
 mod checkpoint_coverage_identity;
 mod collector_lifecycle;
-mod expiry_lock;
 mod listing_window_scope;
-mod node_admission;
 mod partial_bucket_carry;
 mod per_bucket_certification;
 mod scoped_entry_fallback;

crates/scanner/src/scanner_io/tests/expiry_lock.rs

@@ -1,183 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use super::*;
-use crate::storage_api::owner::EcstoreExpiryState;
-use std::future::Future;
-use std::pin::Pin;
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::task::Poll;
-use std::time::Duration;
-
-// Return Some(result) if the operation ended too early, None only if it was
-// actually polled pending after the prerequisite read had finished.
-async fn observe_queued<F: Future>(
-    mut operation: Pin<&mut F>,
-    read_complete: impl Fn() -> bool,
-    observation: Duration,
-) -> std::result::Result<Option<F::Output>, tokio::time::error::Elapsed> {
-    tokio::time::timeout(
-        observation,
-        std::future::poll_fn(|cx| match operation.as_mut().poll(cx) {
-            Poll::Ready(value) => Poll::Ready(Some(value)),
-            Poll::Pending if read_complete() => Poll::Ready(None),
-            Poll::Pending => Poll::Pending,
-        }),
-    )
-    .await
-}
-
-#[tokio::test]
-#[serial]
-async fn free_version_cancelled_while_waiting_for_expiry_write_lock_never_queues() {
-    let state = EcstoreExpiryState::new_with_unconsumed_worker_channel(4);
-    let observation = Duration::from_secs(rustfs_config::DEFAULT_DRIVE_METADATA_TIMEOUT_SECS);
-    let context = crate::ExpiryLockTestContext {
-        state: state.clone(),
-        store: None,
-        completed_incarnation_reads: Arc::new(AtomicUsize::new(0)),
-    };
-    crate::EXPIRY_LOCK_TEST_CONTEXT
-        .scope(context, async {
-            let object = crate::ScannerObjectInfo {
-                bucket: "expiry-lock-bucket".to_string(),
-                name: "free-object".to_string(),
-                ..Default::default()
-            };
-            let cancellation = CancellationToken::new();
-            let guard = state.write().await;
-            let mut pending = Box::pin(crate::enqueue_runtime_free_version(object.clone(), Some(&cancellation)));
-            let first = observe_queued(pending.as_mut(), || true, observation).await;
-            let observed_wait = matches!(&first, Ok(None));
-            let already_finished = matches!(&first, Ok(Some(())));
-            cancellation.cancel();
-            let cancelled_while_locked = if already_finished {
-                false
-            } else {
-                tokio::time::timeout(observation, pending.as_mut()).await.is_ok()
-            };
-            let pending_while_locked = guard.pending_tasks();
-            drop(guard);
-            if !already_finished && !cancelled_while_locked {
-                pending.as_mut().await;
-            }
-            drop(pending);
-            let pending_after_cancel = state.read().await.pending_tasks();
-
-            // Positive control queues a real free-version task while using the same
-            // implementation and isolated, unconsumed worker channel.
-            let mut positive = Box::pin(crate::enqueue_runtime_free_version(object, None));
-            let positive_in_time = tokio::time::timeout(observation, positive.as_mut()).await.is_ok();
-            if !positive_in_time {
-                positive.as_mut().await;
-            }
-            drop(positive);
-            let pending_after_control = state.read().await.pending_tasks();
-            assert!(observed_wait, "must poll the real enqueue while the write lock is held");
-            assert!(cancelled_while_locked, "cancellation must finish before the lock is released");
-            assert_eq!(pending_while_locked, 0);
-            assert_eq!(pending_after_cancel, 0);
-            assert!(positive_in_time, "positive control must finish within the observation limit");
-            assert_eq!(pending_after_control, 1, "positive control must queue a task");
-        })
-        .await;
-}
-
-#[tokio::test]
-#[serial]
-async fn newer_noncurrent_cancelled_after_real_read_while_waiting_for_expiry_write_lock_never_queues() {
-    let (_temp_dir, store) = setup_local_scanner_store(1, 4).await;
-    let bucket = "expiry-lock-bucket";
-    store
-        .make_bucket(bucket, &MakeBucketOptions::default())
-        .await
-        .expect("create bucket");
-    let expected_incarnation = store.bucket_incarnation_id(bucket).await.expect("real incarnation metadata");
-    assert!(!expected_incarnation.is_nil());
-    let state = EcstoreExpiryState::new_with_unconsumed_worker_channel(4);
-    let reads = Arc::new(AtomicUsize::new(0));
-    let context = crate::ExpiryLockTestContext {
-        state: state.clone(),
-        store: Some(store.clone()),
-        completed_incarnation_reads: reads.clone(),
-    };
-    let observation = Duration::from_secs(rustfs_config::DEFAULT_DRIVE_METADATA_TIMEOUT_SECS);
-    crate::EXPIRY_LOCK_TEST_CONTEXT
-        .scope(context, async {
-            let versions = vec![crate::ScannerObjectToDelete {
-                object_name: "noncurrent-object".to_string(),
-                version_id: Some(Uuid::new_v4()),
-                ..Default::default()
-            }];
-            let event = crate::Event::default();
-            let src = crate::LcEventSrc::Scanner;
-            let cancellation = CancellationToken::new();
-            let guard = state.write().await;
-            let mut pending = Box::pin(crate::enqueue_runtime_newer_noncurrent(
-                bucket,
-                versions.clone(),
-                event.clone(),
-                &src,
-                Some(&cancellation),
-            ));
-            let first = observe_queued(pending.as_mut(), || reads.load(Ordering::SeqCst) == 1, observation).await;
-            let observed_wait_after_read = matches!(&first, Ok(None));
-            let mut result = match first {
-                Ok(Some(value)) => Some(value),
-                _ => None,
-            };
-            cancellation.cancel();
-            let cancelled_while_locked = if result.is_some() {
-                false
-            } else {
-                match tokio::time::timeout(observation, pending.as_mut()).await {
-                    Ok(value) => {
-                        result = Some(value);
-                        true
-                    }
-                    Err(_) => false,
-                }
-            };
-            let pending_while_locked = guard.pending_tasks();
-            drop(guard);
-            let result = match result {
-                Some(value) => value,
-                None => pending.as_mut().await,
-            };
-            drop(pending);
-            let pending_after_cancel = state.read().await.pending_tasks();
-            let mut positive = Box::pin(crate::enqueue_runtime_newer_noncurrent(bucket, versions, event, &src, None));
-            let bounded_positive = tokio::time::timeout(observation, positive.as_mut()).await;
-            let positive_in_time = bounded_positive.is_ok();
-            let positive_result = match bounded_positive {
-                Ok(value) => value,
-                Err(_) => positive.as_mut().await,
-            };
-            drop(positive);
-            let pending_after_control = state.read().await.pending_tasks();
-            assert!(
-                observed_wait_after_read,
-                "real incarnation read must finish before waiting on the held lock"
-            );
-            assert!(cancelled_while_locked, "cancellation must finish before the lock is released");
-            assert!(!result);
-            assert_eq!(pending_while_locked, 0);
-            assert_eq!(pending_after_cancel, 0);
-            assert!(positive_in_time, "positive control must finish within the observation limit");
-            assert!(positive_result, "positive control must enqueue the nonempty version batch");
-            assert_eq!(pending_after_control, 1);
-            assert_eq!(reads.load(Ordering::SeqCst), 2);
-        })
-        .await;
-}

crates/scanner/src/scanner_io/tests/node_admission.rs

@@ -1,136 +0,0 @@
-// Copyright 2026 RustFS Team
-// Licensed under the Apache License, Version 2.0.
-
-use super::*;
-use crate::workload_admission::ScannerNodeRequest;
-use rustfs_concurrency::adaptive::{FeedbackController, FeedbackObservation, NodeAdmission, ResourcePressure};
-use std::num::NonZeroU16;
-use tokio::sync::oneshot;
-
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum ResumeCase {
-    Unchanged,
-    Updated,
-    Cancelled,
-}
-
-async fn check_cache_lease_resume(case: ResumeCase) {
-    let (_directory, store) = setup_local_scanner_store(1, 4).await;
-    let set = store.pools[0].disk_set[0].clone();
-    let source = DataUsageCacheSource::new(0, 0);
-    let cache_name = "node-resume/.usage-cache.bin";
-    let cache = DataUsageCache::default();
-    cache.save(set.clone(), cache_name).await.expect("seed cache");
-    let revisions = DataUsageCache::read_revisions(set.clone(), cache_name)
-        .await
-        .expect("initial revisions");
-    let gate = NodeAdmission::new(NonZeroU16::new(1).expect("one shared unit"));
-    gate.update(
-        &mut FeedbackController::new(),
-        Some(FeedbackObservation {
-            generation: 1,
-            max_concurrency: 1,
-            pressure: ResourcePressure::Unknown,
-            completed_units: None,
-        }),
-    );
-    let mut held = Some(gate.acquire().await);
-    let mut guard = acquire_scanner_cache_locks(set.as_ref(), cache_name, source)
-        .await
-        .expect("initial cache lease");
-    let ctx = CancellationToken::new();
-    let (respond, response) = oneshot::channel();
-    let request = ScannerNodeRequest {
-        owner: gate.clone(),
-        respond,
-        cancel: ctx.clone(),
-    };
-    let mut expected = revisions.clone();
-    let result = {
-        let resume = guard.resume_node_operation(set.clone(), cache_name, source, &revisions, request);
-        tokio::pin!(resume);
-        assert!(futures::poll!(&mut resume).is_pending(), "shared node is occupied");
-        let other = tokio::time::timeout(Duration::from_secs(1), acquire_scanner_cache_locks(set.as_ref(), cache_name, source))
-            .await
-            .expect("cache lock must be released before joining the node queue")
-            .expect("another cache worker can acquire the lease");
-        if case == ResumeCase::Updated {
-            let mut newer = cache;
-            newer.info.next_cycle = 1;
-            newer
-                .save(set.clone(), cache_name)
-                .await
-                .expect("another worker updates the cache");
-            expected = DataUsageCache::read_revisions(set.clone(), cache_name)
-                .await
-                .expect("new cache revisions");
-            assert_ne!(expected, revisions);
-        }
-        drop(other);
-        if case == ResumeCase::Cancelled {
-            ctx.cancel();
-        } else {
-            held.take().expect("held node unit").complete();
-        }
-        tokio::time::timeout(Duration::from_secs(2), resume)
-            .await
-            .expect("node resumption must finish or observe cancellation")
-    };
-    if case == ResumeCase::Unchanged {
-        result.expect("unchanged cache resumes the same walk");
-        let permit = response.await.expect("coordinator returns the node permit");
-        assert_eq!(gate.snapshot().active, 1);
-        assert_eq!(gate.completed(), Some(1), "admitting scanner work must not count it as completed");
-        assert!(!guard.is_lock_lost());
-        let lock = set
-            .new_ns_lock(RUSTFS_META_BUCKET, &scanner_cache_lock_resource(cache_name, source))
-            .await
-            .expect("competing cache lock");
-        assert!(
-            lock.get_write_lock_quiet(Duration::from_millis(20)).await.is_err(),
-            "cache lease must be restored before the operation resumes"
-        );
-        permit.complete();
-    } else {
-        result.expect_err("cancelled or stale work cannot resume");
-        assert!(response.await.is_err(), "failed resumption must not authorize storage work");
-        if case == ResumeCase::Cancelled {
-            assert!(guard.is_lock_lost());
-            assert_eq!(gate.snapshot().active, 1, "the running heal keeps its unit");
-            drop(held.take());
-            assert_eq!(gate.completed(), Some(0));
-        } else {
-            assert_eq!(gate.completed(), Some(1));
-        }
-    }
-    drop(guard);
-    assert_eq!(gate.snapshot().active, 0);
-    assert!(gate.try_acquire().is_some(), "dropped requests must leave no queue or capacity leak");
-    assert_eq!(
-        DataUsageCache::read_revisions(set.clone(), cache_name)
-            .await
-            .expect("final revisions"),
-        expected
-    );
-    acquire_scanner_cache_locks(set.as_ref(), cache_name, source)
-        .await
-        .expect("final cache lease is available");
-}
-
-#[tokio::test]
-#[serial]
-async fn scanner_node_wait_yields_cache_lease_before_fifo_admission() {
-    check_cache_lease_resume(ResumeCase::Unchanged).await;
-}
-
-#[tokio::test]
-#[serial]
-async fn scanner_node_wait_rejects_cache_changed_while_unlocked() {
-    check_cache_lease_resume(ResumeCase::Updated).await;
-}
-
-#[tokio::test]
-#[serial]
-async fn scanner_node_wait_cancellation_releases_queue_without_stealing_running_unit() {
-    check_cache_lease_resume(ResumeCase::Cancelled).await;
-}

crates/scanner/src/storage_api.rs

@@ -22,8 +22,6 @@ use serde::{Deserialize, Serialize};
 use tokio::sync::Notify;
 
 pub(crate) use rustfs_ecstore::with_background_disk_io as ecstore_with_background_disk_io;
-#[cfg(all(test, unix))]
-pub(crate) use rustfs_ecstore::with_background_resource_unit as ecstore_with_background_resource_unit;
 
 pub(crate) use s3s::dto::{
     BucketLifecycleConfiguration as EcstoreBucketLifecycleConfiguration, LifecycleRuleFilter as EcstoreLifecycleRuleFilter,
@@ -41,8 +39,6 @@ pub(crate) use rustfs_ecstore::api::data_usage::{NativeScannerPauseBacklogWriteF
 
 pub(crate) use rustfs_ecstore::api::bucket::bucket_target_sys::BucketTargetSys as EcstoreBucketTargetSys;
 pub(crate) use rustfs_ecstore::api::bucket::lifecycle::bucket_lifecycle_audit::LcEventSrc as EcstoreLcEventSrc;
-#[cfg(test)]
-pub(crate) use rustfs_ecstore::api::bucket::lifecycle::bucket_lifecycle_ops::ExpiryState as EcstoreExpiryState;
 pub(crate) use rustfs_ecstore::api::bucket::lifecycle::bucket_lifecycle_ops::{
     apply_expiry_rule as ecstore_apply_expiry_rule, apply_transition_rule as ecstore_apply_transition_rule,
     lifecycle_version_delete_target as ecstore_lifecycle_version_delete_target,
@@ -103,10 +99,6 @@ pub(crate) use rustfs_ecstore::api::disk::{
 pub(crate) use rustfs_ecstore::api::disk::{
     DiskOption as EcstoreDiskOption, DiskStore as EcstoreDiskStore, new_disk as ecstore_new_disk,
 };
-#[cfg(all(test, unix))]
-pub(crate) use rustfs_ecstore::api::disk::{
-    LocalPublicationPause as EcstoreLocalPublicationPause, LocalPublicationStage as EcstoreLocalPublicationStage,
-};
 pub(crate) use rustfs_ecstore::api::error::{
     Error as EcstoreErrorType, Result as EcstoreResultType, StorageError as EcstoreStorageError,
 };
@@ -169,17 +161,10 @@ pub(crate) mod ecstore_diagnostic {
 pub(crate) type EcstoreHealResultItem = <EcstoreStore as storage_contracts::HealOperations>::HealResultItem;
 
 pub(crate) mod owner {
-    #[cfg(test)]
-    pub(crate) use super::EcstoreExpiryState;
     #[cfg(test)]
     pub(crate) use super::ecstore_set_object_store_resolver;
     #[cfg(test)]
     pub(crate) use super::storage_contracts::DiskSetSelector;
-    #[cfg(all(test, unix))]
-    pub(crate) use super::{
-        EcstoreLocalPublicationPause, EcstoreLocalPublicationStage, ecstore_with_background_disk_io,
-        ecstore_with_background_resource_unit,
-    };
     pub(crate) use super::{
         MAX_SCANNER_PAUSE_BACKLOG_BYTES, ScannerPauseBacklogRetirementError, ScannerPauseBacklogRetirementPlan,
         ScannerPauseBacklogRetirementReplica, register_scanner_pause_backlog_retirement_planner,

crates/scanner/src/workload_admission.rs

@@ -12,143 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, LazyLock, OnceLock, RwLock};
+use std::sync::{Arc, LazyLock, RwLock};
 
-use rustfs_concurrency::adaptive::{NodeAdmission, NodePermit};
 use rustfs_concurrency::{AdmissionState, WorkloadAdmissionRegistrySnapshot, WorkloadAdmissionSnapshotProvider, WorkloadClass};
-use tokio::sync::{mpsc, oneshot};
-use tokio_util::sync::CancellationToken;
-
-use crate::ScannerError;
-
-static SCANNER_NODE_ADMISSION: OnceLock<Arc<NodeAdmission>> = OnceLock::new();
-
-tokio::task_local! {
-    static SCANNER_NODE_REQUESTS: ScannerNodeRequestSender;
-    static SCANNER_NODE_OPERATION_CANCEL: CancellationToken;
-}
-
-/// Cancellation for the currently admitted scanner operation, when present.
-pub(crate) fn scanner_node_operation_cancellation() -> Option<CancellationToken> {
-    SCANNER_NODE_OPERATION_CANCEL.try_with(Clone::clone).ok()
-}
-
-pub(crate) struct ScannerNodeRequest {
-    pub(crate) owner: Arc<NodeAdmission>,
-    pub(crate) respond: oneshot::Sender<NodePermit>,
-    pub(crate) cancel: CancellationToken,
-}
-
-pub(crate) type ScannerNodeRequestSender = mpsc::Sender<ScannerNodeRequest>;
-pub(crate) type ScannerNodeRequestReceiver = mpsc::Receiver<ScannerNodeRequest>;
-
-/// One suspended operation per walk; disabled admission allocates no channel.
-pub(crate) fn scanner_node_request_channel() -> (Option<ScannerNodeRequestSender>, Option<ScannerNodeRequestReceiver>) {
-    if scanner_node_admission().is_none() {
-        return (None, None);
-    }
-    let (sender, receiver) = mpsc::channel(1);
-    (Some(sender), Some(receiver))
-}
-
-pub(crate) async fn with_scanner_node_requests<F: std::future::Future>(
-    sender: Option<ScannerNodeRequestSender>,
-    operation: F,
-) -> F::Output {
-    match sender {
-        Some(sender) => SCANNER_NODE_REQUESTS.scope(sender, operation).await,
-        None => operation.await,
-    }
-}
-
-#[cfg(test)]
-tokio::task_local! {
-    pub(crate) static TEST_SCANNER_NODE_ADMISSION: Arc<NodeAdmission>;
-    pub(crate) static TEST_SCANNER_AFTER_NODE_ACQUIRE: Arc<dyn Fn() + Send + Sync>;
-}
-
-/// Install the heal manager's node owner before starting scanner workers.
-/// Refuse replacement: existing scans must not outlive an independently renewed owner.
-pub fn set_scanner_node_admission(owner: Arc<NodeAdmission>) -> bool {
-    SCANNER_NODE_ADMISSION.set(owner).is_ok()
-}
-
-pub(crate) fn scanner_node_admission() -> Option<Arc<NodeAdmission>> {
-    #[cfg(test)]
-    if let Ok(owner) = TEST_SCANNER_NODE_ADMISSION.try_with(Arc::clone) {
-        return Some(owner);
-    }
-    SCANNER_NODE_ADMISSION.get().cloned()
-}
-
-/// Try the fast path first. A scoped coordinator releases the cache lease before
-/// joining the node queue and validates the cache before returning a permit.
-/// Uncoordinated callers defer instead of parking under an unknown lock.
-pub(crate) async fn run_scanner_node_operation<T, E>(
-    owner: Option<&Arc<NodeAdmission>>,
-    cancel: &CancellationToken,
-    operation: impl std::future::Future<Output = Result<T, E>>,
-) -> Result<Result<T, E>, ScannerError> {
-    let Some(owner) = owner else {
-        return Ok(operation.await);
-    };
-    let operation = SCANNER_NODE_OPERATION_CANCEL.scope(cancel.clone(), operation);
-    if cancel.is_cancelled() {
-        return Err(ScannerError::Other("Operation cancelled".to_string()));
-    }
-    let permit = match owner.try_acquire() {
-        Some(permit) => permit,
-        None => {
-            let sender = SCANNER_NODE_REQUESTS
-                .try_with(Clone::clone)
-                .map_err(|_| ScannerError::ResourceDeferred)?;
-            let acquire = async {
-                let (respond, response) = oneshot::channel();
-                sender
-                    .send(ScannerNodeRequest {
-                        owner: owner.clone(),
-                        respond,
-                        cancel: cancel.clone(),
-                    })
-                    .await
-                    .map_err(|_| ScannerError::ResourceDeferred)?;
-                response.await.map_err(|_| ScannerError::ResourceDeferred)
-            };
-            tokio::select! {
-                biased;
-                _ = cancel.cancelled() => return Err(ScannerError::Other("Operation cancelled".to_string())),
-                permit = acquire => permit?,
-            }
-        }
-    };
-    #[cfg(test)]
-    let _ = TEST_SCANNER_AFTER_NODE_ACQUIRE.try_with(|hook| hook());
-    let operation_started = AtomicBool::new(false);
-    tokio::pin!(operation);
-    let observed = std::future::poll_fn(|context| {
-        operation_started.store(true, Ordering::Relaxed);
-        std::future::Future::poll(operation.as_mut(), context)
-    });
-    tokio::pin!(observed);
-    let result = tokio::select! {
-        biased;
-        _ = cancel.cancelled() => {
-            // The node slot belongs to the waiter, not the native operation.
-            drop(permit);
-            if !operation_started.load(Ordering::Relaxed) {
-                return Err(ScannerError::Other("Operation cancelled".to_string()));
-            }
-            // Keep polling the started operation under its existing locks.
-            return Ok(observed.await);
-        }
-        result = &mut observed => result,
-    };
-    if result.is_ok() && !cancel.is_cancelled() {
-        permit.complete();
-    }
-    Ok(result)
-}
 
 type WorkloadSnapshotProviderRef = Arc<dyn WorkloadAdmissionSnapshotProvider + Send + Sync>;
 

docs/architecture/README.md

@@ -50,7 +50,6 @@ Required headings and strings in these files are asserted by `scripts/check_arch
 | [scanner-usage-authority-decision.md](scanner-usage-authority-decision.md) | deciding whether quota admission depends on scanner data usage, removing scanner publication layers, or designing a scanner storage boundary |
 | [scanner-per-bucket-convergence.md](scanner-per-bucket-convergence.md) | changing what makes a scanner cycle `Complete`, `Superseded`, or converged, adding or re-classifying a dirty-usage producer, deciding whether a background writeback may invalidate a cycle, changing scanner worker concurrency or throttling, or activating scoped dirty acknowledgements |
 | [config-model-boundary-adr.md](config-model-boundary-adr.md) | touching the server-config model (`Config`, `KV`, `KVS`) or its persistence, or asking which crate owns which part of server configuration |
-| [plugin-delegation.md](plugin-delegation.md) | changing original-user plugin delegation, attempt credentials, or Runner task APIs |
 | [admin-route-action-snapshot.md](admin-route-action-snapshot.md) | adding, moving, or re-authorizing an admin route and needing to know where the route → handler → `AdminAction` contract is enforced |
 | [kms-bulk-rekey-contract.md](kms-bulk-rekey-contract.md) | changing the bulk envelope re-wrap sweep, its admin endpoints, the re-wrap primitive, or which objects a rekey may touch |
 | [remote-credential-sealing-adr.md](remote-credential-sealing-adr.md) | adding, reading, or persisting a stored remote credential (replication target, remote tier, on-demand migration source), or needing the sealed-envelope format, the mixed-version rules, or the reason this is worth doing in one deployment and not in another |

docs/architecture/erasure-coding.md

@@ -5,7 +5,7 @@
 
 Status: normative. This document is the source of truth for how RustFS erasure-codes, stores, reads, reconstructs, and heals user data, and for the on-disk / on-wire compatibility contract that every future change must preserve. It governs the highest-risk code in the system: a regression here can silently corrupt or lose all user data, or make existing (and MinIO-migrated) objects permanently unreadable.
 
-Erasure coding, quorum/heal, and metadata/on-disk formats are **High-risk** per [AGENTS.md](../../AGENTS.md). Any behavior-affecting change to code this document governs requires adversarial review and, for anything touching decode or the on-disk format, a regression test against real on-disk and MinIO-migrated samples before merge.
+Erasure coding, quorum/heal, and metadata/on-disk formats are **High-risk** per [AGENTS.md](../../AGENTS.md) ("Broad or High-Risk Changes"). Any behavior-affecting change to code this document governs requires adversarial review with the `adversarial-validation` skill and, for anything touching decode or the on-disk format, a regression test against real on-disk and MinIO-migrated samples before merge.
 
 This document describes the algorithm as implemented on `main`. The *invariant* stated is always the rule the code must satisfy; where the code enforces it, the enforcing symbol is cited.
 
@@ -313,7 +313,7 @@ Small objects store their payload inline after the container CRC ([filemeta_inli
 ## 8. Read path and read quorum
 
 - **INVARIANT — read quorum = `data_blocks`.** `object_quorum_from_meta` returns `(read_quorum = data_blocks, write_quorum)` ([set_disk/metadata.rs](../../crates/ecstore/src/set_disk/metadata.rs)); `parity_blocks = common_parity(...)` is the parity value held by the most disks that still reaches its own read quorum. When `default_parity_count == 0`, read = write = all shards.
-- Authoritative FileInfo selection — `find_file_info_in_quorum` ([set_disk/metadata.rs](../../crates/ecstore/src/set_disk/metadata.rs)) groups valid metas by a content-identity SHA-256 (`file_info_quorum_hash`) that hashes size/flags/mod_time/transition/version_id/data_dir/parts and, for real objects, data/parity/distribution — **excluding replication-status keys** so replication noise never splits quorum. A meta counts only if its mod_time equals the common mod_time (or etag matches when mod_time is absent). The winning hash must reach quorum, else `ErasureReadQuorum`. S3 reads select at read quorum through `select_valid_fileinfo`, the same rule heal uses and MinIO's `getObjectFileInfo`: the most common mod_time wins and a tie goes to the newer one, so a write that failed after reaching exactly `data_blocks` copies is served as listing shows it, instead of `ErasureReadQuorum` until heal runs. Two identities tied at the selected mod_time (a data = parity set split in half, such as a metadata update that failed after reaching half the drives) resolve to the one on the lowest-index disk, in reads and heal alike, so a retried metadata write can repair the split. A selected version with local shards also needs as many copies as its own `data_blocks`, since delete markers and empty versions can lower the common parity's read quorum. A metadata update whose target disks cannot reach write quorum is refused before any write. A version replaced by a committed write keeps fewer than `data_blocks` copies and can never be selected again; the newer side of a failed write can be served and then lose to the older side if one of its disks fails before heal converges the set. Reads in the system bucket (`is_meta_bucketname`) keep the commit-proof rule in `select_committed_fileinfo`: when enough copies answer to prove write quorum, the latest version must hold it, and a degraded read never serves a newer version below write quorum. Pool metadata's PREPARE/COMMIT recovery and identity epochs rely on an ordinary read implying a committed record, so a split stays unreadable until native recovery resolves it. When every drive answered and an S3 latest read still cannot select a version, `read_latest_past_dangling_versions` walks the version stack newest first through exact-version reads, as MinIO's `pickLatestQuorumFilesInfo` resolves stacks: it serves the readable version with the newest selected mod_time, skips versions whose exact read proves them dangling (the NoSuchVersion an explicit GET reports) and queues heal for them, and keeps the read-quorum error on any other outcome. A failed versioned PUT that left the new version on fewer drives than its data blocks therefore no longer hides the committed version below it; ListObjectVersions can still show the dangling version as latest until heal removes it. Metadata updates of the latest version (object tagging, `put_object_metadata`) and the CopyObject source read resolve a failed selection through the same walk; when the walk finds no readable version, tagging keeps the read-quorum error while `put_object_metadata` and CopyObject keep their existing `delete_if_dangling` cleanup. Replication status write-back never walks. The update targets only the served version's disks and is refused before writing when they cannot reach its write quorum, including a version-only copy.
+- Authoritative FileInfo selection — `find_file_info_in_quorum` ([set_disk/metadata.rs](../../crates/ecstore/src/set_disk/metadata.rs)) groups valid metas by a content-identity SHA-256 (`file_info_quorum_hash`) that hashes size/flags/mod_time/transition/version_id/data_dir/parts and, for real objects, data/parity/distribution — **excluding replication-status keys** so replication noise never splits quorum. A meta counts only if its mod_time equals the common mod_time (or etag matches when mod_time is absent). The winning hash must reach quorum, else `ErasureReadQuorum`. Reads select at read quorum through `select_valid_fileinfo`, the same rule heal uses and MinIO's `getObjectFileInfo`: the most common mod_time wins and a tie goes to the newer one, so a write that failed after reaching exactly `data_blocks` copies is served as listing shows it, instead of `ErasureReadQuorum` until heal runs. Two identities tied at the selected mod_time (a data = parity set split in half, such as a metadata update that failed after reaching half the drives) resolve to the one on the lowest-index disk, in reads and heal alike, so a retried metadata write can repair the split. A selected version with local shards also needs as many copies as its own `data_blocks`, since delete markers and empty versions can lower the common parity's read quorum. A metadata update whose target disks cannot reach write quorum is refused before any write. A version replaced by a committed write keeps fewer than `data_blocks` copies and can never be selected again; the newer side of a failed write can be served and then lose to the older side if one of its disks fails before heal converges the set.
 - **INVARIANT — decode needs ≥ `data_blocks` shards.** The stripe reader requires `available_shards ≥ data_shards`; below that the read fails closed with a read-quorum error (never silent truncation) ([set_disk/read.rs](../../crates/ecstore/src/set_disk/read.rs), [set_disk/shard_source.rs](../../crates/ecstore/src/set_disk/shard_source.rs)). Codec geometry is validated at construction: `Erasure::try_new` / `try_new_with_options` ([erasure.rs](../../crates/ecstore/src/erasure/coding/erasure.rs)) return `ErasureConstructionError` for `data_shards == 0`, `block_size == 0`, shard-count overflow, or an unsupported shard configuration, so a read never reaches a `block_size` / `data_shards` division with invalid geometry (§13).
 - If `available ≥ data_blocks` but some shards are missing, the read is served **and** a background read-repair heal is enqueued.
 - **INVARIANT — cross-stripe read verification.** When a data shard is missing and `available > data_blocks`, reconstruction regenerates parity and compares it to the surviving parity; a mismatch is `InvalidData "inconsistent read source shards"` (backlog#832), catching corruption that passed per-shard bitrot but disagrees across the stripe ([erasure.rs](../../crates/ecstore/src/erasure/coding/erasure.rs)).
@@ -400,7 +400,7 @@ Decode tolerance
 
 ## 13. Change procedure and guardrails
 
-- **Risk tier.** All of the above is High-risk ([AGENTS.md](../../AGENTS.md)). Any behavior-affecting change requires adversarial review.
+- **Risk tier.** All of the above is High-risk ([AGENTS.md](../../AGENTS.md) "Broad or High-Risk Changes"). Any behavior-affecting change requires adversarial review with the `adversarial-validation` skill.
 - **Keep this document in sync.** A change to any governed behavior, formula, format field, or invariant must update this spec in the same PR; renaming a cited symbol must update its reference here. The spec is normative and is the checklist the next change is reviewed against, so drift is a correctness defect. References are symbol-based (not line numbers) specifically so ordinary refactors do not invalidate them — but semantic changes still must.
 - **Adding an on-disk field** must be additive: new msgpack key or a `minor`/`meta_ver` bump with a read path for the old value; keep decoders skipping unknown keys; write both internal-key prefixes; never repurpose or reorder existing keys or header array positions.
 - **Never make a decode boundary stricter** than what §11 allows without (a) proving no legitimate older-RustFS or MinIO-migrated shape is rejected, and (b) a regression test against real on-disk and MinIO fixtures. New validation belongs at the trust boundary and must fail *open to a tolerant default*, not closed to `FileCorrupt`, for anything recoverable. (Concretely: rejecting a negative `actual_size`, or hard-failing a non-16-byte `transitioned-versionID`, breaks existing data — see §11.)

docs/architecture/plugin-delegation.md

@@ -1,142 +0,0 @@
-# Plugin delegation
-
-**Use this when:** changing plugin delegation registration, revocation, broker identity, or the scope of attempt credentials.
-
-## Integration boundary
-
-Runner owns scheduling, leases, container execution and result publication. RustFS provides original-user delegation, scoped temporary credentials and authenticated task API forwarding. Inputs and outputs use ordinary versioned S3 buckets; event-driven jobs use the existing bucket notification/Webhook path. Managed artifact sealing, inventory, garbage collection and backup retention require separate storage contracts and are outside this integration.
-
-Set `RUSTFS_PLUGIN_RUNNER_URL` to the Controller HTTPS URL ending in `/v1/ingress/manual/jobs`, and `RUSTFS_PLUGIN_RUNNER_DEPLOYMENT` to the delegation deployment. Forwarding requires the published outbound mTLS client identity and uses the published trust roots when configured. Connections are reused within a TLS generation; publishing new TLS material replaces the pool, and removing the client identity rejects new forwarding requests.
-
-## Authority
-
-A delegation is an immutable restriction record owned by an ordinary IAM user. It is neither a permission grant nor a credential. Creating it requires that user's real signed request and `admin:CreatePluginDelegation`; reading and revoking require the corresponding `admin:GetPluginDelegation` and `admin:RevokePluginDelegation` actions. Root, temporary credentials and service accounts cannot own records.
-
-The record binds a deployment, an input bucket, literal input and output prefixes, and an expiry of at most 24 hours. The v1 profile writes to that same bucket; v2 explicitly names the output bucket. Wildcards, control characters and IAM variable expressions are rejected. Its random ID is also its immutable revision. There is no update operation.
-
-The Controller is responsible for validating accepted task identity, current lease, epoch, node session and control generation before requesting credentials. RustFS authenticates the configured broker and enforces the delegation and current parent IAM. RustFS does not independently verify a remote Controller lease.
-
-```mermaid
-sequenceDiagram
-    participant U as Original IAM user
-    participant C as Controller broker
-    participant R as RustFS
-    participant P as Plugin
-    U->>R: Signed delegation registration
-    R-->>U: Immutable ID and revision
-    C->>C: Validate task and current lease
-    C->>R: Signed issue-attempt request
-    R->>R: Broker mapping + active record + current IAM
-    R->>R: Persist scoped STS and recheck authority
-    R-->>C: Short-lived credentials
-    C-->>P: Attempt credentials
-    P->>R: Exact version GET / attempt-prefix PUT
-    R->>R: Current parent IAM intersected with session policy
-```
-
-## Persistence and revocation
-
-`crates/iam/src/delegation.rs` owns record validation and immutable revocation tombstones. Records use the existing IAM store under `config/iam/plugin-delegations/v1`. Writes require a successful readback. Revocation is idempotent and durable; it does not delete or overwrite the restriction record.
-
-`ObjectStore::load_iam_config_strict` distinguishes a missing object from an empty object, invalid JSON or failed decryption. Only a genuinely absent tombstone permits an active record. Corrupt or unavailable storage rejects access rather than treating revocation as absent. Existing non-delegation readers keep their compatibility behavior.
-
-Revocation prevents future issuance. It does not promise immediate invalidation of credentials already delivered; those remain subject to their expiration and current parent IAM. Registration, IAM changes and issuance are not one atomic transaction. Issuance rechecks after persistence and deletes the generated STS account if authority changed. Failed persistence or invalidation acknowledgment is reported as unknown issuance, never as safe retry permission.
-
-Manual job submission reads the active delegation before calling the Runner. A submission that passed this check is in flight and may be admitted if revocation races with the outbound request; revocation prevents submissions whose authority check occurs afterward, but does not cancel an admitted job. Callers must treat a successful submit receipt as accepted work even if the delegation is revoked later. After an ambiguous timeout or service error, retry the same idempotency key while the delegation remains active; after revocation or expiry, query status instead of retrying submission.
-
-`POST /rustfs/admin/v3/plugin-delegations/{id}/runs/query` accepts `{version:1,run_id}` and requires an ordinary IAM user with `admin:GetPluginRun` who owns the delegation in `{id}`. It reads the immutable owner record without checking expiry or revocation, then queries Runner using the record's delegation ID and revision and the authenticated access key. The result can contain only that caller's run status and committed manifest; it does not perform object reads or reauthorize object access. The Runner response must match the requested run ID and the strict status schema before RustFS returns it.
-
-`POST /rustfs/admin/v3/plugin-delegations/{id}/runs/cancel` accepts the same request and requires `admin:CancelPluginRun` plus ownership of `{id}`. Expiry and revocation do not block cancelling an existing run. Runner scopes the run to that owner; missing and other-owner runs share the same not-found response, while successful and failed runs return conflict. Success returns `{version:1,run_id,state:"CANCELLED",cleanup_pending}` and does not imply that asynchronous cleanup has finished.
-
-`POST /rustfs/admin/v3/plugin-delegations/{id}/runs/page` accepts `{version:1,limit,cursor?}` with a limit from 1 to 100 and requires `admin:ListPluginRuns` plus ownership of `{id}`. Expiry and revocation do not hide historical runs. RustFS supplies signer and delegation identity from authenticated IAM state; the Runner page is scoped to the exact caller and deployment. The strict response contains run summaries and an opaque-to-clients stable cursor; callers pass the returned cursor unchanged until it is null. RustFS bounds request/response sizes and rejects malformed, unordered, over-limit, or identity-invalid summaries.
-
-`POST /rustfs/admin/v3/plugin-delegations/{id}/runs/history` accepts `{version:1,run_id}` and requires `admin:ListPluginRuns` plus ownership of `{id}`. RustFS derives signer and delegation identity from the authenticated user and IAM record, then proxies Runner's bounded history response. The response contains at most the latest 32 committed state events in Runner's history-ID order and a `has_older` flag; timestamps are display data and are not used to reorder events. Missing and foreign runs share the same not-found response. RustFS rejects malformed, empty, over-limit, unexpected-state, or mismatched-run responses and bounds both request and response bodies.
-
-`POST /rustfs/admin/v3/plugin-delegations/{id}/runs/replay` accepts `{version:1,origin_run_id,idempotency_key,deadline_unix_micros}` and requires `admin:ReplayPluginRun`, current IAM authorization, ownership, and an active unexpired delegation. Caller identity fields are not accepted; RustFS derives signer and delegation revision from the authenticated request and IAM record. Runner accepts only an owned failed origin, preserves its fixed plugin/configuration/input version, and requires a new deadline no later than its configured run timeout. RustFS requires a positive Unix-microsecond deadline and verifies the strict receipt echoes it. Missing or foreign origins share not-found behavior; conflicts map to an operation conflict. Requests and receipts are bounded, and responses use `Cache-Control: no-store`.
-
-## Broker profile
-
-`rustfs/src/admin/handlers/plugin_attempt.rs` implements `POST /rustfs/admin/v3/plugin-delegations/{id}/issue-attempt`. The signer must be an ordinary IAM user with `admin:IssuePluginAttempt`, independently listed in `RUSTFS_PLUGIN_BROKERS`:
-
-```json
-{"broker-access-key":"deployment-name"}
-```
-
-This configuration contains public access keys, not secrets. It is immutable per process. Missing or invalid configuration disables broker issuance. The broker is a trusted Controller identity; ordinary users cannot substitute their own request fields for Controller validation.
-
-The request carries `tenant`, `run_id`, `attempt_id`, `revision`, `deployment`, `input_bucket`, `input_key`, `input_version`, `output_bucket`, `output_prefix` and `ttl_seconds`. IDs must be non-nil. Both profiles accept one exact input version and an output prefix equal to:
-
-```text
-<delegation-output-prefix><lowercase-hex-tenant>/<run-uuid>/<attempt-uuid>/
-```
-
-The session policy permits only `s3:GetObjectVersion` for that input with an exact `s3:VersionId`, and `s3:PutObject` beneath that attempt prefix. Credential lifetime is at most 900 seconds and cannot exceed delegation expiry. The Controller must additionally cap it to its validated lease and hard deadline.
-
-The original user's current IAM remains the parent permission boundary on every S3 request. The server's signing key only seals the token; it is not the plugin's authorization identity. Broker identity and original user identity are separate.
-
-External policy plugins must be disabled: their authorization path does not enforce this built-in session-policy boundary. Initializing, failed and ready plugin states all reject issuance. Attempt tokens carry a signed, persisted marker: after restart or on another node, marked credentials are accepted only by built-in STS authorization. A denied marked request returns a terminal error, so public bucket policies cannot bypass its session scope. The first profile also rejects parent policies containing conditions, because a broker request cannot reconstruct the original user's IP, MFA or other request context. It does not silently replace that context with the broker's.
-
-## Response and failures
-
-Successful issuance returns `version`, `delegation_id`, `delegation_revision`, `owner_access_key`, `access_key_id`, `secret_access_key`, `session_token` and `expires_at_unix_seconds`, with `Cache-Control: no-store`. The Controller verifies the returned delegation and owner against the accepted caller before delivery. Credentials must never enter logs, metrics or task result manifests.
-
-Missing records and records owned by a different user have the same read response. Revoked or expired records reject access. Storage failures remain errors. Post-persistence failures carry static `error_code`, `issued` and `issuance_unknown` facts without credentials; callers must reconcile an unknown outcome rather than automatically mint another credential.
-
-The route/action inventory is maintained in `rustfs/src/admin/route_policy.rs`. This contract does not imply event capture, physical container cleanup, restart reconciliation or upstream release acceptance.
-
-
-## Cross-bucket restriction profile v2
-
-The existing registration endpoint accepts this explicit v2 restriction:
-
-```json
-{
-  "version": 2,
-  "deployment": "runner-production",
-  "bucket": "source-images",
-  "input_prefix": "inputs/",
-  "output_bucket": "plugin-artifacts",
-  "output_prefix": "outputs/",
-  "expires_at_unix_seconds": 1893456000
-}
-```
-
-The example expiry must be replaced by a future value within the existing
-24-hour limit. `bucket` still identifies the input bucket. The existing
-`issue-attempt` request and credential response do not change: its
-`input_bucket` must equal `bucket`, and `output_bucket` must equal the explicit
-v2 output bucket. Neither a different bucket nor a sibling attempt prefix can
-be supplied by the broker. The exact input version and deterministic output
-prefix checks remain in force.
-
-A v1 restriction has neither `version` nor `output_bucket`; its JSON fields
-and same-bucket behavior are unchanged. V2 requires both `version: 2` and a
-nonempty, bounded, literal `output_bucket`. Missing pairs, explicit nulls,
-unknown versions and unknown fields are rejected rather than downgraded to v1.
-The immutable record envelope carries version 1 or 2 to match its restriction
-profile. Both remain in the existing IAM record namespace; no data migration
-or mutable record update is introduced. Readers reject mismatched envelope
-and restriction versions. Older readers reject v2, so deploy compatible
-readers before creating v2 records.
-
-V2 does not grant the original user additional permissions. Issuance retains
-its current-parent checks and post-persistence recheck/invalidation, and each
-S3 request still requires both the original user's current IAM policy and the
-attempt session policy to allow it. An explicit parent Deny or removal of
-output permission prevents writes even with an already issued token. No
-administrator credential substitutes for missing parent permission.
-
-Focused tests are `delegation_v1_json_remains_compatible`,
-`delegation_v2_requires_explicit_output_bucket`,
-`attempt_v2_policy_keeps_input_version_and_output_bucket` and
-`delegation_v2_persists_and_vends_with_real_parent_intersection`.
-The last uses the actual issuance handler, persistent IAM and four-disk
-storage, including a real input version and a third bucket allowed by the
-parent but forbidden by the delegation. Removing only the output-bucket
-comparison must fail `A03_CROSS_BUCKET_OUTPUT_BOUND`; parent intersection is
-checked independently with issued temporary credentials. These are internal
-handler/IAM tests, not signed HTTP or complete cross-bucket S3 execution.
-
-This profile adds no bucket-creation API, Runner binding support, credential
-endpoint or GC permission. Coordinating Runner's pinned binding with its
-result storage bucket remains a separate integration requirement.

docs/operations/hotpath-warp-ab-runbook.md

@@ -143,39 +143,6 @@ Rules that override the table: a candidate result is actionable only when the `A
 
 ### CPU and memory evidence
 
-#### Local shard batch attribution
-
-The existing GET-stage metric gate also controls local batch attribution. This
-path performs buffered positioned reads, even if O_DIRECT or io_uring is enabled
-for another backend. Keep the gate, exporter, and build features identical
-between compared binaries; calibrate instrumentation overhead separately.
-
-| Metric suffix after `rustfs_io_get_object_local_batch_` | Meaning |
-| --- | --- |
-| `decisions_total` | Reader-setup decisions, labelled by a fixed decision enum; this is not an S3 request counter. |
-| `prepare_seconds` | Eligibility and path preparation, including pre-worker path checks; absent when preparation was skipped. |
-| `stage_seconds` | Queue wait, whole-worker execution, and per-shard metadata/open/read durations, labelled by stage and operation outcome. |
-| `shards` / `shards_total` | Batch size and completed shard outcomes. |
-| `requested_bytes_total` / `read_bytes_total` | Requested bytes and bytes actually returned by positioned reads, split by shard outcome. |
-
-Worker handles are captured before dispatch and remain owned by the worker, so
-completion samples can arrive after the caller stops waiting. A stage that did
-not execute contributes no sample. Queue wait ends when the worker starts;
-execution includes allocation and instrumentation, while read timing excludes
-buffer allocation. These nested and per-shard durations cannot be added to
-request latency, and stage p99 values cannot be summed. Match request-boundary
-samples and successful-request counters to the same workload window when
-normalizing costs. Keep failed requests and partial-shard failures visible.
-Inline GET and HEAD can bypass this reader-setup entry entirely; absence of a
-decision sample does not imply a failed request. The two local duration metrics
-use dedicated 0.1-microsecond-to-10-second histogram boundaries in the OTLP view;
-request-duration histogram boundaries are separate.
-
-For a bounded, four-shard instrumentation microbenchmark, run
-`cargo bench -p rustfs-io-metrics --bench metrics_pipeline -- local_batch_attribution_4_shards_debug_recorder`.
-It performs no disk I/O and uses a debugging recorder, so its result calibrates
-the sampling code rather than production exporter overhead or S3 latency.
-
 Warp output says whether throughput or latency changed; host telemetry says why. Collect it for the whole run and stop the collectors after the script exits.
 
 | Tool | Command | Answers |

docs/operations/scanner-runtime-controls.md

@@ -529,21 +529,17 @@ The OTLP exporter records these node-local histograms for completed manager admi
 
 The two new histograms aggregate all observed admission sources and results without per-request labels. An ordinary uninterrupted admission partitions the phase into wait and hold. Admin forceStart releases these guards while cancelling overlaps, then reacquires them: the cancellation gap is included only in the original total phase, and the second acquisition contributes to wait. Cancellation subroutine work is outside these outer admission guard intervals. Recording happens after all three guards are released. They measure manager admission ownership, not namespace/object-lock waiting during repair. The status field `maxLockPhaseMicros` remains a manager-lifetime maximum, not a p95 sample. Keep same-window histogram counts and bucket resolution when deriving percentiles; missing observations do not mean zero latency. These metrics do not establish performance acceptance by themselves.
 
-## Experimental shared node admission
+## Experimental heal node admission
 
-`RUSTFS_HEAL_ADAPTIVE_ADMISSION=true` enables Linux cgroup-v2 feedback shared by the heal manager’s four object-heal entry points and local Scanner namespace reads and object accounting. It is off by default while full SSD performance acceptance is pending. Unsupported platforms reject an enabled setting. This does not yet control the abandoned-child streaming list coordinator, bucket/format repair or physical devices, and it is not a replacement for existing worker, disk or byte budgets.
+`RUSTFS_HEAL_ADAPTIVE_ADMISSION=true` enables Linux cgroup-v2 feedback for the four object-heal entry points owned by the heal manager. It is off by default while full SSD performance acceptance is pending. Unsupported platforms reject an enabled setting. This does not yet control scanner walks, bucket/format repair or physical devices, and it is not a replacement for existing worker, disk or byte budgets.
 
 The node samples its effective CPU quota/cpuset, ancestor memory headroom, CPU usage/throttling and CPU/memory/I/O pressure once per second. Sampling uses one blocking worker at a time. Resource reads retain their real start/end times: reads spanning over 20 ms or older than one second after all inputs return cannot renew admission. Counter rates use both read brackets conservatively. The concurrency cap is at most the rounded-up effective CPU count and 256 scheduling units; existing operator limits still apply independently. At most 1% memory headroom blocks new work. This is a pressure safeguard, not a memory reservation or a claim that concurrent repair buffers fit in the remaining bytes.
 
 Each complete sample leases admission for three seconds. Missing resource caps block new work; missing or low-confidence feedback retains at most one maintenance unit. CPU use above 90%, throttling or pressure above 1% of elapsed time, memory headroom at most 10%, foreground errors/cancellations, a foreground queue or a comparable foreground p99 regression reduce concurrency immediately. Recovery requires CPU use at most 70%, throttling/stalls at most 0.1% of elapsed time, at least 20% memory headroom, fresh foreground evidence and actual successful work. The existing controller probes one additional unit only after eight consecutive healthy seconds and cooldown. Limits affect new admission and do not revoke active work.
 
-The Scanner captures the same node owner once per bucket walk. Directory open/refill, entry type and size lookup, and object accounting try admission before their first storage poll; each unit ends when its operation future finishes. On contention, local and remote coordinators suspend the same traversal, release the bucket cache lease, and join the shared FIFO queue. They reacquire the cache lease and verify both cache revisions before resuming. A changed cache rejects the suspended result. Cancellation also drops the queued request; the existing cycle budget still bounds the walk. This retains directory and recursion state while allowing Heal to advance at capacity one, without repeatedly replaying a partially classified directory.
-
-Calls without a coordinating cache lease retain immediate resource deferral and useful partial-cache handling. Existing remote single-session ownership and local-disk admission shares remain in force. Disabled admission creates no request channel. Enabled walks use one bounded channel, with a response allocation and cache revision reads only on contention; the uncontended per-entry path adds no global lookup or task. The streaming abandoned-child coordinator requires a separate ownership boundary: retaining a node unit while it waits for a bounded-channel consumer that needs the same unit would deadlock at capacity one.
-
 Foreground comparison uses the existing complete response-body windows and shared admission snapshots. Each active class needs at least 100 completions and a finite p99 interval; this permits the percentile rank but is not a statistical confidence guarantee. Comparisons require the same active classes and rates within 80–125% of a retained reference. A changed workload resets recovery. The reference is an observed workload window, not an independent background-off baseline. A p99 interval can justify stability only when its upper bound is within 5% of the reference lower bound; a lower bound above 105% of the reference upper bound is pressure. Overlapping/uncertain comparisons cannot justify growth. Missing queues, stale or repeated cuts, uncertain cut boundaries and low counts are not idle evidence.
 
-Heal admission waits at most 250 ms before returning the existing typed transient deferral, before polling storage or taking namespace locks. No-lock callers never wait. Queued read repair uses the same node gate; direct foreground ECStore calls remain outside this heal-manager adapter. Cancellation releases the non-cloneable node scheduling unit. Native work retains separate physical-I/O units, and unsuccessful/cancelled/dry-run work cannot increment the node's completed-work counter. This scheduling counter is not an authoritative heal receipt and cannot discharge repair responsibility.
+Admission waits at most 250 ms before returning the existing typed transient deferral, before polling storage or taking namespace locks. No-lock callers never wait. Queued read repair uses the same node gate; direct foreground ECStore calls remain outside this heal-manager adapter. Cancellation releases the non-cloneable node scheduling unit. Native work retains separate physical-I/O units, and unsuccessful/cancelled/dry-run work cannot increment the node's completed-work counter. This scheduling counter is not an authoritative heal receipt and cannot discharge repair responsibility.
 
 The `rustfs_background_node_admission_limit` and `rustfs_background_node_admission_active` gauges describe the last published sample, not a live reservation proof. A blocked sampler can leave these exports stale even though the admission lease has expired. Full disk-owner feedback, shared scanner scheduling, escaping-buffer byte ownership and the matched-release SSD matrix/hot-shrink/72-hour soak remain required before enabling this by default or claiming optimal performance.
 

docs/postmortems/2026-09-03-replication-checksum-default-regression.md

@@ -30,7 +30,7 @@ The same thing was missing at every layer: an inventory of what remote targets m
 
 - **Change design.** A default that applies to every target was changed to satisfy one target class. The PR text considered checksums only for objects that already carried one ("object-level `x-amz-checksum-*` forwarding is unaffected") and never asked the inverse question: which target-side rules depend on a checksum being present.
 - **Tests.** The new unit test asserted the fix ("no `x-amz-trailer`"), not the contract ("the target accepted the PUT"). The fake target modeled neither failure mode: it did not store `aws-chunked` verbatim and it did not demand a checksum on locked PUTs. `replication-check` has an ObjectLock phase, but its probe PUT carries no retention headers, so it would have reported OK against the customer's target.
-- **Review.** The compatibility review guidance listed only inbound and on-disk concerns: `xl.meta`, proto, MinIO fixtures. It contained no line about outbound target behavior, so the review passed while blind to the class.
+- **Review.** The compatibility lens (`.agents/skills/adversarial-validation/references/compatibility.md`) listed only inbound and on-disk concerns: `xl.meta`, proto, MinIO fixtures. It contained no line about outbound target behavior, so the lens passed while blind to the class.
 - **Release.** Two new environment escape hatches shipped undocumented. The customer's second question in rustfs#7082 was whether a configuration option exists; it did, and it was unfindable.
 
 ## Corrective actions
@@ -39,7 +39,7 @@ The same thing was missing at every layer: an inventory of what remote targets m
 | --- | --- |
 | Outbound target matrix e2e: every target failure mode times every object shape, with an explicit expectation table. Known-red cells are pinned to an open issue and fail loudly when they start passing. | `crates/e2e_test/src/replication_target_matrix_test.rs` |
 | Fake target gains the three failure modes a real fleet has shown: rejects `aws-chunked` uploads, requires a checksum on Object Lock PUTs (and verifies `Content-MD5`), mints its own version ids. | `crates/e2e_test/src/fake_s3_target/mod.rs` |
-| Review policy covers outbound target behavior. | `.agents/references/adversarial-validation.md` |
+| Compatibility lens gains an outbound target section. | `.agents/skills/adversarial-validation/references/compatibility.md` |
 | `AGENTS.md` names outbound client defaults as high risk and requires the matrix plus documented escape hatches. | `AGENTS.md`, Adversarial Validation |
 | The two escape hatches from rustfs#6895 are documented. | `docs/operations/replication-outbound-transport.md` |
 | Product fix for rustfs#7082: a locked PUT carries `Content-MD5` derived from the source ETag when that ETag is the MD5 of the wire bytes, and an SDK CRC32 checksum otherwise; the two matrix cells flipped to `Completed` in the same change. | `crates/ecstore/src/bucket/bucket_target_sys.rs` (`object_lock_put_integrity_for`), `crates/replication/src/object.rs` (`object_lock_put_integrity`) |

fuzz/Cargo.toml

@@ -19,18 +19,6 @@ rustfs-security-governance = { path = "../crates/security-governance" }
 rustfs-utils = { path = "../crates/utils", features = ["compress", "path"] }
 serde_json = "1"
 
-[patch.crates-io]
-# Standalone workspaces must repeat the root workspace's fixed SigV4a backend.
-aws-sigv4 = { git = "https://github.com/smithy-lang/smithy-rs", rev = "5c1c4bca2ea7af97496e077c9f1a718eaac64bf8" }
-
-[patch."https://github.com/smithy-lang/smithy-rs"]
-# Keep the signer's path dependencies on the SDK's existing registry types.
-aws-credential-types = { version = "=1.3.1" }
-aws-smithy-eventstream = { version = "=0.61.6" }
-aws-smithy-http = { version = "=0.64.3" }
-aws-smithy-runtime-api = { version = "=1.19.2" }
-aws-smithy-types = { version = "=1.9.1" }
-
 [[bin]]
 name = "bucket_validation"
 path = "fuzz_targets/bucket_validation.rs"

rustfs/src/admin/handlers/mod.rs

@@ -52,8 +52,6 @@ pub mod object_data_cache;
 pub mod object_zip_download;
 pub mod oidc;
 pub mod on_demand_migration;
-pub mod plugin_attempt;
-pub mod plugin_delegation;
 pub mod plugins_catalog;
 pub mod plugins_instances;
 pub mod policies;

rustfs/src/admin/handlers/plugin_attempt.rs

@@ -1,568 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-//! Restricted vending for explicitly configured brokers, never AssumeRole chaining.
-use super::plugin_delegation::{owner, response, storage_error};
-use crate::{
-    admin::{
-        router::{AdminOperation, Operation, S3Router},
-        runtime_sources,
-        storage_api::s3::{self, Body, S3Error, S3ErrorCode, S3Request, S3Response, S3Result},
-    },
-    auth::check_key_valid_with_context,
-    server::ADMIN_PREFIX,
-};
-use http::{Method, StatusCode};
-use matchit::Params;
-use rustfs_iam::{
-    delegation::Delegation,
-    sys::{PLUGIN_ATTEMPT_CREDENTIAL_CLAIM, SESSION_POLICY_NAME},
-};
-use rustfs_policy::{
-    auth::get_new_credentials_with_metadata,
-    policy::{
-        Args, Policy,
-        action::{Action, AdminAction, S3Action},
-    },
-};
-use serde::{Deserialize, Serialize};
-use std::{
-    collections::HashMap,
-    sync::OnceLock,
-    time::{Duration, SystemTime, UNIX_EPOCH},
-};
-use time::OffsetDateTime;
-
-// Operator configuration contains public signer access keys, not credentials.
-// Empty/invalid configuration disables the endpoint. It is immutable per process.
-static BROKERS: OnceLock<Option<HashMap<String, String>>> = OnceLock::new();
-fn configured_deployment(key: &str) -> Option<&'static str> {
-    BROKERS
-        .get_or_init(|| {
-            let raw = std::env::var("RUSTFS_PLUGIN_BROKERS").ok()?;
-            let map: HashMap<String, String> = serde_json::from_str(&raw).ok()?;
-            if map.is_empty()
-                || map
-                    .iter()
-                    .any(|(k, v)| k.is_empty() || v.is_empty() || k.len() > 1024 || v.len() > 1024)
-            {
-                return None;
-            }
-            Some(map)
-        })
-        .as_ref()?
-        .get(key)
-        .map(String::as_str)
-}
-
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct Attempt {
-    tenant: String,
-    run_id: uuid::Uuid,
-    attempt_id: uuid::Uuid,
-    revision: String,
-    deployment: String,
-    input_bucket: String,
-    input_key: String,
-    input_version: String,
-    output_bucket: String,
-    output_prefix: String,
-    ttl_seconds: u64,
-}
-#[derive(Serialize)]
-struct Issued {
-    version: u32,
-    delegation_id: String,
-    delegation_revision: String,
-    owner_access_key: String,
-    access_key_id: String,
-    secret_access_key: String,
-    session_token: String,
-    expires_at_unix_seconds: i64,
-}
-
-pub fn register_plugin_attempt_route(router: &mut S3Router<AdminOperation>) -> std::io::Result<()> {
-    router.insert(
-        Method::POST,
-        &format!("{ADMIN_PREFIX}/v3/plugin-delegations/{{id}}/issue-attempt"),
-        AdminOperation(&Issue),
-    )?;
-    Ok(())
-}
-fn now() -> S3Result<u64> {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|d| d.as_secs())
-        .map_err(|_| s3::error(S3ErrorCode::InternalError, "clock unavailable"))
-}
-fn literal(value: &str) -> bool {
-    !value.is_empty()
-        && value.len() <= 1024
-        && !value.contains("${")
-        && !value.chars().any(|c| c.is_control() || matches!(c, '*' | '?'))
-}
-fn session_policy(record: &Delegation, attempt: &Attempt) -> S3Result<Policy> {
-    let restriction = &record.restrictions;
-    // Stored records from earlier versions must obey the same literal rules.
-    restriction.validate(record.created_at_unix_seconds).map_err(storage_error)?;
-    let exact_output = format!(
-        "{}{}/{}/{}/",
-        restriction.output_prefix,
-        hex_simd::encode_to_string(attempt.tenant.as_bytes(), hex_simd::AsciiCase::Lower),
-        attempt.run_id,
-        attempt.attempt_id
-    );
-    if attempt.tenant.is_empty()
-        || attempt.tenant.len() > 1024
-        || attempt.run_id.is_nil()
-        || attempt.attempt_id.is_nil()
-        || attempt.output_prefix != exact_output
-        || attempt.revision != record.revision
-        || attempt.deployment != restriction.deployment
-        || attempt.input_bucket != restriction.bucket
-        || attempt.output_bucket != restriction.output_bucket().map_err(storage_error)?
-        || !literal(&attempt.input_key)
-        || !attempt.input_key.starts_with(&restriction.input_prefix)
-        || !literal(&attempt.input_version)
-        || attempt.input_version == "null"
-        || !literal(&attempt.output_prefix)
-        || !attempt.output_prefix.starts_with(&restriction.output_prefix)
-        || attempt.output_prefix == restriction.output_prefix
-        || !attempt.output_prefix.ends_with('/')
-        || !(1..=900).contains(&attempt.ttl_seconds)
-    {
-        return Err(s3::error(S3ErrorCode::AccessDenied, "attempt restriction rejected"));
-    }
-    let value = serde_json::json!({"Version":"2012-10-17","Statement":[
-        {"Effect":"Allow","Action":["s3:GetObjectVersion"],"Resource":[format!("arn:aws:s3:::{}/{}",attempt.input_bucket,attempt.input_key)],"Condition":{"StringEquals":{"s3:VersionId":attempt.input_version}}},
-        {"Effect":"Allow","Action":["s3:PutObject"],"Resource":[format!("arn:aws:s3:::{}/{}*",attempt.output_bucket,attempt.output_prefix)]}
-    ]});
-    // Condition operators borrow their keys while the policy is decoded.
-    let bytes = serde_json::to_vec(&value).map_err(|_| s3::error(S3ErrorCode::InternalError, "attempt policy unavailable"))?;
-    serde_json::from_slice(&bytes).map_err(|_| s3::error(S3ErrorCode::InternalError, "attempt policy unavailable"))
-}
-
-fn issuance_error(code: &'static str, issued: bool, unknown: bool) -> S3Result<S3Response<(StatusCode, Body)>> {
-    let mut answer = response(&serde_json::json!({"error_code":code,"issued":issued,"issuance_unknown":unknown}))?;
-    answer.output.0 = StatusCode::SERVICE_UNAVAILABLE;
-    Ok(answer)
-}
-fn same_parent_authority(before_names: &[String], before_policy: &Policy, after_names: &[String], after_policy: &Policy) -> bool {
-    fn names(names: &[String]) -> Vec<&str> {
-        let mut names: Vec<_> = names.iter().map(String::as_str).collect();
-        names.sort_unstable();
-        names.dedup();
-        names
-    }
-    fn statements(policy: &Policy) -> Option<Vec<Vec<u8>>> {
-        let mut statements = policy
-            .statements
-            .iter()
-            .map(serde_json::to_vec)
-            .collect::<Result<Vec<_>, _>>()
-            .ok()?;
-        statements.sort_unstable();
-        Some(statements)
-    }
-
-    names(before_names) == names(after_names)
-        && matches!(
-            (statements(before_policy), statements(after_policy)),
-            (Some(before), Some(after)) if before == after
-        )
-}
-async fn require_builtin_authorization() -> S3Result<()> {
-    rustfs_iam::sys::IamSys::<rustfs_iam::store::object::ObjectStore>::ensure_restricted_credential_vending()
-        .await
-        .map_err(|_| s3::error(S3ErrorCode::AccessDenied, "external policy plugin unsupported for attempt credentials"))
-}
-
-struct Issue;
-#[async_trait::async_trait]
-impl Operation for Issue {
-    async fn call(&self, mut req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        require_builtin_authorization().await?;
-        let (iam, broker) = owner(&req, AdminAction::IssuePluginAttemptAction).await?;
-        let deployment =
-            configured_deployment(&broker).ok_or_else(|| s3::error(S3ErrorCode::AccessDenied, "broker deployment rejected"))?;
-        let context = runtime_sources::app_context_from_req(&req)
-            .ok_or_else(|| s3::error(S3ErrorCode::InternalError, "application context unavailable"))?;
-        let bytes = tokio::time::timeout(Duration::from_secs(10), req.input.store_all_limited(16384))
-            .await
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "attempt body unavailable"))?
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "attempt body unavailable"))?;
-        let attempt: Attempt =
-            serde_json::from_slice(&bytes).map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid attempt request"))?;
-        if attempt.deployment != deployment {
-            return Err(s3::error(S3ErrorCode::AccessDenied, "broker deployment rejected"));
-        }
-        let id = params
-            .get("id")
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "delegation id required"))?;
-        let record = iam
-            .read_active_plugin_delegation_for_broker(id, now()?)
-            .await
-            .map_err(storage_error)?;
-        let policy = session_policy(&record, &attempt)?;
-        let (principal, root) = check_key_valid_with_context("", &record.owner_access_key, Some(context.as_ref())).await?;
-        if root || principal.is_temp() || principal.is_service_account() {
-            return Err(s3::error(S3ErrorCode::AccessDenied, "original user required"));
-        }
-        // A broker request cannot reconstruct the original user's IP/MFA/tag
-        // conditions. This first profile rejects conditional parent policies.
-        let policies = iam
-            .policy_db_get(&principal.access_key, &principal.groups)
-            .await
-            .map_err(|_| s3::error(S3ErrorCode::InternalError, "parent policy unavailable"))?;
-        let parent_policy = iam.get_combined_policy(&policies).await;
-        if policies.is_empty() || parent_policy.statements.iter().any(|s| !s.conditions.is_empty()) {
-            return Err(s3::error(S3ErrorCode::AccessDenied, "parent condition context unsupported"));
-        }
-        let mut conditions = HashMap::new();
-        conditions.insert("s3:VersionId".to_owned(), vec![attempt.input_version.clone()]);
-        if !iam
-            .is_allowed(&Args {
-                account: &principal.access_key,
-                groups: &principal.groups,
-                action: Action::S3Action(S3Action::GetObjectVersionAction),
-                bucket: &attempt.input_bucket,
-                object: &attempt.input_key,
-                conditions: &conditions,
-                is_owner: false,
-                claims: principal.claims_or_empty(),
-                deny_only: false,
-            })
-            .await
-        {
-            return Err(s3::error(S3ErrorCode::AccessDenied, "parent input rejected"));
-        }
-        let expiration = now()?
-            .checked_add(attempt.ttl_seconds)
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "invalid expiration"))?
-            .min(record.restrictions.expires_at_unix_seconds);
-        let expires_at = OffsetDateTime::from_unix_timestamp(
-            i64::try_from(expiration).map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid expiration"))?,
-        )
-        .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid expiration"))?;
-        let mut claims = principal.claims.clone().unwrap_or_default();
-        claims.insert(PLUGIN_ATTEMPT_CREDENTIAL_CLAIM.into(), serde_json::Value::Bool(true));
-        claims.insert("exp".into(), serde_json::json!(expires_at.unix_timestamp()));
-        claims.insert("parent".into(), serde_json::json!(principal.access_key));
-        let bytes =
-            serde_json::to_vec(&policy).map_err(|_| s3::error(S3ErrorCode::InternalError, "attempt policy unavailable"))?;
-        claims.insert(
-            SESSION_POLICY_NAME.into(),
-            serde_json::json!(base64_simd::URL_SAFE_NO_PAD.encode_to_string(&bytes)),
-        );
-        let fresh = iam
-            .read_active_plugin_delegation_for_broker(id, now()?)
-            .await
-            .map_err(storage_error)?;
-        if fresh != record {
-            return Err(s3::error(S3ErrorCode::AccessDenied, "attempt authority changed"));
-        }
-        owner(&req, AdminAction::IssuePluginAttemptAction).await?;
-        require_builtin_authorization().await?;
-        let signing = context
-            .action_credentials()
-            .get()
-            .ok_or_else(|| s3::error(S3ErrorCode::InternalError, "token signer unavailable"))?;
-        // The server key seals the token only. Authorization above uses the
-        // original user's current IAM, and S3 continues its parent intersection.
-        let mut credential = get_new_credentials_with_metadata(&claims, &signing.secret_key)
-            .map_err(|_| s3::error(S3ErrorCode::InternalError, "attempt credential unavailable"))?;
-        credential.parent_user = principal.access_key.clone();
-        if iam.set_temp_user(&credential.access_key, &credential, None).await.is_err() {
-            return issuance_error("PLUGIN_ATTEMPT_ISSUANCE_UNKNOWN", false, true);
-        }
-        // No atomic IAM/delegation transaction spans persistence. Recheck and
-        // invalidate the generated credential if any authority changed.
-        let valid = async {
-            require_builtin_authorization().await?;
-            let after = iam
-                .read_active_plugin_delegation_for_broker(id, now()?)
-                .await
-                .map_err(storage_error)?;
-            let (current, current_root) =
-                check_key_valid_with_context("", &record.owner_access_key, Some(context.as_ref())).await?;
-            let names = iam
-                .policy_db_get(&current.access_key, &current.groups)
-                .await
-                .map_err(|_| s3::error(S3ErrorCode::InternalError, "parent policy unavailable"))?;
-            let current_policy = iam.get_combined_policy(&names).await;
-            if after != record
-                || current_root
-                || current.is_temp()
-                || current.is_service_account()
-                || current.secret_key != principal.secret_key
-                || !same_parent_authority(&policies, &parent_policy, &names, &current_policy)
-            {
-                return Err(s3::error(S3ErrorCode::AccessDenied, "attempt authority changed"));
-            }
-            // Re-evaluate the broker against its real signed request context.
-            owner(&req, AdminAction::IssuePluginAttemptAction).await?;
-            Ok::<(), S3Error>(())
-        }
-        .await;
-        if valid.is_err() {
-            if iam.delete_temp_account(&credential.access_key, true).await.is_err() {
-                return issuance_error("PLUGIN_ATTEMPT_INVALIDATION_UNKNOWN", true, true);
-            }
-            return issuance_error("PLUGIN_ATTEMPT_POST_ISSUANCE_REJECTED", true, false);
-        }
-        response(&Issued {
-            version: 1,
-            delegation_id: record.id,
-            delegation_revision: record.revision,
-            owner_access_key: record.owner_access_key,
-            access_key_id: credential.access_key,
-            secret_access_key: credential.secret_key,
-            session_token: credential.session_token,
-            expires_at_unix_seconds: expires_at.unix_timestamp(),
-        })
-    }
-}
-
-#[cfg(test)]
-#[path = "plugin_attempt_v2_tests.rs"]
-mod v2_tests;
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    #[test]
-    fn parent_authority_recheck_ignores_policy_order_but_detects_changes() {
-        let first: Policy = serde_json::from_value(serde_json::json!({
-            "Version":"2012-10-17",
-            "Statement":[
-                {"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::photos/input/*"},
-                {"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::photos/output/*"}
-            ]
-        }))
-        .unwrap();
-        let reordered: Policy = serde_json::from_value(serde_json::json!({
-            "Version":"2012-10-17",
-            "Statement":[
-                {"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::photos/output/*"},
-                {"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::photos/input/*"}
-            ]
-        }))
-        .unwrap();
-        let before_names = vec!["owner-policy".to_owned(), "bucket-policy".to_owned()];
-        let after_names = vec!["bucket-policy".to_owned(), "owner-policy".to_owned()];
-        assert!(same_parent_authority(&before_names, &first, &after_names, &reordered));
-
-        let changed: Policy = serde_json::from_value(serde_json::json!({
-            "Version":"2012-10-17",
-            "Statement":[
-                {"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::photos/input/*"},
-                {"Effect":"Allow","Action":"s3:DeleteObject","Resource":"arn:aws:s3:::photos/output/*"}
-            ]
-        }))
-        .unwrap();
-        assert!(!same_parent_authority(&before_names, &first, &after_names, &changed));
-        let changed_resource: Policy = serde_json::from_value(serde_json::json!({
-            "Version":"2012-10-17",
-            "Statement":[
-                {"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::photos/input/*"},
-                {"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::photos/private/*"}
-            ]
-        }))
-        .unwrap();
-        assert!(!same_parent_authority(&before_names, &first, &after_names, &changed_resource));
-        let added_deny: Policy = serde_json::from_value(serde_json::json!({
-            "Version":"2012-10-17",
-            "Statement":[
-                {"Effect":"Deny","Action":"s3:GetObject","Resource":"arn:aws:s3:::photos/input/private/*"},
-                {"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::photos/input/*"},
-                {"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::photos/output/*"}
-            ]
-        }))
-        .unwrap();
-        assert!(!same_parent_authority(&before_names, &first, &after_names, &added_deny));
-        assert!(!same_parent_authority(&before_names, &first, &["other-policy".to_owned()], &first));
-    }
-    #[tokio::test]
-    async fn attempt_policy_keeps_exact_version_and_narrow_output() {
-        let record = Delegation {
-            version: 1,
-            id: "a".repeat(32),
-            revision: "a".repeat(32),
-            owner_access_key: "user".into(),
-            created_at_unix_seconds: 1,
-            restrictions: rustfs_iam::delegation::Restrictions {
-                version: None,
-                output_bucket: None,
-                deployment: "runner".into(),
-                bucket: "photos".into(),
-                input_prefix: "input/".into(),
-                output_prefix: "output/".into(),
-                expires_at_unix_seconds: 1000,
-            },
-        };
-        let run_id = uuid::Uuid::new_v4();
-        let attempt_id = uuid::Uuid::new_v4();
-        let output_prefix = format!(
-            "output/{}/{}/{}/",
-            hex_simd::encode_to_string(b"tenant", hex_simd::AsciiCase::Lower),
-            run_id,
-            attempt_id
-        );
-        let mut attempt = Attempt {
-            tenant: "tenant".into(),
-            run_id,
-            attempt_id,
-            revision: record.revision.clone(),
-            deployment: "runner".into(),
-            input_bucket: "photos".into(),
-            input_key: "input/photo.png".into(),
-            input_version: "version-1".into(),
-            output_bucket: "photos".into(),
-            output_prefix: output_prefix.clone(),
-            ttl_seconds: 60,
-        };
-        let policy = session_policy(&record, &attempt).unwrap();
-        let scoped_output = format!("{output_prefix}result");
-        let groups = None;
-        let claims = HashMap::new();
-        for (action, object, version, expected) in [
-            (S3Action::GetObjectVersionAction, "input/photo.png", Some("version-1"), true),
-            (S3Action::GetObjectVersionAction, "input/photo.png", Some("version-2"), false),
-            (S3Action::GetObjectVersionAction, "input/photo.png", None, false),
-            (S3Action::GetObjectAction, "input/photo.png", None, false),
-            (S3Action::PutObjectAction, scoped_output.as_str(), None, true),
-            (S3Action::PutObjectAction, "outside/result", None, false),
-            (S3Action::PutObjectAction, "output/result", None, false),
-        ] {
-            let conditions = version
-                .map(|value| HashMap::from([("versionid".into(), vec![value.into()])]))
-                .unwrap_or_default();
-            assert_eq!(
-                policy
-                    .is_allowed(&Args {
-                        account: "user",
-                        groups: &groups,
-                        action: Action::S3Action(action),
-                        bucket: "photos",
-                        object,
-                        conditions: &conditions,
-                        is_owner: false,
-                        claims: &claims,
-                        deny_only: false,
-                    })
-                    .await,
-                expected,
-                "attempt policy action={action:?} object={object} version={version:?}"
-            );
-        }
-        attempt.output_bucket = "artifacts".into();
-        assert!(
-            session_policy(&record, &attempt).is_err(),
-            "v1 still requires the input bucket for output"
-        );
-        attempt.output_bucket = "photos".into();
-        attempt.output_prefix = "output/".into();
-        assert!(session_policy(&record, &attempt).is_err());
-        attempt.output_prefix = output_prefix;
-        attempt.input_key = "outside/photo.png".into();
-        assert!(session_policy(&record, &attempt).is_err());
-    }
-    #[tokio::test]
-    async fn attempt_v2_policy_keeps_input_version_and_output_bucket() {
-        let record: Delegation = serde_json::from_value(serde_json::json!({
-            "version":2,"id":"a".repeat(32),"revision":"a".repeat(32),"owner_access_key":"user",
-            "created_at_unix_seconds":1,"restrictions":{"version":2,"deployment":"runner","bucket":"photos",
-            "input_prefix":"input/","output_bucket":"artifacts","output_prefix":"output/","expires_at_unix_seconds":1000}
-        }))
-        .expect("explicit v2 delegation");
-        let run_id = uuid::Uuid::new_v4();
-        let attempt_id = uuid::Uuid::new_v4();
-        let output = format!("output/74656e616e74/{run_id}/{attempt_id}/");
-        let mut attempt = Attempt {
-            tenant: "tenant".into(),
-            run_id,
-            attempt_id,
-            revision: record.revision.clone(),
-            deployment: "runner".into(),
-            input_bucket: "photos".into(),
-            input_key: "input/photo.png".into(),
-            input_version: "version-1".into(),
-            output_bucket: "artifacts".into(),
-            output_prefix: output.clone(),
-            ttl_seconds: 60,
-        };
-        let policy = session_policy(&record, &attempt).expect("v2 scope");
-        let result = format!("{output}result");
-        for (action, bucket, object, version, expected) in [
-            (S3Action::GetObjectVersionAction, "photos", "input/photo.png", Some("version-1"), true),
-            (S3Action::GetObjectVersionAction, "photos", "input/photo.png", Some("version-2"), false),
-            (S3Action::GetObjectVersionAction, "artifacts", "input/photo.png", Some("version-1"), false),
-            (S3Action::PutObjectAction, "artifacts", result.as_str(), None, true),
-            (S3Action::PutObjectAction, "photos", result.as_str(), None, false),
-            (S3Action::PutObjectAction, "third", result.as_str(), None, false),
-            (S3Action::PutObjectAction, "artifacts", "output/other/result", None, false),
-        ] {
-            let conditions = version
-                .map(|v| HashMap::from([("versionid".into(), vec![v.into()])]))
-                .unwrap_or_default();
-            assert_eq!(
-                policy
-                    .is_allowed(&Args {
-                        account: "user",
-                        groups: &None,
-                        action: Action::S3Action(action),
-                        bucket,
-                        object,
-                        conditions: &conditions,
-                        claims: &HashMap::new(),
-                        is_owner: false,
-                        deny_only: false
-                    })
-                    .await,
-                expected,
-                "A03_CROSS_BUCKET_SCOPE: bucket={bucket} object={object}"
-            );
-        }
-        attempt.output_bucket = "third".into();
-        assert!(session_policy(&record, &attempt).is_err(), "A03_CROSS_BUCKET_OUTPUT_BOUND");
-        attempt.output_bucket = "photos".into();
-        assert!(session_policy(&record, &attempt).is_err(), "A03_CROSS_BUCKET_OUTPUT_BOUND");
-        attempt.output_bucket = "artifacts".into();
-        attempt.input_bucket = "artifacts".into();
-        assert!(session_policy(&record, &attempt).is_err(), "A03_CROSS_BUCKET_INPUT_BOUND");
-    }
-
-    #[tokio::test]
-    async fn actual_policy_variable_resolution_is_rejected_by_literal_scope() {
-        let resource = rustfs_policy::policy::resource::Resource::S3("photos/input/${aws:username}.png".into());
-        let conditions = HashMap::from([("username".into(), vec!["alice".into()])]);
-        let resolver =
-            rustfs_policy::policy::variables::VariableResolver::new(rustfs_policy::policy::variables::VariableContext {
-                username: Some("alice".into()),
-                ..Default::default()
-            });
-        assert!(
-            resource
-                .is_match_with_resolver("photos/input/alice.png", &conditions, Some(&resolver))
-                .await,
-            "C07_LITERAL_SCOPE_BOUND: actual policy engine substitutes resource variables"
-        );
-        assert!(
-            !literal("input/${aws:username}.png"),
-            "C07_LITERAL_SCOPE_BOUND: requested resources must stay literal"
-        );
-        let restriction = rustfs_iam::delegation::Restrictions {
-            version: None,
-            output_bucket: None,
-            deployment: "runner".into(),
-            bucket: "photos".into(),
-            input_prefix: "input/${aws:username}/".into(),
-            output_prefix: "output/".into(),
-            expires_at_unix_seconds: 200,
-        };
-        assert!(
-            restriction.validate(100).is_err(),
-            "C07_LITERAL_SCOPE_BOUND: legacy stored variable restrictions are rejected"
-        );
-    }
-}

rustfs/src/admin/handlers/plugin_attempt_v2_tests.rs

@@ -1,365 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-//! Real handler, persisted IAM and four-disk storage; this is not a signed HTTP/S3 end-to-end test.
-use super::*;
-use crate::admin::{
-    runtime_sources::{AppContext, IamInterface, KmsInterface, ServerContextSlot},
-    storage_api::{
-        ECStore,
-        contract::bucket::{BucketOperations as _, MakeBucketOptions},
-        contract::object::ObjectIO as _,
-    },
-};
-use crate::storage::storage_api::{StorageObjectOptions, StoragePutObjReader};
-use http_body_util::BodyExt as _;
-use rustfs_iam::{
-    store::{
-        Store as _, UserType,
-        object::{IAM_CONFIG_PREFIX, ObjectStore},
-    },
-    sys::IamSys,
-};
-use rustfs_madmin::{AccountStatus, AddOrUpdateUserReq};
-use serde_json::{Value, json};
-use std::sync::Arc;
-
-const PARENT: &str = "cross-parent";
-const BROKER: &str = "cross-broker";
-const SECRET: &str = "cross-bucket-test-secret";
-const ROOT: &str = "cross-root";
-const ROOT_SECRET: &str = "cross-bucket-root-test-secret";
-
-struct RequestIam(Arc<IamSys<ObjectStore>>);
-impl IamInterface for RequestIam {
-    fn handle(&self) -> Arc<IamSys<ObjectStore>> {
-        self.0.clone()
-    }
-    fn is_ready(&self) -> bool {
-        true
-    }
-}
-struct RequestKms;
-impl KmsInterface for RequestKms {
-    fn handle(&self) -> Arc<rustfs_kms::KmsServiceManager> {
-        Arc::new(rustfs_kms::KmsServiceManager::new())
-    }
-}
-struct Fixture {
-    _root: tempfile::TempDir,
-    store: Arc<ECStore>,
-    iam: Arc<IamSys<ObjectStore>>,
-    context: Arc<AppContext>,
-    input_version: String,
-}
-impl Fixture {
-    async fn new() -> Self {
-        let root = tempfile::tempdir().expect("cross-bucket storage root");
-        let env = rustfs_test_utils::TestECStoreEnv::builder()
-            .base_dir(root.path())
-            .disk_count(4)
-            .build()
-            .await;
-        assert_eq!(env.disk_paths.len(), 4);
-        let store = env.ecstore;
-        for bucket in ["photos", "artifacts", "third"] {
-            store
-                .make_bucket(
-                    bucket,
-                    &MakeBucketOptions {
-                        versioning_enabled: true,
-                        ..Default::default()
-                    },
-                )
-                .await
-                .expect("real versioned bucket");
-        }
-        let object = store
-            .put_object(
-                "photos",
-                "input/photo.png",
-                &mut StoragePutObjReader::from_vec(vec![0xA5; 273]),
-                &StorageObjectOptions {
-                    versioned: true,
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("real input version");
-        let input_version = object.version_id.expect("exact input version").to_string();
-        ObjectStore::new(store.clone())
-            .save_iam_config(json!({"version":1}), format!("{}/format.json", *IAM_CONFIG_PREFIX))
-            .await
-            .expect("persistent IAM format");
-        let iam = rustfs_iam::build_iam_sys(store.clone()).await.expect("real IAM");
-        let context = Arc::new(AppContext::new(store.clone(), Arc::new(RequestIam(iam.clone())), Arc::new(RequestKms)));
-        assert!(context.publish_action_credentials(rustfs_credentials::Credentials {
-            access_key: ROOT.into(),
-            secret_key: ROOT_SECRET.into(),
-            status: "on".into(),
-            ..Default::default()
-        }));
-        let fixture = Self {
-            _root: root,
-            store,
-            iam,
-            context,
-            input_version,
-        };
-        fixture.user(PARENT, Self::parent_policy(true, false)).await;
-        fixture
-            .user(
-                BROKER,
-                json!({"Version":"2012-10-17","Statement":[{
-            "Effect":"Allow","Action":"admin:IssuePluginAttempt"}]}),
-            )
-            .await;
-        fixture
-    }
-    fn parent_policy(output: bool, deny: bool) -> Value {
-        let mut resources = vec!["arn:aws:s3:::photos/output/*", "arn:aws:s3:::third/output/*"];
-        if output {
-            resources.push("arn:aws:s3:::artifacts/output/*");
-        }
-        let mut statements = vec![
-            json!({"Effect":"Allow","Action":"s3:GetObjectVersion","Resource":"arn:aws:s3:::photos/input/*"}),
-            json!({"Effect":"Allow","Action":"s3:PutObject","Resource":resources}),
-        ];
-        if deny {
-            statements.push(json!({"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::artifacts/*"}));
-        }
-        json!({"Version":"2012-10-17","Statement":statements})
-    }
-    async fn policy(&self, name: &str, value: Value) {
-        let policy = Policy::parse_config(&serde_json::to_vec(&value).expect("policy JSON")).expect("real IAM policy");
-        self.iam.set_policy(name, policy).await.expect("persist policy");
-    }
-    async fn user(&self, name: &str, policy: Value) {
-        self.iam
-            .create_user(
-                name,
-                &AddOrUpdateUserReq {
-                    secret_key: SECRET.into(),
-                    policy: None,
-                    status: AccountStatus::Enabled,
-                },
-            )
-            .await
-            .expect("create real user");
-        self.policy(name, policy).await;
-        self.iam
-            .policy_db_set(name, UserType::Reg, false, name)
-            .await
-            .expect("attach actual IAM policy");
-    }
-    fn request(&self, body: &Value) -> S3Request<Body> {
-        let slot = ServerContextSlot::new();
-        assert!(slot.install(self.context.clone()));
-        let mut req = S3Request {
-            input: Body::from(serde_json::to_vec(body).expect("attempt JSON")),
-            method: Method::POST,
-            uri: http::Uri::default(),
-            headers: http::HeaderMap::new(),
-            extensions: http::Extensions::new(),
-            credentials: None,
-            region: None,
-            service: None,
-            trailing_headers: None,
-        };
-        req.extensions.insert(slot);
-        req.method = Method::POST;
-        req.credentials = Some(s3::auth::Credentials {
-            access_key: BROKER.into(),
-            secret_key: s3::auth::SecretKey::from(SECRET.to_owned()),
-        });
-        req
-    }
-    async fn issue(&self, record: &Delegation, body: &Value) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let mut router = matchit::Router::new();
-        router.insert("/{id}", ()).expect("parameter route");
-        let path = format!("/{}", record.id);
-        Issue
-            .call(self.request(body), router.at(&path).expect("actual delegation ID").params)
-            .await
-    }
-    async fn allowed(
-        &self,
-        credential: &rustfs_credentials::Credentials,
-        action: S3Action,
-        bucket: &str,
-        object: &str,
-        version: Option<&str>,
-    ) -> bool {
-        let conditions = version
-            .map(|v| HashMap::from([("versionid".into(), vec![v.into()])]))
-            .unwrap_or_default();
-        self.iam
-            .is_allowed(&Args {
-                account: &credential.access_key,
-                groups: &credential.groups,
-                action: Action::S3Action(action),
-                bucket,
-                object,
-                conditions: &conditions,
-                claims: credential.claims_or_empty(),
-                is_owner: false,
-                deny_only: false,
-            })
-            .await
-    }
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[serial_test::serial]
-async fn delegation_v2_persists_and_vends_with_real_parent_intersection() {
-    temp_env::async_with_vars(
-        [
-            ("RUSTFS_PLUGIN_BROKERS", Some(r#"{"cross-broker":"runner"}"#)),
-            ("RUSTFS_SKIP_BACKGROUND_TASK", Some("1")),
-        ],
-        async {
-            let fixture = Fixture::new().await;
-            let now = now().expect("clock");
-            let legacy = json!({"deployment":"runner","bucket":"photos","input_prefix":"input/",
-            "output_prefix":"output/","expires_at_unix_seconds":now+3600});
-            let v1 = fixture
-                .iam
-                .create_plugin_delegation(PARENT, serde_json::from_value(legacy.clone()).expect("v1"), now)
-                .await
-                .expect("persist legacy delegation");
-            assert_eq!(v1.version, 1);
-            assert_eq!(serde_json::to_value(&v1.restrictions).expect("v1 wire"), legacy);
-            let mut v2 = legacy;
-            v2["version"] = json!(2);
-            v2["output_bucket"] = json!("artifacts");
-            let record = fixture
-                .iam
-                .create_plugin_delegation(PARENT, serde_json::from_value(v2.clone()).expect("v2"), now)
-                .await
-                .expect("persist v2 delegation");
-            assert_eq!(record.version, 2);
-            let loaded = fixture
-                .iam
-                .read_active_plugin_delegation(PARENT, &record.id, now)
-                .await
-                .expect("strict stored v2");
-            assert!(loaded == record, "same persisted v2 identity");
-            assert_eq!(serde_json::to_value(&loaded.restrictions).expect("v2 wire"), v2);
-            // The record envelope and restriction profile cannot disagree on a persisted read.
-            let path = format!("config/iam/plugin-delegations/v1/{}/record.json", record.id);
-            let mut corrupt = serde_json::to_value(&record).expect("record JSON");
-            corrupt["version"] = json!(1);
-            ObjectStore::new(fixture.store.clone())
-                .save_iam_config(corrupt, &path)
-                .await
-                .expect("inject incompatible stored version");
-            assert!(
-                fixture
-                    .iam
-                    .read_active_plugin_delegation(PARENT, &record.id, now)
-                    .await
-                    .is_err(),
-                "mixed v1/v2 stored profiles fail closed"
-            );
-            ObjectStore::new(fixture.store.clone())
-                .save_iam_config(&record, &path)
-                .await
-                .expect("restore exact stored record");
-            let run = uuid::Uuid::new_v4();
-            let attempt = uuid::Uuid::new_v4();
-            let prefix = format!("output/74656e616e74/{run}/{attempt}/");
-            let body = json!({"tenant":"tenant","run_id":run,"attempt_id":attempt,"revision":record.revision,
-            "deployment":"runner","input_bucket":"photos","input_key":"input/photo.png","input_version":fixture.input_version,
-            "output_bucket":"artifacts","output_prefix":prefix,"ttl_seconds":60});
-            let loaded_v1 = fixture
-                .iam
-                .read_active_plugin_delegation(PARENT, &v1.id, now)
-                .await
-                .expect("read legacy record");
-            assert!(loaded_v1 == v1, "legacy persistent identity");
-            let mut legacy_body = body.clone();
-            legacy_body["revision"] = json!(v1.revision);
-            legacy_body["output_bucket"] = json!("photos");
-            let legacy_response = fixture.issue(&v1, &legacy_body).await.expect("legacy same-bucket issuance");
-            assert_eq!(legacy_response.output.0, StatusCode::OK);
-            let mut wrong = body.clone();
-            wrong["output_bucket"] = json!("third");
-            match fixture.issue(&record, &wrong).await {
-                Err(error) => assert_eq!(error.code(), &S3ErrorCode::AccessDenied),
-                Ok(_) => panic!("A03_CROSS_BUCKET_OUTPUT_BOUND"),
-            }
-            let response = fixture.issue(&record, &body).await.expect("actual v2 issuance");
-            assert_eq!(response.output.0, StatusCode::OK);
-            assert_eq!(response.headers[http::header::CACHE_CONTROL], "no-store");
-            let issued: Value =
-                serde_json::from_slice(&response.output.1.collect().await.expect("issued body").to_bytes()).expect("issued JSON");
-            let (credential, root) = check_key_valid_with_context(
-                issued["session_token"].as_str().expect("token"),
-                issued["access_key_id"].as_str().expect("access key"),
-                Some(fixture.context.as_ref()),
-            )
-            .await
-            .expect("persisted actual temporary identity");
-            assert!(!root && credential.is_temp());
-            let output = format!("{prefix}image.png");
-            for (action, bucket, object, version, expected) in [
-                (
-                    S3Action::GetObjectVersionAction,
-                    "photos",
-                    "input/photo.png",
-                    Some(fixture.input_version.as_str()),
-                    true,
-                ),
-                (
-                    S3Action::GetObjectVersionAction,
-                    "photos",
-                    "input/photo.png",
-                    Some("wrong-version"),
-                    false,
-                ),
-                (S3Action::GetObjectAction, "photos", "input/photo.png", None, false),
-                (S3Action::PutObjectAction, "artifacts", output.as_str(), None, true),
-                (S3Action::PutObjectAction, "photos", output.as_str(), None, false),
-                (S3Action::PutObjectAction, "third", output.as_str(), None, false),
-                (S3Action::PutObjectAction, "artifacts", "output/other/image.png", None, false),
-            ] {
-                assert_eq!(
-                    fixture.allowed(&credential, action, bucket, object, version).await,
-                    expected,
-                    "A03_CROSS_BUCKET_PARENT_INTERSECTION: bucket={bucket} object={object}"
-                );
-            }
-            fixture.policy(PARENT, Fixture::parent_policy(true, true)).await;
-            assert!(
-                !fixture
-                    .allowed(&credential, S3Action::PutObjectAction, "artifacts", &output, None)
-                    .await,
-                "explicit parent Deny remains effective"
-            );
-            fixture.policy(PARENT, Fixture::parent_policy(false, false)).await;
-            assert!(
-                !fixture
-                    .allowed(&credential, S3Action::PutObjectAction, "artifacts", &output, None)
-                    .await,
-                "removing parent output permission remains effective"
-            );
-            assert!(
-                fixture
-                    .allowed(
-                        &credential,
-                        S3Action::GetObjectVersionAction,
-                        "photos",
-                        "input/photo.png",
-                        Some(&fixture.input_version)
-                    )
-                    .await
-            );
-            fixture
-                .iam
-                .revoke_plugin_delegation(PARENT, &record.id)
-                .await
-                .expect("revoke v2");
-            assert!(fixture.issue(&record, &body).await.is_err(), "revoked v2 cannot issue again");
-        },
-    )
-    .await;
-}

rustfs/src/admin/handlers/plugin_delegation.rs

@@ -1,624 +0,0 @@
-// Copyright 2026 RustFS Team
-// SPDX-License-Identifier: Apache-2.0
-
-//! Restriction registration only. These endpoints do not vend credentials.
-use crate::admin::{
-    auth::{AdminResourceScope, validate_admin_action_with_bucket_object_for_iam},
-    plugin_runner::{self, ObjectReference, SubmitRequest},
-    router::{AdminOperation, Operation, S3Router},
-    runtime_sources,
-    storage_api::s3::{self, Body, S3Error, S3ErrorCode, S3Request, S3Response, S3Result},
-};
-use crate::{
-    auth::{check_key_valid_with_context, get_session_token},
-    server::{ADMIN_PREFIX, RemoteAddr},
-};
-use http::{HeaderMap, HeaderValue, Method, StatusCode};
-use matchit::Params;
-use rustfs_iam::delegation::{DelegationError, Restrictions};
-use rustfs_policy::policy::action::{Action, AdminAction};
-use serde::Deserialize;
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
-
-pub fn register_plugin_delegation_route(router: &mut S3Router<AdminOperation>) -> std::io::Result<()> {
-    router.insert(Method::POST, &format!("{ADMIN_PREFIX}/v3/plugin-delegations"), AdminOperation(&Create))?;
-    router.insert(Method::GET, &format!("{ADMIN_PREFIX}/v3/plugin-delegations/{{id}}"), AdminOperation(&Get))?;
-    router.insert(
-        Method::POST,
-        &format!("{ADMIN_PREFIX}/v3/plugin-delegations/{{id}}/revoke"),
-        AdminOperation(&Revoke),
-    )?;
-    router.insert(
-        Method::POST,
-        &format!("{ADMIN_PREFIX}/v3/plugin-delegations/{{id}}/submit"),
-        AdminOperation(&Submit),
-    )?;
-    router.insert(
-        Method::POST,
-        &format!("{ADMIN_PREFIX}/v3/plugin-delegations/{{id}}/runs/query"),
-        AdminOperation(&QueryRun),
-    )?;
-    router.insert(
-        Method::POST,
-        &format!("{ADMIN_PREFIX}/v3/plugin-delegations/{{id}}/runs/history"),
-        AdminOperation(&HistoryRun),
-    )?;
-    router.insert(
-        Method::POST,
-        &format!("{ADMIN_PREFIX}/v3/plugin-delegations/{{id}}/runs/cancel"),
-        AdminOperation(&CancelRun),
-    )?;
-    router.insert(
-        Method::POST,
-        &format!("{ADMIN_PREFIX}/v3/plugin-delegations/{{id}}/runs/page"),
-        AdminOperation(&PageRuns),
-    )?;
-    router.insert(
-        Method::POST,
-        &format!("{ADMIN_PREFIX}/v3/plugin-delegations/{{id}}/runs/replay"),
-        AdminOperation(&ReplayRun),
-    )?;
-    Ok(())
-}
-
-pub(super) fn storage_error(error: DelegationError) -> S3Error {
-    match error {
-        DelegationError::Invalid => s3::error(S3ErrorCode::InvalidRequest, "invalid delegation restriction"),
-        DelegationError::NotFound | DelegationError::OwnerRejected => s3::error(S3ErrorCode::NoSuchKey, "delegation not found"),
-        DelegationError::Unavailable => s3::error(S3ErrorCode::InternalError, "delegation unavailable"),
-        _ => s3::error(S3ErrorCode::AccessDenied, "delegation rejected"),
-    }
-}
-
-pub(super) async fn owner(
-    req: &S3Request<Body>,
-    action: AdminAction,
-) -> S3Result<(std::sync::Arc<rustfs_iam::sys::IamSys<rustfs_iam::store::object::ObjectStore>>, String)> {
-    let signed = req
-        .credentials
-        .as_ref()
-        .ok_or_else(|| s3::error(S3ErrorCode::AccessDenied, "authentication required"))?;
-    if get_session_token(&req.uri, &req.headers).is_some() {
-        return Err(s3::error(S3ErrorCode::AccessDenied, "original user required"));
-    }
-    let context = runtime_sources::app_context_from_req(req)
-        .ok_or_else(|| s3::error(S3ErrorCode::InternalError, "application context unavailable"))?;
-    let (credentials, root) = check_key_valid_with_context("", &signed.access_key, Some(context.as_ref())).await?;
-    if root || credentials.is_temp() || credentials.is_service_account() {
-        return Err(s3::error(S3ErrorCode::AccessDenied, "original user required"));
-    }
-    if !context.iam().is_ready() {
-        return Err(s3::error(S3ErrorCode::InternalError, "iam unavailable"));
-    }
-    let iam = context.iam().handle();
-    validate_admin_action_with_bucket_object_for_iam(
-        iam.clone(),
-        &req.headers,
-        &credentials,
-        false,
-        Action::AdminAction(action),
-        req.extensions.get::<Option<RemoteAddr>>().and_then(|a| a.map(|a| a.0)),
-        AdminResourceScope::bucket_object("", ""),
-    )
-    .await?;
-    Ok((iam, credentials.access_key))
-}
-
-pub(super) fn response<T: serde::Serialize>(value: &T) -> S3Result<S3Response<(StatusCode, Body)>> {
-    let bytes =
-        serde_json::to_vec(value).map_err(|_| s3::error(S3ErrorCode::InternalError, "delegation response unavailable"))?;
-    let mut headers = HeaderMap::new();
-    headers.insert(http::header::CONTENT_TYPE, HeaderValue::from_static("application/json"));
-    headers.insert(http::header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
-    Ok(S3Response::with_headers((StatusCode::OK, Body::from(bytes)), headers))
-}
-
-struct Create;
-#[async_trait::async_trait]
-impl Operation for Create {
-    async fn call(&self, mut req: S3Request<Body>, _params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let (iam, owner) = owner(&req, AdminAction::CreatePluginDelegationAction).await?;
-        let bytes = tokio::time::timeout(Duration::from_secs(10), req.input.store_all_limited(16384))
-            .await
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "delegation body unavailable"))?
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "delegation body unavailable"))?;
-        let restriction: Restrictions = serde_json::from_slice(&bytes)
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid delegation restriction"))?;
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .map_err(|_| s3::error(S3ErrorCode::InternalError, "clock unavailable"))?
-            .as_secs();
-        let record = iam
-            .create_plugin_delegation(&owner, restriction, now)
-            .await
-            .map_err(storage_error)?;
-        response(&record)
-    }
-}
-
-struct Get;
-#[async_trait::async_trait]
-impl Operation for Get {
-    async fn call(&self, req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let (iam, owner) = owner(&req, AdminAction::GetPluginDelegationAction).await?;
-        let id = params
-            .get("id")
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "delegation id required"))?;
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .map_err(|_| s3::error(S3ErrorCode::InternalError, "clock unavailable"))?
-            .as_secs();
-        let record = iam
-            .read_active_plugin_delegation(&owner, id, now)
-            .await
-            .map_err(storage_error)?;
-        response(&record)
-    }
-}
-
-struct Revoke;
-#[async_trait::async_trait]
-impl Operation for Revoke {
-    async fn call(&self, req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let (iam, owner) = owner(&req, AdminAction::RevokePluginDelegationAction).await?;
-        let id = params
-            .get("id")
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "delegation id required"))?;
-        iam.revoke_plugin_delegation(&owner, id).await.map_err(storage_error)?;
-        response(&serde_json::json!({"revoked":true,"id":id}))
-    }
-}
-
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct SubmitInput {
-    version: u32,
-    instance_id: String,
-    idempotency_key: String,
-    object: SubmitObject,
-}
-
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct SubmitObject {
-    bucket: String,
-    key: String,
-    version_id: String,
-}
-
-struct Submit;
-#[async_trait::async_trait]
-impl Operation for Submit {
-    async fn call(&self, mut req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let (iam, signer) = owner(&req, AdminAction::SubmitPluginJobAction).await?;
-        let id = params
-            .get("id")
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "delegation id required"))?;
-        let bytes = tokio::time::timeout(Duration::from_secs(10), req.input.store_all_limited(16384))
-            .await
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "submit body unavailable"))?
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "submit body unavailable"))?;
-        let input: SubmitInput =
-            serde_json::from_slice(&bytes).map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid submit request"))?;
-        if input.version != 1
-            || !plugin_runner::literal(&input.instance_id)
-            || !plugin_runner::valid_idempotency_key(&input.idempotency_key)
-        {
-            return Err(s3::error(S3ErrorCode::InvalidRequest, "invalid submit request"));
-        }
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .map_err(|_| s3::error(S3ErrorCode::InternalError, "clock unavailable"))?
-            .as_secs();
-        let record = iam
-            .read_active_plugin_delegation(&signer, id, now)
-            .await
-            .map_err(storage_error)?;
-        let deployment = plugin_runner::configured_deployment()?;
-        if !plugin_runner::validate_delegation_scope(
-            &record,
-            &signer,
-            id,
-            &deployment,
-            ObjectReference {
-                bucket: &input.object.bucket,
-                key: &input.object.key,
-                version_id: &input.object.version_id,
-            },
-            now,
-        ) {
-            return Err(s3::error(S3ErrorCode::AccessDenied, "submit restriction rejected"));
-        }
-        let receipt = plugin_runner::submit(&SubmitRequest {
-            version: input.version,
-            instance_id: &input.instance_id,
-            idempotency_key: &input.idempotency_key,
-            object: ObjectReference {
-                bucket: &input.object.bucket,
-                key: &input.object.key,
-                version_id: &input.object.version_id,
-            },
-            delegation_id: &record.id,
-            delegation_revision: &record.revision,
-            actual_signer_access_key: &signer,
-        })
-        .await?;
-        response(&receipt)
-    }
-}
-
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct QueryRunInput {
-    version: u32,
-    run_id: uuid::Uuid,
-}
-
-struct QueryRun;
-#[async_trait::async_trait]
-impl Operation for QueryRun {
-    async fn call(&self, mut req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let (iam, signer) = owner(&req, AdminAction::GetPluginRunAction).await?;
-        let id = params
-            .get("id")
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "delegation id required"))?;
-        let bytes = tokio::time::timeout(Duration::from_secs(10), req.input.store_all_limited(16384))
-            .await
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "query body unavailable"))?
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "query body unavailable"))?;
-        let input: QueryRunInput =
-            serde_json::from_slice(&bytes).map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid query request"))?;
-        if input.version != 1 || input.run_id.is_nil() {
-            return Err(s3::error(S3ErrorCode::InvalidRequest, "invalid query request"));
-        }
-        let record = iam.read_owned_plugin_delegation(&signer, id).await.map_err(storage_error)?;
-        let result = plugin_runner::query(&plugin_runner::QueryRequest {
-            version: input.version,
-            run_id: input.run_id,
-            delegation_id: &record.id,
-            delegation_revision: &record.revision,
-            actual_signer_access_key: &signer,
-        })
-        .await?;
-        response(&result)
-    }
-}
-
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct HistoryRunInput {
-    version: u32,
-    run_id: uuid::Uuid,
-}
-
-fn valid_history_run_input(input: &HistoryRunInput) -> bool {
-    input.version == 1 && !input.run_id.is_nil()
-}
-
-struct HistoryRun;
-#[async_trait::async_trait]
-impl Operation for HistoryRun {
-    async fn call(&self, mut req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let (iam, signer) = owner(&req, AdminAction::ListPluginRunsAction).await?;
-        let id = params
-            .get("id")
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "delegation id required"))?;
-        let bytes = tokio::time::timeout(Duration::from_secs(10), req.input.store_all_limited(16384))
-            .await
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "history body unavailable"))?
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "history body unavailable"))?;
-        let input: HistoryRunInput =
-            serde_json::from_slice(&bytes).map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid history request"))?;
-        if !valid_history_run_input(&input) {
-            return Err(s3::error(S3ErrorCode::InvalidRequest, "invalid history request"));
-        }
-        let record = iam.read_owned_plugin_delegation(&signer, id).await.map_err(storage_error)?;
-        let result = plugin_runner::history(&plugin_runner::HistoryRequest {
-            version: input.version,
-            run_id: input.run_id,
-            delegation_id: &record.id,
-            delegation_revision: &record.revision,
-            actual_signer_access_key: &signer,
-        })
-        .await?;
-        response(&result)
-    }
-}
-
-struct CancelRun;
-#[async_trait::async_trait]
-impl Operation for CancelRun {
-    async fn call(&self, mut req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let (iam, signer) = owner(&req, AdminAction::CancelPluginRunAction).await?;
-        let id = params
-            .get("id")
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "delegation id required"))?;
-        let bytes = tokio::time::timeout(Duration::from_secs(10), req.input.store_all_limited(16384))
-            .await
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "cancel body unavailable"))?
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "cancel body unavailable"))?;
-        let input: QueryRunInput =
-            serde_json::from_slice(&bytes).map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid cancel request"))?;
-        if input.version != 1 || input.run_id.is_nil() {
-            return Err(s3::error(S3ErrorCode::InvalidRequest, "invalid cancel request"));
-        }
-        let record = iam.read_owned_plugin_delegation(&signer, id).await.map_err(storage_error)?;
-        let result = plugin_runner::cancel(&plugin_runner::CancelRequest {
-            version: input.version,
-            run_id: input.run_id,
-            delegation_id: &record.id,
-            delegation_revision: &record.revision,
-            actual_signer_access_key: &signer,
-        })
-        .await?;
-        response(&result)
-    }
-}
-
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct PageRunsInput {
-    version: u32,
-    limit: u32,
-    #[serde(default)]
-    cursor: Option<plugin_runner::RunPageCursor>,
-}
-
-fn valid_page_runs_input(input: &PageRunsInput) -> bool {
-    input.version == 1 && (1..=100).contains(&input.limit) && !input.cursor.is_some_and(|cursor| cursor.run_id.is_nil())
-}
-
-struct PageRuns;
-#[async_trait::async_trait]
-impl Operation for PageRuns {
-    async fn call(&self, mut req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let (iam, signer) = owner(&req, AdminAction::ListPluginRunsAction).await?;
-        let id = params
-            .get("id")
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "delegation id required"))?;
-        let bytes = tokio::time::timeout(Duration::from_secs(10), req.input.store_all_limited(16384))
-            .await
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "page body unavailable"))?
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "page body unavailable"))?;
-        let input: PageRunsInput =
-            serde_json::from_slice(&bytes).map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid page request"))?;
-        if !valid_page_runs_input(&input) {
-            return Err(s3::error(S3ErrorCode::InvalidRequest, "invalid page request"));
-        }
-        let record = iam.read_owned_plugin_delegation(&signer, id).await.map_err(storage_error)?;
-        let result = plugin_runner::page(&plugin_runner::PageRequest {
-            version: input.version,
-            actual_signer_access_key: &signer,
-            delegation_id: &record.id,
-            delegation_revision: &record.revision,
-            limit: input.limit,
-            cursor: input.cursor,
-        })
-        .await?;
-        response(&result)
-    }
-}
-
-#[derive(Deserialize)]
-#[serde(deny_unknown_fields)]
-struct ReplayRunInput {
-    version: u32,
-    origin_run_id: uuid::Uuid,
-    idempotency_key: String,
-    deadline_unix_micros: i64,
-}
-
-fn valid_replay_run_input(input: &ReplayRunInput) -> bool {
-    input.version == 1
-        && !input.origin_run_id.is_nil()
-        && plugin_runner::valid_idempotency_key(&input.idempotency_key)
-        && input.deadline_unix_micros > 0
-}
-
-struct ReplayRun;
-#[async_trait::async_trait]
-impl Operation for ReplayRun {
-    async fn call(&self, mut req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
-        let (iam, signer) = owner(&req, AdminAction::ReplayPluginRunAction).await?;
-        let id = params
-            .get("id")
-            .ok_or_else(|| s3::error(S3ErrorCode::InvalidRequest, "delegation id required"))?;
-        let bytes = tokio::time::timeout(Duration::from_secs(10), req.input.store_all_limited(16384))
-            .await
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "replay body unavailable"))?
-            .map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "replay body unavailable"))?;
-        let input: ReplayRunInput =
-            serde_json::from_slice(&bytes).map_err(|_| s3::error(S3ErrorCode::InvalidRequest, "invalid replay request"))?;
-        if !valid_replay_run_input(&input) {
-            return Err(s3::error(S3ErrorCode::InvalidRequest, "invalid replay request"));
-        }
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .map_err(|_| s3::error(S3ErrorCode::InternalError, "clock unavailable"))?
-            .as_secs();
-        let record = iam
-            .read_active_plugin_delegation(&signer, id, now)
-            .await
-            .map_err(storage_error)?;
-        let result = plugin_runner::replay(&plugin_runner::ReplayRequest {
-            version: input.version,
-            origin_run_id: input.origin_run_id,
-            idempotency_key: &input.idempotency_key,
-            deadline_unix_micros: input.deadline_unix_micros,
-            actual_signer_access_key: &signer,
-            delegation_id: &record.id,
-            delegation_revision: &record.revision,
-        })
-        .await?;
-        response(&result)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    #[tokio::test]
-    async fn delegation_mutations_require_authenticated_original_user() {
-        for operation in 0..8 {
-            let req = S3Request {
-                input: Body::from("{}".to_owned()),
-                method: Method::POST,
-                uri: http::Uri::from_static("/rustfs/admin/v3/plugin-delegations"),
-                headers: HeaderMap::new(),
-                extensions: http::Extensions::new(),
-                credentials: None,
-                region: None,
-                service: None,
-                trailing_headers: None,
-            };
-            let result = if operation == 0 {
-                Get.call(req, Params::new()).await
-            } else if operation == 1 {
-                Revoke.call(req, Params::new()).await
-            } else if operation == 2 {
-                Submit.call(req, Params::new()).await
-            } else if operation == 3 {
-                QueryRun.call(req, Params::new()).await
-            } else if operation == 4 {
-                HistoryRun.call(req, Params::new()).await
-            } else if operation == 5 {
-                CancelRun.call(req, Params::new()).await
-            } else if operation == 6 {
-                PageRuns.call(req, Params::new()).await
-            } else if operation == 7 {
-                ReplayRun.call(req, Params::new()).await
-            } else {
-                Create.call(req, Params::new()).await
-            };
-            let error = result.expect_err("unsigned mutations must not reach persistence");
-            assert_eq!(error.code(), &S3ErrorCode::AccessDenied);
-        }
-    }
-
-    #[test]
-    fn submit_dto_rejects_client_authority_fields_and_null_versions() {
-        assert!(serde_json::from_str::<SubmitInput>(
-            r#"{"version":1,"instance_id":"img","idempotency_key":"k","object":{"bucket":"b","key":"k","version_id":"v"},"actual_signer_access_key":"forged"}"#
-        )
-        .is_err());
-        let input: SubmitInput = serde_json::from_str(
-            r#"{"version":1,"instance_id":"img","idempotency_key":"k","object":{"bucket":"b","key":"a/x","version_id":"null"}}"#,
-        )
-        .unwrap();
-        let record = rustfs_iam::delegation::Delegation {
-            version: 1,
-            id: "a".repeat(32),
-            revision: "a".repeat(32),
-            owner_access_key: "owner".into(),
-            created_at_unix_seconds: 1,
-            restrictions: Restrictions {
-                version: None,
-                output_bucket: None,
-                deployment: "prod".into(),
-                bucket: "b".into(),
-                input_prefix: "a/".into(),
-                output_prefix: "out/".into(),
-                expires_at_unix_seconds: 100,
-            },
-        };
-        assert!(!plugin_runner::validate_delegation_scope(
-            &record,
-            "owner",
-            &record.id,
-            "prod",
-            ObjectReference {
-                bucket: &input.object.bucket,
-                key: &input.object.key,
-                version_id: &input.object.version_id,
-            },
-            2,
-        ));
-    }
-
-    #[test]
-    fn query_run_dto_rejects_client_authority_fields() {
-        let run_id = uuid::Uuid::from_u128(1);
-        let input: QueryRunInput =
-            serde_json::from_str(&format!(r#"{{"version":1,"run_id":"{run_id}"}}"#)).expect("valid run query");
-        assert_eq!(input.run_id, run_id);
-        assert!(
-            serde_json::from_str::<QueryRunInput>(&format!(
-                r#"{{"version":1,"run_id":"{run_id}","actual_signer_access_key":"forged"}}"#
-            ))
-            .is_err()
-        );
-    }
-
-    #[test]
-    fn history_run_dto_is_strict_and_rejects_nil_run() {
-        let run_id = uuid::Uuid::from_u128(1);
-        let input: HistoryRunInput =
-            serde_json::from_str(&format!(r#"{{"version":1,"run_id":"{run_id}"}}"#)).expect("valid history request");
-        assert!(valid_history_run_input(&input));
-        for raw in [
-            r#"{"version":1,"run_id":"00000000-0000-0000-0000-000000000000"}"#,
-            r#"{"version":2,"run_id":"00000000-0000-0000-0000-000000000001"}"#,
-            r#"{"version":1,"run_id":"00000000-0000-0000-0000-000000000001","actual_signer_access_key":"forged"}"#,
-        ] {
-            let rejected = match serde_json::from_str::<HistoryRunInput>(raw) {
-                Ok(input) => !valid_history_run_input(&input),
-                Err(_) => true,
-            };
-            assert!(rejected, "accepted invalid history request: {raw}");
-        }
-    }
-
-    #[test]
-    fn page_runs_dto_is_strict_and_bounded() {
-        let cursor = plugin_runner::RunPageCursor {
-            created_at_unix_micros: 10,
-            run_id: uuid::Uuid::from_u128(1),
-        };
-        let input: PageRunsInput = serde_json::from_str(
-            r#"{"version":1,"limit":100,"cursor":{"created_at_unix_micros":10,"run_id":"00000000-0000-0000-0000-000000000001"}}"#,
-        )
-        .expect("valid page request");
-        assert_eq!(input.cursor, Some(cursor));
-        for raw in [
-            r#"{"version":1,"limit":0}"#,
-            r#"{"version":1,"limit":101}"#,
-            r#"{"version":1,"limit":1,"unknown":true}"#,
-            r#"{"version":1,"limit":1,"actual_signer_access_key":"forged"}"#,
-            r#"{"version":1,"limit":1,"cursor":{"created_at_unix_micros":10,"run_id":"00000000-0000-0000-0000-000000000000"}}"#,
-        ] {
-            let rejected = match serde_json::from_str::<PageRunsInput>(raw) {
-                Ok(input) => !valid_page_runs_input(&input),
-                Err(_) => true,
-            };
-            assert!(rejected, "accepted invalid page request: {raw}");
-        }
-    }
-
-    #[test]
-    fn replay_run_dto_is_strict_and_bounded() {
-        let run_id = uuid::Uuid::from_u128(1);
-        let input: ReplayRunInput = serde_json::from_str(&format!(
-            r#"{{"version":1,"origin_run_id":"{run_id}","idempotency_key":"retry-1","deadline_unix_micros":123}}"#
-        ))
-        .expect("valid replay request");
-        assert!(valid_replay_run_input(&input));
-        for raw in [
-            r#"{"version":1,"origin_run_id":"00000000-0000-0000-0000-000000000000","idempotency_key":"k","deadline_unix_micros":123}"#.to_string(),
-            format!(r#"{{"version":1,"origin_run_id":"{run_id}","idempotency_key":"","deadline_unix_micros":123}}"#),
-            format!(r#"{{"version":1,"origin_run_id":"{run_id}","idempotency_key":"k","deadline_unix_micros":0}}"#),
-            format!(
-                r#"{{"version":1,"origin_run_id":"{run_id}","idempotency_key":"k","deadline_unix_micros":123,"actual_signer_access_key":"forged"}}"#
-            ),
-            format!(
-                r#"{{"version":1,"origin_run_id":"{run_id}","idempotency_key":"{}","deadline_unix_micros":123}}"#,
-                "x".repeat(1025)
-            ),
-        ] {
-            let rejected = match serde_json::from_str::<ReplayRunInput>(&raw) {
-                Ok(input) => !valid_replay_run_input(&input),
-                Err(_) => true,
-            };
-            assert!(rejected, "accepted invalid replay request: {raw}");
-        }
-    }
-}

rustfs/src/admin/mod.rs

@@ -17,7 +17,6 @@ mod auth;
 pub mod console;
 pub mod handlers;
 mod plugin_contract;
-pub(crate) mod plugin_runner;
 pub(crate) mod replication_metrics_wire;
 // Contract inventory is validated by tests before later runtime integration.
 pub(crate) mod route_policy;
@@ -65,8 +64,6 @@ pub fn make_admin_route(
 fn register_admin_routes(r: &mut S3Router<AdminOperation>) -> std::io::Result<()> {
     health::register_health_route(r)?;
     sts::register_admin_auth_route(r)?;
-    handlers::plugin_delegation::register_plugin_delegation_route(r)?;
-    handlers::plugin_attempt::register_plugin_attempt_route(r)?;
 
     account::register_account_route(r)?;
     mfa::register_mfa_route(r)?;

rustfs/src/admin/route_policy.rs

@@ -25,15 +25,6 @@ const TLS_CERTIFICATE_PUBLISH: AdminActionRef = AdminActionRef::new("TLSCertific
 const TLS_CERTIFICATE_STATUS: AdminActionRef = AdminActionRef::new("TLSCertificateStatusAdminAction");
 const CONSOLE_LOG: AdminActionRef = AdminActionRef::new("ConsoleLogAdminAction");
 const COMMIT_TABLE: AdminActionRef = AdminActionRef::new("CommitTableAction");
-const ISSUE_PLUGIN_ATTEMPT: AdminActionRef = AdminActionRef::new("IssuePluginAttemptAction");
-const SUBMIT_PLUGIN_JOB: AdminActionRef = AdminActionRef::new("SubmitPluginJobAction");
-const GET_PLUGIN_RUN: AdminActionRef = AdminActionRef::new("GetPluginRunAction");
-const CANCEL_PLUGIN_RUN: AdminActionRef = AdminActionRef::new("CancelPluginRunAction");
-const LIST_PLUGIN_RUNS: AdminActionRef = AdminActionRef::new("ListPluginRunsAction");
-const REPLAY_PLUGIN_RUN: AdminActionRef = AdminActionRef::new("ReplayPluginRunAction");
-const GET_PLUGIN_DELEGATION: AdminActionRef = AdminActionRef::new("GetPluginDelegationAction");
-const CREATE_PLUGIN_DELEGATION: AdminActionRef = AdminActionRef::new("CreatePluginDelegationAction");
-const REVOKE_PLUGIN_DELEGATION: AdminActionRef = AdminActionRef::new("RevokePluginDelegationAction");
 const CREATE_POLICY: AdminActionRef = AdminActionRef::new("CreatePolicyAdminAction");
 const CREATE_USER: AdminActionRef = AdminActionRef::new("CreateUserAdminAction");
 const CREATE_SERVICE_ACCOUNT: AdminActionRef = AdminActionRef::new("CreateServiceAccountAdminAction");
@@ -665,66 +656,6 @@ pub const ADMIN_ROUTE_POLICY_SPECS: &[AdminRouteSpec] = &[
         SERVER_INFO,
         RouteRiskLevel::Sensitive,
     ),
-    admin(
-        HttpMethod::Post,
-        "/rustfs/admin/v3/plugin-delegations/{id}/issue-attempt",
-        ISSUE_PLUGIN_ATTEMPT,
-        RouteRiskLevel::High,
-    ),
-    admin(
-        HttpMethod::Post,
-        "/rustfs/admin/v3/plugin-delegations/{id}/submit",
-        SUBMIT_PLUGIN_JOB,
-        RouteRiskLevel::High,
-    ),
-    admin(
-        HttpMethod::Post,
-        "/rustfs/admin/v3/plugin-delegations/{id}/runs/query",
-        GET_PLUGIN_RUN,
-        RouteRiskLevel::Sensitive,
-    ),
-    admin(
-        HttpMethod::Post,
-        "/rustfs/admin/v3/plugin-delegations/{id}/runs/history",
-        LIST_PLUGIN_RUNS,
-        RouteRiskLevel::Sensitive,
-    ),
-    admin(
-        HttpMethod::Post,
-        "/rustfs/admin/v3/plugin-delegations/{id}/runs/cancel",
-        CANCEL_PLUGIN_RUN,
-        RouteRiskLevel::Sensitive,
-    ),
-    admin(
-        HttpMethod::Post,
-        "/rustfs/admin/v3/plugin-delegations/{id}/runs/page",
-        LIST_PLUGIN_RUNS,
-        RouteRiskLevel::Sensitive,
-    ),
-    admin(
-        HttpMethod::Post,
-        "/rustfs/admin/v3/plugin-delegations/{id}/runs/replay",
-        REPLAY_PLUGIN_RUN,
-        RouteRiskLevel::Sensitive,
-    ),
-    admin(
-        HttpMethod::Get,
-        "/rustfs/admin/v3/plugin-delegations/{id}",
-        GET_PLUGIN_DELEGATION,
-        RouteRiskLevel::Sensitive,
-    ),
-    admin(
-        HttpMethod::Post,
-        "/rustfs/admin/v3/plugin-delegations",
-        CREATE_PLUGIN_DELEGATION,
-        RouteRiskLevel::High,
-    ),
-    admin(
-        HttpMethod::Post,
-        "/rustfs/admin/v3/plugin-delegations/{id}/revoke",
-        REVOKE_PLUGIN_DELEGATION,
-        RouteRiskLevel::High,
-    ),
     admin(
         HttpMethod::Get,
         "/rustfs/admin/v4/plugins/catalog",
@@ -2002,72 +1933,6 @@ mod tests {
         assert!(validate_admin_route_policy_specs().is_ok());
     }
 
-    #[test]
-    fn plugin_submit_route_is_registered_as_high_risk_authenticated_action() {
-        let path = "/rustfs/admin/v3/plugin-delegations/{id}/submit";
-        assert_action(HttpMethod::Post, path, SUBMIT_PLUGIN_JOB);
-        let spec = ADMIN_ROUTE_POLICY_SPECS
-            .iter()
-            .find(|spec| spec.method() == HttpMethod::Post && spec.path() == path)
-            .expect("submit route policy");
-        assert_eq!(spec.risk_level(), RouteRiskLevel::High);
-    }
-
-    #[test]
-    fn plugin_run_query_route_uses_dedicated_authenticated_action() {
-        let path = "/rustfs/admin/v3/plugin-delegations/{id}/runs/query";
-        assert_action(HttpMethod::Post, path, GET_PLUGIN_RUN);
-        let spec = ADMIN_ROUTE_POLICY_SPECS
-            .iter()
-            .find(|spec| spec.method() == HttpMethod::Post && spec.path() == path)
-            .expect("plugin run query route policy");
-        assert_eq!(spec.risk_level(), RouteRiskLevel::Sensitive);
-    }
-
-    #[test]
-    fn plugin_run_history_route_uses_list_action() {
-        let path = "/rustfs/admin/v3/plugin-delegations/{id}/runs/history";
-        assert_action(HttpMethod::Post, path, LIST_PLUGIN_RUNS);
-        let spec = ADMIN_ROUTE_POLICY_SPECS
-            .iter()
-            .find(|spec| spec.method() == HttpMethod::Post && spec.path() == path)
-            .expect("plugin run history route policy");
-        assert_eq!(spec.risk_level(), RouteRiskLevel::Sensitive);
-    }
-
-    #[test]
-    fn plugin_run_cancel_route_uses_dedicated_authenticated_action() {
-        let path = "/rustfs/admin/v3/plugin-delegations/{id}/runs/cancel";
-        assert_action(HttpMethod::Post, path, CANCEL_PLUGIN_RUN);
-        let spec = ADMIN_ROUTE_POLICY_SPECS
-            .iter()
-            .find(|spec| spec.method() == HttpMethod::Post && spec.path() == path)
-            .expect("plugin run cancel route policy");
-        assert_eq!(spec.risk_level(), RouteRiskLevel::Sensitive);
-    }
-
-    #[test]
-    fn plugin_run_page_route_uses_dedicated_authenticated_action() {
-        let path = "/rustfs/admin/v3/plugin-delegations/{id}/runs/page";
-        assert_action(HttpMethod::Post, path, LIST_PLUGIN_RUNS);
-        let spec = ADMIN_ROUTE_POLICY_SPECS
-            .iter()
-            .find(|spec| spec.method() == HttpMethod::Post && spec.path() == path)
-            .expect("plugin run page route policy");
-        assert_eq!(spec.risk_level(), RouteRiskLevel::Sensitive);
-    }
-
-    #[test]
-    fn plugin_run_replay_route_uses_dedicated_authenticated_action() {
-        let path = "/rustfs/admin/v3/plugin-delegations/{id}/runs/replay";
-        assert_action(HttpMethod::Post, path, REPLAY_PLUGIN_RUN);
-        let spec = ADMIN_ROUTE_POLICY_SPECS
-            .iter()
-            .find(|spec| spec.method() == HttpMethod::Post && spec.path() == path)
-            .expect("plugin run replay route policy");
-        assert_eq!(spec.risk_level(), RouteRiskLevel::Sensitive);
-    }
-
     #[test]
     fn route_policy_inventory_has_no_internal_overlap() {
         let mut seen = BTreeSet::new();

rustfs/src/admin/route_registration_test.rs

@@ -116,48 +116,6 @@ fn registered_admin_router() -> S3Router<AdminOperation> {
 
 fn expected_admin_route_matrix() -> Vec<RouteMatrixEntry> {
     vec![
-        admin_route(Method::POST, "/v3/plugin-delegations"),
-        admin_route_sample(Method::GET, "/v3/plugin-delegations/{id}", "/v3/plugin-delegations/test-delegation"),
-        admin_route_sample(
-            Method::POST,
-            "/v3/plugin-delegations/{id}/revoke",
-            "/v3/plugin-delegations/test-delegation/revoke",
-        ),
-        admin_route_sample(
-            Method::POST,
-            "/v3/plugin-delegations/{id}/submit",
-            "/v3/plugin-delegations/test-delegation/submit",
-        ),
-        admin_route_sample(
-            Method::POST,
-            "/v3/plugin-delegations/{id}/runs/query",
-            "/v3/plugin-delegations/test-delegation/runs/query",
-        ),
-        admin_route_sample(
-            Method::POST,
-            "/v3/plugin-delegations/{id}/runs/history",
-            "/v3/plugin-delegations/test-delegation/runs/history",
-        ),
-        admin_route_sample(
-            Method::POST,
-            "/v3/plugin-delegations/{id}/runs/cancel",
-            "/v3/plugin-delegations/test-delegation/runs/cancel",
-        ),
-        admin_route_sample(
-            Method::POST,
-            "/v3/plugin-delegations/{id}/runs/page",
-            "/v3/plugin-delegations/test-delegation/runs/page",
-        ),
-        admin_route_sample(
-            Method::POST,
-            "/v3/plugin-delegations/{id}/runs/replay",
-            "/v3/plugin-delegations/test-delegation/runs/replay",
-        ),
-        admin_route_sample(
-            Method::POST,
-            "/v3/plugin-delegations/{id}/issue-attempt",
-            "/v3/plugin-delegations/test-delegation/issue-attempt",
-        ),
         route(Method::GET, HEALTH_PREFIX),
         route(Method::HEAD, HEALTH_PREFIX),
         route(Method::GET, HEALTH_READY_PATH),

rustfs/src/app/multipart_usecase.rs

@@ -17,7 +17,8 @@
 use super::storage_api::multipart_usecase::ECStore;
 use super::storage_api::multipart_usecase::access::{
     TableDataPlaneListAccess, apply_bucket_generation_guard, apply_copy_source_bucket_generation_guard,
-    has_bypass_governance_header, replication_request_authorized, retained_table_data_plane_publication_guards,
+    has_bypass_governance_header, replication_request_authorized, request_context_from_req,
+    retained_table_data_plane_publication_guards,
 };
 use super::storage_api::multipart_usecase::bucket::quota::checker::QuotaChecker;
 use super::storage_api::multipart_usecase::bucket::{
@@ -92,7 +93,7 @@ use crate::auth::{
     reject_presigned_put_max_content_length_for_other_operation,
 };
 use crate::capacity::record_capacity_write;
-use crate::error::ApiError;
+use crate::error::{ApiError, MultipartCreateBoundary, log_multipart_create_timeout};
 use crate::table_catalog;
 #[cfg(test)]
 use bytes::Bytes;
@@ -972,6 +973,24 @@ impl DefaultMultipartUsecase {
     pub async fn execute_create_multipart_upload(
         &self,
         req: S3Request<CreateMultipartUploadInput>,
+    ) -> S3Result<S3Response<CreateMultipartUploadOutput>> {
+        let result = self.execute_create_multipart_upload_inner(&req).await;
+        if let Err(error) = &result {
+            let context = request_context_from_req(&req);
+            log_multipart_create_timeout(
+                error,
+                MultipartCreateBoundary::Execute,
+                context.as_ref().map(|context| context.request_id.as_str()),
+                &req.input.bucket,
+                &req.input.key,
+            );
+        }
+        result
+    }
+
+    async fn execute_create_multipart_upload_inner(
+        &self,
+        req: &S3Request<CreateMultipartUploadInput>,
     ) -> S3Result<S3Response<CreateMultipartUploadOutput>> {
         let multipart_max_total_object_size = parse_presigned_multipart_max_total_object_size(
             &req.headers,
@@ -983,10 +1002,9 @@ impl DefaultMultipartUsecase {
             req.uri.query(),
             req.extensions.get::<VerifiedPresignedRequest>().is_some(),
         )?;
-        let helper =
-            OperationHelper::new(&req, EventName::ObjectCreatedCreateMultipartUpload, S3Operation::CreateMultipartUpload)
-                .suppress_event();
-        let replication_authorized = replication_request_authorized(&req);
+        let helper = OperationHelper::new(req, EventName::ObjectCreatedCreateMultipartUpload, S3Operation::CreateMultipartUpload)
+            .suppress_event();
+        let replication_authorized = replication_request_authorized(req);
         let CreateMultipartUploadInput {
             bucket,
             key,
@@ -1064,7 +1082,7 @@ impl DefaultMultipartUsecase {
 
         // The session data key is generated here, so this is where a multipart upload is held
         // to the KMS key it names. Parts and the completion reuse the resulting envelope.
-        let session_principal = SseKmsPrincipal::from_request(&req);
+        let session_principal = SseKmsPrincipal::from_request(req);
         let encryption_request = PrepareEncryptionRequest {
             bucket: &bucket,
             key: &key,
@@ -1139,7 +1157,7 @@ impl DefaultMultipartUsecase {
             put_opts_with_replication_authorization(&bucket, &key, version_id, &req.headers, metadata, replication_authorized)
                 .await
                 .map_err(ApiError::from)?;
-        apply_bucket_generation_guard(&req, &bucket, &mut opts)?;
+        apply_bucket_generation_guard(req, &bucket, &mut opts)?;
 
         let dsc =
             must_replicate_object(&bucket, &key, &mt2, "".to_string(), opts.delete_marker_replication_status(), opts.clone())
@@ -2684,6 +2702,71 @@ mod tests {
         assert_eq!(s3_op_total(S3Operation::AbortMultipartUpload), before + 1);
     }
 
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn create_multipart_observes_the_actual_object_lock_timeout() {
+        use crate::app::storage_api::multipart_usecase::request_context::RequestContext;
+        use crate::app::storage_api::test::contract::bucket::{BucketOperations as _, MakeBucketOptions};
+        use crate::app::storage_api::test::contract::namespace::NamespaceLocking as _;
+        use crate::error::multipart_timeout_test_log::Capture;
+        use tracing::instrument::WithSubscriber as _;
+
+        let store = crate::app::gating_test_env::shared_gating_ecstore().await;
+        let ambient = crate::app::gating_test_env::shared_gating_ambient().await;
+        let context = Arc::new(AppContext::new(Arc::clone(&store), ambient.iam(), ambient.kms()));
+        let bucket = format!("multipart-timeout-object-{}", Uuid::new_v4());
+        let key = "LEAK-private-key";
+        store
+            .make_bucket(&bucket, &MakeBucketOptions::default())
+            .await
+            .expect("create bucket");
+        let _guard = store
+            .new_ns_lock(&bucket, key)
+            .await
+            .expect("create namespace lock")
+            .get_write_lock(Duration::from_secs(5))
+            .await
+            .expect("hold object lock");
+        let input = CreateMultipartUploadInput::builder()
+            .bucket(bucket.clone())
+            .key(key.to_string())
+            .build()
+            .expect("multipart input");
+        let mut req = build_request(input, Method::POST);
+        let request_context = RequestContext::from_external_headers(&req.headers);
+        let request_id = request_context.request_id.clone();
+        req.extensions.insert(request_context);
+
+        let capture = Capture::default();
+        let subscriber = tracing_subscriber::fmt()
+            .json()
+            .flatten_event(true)
+            .with_current_span(true)
+            .with_span_list(false)
+            .with_max_level(tracing::Level::WARN)
+            .with_writer(capture.clone())
+            .finish();
+        let error = DefaultMultipartUsecase::with_context(Some(context))
+            .execute_create_multipart_upload(req)
+            .with_subscriber(subscriber)
+            .await
+            .expect_err("the held object lock must time out");
+        assert_eq!(error.code(), &S3ErrorCode::ServiceUnavailable);
+        assert_eq!(error.headers().unwrap()["x-rustfs-error-cause"], "namespace_lock_timeout");
+        let rows = capture
+            .rows()
+            .into_iter()
+            .filter(|row| row["event"] == "multipart_create_lock_timeout")
+            .collect::<Vec<_>>();
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0]["boundary"], "execute");
+        assert_eq!(rows[0]["request_id"], request_id);
+        assert_eq!(rows[0]["resource_class"], "request_object");
+        assert_eq!(rows[0]["timeout_source"], "direct");
+        assert!(!rows[0].to_string().contains(&bucket));
+        assert!(!rows[0].to_string().contains(key));
+    }
+
     #[tokio::test]
     async fn execute_create_multipart_upload_rejects_invalid_storage_class() {
         let input = CreateMultipartUploadInput::builder()

rustfs/src/app/storage_api.rs

@@ -298,8 +298,8 @@ pub(crate) mod access {
         authorize_request, bucket_config_mutation_incarnation, delete_object_authorize_action, has_bypass_governance_header,
         load_bucket_generation_from_store, log_list_buckets_iam_implicit_deny, odm_read_generation,
         prepare_list_buckets_iam_authorization, prepare_odm_read_generation, recursive_force_delete_has_authenticated_caller,
-        replication_request_authorized, req_info_mut, req_info_ref, retained_table_data_plane_publication_guards,
-        set_requested_object_lock_retain_until,
+        replication_request_authorized, req_info_mut, req_info_ref, request_context_from_req,
+        retained_table_data_plane_publication_guards, set_requested_object_lock_retain_until,
     };
 }
 

rustfs/src/error.rs

@@ -656,6 +656,99 @@ fn service_unavailable_cause(source: &(dyn std::error::Error + 'static)) -> Opti
     timeout.or(cause)
 }
 
+#[derive(Clone, Copy)]
+pub(crate) enum MultipartCreateBoundary {
+    Access,
+    Execute,
+}
+
+struct MultipartCreateTimeout {
+    resource_class: &'static str,
+    source_kind: &'static str,
+    timeout_ms: u64,
+}
+
+fn multipart_timeout_resource_class(resource: &str, bucket: &str, key: &str) -> &'static str {
+    if bucket.is_empty() {
+        return "unknown";
+    }
+
+    let request_resource = resource
+        .strip_suffix("@latest")
+        .and_then(|path| path.strip_prefix(bucket))
+        .and_then(|path| path.strip_prefix('/'));
+    let lifecycle = request_resource == Some("");
+    let transaction = resource
+        .strip_prefix(".rustfs.sys/bucket-targets/")
+        .and_then(|path| path.strip_suffix("/transaction.lock@latest"))
+        == Some(bucket);
+    let object = if key.is_empty() {
+        false
+    } else {
+        let encoded = rustfs_utils::path::encode_dir_object_ref(key);
+        let identity = rustfs_utils::path::object_name_disk_identity(encoded.as_ref());
+        request_resource == Some(identity.as_ref())
+    };
+
+    // A formatted key may be ambiguous; do not choose a class in that case.
+    match (lifecycle, transaction, object) {
+        (true, false, false) => "bucket_lifecycle",
+        (false, true, false) => "bucket_transaction",
+        (false, false, true) => "request_object",
+        _ => "unknown",
+    }
+}
+
+fn multipart_create_timeout_diagnostic(error: &S3Error, bucket: &str, key: &str) -> Option<MultipartCreateTimeout> {
+    if error.code() != &S3ErrorCode::ServiceUnavailable || error.status_code() != Some(StatusCode::SERVICE_UNAVAILABLE) {
+        return None;
+    }
+    let source = error.source()?;
+    let direct = matches!(source.downcast_ref::<StorageError>(), Some(StorageError::Lock(LockError::Timeout { .. })))
+        || matches!(source.downcast_ref::<LockError>(), Some(LockError::Timeout { .. }));
+    error_chain_find(source, |source| match source.downcast_ref::<LockError>() {
+        Some(LockError::Timeout { resource, timeout }) => Some(MultipartCreateTimeout {
+            resource_class: multipart_timeout_resource_class(resource, bucket, key),
+            source_kind: if direct { "direct" } else { "nested" },
+            timeout_ms: u64::try_from(timeout.as_millis()).unwrap_or(u64::MAX),
+        }),
+        _ => None,
+    })
+}
+
+pub(crate) fn log_multipart_create_timeout(
+    error: &S3Error,
+    boundary: MultipartCreateBoundary,
+    request_id: Option<&str>,
+    bucket: &str,
+    key: &str,
+) {
+    let Some(diagnostic) = multipart_create_timeout_diagnostic(error, bucket, key) else {
+        return;
+    };
+    let request_id = request_id
+        .filter(|value| uuid::Uuid::parse_str(value).is_ok())
+        .unwrap_or("unknown");
+    let boundary = match boundary {
+        MultipartCreateBoundary::Access => "access",
+        MultipartCreateBoundary::Execute => "execute",
+    };
+    tracing::error!(
+        target: rustfs_obs::MULTIPART_CREATE_TIMEOUT_LOG_TARGET,
+        parent: None,
+        event = "multipart_create_lock_timeout",
+        component = "storage",
+        subsystem = "object_lock",
+        state = "failed",
+        boundary,
+        request_id,
+        resource_class = diagnostic.resource_class,
+        timeout_source = diagnostic.source_kind,
+        timeout_budget_ms = diagnostic.timeout_ms,
+        "Multipart creation returned a lock timeout source"
+    );
+}
+
 impl From<ApiError> for S3Error {
     fn from(err: ApiError) -> Self {
         let status = custom_error_status(&err.code);
@@ -899,6 +992,51 @@ impl From<QuotaError> for ApiError {
     }
 }
 
+#[cfg(test)]
+pub(crate) mod multipart_timeout_test_log {
+    use std::{
+        io,
+        io::Write,
+        sync::{Arc, Mutex},
+    };
+    use tracing_subscriber::fmt::MakeWriter;
+
+    #[derive(Clone, Default)]
+    pub(crate) struct Capture(Arc<Mutex<Vec<u8>>>);
+
+    pub(crate) struct Writer(Arc<Mutex<Vec<u8>>>);
+
+    impl Write for Writer {
+        fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+            self.0.lock().expect("log capture").extend_from_slice(buf);
+            Ok(buf.len())
+        }
+
+        fn flush(&mut self) -> io::Result<()> {
+            Ok(())
+        }
+    }
+
+    impl<'a> MakeWriter<'a> for Capture {
+        type Writer = Writer;
+
+        fn make_writer(&'a self) -> Self::Writer {
+            Writer(self.0.clone())
+        }
+    }
+
+    impl Capture {
+        pub(crate) fn rows(&self) -> Vec<serde_json::Value> {
+            let data = self.0.lock().expect("log capture").clone();
+            String::from_utf8(data)
+                .expect("UTF-8 logs")
+                .lines()
+                .map(|line| serde_json::from_str(line).expect("JSON log"))
+                .collect()
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -910,6 +1048,133 @@ mod tests {
     use s3s::{S3Error, S3ErrorCode};
     use std::io::{Error as IoError, ErrorKind};
 
+    fn multipart_timeout_error(resource: &str) -> S3Error {
+        ApiError::from(StorageError::Lock(LockError::timeout(resource, std::time::Duration::from_secs(5)))).into()
+    }
+
+    #[test]
+    fn multipart_create_timeout_classifies_only_the_exact_known_resources() {
+        for (resource, key, expected) in [
+            ("bucket/@latest", "private-key", "bucket_lifecycle"),
+            ("bucket/private-key@latest", "private-key", "request_object"),
+            ("bucket/dir__XLDIR__@latest", "dir/", "request_object"),
+            (
+                ".rustfs.sys/bucket-targets/bucket/transaction.lock@latest",
+                "private-key",
+                "bucket_transaction",
+            ),
+            (".rustfs.sys/bucket-targets/other/transaction.lock@latest", "private-key", "unknown"),
+            ("bucket/private-key@older", "private-key", "unknown"),
+            ("bucket/other@latest", "private-key", "unknown"),
+        ] {
+            let error = multipart_timeout_error(resource);
+            let diagnostic = multipart_create_timeout_diagnostic(&error, "bucket", key).expect("typed timeout");
+            assert_eq!(diagnostic.resource_class, expected, "{resource}");
+            assert_eq!(diagnostic.source_kind, "direct");
+            assert_eq!(diagnostic.timeout_ms, 5_000);
+        }
+
+        let key = "a\\b";
+        let encoded = rustfs_utils::path::object_name_disk_identity(key);
+        let error = multipart_timeout_error(&format!("bucket/{encoded}@latest"));
+        assert_eq!(
+            multipart_create_timeout_diagnostic(&error, "bucket", key)
+                .unwrap()
+                .resource_class,
+            "request_object"
+        );
+
+        let error = multipart_timeout_error(".rustfs.sys/bucket-targets/bucket/transaction.lock@latest");
+        assert_eq!(
+            multipart_create_timeout_diagnostic(&error, ".rustfs.sys", "bucket-targets/bucket/transaction.lock")
+                .unwrap()
+                .resource_class,
+            "request_object"
+        );
+        let ambiguous = multipart_timeout_error(".rustfs.sys/bucket-targets/.rustfs.sys/transaction.lock@latest");
+        assert_eq!(
+            multipart_create_timeout_diagnostic(&ambiguous, ".rustfs.sys", "bucket-targets/.rustfs.sys/transaction.lock")
+                .unwrap()
+                .resource_class,
+            "unknown"
+        );
+    }
+
+    #[test]
+    fn multipart_create_timeout_keeps_nested_and_untrusted_sources_distinct() {
+        let nested = S3Error::from(ApiError {
+            code: S3ErrorCode::ServiceUnavailable,
+            message: "unavailable".into(),
+            source: Some(Box::new(IoError::other(LockError::Network {
+                message: "LEAK-network-detail".into(),
+                source: Box::new(LockError::timeout("bucket/private-key@latest", std::time::Duration::from_secs(5))),
+            }))),
+        });
+        let diagnostic = multipart_create_timeout_diagnostic(&nested, "bucket", "private-key").expect("nested timeout");
+        assert_eq!(diagnostic.resource_class, "request_object");
+        assert_eq!(diagnostic.source_kind, "nested");
+
+        let forged = S3Error::from(ApiError {
+            code: S3ErrorCode::ServiceUnavailable,
+            message: "unavailable".into(),
+            source: Some(Box::new(IoError::other(
+                "Lock acquisition timeout for resource 'bucket/private-key@latest'",
+            ))),
+        });
+        assert!(multipart_create_timeout_diagnostic(&forged, "bucket", "private-key").is_none());
+        let mut denied = multipart_timeout_error("bucket/private-key@latest");
+        denied.set_code(S3ErrorCode::AccessDenied);
+        assert!(multipart_create_timeout_diagnostic(&denied, "bucket", "private-key").is_none());
+    }
+
+    #[test]
+    fn multipart_create_timeout_event_is_visible_at_warn_and_does_not_expose_source() {
+        use crate::error::multipart_timeout_test_log::Capture;
+
+        let capture = Capture::default();
+        let subscriber = tracing_subscriber::fmt()
+            .json()
+            .flatten_event(true)
+            .with_current_span(false)
+            .with_span_list(false)
+            .with_max_level(tracing::Level::WARN)
+            .with_writer(capture.clone())
+            .finish();
+        let error = multipart_timeout_error("private-bucket/LEAK-private-key@latest");
+        let request_id = "b8172a15-a428-4b42-9cef-1f4a7b96874e";
+        tracing::subscriber::with_default(subscriber, || {
+            log_multipart_create_timeout(
+                &error,
+                MultipartCreateBoundary::Execute,
+                Some(request_id),
+                "private-bucket",
+                "LEAK-private-key",
+            );
+            log_multipart_create_timeout(
+                &error,
+                MultipartCreateBoundary::Access,
+                Some("LEAK-invalid-request-id"),
+                "private-bucket",
+                "LEAK-private-key",
+            );
+        });
+        let rows = capture.rows();
+        assert_eq!(rows.len(), 2);
+        assert_eq!(rows[0]["event"], "multipart_create_lock_timeout");
+        assert_eq!(rows[0]["boundary"], "execute");
+        assert_eq!(rows[0]["request_id"], request_id);
+        assert_eq!(rows[0]["resource_class"], "request_object");
+        assert_eq!(rows[0]["timeout_budget_ms"], 5_000);
+        let output = rows[0].to_string();
+        assert!(!output.contains("private-bucket"));
+        assert!(!output.contains("LEAK-private-key"));
+        assert!(!output.contains("LEAK-parent-span"));
+        assert_eq!(rows[1]["request_id"], "unknown");
+        assert!(!rows[1].to_string().contains("LEAK-invalid-request-id"));
+        assert_eq!(error.headers().unwrap()["x-rustfs-error-cause"], "namespace_lock_timeout");
+        assert_eq!(error.headers().unwrap()[http::header::RETRY_AFTER], "1");
+    }
+
     fn error_chain_has_type<T>(err: &(dyn std::error::Error + 'static)) -> bool
     where
         T: std::error::Error + 'static,

rustfs/src/startup_background.rs

@@ -81,14 +81,6 @@ pub(crate) async fn init_background_service_runtime(store: Arc<ECStore>) -> Resu
         let admission = None;
         let heal_storage = Arc::new(ECStoreHealStorage::new(store.clone()).with_admission(admission.clone()));
         init_heal_manager_with_workload_provider(heal_storage, None, Some(workload_provider.clone())).await?;
-        if let Some(admission) = &admission
-            && !rustfs_scanner::set_scanner_node_admission(admission.clone())
-        {
-            return Err(std::io::Error::new(
-                std::io::ErrorKind::AlreadyExists,
-                "scanner node admission is already initialized",
-            ));
-        }
         #[cfg(any(target_os = "linux", all(test, unix)))]
         if let Some(admission) = admission {
             crate::background_admission::start(admission, background_cancel.clone(), workload_provider);

rustfs/src/storage/access.rs

@@ -22,7 +22,7 @@ use crate::auth::{
     get_request_auth_type_with_query, get_session_token, parse_presigned_multipart_max_total_object_size,
     parse_presigned_put_max_content_length, reject_unsigned_amz_headers_on_sigv4_request,
 };
-use crate::error::{ApiError, normalize_read_quorum_error};
+use crate::error::{ApiError, MultipartCreateBoundary, log_multipart_create_timeout, normalize_read_quorum_error};
 use crate::license::license_check;
 use crate::shared_types::RemoteAddr;
 use crate::storage::request_context::RequestContext;
@@ -64,13 +64,6 @@ use std::sync::OnceLock;
 use time::OffsetDateTime;
 use url::{Url, form_urlencoded};
 
-fn iam_authorization_error(err: IamError) -> ApiError {
-    match err {
-        IamError::IAMActionNotAllowed => ApiError::access_denied(),
-        other => ApiError::from(other),
-    }
-}
-
 const EVENT_OBJECT_TAG_AUTHORIZATION: &str = "object_tag_authorization";
 const LOG_COMPONENT_ACCESS: &str = "storage_access";
 const LOG_SUBSYSTEM_AUTHORIZATION: &str = "authorization";
@@ -469,6 +462,7 @@ static OBJECT_GENERATION_TEST_HOOK: OnceLock<std::sync::Mutex<Option<ObjectGener
 #[cfg(test)]
 tokio::task_local! {
     static PUT_GENERATION_READ_QUORUM_FAILURE: ();
+    static CREATE_MULTIPART_GENERATION_LOCK_TIMEOUT: ();
 }
 
 #[cfg(test)]
@@ -1490,7 +1484,7 @@ async fn authorize_request_with_location_constraint<T>(
             let allowed = iam_store
                 .try_eval_prepared(&prepared, &final_args)
                 .await
-                .map_err(iam_authorization_error)?;
+                .map_err(ApiError::from)?;
             if !allowed
                 && matches!(
                     action,
@@ -1512,7 +1506,7 @@ async fn authorize_request_with_location_constraint<T>(
                 if !iam_store
                     .try_eval_prepared(&prepared, &final_args)
                     .await
-                    .map_err(iam_authorization_error)?
+                    .map_err(ApiError::from)?
                 {
                     return Err(denial.deny("iam_explicit_deny", action));
                 }
@@ -2436,28 +2430,52 @@ impl S3Access for FS {
 
     /// Checks whether the CreateMultipartUpload request has accesses to the resources.
     async fn create_multipart_upload(&self, req: &mut S3Request<CreateMultipartUploadInput>) -> S3Result<()> {
-        let bucket = req.input.bucket.clone();
-        let bucket_generation = load_bucket_generation(self, req, &bucket).await;
-        let req_info = ext_req_info_mut(&mut req.extensions)?;
-        req_info.bucket = Some(req.input.bucket.clone());
-        req_info.object = Some(req.input.key.clone());
+        let result = async {
+            let bucket = req.input.bucket.clone();
+            let bucket_generation = load_bucket_generation(self, req, &bucket).await;
+            #[cfg(test)]
+            let bucket_generation = if CREATE_MULTIPART_GENERATION_LOCK_TIMEOUT.try_with(|_| ()).is_ok() {
+                Err(ApiError::from(StorageError::Lock(rustfs_lock::LockError::timeout(
+                    format!(".rustfs.sys/bucket-targets/{bucket}/transaction.lock@latest"),
+                    std::time::Duration::from_secs(5),
+                )))
+                .into())
+            } else {
+                bucket_generation
+            };
+            let req_info = ext_req_info_mut(&mut req.extensions)?;
+            req_info.bucket = Some(req.input.bucket.clone());
+            req_info.object = Some(req.input.key.clone());
 
-        let requested_retain_until = req.input.object_lock_retain_until_date.clone();
-        set_requested_object_lock_retain_until(req, requested_retain_until.as_ref());
-        authorize_request(req, Action::S3Action(S3Action::PutObjectAction)).await?;
+            let requested_retain_until = req.input.object_lock_retain_until_date.clone();
+            set_requested_object_lock_retain_until(req, requested_retain_until.as_ref());
+            authorize_request(req, Action::S3Action(S3Action::PutObjectAction)).await?;
 
-        authorize_replication_only_put_headers(req).await?;
+            authorize_replication_only_put_headers(req).await?;
 
-        if legal_hold_write_requested(req.input.object_lock_legal_hold_status.as_ref()) {
-            authorize_request(req, Action::S3Action(S3Action::PutObjectLegalHoldAction)).await?;
+            if legal_hold_write_requested(req.input.object_lock_legal_hold_status.as_ref()) {
+                authorize_request(req, Action::S3Action(S3Action::PutObjectLegalHoldAction)).await?;
+            }
+
+            if retention_write_requested(req.input.object_lock_mode.as_ref(), req.input.object_lock_retain_until_date.as_ref()) {
+                authorize_request(req, Action::S3Action(S3Action::PutObjectRetentionAction)).await?;
+            }
+
+            req.extensions.insert(bucket_generation?);
+            Ok(())
         }
-
-        if retention_write_requested(req.input.object_lock_mode.as_ref(), req.input.object_lock_retain_until_date.as_ref()) {
-            authorize_request(req, Action::S3Action(S3Action::PutObjectRetentionAction)).await?;
+        .await;
+        if let Err(error) = &result {
+            let context = request_context_from_req(req);
+            log_multipart_create_timeout(
+                error,
+                MultipartCreateBoundary::Access,
+                context.as_ref().map(|context| context.request_id.as_str()),
+                &req.input.bucket,
+                &req.input.key,
+            );
         }
-
-        req.extensions.insert(bucket_generation?);
-        Ok(())
+        result
     }
 
     /// Checks whether the DeleteBucket request has accesses to the resources.
@@ -3625,14 +3643,6 @@ mod tests {
     use std::{collections::HashMap, sync::Arc};
     use time::OffsetDateTime;
 
-    #[test]
-    fn terminal_iam_denial_is_access_denied_and_backend_failure_stays_internal() {
-        let denied = s3s::S3Error::from(super::iam_authorization_error(rustfs_iam::error::Error::IAMActionNotAllowed));
-        assert_eq!(denied.code(), &S3ErrorCode::AccessDenied);
-        let unavailable = s3s::S3Error::from(super::iam_authorization_error(rustfs_iam::error::Error::IamSysNotInitialized));
-        assert_eq!(unavailable.code(), &S3ErrorCode::InternalError);
-    }
-
     struct UnreadyIam;
 
     impl IamInterface for UnreadyIam {
@@ -5553,6 +5563,85 @@ mod tests {
         });
     }
 
+    #[tokio::test]
+    #[serial]
+    async fn multipart_timeout_observes_only_the_authorized_final_error() {
+        use crate::error::multipart_timeout_test_log::Capture;
+        use crate::storage::request_context::RequestContext;
+        use tracing::instrument::WithSubscriber as _;
+
+        let store = crate::app::gating_test_env::shared_gating_ecstore().await;
+        let server_ctx = ServerContextSlot::new();
+        assert!(server_ctx.install(Arc::new(AppContext::new(Arc::clone(&store), Arc::new(UnreadyIam), Arc::new(TestKms)))));
+        let fs = FS::with_server_ctx(server_ctx);
+
+        for effect in ["Allow", "Deny"] {
+            let bucket = format!("multipart-timeout-access-{}", uuid::Uuid::new_v4());
+            store
+                .make_bucket(&bucket, &MakeBucketOptions::default())
+                .await
+                .expect("create bucket");
+            let policy_json = format!(
+                r#"{{"Version":"2012-10-17","Statement":[{{"Effect":"{effect}","Principal":{{"AWS":"*"}},"Action":["s3:PutObject"],"Resource":["arn:aws:s3:::{bucket}/*"]}}]}}"#
+            );
+            let mut metadata = (*crate::storage::get_bucket_metadata(&bucket).await.expect("cached metadata")).clone();
+            metadata.policy_config = Some(serde_json::from_str(&policy_json).expect("policy"));
+            metadata.policy_config_json = policy_json.into_bytes();
+            crate::storage::storage_api::set_bucket_metadata(bucket.clone(), metadata)
+                .await
+                .expect("install policy");
+
+            let input = CreateMultipartUploadInput::builder()
+                .bucket(bucket.clone())
+                .key("LEAK-private-key".to_string())
+                .build()
+                .expect("multipart input");
+            let mut req = build_request(input, Method::POST);
+            ensure_req_info(&mut req);
+            req.extensions.insert(fs.server_ctx().clone());
+            let context = RequestContext::from_external_headers(&req.headers);
+            let request_id = context.request_id.clone();
+            req.extensions.insert(context);
+
+            let capture = Capture::default();
+            let subscriber = tracing_subscriber::fmt()
+                .json()
+                .flatten_event(true)
+                .with_current_span(true)
+                .with_span_list(false)
+                .with_max_level(tracing::Level::WARN)
+                .with_writer(capture.clone())
+                .finish();
+            let error = super::CREATE_MULTIPART_GENERATION_LOCK_TIMEOUT
+                .scope((), fs.create_multipart_upload(&mut req))
+                .with_subscriber(subscriber)
+                .await
+                .expect_err("generation timeout must not admit creation");
+            let rows = capture
+                .rows()
+                .into_iter()
+                .filter(|row| row["event"] == "multipart_create_lock_timeout")
+                .collect::<Vec<_>>();
+            if effect == "Allow" {
+                assert_eq!(error.code(), &S3ErrorCode::ServiceUnavailable);
+                assert_eq!(error.headers().unwrap()["x-rustfs-error-cause"], "namespace_lock_timeout");
+                assert_eq!(error.headers().unwrap()[http::header::RETRY_AFTER], "1");
+                assert_eq!(rows.len(), 1);
+                assert_eq!(rows[0]["boundary"], "access");
+                assert_eq!(rows[0]["request_id"], request_id);
+                assert_eq!(rows[0]["resource_class"], "bucket_transaction");
+                let output = rows[0].to_string();
+                assert!(!output.contains(&bucket));
+                assert!(!output.contains("LEAK-private-key"));
+            } else {
+                assert_eq!(error.code(), &S3ErrorCode::AccessDenied);
+                assert_eq!(error.status_code(), Some(http::StatusCode::FORBIDDEN));
+                assert!(rows.is_empty(), "a hidden generation error must not be logged");
+            }
+            assert!(req.extensions.get::<BucketGenerationGuard>().is_none());
+        }
+    }
+
     #[tokio::test]
     #[serial]
     async fn put_read_quorum_access_keeps_authorization_precedence() {

rustfs/src/storage/scanner_dirty_journal.rs

@@ -384,10 +384,6 @@ fn decode_owned_replay_record(owner: &str, bytes: &[u8]) -> Option<(JournalState
 
 fn encode_owned_replay_record(owner: &str, state: &JournalState) -> Result<Vec<u8>, serde_json::Error> {
     let mut entries = state.replay_entries();
-    let mut prefix = Vec::with_capacity(owner.len() + 32);
-    prefix.extend_from_slice(b"{\"owner\":");
-    serde_json::to_writer(&mut prefix, owner)?;
-    prefix.extend_from_slice(b",\"replay\":");
     for compact in [false, true] {
         if let Some(entries) = &mut entries {
             if compact {
@@ -395,12 +391,13 @@ fn encode_owned_replay_record(owner: &str, state: &JournalState) -> Result<Vec<u
                     entry.scope = ScannerDurableDirtyUsageReplayScope::WholeBucket;
                 }
             }
-            if let Ok(replay) = rustfs_scanner::encode_durable_dirty_usage_producer_replay_record(entries.clone()) {
-                // This producer already validated and serialized the complete frame.
-                let mut bytes = prefix.clone();
-                bytes.reserve(replay.len() + 1);
-                bytes.extend_from_slice(&replay);
-                bytes.push(b'}');
+            if let Ok(replay) = rustfs_scanner::encode_durable_dirty_usage_producer_replay_record(entries.clone())
+                && let Ok(replay) = serde_json::from_slice(&replay)
+            {
+                let bytes = serde_json::to_vec(&OwnedReplayRecord {
+                    owner: owner.to_string(),
+                    replay: Some(replay),
+                })?;
                 if bytes.len() <= DURABLE_DIRTY_USAGE_REPLAY_MAX_BYTES {
                     return Ok(bytes);
                 }
@@ -408,8 +405,10 @@ fn encode_owned_replay_record(owner: &str, state: &JournalState) -> Result<Vec<u
         }
     }
     // Never label a truncated record as complete producer coverage.
-    prefix.extend_from_slice(b"null}");
-    Ok(prefix)
+    serde_json::to_vec(&OwnedReplayRecord {
+        owner: owner.to_string(),
+        replay: None,
+    })
 }
 
 async fn run_durable_dirty_usage_journal(store: Arc<ECStore>, owner: String, shared: Weak<SharedJournal>, changed: Arc<Notify>) {
@@ -576,63 +575,6 @@ mod tests {
         ENV.get_or_init(|| rustfs_test_utils::TestECStoreEnv::builder().build()).await
     }
 
-    fn legacy_owned_encoding(owner: &str, state: &JournalState) -> Vec<u8> {
-        let mut entries = state.replay_entries();
-        for compact in [false, true] {
-            if let Some(entries) = &mut entries {
-                if compact {
-                    for entry in entries.iter_mut() {
-                        entry.scope = ScannerDurableDirtyUsageReplayScope::WholeBucket;
-                    }
-                }
-                if let Ok(replay) = rustfs_scanner::encode_durable_dirty_usage_producer_replay_record(entries.clone())
-                    && let Ok(replay) = serde_json::from_slice(&replay)
-                {
-                    let bytes = serde_json::to_vec(&OwnedReplayRecord {
-                        owner: owner.to_string(),
-                        replay: Some(replay),
-                    })
-                    .expect("legacy typed wrapper");
-                    if bytes.len() <= DURABLE_DIRTY_USAGE_REPLAY_MAX_BYTES {
-                        return bytes;
-                    }
-                }
-            }
-        }
-        serde_json::to_vec(&OwnedReplayRecord {
-            owner: owner.to_string(),
-            replay: None,
-        })
-        .expect("legacy unknown marker")
-    }
-
-    #[test]
-    fn owned_encoding_reuses_the_producer_frame_without_changing_wire_bytes() {
-        let mut scoped = JournalState::default();
-        for producer in SegmentInvalidationProducerIdentity::REQUIRED_PRODUCTION {
-            scoped.record_mutation("bucket-a".to_string(), "quote\"雪/object", 17, producer);
-        }
-        scoped.record_mutation("bucket-b".to_string(), "object", 9, SegmentInvalidationProducerIdentity::PutObject);
-        let unknown = JournalState {
-            invalidated: true,
-            ..Default::default()
-        };
-        for owner in ["owner", "quote\"slash\\newline\n", "所有者", "\0"] {
-            for state in [&scoped, &unknown, &JournalState::default()] {
-                let expected = legacy_owned_encoding(owner, state);
-                let actual = encode_owned_replay_record(owner, state).expect("complete owned encoding");
-                assert_eq!(actual, expected, "legacy bytes for owner {owner:?}");
-            }
-        }
-    }
-
-    #[test]
-    fn owned_unknown_marker_keeps_the_pinned_legacy_wire_fixture() {
-        let bytes = encode_owned_replay_record("owner", &JournalState::default()).expect("unknown marker");
-        assert_eq!(bytes, br#"{"owner":"owner","replay":null}"#);
-        assert!(decode_owned_replay_record("owner", &bytes).is_none());
-    }
-
     #[test]
     fn journal_owner_is_stable_and_never_defaults_to_a_shared_identity() {
         assert!(durable_dirty_usage_owner("").is_none());
@@ -712,7 +654,6 @@ mod tests {
         }
         assert!(state.scope_bytes <= DURABLE_DIRTY_USAGE_REPLAY_MAX_BYTES);
         let bytes = encode_owned_replay_record(&owner, &state).expect("bounded record");
-        assert_eq!(bytes, legacy_owned_encoding(&owner, &state), "legacy compacted bytes");
         assert!(bytes.len() <= DURABLE_DIRTY_USAGE_REPLAY_MAX_BYTES);
         let (decoded, _) = decode_owned_replay_record(&owner, &bytes).expect("compacted replay");
         assert_eq!(decoded.buckets.len(), 3);
@@ -732,7 +673,6 @@ mod tests {
         assert!(!state.invalidated);
         assert_eq!(state.buckets.len(), 1024);
         let bytes = encode_owned_replay_record(&owner, &state).expect("unverified marker");
-        assert_eq!(bytes, legacy_owned_encoding(&owner, &state), "legacy unknown marker bytes");
         assert!(bytes.len() <= DURABLE_DIRTY_USAGE_REPLAY_MAX_BYTES);
         let record: OwnedReplayRecord = serde_json::from_slice(&bytes).expect("marker");
         assert!(record.replay.is_none());

rustfs/src/storage/storage_api.rs

@@ -142,8 +142,8 @@ pub(crate) mod access_consumer {
         authorize_request, bucket_config_mutation_incarnation, delete_object_authorize_action, has_bypass_governance_header,
         load_bucket_generation_from_store, log_list_buckets_iam_implicit_deny, odm_read_generation,
         prepare_list_buckets_iam_authorization, prepare_odm_read_generation, recursive_force_delete_has_authenticated_caller,
-        replication_request_authorized, req_info_mut, req_info_ref, retained_table_data_plane_publication_guards,
-        set_requested_object_lock_retain_until,
+        replication_request_authorized, req_info_mut, req_info_ref, request_context_from_req,
+        retained_table_data_plane_publication_guards, set_requested_object_lock_retain_until,
     };
 }
 

scripts/check_embedded_secrets.sh

@@ -3,8 +3,9 @@ set -euo pipefail
 
 # Guard: no private key material and no long-lived provider credential may
 # exist as a literal anywhere in the repository — see AGENTS.md "Security
-# Baseline" ("Never commit secrets, credentials, or key material"). This includes
-# shared tokens, HMAC secrets, private keys, and production test keys.
+# Baseline" ("Never commit secrets, credentials, or key material") and
+# .agents/skills/security-advisory-lessons ("Do not ship hard-coded shared
+# tokens, HMAC secrets, private keys, or production test keys").
 #
 # This replaces the unit test `test_source_does_not_embed_private_key` that
 # used to live in crates/crypto/src/license_token.rs (rustfs/backlog#1884).

scripts/error-other-format-baseline.txt

@@ -45,9 +45,9 @@
 3|crates/ecstore/src/runtime/sources.rs
 4|crates/ecstore/src/services/batch_processor.rs
 12|crates/ecstore/src/services/notification_sys.rs
-15|crates/ecstore/src/services/rebalance/control.rs
+16|crates/ecstore/src/services/rebalance/control.rs
 1|crates/ecstore/src/services/rebalance/entry.rs
-6|crates/ecstore/src/services/rebalance/meta.rs
+8|crates/ecstore/src/services/rebalance/meta.rs
 8|crates/ecstore/src/services/rebalance/runtime.rs
 17|crates/ecstore/src/services/rebalance/worker.rs
 33|crates/ecstore/src/services/tier/tier.rs

scripts/scanner_process_receipt.py

@@ -18,7 +18,6 @@ SAFE_ENVIRONMENT = frozenset({
     "RUSTFS_STORAGE_CLASS_STANDARD", "RUSTFS_DURABILITY_MODE", "RUSTFS_NEW_BUCKET_DURABILITY_MODE",
     "RUSTFS_SCANNER_ENABLED", "RUSTFS_HEAL_ENABLED", "RUSTFS_SCANNER_SPEED", "RUSTFS_SCANNER_IDLE_MODE",
     "RUSTFS_SCANNER_START_DELAY_SECS", "RUSTFS_SCANNER_CYCLE",
-    "RUSTFS_HEAL_ADAPTIVE_ADMISSION",
     "RUSTFS_OBJECT_LOCK_DIAG_ENABLE", "RUSTFS_OBS_LOGS_EXPORT_ENABLED", "RUSTFS_OBS_TRACES_EXPORT_ENABLED",
     "RUSTFS_OBS_METRICS_EXPORT_ENABLED", "RUST_LOG", "NO_PROXY", "no_proxy",
 })

scripts/test_scanner_process_receipt.py

@@ -108,21 +108,6 @@ class ProcessReceiptTest(unittest.TestCase):
         with self.assertRaisesRegex(ValueError, "not active"):
             self.attest()
 
-    def test_adaptive_admission_is_bound_to_actual_process_environment(self):
-        key = "RUSTFS_HEAL_ADAPTIVE_ADMISSION"
-        self.public[key] = "true"
-        raw = self.environment + b"RUSTFS_HEAL_ADAPTIVE_ADMISSION=true\0"
-        (self.pid / "environ").write_bytes(raw)
-        result = self.attest()
-        self.assertEqual(result["environment_sha256"], receipt.fingerprint(self.public))
-        self.assertIn(key, result["environment_keys"])
-        for observed in (self.environment, raw.replace(b"ADMISSION=true", b"ADMISSION=false"),
-                         raw + b"RUSTFS_HEAL_ADAPTIVE_ADMISSION=true\0"):
-            with self.subTest(raw_hash=hashlib.sha256(observed).hexdigest()), self.assertRaises(ValueError):
-                receipt.environment_digest(observed, self.public)
-        with self.assertRaisesRegex(ValueError, "mismatch"):
-            receipt.environment_digest(raw, {**self.public, key: "false"})
-
     def test_wrong_binary_content_is_rejected(self):
         self.binary.write_bytes(b"replaced executable")
         with self.assertRaisesRegex(ValueError, "binary digest"):