refactor(e2e/kms): replace fixed startup sleeps with KMS readiness probe

Replace 33 hard-coded sleep(3s) / sleep(2s) startup waits in KMS e2e tests with an active readiness probe (wait_for_kms_ready) that polls the KMS status endpoint with exponential backoff (200ms→1s, 5s budget). This cuts per-test startup latency from a fixed 3s to ~200-500ms while remaining robust against slow CI machines. Non-startup sleeps (ILM polling loops, fault-recovery detection delays, test-runner inter-test pauses) are left untouched.
ci: harden test selection and nightly coverage (#6341 )
2026-08-21 20:06:37 +00:00 · 2026-08-22 01:14:47 +08:00 · 2026-08-21 15:04:08 +00:00 · 2026-08-21 13:16:18 +00:00 · 2026-08-21 17:32:59 +08:00 · 2026-08-21 17:32:12 +08:00
329 changed files with 62548 additions and 37031 deletions
@@ -0,0 +1,2 @@
+sha256-darwin=b4ae71aa894e5c7795ae3eb8116f1777a7601d0f5db3898be2e48faf3329bd9b
+sha256-linux=433debd9d9defa832986269abdf0f1d131597b2d7a417ce930e17c1fd47d85ba
@@ -0,0 +1 @@
+sha256=9b9bc336b43b70d0e06e0adb5455bf035bb18945d85d60936eb6fe4d48e0e680
@@ -0,0 +1,2 @@
+sha256-darwin=55534a97fbd376f64c8f6c341d319017d11ff77cad6da8629a1a7f6a874e0315
+sha256-linux=c06fb8c19aed6f388b9dc61cb8251b7a44f8561a9bf764ad2b9e635598f8dc17
@@ -0,0 +1 @@
+sha256=655a3f3c1d042e694339d15caba7580518320322d1bac0f09450b37e6c09e2e7
@@ -0,0 +1 @@
+sha256=ec27cde6ce6400723c4b372bfbd2ac61709c744294e4810af765e8a808d8e31d
@@ -75,6 +75,11 @@ embedded-secrets-check: ## Check no private key material or credential literal i
 	@echo "🔑 Checking embedded secret material guard..."
 	./scripts/check_embedded_secrets.sh

+.PHONY: test-wiring-check
+test-wiring-check: ## Check tests stay registered and selected by their intended runners
+	@echo "🧪 Checking test wiring..."
+	python3 ./scripts/check_test_wiring.py
+
 .PHONY: log-analyzer-rules-check
 log-analyzer-rules-check: core-deps ## Check log-analyzer rule anchors still exist verbatim in source
 	@echo "🩺 Checking log-analyzer rule anchors..."
@@ -19,13 +19,13 @@ planning-docs-check: ## Check that no planning-type documents are committed
 	./scripts/check_no_planning_docs.sh

 .PHONY: pre-commit
-pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
+pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
 	@echo "✅ All pre-commit checks passed!"

 .PHONY: pre-pr
-pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests
+pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests
 	@echo "✅ All pre-PR checks passed!"

 .PHONY: dev-check
-dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks
+dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks
 	@echo "✅ Fast development checks passed!"
@@ -35,6 +35,8 @@ script-tests: ## Run shell script tests
 	./scripts/test_pinned_paired_abba_bench.sh
 	./scripts/test_manual_transition_runbooks.sh
 	./scripts/check_embedded_secrets.sh --self-test
+	python3 ./scripts/check_test_wiring.py --self-test
+	python3 ./scripts/s3-tests/test_report_compat.py
 	bash -n ./scripts/validate_object_data_cache_cold_stampede.sh
 	python3 ./scripts/check_object_data_cache_follower_samples.py --self-test
 	./scripts/validate_object_data_cache_cold_stampede.sh --self-test
@@ -38,10 +38,11 @@ e2e-vault = { max-threads = 1 }
 # replacement_privileged_e2e_test when explicitly run as root on Linux). They
 # are correct in isolation but resource-heavy; serialize them under nextest's
 # process boundary (serial_test's #[serial] does not cross it) so several 4-disk
-# servers never run at once. ci-7's nightly picks these up via the e2e suite;
+# servers never run at once. The e2e-full merge/main lane picks these up;
 # they are deliberately NOT in the fast PR `e2e-smoke` filter.
 e2e-reliability = { max-threads = 1 }
 e2e-inline-boundaries = { max-threads = 1 }
+e2e-cluster-nightly = { max-threads = 1 }

 # --- default profile (local): serialize the flaky groups, never retry --------
 [[profile.default.overrides]]
@@ -161,7 +162,7 @@ retries = 2
 # Serialize the 4-disk reliability / degraded-read e2e tests under the ci
 # profile too (see the e2e-reliability test-group note near the top). Not a
 # quarantine: no retries, just single-threaded so several 4-disk servers never
-# run concurrently when ci-7's nightly runs the full e2e suite.
+# run concurrently when e2e-full runs the suite.
 [[profile.ci.overrides]]
 filter = 'package(e2e_test) & test(/^(reliability_disk_fault|degraded_read_eof_regression|replacement_privileged_e2e)_test::/)'
 test-group = 'e2e-reliability'
@@ -230,8 +231,8 @@ test-group = 'ecstore-serial-flaky'
 # the nightly profile derives its set as "the replication module MINUS this
 # allowlist", so any new replication test lands in nightly by default (never
 # silently unrun) until it is explicitly blessed as fast here. Keep the two
-# regexes byte-identical. Count invariant: 20 here + 49 nightly = 69 total
-# (authority: `cargo nextest list`; docs/testing/e2e-suite-inventory.md).
+# regexes byte-identical. The committed profile selection digests make changes
+# visible in CI; current counts live in docs/testing/e2e-suite-inventory.md.
 # HISTORY (2026-07-11): the 20 fast tests were briefly pulled out of this lane
 # (#4724) because they set a loopback (127.0.0.1) replication target that the
 # SSRF egress guard rejected on every PR after repl-1 (#4712). That is fixed —
@@ -327,9 +328,8 @@ slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
 # the STS dual-node test actually exercises its path (it skips gracefully with
 # a visible log line when awscurl is absent), and routes scheduled failures
 # through .github/actions/schedule-failure-issue (ci-8). Explicit division of
-# labor with ci-5's future e2e-full merge gate: these tests run ONLY here, not
-# double-run there. TODO(ci-7): fold this interim repl-owned lane into the ci
-# domain's consolidated scheduled e2e workflow once it exists.
+# labor with e2e-full: these tests run only in the consolidated nightly
+# workflow, not in the merge/main lane.
 [profile.e2e-repl-nightly]
 default-filter = """
    package(e2e_test)
@@ -343,26 +343,60 @@ fail-fast = false
 # workflow as the failure-triage artifact.
 path = "junit.xml"

+# ---------------------------------------------------------------------------
+# e2e-nightly profile — destructive multi-process cluster fault domains
+# ---------------------------------------------------------------------------
+# These seven modules are deliberately outside e2e-full's merge budget. Each
+# starts a real multi-process or multi-disk topology and exercises node/disk
+# loss, quorum, cleanup, notification fan-in, or admin-timeout behavior. The
+# consolidated nightly workflow runs them serially to avoid resource
+# starvation; failures are never retried.
+[profile.e2e-nightly]
+default-filter = """
+    package(e2e_test)
+    & test(/^(admin_timeout_regression_test|cluster_concurrency_test|cluster_multidrive_pool_test|heal_erasure_disk_rebuild_test|namespace_lock_quorum_test|object_lambda_test|stale_multipart_cleanup_cluster_test)::/)
+"""
+fail-fast = false
+
+[profile.e2e-nightly.junit]
+path = "junit.xml"
+
+[[profile.e2e-nightly.overrides]]
+filter = 'package(e2e_test)'
+test-group = 'e2e-cluster-nightly'
+
+# ---------------------------------------------------------------------------
+# e2e-protocols profile — serial protocol lane
+# ---------------------------------------------------------------------------
+# The suite owns fixed ports, so the nightly workflow runs this exact profile
+# with one nextest worker.
+[profile.e2e-protocols]
+default-filter = 'package(e2e_test) & test(/^protocols::/)'
+fail-fast = false
+
+[profile.e2e-protocols.junit]
+path = "junit.xml"
+
 # ---------------------------------------------------------------------------
 # e2e-full profile — merge-gate full single-node e2e lane (backlog#1149 ci-5)
 # ---------------------------------------------------------------------------
 # The merge gate (ci.yml `e2e-full` job: push main + merge_group +
-# workflow_dispatch). Runs the never-automated user-visible suites — KMS (40),
-# object_lock (33), multipart_auth (109), quota, checksum, encryption,
+# workflow_dispatch). Runs the user-visible KMS, object-lock, multipart-auth,
+# quota, checksum, encryption,
 # security-boundary, ... — that the fast PR `e2e-smoke` subset deliberately
 # skips. Budget <= 45 min; authority for the suite count is `cargo nextest list
 # --profile e2e-full` (see docs/testing/e2e-suite-inventory.md).
 #
 # The filter is "the whole e2e_test crate MINUS the sets owned by other lanes":
-#   * protocols:: — FTPS/SFTP/WebDAV, still pinned to --test-threads=1 by fixed
-#     ports; they join a scheduled lane once ci-6 randomises the ports (ci-7).
+#   * protocols:: — FTPS/SFTP/WebDAV, run from the dedicated protocol profile
+#     with one worker because the suite owns fixed ports.
 #   * the 7 cluster suites that spin up a RustFSTestClusterEnvironment
 #     (cluster_concurrency, cluster_multidrive_pool, stale_multipart_cleanup_cluster,
 #     namespace_lock_quorum, heal_erasure_disk_rebuild, admin_timeout_regression,
-#     object_lambda) — too heavy for the merge budget; they run in ci-7's
-#     nightly 4-node lane.
+#     object_lambda) — too heavy for the merge budget; they run in the
+#     e2e-nightly serial cluster-fault lane.
 #   * replication_extension_test — repl-1 already splits it into the PR
-#     `e2e-smoke` (20 fast) and `e2e-repl-nightly` (49 slow) lanes and reserves
+#     `e2e-smoke` (20 fast) and `e2e-repl-nightly` (55 slow) lanes and reserves
 #     it for those, so e2e-full does not double-run it.
 #   * #[ignore]d tests — nextest skips them by default (no --run-ignored); the
 #     manual-localhost:9000 reliant/policy tests are ci-13's migration.
@@ -46,10 +46,9 @@ lists when upstream changes.
  the PR.
 - **Weekly + manual**: `.github/workflows/e2e-s3tests.yml` runs the full
  upstream suite (`TEST_SCOPE=all`) against a Docker deployment (single node
-  or a 4-node distributed cluster behind HAProxy). It fails only on
-  regressions in the implemented whitelist and publishes a classification
-  report (`compat-report.md`, also shown in the job summary) listing promotion
-  candidates and unclassified tests.
+  or a 4-node distributed cluster behind HAProxy). The canonical gate policy
+  and compatibility-report behavior are documented in
+  [`scripts/s3-tests/README.md`](../../scripts/s3-tests/README.md).

 ## Running Tests Locally

@@ -53,9 +53,9 @@ jobs:
          persist-credentials: false

      - name: Install ripgrep
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y ripgrep
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
+        with:
+          tool: ripgrep@15.2.0

      - name: Check architecture migration rules
        run: ./scripts/check_architecture_migration_rules.sh
@@ -83,7 +83,9 @@ jobs:
          persist-credentials: false

      - name: Install ripgrep
-        run: sudo apt-get update && sudo apt-get install -y ripgrep
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
+        with:
+          tool: ripgrep@15.2.0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -123,6 +125,9 @@ jobs:
      - name: Check no embedded secret material
        run: ./scripts/check_embedded_secrets.sh

+      - name: Check test wiring
+        run: python3 ./scripts/check_test_wiring.py
+
      - name: Check no planning docs committed
        run: ./scripts/check_no_planning_docs.sh

@@ -118,7 +118,9 @@ jobs:
          persist-credentials: false

      - name: Install ripgrep
-        run: sudo apt-get update && sudo apt-get install -y ripgrep
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
+        with:
+          tool: ripgrep@15.2.0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -158,6 +160,9 @@ jobs:
      - name: Check no embedded secret material
        run: ./scripts/check_embedded_secrets.sh

+      - name: Check test wiring
+        run: python3 ./scripts/check_test_wiring.py
+
      - name: Check no planning docs committed
        run: ./scripts/check_no_planning_docs.sh

@@ -684,9 +689,9 @@ jobs:
      - name: Make binary executable
        run: chmod +x ./target/debug/rustfs

-      # Build the e2e test graph once. The archive is reused by the security
-      # count-floor check and the smoke run below, avoiding a second compile of
-      # the same e2e_test target on cold runners (backlog#1645).
+      # Build the e2e test graph once. The archive is reused by the smoke
+      # selection guard, security exact-count check, and run below, avoiding a
+      # second compile of the same e2e_test target on cold runners (backlog#1645).
      - name: Archive e2e smoke test binaries
        env:
          NEXTEST_ARCHIVE: ${{ runner.temp }}/rustfs-e2e-smoke.tar.zst
@@ -694,6 +699,7 @@ jobs:
        run: |
          cargo nextest archive --profile e2e-smoke -p e2e_test --archive-file "${NEXTEST_ARCHIVE}"
          cargo nextest list --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" --message-format json > "${NEXTEST_LISTING}"
+          python3 ./scripts/check_test_wiring.py --check-profile e2e-smoke "${NEXTEST_LISTING}"
          ./scripts/check_security_smoke_count.sh check "${NEXTEST_LISTING}"

      # PR smoke subset of the in-repo e2e suite (backlog#1149 ci-4). The
@@ -758,7 +764,7 @@ jobs:
    # suites — KMS, object_lock, multipart_auth, quota, checksum, encryption,
    # security-boundary, ... — via the e2e-full nextest profile. Too heavy for
    # every PR, so it is gated to main pushes, the merge queue, and manual
-    # dispatch. protocols / the 6 cluster suites / replication / #[ignore] are
+    # dispatch. protocols / the 7 cluster suites / replication / #[ignore] are
    # owned by other lanes (see .config/nextest.toml profile.e2e-full).
    if: >-
      github.event_name == 'workflow_dispatch' ||
@@ -818,6 +824,13 @@ jobs:
      - name: Make binary executable
        run: chmod +x ./target/debug/rustfs

+      - name: Verify e2e full membership
+        env:
+          NEXTEST_LISTING: ${{ runner.temp }}/rustfs-e2e-full-list.json
+        run: |
+          cargo nextest list --profile e2e-full -p e2e_test --message-format json > "${NEXTEST_LISTING}"
+          python3 ./scripts/check_test_wiring.py --check-profile e2e-full "${NEXTEST_LISTING}"
+
      # Full single-node e2e lane (backlog#1149 ci-5). The e2e-full
      # default-filter in .config/nextest.toml is the single wiring mechanism —
      # extend that filter, never add ad-hoc e2e jobs here. Reuses the downloaded
@@ -830,7 +843,9 @@ jobs:
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: e2e-full-junit-${{ github.run_number }}
-          path: target/nextest/e2e-full/junit.xml
+          path: |
+            target/nextest/e2e-full/junit.xml
+            ${{ runner.temp }}/rustfs-e2e-full-list.json
          retention-days: 7

  e2e-tests-rio-v2:
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# Nightly full replication e2e lane (backlog#1147 repl-1, deps: ci-4).
+# Consolidated nightly e2e lane for replication, cluster faults, and protocols.
 #
 # The per-PR gate (ci.yml `e2e-tests` job, `--profile e2e-smoke`) runs the
 # FAST replication tests. This scheduled lane runs the remaining heavier
@@ -28,15 +28,12 @@
 # add ad-hoc cargo-test steps here; change the filterset instead. The
 # authoritative membership and count come from
 # `cargo nextest list -p e2e_test --profile e2e-repl-nightly`; the PR/nightly
-# count invariant is maintained next to the filtersets in .config/nextest.toml
-# (deliberately not duplicated here).
+# selection digest is committed under .config/.
 #
-# Explicit division of labor: the nightly subset runs ONLY here, never double-run
-# in ci-5's future e2e-full merge gate. TODO(ci-7): once the ci domain's
-# consolidated scheduled e2e workflow exists, fold this interim repl-owned lane
-# into it rather than growing a second scheduled entrypoint.
+# Explicit division of labor: these subsets run only here and never double-run
+# in the e2e-full merge gate.

-name: e2e-replication-nightly
+name: e2e-nightly

 on:
  workflow_dispatch:
@@ -50,6 +47,10 @@ on:
 permissions:
  contents: read

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
  repl-nightly:
    name: Replication e2e (nightly)
@@ -97,9 +98,20 @@ jobs:
      # demand otherwise, but a single explicit build avoids several parallel
      # nextest test processes racing to build it at once.
      - name: Build rustfs binary
-        run: cargo build -p rustfs --bins
+        run: |
+          cargo build -p rustfs --bins
+          : > target/debug/rustfs.features
+
+      - name: Verify replication e2e membership
+        env:
+          NEXTEST_LISTING: ${{ runner.temp }}/rustfs-e2e-repl-nightly-list.json
+        run: |
+          cargo nextest list --profile e2e-repl-nightly -p e2e_test --message-format json > "${NEXTEST_LISTING}"
+          python3 ./scripts/check_test_wiring.py --check-profile e2e-repl-nightly "${NEXTEST_LISTING}"

      - name: Run replication e2e nightly suite
+        env:
+          RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-repl-nightly-logs
        run: cargo nextest run --profile e2e-repl-nightly -p e2e_test

      - name: Upload nextest junit report
@@ -107,13 +119,112 @@ jobs:
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: e2e-replication-nightly-junit-${{ github.run_number }}
-          path: target/nextest/e2e-repl-nightly/junit.xml
+          path: |
+            target/nextest/e2e-repl-nightly/junit.xml
+            ${{ runner.temp }}/rustfs-e2e-repl-nightly-list.json
+            ${{ runner.temp }}/rustfs-e2e-repl-nightly-logs/
          retention-days: 7
          if-no-files-found: ignore

+  cluster-nightly:
+    name: Cluster fault e2e (nightly)
+    runs-on: sm-standard-4
+    timeout-minutes: 90
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-e2e-nightly
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'
+
+      - name: Build rustfs binary
+        run: |
+          cargo build -p rustfs --bins --features e2e-test-hooks
+          : > target/debug/rustfs.features
+
+      - name: Verify cluster fault e2e membership
+        env:
+          NEXTEST_LISTING: ${{ runner.temp }}/rustfs-e2e-nightly-list.json
+        run: |
+          cargo nextest list --profile e2e-nightly -p e2e_test --message-format json > "${NEXTEST_LISTING}"
+          python3 ./scripts/check_test_wiring.py --check-profile e2e-nightly "${NEXTEST_LISTING}"
+
+      - name: Run cluster fault e2e nightly suite
+        env:
+          RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-nightly-logs
+        run: cargo nextest run --profile e2e-nightly -p e2e_test
+
+      - name: Upload cluster fault diagnostics
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: e2e-cluster-nightly-${{ github.run_number }}
+          path: |
+            target/nextest/e2e-nightly/junit.xml
+            ${{ runner.temp }}/rustfs-e2e-nightly-list.json
+            ${{ runner.temp }}/rustfs-e2e-nightly-logs/
+          retention-days: 7
+          if-no-files-found: warn
+
+  protocols-nightly:
+    name: Protocol e2e (nightly)
+    runs-on: sm-standard-4
+    timeout-minutes: 90
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+      RUSTFS_BUILD_FEATURES: ftps,webdav,sftp
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-e2e-protocols
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'
+
+      # The suite owns fixed protocol ports and serializes its internal cases.
+      - name: Verify protocol e2e membership
+        env:
+          NEXTEST_LISTING: ${{ runner.temp }}/rustfs-e2e-protocols-list.json
+        run: |
+          cargo nextest list --profile e2e-protocols -p e2e_test --message-format json > "${NEXTEST_LISTING}"
+          python3 ./scripts/check_test_wiring.py --check-profile e2e-protocols "${NEXTEST_LISTING}"
+
+      - name: Run protocol e2e nightly suite
+        env:
+          RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-protocol-e2e-logs
+        run: >-
+          cargo nextest run -j 1 --profile e2e-protocols -p e2e_test --no-capture
+
+      - name: Upload protocol diagnostics
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: e2e-protocol-nightly-${{ github.run_number }}
+          path: |
+            target/nextest/e2e-protocols/junit.xml
+            ${{ runner.temp }}/rustfs-e2e-protocols-list.json
+            ${{ runner.temp }}/rustfs-protocol-e2e-logs/
+          retention-days: 7
+          if-no-files-found: warn
+
  alert-on-failure:
    name: Alert on scheduled failure
-    needs: [repl-nightly]
+    needs: [repl-nightly, cluster-nightly, protocols-nightly]
    # Only scheduled runs open/append the tracking issue (backlog#1149 ci-8);
    # manual workflow_dispatch runs stay quiet so a debugging run never files a
    # spurious alert.
@@ -18,10 +18,9 @@
 # runs only the implemented_tests.txt whitelist. This workflow complements it:
 #
 #   - Scheduled weekly full sweep (TEST_SCOPE=all): runs the ENTIRE upstream
-#     suite and reports promotion candidates (tests that newly pass) and
-#     unclassified tests. The job fails only on regressions in the implemented
-#     whitelist or on infrastructure errors — expected failures from
-#     not-yet-implemented features do not turn the run red.
+#     suite and reports promotion candidates. Regressions, unclassified tests,
+#     incomplete execution, and infrastructure errors fail the job; classified
+#     failures for not-yet-implemented features remain informational.
 #   - Manual runs (workflow_dispatch): same, with configurable mode/scope.
 #
 # All test execution is delegated to scripts/s3-tests/run.sh (single source of
@@ -45,13 +44,6 @@
 # The PR gate (ci.yml s3-implemented-tests) is unaffected: it avoids Docker
 # via DEPLOY_MODE=binary and defers all pip setup to run.sh's self-bootstrap.

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: e2e-s3tests

 on:
@@ -81,6 +73,19 @@ on:
        description: "Stop after N failures. '0' to run everything."
        required: false
        default: "0"
+      shard-count:
+        description: "Exact-node-ID shard count for a targeted manual run"
+        required: false
+        default: "1"
+        type: choice
+        options:
+          - "1"
+          - "2"
+          - "4"
+      shard-index:
+        description: "Zero-based shard index for a targeted manual run"
+        required: false
+        default: "0"
      markexpr:
        description: "Optional pytest -m expression"
        required: false
@@ -111,6 +116,8 @@ env:
  XDIST: ${{ github.event.inputs.xdist || '4' }}
  MAXFAIL: ${{ github.event.inputs.maxfail || '0' }}
  MARKEXPR: ${{ github.event.inputs.markexpr || '' }}
+  S3_SHARD_COUNT: ${{ github.event_name == 'schedule' && '4' || github.event.inputs.shard-count || '1' }}
+  TEST_TIMEOUT: "300"

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.inputs['test-mode'] || 'single' }}
@@ -127,19 +134,22 @@ defaults:

 jobs:
  s3tests:
+    name: s3tests (${{ matrix.test-mode }}, shard ${{ matrix.shard-index }})
    # GitHub-hosted: reliably provides Docker + docker compose + python3/pip.
    # See the header note (ci-1) for why the self-hosted sm-standard-4 label
-    # was abandoned. TODO(ci-8): scheduled-failure alerting (auto-open issue)
-    # is added by the ci-8 composite action; do not implement it here.
+    # was abandoned. Scheduled failures are handled by alert-on-failure below.
    runs-on: ubuntu-latest
    timeout-minutes: 180
    strategy:
      fail-fast: false
+      max-parallel: 2
      matrix:
        # Scheduled sweeps cover both topologies; manual runs use the input.
        test-mode: ${{ github.event_name == 'schedule' && fromJSON('["single", "multi"]') || fromJSON(format('["{0}"]', github.event.inputs.test-mode || 'single')) }}
+        shard-index: ${{ github.event_name == 'schedule' && fromJSON('[0, 1, 2, 3]') || fromJSON(format('[{0}]', github.event.inputs.shard-index || '0')) }}
    env:
      TEST_MODE: ${{ matrix.test-mode }}
+      S3_SHARD_INDEX: ${{ matrix.shard-index }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
@@ -181,6 +191,7 @@ jobs:
      - name: Start single RustFS
        if: env.TEST_MODE == 'single'
        run: |
+          SSE_KEY="$(head -c 32 /dev/zero | base64 -w0)"
          docker network inspect rustfs-net >/dev/null 2>&1 || docker network create rustfs-net
          docker rm -f rustfs-single >/dev/null 2>&1 || true
          # The four disks share one physical device on the runner (a single
@@ -193,6 +204,7 @@ jobs:
            -e RUSTFS_ADDRESS=0.0.0.0:9000 \
            -e RUSTFS_ACCESS_KEY="${S3_ACCESS_KEY}" \
            -e RUSTFS_SECRET_KEY="${S3_SECRET_KEY}" \
+            -e RUSTFS_SSE_S3_MASTER_KEY="${SSE_KEY}" \
            -e RUSTFS_VOLUMES="/data/rustfs{0...3}" \
            -e RUSTFS_UNSAFE_BYPASS_DISK_CHECK=true \
            -v /tmp/rustfs-single:/data \
@@ -201,6 +213,7 @@ jobs:
      - name: Start 4-node distributed cluster
        if: env.TEST_MODE == 'multi'
        run: |
+          SSE_KEY="$(head -c 32 /dev/zero | base64 -w0)"
          # A real distributed deployment: every node lists all endpoints in
          # RUSTFS_VOLUMES so data is erasure-coded ACROSS nodes. Do not use
          # node-local volume paths here — that would create four independent
@@ -213,6 +226,7 @@ jobs:
              RUSTFS_ADDRESS: "0.0.0.0:9000"
              RUSTFS_ACCESS_KEY: ${S3_ACCESS_KEY}
              RUSTFS_SECRET_KEY: ${S3_SECRET_KEY}
+              RUSTFS_SSE_S3_MASTER_KEY: "${SSE_KEY}"
              RUSTFS_VOLUMES: "http://rustfs{1...4}:9000/data/rustfs{0...3}"
              # Each node's four disks share one physical device inside its
              # container, so bypass the local physical-disk-independence guard
@@ -294,7 +308,6 @@ jobs:

      - name: Run ceph s3-tests
        run: |
-          set +e
          DEPLOY_MODE=existing \
          TEST_MODE="${TEST_MODE}" \
          TEST_SCOPE="${TEST_SCOPE}" \
@@ -302,26 +315,6 @@ jobs:
          MAXFAIL="${MAXFAIL}" \
          MARKEXPR="${MARKEXPR}" \
          ./scripts/s3-tests/run.sh
-          RC=$?
-          set -e
-
-          if [ "${TEST_SCOPE}" = "implemented" ]; then
-            # Whitelist run: every failure is a regression.
-            exit "${RC}"
-          fi
-
-          # Full sweep: failures outside the implemented whitelist are
-          # inventory (promotion candidates / unimplemented features), not a
-          # gate. Fail only on whitelist regressions or infrastructure errors.
-          JUNIT="artifacts/s3tests-${TEST_MODE}/junit.xml"
-          if [ ! -f "${JUNIT}" ]; then
-            echo "No junit.xml produced — infrastructure failure (exit ${RC})" >&2
-            exit "${RC}"
-          fi
-          python3 scripts/s3-tests/report_compat.py \
-            --junit "${JUNIT}" \
-            --lists-dir scripts/s3-tests \
-            --fail-on-regression

      - name: Publish compatibility report
        if: always()
@@ -346,7 +339,7 @@ jobs:
        if: always() && env.ACT != 'true'
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
-          name: s3tests-${{ env.TEST_MODE }}
+          name: s3tests-${{ env.TEST_MODE }}-shard-${{ matrix.shard-index }}
          path: artifacts/**

  alert-on-failure:
@@ -12,27 +12,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# DISABLED. This workflow is switched off in the repository's Actions settings
-# (state: disabled_manually) and does not run on any trigger, including its cron
-# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
-# reading this file, which has already misled at least one audit — hence this
-# banner. Re-enabling is a UI action; anyone doing so should first check that the
-# workflow still matches the current CI layout. See rustfs/backlog#1603.
-#
 name: Fuzz

 on:
  pull_request:
    types: [ opened, synchronize, reopened, closed ]
-    # PR trigger is intentionally narrow: only changes to the fuzz harness
-    # itself gate a PR. Broad crate paths (ecstore/filemeta/utils/policy/…)
-    # are covered by the nightly `schedule` run below, which fuzzes against
-    # whatever landed on main. Widening these paths previously queued a
-    # ~45min fuzz-build on nearly every PR and is why this workflow was
-    # disabled; do not re-add crate paths here.
+    # Run when the harness or any directly fuzzed production crate changes.
    paths:
      - "fuzz/**"
      - "scripts/fuzz/**"
+      - "crates/ecstore/**"
+      - "crates/filemeta/**"
+      - "crates/policy/**"
+      - "crates/security-governance/**"
+      - "crates/utils/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
      - ".github/workflows/fuzz.yml"
  schedule:
    - cron: "0 2 * * *"
@@ -81,7 +76,7 @@ jobs:
      github.event_name == 'schedule' ||
      github.event_name == 'workflow_dispatch'
    runs-on: sm-standard-4
-    timeout-minutes: 45
+    timeout-minutes: 60
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
    steps:
@@ -121,12 +116,7 @@ jobs:
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: fuzz-prebuilt-binaries-${{ github.run_number }}
-          path: |
-            fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/archive_extract
-            fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/bucket_validation
-            fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/local_metadata
-            fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/path_containment
-            fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/policy_ingress
+          path: fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/
          if-no-files-found: error
          retention-days: 1
          compression-level: 0
@@ -192,10 +182,7 @@ jobs:
  nightly-fuzz-corpus:
    name: "Nightly / ${{ matrix.target }}"
    needs: fuzz-build
-    # TODO(ci-8): when the schedule-failure-issue composite action lands,
-    # add a step here (or a dependent job) that opens/updates a GitHub issue
-    # on nightly failure. ci-8 is the single alerting mechanism for all
-    # scheduled workflows; do not self-roll alerting in this workflow.
+    # Scheduled failures are handled by alert-on-failure below.
    if: >
      github.event_name == 'schedule' ||
      (github.event_name == 'workflow_dispatch' &&
@@ -189,6 +189,7 @@ jobs:
    timeout-minutes: 30
    strategy:
      fail-fast: false
+      max-parallel: 1
      matrix:
        include:
          - arch: x86_64
@@ -510,15 +511,13 @@ jobs:

          CHECKSUM_DIR="$(mktemp -d)"
          gh release download "$TAG" -p 'SHA256SUMS' -p 'SHA512SUMS' \
-            -D "$CHECKSUM_DIR" --clobber 2>/dev/null || true
+            -D "$CHECKSUM_DIR" --clobber

          for spec in "SHA256SUMS:sha256sum" "SHA512SUMS:sha512sum"; do
            asset="${spec%%:*}"
            checksum_cmd="${spec##*:}"
            checksum_file="${CHECKSUM_DIR}/${asset}"

-            touch "$checksum_file"
-
            for f in "$DEB_FILE" "$RPM_FILE"; do
              if [[ -n "$f" && -f "$f" ]]; then
                base="$(basename "$f")"
@@ -531,7 +530,8 @@ jobs:
                grep -Fv -- "$base" "$checksum_file" > "${checksum_file}.tmp" || true
                grep -Fv -- "$github_base" "${checksum_file}.tmp" > "${checksum_file}.tmp2" || true
                mv "${checksum_file}.tmp2" "$checksum_file"
-                (cd "$(dirname "$f")" && "$checksum_cmd" -- "$github_base") >> "$checksum_file"
+                digest=$("$checksum_cmd" -- "$f" | awk '{print $1}')
+                printf '%s  %s\n' "$digest" "$github_base" >> "$checksum_file"
              fi
            done

@@ -127,8 +127,9 @@ the broadest gate. Inspect only the final task-owned diff, classify it by
 behavioral impact rather than line count or path alone, and run the smallest
 set of checks that provides meaningful coverage. Do not let unrelated
 worktree changes or a generic contributor checklist expand the scope.
-Non-exempt changes must also pass Adversarial Validation (next section) before
-the checks below count as completion.
+For non-exempt changes, complete the applicable multi-role adversarial review
+before running `make pre-pr` (or an equivalent full gate). Resolve or rebut
+every finding first, then run the gate against the reviewed final diff.

 ### Validation floor

@@ -166,8 +167,9 @@ the checks below count as completion.
   dependency set is identifiable, validate those packages and known
   dependents instead of the whole workspace. Use `make pre-commit` only when
   a repository-wide fast gate adds useful confidence beyond those checks.
-4. **Broad or high-risk change:** Run `make pre-pr` only when targeted coverage
-   cannot bound the impact, including:
+4. **Broad or high-risk change:** After the applicable adversarial review has
+   completed, run `make pre-pr` only when targeted coverage cannot bound the
+   impact, including:
   - dependency, feature, build-script, procedural-macro, code-generation,
     toolchain, or CI changes that alter compilation or the test matrix;
   - cross-crate public APIs, shared foundational code, or broad refactors with
@@ -287,8 +289,9 @@ High risk: all seven roles.
 - Every testable behavior change has a focused regression check. Exceptions
  follow the validation floor and state why a check is impractical and what
  risk remains.
- The Verification Before PR gates pass — adversarial review supplements
-  those gates, never replaces them.
+- After the applicable adversarial review has completed, the Verification
+  Before PR gates pass; adversarial review supplements those gates, never
+  replaces them.
 - High risk only: record a one-line verdict per role in the PR description.

 ## Git and PR Baseline
@@ -91,8 +91,9 @@ A green `make pre-commit` is not enough to open a pull request.
 `make pre-pr` is the **full** gate: it runs all of the guard checks above,
 then `clippy-check` (`cargo clippy --all-targets --all-features -- -D warnings`)
 and `test` (shell script tests, workspace tests excluding `e2e_test`, and doc
-tests). Run `make pre-pr` before opening or updating a pull request — this is
-what CI enforces.
+tests). Complete the applicable multi-role adversarial review described in
+`AGENTS.md` before running `make pre-pr`; then run the gate before opening or
+updating a pull request. This is what CI enforces.

 ### 🔒 Git Pre-commit Hooks (optional)

@@ -150,8 +151,9 @@ Example output when formatting fails:
 2. **Format your code**: `make fmt` or `cargo fmt --all`
 3. **Run the fast gate**: `make pre-commit` (no clippy, no tests)
 4. **Commit your changes**: `git commit -m "your message"`
-5. **Run the full gate before opening/updating a PR**: `make pre-pr` (clippy + tests)
-6. **Push to your branch**: `git push`
+5. **Complete the applicable multi-role adversarial review** for non-exempt changes (see `AGENTS.md`)
+6. **Run the full gate before opening/updating a PR**: `make pre-pr` (clippy + tests)
+7. **Push to your branch**: `git push`

 ### 🛠️ IDE Integration

@@ -1198,9 +1198,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-http-client"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c1c8a04cb31ba74d0115af5a890bb8c0d48fba64b52812fa13929a6ef0cc83c"
+checksum = "ebfd138fac0337cee7516c352757ea73b9f2266e57d0bcb5bc70e9547e45aef1"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-protocol-test",
@@ -1280,9 +1280,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-runtime"
-version = "1.13.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "483b858ff67522011c4786310c5cd8fd88d0be7ea3d5f1a48328446300c4269e"
+checksum = "b82e438d30e02a825d363bd639a9efaed68a8089d86101054b0081e7e0d3e606"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-http",
@@ -1306,9 +1306,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b98f2e1fd67ec06618f9c291e5e495a468e60519e44c9c1979cd0521f3affdb"
+checksum = "954c563ce84507722d2679f07a35d21b9c6466b3872d513020d0281fc8112ac9"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-runtime-api-macros",
@@ -1598,7 +1598,7 @@ version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
- "generic-array 0.14.7",
+ "generic-array 0.14.9",
 ]

 [[package]]
@@ -1617,7 +1617,7 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
 dependencies = [
- "generic-array 0.14.7",
+ "generic-array 0.14.9",
 ]

 [[package]]
@@ -1968,7 +1968,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common 0.1.6",
 "inout 0.1.4",
 ]

@@ -2428,7 +2428,7 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
- "generic-array 0.14.7",
+ "generic-array 0.14.9",
 "rand_core 0.6.4",
 "subtle",
 "zeroize",
@@ -2453,11 +2453,11 @@ dependencies = [

 [[package]]
 name = "crypto-common"
-version = "0.1.7"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
- "generic-array 0.14.7",
+ "generic-array 0.14.9",
 "typenum",
 ]

@@ -2703,8 +2703,9 @@ checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"

 [[package]]
 name = "datafusion"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96f76f0167ed0842b29a3d1e41be3c034c0a46409a3a703cc4cc84ee8c24abf4"
 dependencies = [
 "arrow",
 "arrow-schema",
@@ -2751,8 +2752,9 @@ dependencies = [

 [[package]]
 name = "datafusion-catalog"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d79ec3460f6ed5c58f9b3f2d873fbc77748b82653bff1b4cdaf06de33bb4e05f"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2775,8 +2777,9 @@ dependencies = [

 [[package]]
 name = "datafusion-catalog-listing"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b48cef241e2efcfd496fe05ae4d0d5de20793451862faefe406c397a467e12d4"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2798,8 +2801,9 @@ dependencies = [

 [[package]]
 name = "datafusion-common"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f72810485975c258f1b4d00baab31728470676c60c5546f366ebd0d99f05ab6"
 dependencies = [
 "arrow",
 "arrow-ipc",
@@ -2824,8 +2828,9 @@ dependencies = [

 [[package]]
 name = "datafusion-common-runtime"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "533c28e75dba52f41bde187d23a1cb24ab91c7c097966824fa471e67b60320ea"
 dependencies = [
 "futures",
 "log",
@@ -2834,8 +2839,9 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b00a1fa0da26f6087136a82fea7f13c76a672cbab452d4086952a7cf770a19b"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2863,8 +2869,9 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource-arrow"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ad17ec881bff2ed7768b4bfe971d3efbf3473f2fd1f9d365447bccbdf908678"
 dependencies = [
 "arrow",
 "arrow-ipc",
@@ -2886,8 +2893,9 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource-csv"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5345285b0c3eaab412e7539b706973c083bd7e5bce575de5e0a3da488d08d1d"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2908,8 +2916,9 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource-json"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da02fb9324f56bd8c53f1ee2e949547425cb66f76adc6832b10d44f80a1221d2"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2930,8 +2939,9 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource-parquet"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c0b0dc1453952952fd5c69ad1c7f6042176e69ed233011d47e07cf74ed0949e"
 dependencies = [
 "arrow",
 "arrow-schema",
@@ -2961,13 +2971,15 @@ dependencies = [

 [[package]]
 name = "datafusion-doc"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a88fd985bc0550c36f557db69543cc9d6393b1509783520b30e902f23c555da6"

 [[package]]
 name = "datafusion-execution"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a98f1052f91b4991f0bf2ce1e4e36dfbdcda454a956b8c8d562c7c845e8fce1d"
 dependencies = [
 "arrow",
 "arrow-buffer",
@@ -2991,8 +3003,9 @@ dependencies = [

 [[package]]
 name = "datafusion-expr"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "464625a1f0e4b9df552d894fafcc8aac953ebbc8b0fa0acdaf20975fd615040e"
 dependencies = [
 "arrow",
 "arrow-schema",
@@ -3013,8 +3026,9 @@ dependencies = [

 [[package]]
 name = "datafusion-expr-common"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2604994999d5aeca1d1df645ffc98bc787447aaff05dde27aad0342b48fc1fe0"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3024,8 +3038,9 @@ dependencies = [

 [[package]]
 name = "datafusion-functions"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "051e97533e6af53e4aa0a0667cadc886abcaf36c4a5925019c55c0aa4c218fde"
 dependencies = [
 "arrow",
 "arrow-buffer",
@@ -3051,8 +3066,9 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-aggregate"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d0f1bb166d3572b6ed40e1afb2faaacade962abc08c2fcf04babee74681c56b"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3071,8 +3087,9 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-aggregate-common"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ed756770f5f98369e181d692fd5ee6b1127ffd7322caba92f3730f9f5c92333"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3082,8 +3099,9 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-nested"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91173fdb5c0ff2a41169a8ffa1b385b8844f18728747bb0a37e35ad7d5772a4f"
 dependencies = [
 "arrow",
 "arrow-ord",
@@ -3106,8 +3124,9 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-table"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1bcdfb286a745461b126719c32700777e83df4f17cc44db5d71ebce5731e840"
 dependencies = [
 "arrow",
 "async-trait",
@@ -3121,8 +3140,9 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-window"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ec4b508f1f93f00038ba3e737e894ec6c775528b4369413386655ae6125f0fc"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3137,8 +3157,9 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-window-common"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b352020834140073fbf5b46ee0ceb926e5074a9d0bcae1dbd91d0586d999cde"
 dependencies = [
 "datafusion-common",
 "datafusion-physical-expr-common",
@@ -3146,8 +3167,9 @@ dependencies = [

 [[package]]
 name = "datafusion-macros"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15192effab05d38cce10e92a6fb48c967b5f166b27b7195a165a72b232569c58"
 dependencies = [
 "datafusion-doc",
 "quote",
@@ -3156,8 +3178,9 @@ dependencies = [

 [[package]]
 name = "datafusion-optimizer"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854445d9f7847e1e46089cf61b8d341a64382f14484e912c83a0f23b31216896"
 dependencies = [
 "arrow",
 "chrono",
@@ -3175,8 +3198,9 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-expr"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "671558dad1d2aa253c39c0a4c52515958b99eb91abf649f4b88d5e69cc55282f"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3196,8 +3220,9 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-expr-adapter"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffae3d78c2da80ecc829cb58536cc5aca2e99cf1365eda694fc75bfe288861e0"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3210,8 +3235,9 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-expr-common"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d9092ed15e7203fbd0903215172f7c9d18f10d94cba35137f3b3836f7c46f16"
 dependencies = [
 "arrow",
 "chrono",
@@ -3226,8 +3252,9 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-optimizer"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9005b6cf50b57b72d476c6ed4662b04be7ca6be5320ba9127c6d0b7e4218095b"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3245,8 +3272,9 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-plan"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5787e4fcff4adc4fce8948441103a99705018b49c8dff0720b650bd7a15da112"
 dependencies = [
 "arrow",
 "arrow-data",
@@ -3279,8 +3307,9 @@ dependencies = [

 [[package]]
 name = "datafusion-pruning"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e651c8df0b90daed6a7be5921ec0ee379e6909705f063eeff70fd4e35010e4c"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3294,8 +3323,9 @@ dependencies = [

 [[package]]
 name = "datafusion-session"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb56667ee38217efab19b895d9a936052cfb47ed438a19663351bdc42a6214a1"
 dependencies = [
 "arrow-schema",
 "async-trait",
@@ -3308,8 +3338,9 @@ dependencies = [

 [[package]]
 name = "datafusion-sql"
-version = "54.1.0"
-source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
+version = "55.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c29067cb9d32f8e603c45e15d61ea18f1069f96ceafeceb4e18466b8e5b31d9"
 dependencies = [
 "arrow",
 "bigdecimal",
@@ -3664,7 +3695,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
 "block-buffer 0.10.4",
 "const-oid 0.9.6",
- "crypto-common 0.1.7",
+ "crypto-common 0.1.6",
 "subtle",
 ]

@@ -3764,7 +3795,7 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"

 [[package]]
 name = "e2e_test"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "anyhow",
 "astral-tokio-tar",
@@ -3924,7 +3955,7 @@ dependencies = [
 "crypto-bigint 0.5.5",
 "digest 0.10.7",
 "ff 0.13.1",
- "generic-array 0.14.7",
+ "generic-array 0.14.9",
 "group 0.13.0",
 "hkdf 0.12.4",
 "pem-rfc7468 0.7.0",
@@ -4369,9 +4400,9 @@ dependencies = [

 [[package]]
 name = "generic-array"
-version = "0.14.7"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
 dependencies = [
 "typenum",
 "version_check",
@@ -4384,7 +4415,7 @@ version = "1.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "337d46834ee672ab3e48caca2cb0c78cc174fb12b3a68d0d88f99a0519a5e36e"
 dependencies = [
- "generic-array 0.14.7",
+ "generic-array 0.14.9",
 "rustversion",
 "typenum",
 ]
@@ -4726,9 +4757,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.16"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
+checksum = "839c0e8a181239723652be9062bb56ca5bf5f64011f73b623f6f4fc59086a228"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -5418,7 +5449,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
 "block-padding 0.3.3",
- "generic-array 0.14.7",
+ "generic-array 0.14.9",
 ]

 [[package]]
@@ -8628,18 +8659,18 @@ dependencies = [

 [[package]]
 name = "ref-cast"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
 dependencies = [
 "ref-cast-impl",
 ]

 [[package]]
 name = "ref-cast-impl"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -9094,7 +9125,7 @@ dependencies = [

 [[package]]
 name = "rustfs"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "aes-gcm",
 "anyhow",
@@ -9142,6 +9173,7 @@ dependencies = [
 "mime_guess",
 "opentelemetry",
 "opentelemetry_sdk",
+ "p256 0.13.2",
 "parking_lot",
 "percent-encoding",
 "pin-project-lite",
@@ -9232,7 +9264,7 @@ dependencies = [

 [[package]]
 name = "rustfs-audit"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-trait",
 "const-str",
@@ -9255,7 +9287,7 @@ dependencies = [

 [[package]]
 name = "rustfs-checksums"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "base64-simd",
 "bytes",
@@ -9271,14 +9303,13 @@ dependencies = [

 [[package]]
 name = "rustfs-common"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "chrono",
 "hotpath",
 "jiff",
 "metrics",
 "rmp-serde",
- "s3s",
 "serde",
 "serde_json",
 "smallvec",
@@ -9290,7 +9321,7 @@ dependencies = [

 [[package]]
 name = "rustfs-concurrency"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "hotpath",
 "insta",
@@ -9303,7 +9334,7 @@ dependencies = [

 [[package]]
 name = "rustfs-config"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "const-str",
 "hotpath",
@@ -9313,7 +9344,7 @@ dependencies = [

 [[package]]
 name = "rustfs-credentials"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "base64-simd",
 "hmac 0.13.0",
@@ -9327,7 +9358,7 @@ dependencies = [

 [[package]]
 name = "rustfs-crypto"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "aes-gcm",
 "argon2",
@@ -9348,7 +9379,7 @@ dependencies = [

 [[package]]
 name = "rustfs-data-usage"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "hotpath",
 "rmp-serde",
@@ -9358,13 +9389,12 @@ dependencies = [

 [[package]]
 name = "rustfs-ecstore"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "arc-swap",
 "async-channel",
 "async-recursion",
 "async-trait",
- "aws-config",
 "aws-credential-types",
 "aws-sdk-s3",
 "aws-smithy-http-client",
@@ -9402,6 +9432,7 @@ dependencies = [
 "md-5 0.11.0",
 "memmap2",
 "metrics",
+ "metrics-util",
 "moka",
 "num_cpus",
 "opentelemetry",
@@ -9498,7 +9529,7 @@ dependencies = [

 [[package]]
 name = "rustfs-extension-schema"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "hotpath",
 "serde",
@@ -9508,7 +9539,7 @@ dependencies = [

 [[package]]
 name = "rustfs-filemeta"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "arc-swap",
 "byteorder",
@@ -9535,7 +9566,7 @@ dependencies = [

 [[package]]
 name = "rustfs-heal"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-trait",
 "base64 0.23.1",
@@ -9568,7 +9599,7 @@ dependencies = [

 [[package]]
 name = "rustfs-iam"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "arc-swap",
 "async-trait",
@@ -9609,7 +9640,7 @@ dependencies = [

 [[package]]
 name = "rustfs-io-core"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "bytes",
 "hotpath",
@@ -9621,7 +9652,7 @@ dependencies = [

 [[package]]
 name = "rustfs-io-metrics"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "criterion",
 "hotpath",
@@ -9685,7 +9716,7 @@ dependencies = [

 [[package]]
 name = "rustfs-keystone"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "bytes",
 "futures",
@@ -9712,7 +9743,7 @@ dependencies = [

 [[package]]
 name = "rustfs-kms"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "aes-gcm",
 "anyhow",
@@ -9761,7 +9792,7 @@ dependencies = [

 [[package]]
 name = "rustfs-lifecycle"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-trait",
 "hotpath",
@@ -9784,7 +9815,7 @@ dependencies = [

 [[package]]
 name = "rustfs-lock"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-trait",
 "compact_str",
@@ -9807,7 +9838,7 @@ dependencies = [

 [[package]]
 name = "rustfs-log-analyzer"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "chrono",
 "flate2",
@@ -9826,7 +9857,7 @@ dependencies = [

 [[package]]
 name = "rustfs-madmin"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "hotpath",
 "http 1.5.0",
@@ -9846,7 +9877,7 @@ dependencies = [

 [[package]]
 name = "rustfs-notify"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "arc-swap",
 "async-trait",
@@ -9881,7 +9912,7 @@ dependencies = [

 [[package]]
 name = "rustfs-object-capacity"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "criterion",
 "futures",
@@ -9901,7 +9932,7 @@ dependencies = [

 [[package]]
 name = "rustfs-object-data-cache"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "bytes",
 "criterion",
@@ -9918,7 +9949,7 @@ dependencies = [

 [[package]]
 name = "rustfs-obs"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "chrono",
 "crossbeam-channel",
@@ -9933,6 +9964,7 @@ dependencies = [
 "libc",
 "log",
 "metrics",
+ "metrics-util",
 "num_cpus",
 "nvml-wrapper",
 "opentelemetry",
@@ -9973,7 +10005,7 @@ dependencies = [

 [[package]]
 name = "rustfs-policy"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-trait",
 "base64-simd",
@@ -10004,7 +10036,7 @@ dependencies = [

 [[package]]
 name = "rustfs-protocols"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "astral-tokio-tar",
 "async-compression",
@@ -10066,7 +10098,7 @@ dependencies = [

 [[package]]
 name = "rustfs-protos"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "flatbuffers",
 "hotpath",
@@ -10090,7 +10122,7 @@ dependencies = [

 [[package]]
 name = "rustfs-replication"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "byteorder",
 "bytes",
@@ -10108,7 +10140,7 @@ dependencies = [

 [[package]]
 name = "rustfs-rio"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "aes-gcm",
 "arc-swap",
@@ -10146,7 +10178,7 @@ dependencies = [

 [[package]]
 name = "rustfs-rio-v2"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "aes-gcm",
 "bytes",
@@ -10169,7 +10201,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3-ops"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "hotpath",
 "rustfs-s3-types",
@@ -10177,7 +10209,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3-types"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "hotpath",
 "serde",
@@ -10186,7 +10218,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3select-api"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-trait",
 "bytes",
@@ -10216,7 +10248,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3select-query"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-recursion",
 "async-trait",
@@ -10235,7 +10267,7 @@ dependencies = [

 [[package]]
 name = "rustfs-scanner"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-trait",
 "bytes",
@@ -10276,7 +10308,7 @@ dependencies = [

 [[package]]
 name = "rustfs-security-governance"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "hotpath",
 "thiserror 2.0.20",
@@ -10284,7 +10316,7 @@ dependencies = [

 [[package]]
 name = "rustfs-signer"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "base64-simd",
 "bytes",
@@ -10302,7 +10334,7 @@ dependencies = [

 [[package]]
 name = "rustfs-storage-api"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-trait",
 "hotpath",
@@ -10317,7 +10349,7 @@ dependencies = [

 [[package]]
 name = "rustfs-targets"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "arc-swap",
 "async-nats",
@@ -10371,7 +10403,7 @@ dependencies = [

 [[package]]
 name = "rustfs-test-utils"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "hotpath",
 "rustfs-data-usage",
@@ -10387,7 +10419,7 @@ dependencies = [

 [[package]]
 name = "rustfs-tls-runtime"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "arc-swap",
 "hotpath",
@@ -10408,7 +10440,7 @@ dependencies = [

 [[package]]
 name = "rustfs-trusted-proxies"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-trait",
 "axum",
@@ -10445,7 +10477,7 @@ dependencies = [

 [[package]]
 name = "rustfs-utils"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "base64-simd",
 "blake2",
@@ -10487,7 +10519,7 @@ dependencies = [

 [[package]]
 name = "rustfs-zip"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 dependencies = [
 "async-compression",
 "hotpath",
@@ -10677,8 +10709,8 @@ checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"

 [[package]]
 name = "s3s"
-version = "0.14.1"
-source = "git+https://github.com/rustfs/s3s.git?rev=d358a68783096df1db0c3e314127f2704603b29e#d358a68783096df1db0c3e314127f2704603b29e"
+version = "0.15.0-alpha.1"
+source = "git+https://github.com/rustfs/s3s.git?rev=ed70cb048cc4be168419d461cb9ac3c2c7fa6d5a#ed70cb048cc4be168419d461cb9ac3c2c7fa6d5a"
 dependencies = [
 "arc-swap",
 "arrayvec",
@@ -10832,7 +10864,7 @@ checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
 "base16ct 0.2.0",
 "der 0.7.10",
- "generic-array 0.14.7",
+ "generic-array 0.14.9",
 "pkcs8 0.10.2",
 "subtle",
 "zeroize",
@@ -11617,9 +11649,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "suppaftp"
-version = "10.0.1"
+version = "10.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c890e698eaf58526b6e7105d74c5d91ebe76a4da1faac2e20ff10e8e5c8bcff"
+checksum = "821001051ea3d12a60fb790b8c7cb9a6f5f8698dcfdca4cd533a025fefb0b5b8"
 dependencies = [
 "async-trait",
 "chrono",
@@ -11810,7 +11842,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
 "once_cell",
 "rustix",
 "windows-sys 0.61.2",
@@ -13360,9 +13392,9 @@ dependencies = [

 [[package]]
 name = "zerovec"
-version = "0.11.7"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94b5c6b5976d66c1d703c4fd17d3f5e43c8cedaacf604961b171adc7130896d8"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
 "yoke",
 "zerofrom",
@@ -69,7 +69,7 @@ edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
 rust-version = "1.97.1"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
@@ -86,52 +86,52 @@ redundant_clone = "warn"

 [workspace.dependencies]
 # RustFS Internal Crates
-rustfs = { path = "./rustfs", version = "1.0.0-rc.2" }
-rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.2" }
-rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.2" }
-rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.2" }
-rustfs-common = { path = "crates/common", version = "1.0.0-rc.2" }
-rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.2" }
-rustfs-config = { path = "./crates/config", version = "1.0.0-rc.2" }
-rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.2" }
-rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.2" }
-rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.2" }
-rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.2" }
-rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.2" }
-rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.2" }
-rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.2" }
-rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.2" }
-rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.2" }
-rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.2" }
-rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.2" }
-rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.2" }
-rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.2" }
-rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.2" }
-rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.2" }
-rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.2", default-features = false }
-rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.2" }
-rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.2" }
-rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.2" }
-rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.2" }
-rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.2" }
-rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.2" }
-rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.2" }
-rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.2" }
-rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.2" }
-rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.2" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.2" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.2" }
-rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.2" }
-rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.2" }
-rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.2" }
-rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.2" }
-rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.2" }
-rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.2" }
-rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.2" }
-rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.2" }
-rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.2" }
-rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.2" }
-rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.2" }
+rustfs = { path = "./rustfs", version = "1.0.0-rc.3" }
+rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.3" }
+rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.3" }
+rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.3" }
+rustfs-common = { path = "crates/common", version = "1.0.0-rc.3" }
+rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.3" }
+rustfs-config = { path = "./crates/config", version = "1.0.0-rc.3" }
+rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.3" }
+rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.3" }
+rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.3" }
+rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.3" }
+rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.3" }
+rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.3" }
+rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.3" }
+rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.3" }
+rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.3" }
+rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.3" }
+rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.3" }
+rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.3" }
+rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.3" }
+rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.3" }
+rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.3" }
+rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.3", default-features = false }
+rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.3" }
+rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.3" }
+rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.3" }
+rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.3" }
+rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.3" }
+rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.3" }
+rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.3" }
+rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.3" }
+rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.3" }
+rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.3" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.3" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.3" }
+rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.3" }
+rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.3" }
+rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.3" }
+rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.3" }
+rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.3" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.3" }
+rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.3" }
+rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.3" }
+rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.3" }
+rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.3" }
+rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.3" }

 # Async Runtime and Networking
 async-channel = "2.5.0"
@@ -231,8 +231,8 @@ aws-credential-types = { version = "1.3.0" }
 aws-sdk-kms = { default-features = false, version = "1.115.0" }
 aws-sdk-s3 = { default-features = false, version = "1.142.0" }
 aws-sdk-sts = { default-features = false, version = "1.111.0" }
-aws-smithy-http-client = { default-features = false, version = "1.3.0" }
-aws-smithy-runtime-api = { version = "1.14.0" }
+aws-smithy-http-client = { default-features = false, version = "1.4.0" }
+aws-smithy-runtime-api = { version = "1.15.0" }
 aws-smithy-types = { version = "1.6.2" }
 base64 = "0.23.1"
 base64-simd = "0.8.0"
@@ -245,8 +245,7 @@ crossbeam-queue = "0.3.13"
 crossbeam-channel = "0.5.16"
 crossbeam-deque = "0.8.7"
 crossbeam-utils = "0.8.22"
-datafusion = { default-features = false, git = "https://github.com/apache/datafusion.git", rev = "e08aed1e5de41dcf81d529140dae07723b942a5e" }
-#datafusion = { default-features = false, version = "54.1.0" }
+datafusion = { default-features = false, version = "55.0.0" }
 derive_builder = "0.20.2"
 enumset = "1.1.14"
 faster-hex = "0.10.0"
@@ -264,6 +263,7 @@ lazy_static = "1.5.0"
 libc = "0.2.189"
 libsystemd = "0.7.2"
 local-ip-address = "0.6.13"
+log = "0.4"
 memmap2 = "0.9.11"
 lz4 = "1.28.1"
 matchit = "0.9.2"
@@ -290,7 +290,7 @@ rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.4" }
 rust-embed = { version = "8.12.0" }
 rustc-hash = { version = "2.1.3" }
-s3s = { git = "https://github.com/rustfs/s3s.git", rev = "d358a68783096df1db0c3e314127f2704603b29e" }
+s3s = { git = "https://github.com/rustfs/s3s.git", rev = "ed70cb048cc4be168419d461cb9ac3c2c7fa6d5a" }
 serial_test = "4.0.1"
 shadow-rs = { default-features = false, version = "2.0.0" }
 siphasher = "1.0.3"
@@ -326,6 +326,7 @@ zstd = "0.13.3"

 # Observability and Metrics
 metrics = "0.24.6"
+metrics-util = "0.20"
 dial9-tokio-telemetry = "0.3"
 opentelemetry = { version = "0.32.0" }
 opentelemetry-appender-tracing = { version = "0.32.0" }
@@ -339,7 +340,7 @@ pyroscope = { version = "2.1.1" }
 # FTP and SFTP
 libunftp = { version = "0.23.0" }
 unftp-core = "0.1.0"
-suppaftp = { version = "10.0.1" }
+suppaftp = { version = "10.0.2" }
 rcgen = { version = "0.14.9", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
 russh = { version = "0.62.7" }
 russh-sftp = "2.4.0"
@@ -116,7 +116,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.2
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.3
 ```

 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command
@@ -113,7 +113,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.2
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.3
 ```

 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：
@@ -236,12 +236,19 @@ async fn audit_pipeline_reports_empty_runtime_snapshots() {
 }

 #[tokio::test]
-async fn audit_runtime_facade_stops_empty_replay_workers() {
+async fn stopping_audit_replay_workers_is_a_no_op_when_there_are_none() {
    let registry = Arc::new(Mutex::new(AuditRegistry::new()));
    let replay_workers = Arc::new(RwLock::new(rustfs_targets::ReplayWorkerManager::new()));
-    let facade = AuditRuntimeFacade::new(registry, replay_workers);
+    let facade = AuditRuntimeFacade::new(registry, Arc::clone(&replay_workers));

    facade.stop_replay_workers().await;
+
+    // The stop path takes the manager's workers and hands them to the adapter,
+    // so an empty facade must leave it empty rather than wedge it, and a second
+    // call — which shutdown paths make — must stay harmless (rustfs/backlog#1836).
+    assert!(replay_workers.read().await.is_empty());
+    facade.stop_replay_workers().await;
+    assert!(replay_workers.read().await.is_empty());
 }

 #[tokio::test]
@@ -44,7 +44,6 @@ metrics = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 smallvec = { workspace = true }
 rmp-serde = { workspace = true }
-s3s = { workspace = true, features = ["minio"] }
 tracing = { workspace = true }

 [dev-dependencies]
@@ -12,7 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-use s3s::dto::{BucketLifecycleConfiguration, ExpirationStatus, LifecycleRule, ReplicationConfiguration, ReplicationRuleStatus};
 use serde::{Deserialize, Serialize};
 use std::{
    fmt::{self, Display},
@@ -633,104 +632,6 @@ pub fn create_heal_response(
    }
 }

-fn lc_get_prefix(rule: &LifecycleRule) -> String {
-    if let Some(p) = &rule.prefix {
-        return p.to_string();
-    } else if let Some(filter) = &rule.filter {
-        if let Some(p) = &filter.prefix {
-            return p.to_string();
-        } else if let Some(and) = &filter.and
-            && let Some(p) = &and.prefix
-        {
-            return p.to_string();
-        }
-    }
-
-    "".into()
-}
-
-pub fn lc_has_active_rules(config: &BucketLifecycleConfiguration, prefix: &str) -> bool {
-    if config.rules.is_empty() {
-        return false;
-    }
-
-    for rule in config.rules.iter() {
-        if rule.status == ExpirationStatus::from_static(ExpirationStatus::DISABLED) {
-            continue;
-        }
-        let rule_prefix = lc_get_prefix(rule);
-        if !prefix.is_empty() && !rule_prefix.is_empty() && !prefix.starts_with(&rule_prefix) && !rule_prefix.starts_with(prefix)
-        {
-            continue;
-        }
-
-        if let Some(e) = &rule.noncurrent_version_expiration {
-            if e.noncurrent_days.is_some() {
-                return true;
-            }
-            if let Some(true) = e.newer_noncurrent_versions.map(|d| d > 0) {
-                return true;
-            }
-        }
-
-        if rule.noncurrent_version_transitions.is_some() {
-            return true;
-        }
-        if let Some(true) = rule.expiration.as_ref().map(|e| e.date.is_some()) {
-            return true;
-        }
-
-        if let Some(true) = rule.expiration.as_ref().map(|e| e.days.is_some()) {
-            return true;
-        }
-
-        if let Some(Some(true)) = rule.expiration.as_ref().map(|e| e.expired_object_delete_marker) {
-            return true;
-        }
-
-        if let Some(true) = rule.transitions.as_ref().map(|t| !t.is_empty()) {
-            return true;
-        }
-
-        if rule.transitions.is_some() {
-            return true;
-        }
-    }
-    false
-}
-
-pub fn rep_has_active_rules(config: &ReplicationConfiguration, prefix: &str, recursive: bool) -> bool {
-    if config.rules.is_empty() {
-        return false;
-    }
-
-    for rule in config.rules.iter() {
-        if rule
-            .status
-            .eq(&ReplicationRuleStatus::from_static(ReplicationRuleStatus::DISABLED))
-        {
-            continue;
-        }
-        if !prefix.is_empty()
-            && let Some(filter) = &rule.filter
-            && let Some(r_prefix) = &filter.prefix
-            && !r_prefix.is_empty()
-        {
-            // incoming prefix must be in rule prefix
-            if !recursive && !prefix.starts_with(r_prefix) {
-                continue;
-            }
-            // If recursive, we can skip this rule if it doesn't match the tested prefix or level below prefix
-            // does not match
-            if recursive && !r_prefix.starts_with(prefix) && !prefix.starts_with(r_prefix) {
-                continue;
-            }
-        }
-        return true;
-    }
-    false
-}
-
 pub async fn send_heal_disk(set_disk_id: String, priority: Option<HealChannelPriority>) -> Result<(), String> {
    let req = HealChannelRequest {
        id: Uuid::new_v4().to_string(),
@@ -13,82 +13,6 @@
 // limitations under the License.

 use std::time::{Duration, SystemTime, UNIX_EPOCH};
-
-#[allow(dead_code)]
-#[derive(Debug, Default)]
-struct TimedAction {
-    count: u64,
-    acc_time: u64,
-    min_time: Option<u64>,
-    max_time: Option<u64>,
-    bytes: u64,
-}
-
-#[allow(dead_code)]
-impl TimedAction {
-    // Avg returns the average time spent on the action.
-    pub fn avg(&self) -> Option<Duration> {
-        if self.count == 0 {
-            return None;
-        }
-        Some(Duration::from_nanos(self.acc_time / self.count))
-    }
-
-    // AvgBytes returns the average bytes processed.
-    pub fn avg_bytes(&self) -> u64 {
-        if self.count == 0 {
-            return 0;
-        }
-        self.bytes / self.count
-    }
-
-    // Merge other into t.
-    pub fn merge(&mut self, other: TimedAction) {
-        self.count += other.count;
-        self.acc_time += other.acc_time;
-        self.bytes += other.bytes;
-
-        if self.count == 0 {
-            self.min_time = other.min_time;
-        }
-        if let Some(other_min) = other.min_time {
-            self.min_time = self.min_time.map_or(Some(other_min), |min| Some(min.min(other_min)));
-        }
-
-        self.max_time = self
-            .max_time
-            .map_or(other.max_time, |max| Some(max.max(other.max_time.unwrap_or(0))));
-    }
-}
-
-#[allow(dead_code)]
-#[derive(Debug)]
-enum SizeCategory {
-    SizeLessThan1KiB = 0,
-    SizeLessThan1MiB,
-    SizeLessThan10MiB,
-    SizeLessThan100MiB,
-    SizeLessThan1GiB,
-    SizeGreaterThan1GiB,
-    // Add new entries here
-    SizeLastElemMarker,
-}
-
-impl std::fmt::Display for SizeCategory {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        let s = match *self {
-            SizeCategory::SizeLessThan1KiB => "SizeLessThan1KiB",
-            SizeCategory::SizeLessThan1MiB => "SizeLessThan1MiB",
-            SizeCategory::SizeLessThan10MiB => "SizeLessThan10MiB",
-            SizeCategory::SizeLessThan100MiB => "SizeLessThan100MiB",
-            SizeCategory::SizeLessThan1GiB => "SizeLessThan1GiB",
-            SizeCategory::SizeGreaterThan1GiB => "SizeGreaterThan1GiB",
-            SizeCategory::SizeLastElemMarker => "SizeLastElemMarker",
-        };
-        write!(f, "{s}")
-    }
-}
-
 #[derive(Clone, Debug, Default, Copy)]
 pub struct AccElem {
    pub total: u64,
@@ -729,7 +729,7 @@ fn timestamp_elapsed_seconds_since(now: Timestamp, earlier: Timestamp) -> u64 {
        return 0;
    }

-    u64::try_from(duration.as_secs()).map_or(u64::MAX, |seconds| seconds)
+    u64::try_from(duration.as_secs()).unwrap_or(u64::MAX)
 }

 #[derive(Clone, Copy, Debug, Default)]
@@ -781,6 +781,19 @@ struct ScannerBucketDriveResultValue {
    last_seen: u64,
 }

+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+struct ScannerActiveBucketDriveKey {
+    source: String,
+    bucket: String,
+    drive: String,
+}
+
+#[derive(Clone, Copy, Debug)]
+struct ScannerActiveBucketDriveValue {
+    count: u64,
+    started_at: Timestamp,
+}
+
 // ---------------------------------------------------------------------------
 // Metrics
 // ---------------------------------------------------------------------------
@@ -813,6 +826,7 @@ pub struct Metrics {
    scanner_set_scans_active: AtomicU64,
    scanner_disk_bucket_scan_states: Mutex<HashMap<ScannerDiskBucketScanKey, ScannerDiskBucketScanState>>,
    scanner_bucket_drive_results: Mutex<ScannerBucketDriveResults>,
+    scanner_active_bucket_drive_scans: Mutex<HashMap<ScannerActiveBucketDriveKey, ScannerActiveBucketDriveValue>>,
    scanner_bucket_drive_result_clock: AtomicU64,
    current_scan_cycle_bucket_drive_results_start: Mutex<HashMap<ScannerBucketDriveResultKey, u64>>,
    last_scan_cycle_bucket_drive_results: Mutex<Vec<ScannerBucketDriveResultSnapshot>>,
@@ -1045,6 +1059,15 @@ pub struct ScannerBucketDriveResultSnapshot {
    pub count: u64,
 }

+#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ScannerActiveBucketDriveSnapshot {
+    pub source: String,
+    pub bucket: String,
+    pub drive: String,
+    pub count: u64,
+    pub age_seconds: u64,
+}
+
 #[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
 pub struct ScannerReplicationRepairSnapshot {
    pub source: String,
@@ -1387,6 +1410,8 @@ pub struct ScannerRuntimeDetailsReport {
    pub current_cycle_bucket_drive_results: Vec<ScannerBucketDriveResultSnapshot>,
    #[serde(default)]
    pub last_cycle_bucket_drive_results: Vec<ScannerBucketDriveResultSnapshot>,
+    #[serde(default)]
+    pub active_bucket_drive_scans: Vec<ScannerActiveBucketDriveSnapshot>,
 }

 impl CurrentCycle {
@@ -1401,25 +1426,11 @@ impl CurrentCycle {
 }

 /// OTEL metric name constants for scanner metrics
-const OTEL_SCANNER_OBJECTS_SCANNED: &str = "rustfs_scanner_objects_scanned_total";
-const OTEL_SCANNER_DIRECTORIES_SCANNED: &str = "rustfs_scanner_directories_scanned_total";
 const OTEL_SCANNER_BUCKETS_SCANNED: &str = "rustfs_scanner_buckets_scanned_total";
 const OTEL_SCANNER_CYCLES: &str = "rustfs_scanner_cycles_total";
 const OTEL_SCANNER_CYCLE_DURATION_SECONDS: &str = "rustfs_scanner_cycle_duration_seconds";
 const OTEL_SCANNER_BUCKET_DRIVE_DURATION_SECONDS: &str = "rustfs_scanner_bucket_drive_duration_seconds";

-fn emit_otel_counter(metric: usize, count: u64) {
-    match Metric::from_index(metric) {
-        Some(Metric::ScanObject) => {
-            metrics::counter!(OTEL_SCANNER_OBJECTS_SCANNED).increment(count);
-        }
-        Some(Metric::ScanFolder) => {
-            metrics::counter!(OTEL_SCANNER_DIRECTORIES_SCANNED).increment(count);
-        }
-        _ => {}
-    }
-}
-
 fn scan_cycle_result_label(result: u8) -> &'static str {
    match result {
        SCAN_CYCLE_RESULT_SUCCESS => SCAN_CYCLE_RESULT_SUCCESS_LABEL,
@@ -1760,7 +1771,7 @@ pub fn emit_scan_cycle_deferred(duration: Duration) {
    metrics::counter!(OTEL_SCANNER_CYCLES, "result" => SCAN_CYCLE_RESULT_DEFERRED_LABEL).increment(1);
 }

-pub fn emit_scan_bucket_drive_complete(success: bool, bucket: &str, disk: &str, duration: Duration) {
+pub fn emit_scan_bucket_drive_complete(_source: ScannerWorkSource, success: bool, bucket: &str, disk: &str, duration: Duration) {
    let result = if success { "success" } else { "error" };
    global_metrics().record_scanner_bucket_drive_result(bucket, disk, result);
    metrics::counter!(
@@ -1778,7 +1789,7 @@ pub fn emit_scan_bucket_drive_complete(success: bool, bucket: &str, disk: &str,
    .record(duration.as_secs_f64());
 }

-pub fn emit_scan_bucket_drive_partial(bucket: &str, disk: &str, duration: Duration) {
+pub fn emit_scan_bucket_drive_partial(_source: ScannerWorkSource, bucket: &str, disk: &str, duration: Duration) {
    global_metrics().record_scanner_bucket_drive_result(bucket, disk, SCAN_CYCLE_RESULT_PARTIAL_LABEL);
    metrics::counter!(
        OTEL_SCANNER_BUCKETS_SCANNED,
@@ -1831,6 +1842,7 @@ impl Metrics {
            scanner_set_scans_active: AtomicU64::new(0),
            scanner_disk_bucket_scan_states: Mutex::new(HashMap::new()),
            scanner_bucket_drive_results: Mutex::new(ScannerBucketDriveResults::default()),
+            scanner_active_bucket_drive_scans: Mutex::new(HashMap::new()),
            scanner_bucket_drive_result_clock: AtomicU64::new(0),
            current_scan_cycle_bucket_drive_results_start: Mutex::new(HashMap::new()),
            last_scan_cycle_bucket_drive_results: Mutex::new(Vec::new()),
@@ -1960,7 +1972,6 @@ impl Metrics {
            let duration = SystemTime::now().duration_since(start).unwrap_or_default();
            global_metrics().operations[metric_idx].fetch_add(1, Ordering::Relaxed);
            global_metrics().record_source_work_for_metric(metric, 1);
-            emit_otel_counter(metric_idx, 1);
            if metric_idx < Metric::LastRealtime as usize {
                global_metrics().latency[metric_idx].add(duration);
            }
@@ -1976,7 +1987,6 @@ impl Metrics {
            let duration = SystemTime::now().duration_since(start).unwrap_or_default();
            global_metrics().operations[metric_idx].fetch_add(1, Ordering::Relaxed);
            global_metrics().record_source_work_for_metric(metric, 1);
-            emit_otel_counter(metric_idx, 1);
            if metric_idx < Metric::LastRealtime as usize {
                global_metrics().latency[metric_idx].add_size(duration, size);
            }
@@ -1992,7 +2002,6 @@ impl Metrics {
            let duration = SystemTime::now().duration_since(start).unwrap_or_default();
            global_metrics().operations[metric_idx].fetch_add(1, Ordering::Relaxed);
            global_metrics().record_source_work_for_metric(metric, 1);
-            emit_otel_counter(metric_idx, 1);
            if metric_idx < Metric::LastRealtime as usize {
                global_metrics().latency[metric_idx].add(duration);
            }
@@ -2010,7 +2019,6 @@ impl Metrics {
                let count = usize_to_u64_saturated(count);
                global_metrics().operations[metric_idx].fetch_add(count, Ordering::Relaxed);
                global_metrics().record_source_work_for_metric(metric, count);
-                emit_otel_counter(metric_idx, count);
                if metric_idx < Metric::LastRealtime as usize {
                    global_metrics().latency[metric_idx].add(duration);
                }
@@ -2031,7 +2039,6 @@ impl Metrics {
                let duration = SystemTime::now().duration_since(start).unwrap_or_default();
                let metric_idx = Metric::Ilm as usize;
                global_metrics().operations[metric_idx].fetch_add(versions, Ordering::Relaxed);
-                emit_otel_counter(metric_idx, versions);
                global_metrics().actions[a_idx].fetch_add(versions, Ordering::Relaxed);
                global_metrics().actions_latency[a_idx].add(duration);
            })
@@ -2044,7 +2051,6 @@ impl Metrics {
        let metric_idx = metric as usize;
        global_metrics().operations[metric_idx].fetch_add(1, Ordering::Relaxed);
        global_metrics().record_source_work_for_metric(metric, 1);
-        emit_otel_counter(metric_idx, 1);
        if metric_idx < Metric::LastRealtime as usize {
            global_metrics().latency[metric_idx].add(duration);
        }
@@ -2328,8 +2334,45 @@ impl Metrics {
        }
    }

-    pub fn record_scan_bucket_drive_start(&self) {
+    pub fn record_scan_bucket_drive_start(&self, source: ScannerWorkSource, bucket: &str, drive: &str) {
        self.operations[Metric::ScanBucketDriveStart as usize].fetch_add(1, Ordering::Relaxed);
+        if bucket.is_empty() || drive.is_empty() {
+            return;
+        }
+        let key = ScannerActiveBucketDriveKey {
+            source: source.as_str().to_string(),
+            bucket: bucket.to_string(),
+            drive: drive.to_string(),
+        };
+        let mut active = self
+            .scanner_active_bucket_drive_scans
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        active
+            .entry(key)
+            .and_modify(|value| value.count = value.count.saturating_add(1))
+            .or_insert(ScannerActiveBucketDriveValue {
+                count: 1,
+                started_at: Timestamp::now(),
+            });
+    }
+
+    pub fn record_scan_bucket_drive_end(&self, source: ScannerWorkSource, bucket: &str, drive: &str) {
+        let key = ScannerActiveBucketDriveKey {
+            source: source.as_str().to_string(),
+            bucket: bucket.to_string(),
+            drive: drive.to_string(),
+        };
+        let mut active = self
+            .scanner_active_bucket_drive_scans
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        if let Some(value) = active.get_mut(&key) {
+            value.count = value.count.saturating_sub(1);
+            if value.count == 0 {
+                active.remove(&key);
+            }
+        }
    }

    pub fn record_scan_bucket_drive_failure(&self) {
@@ -2802,6 +2845,26 @@ impl Metrics {
        } else {
            Vec::new()
        };
+        let now = Timestamp::now();
+        let mut active_bucket_drive_scans = self
+            .scanner_active_bucket_drive_scans
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .iter()
+            .map(|(key, value)| ScannerActiveBucketDriveSnapshot {
+                source: key.source.clone(),
+                bucket: key.bucket.clone(),
+                drive: key.drive.clone(),
+                count: value.count,
+                age_seconds: timestamp_elapsed_seconds_since(now, value.started_at),
+            })
+            .collect::<Vec<_>>();
+        active_bucket_drive_scans.sort_by(|left, right| {
+            left.source
+                .cmp(&right.source)
+                .then_with(|| left.bucket.cmp(&right.bucket))
+                .then_with(|| left.drive.cmp(&right.drive))
+        });
        ScannerRuntimeDetailsReport {
            disk_bucket_scan_states: self.scanner_disk_bucket_scan_state_snapshots(),
            bucket_drive_results: self.scanner_bucket_drive_result_counter_snapshots(),
@@ -2811,6 +2874,7 @@ impl Metrics {
                .lock()
                .unwrap_or_else(|poisoned| poisoned.into_inner())
                .clone(),
+            active_bucket_drive_scans,
        }
    }

@@ -4391,7 +4455,7 @@ mod tests {
    #[tokio::test]
    async fn report_includes_bucket_drive_scan_starts() {
        let metrics = Metrics::new();
-        metrics.record_scan_bucket_drive_start();
+        metrics.record_scan_bucket_drive_start(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
        metrics.record_scan_bucket_drive_failure();

        let report = metrics.report().await;
@@ -4400,6 +4464,27 @@ mod tests {
        assert_eq!(report.life_time_ops.get("scan_bucket_drive_failure"), Some(&1));
    }

+    #[tokio::test]
+    async fn active_bucket_drive_snapshot_is_structured_and_retired_on_end() {
+        let metrics = Metrics::new();
+        metrics.record_scan_bucket_drive_start(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
+        metrics.record_scan_bucket_drive_start(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
+        let active = metrics.scanner_runtime_details_report().active_bucket_drive_scans;
+        assert_eq!(active.len(), 1);
+        assert_eq!(active[0].source, ScannerWorkSource::Usage.as_str());
+        assert_eq!(active[0].bucket, "bucket-a");
+        assert_eq!(active[0].drive, "/mnt/data/1");
+        assert_eq!(active[0].count, 2);
+
+        metrics.record_scan_bucket_drive_end(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
+        assert_eq!(metrics.scanner_runtime_details_report().active_bucket_drive_scans[0].count, 1);
+        metrics.record_scan_bucket_drive_end(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
+        assert!(metrics.scanner_runtime_details_report().active_bucket_drive_scans.is_empty());
+
+        metrics.record_scan_bucket_drive_start(ScannerWorkSource::Usage, "", "/mnt/data/1");
+        assert!(metrics.scanner_runtime_details_report().active_bucket_drive_scans.is_empty());
+    }
+
    #[tokio::test]
    async fn report_includes_structured_bucket_drive_results() {
        let metrics = Metrics::new();
@@ -148,6 +148,62 @@ fn unix_now_ms() -> u64 {
        .unwrap_or(0)
 }

+/// A repair the MRF consumer landed, fanned out so retry ledgers can drop
+/// entries the journal no longer tracks (backlog#1894 axis B). The payload
+/// mirrors the intent identity so consumers match without re-parsing.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MrfRepairedEvent {
+    pub bucket: Arc<str>,
+    pub object: Arc<str>,
+    pub version_id: Option<[u8; 16]>,
+}
+
+/// Bound on the repaired-event backlog. Notices are best-effort hints; when
+/// the ring is full the oldest are dropped and the affected ledger entries
+/// simply expire through their own attempts/age limits.
+const MRF_REPAIRED_EVENT_CAP: usize = 4096;
+
+static MRF_REPAIRED_EVENTS: OnceLock<std::sync::Mutex<std::collections::VecDeque<MrfRepairedEvent>>> = OnceLock::new();
+
+/// Record that the MRF consumer landed a repair. Never blocks: the critical
+/// section is a deque push under a std mutex.
+pub fn note_mrf_repaired(bucket: &str, object: &str, version_id: Option<[u8; 16]>) {
+    let registry = MRF_REPAIRED_EVENTS.get_or_init(|| std::sync::Mutex::new(std::collections::VecDeque::new()));
+    let Ok(mut events) = registry.lock() else {
+        return;
+    };
+    if events.len() >= MRF_REPAIRED_EVENT_CAP {
+        events.pop_front();
+    }
+    events.push_back(MrfRepairedEvent {
+        bucket: Arc::from(bucket),
+        object: Arc::from(object),
+        version_id,
+    });
+}
+
+/// Take the repair notices recorded for `bucket`, leaving other buckets'
+/// notices in place for their own scanners.
+pub fn take_mrf_repaired_events_for(bucket: &str) -> Vec<MrfRepairedEvent> {
+    let Some(registry) = MRF_REPAIRED_EVENTS.get() else {
+        return Vec::new();
+    };
+    let Ok(mut events) = registry.lock() else {
+        return Vec::new();
+    };
+    let mut taken = Vec::new();
+    let mut retained = std::collections::VecDeque::with_capacity(events.len());
+    while let Some(event) = events.pop_front() {
+        if event.bucket.as_ref() == bucket {
+            taken.push(event);
+        } else {
+            retained.push_back(event);
+        }
+    }
+    *events = retained;
+    taken
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -200,4 +256,32 @@ mod tests {
        assert!(!try_send_mrf_intent(MrfKind::MetadataCorruption, "b", "o", None));
        set_mrf_delivery_enabled(true);
    }
+
+    #[test]
+    fn repaired_events_take_is_bucket_scoped_and_cap_bounded() {
+        // Distinct buckets keep their notices until their own scanner takes
+        // them; a take for one bucket leaves the others' notices in place.
+        note_mrf_repaired("bucket-a", "object-1", None);
+        note_mrf_repaired("bucket-b", "object-2", None);
+        note_mrf_repaired("bucket-a", "object-3", None);
+
+        let taken_a = take_mrf_repaired_events_for("bucket-a");
+        assert_eq!(taken_a.len(), 2);
+        assert_eq!(taken_a[0].object.as_ref(), "object-1");
+        assert_eq!(taken_a[1].object.as_ref(), "object-3");
+        assert!(take_mrf_repaired_events_for("bucket-a").is_empty(), "take is destructive per bucket");
+
+        let taken_b = take_mrf_repaired_events_for("bucket-b");
+        assert_eq!(taken_b.len(), 1);
+        assert_eq!(taken_b[0].object.as_ref(), "object-2");
+
+        // Cap bound: flooding the ring drops the oldest notices rather than
+        // growing unbounded.
+        for i in 0..=(MRF_REPAIRED_EVENT_CAP + 8) {
+            note_mrf_repaired("flood-bucket", &format!("object-{i}"), None);
+        }
+        let flooded = take_mrf_repaired_events_for("flood-bucket");
+        assert_eq!(flooded.len(), MRF_REPAIRED_EVENT_CAP);
+        assert_eq!(flooded[0].object.as_ref(), "object-9", "the oldest notices past the cap are dropped");
+    }
 }
@@ -115,6 +115,15 @@ Current guidance:
  - enables KMS readiness enforcement for `/health/ready`.
  - default is `false`.

+## Object lock admission environment variables
+
+- `RUSTFS_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS`
+  - experimental same-object PUT commit namespace-lock admission budget.
+  - default is `0`, which disables this override and keeps `RUSTFS_OBJECT_LOCK_ACQUIRE_TIMEOUT` behavior.
+  - when set, only `put_object_commit` write-lock acquisition is bounded by this millisecond budget; other namespace lock users keep the global object-lock timeout.
+  - timeout returns S3 `SlowDown`, so clients should use normal SDK retry handling.
+  - this is not a fdatasync or group-commit switch. Track fdatasync batching separately with `rustfs_s3_put_object_rename_fdatasync_batch_files`.
+
 ## Drive timeout environment variables

 - `RUSTFS_DRIVE_METADATA_TIMEOUT_SECS`
@@ -427,6 +427,19 @@ pub const ENV_OBJECT_LOCK_ACQUIRE_TIMEOUT: &str = "RUSTFS_OBJECT_LOCK_ACQUIRE_TI
 /// Default lock acquisition timeout: 5 seconds.
 pub const DEFAULT_OBJECT_LOCK_ACQUIRE_TIMEOUT: u64 = 5;

+/// Environment variable for the experimental PUT commit namespace lock acquire timeout in milliseconds.
+///
+/// A value of `0` disables the experiment and keeps
+/// `RUSTFS_OBJECT_LOCK_ACQUIRE_TIMEOUT` as the timeout. This only bounds the
+/// `put_object_commit` namespace write-lock wait and is intended for #925
+/// tail-drain admission experiments.
+///
+/// Default: 0 milliseconds (disabled).
+pub const ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS: &str = "RUSTFS_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS";
+
+/// Default: PUT commit namespace lock acquire timeout override is disabled.
+pub const DEFAULT_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS: u64 = 0;
+
 /// Environment variable for remote namespace lock RPC transport timeout in milliseconds.
 ///
 /// This timeout bounds the internode RPC call itself. It is intentionally
@@ -228,15 +228,6 @@ pub const DEFAULT_SCANNER_MAX_CONCURRENT_DISK_SCANS: usize = 4;
 /// Default object interval for cooperative scanner yields.
 pub const DEFAULT_SCANNER_YIELD_EVERY_N_OBJECTS: u64 = 128;

-/// Compatibility flag kept for Patch 3 rollback windows.
-///
-/// Inline scanner heal execution has been removed in favor of heal-candidate enqueue.
-/// When this flag is enabled, RustFS logs a warning and continues to use enqueue-based heal.
-pub const ENV_SCANNER_INLINE_HEAL_ENABLE: &str = "RUSTFS_SCANNER_INLINE_HEAL_ENABLE";
-
-/// Default inline scanner heal compatibility mode.
-pub const DEFAULT_SCANNER_INLINE_HEAL_ENABLE: bool = false;
-
 /// Scanner speed preset controlling throttling behavior.
 ///
 /// Each preset defines three parameters:
@@ -92,15 +92,11 @@ pub const NOTIFY_SUB_SYSTEMS: &[&str] = &[
 pub const NOTIFY_KAFKA_SUB_SYS: &str = "notify_kafka";
 pub const NOTIFY_MQTT_SUB_SYS: &str = "notify_mqtt";
 pub const NOTIFY_MYSQL_SUB_SYS: &str = "notify_mysql";
-#[allow(dead_code)]
 pub const NOTIFY_NATS_SUB_SYS: &str = "notify_nats";
-#[allow(dead_code)]
 pub const NOTIFY_NSQ_SUB_SYS: &str = "notify_nsq";
-#[allow(dead_code)]
 pub const NOTIFY_ES_SUB_SYS: &str = "notify_elasticsearch";
 pub const NOTIFY_AMQP_SUB_SYS: &str = "notify_amqp";
 pub const NOTIFY_POSTGRES_SUB_SYS: &str = "notify_postgres";
-#[allow(dead_code)]
 pub const NOTIFY_REDIS_SUB_SYS: &str = "notify_redis";
 pub const NOTIFY_REDIS_DEFAULT_CHANNEL: &str = "rustfs_notify_channel";
 pub const NOTIFY_PULSAR_SUB_SYS: &str = "notify_pulsar";
@@ -48,16 +48,14 @@ cargo nextest run --profile e2e-smoke -p e2e_test
 cargo nextest run -j1 --run-ignored ignored-only -p rustfs-scanner -p rustfs \
  -E 'binary(lifecycle_integration_test) or (package(rustfs) and test(lifecycle_transition_api_test))'

-# Protocols suite — fixed ports, MUST be single-threaded, gated by build features
-RUSTFS_BUILD_FEATURES=ftps,webdav,sftp \
-  cargo test -p e2e_test test_protocol_core_suite -- --test-threads=1 --nocapture
 ```

 The protocols suite has its own contract (fixed bind ports 9022–9301,
-`--test-threads=1`, feature-gated scheduling) documented in
+single-worker execution, feature-gated scheduling) documented in
 [`src/protocols/README.md`](src/protocols/README.md). `RUSTFS_BUILD_FEATURES`
 selects which features the spawned binary is built with; leave it unset to run
-every protocol entry.
+every protocol entry. Use the exact profile command under
+[Troubleshooting](#troubleshooting) for CI-equivalent execution.

 ### `#[ignore]` semantics

@@ -159,27 +157,26 @@ construction (random port + isolated temp dir) and need no serialization.
 ## CI map

 `e2e_test` is **excluded** from the main `cargo nextest run --profile ci --all`
-pass ([`.github/workflows/ci.yml`](../../.github/workflows/ci.yml) line 158,
-`--exclude e2e_test`) — the whole crate is too slow to gate every PR. Subsets
-join CI through the nextest profile system only (never as ad-hoc jobs):
+pass (`--exclude e2e_test`) — the whole crate is too slow to gate every PR.
+Subsets join CI through nextest profiles; the fixed-port protocol suite uses
+the same profile for membership and execution with one nightly worker.

 | Suite | Runs where | Status |
 | --- | --- | --- |
 | Smoke subset (`e2e-smoke` profile) | `e2e-tests` job, every PR | **Active** (backlog#1149 ci-4) |
+| Full single-node suite (`e2e-full` profile) | `e2e-full` job, merge queue + main | **Active** (backlog#1149 ci-5) |
 | `s3s-e2e` black-box | `e2e-tests` + `e2e-tests-rio-v2` jobs | **Active** (external conformance tool) |
 | ILM / lifecycle (ignored) | `test-ilm-integration-serial` lane, `-j1` | **Active** (backlog#1148 ilm-1) |
-| KMS suite | — | Not in CI yet (backlog#1149 ci-5) |
-| Protocols (FTPS/WebDAV/SFTP) | — | Not in CI yet (backlog#1149 ci-7) |
+| KMS suite | `e2e-full` job, merge queue + main | **Active** |
+| Cluster faults (`e2e-nightly` profile) | consolidated nightly workflow | **Active** (backlog#1149 ci-7) |
+| Protocols (FTPS/WebDAV/SFTP) | consolidated nightly workflow, serial | **Active** (backlog#1149 ci-7) |
 | Replication (fast subset) | `e2e-smoke` profile, `e2e-tests` job, every PR | **Active** (backlog#1147 repl-1) |
-| Replication (slow + dual-node) | `e2e-repl-nightly` profile, scheduled workflow | **Active** (backlog#1147 repl-1) |
-| `reliant/*` (pre-started server) | — | Manual only |
+| Replication (slow + multi-node) | `e2e-repl-nightly` profile, consolidated nightly workflow | **Active** (backlog#1147 repl-1) |
+| `reliant/*` | 19 tests in PR smoke; remaining default tests in `e2e-full` | **Active** except `#[ignore]` |

-Links: [`ci.yml`](../../.github/workflows/ci.yml) `e2e-tests` (line 347),
-`test-ilm-integration-serial` (line 196). The `e2e-smoke` `default-filter` in
-[`.config/nextest.toml`](../../.config/nextest.toml) is the **single wiring
-mechanism** — extend that filter (or add a sibling profile) to admit more
-tests; do not add e2e jobs to `ci.yml`. repl-1 / ilm-3 are landing in parallel
-and may add lanes; keep the table above easy to extend.
+The profile filters in [`.config/nextest.toml`](../../.config/nextest.toml) are
+the wiring source of truth. Committed test-ID digests under
+`.config/e2e-*-selection.txt` make every membership change explicit.

 ## Troubleshooting

@@ -188,9 +185,15 @@ and may add lanes; keep the table above easy to extend.
 ```bash
 # Smoke (e2e-tests job) — includes the 20 fast replication tests
 cargo nextest run --profile e2e-smoke -p e2e_test
-# Replication nightly lane (16 slow + dual-node tests; install awscurl for the
-# STS dual-node test, else it skips gracefully)
+# Full single-node merge/main lane
+cargo nextest run --profile e2e-full -p e2e_test
+# Cluster fault nightly lane
+cargo nextest run --profile e2e-nightly -p e2e_test
+# Replication nightly lane; install awscurl so STS paths do not skip
 cargo nextest run --profile e2e-repl-nightly -p e2e_test
+# Fixed-port protocol nightly lane
+RUSTFS_BUILD_FEATURES=ftps,webdav,sftp \
+  cargo nextest run -j 1 --profile e2e-protocols -p e2e_test --no-capture
 # ILM serial lane
 cargo nextest run -j1 --run-ignored ignored-only -p rustfs-scanner -p rustfs \
  -E 'binary(lifecycle_integration_test) or (package(rustfs) and test(lifecycle_transition_api_test))'
@@ -273,4 +276,6 @@ current subset is.
 `docs/testing/e2e-suite-inventory.md` records the per-module test counts as
 listed by `cargo nextest list -p e2e_test`. Regenerate it when adding or
 moving e2e tests so acceptance numbers in the test-strategy issues
-(backlog#1147–#1155) stay auditable.
+(backlog#1147–#1155) stay auditable. When a profile membership change is
+intentional, review its JSON listing before updating the matching
+`.config/e2e-*-selection.txt` test-ID digest.
@@ -53,7 +53,8 @@ pub(crate) const FAST_DATA_USAGE_SCANNER_ENV: &[(&str, &str)] =
 pub const TEST_BUCKET: &str = "e2e-test-bucket";
 const RUSTFS_FULL_FEATURE: &str = "full";
 const TEST_PORT_MIN: u16 = 20_000;
-const TEST_PORT_RANGE: u16 = 40_000;
+// Keep allocator ports below the ephemeral range used by bind(..., 0) test helpers.
+const TEST_PORT_RANGE: u16 = 10_000;
 const TEST_PORT_COUNTER_PATH: &str = "/tmp/rustfs_e2e_next_port";
 const TEST_PORT_LOCK_DIR: &str = "/tmp/rustfs_e2e_port_allocator.lock";
 const TEST_PORT_LOCK_STALE_AFTER: Duration = Duration::from_secs(30);
@@ -6,9 +6,6 @@ use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
 use std::fs;
 use std::path::PathBuf;
 use std::process::Command;
-use std::time::Duration;
-use tokio::net::TcpStream;
-use tokio::time::sleep;
 use tracing::info;

 const COMPRESSION_TEST_BUCKET: &str = "compression-test-bucket";
@@ -87,17 +84,7 @@ async fn start_rustfs_with_compression(env: &mut RustFSTestEnvironment) -> Resul
    env.process = Some(process);

    info!("Waiting for RustFS server with compression enabled on {}", env.address);
-    for i in 0..30 {
-        if TcpStream::connect(&env.address).await.is_ok() {
-            info!("RustFS server is ready after {} attempts", i + 1);
-            return Ok(());
-        }
-        if i == 29 {
-            return Err("RustFS server failed to become ready".into());
-        }
-        sleep(Duration::from_secs(1)).await;
-    }
-    Ok(())
+    env.wait_for_server_ready().await
 }

 #[tokio::test]
@@ -666,17 +653,7 @@ async fn start_rustfs_with_compression_and_sse(
    env.process = Some(process);

    info!("Waiting for RustFS server with compression + SSE-S3 enabled on {}", env.address);
-    for i in 0..30 {
-        if TcpStream::connect(&env.address).await.is_ok() {
-            info!("RustFS server is ready after {} attempts", i + 1);
-            return Ok(());
-        }
-        if i == 29 {
-            return Err("RustFS server failed to become ready".into());
-        }
-        sleep(Duration::from_secs(1)).await;
-    }
-    Ok(())
+    env.wait_for_server_ready().await
 }

 /// SSE-S3 + disk compression multipart: each part is compressed and then encrypted, and every GET
@@ -0,0 +1,250 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! E2E proof that a mid-stream GET failure is *reportable* — rustfs#4784.
+//!
+//! The functional invariant (a beyond-quorum read must fail rather than return
+//! a clean short body) is already covered by
+//! `degraded_read_eof_regression_test`. This suite covers the half that issue
+//! #4784 got stuck on for a month: whether an operator can tell, from the
+//! source server's log alone, that a GET failed mid-body and **which object**
+//! it failed on.
+//!
+//! The reporter saw only downstream symptoms — `rclone` reporting
+//! `unexpected EOF` on its PUT, and the receiving RustFS logging
+//! `Io error: error reading a body from connection` with a 500. In a cross-remote
+//! `rclone sync`, the source GET body *is* the destination PUT body, so a source
+//! read that ends short of its committed `Content-Length` surfaces as a PUT
+//! failure on the far side. Built-in replication and site replication have the
+//! same shape (read locally, PUT remotely), which is why every transport in that
+//! report failed the same way.
+//!
+//! The source side, meanwhile, said nothing:
+//!   * `GetObjectReaderStream`'s short-read and read-error arms only incremented
+//!     a metric; their log lines sat behind the `tracing-chunk-debug` cargo
+//!     feature, which is not in the default feature set and therefore is not
+//!     compiled into any released binary.
+//!   * `GetObjectStreamingReader` did log mid-stream failures, but only under a
+//!     `request_id` — with no bucket or object name, a failure could not be
+//!     traced back to the object that caused it.
+//!   * Those lines were `warn!`, while `DEFAULT_LOG_LEVEL` is `error`, so a
+//!     default deployment filtered them out anyway.
+//!
+//! This test reproduces the source-side fault against a real server over the S3
+//! API and asserts the operator-visible evidence, at the **default** log level.
+
+#[cfg(test)]
+mod tests {
+    use crate::chaos::DiskFaultHarness;
+    use crate::common::init_logging;
+    use aws_sdk_s3::Client;
+    use aws_sdk_s3::primitives::ByteStream;
+    use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
+    use serial_test::serial;
+    use std::error::Error;
+    use tokio::time::{Duration, timeout};
+    use tracing::info;
+
+    type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+
+    const MIB: usize = 1024 * 1024;
+    const OP_TIMEOUT: Duration = Duration::from_secs(90);
+
+    /// The structured event name every GET body failure is tagged with.
+    const STREAM_BODY_EVENT: &str = "get_object_stream_body";
+
+    fn payload(len: usize, seed: u8) -> Vec<u8> {
+        (0..len)
+            .map(|i| (i as u64).wrapping_mul(2654435761).wrapping_add(seed as u64) as u8)
+            .collect()
+    }
+
+    /// Upload a multipart object so the data lands in real `part.*` shard files
+    /// rather than being inlined into `xl.meta` (inlined objects cannot be
+    /// corrupted shard-wise, and never exercise the streaming read path).
+    async fn put_multipart(
+        client: &Client,
+        bucket: &str,
+        key: &str,
+        parts: Vec<Vec<u8>>,
+    ) -> Result<usize, Box<dyn Error + Send + Sync>> {
+        let total_len = parts.iter().map(Vec::len).sum();
+
+        let create = client.create_multipart_upload().bucket(bucket).key(key).send().await?;
+        let upload_id = create.upload_id().ok_or("missing upload id")?.to_string();
+
+        let mut completed = Vec::with_capacity(parts.len());
+        for (index, part_body) in parts.into_iter().enumerate() {
+            let part_number = (index + 1) as i32;
+            let uploaded = timeout(
+                OP_TIMEOUT,
+                client
+                    .upload_part()
+                    .bucket(bucket)
+                    .key(key)
+                    .upload_id(&upload_id)
+                    .part_number(part_number)
+                    .body(ByteStream::from(part_body))
+                    .send(),
+            )
+            .await
+            .map_err(|_| format!("upload_part {part_number} timed out"))??;
+            completed.push(
+                CompletedPart::builder()
+                    .part_number(part_number)
+                    .e_tag(uploaded.e_tag().ok_or("missing part etag")?)
+                    .build(),
+            );
+        }
+
+        timeout(
+            OP_TIMEOUT,
+            client
+                .complete_multipart_upload()
+                .bucket(bucket)
+                .key(key)
+                .upload_id(&upload_id)
+                .multipart_upload(CompletedMultipartUpload::builder().set_parts(Some(completed)).build())
+                .send(),
+        )
+        .await
+        .map_err(|_| "complete_multipart_upload timed out")??;
+
+        Ok(total_len)
+    }
+
+    /// rustfs#4784: reproduce the source-side fault the reporter kept hitting —
+    /// a GET that commits `200` + a full `Content-Length` and then cannot finish
+    /// the body — and assert the server log names the object, at the log level a
+    /// default deployment actually runs with.
+    #[tokio::test]
+    #[serial]
+    async fn midstream_get_failure_is_logged_with_the_object_at_default_log_level() -> TestResult {
+        init_logging();
+        info!("rustfs#4784: a mid-stream GET failure must name its object in the source log");
+
+        let mut harness = DiskFaultHarness::new(4).await?;
+
+        // Capture the child's stdout so the test can read what an operator would.
+        let log_path = format!("{}/server.log", harness.env.temp_dir);
+        harness.env.capture_log_path = Some(log_path.clone());
+
+        // Reproduce a DEFAULT deployment's logging, not the e2e harness's
+        // permissive `rustfs=info`: `DEFAULT_LOG_LEVEL` is `error`. Before the
+        // #4784 fix these failures were `warn!`, so a default deployment
+        // filtered them out entirely — which is why the reporter's source logs
+        // were empty. extra_env is applied after the harness's own RUST_LOG, so
+        // this wins.
+        harness.set_env("RUST_LOG", "error");
+        harness.set_env("RUSTFS_OBS_LOGGER_LEVEL", "error");
+
+        harness.start_server().await?;
+        let client = harness.env.create_s3_client();
+
+        let bucket = "issue4784-source-read";
+        client.create_bucket().bucket(bucket).send().await?;
+
+        // Named after the reporter's restic index objects, which is where they
+        // saw the failures.
+        let key = "index/3b18542ab3af4c3d03f804c7a24173e7836ef7fa447b5d1e9d634f975cc51611";
+        let expected_len = put_multipart(
+            &client,
+            bucket,
+            key,
+            vec![payload(5 * MIB, 71), payload(5 * MIB, 72), payload(5 * MIB, 73)],
+        )
+        .await?;
+
+        // Baseline: the object reads back completely before any corruption.
+        let baseline = timeout(OP_TIMEOUT, client.get_object().bucket(bucket).key(key).send())
+            .await
+            .map_err(|_| "baseline GET timed out")??
+            .body
+            .collect()
+            .await?;
+        assert_eq!(baseline.into_bytes().len(), expected_len, "baseline GET must return the whole object");
+
+        // Corrupt three of four shards in a 2+2 set: below the 2-shard read
+        // quorum. The corruption sits mid-file, so block 0 still reads clean —
+        // the server commits 200 + the full Content-Length and only then cannot
+        // reconstruct. That is the mid-stream window the reporter's downstream
+        // saw as `unexpected EOF`.
+        harness.corrupt_object_shard(0, bucket, key)?;
+        harness.corrupt_object_shard(1, bucket, key)?;
+        harness.corrupt_object_shard(2, bucket, key)?;
+
+        let response = timeout(OP_TIMEOUT, client.get_object().bucket(bucket).key(key).send())
+            .await
+            .map_err(|_| "degraded GET timed out")?;
+
+        // Either outcome is functionally correct (that invariant belongs to
+        // degraded_read_eof_regression_test); this suite only needs the read to
+        // have failed so there is something to report.
+        let delivered = match response {
+            Err(err) => {
+                info!("degraded GET failed before the body: {err}");
+                None
+            }
+            Ok(response) => match response.body.collect().await {
+                Ok(aggregated) => Some(aggregated.into_bytes().len()),
+                Err(err) => {
+                    info!("degraded GET failed mid-body as expected: {err}");
+                    None
+                }
+            },
+        };
+        assert_ne!(
+            delivered,
+            Some(expected_len),
+            "the beyond-quorum read unexpectedly succeeded; this suite needs a failed read to have something to report"
+        );
+
+        // Give the child a moment to flush its stdout.
+        tokio::time::sleep(Duration::from_millis(500)).await;
+        let logged = std::fs::read_to_string(&log_path)?;
+
+        let failure_lines: Vec<&str> = logged.lines().filter(|line| line.contains(STREAM_BODY_EVENT)).collect();
+
+        assert!(
+            !failure_lines.is_empty(),
+            "a mid-stream GET failure produced no `{STREAM_BODY_EVENT}` line at the default log level. \
+             This is the #4784 blind spot: the failure was only counted in a metric, or logged below \
+             `error` and filtered out. Captured log:\n{logged}"
+        );
+
+        // The identity is the whole point: a request_id alone cannot be resolved
+        // back to an object once the request is over.
+        assert!(
+            failure_lines.iter().any(|line| line.contains(key)),
+            "no `{STREAM_BODY_EVENT}` line named the failing object `{key}`, so the report is still \
+             unactionable. Lines seen:\n{}",
+            failure_lines.join("\n")
+        );
+        assert!(
+            failure_lines.iter().any(|line| line.contains(bucket)),
+            "no `{STREAM_BODY_EVENT}` line named the failing bucket `{bucket}`. Lines seen:\n{}",
+            failure_lines.join("\n")
+        );
+
+        info!(
+            "source-side evidence now present: {} stream-body failure line(s) naming the object",
+            failure_lines.len()
+        );
+        for line in &failure_lines {
+            info!("operator-visible evidence: {line}");
+        }
+
+        Ok(())
+    }
+}
@@ -1028,20 +1028,6 @@ impl<'a> ReaderPathExpectation<'a> {
        }
    }

-    fn with_size_bucket(
-        object: ReaderObject<'a>,
-        expected_path: &'a str,
-        object_class: &'a str,
-        expected_size_bucket: &'a str,
-    ) -> Self {
-        Self {
-            object,
-            expected_path,
-            object_class,
-            expected_size_bucket: Some(expected_size_bucket),
-        }
-    }
-
    fn with_any_size_bucket(object: ReaderObject<'a>, expected_path: &'a str, object_class: &'a str) -> Self {
        Self {
            object,
@@ -1909,12 +1895,7 @@ async fn four_node_compressed_inline_fallback() -> TestResult {
    assert_reader_path(
        &collector,
        &client,
-        ReaderPathExpectation::with_size_bucket(
-            ReaderObject::new(bucket, key, &body, put.e_tag(), None),
-            LEGACY_DUPLEX,
-            COMPRESSED,
-            size_bucket(4 * KIB),
-        ),
+        ReaderPathExpectation::for_class(ReaderObject::new(bucket, key, &body, put.e_tag(), None), LEGACY_DUPLEX, COMPRESSED),
    )
    .await?;

@@ -2274,6 +2255,7 @@ async fn four_node_manual_transition_distributed_admission_conflict_reports_stat
    hot.set_env("RUSTFS_SCANNER_CYCLE", "3600");
    hot.set_env("RUSTFS_MAX_TRANSITION_WORKERS", "1");
    hot.set_env("RUSTFS_TRANSITION_QUEUE_CAPACITY", "1");
+    hot.set_env("RUSTFS_TRANSITION_QUEUE_SEND_TIMEOUT_MS", "1");
    hot.start().await?;

    let hot_client = hot.create_s3_client(0)?;
@@ -2290,7 +2272,7 @@ async fn four_node_manual_transition_distributed_admission_conflict_reports_stat
            .put_object()
            .bucket(&bucket)
            .key(key)
-            .body(ByteStream::from(payload(64 * KIB, index)))
+            .body(ByteStream::from(payload(1024 * KIB, index)))
            .send()
            .await?;
    }
@@ -37,7 +37,7 @@ async fn test_bucket_default_sse_s3_put_object() -> Result<(), Box<dyn std::erro

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -159,7 +159,7 @@ async fn test_bucket_default_sse_kms_put_object() -> Result<(), Box<dyn std::err

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -278,7 +278,7 @@ async fn test_bucket_default_sse_kms_multipart_crc32() -> Result<(), Box<dyn std

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -475,7 +475,7 @@ async fn test_explicit_encryption_overrides_bucket_default() -> Result<(), Box<d

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -570,7 +570,7 @@ async fn test_sse_kms_without_key_id_populates_default() -> Result<(), Box<dyn s

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -40,7 +40,7 @@ use std::time::Duration;
 use tokio::fs;
 use tokio::net::TcpStream;
 use tokio::time::sleep;
-use tracing::{debug, error, info};
+use tracing::{debug, error, info, warn};

 // KMS-specific constants
 pub const TEST_BUCKET: &str = "kms-test-bucket";
@@ -177,6 +177,49 @@ pub async fn get_kms_status(
    Ok(status)
 }

+/// Poll the KMS status endpoint until the backend reports ready or the timeout
+/// expires.  Replaces hard-coded `sleep(Duration::from_secs(3))` startup waits
+/// with an active readiness probe so tests start as soon as KMS is usable
+/// (typically < 1 s) instead of always waiting the full 3 s.
+///
+/// Uses exponential back-off starting at 200 ms (doubling each attempt, capped
+/// at 1 s) up to a total wall-clock budget of 5 s.
+pub async fn wait_for_kms_ready(
+    base_url: &str,
+    access_key: &str,
+    secret_key: &str,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    let total_deadline = Duration::from_secs(5);
+    let start = tokio::time::Instant::now();
+    let mut backoff = Duration::from_millis(200);
+    let max_backoff = Duration::from_secs(1);
+    let mut first_attempt = true;
+
+    loop {
+        if !first_attempt {
+            if start.elapsed() >= total_deadline {
+                return Err("KMS failed to become ready within 5 seconds".into());
+            }
+            sleep(backoff).await;
+            backoff = (backoff * 2).min(max_backoff);
+        }
+        first_attempt = false;
+
+        match get_kms_status(base_url, access_key, secret_key).await {
+            Ok(status) => {
+                info!("KMS is ready (status: {})", status);
+                return Ok(());
+            }
+            Err(e) => {
+                if start.elapsed() >= total_deadline {
+                    return Err(format!("KMS did not become ready within 5 s: last error: {e}").into());
+                }
+                warn!(error = %e, elapsed_ms = start.elapsed().as_millis() as u64, "KMS not ready yet, retrying…");
+            }
+        }
+    }
+}
+
 /// Create a default KMS key for testing and return the created key ID
 pub async fn create_default_key(
    base_url: &str,
@@ -861,6 +904,13 @@ impl LocalKMSTestEnvironment {
        Ok(default_key_id.to_string())
    }

+    /// Poll the KMS status endpoint until the backend reports ready.
+    ///
+    /// Prefer this over a fixed `sleep` after calling `start_rustfs_for_local_kms`.
+    pub async fn wait_for_kms_ready(&self) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        wait_for_kms_ready(&self.base_env.url, &self.base_env.access_key, &self.base_env.secret_key).await
+    }
+
    /// Configure Local KMS backend with a predefined default key
    pub async fn configure_local_kms(&self) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
        // Use a fixed, predictable default key ID
@@ -61,7 +61,7 @@ async fn test_metadata_replace_self_copy_of_sse_object_stays_decryptable() {
        )
        .await
        .expect("failed to start RustFS with local KMS");
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let client = kms_env.base_env.create_s3_client();
    // Deliberately an UNVERSIONED bucket: that is the branch where the store layer can service
@@ -160,7 +160,7 @@ async fn test_metadata_replace_self_copy_dropping_sse_rewrites_plaintext() {
        )
        .await
        .expect("failed to start RustFS with local KMS");
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let client = kms_env.base_env.create_s3_client();
    // Unversioned, and deliberately WITHOUT a bucket default-encryption rule, so the copy below
@@ -256,7 +256,7 @@ async fn test_metadata_replace_self_copy_under_bucket_default_sse_stays_decrypta
        )
        .await
        .expect("failed to start RustFS with local KMS");
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let client = kms_env.base_env.create_s3_client();
    let bucket = "copy-object-self-copy-bucket-default-sse-test";
@@ -56,7 +56,7 @@ async fn test_self_copy_of_historical_sse_s3_version_is_readable() {
        )
        .await
        .expect("failed to start RustFS with local KMS");
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let client = kms_env.base_env.create_s3_client();
    let bucket = "copy-object-version-restore-sse-test";
@@ -87,7 +87,7 @@ async fn test_head_reports_managed_metadata_for_sse_s3() -> Result<(), Box<dyn s

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -147,7 +147,7 @@ async fn test_head_reports_managed_metadata_for_sse_kms_and_copy() -> Result<(),

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -250,7 +250,7 @@ async fn test_multipart_upload_writes_encrypted_data() -> Result<(), Box<dyn std

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -39,6 +39,7 @@ use std::time::Duration;
 use tracing::info;

 type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
+type S3OperationResult<T> = Result<T, Box<aws_sdk_s3::Error>>;

 const ALLOWED_KEY: &str = "kms-matrix-allowed-key";
 const OTHER_KEY: &str = "kms-matrix-other-key";
@@ -130,7 +131,7 @@ fn policy_document(statements: Vec<serde_json::Value>) -> String {
    serde_json::json!({ "Version": "2012-10-17", "Statement": statements }).to_string()
 }

-async fn put_sse_kms(client: &Client, key: &str, kms_key_id: &str) -> Result<(), aws_sdk_s3::Error> {
+async fn put_sse_kms(client: &Client, key: &str, kms_key_id: &str) -> S3OperationResult<()> {
    client
        .put_object()
        .bucket(BUCKET)
@@ -141,16 +142,23 @@ async fn put_sse_kms(client: &Client, key: &str, kms_key_id: &str) -> Result<(),
        .send()
        .await
        .map(|_| ())
-        .map_err(aws_sdk_s3::Error::from)
+        .map_err(|error| Box::new(aws_sdk_s3::Error::from(error)))
 }

 /// Assert the operation failed with `AccessDenied` rather than any other error.
 ///
 /// A bare `is_err` would also accept `KMSKeyDisabled` or an internal error, which
 /// would hide both a leak of key state and an outage masquerading as a denial.
-fn assert_access_denied<T: std::fmt::Debug>(result: Result<T, aws_sdk_s3::Error>, what: &str) {
+fn assert_access_denied<T: std::fmt::Debug, E: std::fmt::Debug + std::borrow::Borrow<aws_sdk_s3::Error>>(
+    result: Result<T, E>,
+    what: &str,
+) {
    let error = result.expect_err(&format!("{what} must be denied"));
-    assert_eq!(error.code(), Some("AccessDenied"), "{what} must fail with AccessDenied: {error:?}");
+    assert_eq!(
+        error.borrow().code(),
+        Some("AccessDenied"),
+        "{what} must fail with AccessDenied: {error:?}"
+    );
 }

 /// Retry an SSE-KMS write until the identity's policy has reached the request path.
@@ -296,7 +304,7 @@ async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
            .send()
            .await
            .map(|_| ())
-            .map_err(aws_sdk_s3::Error::from),
+            .map_err(|err| Box::new(aws_sdk_s3::Error::from(err))),
        "SSE-KMS read by an identity holding no kms grant",
    );

@@ -310,7 +318,7 @@ async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
            .send()
            .await
            .map(|_| ())
-            .map_err(aws_sdk_s3::Error::from),
+            .map_err(|err| Box::new(aws_sdk_s3::Error::from(err))),
        "SSE-KMS read by an identity holding kms:GenerateDataKey but not kms:Decrypt",
    );

@@ -24,7 +24,6 @@ use super::common::{
    test_sse_kms_encryption, test_sse_s3_encryption,
 };
 use crate::common::{TEST_BUCKET, init_logging};
-use tokio::time::{Duration, sleep};
 use tracing::info;

 /// Comprehensive test: Full KMS workflow with all encryption types
@@ -35,7 +34,7 @@ async fn test_comprehensive_kms_full_workflow() -> Result<(), Box<dyn std::error

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    sleep(Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -103,7 +102,7 @@ async fn test_comprehensive_stress_test() -> Result<(), Box<dyn std::error::Erro

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    sleep(Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -137,7 +136,7 @@ async fn test_comprehensive_key_isolation() -> Result<(), Box<dyn std::error::Er

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    sleep(Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -208,7 +207,7 @@ async fn test_comprehensive_concurrent_operations() -> Result<(), Box<dyn std::e

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    sleep(Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -253,7 +252,7 @@ async fn test_comprehensive_performance_benchmark() -> Result<(), Box<dyn std::e

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    sleep(Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -44,7 +44,7 @@ async fn test_kms_zero_byte_file_encryption() -> Result<(), Box<dyn std::error::

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -117,7 +117,7 @@ async fn test_kms_single_byte_file_encryption() -> Result<(), Box<dyn std::error

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -209,7 +209,7 @@ async fn test_kms_multipart_boundary_conditions() -> Result<(), Box<dyn std::err

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -284,7 +284,7 @@ async fn test_kms_invalid_key_scenarios() -> Result<(), Box<dyn std::error::Erro

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -371,7 +371,7 @@ async fn test_kms_concurrent_encryption() -> Result<(), Box<dyn std::error::Erro

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = Arc::new(kms_env.base_env.create_s3_client());
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -478,7 +478,7 @@ async fn test_kms_key_validation_security() -> Result<(), Box<dyn std::error::Er

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -37,7 +37,7 @@ async fn test_kms_key_directory_unavailable() -> Result<(), Box<dyn std::error::

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -127,7 +127,7 @@ async fn test_kms_corrupted_key_files() -> Result<(), Box<dyn std::error::Error

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -218,7 +218,7 @@ async fn test_kms_multipart_upload_interruption() -> Result<(), Box<dyn std::err

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -401,7 +401,7 @@ async fn test_kms_resource_constraints() -> Result<(), Box<dyn std::error::Error

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -46,7 +46,7 @@ async fn test_local_kms_end_to_end() -> Result<(), Box<dyn std::error::Error + S
        .expect("Failed to start RustFS with Local KMS");

    // Wait a moment for RustFS to fully start up and initialize KMS
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    info!("RustFS started with KMS auto-configuration, default_key_id: {}", default_key_id);

@@ -127,7 +127,7 @@ async fn test_local_kms_key_isolation() {
        .expect("Failed to start RustFS with Local KMS");

    // Wait a moment for RustFS to fully start up and initialize KMS
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    info!("RustFS started with KMS auto-configuration, default_key_id: {}", default_key_id);

@@ -227,7 +227,7 @@ async fn test_local_kms_large_file() {
        .expect("Failed to start RustFS with Local KMS");

    // Wait a moment for RustFS to fully start up and initialize KMS
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    info!("RustFS started with KMS auto-configuration, default_key_id: {}", default_key_id);

@@ -309,7 +309,7 @@ async fn test_local_kms_multipart_upload() {
        .expect("Failed to start RustFS with Local KMS");

    // Wait for KMS initialization
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    info!("RustFS started with KMS auto-configuration, default_key_id: {}", default_key_id);

@@ -647,7 +647,10 @@ async fn test_multipart_upload_with_sse_c(
 }

 /// Test large multipart upload to verify streaming encryption works correctly
-#[allow(dead_code)]
+#[allow(
+    dead_code,
+    reason = "parked behind the TODO in test_local_kms_multipart_upload until streaming encryption is fixed for large files (backlog#1823)"
+)]
 async fn test_large_multipart_upload(
    s3_client: &aws_sdk_s3::Client,
    bucket: &str,
@@ -20,7 +20,6 @@

 use crate::common::{TEST_BUCKET, init_logging};
 use serial_test::serial;
-use tokio::time::{Duration, sleep};
 use tracing::{error, info};

 use super::common::{
@@ -46,8 +45,13 @@ impl VaultKmsTestContext {

        start_kms(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;

-        // Allow Vault to finish initialising token auth and transit engine.
-        sleep(Duration::from_secs(2)).await;
+        // Wait for KMS to finish initialising.
+        super::common::wait_for_kms_ready(
+            &env.base_env.url,
+            &env.base_env.access_key,
+            &env.base_env.secret_key,
+        )
+        .await?;

        Ok(Self { env })
    }
@@ -33,7 +33,7 @@ async fn test_step1_basic_single_file_encryption() -> Result<(), Box<dyn std::er

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -89,7 +89,7 @@ async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Bo

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -187,7 +187,7 @@ async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::er

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -310,7 +310,7 @@ async fn test_step4_large_multipart_upload_with_encryption() -> Result<(), Box<d

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -435,7 +435,7 @@ async fn test_step5_all_encryption_types_multipart() -> Result<(), Box<dyn std::

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
-    tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
+    kms_env.wait_for_kms_ready().await?;

    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;
@@ -48,6 +48,11 @@ mod replacement_privileged_e2e_test;
 #[cfg(test)]
 mod degraded_read_eof_regression_test;

+// rustfs#4784: a mid-stream GET failure must be reportable from the source
+// server's log alone — naming the object, at the default log level.
+#[cfg(test)]
+mod get_stream_failure_observability_test;
+
 // backlog#1183: GET codec-streaming fast path must be byte/header identical to
 // the legacy duplex path before its rollout gates can be flipped on by default.
 #[cfg(test)]
@@ -19,32 +19,17 @@ use std::time::Instant;
 use tokio::time::{Duration, sleep};
 use tracing::{error, info};

-/// Core test categories
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum TestCategory {
-    SingleValue,
-    MultiValue,
-    Concatenation,
-    Nested,
-    DenyScenarios,
-}
-
-impl TestCategory {}
-
 /// Test case definition
 #[derive(Debug, Clone)]
 pub struct TestDefinition {
    pub name: String,
-    #[allow(dead_code)]
-    pub category: TestCategory,
    pub is_critical: bool,
 }

 impl TestDefinition {
-    pub fn new(name: impl Into<String>, category: TestCategory, is_critical: bool) -> Self {
+    pub fn new(name: impl Into<String>, is_critical: bool) -> Self {
        Self {
            name: name.into(),
-            category,
            is_critical,
        }
    }
@@ -92,12 +77,12 @@ impl PolicyTestSuite {
    /// Create default test suite
    pub fn new() -> Self {
        let tests = vec![
-            TestDefinition::new("test_aws_policy_variables_single_value", TestCategory::SingleValue, true),
-            TestDefinition::new("test_aws_policy_variables_multi_value", TestCategory::MultiValue, true),
-            TestDefinition::new("test_aws_policy_variables_concatenation", TestCategory::Concatenation, true),
-            TestDefinition::new("test_aws_policy_variables_nested", TestCategory::Nested, true),
-            TestDefinition::new("test_aws_policy_variables_deny", TestCategory::DenyScenarios, true),
-            TestDefinition::new("test_aws_policy_variables_sts", TestCategory::SingleValue, true),
+            TestDefinition::new("test_aws_policy_variables_single_value", true),
+            TestDefinition::new("test_aws_policy_variables_multi_value", true),
+            TestDefinition::new("test_aws_policy_variables_concatenation", true),
+            TestDefinition::new("test_aws_policy_variables_nested", true),
+            TestDefinition::new("test_aws_policy_variables_deny", true),
+            TestDefinition::new("test_aws_policy_variables_sts", true),
        ];

        Self {
@@ -11,10 +11,17 @@ test process directly.

 ## Running Tests

+Use the canonical CI-equivalent protocol command in the parent
+[`e2e_test` README](../../README.md#troubleshooting).
+
+For targeted debugging of the core suite only:
+
 ```bash
 RUSTFS_BUILD_FEATURES=ftps,webdav,sftp cargo test --package e2e_test test_protocol_core_suite -- --test-threads=1 --nocapture
 ```

+This targeted command does not cover the full `e2e-protocols` profile.
+
 `RUSTFS_BUILD_FEATURES` controls which features the test rustfs binary is
 built with. When this variable is set, the protocol test runner schedules
 only entries whose protocol is present in the requested feature list. Leave
@@ -133,4 +140,3 @@ property without consulting any external doc.
 Bind ports 9023 (SFTP) and 9100 (S3). Spawns rustfs with
 `RUSTFS_SFTP_IDLE_TIMEOUT=5`, sleeps 10 s past the timeout, then issues an
 SFTP request and asserts the server has closed the session.
-
@@ -233,6 +233,111 @@ pub async fn test_webdav_core_operations() -> Result<()> {
        );
        info!("PASS: PUT file '{}' successful", filename);

+        // Regression for #6260: a bucket-scoped policy must be able to discover its bucket at the
+        // WebDAV root without the unrelated global ListAllMyBuckets permission.
+        let scoped_bucket = "webdav-scoped-bucket";
+        let scoped_file = "visible.txt";
+        let scoped_user = "webdav-scoped-user";
+        let scoped_secret = "webdav-scoped-secret";
+        let scoped_policy_name = "webdav-scoped-policy";
+
+        let resp = client
+            .request(reqwest::Method::from_bytes(b"MKCOL").unwrap(), format!("{}/{}", base_url, scoped_bucket))
+            .header("Authorization", &auth_header)
+            .send()
+            .await?;
+        assert_eq!(resp.status().as_u16(), 201, "scoped test bucket should be created");
+
+        let resp = client
+            .put(format!("{}/{}/{}", base_url, scoped_bucket, scoped_file))
+            .header("Authorization", &auth_header)
+            .body("visible to the scoped principal")
+            .send()
+            .await?;
+        assert_eq!(resp.status().as_u16(), 201, "scoped test object should be created");
+
+        admin_create_user(&admin_base_url, scoped_user, scoped_secret).await?;
+        admin_add_canned_policy(
+            &admin_base_url,
+            scoped_policy_name,
+            &serde_json::json!({
+                "Version": "2012-10-17",
+                "Statement": [
+                    {
+                        "Effect": "Allow",
+                        "Action": ["s3:*"],
+                        "Resource": [
+                            format!("arn:aws:s3:::{}", scoped_bucket),
+                            format!("arn:aws:s3:::{}/*", scoped_bucket)
+                        ]
+                    },
+                    {
+                        "Effect": "Deny",
+                        "Action": ["s3:*"],
+                        "Resource": [
+                            format!("arn:aws:s3:::{}", scoped_bucket),
+                            format!("arn:aws:s3:::{}/*", scoped_bucket)
+                        ],
+                        "Condition": { "Bool": { "aws:SecureTransport": "true" } }
+                    },
+                    {
+                        "Effect": "Deny",
+                        "Action": ["s3:*"],
+                        "Resource": [
+                            format!("arn:aws:s3:::{}", scoped_bucket),
+                            format!("arn:aws:s3:::{}/*", scoped_bucket)
+                        ],
+                        "Condition": { "StringEquals": { "s3:signatureversion": "AWS4-HMAC-SHA256" } }
+                    }
+                ]
+            }),
+        )
+        .await?;
+        admin_attach_policy_to_user(&admin_base_url, scoped_policy_name, scoped_user).await?;
+
+        let scoped_auth = basic_auth_header_for(scoped_user, scoped_secret);
+        let resp = client
+            .request(reqwest::Method::from_bytes(b"PROPFIND").unwrap(), &base_url)
+            .header("Authorization", &scoped_auth)
+            .header("Depth", "1")
+            .header("x-amz-content-sha256", "STREAMING-AWS4-HMAC-SHA256-PAYLOAD")
+            .send()
+            .await?;
+        assert_eq!(resp.status().as_u16(), 207, "bucket-scoped root PROPFIND should succeed");
+        let root_listing = resp.text().await?;
+        assert!(root_listing.contains(scoped_bucket), "the authorized bucket should be listed");
+        assert!(!root_listing.contains(bucket_name), "an unauthorized bucket must not be listed");
+
+        let resp = client
+            .request(
+                reqwest::Method::from_bytes(b"PROPFIND").unwrap(),
+                format!("{}/{}", base_url, scoped_bucket),
+            )
+            .header("Authorization", &scoped_auth)
+            .header("Depth", "1")
+            .send()
+            .await?;
+        assert_eq!(resp.status().as_u16(), 207, "authorized bucket PROPFIND should succeed");
+        assert!(resp.text().await?.contains(scoped_file), "the authorized object should be listed");
+
+        let denied_user = "webdav-no-buckets-user";
+        let denied_secret = "webdav-no-buckets-secret";
+        admin_create_user(&admin_base_url, denied_user, denied_secret).await?;
+        let resp = client
+            .request(reqwest::Method::from_bytes(b"PROPFIND").unwrap(), &base_url)
+            .header("Authorization", basic_auth_header_for(denied_user, denied_secret))
+            .header("Depth", "1")
+            .send()
+            .await?;
+        assert_eq!(
+            resp.status().as_u16(),
+            207,
+            "PROPFIND keeps the root resource visible when the directory listing is forbidden"
+        );
+        let denied_body = resp.text().await?;
+        assert!(!denied_body.contains(scoped_bucket), "a denied response must not leak the scoped bucket");
+        assert!(!denied_body.contains(bucket_name), "a denied response must not leak the admin bucket");
+
        // Test GET (download file)
        info!("Testing WebDAV: GET (download file '{}')", filename);
        let resp = client
@@ -169,6 +169,42 @@ impl QuotaTestEnv {
        bucket: &str,
        quota_bytes: u64,
    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        self.wait_for_quota_usage_for(bucket).await?;
+
+        let quota_path = format!("/rustfs/admin/v3/quota/{bucket}");
+        let quota_config = serde_json::json!({
+            "quota": quota_bytes,
+            "quota_type": "HARD"
+        })
+        .to_string();
+        let readiness = async {
+            loop {
+                let (status, response) = admin_request(
+                    &self.env.url,
+                    Method::PUT,
+                    &quota_path,
+                    Some(quota_config.clone()),
+                    &self.env.access_key,
+                    &self.env.secret_key,
+                )
+                .await?;
+                if status.is_success() {
+                    return Ok::<(), Box<dyn std::error::Error + Send + Sync>>(());
+                }
+                if status != StatusCode::SERVICE_UNAVAILABLE {
+                    return Err(format!("failed to set quota for {bucket}: {status} {response}").into());
+                }
+
+                sleep(Duration::from_secs(1)).await;
+            }
+        };
+        match timeout(Duration::from_secs(30), readiness).await {
+            Ok(result) => result,
+            Err(_) => Err(format!("quota readiness did not converge for {bucket} within 30 seconds").into()),
+        }
+    }
+
+    pub async fn wait_for_quota_usage_for(&self, bucket: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        let stats_path = format!("/rustfs/admin/v3/quota-stats/{bucket}");
        let readiness = async {
            loop {
@@ -181,28 +217,12 @@ impl QuotaTestEnv {
                if status != StatusCode::SERVICE_UNAVAILABLE {
                    return Err(format!("quota usage readiness failed for {bucket}: {status} {response}").into());
                }
-
                sleep(Duration::from_secs(1)).await;
            }
        };
        match timeout(Duration::from_secs(30), readiness).await {
-            Ok(result) => result?,
-            Err(_) => {
-                return Err(format!("quota usage did not become authoritative for {bucket} within 30 seconds").into());
-            }
-        }
-
-        let url = format!("{}/rustfs/admin/v3/quota/{}", self.env.url, bucket);
-        let quota_config = serde_json::json!({
-            "quota": quota_bytes,
-            "quota_type": "HARD"
-        });
-
-        let response = awscurl_put(&url, &quota_config.to_string(), &self.env.access_key, &self.env.secret_key).await?;
-        if response.contains("error") {
-            Err(format!("Failed to set quota: {}", response).into())
-        } else {
-            Ok(())
+            Ok(result) => result,
+            Err(_) => Err(format!("quota usage did not become authoritative for {bucket} within 30 seconds").into()),
        }
    }

@@ -614,6 +634,7 @@ mod integration_tests {
        let env = QuotaTestEnv::new().await?;

        env.create_bucket().await?;
+        env.wait_for_quota_usage_for(&env.bucket_name).await?;

        // Test 1: GET quota for bucket without quota config
        let url = format!("{}/rustfs/admin/v3/quota/{}", env.env.url, env.bucket_name);
@@ -621,12 +642,7 @@ mod integration_tests {
        assert!(response.contains("quota") && response.contains("null"));

        // Test 2: PUT quota - valid config
-        let quota_config = serde_json::json!({
-            "quota": 1048576,
-            "quota_type": "HARD"
-        });
-        let response = awscurl_put(&url, &quota_config.to_string(), &env.env.access_key, &env.env.secret_key).await?;
-        assert!(response.contains("success") || !response.contains("error"));
+        env.set_bucket_quota(1048576).await?;

        // Test 3: GET quota after setting
        let response = awscurl_get(&url, &env.env.access_key, &env.env.secret_key).await?;
@@ -168,6 +168,24 @@ async fn wait_for_version_expired(
    }
 }

+async fn wait_for_key_versions_empty(client: &Client, bucket: &str, key: &str, deadline: StdDuration) -> TestResult {
+    let start = std::time::Instant::now();
+    loop {
+        let listing = client.list_object_versions().bucket(bucket).prefix(key).send().await?;
+        if listing.versions().is_empty() && listing.delete_markers().is_empty() {
+            return Ok(());
+        }
+        if start.elapsed() >= deadline {
+            return Err(format!(
+                "object {bucket}/{key} still had versions or delete markers after {}s: {listing:?}",
+                deadline.as_secs()
+            )
+            .into());
+        }
+        tokio::time::sleep(StdDuration::from_millis(500)).await;
+    }
+}
+
 /// Build a prefix-scoped `Days`-based expiration rule.
 fn expiration_rule(id: &str, prefix: &str, days: i32) -> Result<LifecycleRule, Box<dyn std::error::Error + Send + Sync>> {
    let rule = LifecycleRule::builder()
@@ -193,6 +211,21 @@ fn noncurrent_expiration_rule(
    Ok(rule)
 }

+fn noncurrent_expiration_with_delete_marker_cleanup_rule(
+    id: &str,
+    prefix: &str,
+    days: i32,
+) -> Result<LifecycleRule, Box<dyn std::error::Error + Send + Sync>> {
+    let rule = LifecycleRule::builder()
+        .id(id)
+        .filter(LifecycleRuleFilter::builder().prefix(prefix).build())
+        .expiration(LifecycleExpiration::builder().expired_object_delete_marker(true).build())
+        .noncurrent_version_expiration(NoncurrentVersionExpiration::builder().noncurrent_days(days).build())
+        .status(ExpirationStatus::Enabled)
+        .build()?;
+    Ok(rule)
+}
+
 async fn put_expiration_config(client: &Client, bucket: &str, rule: LifecycleRule) -> TestResult {
    let lifecycle = BucketLifecycleConfiguration::builder().rules(rule).build()?;
    client
@@ -412,6 +445,143 @@ async fn test_lifecycle_noncurrent_version_expiry_removes_only_old_version() ->
    Ok(())
 }

+/// A combined `NoncurrentDays=1` and `ExpiredObjectDeleteMarker=true` rule
+/// must remove a noncurrent data version and then its sole latest delete
+/// marker, without expiring current-only objects. A second prefix with only
+/// noncurrent expiry proves that marker cleanup comes from EODM.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_lifecycle_noncurrent_expiry_then_cleans_expired_delete_marker() -> TestResult {
+    let mut env = RustFSTestEnvironment::new().await?;
+    let mut extra_env = fast_lifecycle_env();
+    extra_env.push(("RUSTFS_ILM_DEBUG_DAY_SECS", "2"));
+    env.start_rustfs_server_with_env(vec![], &extra_env).await?;
+
+    let client = env.create_s3_client();
+    let bucket = "ilm-expired-delete-marker";
+    client.create_bucket().bucket(bucket).send().await?;
+    client
+        .put_bucket_versioning()
+        .bucket(bucket)
+        .versioning_configuration(
+            VersioningConfiguration::builder()
+                .status(BucketVersioningStatus::Enabled)
+                .build(),
+        )
+        .send()
+        .await?;
+
+    let cascade_key = "cascade/deleted.txt";
+    let cascade_put = client
+        .put_object()
+        .bucket(bucket)
+        .key(cascade_key)
+        .body(ByteStream::from_static(b"cascade payload"))
+        .send()
+        .await?;
+    let cascade_data_version = cascade_put
+        .version_id()
+        .map(str::to_string)
+        .expect("cascade PUT returns a version id");
+    let cascade_delete = client.delete_object().bucket(bucket).key(cascade_key).send().await?;
+    let cascade_marker_version = cascade_delete
+        .version_id()
+        .map(str::to_string)
+        .expect("cascade DELETE returns a marker version id");
+    assert_eq!(cascade_delete.delete_marker(), Some(true));
+
+    let survivor_key = "cascade/current-only.txt";
+    client
+        .put_object()
+        .bucket(bucket)
+        .key(survivor_key)
+        .body(ByteStream::from_static(b"current payload"))
+        .send()
+        .await?;
+    let survivor_before = client.get_object().bucket(bucket).key(survivor_key).send().await?;
+    assert_eq!(survivor_before.body.collect().await?.into_bytes().as_ref(), b"current payload");
+
+    let control_key = "nve-only/deleted.txt";
+    let control_put = client
+        .put_object()
+        .bucket(bucket)
+        .key(control_key)
+        .body(ByteStream::from_static(b"control payload"))
+        .send()
+        .await?;
+    let control_data_version = control_put
+        .version_id()
+        .map(str::to_string)
+        .expect("control PUT returns a version id");
+    let control_delete = client.delete_object().bucket(bucket).key(control_key).send().await?;
+    let control_marker_version = control_delete
+        .version_id()
+        .map(str::to_string)
+        .expect("control DELETE returns a marker version id");
+    assert_eq!(control_delete.delete_marker(), Some(true));
+
+    let cascade_before = client
+        .list_object_versions()
+        .bucket(bucket)
+        .prefix(cascade_key)
+        .send()
+        .await?;
+    assert!(
+        cascade_before
+            .versions()
+            .iter()
+            .any(|version| version.version_id() == Some(cascade_data_version.as_str())),
+        "cascade data version must exist before lifecycle is installed: {cascade_before:?}"
+    );
+    assert!(
+        cascade_before
+            .delete_markers()
+            .iter()
+            .any(|marker| { marker.version_id() == Some(cascade_marker_version.as_str()) && marker.is_latest() == Some(true) }),
+        "cascade latest delete marker must exist before lifecycle is installed: {cascade_before:?}"
+    );
+
+    let lifecycle = BucketLifecycleConfiguration::builder()
+        .rules(noncurrent_expiration_with_delete_marker_cleanup_rule(
+            "expire-and-clean-marker",
+            "cascade/",
+            1,
+        )?)
+        .rules(noncurrent_expiration_rule("expire-only", "nve-only/", 1)?)
+        .build()?;
+    client
+        .put_bucket_lifecycle_configuration()
+        .bucket(bucket)
+        .lifecycle_configuration(lifecycle)
+        .send()
+        .await?;
+
+    wait_for_key_versions_empty(&client, bucket, cascade_key, StdDuration::from_secs(90)).await?;
+    wait_for_version_expired(&client, bucket, control_key, &control_data_version, StdDuration::from_secs(90)).await?;
+
+    let survivor = client.get_object().bucket(bucket).key(survivor_key).send().await?;
+    assert_eq!(survivor.body.collect().await?.into_bytes().as_ref(), b"current payload");
+
+    let control_after = client
+        .list_object_versions()
+        .bucket(bucket)
+        .prefix(control_key)
+        .send()
+        .await?;
+    assert!(
+        control_after.versions().is_empty(),
+        "NVE-only control must remove its data version: {control_after:?}"
+    );
+    assert!(
+        control_after
+            .delete_markers()
+            .iter()
+            .any(|marker| { marker.version_id() == Some(control_marker_version.as_str()) && marker.is_latest() == Some(true) }),
+        "NVE-only control must preserve its latest delete marker: {control_after:?}"
+    );
+
+    Ok(())
+}
+
 /// `Days=0` expiration is invalid per S3 semantics (`Days` must be a positive
 /// integer >= 1). A `PutBucketLifecycleConfiguration` carrying a zero-day rule
 /// must be rejected with `InvalidArgument` (HTTP 400) - see crates/lifecycle
@@ -110,6 +110,7 @@ const USER_META_KEY: &str = "ilm7-origin";
 const USER_META_VAL: &str = "hermetic-transition";
 const HDR_SOURCE_REPLICATION_REQUEST: &str = "x-rustfs-source-replication-request";
 const HDR_SOURCE_MTIME: &str = "x-rustfs-source-mtime";
+const TIER_MUTATION_RECOVERY_CHANGED: &str = "Remote tier mutation recovery changed before publish";

 /// 5 MiB — the S3 minimum size for a non-final multipart part; the object's only
 /// internal part boundary sits at this offset.
@@ -183,28 +184,58 @@ async fn add_rustfs_tier(hot: &RustFSTestEnvironment, cold: &RustFSTestEnvironme
    })
    .to_string();

-    let (status, resp) = signed_admin_request(
-        &hot.url,
-        Method::PUT,
-        "/rustfs/admin/v3/tier",
-        Some(&body),
-        &hot.access_key,
-        &hot.secret_key,
-    )
-    .await?;
-    if !status.is_success() {
-        return Err(format!("AddTier(RustFS) failed: status={status}, body={resp}").into());
+    let verify_path = format!("/rustfs/admin/v3/tier/{TIER_NAME}");
+    let deadline = Instant::now() + StdDuration::from_secs(30);
+    let mut recovery_changed = false;
+    loop {
+        if recovery_changed {
+            let (status, _) =
+                signed_admin_request(&hot.url, Method::GET, &verify_path, None, &hot.access_key, &hot.secret_key).await?;
+            if status.is_success() {
+                return Ok(());
+            }
+        }
+        let (status, resp) = signed_admin_request(
+            &hot.url,
+            Method::PUT,
+            "/rustfs/admin/v3/tier",
+            Some(&body),
+            &hot.access_key,
+            &hot.secret_key,
+        )
+        .await?;
+        if status.is_success() {
+            return Ok(());
+        }
+        if resp.contains(TIER_MUTATION_RECOVERY_CHANGED) {
+            recovery_changed = true;
+        } else if !recovery_changed || !resp.contains("TierNameAlreadyExist") {
+            return Err(format!("AddTier(RustFS) failed: status={status}, body={resp}").into());
+        }
+        if Instant::now() >= deadline {
+            return Err(format!("AddTier(RustFS) failed: status={status}, body={resp}").into());
+        }
+        tokio::time::sleep(StdDuration::from_millis(100)).await;
    }
-    Ok(())
 }

 async fn remove_rustfs_tier_force(hot: &RustFSTestEnvironment) -> TestResult {
    let path = format!("/rustfs/admin/v3/tier/{TIER_NAME}?force=true");
-    let (status, resp) = signed_admin_request(&hot.url, Method::DELETE, &path, None, &hot.access_key, &hot.secret_key).await?;
-    if !status.is_success() {
-        return Err(format!("RemoveTier(RustFS) failed: status={status}, body={resp}").into());
+    let deadline = Instant::now() + StdDuration::from_secs(30);
+    loop {
+        let (status, resp) =
+            signed_admin_request(&hot.url, Method::DELETE, &path, None, &hot.access_key, &hot.secret_key).await?;
+        if status.is_success() {
+            return Ok(());
+        }
+        if (!resp.contains("TierNameBackendInUse") && !resp.contains(TIER_MUTATION_RECOVERY_CHANGED))
+            || Instant::now() >= deadline
+        {
+            return Err(format!("RemoveTier(RustFS) failed: status={status}, body={resp}").into());
+        }
+        // Tier mutation cleanup and startup recovery are asynchronous.
+        tokio::time::sleep(StdDuration::from_millis(100)).await;
    }
-    Ok(())
 }

 /// A current-version `Transition Days=0` rule scoped to the object's prefix.
@@ -1477,15 +1508,6 @@ async fn test_manual_transition_async_tier_failure_reports_terminal_partial() ->
    add_rustfs_tier(&hot, &cold).await?;

    hot_client.create_bucket().bucket(MANUAL_TIER_FAILURE_BUCKET).send().await?;
-    let due_mtime = OffsetDateTime::now_utc() - time::Duration::hours(25);
-    put_backdated_single_part_object(
-        &hot_client,
-        MANUAL_TIER_FAILURE_BUCKET,
-        MANUAL_TIER_FAILURE_KEY,
-        b"manual tier failure object",
-        due_mtime,
-    )
-    .await?;
    put_lifecycle_transition_rule(
        &hot_client,
        MANUAL_TIER_FAILURE_BUCKET,
@@ -1496,6 +1518,15 @@ async fn test_manual_transition_async_tier_failure_reports_terminal_partial() ->
    .await?;
    remove_rustfs_tier_force(&hot).await?;

+    let due_mtime = OffsetDateTime::now_utc() - time::Duration::hours(25);
+    put_backdated_single_part_object(
+        &hot_client,
+        MANUAL_TIER_FAILURE_BUCKET,
+        MANUAL_TIER_FAILURE_KEY,
+        b"manual tier failure object",
+        due_mtime,
+    )
+    .await?;
    let before_remote_count = cold_tier_object_count(&cold_client).await?;
    let accepted = manual_transition_async_run(&hot, MANUAL_TIER_FAILURE_BUCKET, MANUAL_TIER_FAILURE_PREFIX, false, 10).await?;
    assert_eq!(accepted.state, "accepted");
@@ -229,7 +229,6 @@ base64-simd.workspace = true
 serde_urlencoded.workspace = true
 google-cloud-storage = { workspace = true }
 google-cloud-auth = { workspace = true }
-aws-config = { workspace = true }
 faster-hex = { workspace = true }
 ratelimit = { workspace = true }
 aws-smithy-http-client = { workspace = true, default-features = false, features = ["rustls-aws-lc"] }
@@ -268,6 +267,7 @@ tracing-subscriber = { workspace = true, features = ["json", "env-filter", "time
 # dispatcher to keep tracing's process-global callsite-interest cache honest.
 tracing-core = { workspace = true }
 serial_test = { workspace = true }
+metrics-util = { workspace = true, features = ["debugging"] }
 opentelemetry_sdk = { workspace = true, features = ["rt-tokio"] }
 proptest = "1"
 rcgen.workspace = true
@@ -90,6 +90,12 @@ use uuid::Uuid;
 const MAX_CONCURRENT_TARGET_HEALTH_CHECKS: usize = 16;
 const REDACTED_CREDENTIAL: &str = "<redacted>";

+pub type HeadObjectSdkError = Box<SdkError<HeadObjectError>>;
+pub type GetObjectSdkError = Box<SdkError<GetObjectError>>;
+pub type GetObjectTaggingSdkError = Box<SdkError<GetObjectTaggingError>>;
+pub type PutObjectTaggingSdkError = Box<SdkError<PutObjectTaggingError>>;
+pub type DeleteObjectTaggingSdkError = Box<SdkError<DeleteObjectTaggingError>>;
+
 pub static GLOBAL_BUCKET_TARGET_SYS: OnceLock<BucketTargetSys> = OnceLock::new();

 fn replication_target_versioning_enabled(versioning: Option<&BucketVersioningStatus>) -> bool {
@@ -1968,7 +1974,7 @@ impl TargetClient {
        bucket: &str,
        object: &str,
        version_id: Option<String>,
-    ) -> Result<HeadObjectOutput, SdkError<HeadObjectError>> {
+    ) -> Result<HeadObjectOutput, HeadObjectSdkError> {
        // Announce the replication check so a RustFS target returns SSE-C
        // object metadata (etag/size) without the customer key the replication
        // worker cannot hold; otherwise SSE-C replicas never converge on HEAD.
@@ -1981,8 +1987,7 @@ impl TargetClient {
        // object with an identical ETag, and the worker concludes the object
        // already converged — so it never actually replicates it.
        insert_header(&mut headers, SUFFIX_SOURCE_PROXY_REQUEST, "false");
-        match self
-            .client
+        self.client
            .head_object()
            .bucket(bucket)
            .key(object)
@@ -1999,10 +2004,7 @@ impl TargetClient {
            })
            .send()
            .await
-        {
-            Ok(res) => Ok(res),
-            Err(e) => Err(e),
-        }
+            .map_err(Box::new)
    }

    /// HEAD used by the read-proxy path (GET/HEAD of an object not yet
@@ -2023,7 +2025,7 @@ impl TargetClient {
        range: Option<String>,
        part_number: Option<i32>,
        extra_headers: HeaderMap,
-    ) -> Result<HeadObjectOutput, SdkError<HeadObjectError>> {
+    ) -> Result<HeadObjectOutput, HeadObjectSdkError> {
        let headers = proxy_outbound_headers(extra_headers);
        self.client
            .head_object()
@@ -2036,6 +2038,7 @@ impl TargetClient {
            .map_request(move |req| apply_extra_headers(req, &headers))
            .send()
            .await
+            .map_err(Box::new)
    }

    /// GET used by the read-proxy path (MinIO `proxyGetToReplicationTarget`).
@@ -2051,7 +2054,7 @@ impl TargetClient {
        range: Option<String>,
        part_number: Option<i32>,
        extra_headers: HeaderMap,
-    ) -> Result<GetObjectOutput, SdkError<GetObjectError>> {
+    ) -> Result<GetObjectOutput, GetObjectSdkError> {
        let headers = proxy_outbound_headers(extra_headers);
        self.client
            .get_object()
@@ -2064,6 +2067,7 @@ impl TargetClient {
            .map_request(move |req| apply_extra_headers(req, &headers))
            .send()
            .await
+            .map_err(Box::new)
    }

    /// GetObjectTagging for the tagging read-proxy path
@@ -2073,7 +2077,7 @@ impl TargetClient {
        bucket: &str,
        object: &str,
        version_id: Option<String>,
-    ) -> Result<GetObjectTaggingOutput, SdkError<GetObjectTaggingError>> {
+    ) -> Result<GetObjectTaggingOutput, GetObjectTaggingSdkError> {
        let headers = proxy_outbound_headers(HeaderMap::new());
        self.client
            .get_object_tagging()
@@ -2084,6 +2088,7 @@ impl TargetClient {
            .map_request(move |req| apply_extra_headers(req, &headers))
            .send()
            .await
+            .map_err(Box::new)
    }

    /// PutObjectTagging for the tagging proxy path
@@ -2094,7 +2099,7 @@ impl TargetClient {
        object: &str,
        version_id: Option<String>,
        tagging: SdkTagging,
-    ) -> Result<PutObjectTaggingOutput, SdkError<PutObjectTaggingError>> {
+    ) -> Result<PutObjectTaggingOutput, PutObjectTaggingSdkError> {
        let headers = proxy_outbound_headers(HeaderMap::new());
        self.client
            .put_object_tagging()
@@ -2106,6 +2111,7 @@ impl TargetClient {
            .map_request(move |req| apply_extra_headers(req, &headers))
            .send()
            .await
+            .map_err(Box::new)
    }

    /// DeleteObjectTagging for the tagging proxy path
@@ -2115,7 +2121,7 @@ impl TargetClient {
        bucket: &str,
        object: &str,
        version_id: Option<String>,
-    ) -> Result<DeleteObjectTaggingOutput, SdkError<DeleteObjectTaggingError>> {
+    ) -> Result<DeleteObjectTaggingOutput, DeleteObjectTaggingSdkError> {
        let headers = proxy_outbound_headers(HeaderMap::new());
        self.client
            .delete_object_tagging()
@@ -2126,6 +2132,7 @@ impl TargetClient {
            .map_request(move |req| apply_extra_headers(req, &headers))
            .send()
            .await
+            .map_err(Box::new)
    }

    /// On success returns the version id the target assigned (from
@@ -2180,7 +2180,7 @@ pub async fn recover_manual_transition_jobs_once(
    if limit == 0 {
        return Err(Error::other("manual transition job recovery limit must be greater than zero"));
    }
-    let list_limit = i32::try_from(limit).map_or(i32::MAX, |value| value);
+    let list_limit = i32::try_from(limit).unwrap_or(i32::MAX);
    let page = api
        .clone()
        .list_objects_v2(
@@ -2386,7 +2386,7 @@ async fn replay_manual_transition_pending_tasks(
            version_id: task.version_id,
            etag: task.etag,
            mod_time,
-            size: task.size.map_or(0, |size| size),
+            size: task.size.unwrap_or(0),
            is_latest: task.is_latest.unwrap_or(false),
            ..Default::default()
        };
@@ -4994,6 +4994,9 @@ pub async fn apply_expiry_on_transitioned_object(
    src: &LcEventSrc,
    bucket_incarnation_id: Uuid,
 ) -> bool {
+    if lc_event.action.delete_all() {
+        return apply_expiry_on_non_transitioned_objects(api, oi, lc_event, src, bucket_incarnation_id).await;
+    }
    let time_ilm = Metrics::time_ilm(lc_event.action);
    if let Err(_err) = expire_transitioned_object(api, oi, lc_event, src, bucket_incarnation_id).await {
        return false;
@@ -5047,13 +5050,24 @@ pub async fn apply_expiry_on_non_transitioned_objects(
    if lc_event.action.delete_all() {
        opts.delete_prefix = true;
        opts.delete_prefix_object = true;
+        opts.lifecycle_delete_all = Some(crate::object_api::LifecycleDeleteAllRequest {
+            version_id: oi.version_id.filter(|version_id| !version_id.is_nil()),
+            delete_marker: oi.delete_marker,
+            action: lc_event.action,
+            rule_id: lc_event.rule_id.clone(),
+            phase: crate::object_api::LifecycleDeleteAllPhase::Preflight,
+        });
+        opts.ensure_lifecycle_delete_all_journal();
    }

    let time_ilm = Metrics::time_ilm(lc_event.action);

    //debug!("lc_event.action: {:?}", lc_event.action);
    debug!("expiry_on_non_transitioned_objects opts: {:?}", opts);
-    let mut dobj = match api.delete_object(&oi.bucket, &encode_dir_object(&oi.name), opts).await {
+    let mut dobj = match api
+        .delete_object_with_tier_delete_journal(&oi.bucket, &encode_dir_object(&oi.name), opts)
+        .await
+    {
        Ok(dobj) => dobj,
        Err(e) => {
            error!(
@@ -5283,7 +5297,7 @@ mod tests {
    };
    use crate::bucket::lifecycle::tier_last_day_stats::LastDayTierStats;
    use crate::bucket::lifecycle::tier_sweeper::Jentry;
-    use crate::bucket::metadata::BUCKET_LIFECYCLE_CONFIG;
+    use crate::bucket::metadata::{BUCKET_LIFECYCLE_CONFIG, BUCKET_VERSIONING_CONFIG};
    use crate::bucket::metadata_sys;
    #[cfg(feature = "test-util")]
    use crate::client::transition_api::ReaderImpl;
@@ -5304,6 +5318,7 @@ mod tests {
    use crate::storage_api_contracts::{
        bucket::{BucketOperations, BucketOptions, DeleteBucketOptions, MakeBucketOptions},
        lifecycle::ExpirationOptions,
+        list::ListOperations as _,
        multipart::MultipartOperations as _,
        object::{ObjectIO as _, ObjectOperations as _},
    };
@@ -10917,6 +10932,199 @@ mod tests {
        );
    }

+    #[tokio::test]
+    #[serial]
+    async fn queued_delete_all_rechecks_a_same_id_rule_moved_into_the_future() {
+        let (_disk_paths, ecstore) = setup_test_env().await;
+        let bucket = format!("stale-delete-all-rule-{}", Uuid::new_v4().simple());
+        let object = "object";
+        create_test_bucket(&ecstore, &bucket).await;
+        metadata_sys::update(
+            &bucket,
+            BUCKET_VERSIONING_CONFIG,
+            b"<VersioningConfiguration><Status>Enabled</Status></VersioningConfiguration>".to_vec(),
+        )
+        .await
+        .expect("bucket versioning should be enabled");
+        let lifecycle_xml = |days| {
+            format!(
+                r#"<LifecycleConfiguration>
+  <Rule>
+    <ID>delete-marker-history</ID>
+    <Status>Enabled</Status>
+    <Filter><Prefix></Prefix></Filter>
+    <DelMarkerExpiration><Days>{days}</Days></DelMarkerExpiration>
+  </Rule>
+</LifecycleConfiguration>"#
+            )
+        };
+        metadata_sys::update(&bucket, BUCKET_LIFECYCLE_CONFIG, lifecycle_xml(1).into_bytes())
+            .await
+            .expect("initial lifecycle rule should be stored");
+
+        let old_time = OffsetDateTime::now_utc() - time::Duration::days(3);
+        let mut reader = PutObjReader::from_vec(b"old version".to_vec());
+        ecstore
+            .put_object(
+                &bucket,
+                object,
+                &mut reader,
+                &ObjectOptions {
+                    versioned: true,
+                    mod_time: Some(old_time - time::Duration::hours(1)),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("old version should be stored");
+        let marker = ecstore
+            .delete_object(
+                &bucket,
+                object,
+                ObjectOptions {
+                    versioned: true,
+                    mod_time: Some(old_time),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("delete marker should be created");
+
+        let queued_event = crate::bucket::lifecycle::lifecycle::Event {
+            action: IlmAction::DelMarkerDeleteAllVersionsAction,
+            rule_id: "delete-marker-history".to_string(),
+            ..Default::default()
+        };
+        metadata_sys::update(&bucket, BUCKET_LIFECYCLE_CONFIG, lifecycle_xml(30).into_bytes())
+            .await
+            .expect("updated lifecycle rule should be stored");
+        let incarnation = ecstore
+            .bucket_incarnation_id_from_disk(&bucket)
+            .await
+            .expect("bucket incarnation should be available");
+
+        let deleted = super::apply_expiry_on_non_transitioned_objects(
+            ecstore.clone(),
+            &marker,
+            &queued_event,
+            &LcEventSrc::Scanner,
+            incarnation,
+        )
+        .await;
+        assert!(!deleted, "the stale queued rule must be rejected");
+        let versions = ecstore
+            .clone()
+            .list_object_versions(&bucket, object, None, None, None, 10)
+            .await
+            .expect("remaining versions should be listable");
+        assert_eq!(versions.objects.iter().filter(|version| version.name == object).count(), 2);
+
+        metadata_sys::update(&bucket, BUCKET_LIFECYCLE_CONFIG, lifecycle_xml(1).into_bytes())
+            .await
+            .expect("due lifecycle rule should be restored");
+        let deleted = super::apply_expiry_on_non_transitioned_objects(
+            ecstore.clone(),
+            &marker,
+            &queued_event,
+            &LcEventSrc::Scanner,
+            incarnation,
+        )
+        .await;
+        assert!(deleted, "the current due rule should purge marker and history");
+        let versions = ecstore
+            .clone()
+            .list_object_versions(&bucket, object, None, None, None, 10)
+            .await
+            .expect("purged versions should be listable");
+        assert_eq!(versions.objects.iter().filter(|version| version.name == object).count(), 0);
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn queued_expired_object_all_versions_purges_history_through_transitioned_dispatch() {
+        let (_disk_paths, ecstore) = setup_test_env().await;
+        let bucket = format!("expired-all-versions-{}", Uuid::new_v4().simple());
+        let object = "object";
+        create_test_bucket(&ecstore, &bucket).await;
+        metadata_sys::update(
+            &bucket,
+            BUCKET_VERSIONING_CONFIG,
+            b"<VersioningConfiguration><Status>Enabled</Status></VersioningConfiguration>".to_vec(),
+        )
+        .await
+        .expect("bucket versioning should be enabled");
+        metadata_sys::update(
+            &bucket,
+            BUCKET_LIFECYCLE_CONFIG,
+            br#"<LifecycleConfiguration>
+  <Rule>
+    <ID>delete-all-versions</ID>
+    <Status>Enabled</Status>
+    <Filter><Prefix></Prefix></Filter>
+    <Expiration><Days>1</Days><ExpiredObjectAllVersions>true</ExpiredObjectAllVersions></Expiration>
+  </Rule>
+</LifecycleConfiguration>"#
+                .to_vec(),
+        )
+        .await
+        .expect("delete-all lifecycle rule should be stored");
+
+        let old_time = OffsetDateTime::now_utc() - time::Duration::days(3);
+        let mut old_reader = PutObjReader::from_vec(b"old version".to_vec());
+        ecstore
+            .put_object(
+                &bucket,
+                object,
+                &mut old_reader,
+                &ObjectOptions {
+                    versioned: true,
+                    mod_time: Some(old_time - time::Duration::hours(1)),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("old version should be stored");
+        let mut current_reader = PutObjReader::from_vec(b"current version".to_vec());
+        let mut current = ecstore
+            .put_object(
+                &bucket,
+                object,
+                &mut current_reader,
+                &ObjectOptions {
+                    versioned: true,
+                    mod_time: Some(old_time),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("current version should be stored");
+        current.transitioned_object.status = crate::bucket::lifecycle::lifecycle::TRANSITION_COMPLETE.to_string();
+
+        let incarnation = ecstore
+            .bucket_incarnation_id_from_disk(&bucket)
+            .await
+            .expect("bucket incarnation should be available");
+        let deleted = super::apply_expiry_on_transitioned_object(
+            ecstore.clone(),
+            &current,
+            &crate::bucket::lifecycle::lifecycle::Event {
+                action: IlmAction::DeleteAllVersionsAction,
+                rule_id: "delete-all-versions".to_string(),
+                ..Default::default()
+            },
+            &LcEventSrc::Scanner,
+            incarnation,
+        )
+        .await;
+
+        assert!(deleted, "delete-all must not degrade to transitioned single-version expiry");
+        let versions = ecstore
+            .list_object_versions(&bucket, object, None, None, None, 10)
+            .await
+            .expect("purged versions should be listable");
+        assert_eq!(versions.objects.iter().filter(|version| version.name == object).count(), 0);
+    }
+
    #[tokio::test]
    async fn existing_object_lifecycle_skips_current_expiration_for_explicit_legal_hold() {
        let lc = latest_expiration_lifecycle();
@@ -435,12 +435,88 @@ async fn process_committed_tier_delete_journal_entry(api: Arc<ECStore>, je: &Jen
    remove_tier_delete_journal_entry(api, je).await
 }

-async fn reconcile_prepared_tier_delete_journal_entry(api: Arc<ECStore>, je: &Jentry) -> std::io::Result<()> {
-    let (data, metadata) =
-        config_boundary::read_config_with_metadata(api.clone(), &tier_delete_journal_object_name(je), &ObjectOptions::default())
+fn object_info_references_tier_delete(info: &ObjectInfo, je: &Jentry) -> std::io::Result<bool> {
+    if info.transitioned_object.status != rustfs_filemeta::TRANSITION_COMPLETE
+        || info.transitioned_object.name != je.obj_name
+        || info.transitioned_object.tier != je.tier_name
+    {
+        return Ok(false);
+    }
+    let source_backend_identity = tier_destination_id_from_metadata(&info.user_defined)?;
+    if source_backend_identity.is_some() && source_backend_identity != je.backend_identity {
+        return Ok(false);
+    }
+    if !je.version_id_exact {
+        return Ok(true);
+    }
+    Ok(match info.transition_version_state {
+        rustfs_filemeta::TransitionVersionState::Unknown => true,
+        rustfs_filemeta::TransitionVersionState::KnownDisabled => false,
+        rustfs_filemeta::TransitionVersionState::SuspendedNull | rustfs_filemeta::TransitionVersionState::Exact => {
+            info.transitioned_object.version_id == je.version_id
+        }
+    })
+}
+
+async fn prepared_tier_delete_has_live_source(
+    api: &ECStore,
+    source: &TierDeleteSourceIdentity,
+    je: &Jentry,
+) -> std::io::Result<(bool, Vec<crate::store::ObjectLockDiagGuard>)> {
+    let lock_object = rustfs_utils::path::encode_dir_object(&source.object);
+    let mut lock_opts = ObjectOptions::default();
+    let read_guards = api
+        .acquire_all_object_read_locks("tier_delete_journal_recovery", &source.bucket, &lock_object, &mut lock_opts)
+        .await
+        .map_err(std::io::Error::other)?;
+    if api.ctx.lock_manager().is_disabled() {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::WouldBlock,
+            "tier delete journal recovery requires namespace locking",
+        ));
+    }
+    let mut has_live_source = false;
+    for pool in &api.pools {
+        let set = pool.get_disks_by_key(&lock_object);
+        let Some(versions) = set
+            .load_file_info_versions_exact(&source.bucket, &source.object)
            .await
-            .map_err(std::io::Error::other)?;
+            .map_err(std::io::Error::other)?
+        else {
+            continue;
+        };
+        for version in versions.versions.iter().filter(|version| !version.tier_free_version()) {
+            let info = ObjectInfo::from_file_info(version, &source.bucket, &source.object, source.versioned);
+            if object_info_references_tier_delete(&info, je)? {
+                has_live_source = true;
+                break;
+            }
+        }
+        if has_live_source {
+            break;
+        }
+    }
+    if read_guards.iter().any(crate::store::ObjectLockDiagGuard::is_lock_lost) {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::WouldBlock,
+            "tier delete journal recovery object read lock was lost",
+        ));
+    }
+    Ok((has_live_source, read_guards))
+}
+
+async fn reconcile_prepared_tier_delete_journal_entry(api: Arc<ECStore>, je: &Jentry) -> std::io::Result<()> {
+    let journal_name = tier_delete_journal_object_name(je);
+    let (data, metadata) = config_boundary::read_config_with_metadata(api.clone(), &journal_name, &ObjectOptions::default())
+        .await
+        .map_err(std::io::Error::other)?;
    let current = decode_tier_delete_journal_entry(&data).map_err(std::io::Error::other)?;
+    if tier_delete_journal_object_name(&current) != journal_name {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            "prepared tier delete journal content does not match its object name",
+        ));
+    }
    if current.state != TierDeleteJournalState::Prepared {
        return Err(std::io::Error::new(
            std::io::ErrorKind::WouldBlock,
@@ -453,16 +529,21 @@ async fn reconcile_prepared_tier_delete_journal_entry(api: Arc<ECStore>, je: &Je
            "prepared tier delete journal has no entity tag",
        ));
    };
-    let source = je
+    let source = current
        .source
        .as_ref()
        .ok_or_else(|| std::io::Error::new(std::io::ErrorKind::InvalidData, "prepared tier delete journal has no source"))?;
-    match api
-        .get_object_info(&source.bucket, &source.object, &source.lookup_options())
-        .await
-    {
-        Ok(info) if source.matches(&info) => {
-            match config_boundary::delete_config_if_match(api, &tier_delete_journal_object_name(&current), &etag).await {
+    match prepared_tier_delete_has_live_source(&api, source, &current).await {
+        Ok((true, read_guards)) => {
+            if read_guards.iter().any(crate::store::ObjectLockDiagGuard::is_lock_lost) {
+                return Err(std::io::Error::new(
+                    std::io::ErrorKind::WouldBlock,
+                    "tier delete journal recovery object read lock was lost before abort",
+                ));
+            }
+            let result = config_boundary::delete_config_if_match(api, &tier_delete_journal_object_name(&current), &etag).await;
+            drop(read_guards);
+            match result {
                Ok(()) => Ok(()),
                Err(Error::PreconditionFailed) => Err(std::io::Error::new(
                    std::io::ErrorKind::WouldBlock,
@@ -471,17 +552,32 @@ async fn reconcile_prepared_tier_delete_journal_entry(api: Arc<ECStore>, je: &Je
                Err(err) => Err(std::io::Error::other(err)),
            }
        }
-        Ok(_info) if source.has_stable_identity() => {
-            commit_prepared_tier_delete_journal_entry_if_current(api, current, etag).await
+        Ok((false, read_guards)) if source.has_stable_identity() => {
+            if read_guards.iter().any(crate::store::ObjectLockDiagGuard::is_lock_lost) {
+                return Err(std::io::Error::new(
+                    std::io::ErrorKind::WouldBlock,
+                    "tier delete journal recovery object read lock was lost before commit",
+                ));
+            }
+            let mut commit_opts = ObjectOptions::default();
+            for signal in read_guards
+                .iter()
+                .filter_map(crate::store::ObjectLockDiagGuard::lock_lost_signal)
+            {
+                commit_opts.add_namespace_lock_lost_signal(signal);
+            }
+            let committed =
+                commit_prepared_tier_delete_journal_entry_if_current(api.clone(), current, etag, &commit_opts).await?;
+            // Keep namespace locks only through the journal CAS. Remote-tier IO
+            // must not block writers for the object during recovery.
+            drop(read_guards);
+            process_committed_tier_delete_journal_entry(api, &committed).await
        }
-        Ok(_) => Err(std::io::Error::new(
+        Ok((false, _read_guards)) => Err(std::io::Error::new(
            std::io::ErrorKind::WouldBlock,
            "prepared tier delete journal source identity is not sufficient to confirm deletion",
        )),
-        Err(Error::ObjectNotFound(_, _)) | Err(Error::FileNotFound) | Err(Error::FileVersionNotFound) => {
-            commit_prepared_tier_delete_journal_entry_if_current(api, current, etag).await
-        }
-        Err(err) => Err(std::io::Error::other(err)),
+        Err(err) => Err(err),
    }
 }

@@ -489,7 +585,8 @@ async fn commit_prepared_tier_delete_journal_entry_if_current(
    api: Arc<ECStore>,
    mut committed: Jentry,
    etag: String,
-) -> std::io::Result<()> {
+    lock_opts: &ObjectOptions,
+) -> std::io::Result<Jentry> {
    committed.state = TierDeleteJournalState::Committed;
    let data = encode_tier_delete_journal_entry(&committed).map_err(std::io::Error::other)?;
    match config_boundary::save_config_with_opts(
@@ -502,12 +599,13 @@ async fn commit_prepared_tier_delete_journal_entry_if_current(
                if_match: Some(etag),
                ..Default::default()
            }),
+            namespace_lock_fence: lock_opts.namespace_lock_fence.clone(),
            ..Default::default()
        },
    )
    .await
    {
-        Ok(()) => process_committed_tier_delete_journal_entry(api, &committed).await,
+        Ok(()) => Ok(committed),
        Err(Error::PreconditionFailed) => Err(std::io::Error::new(
            std::io::ErrorKind::WouldBlock,
            "prepared tier delete journal changed before commit",
@@ -582,6 +680,18 @@ pub async fn recover_tier_delete_journal_entries(
            }
        };

+        if tier_delete_journal_object_name(&je) != object.name {
+            stats.failed += 1;
+            warn!(
+                event = EVENT_LIFECYCLE_TIER_DELETE_JOURNAL,
+                component = LOG_COMPONENT_ECSTORE,
+                subsystem = LOG_SUBSYSTEM_LIFECYCLE,
+                journal_object = %object.name,
+                "Tier delete journal content does not match its object name and will be retained"
+            );
+            continue;
+        }
+
        if je.backend_identity.is_none() {
            stats.failed += 1;
            warn!(
@@ -699,16 +809,14 @@ where
 mod tests {
    use super::{
        TIER_DELETE_JOURNAL_EXACT_VERSION, TIER_DELETE_JOURNAL_STATE_VERSION, await_tier_delete_journal_recovery,
-        decode_tier_delete_journal_entry, encode_tier_delete_journal_entry, record_tier_delete_journal_backend_identity,
-        tier_delete_journal_object_name,
+        decode_tier_delete_journal_entry, encode_tier_delete_journal_entry, object_info_references_tier_delete,
+        record_tier_delete_journal_backend_identity, tier_delete_journal_object_name,
    };
    use crate::bucket::lifecycle::tier_sweeper::{Jentry, TierDeleteJournalState, TierDeleteSourceIdentity};
    use crate::error::Result;
    use crate::object_api::ObjectInfo;
    use std::time::Duration;
-    use time::OffsetDateTime;
    use tokio_util::sync::CancellationToken;
-    use uuid::Uuid;

    fn journal_entry() -> Jentry {
        Jentry {
@@ -738,6 +846,16 @@ mod tests {
        assert_eq!(decoded.version_state, je.version_state);
    }

+    #[test]
+    fn tier_delete_journal_object_name_binds_persisted_content() {
+        let original = journal_entry();
+        let original_name = tier_delete_journal_object_name(&original);
+        let mut replaced = original;
+        replaced.obj_name = "remote/replaced".to_string();
+
+        assert_ne!(tier_delete_journal_object_name(&replaced), original_name);
+    }
+
    #[test]
    fn tier_delete_transaction_roundtrips_prepared_source_identity() {
        let mut je = journal_entry();
@@ -765,26 +883,35 @@ mod tests {
    }

    #[test]
-    fn tier_delete_source_identity_rejects_recreated_object() {
-        let version_id = Uuid::from_u128(1);
-        let data_dir = Uuid::from_u128(2);
-        let mod_time = OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(1);
-        let info = ObjectInfo {
-            bucket: "bucket".to_string(),
-            name: "object".to_string(),
-            version_id: Some(version_id),
-            data_dir: Some(data_dir),
-            mod_time: Some(mod_time),
+    fn prepared_recovery_blocks_any_live_reference_to_the_remote_version() {
+        let je = journal_entry();
+        let mut metadata = std::collections::HashMap::new();
+        rustfs_utils::http::metadata_compat::insert_str(
+            &mut metadata,
+            rustfs_utils::http::metadata_compat::SUFFIX_TRANSITION_TIER_DESTINATION_ID,
+            rustfs_utils::crypto::hex(je.backend_identity.expect("test journal should bind a backend")),
+        );
+        let mut info = ObjectInfo {
+            user_defined: std::sync::Arc::new(metadata),
+            transitioned_object: crate::storage_api_contracts::lifecycle::TransitionedObject {
+                name: je.obj_name.clone(),
+                version_id: je.version_id.clone(),
+                tier: je.tier_name.clone(),
+                status: rustfs_filemeta::TRANSITION_COMPLETE.to_string(),
+                ..Default::default()
+            },
+            transition_version_state: rustfs_filemeta::TransitionVersionState::Exact,
            ..Default::default()
        };
-        let source = TierDeleteSourceIdentity::from_object_info("bucket", "object", &info, true, false);
-        assert!(source.matches(&info));

-        let recreated = ObjectInfo {
-            data_dir: Some(Uuid::from_u128(3)),
-            ..info
-        };
-        assert!(!source.matches(&recreated));
+        assert!(object_info_references_tier_delete(&info, &je).expect("matching reference should be valid"));
+        info.transitioned_object.version_id = "other-version".to_string();
+        assert!(!object_info_references_tier_delete(&info, &je).expect("different exact version should be valid"));
+        info.transition_version_state = rustfs_filemeta::TransitionVersionState::Unknown;
+        assert!(
+            object_info_references_tier_delete(&info, &je).expect("legacy unknown reference should fail closed"),
+            "an unknown live source may still reference the journaled remote version"
+        );
    }

    #[test]
@@ -334,32 +334,6 @@ impl TierDeleteSourceIdentity {
        }
    }

-    pub(crate) fn lookup_options(&self) -> crate::object_api::ObjectOptions {
-        crate::object_api::ObjectOptions {
-            version_id: self.version_id.clone(),
-            versioned: self.versioned,
-            version_suspended: self.version_suspended,
-            ..Default::default()
-        }
-    }
-
-    pub(crate) fn matches(&self, info: &ObjectInfo) -> bool {
-        if self.bucket != info.bucket {
-            return false;
-        }
-        if let Some(version_id) = &self.version_id {
-            return info.version_id.map(|id| id.to_string()).as_deref() == Some(version_id.as_str())
-                && self.data_dir == info.data_dir.map(|id| id.to_string());
-        }
-        if self.data_dir.is_some() {
-            return self.data_dir == info.data_dir.map(|id| id.to_string());
-        }
-        self.etag.is_some()
-            && self.etag == info.etag
-            && self.mod_time.is_some()
-            && self.mod_time == info.mod_time.map(|time| time.to_string())
-    }
-
    pub(crate) fn has_stable_identity(&self) -> bool {
        self.version_id.is_some() || self.data_dir.is_some() || (self.etag.is_some() && self.mod_time.is_some())
    }
@@ -1016,7 +1016,7 @@ pub async fn recover_transition_transaction_records(
        return Err(Error::other("transition transaction recovery limit must be greater than zero"));
    }

-    let list_limit = i32::try_from(limit).map_or(i32::MAX, |value| value);
+    let list_limit = i32::try_from(limit).unwrap_or(i32::MAX);
    let list = api
        .clone()
        .list_objects_v2(
@@ -41,6 +41,7 @@ const IAM_FORMAT_FILE_PATH: &str = "config/iam/format.json";
 const IAM_USERS_PREFIX: &str = "config/iam/users/";
 const IAM_SERVICE_ACCOUNTS_PREFIX: &str = "config/iam/service-accounts/";
 const IAM_STS_PREFIX: &str = "config/iam/sts/";
+const MINIO_GO_ZERO_TIME: OffsetDateTime = time::macros::datetime!(0001-01-01 00:00 UTC);
 const IAM_GROUPS_PREFIX: &str = "config/iam/groups/";
 const IAM_POLICIES_PREFIX: &str = "config/iam/policies/";
 const IAM_POLICY_DB_PREFIX: &str = "config/iam/policydb/";
@@ -120,6 +121,15 @@ fn normalize_iam_config_blob(path: &str, data: &[u8]) -> std::result::Result<Opt
    if is_identity_path(path) {
        let mut identity: UserIdentity =
            serde_json::from_slice(data).map_err(|err| format!("parse IAM identity failed: {err}"))?;
+        if (path.starts_with(IAM_USERS_PREFIX) || path.starts_with(IAM_SERVICE_ACCOUNTS_PREFIX))
+            && identity
+                .credentials
+                .expiration
+                .as_ref()
+                .is_some_and(|expiration| *expiration == MINIO_GO_ZERO_TIME || *expiration == OffsetDateTime::UNIX_EPOCH)
+        {
+            identity.credentials.expiration = None;
+        }
        if identity.update_at.is_none() {
            identity.update_at = Some(OffsetDateTime::now_utc());
        }
@@ -441,7 +451,10 @@ mod tests {
    use crate::bucket::replication::{
        BucketReplicationResyncStatus, ReplicationMigrationBridge, ResyncStatusType, TargetReplicationResyncStatus,
    };
+    use rustfs_policy::auth::UserIdentity;
    use std::collections::HashMap;
+    use time::OffsetDateTime;
+    use time::format_description::well_known::Rfc3339;

    #[test]
    fn test_normalize_policy_mapping_legacy_timestamp_and_fields() {
@@ -493,6 +506,54 @@ mod tests {
        assert!(v.get("updatedAt").is_some(), "normalize should backfill updatedAt");
    }

+    #[test]
+    fn test_normalize_minio_permanent_credential_expiration() {
+        let cases = [
+            ("config/iam/users/alice/identity.json", "0001-01-01T00:00:00Z", true),
+            ("config/iam/users/alice/identity.json", "1970-01-01T00:00:00Z", true),
+            ("config/iam/service-accounts/svc/identity.json", "0001-01-01T00:00:00Z", true),
+            ("config/iam/service-accounts/svc/identity.json", "1970-01-01T00:00:00Z", true),
+            ("config/iam/service-accounts/svc/identity.json", "1970-01-01T00:00:00.000000001Z", false),
+            ("config/iam/sts/temp/identity.json", "0001-01-01T00:00:00Z", false),
+            ("config/iam/sts/temp/identity.json", "1970-01-01T00:00:00Z", false),
+            ("config/iam/users/alice/identity.json", "1969-12-31T23:59:59Z", false),
+            ("config/iam/users/alice/identity.json", "1970-01-01T00:00:00.000000001Z", false),
+            ("config/iam/users/alice/identity.json", "0001-01-01T00:00:00.000000001Z", false),
+            ("config/iam/users/alice/identity.json", "2030-01-01T00:00:00Z", false),
+        ];
+
+        for (path, expiration, should_clear) in cases {
+            let input = serde_json::json!({
+                "version": 1,
+                "credentials": {
+                    "accessKey": "test-access",
+                    "secretKey": "test-secret",
+                    "sessionToken": "test-session-token",
+                    "parentUser": "test-parent",
+                    "expiration": expiration,
+                }
+            });
+            let output = normalize_iam_config_blob(path, &serde_json::to_vec(&input).expect("serialize identity fixture"))
+                .expect("normalize should succeed")
+                .expect("identity path should be supported");
+            let identity: UserIdentity = serde_json::from_slice(&output).expect("deserialize normalized identity");
+
+            assert_eq!(identity.credentials.access_key, "test-access");
+            assert_eq!(identity.credentials.secret_key, "test-secret");
+            assert_eq!(identity.credentials.session_token, "test-session-token");
+            assert_eq!(identity.credentials.parent_user, "test-parent");
+            if should_clear {
+                assert_eq!(identity.credentials.expiration, None, "path: {path}, expiration: {expiration}");
+            } else {
+                assert_eq!(
+                    identity.credentials.expiration,
+                    Some(OffsetDateTime::parse(expiration, &Rfc3339).expect("parse expected expiration")),
+                    "path: {path}, expiration: {expiration}"
+                );
+            }
+        }
+    }
+
    #[test]
    fn test_normalize_bucket_meta_blob_resync_reencode() {
        let path = ".buckets/test/.replication/resync.bin";
@@ -76,7 +76,12 @@ impl QuotaChecker {

        let current_usage = self.get_real_time_usage(bucket).await?;

-        let admission_size = if uses_durable_reservations { 0 } else { operation_size };
+        // The reporting path projects this operation; storage mutations reserve it at commit.
+        let admission_size = if uses_durable_reservations && !force_usage_calculation {
+            0
+        } else {
+            operation_size
+        };
        let expected_usage = match operation {
            QuotaOperation::PutObject | QuotaOperation::PostObject | QuotaOperation::CopyObject => {
                current_usage.saturating_add(admission_size)
@@ -23,6 +23,8 @@ use super::replication_queue_boundary::DeletedObjectReplicationInfo;
 use super::replication_storage_boundary::{
    DeletedObject, ObjectInfo, ObjectOptions, ObjectToDelete, deleted_object_for_replication,
 };
+#[cfg(test)]
+use std::sync::Mutex;

 #[allow(
    dead_code,
@@ -32,6 +34,9 @@ pub(crate) type ReplicationLifecycleConfig = ReplicationConfig;

 pub(crate) struct ReplicationLifecycleBridge;

+#[cfg(test)]
+static SCHEDULED_DELETE_OBJECTS: Mutex<Vec<DeletedObject>> = Mutex::new(Vec::new());
+
 impl ReplicationLifecycleBridge {
    #[allow(
        dead_code,
@@ -85,6 +90,13 @@ impl ReplicationLifecycleBridge {
    }

    pub(crate) async fn schedule_delete(bucket: String, delete_object: DeletedObject) {
+        #[cfg(test)]
+        {
+            SCHEDULED_DELETE_OBJECTS
+                .lock()
+                .expect("scheduled delete test hook lock should not poison")
+                .push(delete_object.clone());
+        }
        super::replication_pool::schedule_replication_delete(DeletedObjectReplicationInfo {
            delete_object: deleted_object_for_replication(delete_object),
            bucket,
@@ -93,6 +105,15 @@ impl ReplicationLifecycleBridge {
        })
        .await;
    }
+
+    #[cfg(test)]
+    pub(crate) fn take_scheduled_deletes_for_test() -> Vec<DeletedObject> {
+        std::mem::take(
+            &mut *SCHEDULED_DELETE_OBJECTS
+                .lock()
+                .expect("scheduled delete test hook lock should not poison"),
+        )
+    }
 }

 #[cfg(test)]
@@ -52,8 +52,8 @@ use super::replication_storage_boundary::{
    ReplicationObjectIO, ReplicationStorage, StatObjectOptions, StorageObjectInfoOrErr, WalkOptions,
 };
 use super::replication_target_boundary::{
-    ERR_REPLICATION_SSEC_PASSTHROUGH_UNSUPPORTED, PutObjectOptions, PutObjectPartOptions, ReplicationTargetStore,
-    SsecPassthroughCapability, SsecPassthroughGate, TargetClient, is_replication_target_offline_error,
+    ERR_REPLICATION_SSEC_PASSTHROUGH_UNSUPPORTED, HeadObjectSdkError, PutObjectOptions, PutObjectPartOptions,
+    ReplicationTargetStore, SsecPassthroughCapability, SsecPassthroughGate, TargetClient, is_replication_target_offline_error,
    replication_action_for_target_head, replication_complete_multipart_options, replication_delete_marker_purge_remove_options,
    replication_delete_remove_options, replication_force_delete_remove_options, replication_object_is_ssec_encrypted,
    replication_put_object_header_size, replication_put_object_options, replication_target_head_is_newer_null_version,
@@ -214,7 +214,7 @@ async fn head_object_for_worker(
    target_bucket: &str,
    object: &str,
    version_id: Option<String>,
-) -> std::result::Result<HeadObjectOutput, SdkError<HeadObjectError>> {
+) -> std::result::Result<HeadObjectOutput, HeadObjectSdkError> {
    target_client.head_object(target_bucket, object, version_id).await
 }

@@ -233,7 +233,7 @@ async fn mark_replication_target_offline_if_needed(target_client: &Arc<TargetCli
 async fn head_object_fallback(
    tgt_client: &TargetClient,
    object: &str,
-) -> std::result::Result<Option<HeadObjectOutput>, SdkError<HeadObjectError>> {
+) -> std::result::Result<Option<HeadObjectOutput>, HeadObjectSdkError> {
    match head_object_for_worker(tgt_client, &tgt_client.bucket, object, None).await {
        Ok(oi) => Ok(Some(oi)),
        Err(e) if e.as_service_error().is_some_and(|se| se.is_not_found()) || has_raw_status(&e, 404) => Ok(None),
@@ -1152,11 +1152,11 @@ fn spawn_resync_walk_task<S: ReplicationStorage>(
 /// updating the per-object status counters and returning the accounted size
 /// together with any verification error.
 async fn verify_resync_head_result(
-    head_result: std::result::Result<HeadObjectOutput, SdkError<HeadObjectError>>,
+    head_result: std::result::Result<HeadObjectOutput, HeadObjectSdkError>,
    roi: &ReplicateObjectInfo,
    st: &mut TargetReplicationResyncStatus,
    target_client: &Arc<TargetClient>,
-) -> (i64, Option<SdkError<HeadObjectError>>) {
+) -> (i64, Option<HeadObjectSdkError>) {
    match head_result {
        Ok(_) => {
            st.replicated_count += 1;
@@ -1275,7 +1275,7 @@ async fn resync_worker_process_object<S: ReplicationStorage>(
            "Processed resync object"
        );
    }
-    st.error = err.as_ref().and_then(resync_target_error_detail);
+    st.error = err.as_ref().and_then(|err| resync_target_error_detail(err.as_ref()));

    st
 }
@@ -2467,7 +2467,7 @@ async fn replicate_delete_to_target(dobj: &DeletedObjectReplicationInfo, tgt_cli
            Ok(_) => {}
            Err(e) => {
                let non_retryable = matches!(
-                    &e,
+                    e.as_ref(),
                    SdkError::ServiceError(service_err)
                        if is_retryable_delete_replication_head_error(
                            service_err.err().is_not_found(),
@@ -36,7 +36,8 @@ use time::OffsetDateTime;
 use time::format_description::well_known::Rfc3339;

 pub(crate) use crate::bucket::bucket_target_sys::{
-    AdvancedPutOptions, PutObjectOptions, PutObjectPartOptions, RemoveObjectOptions, TargetClient, resolve_read_api_version_id,
+    AdvancedPutOptions, HeadObjectSdkError, PutObjectOptions, PutObjectPartOptions, RemoveObjectOptions, TargetClient,
+    resolve_read_api_version_id,
 };
 #[cfg(test)]
 pub(crate) use crate::bucket::target::BucketTarget;
@@ -41,6 +41,10 @@ use bytes::Bytes;
 use futures::lock::Mutex;
 use metrics::counter;
 use rustfs_filemeta::{FileInfo, ObjectPartInfo, RawFileInfo};
+use rustfs_io_metrics::internode_metrics::{
+    INTERNODE_STAGE_READ_VERSION_REQUEST_ENCODE, INTERNODE_STAGE_READ_VERSION_RESPONSE_DECODE,
+    INTERNODE_STAGE_READ_VERSION_RPC_ROUNDTRIP,
+};
 use rustfs_protos::ChannelClass;
 use rustfs_protos::evict_failed_connection;
 use rustfs_protos::proto_gen::node_service::RenamePartRequest;
@@ -64,7 +68,7 @@ use std::{
        atomic::{AtomicBool, AtomicU32, Ordering},
    },
    task::{Context, Poll},
-    time::Duration,
+    time::{Duration, Instant},
 };
 use tokio::time;
 use tokio::{
@@ -1790,6 +1794,16 @@ fn decode_msgpack_or_json<T: DeserializeOwned>(binary: &[u8], json: &str, value_
    }
 }

+fn read_version_stage_timer(attribution_enabled: bool) -> Option<Instant> {
+    attribution_enabled.then(Instant::now)
+}
+
+fn record_read_version_stage(stage: &'static str, started_at: Option<Instant>) {
+    if let Some(started_at) = started_at {
+        crate::cluster::rpc::runtime_sources::record_remote_disk_grpc_read_version_stage(stage, started_at.elapsed());
+    }
+}
+
 /// Aggregate encoded size (bytes) of a `ReadMultiple` response, preferring the msgpack payloads
 /// and falling back to the JSON compatibility strings. Used to size the RPC for the payload
 /// histogram / large-payload alerting (grpc-optimization P0 instrumentation).
@@ -2705,8 +2719,11 @@ impl DiskAPI for RemoteDisk {
            state = "started",
            "Remote disk RPC started"
        );
-        let opts_str = compat_json(opts)?;
-        let opts_bin = encode_msgpack(opts)?;
+        let read_version_attribution_enabled = rustfs_io_metrics::get_stage_metrics_enabled();
+        let encode_started = read_version_stage_timer(read_version_attribution_enabled);
+        let encoded_opts = compat_json(opts).and_then(|opts_str| encode_msgpack(opts).map(|opts_bin| (opts_str, opts_bin)));
+        record_read_version_stage(INTERNODE_STAGE_READ_VERSION_REQUEST_ENCODE, encode_started);
+        let (opts_str, opts_bin) = encoded_opts?;

        // Idempotent version read: eligible for the bounded transient-network retry so a single
        // reset-by-peer during the read-after-write window does not erode the metadata read
@@ -2722,6 +2739,14 @@ impl DiskAPI for RemoteDisk {
                    .get_client()
                    .await
                    .map_err(|err| Error::other(format!("can not get client, err: {err}")))?;
+                let request_payload_bytes = read_version_attribution_enabled.then(|| {
+                    disk.len()
+                        .saturating_add(volume.len())
+                        .saturating_add(path.len())
+                        .saturating_add(version_id.len())
+                        .saturating_add(opts_str.len())
+                        .saturating_add(opts_bin.len())
+                });
                let request = Request::new(ReadVersionRequest {
                    disk,
                    volume: volume.to_string(),
@@ -2731,14 +2756,47 @@ impl DiskAPI for RemoteDisk {
                    opts_bin: opts_bin.into(),
                });

-                let response = client.read_version(request).await?.into_inner();
+                crate::cluster::rpc::runtime_sources::record_remote_disk_grpc_read_version_request();
+                if let Some(request_payload_bytes) = request_payload_bytes {
+                    crate::cluster::rpc::runtime_sources::record_remote_disk_grpc_read_version_sent_bytes(request_payload_bytes);
+                }
+                let rpc_started = read_version_stage_timer(read_version_attribution_enabled);
+                let response = match client.read_version(request).await {
+                    Ok(response) => {
+                        record_read_version_stage(INTERNODE_STAGE_READ_VERSION_RPC_ROUNDTRIP, rpc_started);
+                        response.into_inner()
+                    }
+                    Err(err) => {
+                        record_read_version_stage(INTERNODE_STAGE_READ_VERSION_RPC_ROUNDTRIP, rpc_started);
+                        crate::cluster::rpc::runtime_sources::record_remote_disk_grpc_read_version_error();
+                        return Err(err.into());
+                    }
+                };

                if !response.success {
+                    crate::cluster::rpc::runtime_sources::record_remote_disk_grpc_read_version_error();
                    return Err(response.error.unwrap_or_default().into());
                }

-                let file_info = decode_msgpack_or_json::<FileInfo>(&response.file_info_bin, &response.file_info, "FileInfo")?;
-                validate_decoded_file_info(&file_info)?;
+                crate::cluster::rpc::runtime_sources::record_remote_disk_grpc_read_version_recv_bytes(
+                    response.file_info.len().saturating_add(response.file_info_bin.len()),
+                );
+                let decode_started = read_version_stage_timer(read_version_attribution_enabled);
+                let file_info = match decode_msgpack_or_json::<FileInfo>(&response.file_info_bin, &response.file_info, "FileInfo")
+                    .and_then(|file_info| {
+                        validate_decoded_file_info(&file_info)?;
+                        Ok(file_info)
+                    }) {
+                    Ok(file_info) => {
+                        record_read_version_stage(INTERNODE_STAGE_READ_VERSION_RESPONSE_DECODE, decode_started);
+                        file_info
+                    }
+                    Err(err) => {
+                        record_read_version_stage(INTERNODE_STAGE_READ_VERSION_RESPONSE_DECODE, decode_started);
+                        crate::cluster::rpc::runtime_sources::record_remote_disk_grpc_read_version_error();
+                        return Err(err);
+                    }
+                };

                Ok(file_info)
            },
@@ -7931,12 +7989,17 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn read_version_uses_the_metadata_timeout_on_a_stalled_peer() {
        runtime_sources::ensure_test_rpc_secret();
        let Some((base_addr, accept_task)) = spawn_stalled_grpc_peer().await else {
            return;
        };
        let remote_disk = remote_disk_for_addr(&base_addr).await;
+        let metrics = rustfs_io_metrics::internode_metrics::global_internode_metrics();
+        let previous_stage_metrics = rustfs_io_metrics::get_stage_metrics_enabled();
+        metrics.reset_for_test();
+        rustfs_io_metrics::set_get_stage_metrics_enabled(true);

        temp_env::async_with_vars(
            [
@@ -7960,6 +8023,18 @@ mod tests {
        )
        .await;

+        rustfs_io_metrics::set_get_stage_metrics_enabled(previous_stage_metrics);
+        let snapshot = metrics.snapshot();
+        assert!(
+            snapshot.outgoing_requests_total >= 1,
+            "ReadVersion call site should record outgoing attempts when attribution is enabled"
+        );
+        assert!(
+            snapshot.sent_bytes_total > 0,
+            "ReadVersion call site should record request payload bytes when attribution is enabled"
+        );
+        metrics.reset_for_test();
+
        remote_disk.cancel_token.cancel();
        accept_task.abort();
    }
@@ -14,10 +14,11 @@

 use rustfs_io_metrics::internode_metrics::{
    INTERNODE_MSGPACK_CODEC_JSON, INTERNODE_MSGPACK_CODEC_MSGPACK, INTERNODE_MSGPACK_DIRECTION_RESPONSE,
-    INTERNODE_OPERATION_GRPC_READ_ALL, INTERNODE_OPERATION_GRPC_READ_MULTIPLE, INTERNODE_OPERATION_GRPC_WRITE_ALL,
-    INTERNODE_OPERATION_PUT_FILE_STREAM, INTERNODE_OPERATION_READ_FILE_STREAM, INTERNODE_TRANSPORT_BACKEND_GRPC,
-    INTERNODE_TRANSPORT_BACKEND_TCP_HTTP, global_internode_metrics,
+    INTERNODE_OPERATION_GRPC_READ_ALL, INTERNODE_OPERATION_GRPC_READ_MULTIPLE, INTERNODE_OPERATION_GRPC_READ_VERSION,
+    INTERNODE_OPERATION_GRPC_WRITE_ALL, INTERNODE_OPERATION_PUT_FILE_STREAM, INTERNODE_OPERATION_READ_FILE_STREAM,
+    INTERNODE_TRANSPORT_BACKEND_GRPC, INTERNODE_TRANSPORT_BACKEND_TCP_HTTP, global_internode_metrics,
 };
+use std::time::Duration;

 #[cfg(test)]
 use rustfs_io_metrics::internode_metrics::InternodeMetricsSnapshot;
@@ -82,6 +83,59 @@ pub(crate) fn record_remote_disk_grpc_read_all_request() {
        .record_outgoing_request_for_operation_and_backend(INTERNODE_OPERATION_GRPC_READ_ALL, INTERNODE_TRANSPORT_BACKEND_GRPC);
 }

+pub(crate) fn record_remote_disk_grpc_read_version_request() {
+    if !rustfs_io_metrics::get_stage_metrics_enabled() {
+        return;
+    }
+    global_internode_metrics().record_outgoing_request_for_operation_and_backend(
+        INTERNODE_OPERATION_GRPC_READ_VERSION,
+        INTERNODE_TRANSPORT_BACKEND_GRPC,
+    );
+}
+
+pub(crate) fn record_remote_disk_grpc_read_version_error() {
+    if !rustfs_io_metrics::get_stage_metrics_enabled() {
+        return;
+    }
+    global_internode_metrics()
+        .record_error_for_operation_and_backend(INTERNODE_OPERATION_GRPC_READ_VERSION, INTERNODE_TRANSPORT_BACKEND_GRPC);
+}
+
+pub(crate) fn record_remote_disk_grpc_read_version_sent_bytes(bytes: usize) {
+    if !rustfs_io_metrics::get_stage_metrics_enabled() {
+        return;
+    }
+    global_internode_metrics().record_sent_bytes_for_operation_and_backend(
+        INTERNODE_OPERATION_GRPC_READ_VERSION,
+        INTERNODE_TRANSPORT_BACKEND_GRPC,
+        bytes,
+    );
+}
+
+pub(crate) fn record_remote_disk_grpc_read_version_recv_bytes(bytes: usize) {
+    if !rustfs_io_metrics::get_stage_metrics_enabled() {
+        return;
+    }
+    global_internode_metrics().record_recv_bytes_for_operation_and_backend(
+        INTERNODE_OPERATION_GRPC_READ_VERSION,
+        INTERNODE_TRANSPORT_BACKEND_GRPC,
+        bytes,
+    );
+    record_grpc_payload_size(INTERNODE_OPERATION_GRPC_READ_VERSION, bytes);
+}
+
+pub(crate) fn record_remote_disk_grpc_read_version_stage(stage: &'static str, duration: Duration) {
+    if !rustfs_io_metrics::get_stage_metrics_enabled() {
+        return;
+    }
+    global_internode_metrics().record_stage_duration_for_operation_and_backend(
+        INTERNODE_OPERATION_GRPC_READ_VERSION,
+        INTERNODE_TRANSPORT_BACKEND_GRPC,
+        stage,
+        duration,
+    );
+}
+
 pub(crate) fn record_remote_disk_grpc_read_all_recv_bytes(bytes: usize) {
    global_internode_metrics().record_recv_bytes_for_operation_and_backend(
        INTERNODE_OPERATION_GRPC_READ_ALL,
@@ -94,6 +94,9 @@ const DECOMMISSION_BUCKET_CONCURRENCY_DEFAULT_CAP: usize = 4;
 const DECOMMISSION_TARGET_CAPACITY_OVERHEAD_PERCENT: usize = 30;
 const DECOMMISSION_LISTING_MAX_ATTEMPTS: usize = 3;
 const DECOMMISSION_LISTING_RETRY_DELAY: std::time::Duration = std::time::Duration::from_secs(5);
+/// Background decommission walks must tolerate slow object migrations; the
+/// stall timeout is the drive-health bound, not the total listing duration.
+const DECOMMISSION_BACKGROUND_WALKDIR_STALL_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(60);

 pub const POOL_META_NAME: &str = "pool.bin";
 pub const POOL_META_FORMAT: u16 = 1;
@@ -1041,7 +1044,13 @@ fn should_count_decommission_version_complete(ignore: bool, cleanup_ignored: boo
 fn is_decommission_copy_cleanup_safe_error(err: &Error) -> bool {
    // DataMovementOverwriteErr only means source and destination pool resolved to
    // the same pool. Without a target equivalence check it is not cleanup-safe.
-    is_err_object_not_found(err) || is_err_version_not_found(err)
+    if is_err_object_not_found(err) || is_err_version_not_found(err) {
+        return true;
+    }
+
+    // A not-found surfacing from inside a data-movement stage is the same
+    // condition once the wrapper is unwrapped (backlog#1827 T2).
+    crate::data_movement::data_movement_stage_source(err).is_some_and(is_decommission_copy_cleanup_safe_error)
 }

 fn is_decommission_target_capacity_error(err: &Error) -> bool {
@@ -1049,6 +1058,13 @@ fn is_decommission_target_capacity_error(err: &Error) -> bool {
        return true;
    }

+    // A stage failure keeps the error it wrapped, so classify by type rather
+    // than by the rendered message (backlog#1827 T2). The substring fallback
+    // stays for errors that reached here through some other wrapper.
+    if let Some(source) = crate::data_movement::data_movement_stage_source(err) {
+        return is_decommission_target_capacity_error(source);
+    }
+
    let message = err.to_string();
    let disk_full = Error::DiskFull.to_string();
    let storage_full = Error::StorageFull.to_string();
@@ -4427,6 +4443,36 @@ mod tests {
        assert!(is_decommission_target_capacity_error(&Error::StorageFull));
    }

+    /// The decommission loop classifies errors that came back through a
+    /// data-movement stage wrapper. Before backlog#1827 T2 the wrapper flattened
+    /// everything into `Error::other(String)`, so these two classifiers had to
+    /// match on rendered text; now the wrapped error is recoverable by type.
+    #[test]
+    fn decommission_classifiers_see_through_a_stage_wrapper() {
+        let wrap = |inner: Error| {
+            crate::data_movement::data_movement_stage_error_for_test(
+                "decommission_object",
+                "put_object",
+                "bucket-a",
+                "object-a",
+                inner,
+            )
+        };
+
+        // Capacity: the target pool filling up must still stop the loop.
+        assert!(is_decommission_target_capacity_error(&wrap(Error::DiskFull)));
+        assert!(is_decommission_target_capacity_error(&wrap(Error::StorageFull)));
+        assert!(!is_decommission_target_capacity_error(&wrap(Error::SlowDown)));
+
+        // Cleanup safety: a not-found surfacing from inside a stage is the same
+        // condition as one surfacing directly, so the source entry stays
+        // eligible for cleanup.
+        let not_found = Error::ObjectNotFound("bucket-a".to_string(), "object-a".to_string());
+        assert!(is_decommission_copy_cleanup_safe_error(&not_found));
+        assert!(is_decommission_copy_cleanup_safe_error(&wrap(not_found)));
+        assert!(!is_decommission_copy_cleanup_safe_error(&wrap(Error::SlowDown)));
+    }
+
    #[test]
    fn decommission_target_capacity_error_accepts_wrapped_capacity_errors() {
        let disk_full = Error::other(format!("decommission_object: put_object failed for bucket/object: {}", Error::DiskFull));
@@ -5004,6 +5050,8 @@ impl SetDisks {
                path: bucket_info.prefix.clone(),
                recursive: true,
                min_disks: listing_quorum,
+                skip_walkdir_total_timeout: true,
+                walkdir_stall_timeout: Some(DECOMMISSION_BACKGROUND_WALKDIR_STALL_TIMEOUT),
                agreed: Some(Box::new(move |entry: MetaCacheEntry| Box::pin(cb1(entry)))),
                partial: Some(Box::new(move |entries: MetaCacheEntries, _: &[Option<DiskError>]| {
                    let resolver = resolver.clone();
@@ -471,8 +471,60 @@ fn resolve_data_movement_abort_result(
    ))
 }

-fn data_movement_stage_error(op_label: &str, stage: &str, bucket: &str, object: &str, err: impl std::fmt::Display) -> Error {
-    Error::other(format!("{op_label}: {stage} failed for {bucket}/{object}: {err}"))
+/// A data-movement stage failure that keeps the error it wrapped.
+///
+/// The rendered message is byte-identical to the `format!` this replaced, so
+/// logs and any message-matching callers are unaffected. What changes is that
+/// the original error stays reachable through `source()`, which is what lets
+/// the decommission loop classify by type instead of by substring
+/// (backlog#1827 T2).
+#[derive(Debug)]
+struct DataMovementStageError {
+    rendered: String,
+    source: Box<dyn std::error::Error + Send + Sync>,
+}
+
+impl std::fmt::Display for DataMovementStageError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.rendered)
+    }
+}
+
+impl std::error::Error for DataMovementStageError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        Some(self.source.as_ref())
+    }
+}
+
+fn data_movement_stage_error<E>(op_label: &str, stage: &str, bucket: &str, object: &str, err: E) -> Error
+where
+    E: std::error::Error + Send + Sync + 'static,
+{
+    let rendered = format!("{op_label}: {stage} failed for {bucket}/{object}: {err}");
+    Error::other(DataMovementStageError {
+        rendered,
+        source: Box::new(err),
+    })
+}
+
+#[cfg(test)]
+pub(crate) fn data_movement_stage_error_for_test(op_label: &str, stage: &str, bucket: &str, object: &str, err: Error) -> Error {
+    data_movement_stage_error(op_label, stage, bucket, object, err)
+}
+
+/// Recover the error a [`data_movement_stage_error`] wrapped, if this is one.
+///
+/// `Error::other` boxes through `std::io::Error`, so the chain is
+/// `StorageError::Io` -> `DataMovementStageError` -> the original error.
+pub(crate) fn data_movement_stage_source(err: &Error) -> Option<&Error> {
+    let Error::Io(io_err) = err else {
+        return None;
+    };
+    io_err
+        .get_ref()?
+        .downcast_ref::<DataMovementStageError>()?
+        .source
+        .downcast_ref::<Error>()
 }

 fn schedule_data_movement_multipart_abort_cleanup(
@@ -1865,6 +1917,40 @@ mod tests {
        assert!(message.contains(Error::SlowDown.to_string().as_str()));
    }

+    #[test]
+    fn stage_error_renders_exactly_as_the_format_it_replaced() {
+        // The wrapper gained a source; its message must not have moved, or log
+        // scrapers and any message-matching caller would break (backlog#1827 T2).
+        // `Error::other` renders through `StorageError::Io`, which prefixes
+        // "Io error: " — that was true of the `format!` this replaced too, so
+        // the full string is what must stay stable.
+        let err = data_movement_stage_error("rebalance_object", "put_object", "bucket-a", "object-a", Error::SlowDown);
+        assert_eq!(
+            err.to_string(),
+            format!("Io error: rebalance_object: put_object failed for bucket-a/object-a: {}", Error::SlowDown)
+        );
+        assert_eq!(
+            err.to_string(),
+            Error::other(format!("rebalance_object: put_object failed for bucket-a/object-a: {}", Error::SlowDown)).to_string()
+        );
+    }
+
+    #[test]
+    fn stage_error_keeps_the_wrapped_error_recoverable() {
+        for original in [Error::DiskFull, Error::StorageFull, Error::FileNotFound, Error::SlowDown] {
+            let wrapped =
+                data_movement_stage_error("decommission_object", "put_object", "bucket-a", "object-a", original.clone());
+            let recovered = data_movement_stage_source(&wrapped).expect("the wrapped error must be recoverable");
+            assert_eq!(recovered.to_string(), original.to_string());
+        }
+    }
+
+    #[test]
+    fn stage_source_ignores_errors_it_did_not_wrap() {
+        assert!(data_movement_stage_source(&Error::DiskFull).is_none());
+        assert!(data_movement_stage_source(&Error::other("plain io error")).is_none());
+    }
+
    #[test]
    fn test_data_movement_part_stage_error_includes_stage_object_and_part() {
        let err =
@@ -23,6 +23,7 @@ use std::{
    io,
    path::{Component, Path, PathBuf},
    sync::{Arc, LazyLock, Weak},
+    time::{Duration, Instant},
 };
 use tokio::fs;
 use tokio::sync::{
@@ -325,6 +326,11 @@ pub async fn fsync_dir(dir: impl AsRef<Path>) -> io::Result<()> {

 const ENV_DST_DIR_FSYNC_GROUP_COMMIT_ENABLE: &str = "RUSTFS_EXPERIMENTAL_DST_DIR_FSYNC_GROUP_COMMIT_ENABLE";
 const DEFAULT_DST_DIR_FSYNC_GROUP_COMMIT_ENABLE: bool = false;
+const ENV_FILE_FDATASYNC_GROUP_COMMIT_ENABLE: &str = "RUSTFS_EXPERIMENTAL_FILE_FDATASYNC_GROUP_COMMIT_ENABLE";
+const DEFAULT_FILE_FDATASYNC_GROUP_COMMIT_ENABLE: bool = false;
+const ENV_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS: &str = "RUSTFS_EXPERIMENTAL_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS";
+const DEFAULT_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS: u64 = 0;
+const MAX_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS: u64 = 1_000;
 #[cfg(not(test))]
 const MAX_DST_DIR_FSYNC_GROUPS: usize = 1024;
 #[cfg(test)]
@@ -333,9 +339,34 @@ const MAX_DST_DIR_FSYNC_GROUPS: usize = 4;
 const MAX_DST_DIR_FSYNC_WAITERS: usize = 8192;
 #[cfg(test)]
 const MAX_DST_DIR_FSYNC_WAITERS: usize = 8;
+#[cfg(not(test))]
+const MAX_FILE_FDATASYNC_GROUPS: usize = 1024;
+#[cfg(test)]
+const MAX_FILE_FDATASYNC_GROUPS: usize = 4;
+#[cfg(not(test))]
+const MAX_FILE_FDATASYNC_WAITERS: usize = 8192;
+#[cfg(test)]
+const MAX_FILE_FDATASYNC_WAITERS: usize = 8;
+#[cfg(not(test))]
+const MAX_FILE_FDATASYNC_BATCH_FILES: usize = 1024;
+#[cfg(test)]
+const MAX_FILE_FDATASYNC_BATCH_FILES: usize = 8;
 static DST_DIR_FSYNC_GROUP_COMMIT_ENABLED: LazyLock<bool> = LazyLock::new(|| {
    rustfs_utils::get_env_bool(ENV_DST_DIR_FSYNC_GROUP_COMMIT_ENABLE, DEFAULT_DST_DIR_FSYNC_GROUP_COMMIT_ENABLE)
 });
+static FILE_FDATASYNC_GROUP_COMMIT_ENABLED: LazyLock<bool> = LazyLock::new(|| {
+    rustfs_utils::get_env_bool(ENV_FILE_FDATASYNC_GROUP_COMMIT_ENABLE, DEFAULT_FILE_FDATASYNC_GROUP_COMMIT_ENABLE)
+});
+fn file_fdatasync_group_commit_wait_duration(wait_micros: u64) -> Duration {
+    Duration::from_micros(wait_micros.min(MAX_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS))
+}
+
+static FILE_FDATASYNC_GROUP_COMMIT_WAIT: LazyLock<Duration> = LazyLock::new(|| {
+    file_fdatasync_group_commit_wait_duration(rustfs_utils::get_env_u64(
+        ENV_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS,
+        DEFAULT_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS,
+    ))
+});

 #[cfg(test)]
 mod dst_dir_fsync_group_commit_override {
@@ -379,6 +410,72 @@ fn dst_dir_fsync_group_commit_enabled() -> bool {
    *DST_DIR_FSYNC_GROUP_COMMIT_ENABLED
 }

+#[cfg(test)]
+mod file_fdatasync_group_commit_override {
+    use std::sync::{Mutex, MutexGuard, PoisonError, RwLock};
+
+    static OVERRIDE: RwLock<Option<bool>> = RwLock::new(None);
+    static WAIT_OVERRIDE_MICROS: RwLock<Option<u64>> = RwLock::new(None);
+    static SERIAL: Mutex<()> = Mutex::new(());
+
+    pub(crate) fn get() -> Option<bool> {
+        *OVERRIDE.read().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    pub(crate) struct OverrideGuard {
+        _serial: MutexGuard<'static, ()>,
+    }
+
+    impl Drop for OverrideGuard {
+        fn drop(&mut self) {
+            *OVERRIDE.write().unwrap_or_else(PoisonError::into_inner) = None;
+            *WAIT_OVERRIDE_MICROS.write().unwrap_or_else(PoisonError::into_inner) = None;
+        }
+    }
+
+    pub(crate) fn set(enabled: bool) -> OverrideGuard {
+        let serial = SERIAL.lock().unwrap_or_else(PoisonError::into_inner);
+        *OVERRIDE.write().unwrap_or_else(PoisonError::into_inner) = Some(enabled);
+        OverrideGuard { _serial: serial }
+    }
+
+    pub(crate) fn set_wait_micros(wait_micros: u64) {
+        *WAIT_OVERRIDE_MICROS.write().unwrap_or_else(PoisonError::into_inner) = Some(wait_micros);
+    }
+
+    pub(crate) fn wait_micros() -> Option<u64> {
+        *WAIT_OVERRIDE_MICROS.read().unwrap_or_else(PoisonError::into_inner)
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn set_file_fdatasync_group_commit_for_test(enabled: bool) -> file_fdatasync_group_commit_override::OverrideGuard {
+    file_fdatasync_group_commit_override::set(enabled)
+}
+
+#[cfg(test)]
+fn set_file_fdatasync_group_commit_wait_for_test(wait_micros: u64) {
+    file_fdatasync_group_commit_override::set_wait_micros(wait_micros);
+}
+
+fn file_fdatasync_group_commit_enabled() -> bool {
+    #[cfg(test)]
+    if let Some(enabled) = file_fdatasync_group_commit_override::get() {
+        return enabled;
+    }
+
+    *FILE_FDATASYNC_GROUP_COMMIT_ENABLED
+}
+
+fn file_fdatasync_group_commit_wait() -> Duration {
+    #[cfg(test)]
+    if let Some(wait_micros) = file_fdatasync_group_commit_override::wait_micros() {
+        return file_fdatasync_group_commit_wait_duration(wait_micros);
+    }
+
+    *FILE_FDATASYNC_GROUP_COMMIT_WAIT
+}
+
 #[derive(Clone, Eq, Hash, PartialEq)]
 struct DstDirFsyncGroupKey {
    canonical_path: PathBuf,
@@ -703,6 +800,273 @@ fn clear_dst_dir_fsync_group_commit_for_test() {
    DST_DIR_FSYNC_GROUP_COMMIT.clear_for_test();
 }

+type FileFdatasyncGroupKey = usize;
+
+struct FileFdatasyncWaiter {
+    files: Vec<PathBuf>,
+    enqueued_at: Option<Instant>,
+    wait_role: &'static str,
+    result_tx: oneshot::Sender<SharedFileFdatasyncResult>,
+}
+
+#[derive(Clone)]
+struct SharedFileFdatasyncError {
+    kind: io::ErrorKind,
+    message: Arc<str>,
+}
+
+impl SharedFileFdatasyncError {
+    fn from_error(err: io::Error) -> Self {
+        Self {
+            kind: err.kind(),
+            message: Arc::from(err.to_string()),
+        }
+    }
+
+    fn into_error(self) -> io::Error {
+        io::Error::new(self.kind, self.message.to_string())
+    }
+}
+
+type SharedFileFdatasyncResult = std::result::Result<(), SharedFileFdatasyncError>;
+
+struct FileFdatasyncGroup {
+    key: FileFdatasyncGroupKey,
+    disk_permits: Weak<Semaphore>,
+    inner: Mutex<FileFdatasyncGroupInner>,
+}
+
+#[derive(Default)]
+struct FileFdatasyncGroupInner {
+    worker_running: bool,
+    pending_files: usize,
+    pending: VecDeque<FileFdatasyncWaiter>,
+}
+
+#[derive(Default)]
+struct FileFdatasyncGroupCommit {
+    inner: Mutex<FileFdatasyncGroupCommitInner>,
+}
+
+#[derive(Default)]
+struct FileFdatasyncGroupCommitInner {
+    groups: HashMap<FileFdatasyncGroupKey, Arc<FileFdatasyncGroup>>,
+    total_waiters: usize,
+    total_files: usize,
+}
+
+static FILE_FDATASYNC_GROUP_COMMIT: LazyLock<FileFdatasyncGroupCommit> = LazyLock::new(FileFdatasyncGroupCommit::default);
+
+impl FileFdatasyncGroupCommit {
+    // Lock order: registry first, then per-group state. No path may hold a
+    // group lock while acquiring the registry lock.
+    fn enqueue(
+        &self,
+        disk_permits: Arc<Semaphore>,
+        files: Vec<PathBuf>,
+    ) -> io::Result<(oneshot::Receiver<SharedFileFdatasyncResult>, Option<Arc<FileFdatasyncGroup>>)> {
+        if files.is_empty() {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "file fdatasync group commit needs at least one file",
+            ));
+        }
+        let (result_tx, result_rx) = oneshot::channel();
+        let key = Arc::as_ptr(&disk_permits) as FileFdatasyncGroupKey;
+        let mut registry = self.inner.lock();
+        registry.groups.retain(|_, group| group.disk_permits.strong_count() > 0);
+        if registry.total_waiters >= MAX_FILE_FDATASYNC_WAITERS {
+            return Err(io::Error::new(
+                io::ErrorKind::WouldBlock,
+                "file fdatasync group commit waiter limit reached",
+            ));
+        }
+        if registry.total_files.saturating_add(files.len()) > MAX_FILE_FDATASYNC_BATCH_FILES {
+            return Err(io::Error::new(
+                io::ErrorKind::WouldBlock,
+                "file fdatasync group commit file limit reached",
+            ));
+        }
+        let group = if let Some(group) = registry.groups.get(&key) {
+            group.clone()
+        } else {
+            if registry.groups.len() >= MAX_FILE_FDATASYNC_GROUPS {
+                return Err(io::Error::new(
+                    io::ErrorKind::WouldBlock,
+                    "file fdatasync group commit active group limit reached",
+                ));
+            }
+            let group = Arc::new(FileFdatasyncGroup {
+                key,
+                disk_permits: Arc::downgrade(&disk_permits),
+                inner: Mutex::new(FileFdatasyncGroupInner::default()),
+            });
+            registry.groups.insert(key, group.clone());
+            group
+        };
+        let file_count = files.len();
+        let mut group_state = group.inner.lock();
+        let start_worker = !group_state.worker_running;
+        let wait_role = if start_worker {
+            rustfs_io_metrics::PUT_RENAME_FDATASYNC_GROUP_WAIT_ROLE_LEADER
+        } else {
+            rustfs_io_metrics::PUT_RENAME_FDATASYNC_GROUP_WAIT_ROLE_FOLLOWER
+        };
+        group_state.pending.push_back(FileFdatasyncWaiter {
+            files,
+            enqueued_at: rustfs_io_metrics::put_stage_timer(),
+            wait_role,
+            result_tx,
+        });
+        group_state.pending_files += file_count;
+        if start_worker {
+            group_state.worker_running = true;
+        }
+        rustfs_io_metrics::record_put_rename_fdatasync_group_outstanding(
+            rustfs_io_metrics::PUT_RENAME_FDATASYNC_GROUP_OUTSTANDING_STATE_ENQUEUE_WAITERS,
+            group_state.pending.len(),
+        );
+        rustfs_io_metrics::record_put_rename_fdatasync_group_outstanding(
+            rustfs_io_metrics::PUT_RENAME_FDATASYNC_GROUP_OUTSTANDING_STATE_ENQUEUE_FILES,
+            group_state.pending_files,
+        );
+        registry.total_waiters += 1;
+        registry.total_files += file_count;
+        drop(group_state);
+        drop(registry);
+        Ok((result_rx, start_worker.then_some(group)))
+    }
+
+    fn complete_batch(&self, waiters: usize, files: usize) {
+        let mut registry = self.inner.lock();
+        registry.total_waiters = registry.total_waiters.saturating_sub(waiters);
+        registry.total_files = registry.total_files.saturating_sub(files);
+    }
+
+    fn remove_idle_group(&self, group: &Arc<FileFdatasyncGroup>) {
+        let mut registry = self.inner.lock();
+        let group_state = group.inner.lock();
+        if !group_state.worker_running && group_state.pending.is_empty() {
+            registry.groups.remove(&group.key);
+        }
+    }
+
+    #[cfg(test)]
+    fn counts_for_test(&self) -> (usize, usize, usize) {
+        let registry = self.inner.lock();
+        (registry.groups.len(), registry.total_waiters, registry.total_files)
+    }
+
+    #[cfg(test)]
+    fn clear_for_test(&self) {
+        let mut registry = self.inner.lock();
+        registry.groups.clear();
+        registry.total_waiters = 0;
+        registry.total_files = 0;
+    }
+}
+
+async fn run_file_fdatasync_group_worker(group: Arc<FileFdatasyncGroup>) {
+    loop {
+        #[cfg(test)]
+        file_sync_probe::run_before_group_batch();
+        tokio::task::yield_now().await;
+        let wait = file_fdatasync_group_commit_wait();
+        if !wait.is_zero() {
+            tokio::time::sleep(wait).await;
+        }
+        let (batch, batch_file_count): (Vec<FileFdatasyncWaiter>, usize) = {
+            let mut group_state = group.inner.lock();
+            let batch_file_count = group_state.pending_files;
+            group_state.pending_files = 0;
+            (group_state.pending.drain(..).collect(), batch_file_count)
+        };
+        if batch.is_empty() {
+            let mut group_state = group.inner.lock();
+            group_state.worker_running = false;
+            drop(group_state);
+            FILE_FDATASYNC_GROUP_COMMIT.remove_idle_group(&group);
+            return;
+        }
+
+        rustfs_io_metrics::record_put_rename_fdatasync_group_outstanding(
+            rustfs_io_metrics::PUT_RENAME_FDATASYNC_GROUP_OUTSTANDING_STATE_BATCH_WAITERS,
+            batch.len(),
+        );
+        rustfs_io_metrics::record_put_rename_fdatasync_group_outstanding(
+            rustfs_io_metrics::PUT_RENAME_FDATASYNC_GROUP_OUTSTANDING_STATE_BATCH_FILES,
+            batch_file_count,
+        );
+        for waiter in &batch {
+            if let Some(enqueued_at) = waiter.enqueued_at {
+                rustfs_io_metrics::record_put_rename_fdatasync_group_wait(
+                    waiter.wait_role,
+                    enqueued_at.elapsed().as_secs_f64() * 1000.0,
+                );
+            }
+        }
+        let batch_files: Vec<PathBuf> = batch.iter().flat_map(|waiter| waiter.files.iter().cloned()).collect();
+        #[cfg(test)]
+        file_sync_probe::record_group_batch(batch_file_count);
+        rustfs_io_metrics::record_put_rename_fdatasync_batch(
+            rustfs_io_metrics::PUT_RENAME_FDATASYNC_BATCH_MODE_PARALLEL,
+            batch_file_count,
+        );
+        let result = if let Some(disk_permits) = group.disk_permits.upgrade() {
+            run_file_sync_blocking(disk_permits, move || sync_files(&batch_files))
+                .await
+                .map_err(SharedFileFdatasyncError::from_error)
+        } else {
+            Err(SharedFileFdatasyncError::from_error(io::Error::other(
+                "file fdatasync group commit limiter dropped",
+            )))
+        };
+        FILE_FDATASYNC_GROUP_COMMIT.complete_batch(batch.len(), batch_file_count);
+
+        let should_stop = {
+            let mut group_state = group.inner.lock();
+            if group_state.pending.is_empty() {
+                group_state.worker_running = false;
+                true
+            } else {
+                false
+            }
+        };
+        if should_stop {
+            FILE_FDATASYNC_GROUP_COMMIT.remove_idle_group(&group);
+        }
+        for waiter in batch {
+            let _ = waiter.result_tx.send(result.clone());
+        }
+        if should_stop {
+            return;
+        }
+    }
+}
+
+async fn sync_files_group_commit(files: Vec<PathBuf>, disk_permits: Arc<Semaphore>) -> io::Result<()> {
+    let (result_rx, worker) = FILE_FDATASYNC_GROUP_COMMIT.enqueue(disk_permits, files)?;
+    if let Some(group) = worker {
+        tokio::spawn(run_file_fdatasync_group_worker(group));
+    }
+
+    match result_rx.await {
+        Ok(Ok(())) => Ok(()),
+        Ok(Err(err)) => Err(err.into_error()),
+        Err(_) => Err(io::Error::other("file fdatasync group worker dropped the waiter")),
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn file_fdatasync_group_commit_counts_for_test() -> (usize, usize, usize) {
+    FILE_FDATASYNC_GROUP_COMMIT.counts_for_test()
+}
+
+#[cfg(test)]
+fn clear_file_fdatasync_group_commit_for_test() {
+    FILE_FDATASYNC_GROUP_COMMIT.clear_for_test();
+}
+
 // Small object directories are cheaper to flush in one blocking task. Multipart
 // directories fan out only once enough files can amortize per-task scheduling.
 const PARALLEL_FILE_SYNC_THRESHOLD: usize = 16;
@@ -880,6 +1244,8 @@ pub(crate) mod file_sync_probe {
    static ATTEMPTS: AtomicUsize = AtomicUsize::new(0);
    static FAIL_ON_ATTEMPT: AtomicUsize = AtomicUsize::new(usize::MAX);
    static BLOCK: AtomicBool = AtomicBool::new(false);
+    static GROUP_BATCHES: Mutex<Vec<usize>> = Mutex::new(Vec::new());
+    static BEFORE_GROUP_BATCH: Mutex<Option<Box<dyn FnOnce() + Send>>> = Mutex::new(None);
    const WAIT_TIMEOUT: Duration = Duration::from_secs(30);

    pub(crate) struct ProbeGuard;
@@ -905,6 +1271,8 @@ pub(crate) mod file_sync_probe {
        fn drop(&mut self) {
            release();
            FAIL_ON_ATTEMPT.store(usize::MAX, Ordering::SeqCst);
+            GROUP_BATCHES.lock().expect("file sync group batch recorder poisoned").clear();
+            BEFORE_GROUP_BATCH.lock().expect("file sync group batch hook poisoned").take();
            ROOTS.write().expect("file sync probe lock poisoned").clear();
        }
    }
@@ -914,6 +1282,8 @@ pub(crate) mod file_sync_probe {
        PEAK.store(0, Ordering::SeqCst);
        ATTEMPTS.store(0, Ordering::SeqCst);
        FAIL_ON_ATTEMPT.store(fail_on_attempt.unwrap_or(usize::MAX), Ordering::SeqCst);
+        GROUP_BATCHES.lock().expect("file sync group batch recorder poisoned").clear();
+        BEFORE_GROUP_BATCH.lock().expect("file sync group batch hook poisoned").take();
        {
            let _guard = BLOCK_MUTEX.lock().expect("file sync probe blocker poisoned");
            BLOCK.store(block, Ordering::SeqCst);
@@ -1025,6 +1395,27 @@ pub(crate) mod file_sync_probe {
        BLOCK.store(false, Ordering::SeqCst);
        BLOCK_CONDVAR.notify_all();
    }
+
+    pub(super) fn record_group_batch(batch_len: usize) {
+        GROUP_BATCHES
+            .lock()
+            .expect("file sync group batch recorder poisoned")
+            .push(batch_len);
+    }
+
+    pub(crate) fn group_batches() -> Vec<usize> {
+        GROUP_BATCHES.lock().expect("file sync group batch recorder poisoned").clone()
+    }
+
+    pub(crate) fn set_before_group_batch(hook: impl FnOnce() + Send + 'static) {
+        *BEFORE_GROUP_BATCH.lock().expect("file sync group batch hook poisoned") = Some(Box::new(hook));
+    }
+
+    pub(super) fn run_before_group_batch() {
+        if let Some(hook) = BEFORE_GROUP_BATCH.lock().expect("file sync group batch hook poisoned").take() {
+            hook();
+        }
+    }
 }

 pub(crate) fn sync_file(path: &Path) -> io::Result<()> {
@@ -1095,9 +1486,17 @@ pub async fn sync_dir_files(dir: impl AsRef<Path>) -> io::Result<()> {
 pub(crate) async fn sync_dir_files_with_limiter(dir: impl AsRef<Path>, disk_permits: Arc<Semaphore>) -> io::Result<()> {
    let dir = dir.as_ref().to_path_buf();
    let scan_dir = dir.clone();
+    let group_file_fdatasync = file_fdatasync_group_commit_enabled();
    let files = run_file_sync_blocking(disk_permits.clone(), move || {
        let files = regular_files(&scan_dir)?;
        if files.len() < PARALLEL_FILE_SYNC_THRESHOLD {
+            if group_file_fdatasync && !files.is_empty() {
+                return Ok(Some(files));
+            }
+            rustfs_io_metrics::record_put_rename_fdatasync_batch(
+                rustfs_io_metrics::PUT_RENAME_FDATASYNC_BATCH_MODE_SERIAL,
+                files.len(),
+            );
            sync_files(&files)?;
            let fsync_started = rustfs_io_metrics::put_stage_timer();
            let result = fsync_dir_std(scan_dir);
@@ -1115,6 +1514,23 @@ pub(crate) async fn sync_dir_files_with_limiter(dir: impl AsRef<Path>, disk_perm
    let Some(files) = files else {
        return Ok(());
    };
+    if group_file_fdatasync && files.len() < PARALLEL_FILE_SYNC_THRESHOLD {
+        sync_files_group_commit(files, disk_permits.clone()).await?;
+        return run_file_sync_blocking(disk_permits, move || {
+            let fsync_started = rustfs_io_metrics::put_stage_timer();
+            let result = fsync_dir_std(dir);
+            rustfs_io_metrics::record_put_object_stage_duration_from(
+                rustfs_io_metrics::PUT_STAGE_SET_DISK_RENAME_SRC_DIR_FSYNC,
+                fsync_started,
+            );
+            result
+        })
+        .await;
+    }
+    rustfs_io_metrics::record_put_rename_fdatasync_batch(
+        rustfs_io_metrics::PUT_RENAME_FDATASYNC_BATCH_MODE_PARALLEL,
+        files.len(),
+    );
    futures::stream::iter(files.into_iter().map(Ok::<_, io::Error>))
        .try_for_each_concurrent(MAX_PARALLEL_FILE_SYNCS, |path| {
            let disk_permits = disk_permits.clone();
@@ -5667,6 +6083,341 @@ mod tests {
            .expect("sequential file sync must succeed");
    }

+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    #[serial_test::serial(file_sync_probe)]
+    async fn file_fdatasync_group_commit_default_off_keeps_small_directory_serial() {
+        let _group_commit = set_file_fdatasync_group_commit_for_test(false);
+        let temp_dir = tempdir().expect("create temp dir");
+        std::fs::write(temp_dir.path().join("part.1"), b"shard").expect("write part");
+        let _probe = file_sync_probe::set_blocking(temp_dir.path());
+        let path = temp_dir.path().to_path_buf();
+        let task = tokio::spawn(async move { sync_dir_files_with_limiter(path, file_sync_limiter()).await });
+        file_sync_probe::wait_for_active(1).await;
+
+        assert_eq!(
+            file_sync_probe::group_batches(),
+            Vec::<usize>::new(),
+            "default-off small directory sync must not enter the file fdatasync group coordinator"
+        );
+        file_sync_probe::release();
+        task.await
+            .expect("join default-off file sync")
+            .expect("default-off file sync must succeed");
+        assert!(
+            fsync_dir_recorder::was_fsynced(temp_dir.path()),
+            "default-off successful sync must fsync the source directory"
+        );
+        assert_eq!(file_fdatasync_group_commit_counts_for_test(), (0, 0, 0));
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    #[serial_test::serial(file_sync_probe)]
+    async fn file_fdatasync_group_commit_batches_same_disk_small_directories() {
+        use std::sync::mpsc;
+
+        let _group_commit = set_file_fdatasync_group_commit_for_test(true);
+        set_file_fdatasync_group_commit_wait_for_test(0);
+        clear_file_fdatasync_group_commit_for_test();
+        let temp_dir = tempdir().expect("create temp dir");
+        let first_dir = temp_dir.path().join("first");
+        let second_dir = temp_dir.path().join("second");
+        std::fs::create_dir(&first_dir).expect("create first dir");
+        std::fs::create_dir(&second_dir).expect("create second dir");
+        std::fs::write(first_dir.join("part.1"), b"first").expect("write first part");
+        std::fs::write(second_dir.join("part.1"), b"second").expect("write second part");
+        let _probe = file_sync_probe::set_blocking(temp_dir.path());
+        let (entered_tx, entered_rx) = mpsc::channel();
+        let (release_batch_tx, release_batch_rx) = mpsc::channel();
+        file_sync_probe::set_before_group_batch(move || {
+            entered_tx.send(()).expect("signal first file fdatasync group worker");
+            release_batch_rx.recv().expect("wait until second waiter is queued");
+        });
+
+        let limiter = file_sync_limiter();
+        let first_limiter = limiter.clone();
+        let first_path = first_dir.clone();
+        let first = tokio::spawn(async move { sync_dir_files_with_limiter(first_path, first_limiter).await });
+        tokio::task::spawn_blocking(move || entered_rx.recv_timeout(Duration::from_secs(30)))
+            .await
+            .expect("group worker hook waiter should run")
+            .expect("first file fdatasync group worker should start");
+
+        let second_limiter = limiter.clone();
+        let second_path = second_dir.clone();
+        let second = tokio::spawn(async move { sync_dir_files_with_limiter(second_path, second_limiter).await });
+        tokio::time::timeout(Duration::from_secs(30), async {
+            loop {
+                if file_fdatasync_group_commit_counts_for_test().1 == 2 {
+                    return;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("second waiter should enqueue before releasing the grouped batch");
+        release_batch_tx.send(()).expect("release group batch hook");
+        file_sync_probe::wait_for_active(1).await;
+
+        assert_eq!(
+            file_sync_probe::group_batches(),
+            vec![2],
+            "same-disk small directory fdatasync waiters must share one observable batch"
+        );
+        file_sync_probe::release();
+        first
+            .await
+            .expect("join first grouped file sync")
+            .expect("first grouped file sync must succeed");
+        second
+            .await
+            .expect("join second grouped file sync")
+            .expect("second grouped file sync must succeed");
+        assert!(
+            fsync_dir_recorder::was_fsynced(&first_dir),
+            "first source directory must still be fsynced"
+        );
+        assert!(
+            fsync_dir_recorder::was_fsynced(&second_dir),
+            "second source directory must still be fsynced"
+        );
+        assert_eq!(file_fdatasync_group_commit_counts_for_test(), (0, 0, 0));
+    }
+
+    #[test]
+    fn file_fdatasync_group_commit_wait_duration_uses_default_and_cap() {
+        assert_eq!(DEFAULT_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS, 0);
+        assert_eq!(
+            file_fdatasync_group_commit_wait_duration(DEFAULT_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS),
+            Duration::ZERO
+        );
+        assert_eq!(file_fdatasync_group_commit_wait_duration(250), Duration::from_micros(250));
+        assert_eq!(
+            file_fdatasync_group_commit_wait_duration(MAX_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS),
+            Duration::from_micros(MAX_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS)
+        );
+        assert_eq!(
+            file_fdatasync_group_commit_wait_duration(u64::MAX),
+            Duration::from_micros(MAX_FILE_FDATASYNC_GROUP_COMMIT_WAIT_MICROS)
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread", start_paused = true)]
+    #[serial_test::serial(file_sync_probe)]
+    async fn file_fdatasync_group_commit_wait_budget_batches_late_follower() {
+        use std::sync::mpsc;
+
+        let _group_commit = set_file_fdatasync_group_commit_for_test(true);
+        let wait_budget_micros = 1_000;
+        let wait_budget = file_fdatasync_group_commit_wait_duration(wait_budget_micros);
+        set_file_fdatasync_group_commit_wait_for_test(wait_budget_micros);
+        clear_file_fdatasync_group_commit_for_test();
+        let temp_dir = tempdir().expect("create temp dir");
+        let first_dir = temp_dir.path().join("first");
+        let second_dir = temp_dir.path().join("second");
+        std::fs::create_dir(&first_dir).expect("create first dir");
+        std::fs::create_dir(&second_dir).expect("create second dir");
+        std::fs::write(first_dir.join("part.1"), b"first").expect("write first part");
+        std::fs::write(second_dir.join("part.1"), b"second").expect("write second part");
+        let _probe = file_sync_probe::set_blocking(temp_dir.path());
+        let (entered_tx, entered_rx) = mpsc::channel();
+        file_sync_probe::set_before_group_batch(move || {
+            entered_tx.send(()).expect("signal first file fdatasync group worker");
+        });
+
+        let limiter = file_sync_limiter();
+        let first_limiter = limiter.clone();
+        let first_path = first_dir.clone();
+        let first = tokio::spawn(async move { sync_dir_files_with_limiter(first_path, first_limiter).await });
+        tokio::task::spawn_blocking(move || entered_rx.recv_timeout(Duration::from_secs(30)))
+            .await
+            .expect("group worker hook waiter should run")
+            .expect("first file fdatasync group worker should start");
+
+        let second_limiter = limiter.clone();
+        let second_path = second_dir.clone();
+        let second = tokio::spawn(async move { sync_dir_files_with_limiter(second_path, second_limiter).await });
+        tokio::time::timeout(Duration::from_secs(30), async {
+            loop {
+                if file_fdatasync_group_commit_counts_for_test().1 == 2 {
+                    return;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("second waiter should enqueue during the configured wait budget");
+        tokio::time::advance(wait_budget).await;
+        tokio::task::yield_now().await;
+        file_sync_probe::wait_for_active(1).await;
+
+        assert_eq!(
+            file_sync_probe::group_batches(),
+            vec![2],
+            "configured wait budget should let a follower join the leader's batch"
+        );
+        file_sync_probe::release();
+        first
+            .await
+            .expect("join first wait-budget file sync")
+            .expect("first wait-budget file sync must succeed");
+        second
+            .await
+            .expect("join second wait-budget file sync")
+            .expect("second wait-budget file sync must succeed");
+        assert!(
+            fsync_dir_recorder::was_fsynced(&first_dir),
+            "first source directory must still be fsynced"
+        );
+        assert!(
+            fsync_dir_recorder::was_fsynced(&second_dir),
+            "second source directory must still be fsynced"
+        );
+        assert_eq!(file_fdatasync_group_commit_counts_for_test(), (0, 0, 0));
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    #[serial_test::serial(file_sync_probe)]
+    async fn file_fdatasync_group_commit_failure_fails_all_waiters_before_dir_fsync() {
+        use std::sync::mpsc;
+
+        let _group_commit = set_file_fdatasync_group_commit_for_test(true);
+        set_file_fdatasync_group_commit_wait_for_test(0);
+        clear_file_fdatasync_group_commit_for_test();
+        let temp_dir = tempdir().expect("create temp dir");
+        let first_dir = temp_dir.path().join("first");
+        let second_dir = temp_dir.path().join("second");
+        std::fs::create_dir(&first_dir).expect("create first dir");
+        std::fs::create_dir(&second_dir).expect("create second dir");
+        std::fs::write(first_dir.join("part.1"), b"first").expect("write first part");
+        std::fs::write(second_dir.join("part.1"), b"second").expect("write second part");
+        let _probe = file_sync_probe::set_failing_blocking(temp_dir.path());
+        let (entered_tx, entered_rx) = mpsc::channel();
+        let (release_batch_tx, release_batch_rx) = mpsc::channel();
+        file_sync_probe::set_before_group_batch(move || {
+            entered_tx.send(()).expect("signal first file fdatasync group worker");
+            release_batch_rx.recv().expect("wait until second waiter is queued");
+        });
+
+        let limiter = file_sync_limiter();
+        let first_limiter = limiter.clone();
+        let first_path = first_dir.clone();
+        let first = tokio::spawn(async move { sync_dir_files_with_limiter(first_path, first_limiter).await });
+        tokio::task::spawn_blocking(move || entered_rx.recv_timeout(Duration::from_secs(30)))
+            .await
+            .expect("group worker hook waiter should run")
+            .expect("first file fdatasync group worker should start");
+
+        let second_limiter = limiter.clone();
+        let second_path = second_dir.clone();
+        let second = tokio::spawn(async move { sync_dir_files_with_limiter(second_path, second_limiter).await });
+        tokio::time::timeout(Duration::from_secs(30), async {
+            loop {
+                if file_fdatasync_group_commit_counts_for_test().1 == 2 {
+                    return;
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("second waiter should enqueue before releasing the grouped batch");
+        release_batch_tx.send(()).expect("release group batch hook");
+
+        let first_err = first
+            .await
+            .expect("join first grouped file sync")
+            .expect_err("first grouped waiter must fail closed");
+        let second_err = second
+            .await
+            .expect("join second grouped file sync")
+            .expect_err("second grouped waiter must fail closed");
+
+        assert_eq!(first_err.kind(), io::ErrorKind::Other);
+        assert_eq!(second_err.kind(), io::ErrorKind::Other);
+        assert_eq!(file_sync_probe::group_batches(), vec![2]);
+        assert!(
+            !fsync_dir_recorder::was_fsynced(&first_dir) && !fsync_dir_recorder::was_fsynced(&second_dir),
+            "source directories must not be fsynced after grouped file fdatasync failure"
+        );
+        assert_eq!(file_fdatasync_group_commit_counts_for_test(), (0, 0, 0));
+        file_sync_probe::release();
+        file_sync_probe::wait_for_idle().await;
+    }
+
+    #[test]
+    #[serial_test::serial(file_sync_probe)]
+    fn file_fdatasync_group_commit_rejects_active_group_overflow() {
+        let _group_commit = set_file_fdatasync_group_commit_for_test(true);
+        clear_file_fdatasync_group_commit_for_test();
+        let mut receivers = Vec::new();
+        let mut limiters = Vec::new();
+        for index in 0..MAX_FILE_FDATASYNC_GROUPS {
+            let limiter = Arc::new(Semaphore::new(1));
+            let (result_rx, _worker) = FILE_FDATASYNC_GROUP_COMMIT
+                .enqueue(limiter.clone(), vec![PathBuf::from(format!("part-{index}"))])
+                .expect("group below cap should enqueue");
+            limiters.push(limiter);
+            receivers.push(result_rx);
+        }
+
+        let overflow_limiter = Arc::new(Semaphore::new(1));
+        let err = match FILE_FDATASYNC_GROUP_COMMIT.enqueue(overflow_limiter, vec![PathBuf::from("overflow")]) {
+            Ok(_) => panic!("active group max+1 must fail closed"),
+            Err(err) => err,
+        };
+
+        assert_eq!(err.kind(), io::ErrorKind::WouldBlock);
+        clear_file_fdatasync_group_commit_for_test();
+        assert_eq!(file_fdatasync_group_commit_counts_for_test(), (0, 0, 0));
+        drop(receivers);
+        drop(limiters);
+    }
+
+    #[test]
+    #[serial_test::serial(file_sync_probe)]
+    fn file_fdatasync_group_commit_rejects_waiter_and_file_overflow() {
+        let _group_commit = set_file_fdatasync_group_commit_for_test(true);
+        clear_file_fdatasync_group_commit_for_test();
+        let limiter = Arc::new(Semaphore::new(1));
+        let mut receivers = Vec::new();
+        for index in 0..MAX_FILE_FDATASYNC_WAITERS {
+            let (result_rx, _worker) = FILE_FDATASYNC_GROUP_COMMIT
+                .enqueue(limiter.clone(), vec![PathBuf::from(format!("part-{index}"))])
+                .expect("waiter below cap should enqueue");
+            receivers.push(result_rx);
+        }
+
+        let waiter_err = match FILE_FDATASYNC_GROUP_COMMIT.enqueue(limiter, vec![PathBuf::from("overflow-waiter")]) {
+            Ok(_) => panic!("waiter max+1 must fail closed"),
+            Err(err) => err,
+        };
+
+        assert_eq!(waiter_err.kind(), io::ErrorKind::WouldBlock);
+        clear_file_fdatasync_group_commit_for_test();
+        drop(receivers);
+
+        let mut receivers = Vec::new();
+        let file_limit_limiter = Arc::new(Semaphore::new(1));
+        let (result_rx, _worker) = FILE_FDATASYNC_GROUP_COMMIT
+            .enqueue(
+                file_limit_limiter.clone(),
+                (0..MAX_FILE_FDATASYNC_BATCH_FILES)
+                    .map(|index| PathBuf::from(format!("part-{index}")))
+                    .collect(),
+            )
+            .expect("file count up to cap should enqueue");
+        receivers.push(result_rx);
+
+        let file_err = match FILE_FDATASYNC_GROUP_COMMIT.enqueue(file_limit_limiter, vec![PathBuf::from("overflow-file")]) {
+            Ok(_) => panic!("file max+1 must fail closed"),
+            Err(err) => err,
+        };
+
+        assert_eq!(file_err.kind(), io::ErrorKind::WouldBlock);
+        clear_file_fdatasync_group_commit_for_test();
+        assert_eq!(file_fdatasync_group_commit_counts_for_test(), (0, 0, 0));
+        drop(receivers);
+    }
+
    #[tokio::test]
    #[serial_test::serial(file_sync_probe)]
    async fn sync_dir_files_bounds_concurrency_across_directories() {
@@ -218,6 +218,63 @@ pub struct QuotaAdmission {
    quota_limit: u64,
 }

+#[doc(hidden)]
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LifecycleDeleteAllRequest {
+    pub(crate) version_id: Option<Uuid>,
+    pub(crate) delete_marker: bool,
+    pub(crate) action: rustfs_common::metrics::IlmAction,
+    pub(crate) rule_id: String,
+    pub(crate) phase: LifecycleDeleteAllPhase,
+}
+
+#[doc(hidden)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LifecycleDeleteAllPhase {
+    Preflight,
+    History,
+    FinalPreflight,
+    Trigger,
+}
+
+#[doc(hidden)]
+#[derive(Default)]
+pub struct LifecycleDeleteAllJournalState {
+    prepared: HashMap<String, crate::bucket::lifecycle::tier_sweeper::Jentry>,
+    mutation_started: bool,
+}
+
+impl Debug for LifecycleDeleteAllJournalState {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LifecycleDeleteAllJournalState")
+            .field("prepared_count", &self.prepared.len())
+            .field("mutation_started", &self.mutation_started)
+            .finish()
+    }
+}
+
+impl LifecycleDeleteAllJournalState {
+    pub(crate) fn contains(&self, name: &str) -> bool {
+        self.prepared.contains_key(name)
+    }
+
+    pub(crate) fn insert(&mut self, name: String, entry: crate::bucket::lifecycle::tier_sweeper::Jentry) {
+        self.prepared.insert(name, entry);
+    }
+
+    pub(crate) fn prepared_entries(&self) -> Vec<crate::bucket::lifecycle::tier_sweeper::Jentry> {
+        self.prepared.values().cloned().collect()
+    }
+
+    pub(crate) fn mark_mutation_started(&mut self) {
+        self.mutation_started = true;
+    }
+
+    pub(crate) fn mutation_started(&self) -> bool {
+        self.mutation_started
+    }
+}
+
 impl QuotaAdmission {
    pub(crate) fn current_usage(self) -> u64 {
        self.current_usage
@@ -242,6 +299,11 @@ pub struct ObjectOptions {
    pub delete_prefix: bool,
    pub delete_prefix_object: bool,
    pub version_id: Option<String>,
+    /// Lifecycle-only staged purge request checked under the object write lock.
+    #[doc(hidden)]
+    pub lifecycle_delete_all: Option<LifecycleDeleteAllRequest>,
+    #[doc(hidden)]
+    pub lifecycle_delete_all_journal: Option<Arc<parking_lot::Mutex<LifecycleDeleteAllJournalState>>>,
    /// RustFS-only compare-and-set condition checked under the object write lock.
    pub expected_current_version_id: Option<String>,
    /// Persisted bucket incarnation observed before authorization.
@@ -349,6 +411,15 @@ impl ObjectOptions {
        self.namespace_lock_fence.get_or_insert_with(NamespaceLockFence::new);
    }

+    pub(crate) fn ensure_lifecycle_delete_all_journal(&mut self) {
+        self.lifecycle_delete_all_journal
+            .get_or_insert_with(|| Arc::new(parking_lot::Mutex::new(LifecycleDeleteAllJournalState::default())));
+    }
+
+    pub(crate) fn lifecycle_delete_all_journal(&self) -> Option<&Arc<parking_lot::Mutex<LifecycleDeleteAllJournalState>>> {
+        self.lifecycle_delete_all_journal.as_ref()
+    }
+
    pub fn add_namespace_lock_guard(&mut self, guard: &rustfs_lock::NamespaceLockGuard) {
        if let Some(signal) = guard.lock_lost_signal() {
            self.add_namespace_lock_lost_signal(signal);
@@ -648,14 +719,23 @@ impl ObjectInfo {
    }

    pub fn from_file_info(fi: &FileInfo, bucket: &str, object: &str, versioned: bool) -> ObjectInfo {
-        let name = decode_dir_object(object);
-
        let mut version_id = fi.version_id;

        if versioned && version_id.is_none() {
            version_id = Some(Uuid::nil())
        }

+        Self::from_file_info_with_version_id(fi, bucket, object, version_id)
+    }
+
+    pub(crate) fn from_file_info_with_version_id(
+        fi: &FileInfo,
+        bucket: &str,
+        object: &str,
+        version_id: Option<Uuid>,
+    ) -> ObjectInfo {
+        let name = decode_dir_object(object);
+
        // etag
        let (content_type, content_encoding, etag) = {
            let content_type = fi.metadata.get("content-type").cloned();
@@ -1569,6 +1649,18 @@ mod tests {
        assert_eq!(info.replication_decision, "arn=true;false;arn:replication::1:dest;rule-id");
    }

+    #[test]
+    fn from_file_info_with_version_id_keeps_normalized_absent_version() {
+        let fi = FileInfo {
+            version_id: Some(Uuid::new_v4()),
+            ..Default::default()
+        };
+
+        let info = ObjectInfo::from_file_info_with_version_id(&fi, "bucket", "object", None);
+
+        assert_eq!(info.version_id, None, "a normalized absent version must not be rewritten to nil");
+    }
+
    #[test]
    fn from_file_info_reports_effective_storage_class_for_legacy_metadata() {
        for legacy_label in [
@@ -1890,4 +1982,13 @@ mod tests {
        assert!(default_cloned.user_tags.is_empty());
        assert!(default_cloned.parts.is_empty());
    }
+
+    #[test]
+    fn object_options_default_does_not_allocate_lifecycle_delete_all_journal() {
+        let mut opts = ObjectOptions::default();
+
+        assert!(opts.lifecycle_delete_all_journal().is_none());
+        opts.ensure_lifecycle_delete_all_journal();
+        assert!(opts.lifecycle_delete_all_journal().is_some());
+    }
 }
@@ -573,9 +573,7 @@ pub(crate) async fn initialize_local_disk_maps(
 pub(crate) async fn init_tier_config_mgr(store: Arc<ECStore>) -> Result<()> {
    let handle = get_global_tier_config_mgr();
    TierConfigMgr::reload_handle(&handle, store.clone()).await?;
-    if setup_is_dist_erasure().await {
-        tokio::spawn(TierConfigMgr::refresh_tier_config_handle(handle, store));
-    }
+    tokio::spawn(TierConfigMgr::refresh_tier_config_handle(handle, store));
    Ok(())
 }

@@ -657,7 +657,7 @@ where
            prefix,
            marker,
            None,
-            i32::try_from(limit).map_or(i32::MAX, |value| value),
+            i32::try_from(limit).unwrap_or(i32::MAX),
            false,
            None,
            false,
@@ -17,7 +17,7 @@ use std::sync::Arc;
 use rustfs_protos::{TIER_MUTATION_RPC_PROTOCOL_VERSION, TierMutationRpcPhase};
 use uuid::Uuid;

-use super::tier::{TierConfigMgr, tier_config_etag_matches};
+use super::tier::{TierConfigMgr, tier_config_abort_matches, tier_config_commit_matches, tier_config_etag_matches};
 use super::tier_mutation_intent::{
    MAX_TIER_MUTATION_INTENT_SIZE, TierMutationIntent, TierMutationIntentState, advance_tier_mutation_intent_record_idempotent,
    load_tier_mutation_intent_record, save_tier_mutation_intent_record_if_absent,
@@ -53,6 +53,10 @@ pub enum TierMutationPeerError {
    InvalidPayload(String),
    #[error("tier mutation peer intent conflicts with existing record")]
    ConflictingIntent,
+    #[error("tier mutation peer commit proof does not match the persisted tier configuration")]
+    CommitProofMismatch,
+    #[error("tier mutation peer abort proof does not match the persisted tier configuration")]
+    AbortProofMismatch,
    #[error("tier mutation peer runtime error: {0}")]
    Runtime(#[source] AdminError),
    #[error("tier mutation peer store error: {0}")]
@@ -120,8 +124,13 @@ async fn handle_prepare(
                        .await
                        .map_err(TierMutationPeerError::Runtime)?;
                }
-                TierMutationIntentState::Committed | TierMutationIntentState::Aborted => {
-                    TierConfigMgr::clear_prepared_mutation_intent_block(&tier_config_mgr, mutation_id).await;
+                TierMutationIntentState::Committed => {
+                    TierConfigMgr::apply_committed_mutation_intent_block(&tier_config_mgr, &existing)
+                        .await
+                        .map_err(TierMutationPeerError::Runtime)?;
+                }
+                TierMutationIntentState::Aborted => {
+                    TierConfigMgr::request_committed_mutation_refresh(&tier_config_mgr).await;
                }
            }
            Ok(TierMutationPeerOutcome {
@@ -140,6 +149,18 @@ async fn handle_commit(
 ) -> TierMutationPeerResult<TierMutationPeerOutcome> {
    let committed_config_etag = parse_commit_etag(canonical_payload)?;
    let tier_config_mgr = api.tier_config_mgr();
+    match load_tier_mutation_intent_record(api.clone(), mutation_id).await {
+        Ok(intent) if intent.state == TierMutationIntentState::Prepared => {
+            let proof_matches = tier_config_commit_matches(api.clone(), &committed_config_etag, intent.candidate_digest)
+                .await
+                .map_err(Error::other)?;
+            if !proof_matches {
+                return Err(TierMutationPeerError::CommitProofMismatch);
+            }
+        }
+        Ok(_) | Err(Error::ConfigNotFound) => {}
+        Err(err) => return Err(err.into()),
+    }
    let (intent, applied) = match advance_tier_mutation_intent_record_idempotent(
        api.clone(),
        mutation_id,
@@ -154,6 +175,9 @@ async fn handle_commit(
                .await
                .map_err(Error::other)? =>
        {
+            TierConfigMgr::promote_prepared_mutation_intent_block(&tier_config_mgr, mutation_id)
+                .await
+                .map_err(TierMutationPeerError::Runtime)?;
            return Ok(TierMutationPeerOutcome {
                state: TierMutationPeerState::Committed,
                applied: false,
@@ -162,7 +186,9 @@ async fn handle_commit(
        Err(err) => return Err(err.into()),
    };
    if intent.state == TierMutationIntentState::Committed {
-        TierConfigMgr::clear_prepared_mutation_intent_block(&tier_config_mgr, mutation_id).await;
+        TierConfigMgr::apply_committed_mutation_intent_block(&tier_config_mgr, &intent)
+            .await
+            .map_err(TierMutationPeerError::Runtime)?;
    }
    Ok(TierMutationPeerOutcome {
        state: peer_state_from_intent(intent.state),
@@ -178,11 +204,18 @@ async fn handle_abort(
    if !canonical_payload.is_empty() {
        return Err(TierMutationPeerError::InvalidPayload("abort payload must be empty".to_string()));
    }
-    let tier_config_mgr = api.tier_config_mgr();
+    let existing = load_tier_mutation_intent_record(api.clone(), mutation_id).await?;
+    if existing.state == TierMutationIntentState::Prepared
+        && !tier_config_abort_matches(api.clone(), &existing)
+            .await
+            .map_err(Error::other)?
+    {
+        return Err(TierMutationPeerError::AbortProofMismatch);
+    }
    let (intent, applied) =
-        advance_tier_mutation_intent_record_idempotent(api, mutation_id, TierMutationIntentState::Aborted, None).await?;
+        advance_tier_mutation_intent_record_idempotent(api.clone(), mutation_id, TierMutationIntentState::Aborted, None).await?;
    if intent.state == TierMutationIntentState::Aborted {
-        TierConfigMgr::clear_prepared_mutation_intent_block(&tier_config_mgr, mutation_id).await;
+        TierConfigMgr::request_committed_mutation_refresh(&api.tier_config_mgr()).await;
    }
    Ok(TierMutationPeerOutcome {
        state: peer_state_from_intent(intent.state),
@@ -272,6 +272,7 @@ const MULTIPART_WRITE_QUORUM_RENAME_PART: &str = "rename_part";
 const EVENT_SET_DISK_WRITE: &str = "set_disk_write";
 const EVENT_SET_DISK_HEAL: &str = "set_disk_heal";
 const EVENT_SET_DISK_COMMIT_TAIL_SLOW: &str = "set_disk_commit_tail_slow";
+const EVENT_SET_DISK_RENAME_TAIL_DRAIN_FAILED: &str = "set_disk_rename_tail_drain_failed";
 const EVENT_SET_DISK_PUT_OBJECT_STAGE_SUMMARY: &str = "set_disk_put_object_stage_summary";
 const SET_DISK_COMMIT_TAIL_WARN_THRESHOLD_MS: u128 = 5_000;
 const ENV_RUSTFS_PUT_LARGE_BATCH_MIN_SIZE_BYTES: &str = "RUSTFS_PUT_LARGE_BATCH_MIN_SIZE_BYTES";
@@ -921,14 +922,10 @@ mod prepared_get_object_metadata_tests {
            .expect("test should find an object whose initial fanout covers both data shards")
    }

-    #[allow(
-        dead_code,
-        reason = "test fixture no assertion in this module uses today; the live namesake lives in io_primitives tests (backlog#1823)"
-    )]
-    fn bounded_spare_disk_index(bucket: &str, object: &str) -> usize {
+    fn bounded_initial_parity_disk_index(bucket: &str, object: &str) -> usize {
        *bounded_metadata_fanout_order(bucket, object, 4, 2)
-            .get(3)
-            .expect("4-disk test geometry should leave one bounded spare disk")
+            .get(2)
+            .expect("4-disk test geometry should schedule one parity disk initially")
    }

    #[tokio::test]
@@ -1086,7 +1083,7 @@ mod prepared_get_object_metadata_tests {
                        ("RUSTFS_GET_METADATA_EARLY_STOP_BOUNDED_FANOUT", None::<&str>),
                    ],
                    async {
-                        let slow_parity_disk = bounded_spare_disk_index(bucket, &object);
+                        let slow_parity_disk = bounded_initial_parity_disk_index(bucket, &object);
                        let barrier =
                            rename_fanout_barrier::arm(&object, slow_parity_disk, rename_fanout_barrier::PHASE_READ_VERSION);
                        let calls = disk_call_counters::observe(&object);
@@ -1500,6 +1497,102 @@ pub fn get_lock_acquire_timeout() -> Duration {
    }
 }

+fn get_put_object_commit_lock_acquire_timeout_override_ms() -> u64 {
+    #[cfg(test)]
+    {
+        rustfs_utils::get_env_u64(
+            rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS,
+            rustfs_config::DEFAULT_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS,
+        )
+    }
+    #[cfg(not(test))]
+    {
+        static CACHED: OnceLock<u64> = OnceLock::new();
+        *CACHED.get_or_init(|| {
+            rustfs_utils::get_env_u64(
+                rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS,
+                rustfs_config::DEFAULT_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS,
+            )
+        })
+    }
+}
+
+fn get_put_object_commit_lock_acquire_timeout(op: &'static str) -> Duration {
+    let default_timeout = get_lock_acquire_timeout();
+    if op != "put_object_commit" {
+        return default_timeout;
+    }
+
+    let timeout_ms = get_put_object_commit_lock_acquire_timeout_override_ms();
+    if timeout_ms == 0 {
+        default_timeout
+    } else {
+        Duration::from_millis(timeout_ms)
+    }
+}
+
+fn put_object_commit_lock_timeout_override_enabled(op: &'static str) -> bool {
+    op == "put_object_commit" && get_put_object_commit_lock_acquire_timeout_override_ms() != 0
+}
+
+fn put_object_commit_lock_admission_budget_label() -> &'static str {
+    match get_put_object_commit_lock_acquire_timeout_override_ms() {
+        0 => rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_DISABLED,
+        1..=250 => rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_250MS,
+        251..=500 => rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_500MS,
+        501..=1000 => rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_1000MS,
+        _ => rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_GT_1000MS,
+    }
+}
+
+fn record_put_object_commit_lock_admission(op: &'static str, outcome: &'static str) {
+    if op != "put_object_commit" || !rustfs_io_metrics::put_stage_metrics_enabled() {
+        return;
+    }
+    rustfs_io_metrics::record_put_object_commit_lock_admission(put_object_commit_lock_admission_budget_label(), outcome);
+}
+
+fn put_object_commit_lock_acquire_error_outcome(op: &'static str, err: &rustfs_lock::error::LockError) -> &'static str {
+    if put_object_commit_lock_timeout_override_enabled(op) && matches!(err, rustfs_lock::error::LockError::Timeout { .. }) {
+        rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_TIMEOUT_SLOWDOWN
+    } else {
+        rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_LOCK_ERROR
+    }
+}
+
+fn resolve_put_object_commit_lock_acquire_result(
+    set: &SetDisks,
+    op: &'static str,
+    bucket: &str,
+    object: &str,
+    result: std::result::Result<rustfs_lock::namespace::NamespaceLockGuard, rustfs_lock::error::LockError>,
+) -> Result<rustfs_lock::namespace::NamespaceLockGuard> {
+    match result {
+        Ok(guard) => {
+            record_put_object_commit_lock_admission(op, rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_ACQUIRED);
+            Ok(guard)
+        }
+        Err(err) => {
+            record_put_object_commit_lock_admission(op, put_object_commit_lock_acquire_error_outcome(op, &err));
+            Err(map_put_object_commit_lock_acquire_error(set, op, bucket, object, err))
+        }
+    }
+}
+
+fn map_put_object_commit_lock_acquire_error(
+    set: &SetDisks,
+    op: &'static str,
+    bucket: &str,
+    object: &str,
+    err: rustfs_lock::error::LockError,
+) -> StorageError {
+    if put_object_commit_lock_timeout_override_enabled(op) && matches!(err, rustfs_lock::error::LockError::Timeout { .. }) {
+        StorageError::SlowDown
+    } else {
+        set.map_namespace_lock_error(bucket, object, "write", err)
+    }
+}
+
 pub fn is_object_lock_diag_enabled() -> bool {
    *OBJECT_LOCK_DIAG_ENABLED.get_or_init(|| {
        let enabled = rustfs_utils::get_env_bool(
@@ -3263,6 +3356,17 @@ impl SetDisks {
        self.get_object_metadata_cache.invalidate_all();
    }

+    #[inline(always)]
+    fn record_put_object_commit_namespace_lock_wait(op: &'static str, acquire_start: Instant) {
+        if op != "put_object_commit" || !rustfs_io_metrics::put_stage_metrics_enabled() {
+            return;
+        }
+        rustfs_io_metrics::record_put_object_stage_duration_from(
+            rustfs_io_metrics::PUT_STAGE_PUT_OBJECT_COMMIT_NAMESPACE_LOCK_WAIT,
+            Some(acquire_start),
+        );
+    }
+
    async fn acquire_read_lock_diag(&self, op: &'static str, bucket: &str, object: &str) -> Result<ObjectLockDiagGuard> {
        crate::hp_guard!("SetDisks::acquire_read_lock");
        let diag_enabled = is_object_lock_diag_enabled();
@@ -3290,10 +3394,15 @@ impl SetDisks {
        let diag_enabled = is_object_lock_diag_enabled();
        let ns_lock = self.new_ns_lock(bucket, object).await?;
        let acquire_start = Instant::now();
-        let guard = ns_lock
-            .get_write_lock(get_lock_acquire_timeout())
-            .await
-            .map_err(|e| self.map_namespace_lock_error(bucket, object, "write", e))?;
+        let acquire_timeout = get_put_object_commit_lock_acquire_timeout(op);
+        let guard = resolve_put_object_commit_lock_acquire_result(
+            self,
+            op,
+            bucket,
+            object,
+            ns_lock.get_write_lock(acquire_timeout).await,
+        )?;
+        Self::record_put_object_commit_namespace_lock_wait(op, acquire_start);
        let owner = diag_enabled.then(|| ns_lock.owner().to_string());
        self.log_object_lock_acquire_if_slow(
            op,
@@ -3327,20 +3436,27 @@ impl SetDisks {
        let diag_enabled = is_object_lock_diag_enabled();
        let ns_lock = self.new_ns_lock(bucket, object).await?;
        let acquire_start = Instant::now();
-        let acquire = ns_lock.get_write_lock(get_lock_acquire_timeout());
+        let acquire_timeout = get_put_object_commit_lock_acquire_timeout(op);
+        let acquire = ns_lock.get_write_lock(acquire_timeout);
        tokio::pin!(acquire);
        let mut on_pending = Some(on_pending);
-        let guard = futures::future::poll_fn(|cx| match std::future::Future::poll(acquire.as_mut(), cx) {
-            std::task::Poll::Pending => {
-                if let Some(on_pending) = on_pending.take() {
-                    on_pending();
+        let guard = resolve_put_object_commit_lock_acquire_result(
+            self,
+            op,
+            bucket,
+            object,
+            futures::future::poll_fn(|cx| match std::future::Future::poll(acquire.as_mut(), cx) {
+                std::task::Poll::Pending => {
+                    if let Some(on_pending) = on_pending.take() {
+                        on_pending();
+                    }
+                    std::task::Poll::Pending
                }
-                std::task::Poll::Pending
-            }
-            std::task::Poll::Ready(result) => std::task::Poll::Ready(result),
-        })
-        .await
-        .map_err(|e| self.map_namespace_lock_error(bucket, object, "write", e))?;
+                std::task::Poll::Ready(result) => std::task::Poll::Ready(result),
+            })
+            .await,
+        )?;
+        Self::record_put_object_commit_namespace_lock_wait(op, acquire_start);
        let owner = diag_enabled.then(|| ns_lock.owner().to_string());
        self.log_object_lock_acquire_if_slow(
            op,
@@ -4578,10 +4694,15 @@ impl SetDisks {
        )?;
        let fi = build_tiered_decommission_file_info(bucket, object, fi, layout);
        let write_quorum = layout.write_quorum;
-        if opts
-            .bucket_lifecycle_lock_fence
-            .as_ref()
-            .is_some_and(NamespaceLockFence::is_lock_lost)
+        if _lock_guard.as_ref().is_some_and(|guard| guard.is_lock_lost())
+            || opts
+                .namespace_lock_fence
+                .as_ref()
+                .is_some_and(NamespaceLockFence::is_lock_lost)
+            || opts
+                .bucket_lifecycle_lock_fence
+                .as_ref()
+                .is_some_and(NamespaceLockFence::is_lock_lost)
            || bucket_lifecycle_guard.as_ref().is_some_and(|guard| guard.is_lock_lost())
        {
            return Err(StorageError::NamespaceLockQuorumUnavailable {
@@ -5454,6 +5575,7 @@ mod tests {
    };
    use crate::store::init_format::save_format_file;
    use crate::store::list_objects::ListPathOptions;
+    use metrics_util::debugging::{DebugValue, DebuggingRecorder};
    use rustfs_filemeta::ErasureInfo;
    use rustfs_filemeta::FileMeta;
    use rustfs_filemeta::MetaCacheEntry;
@@ -5689,6 +5811,448 @@ mod tests {
        assert_eq!(Arc::strong_count(&set.set_lock_namespace), before);
    }

+    fn put_object_commit_namespace_lock_wait_sample_count(snapshotter: &metrics_util::debugging::Snapshotter) -> usize {
+        snapshotter
+            .snapshot()
+            .into_vec()
+            .into_iter()
+            .filter(|(composite, _, _, _)| {
+                composite.key().name() == "rustfs_s3_put_object_stage_duration_ms"
+                    && composite.key().labels().any(|label| {
+                        label.key() == "stage"
+                            && label.value() == rustfs_io_metrics::PUT_STAGE_PUT_OBJECT_COMMIT_NAMESPACE_LOCK_WAIT
+                    })
+            })
+            .map(|(_, _, _, value)| match value {
+                DebugValue::Histogram(samples) => samples.len(),
+                _ => 0,
+            })
+            .sum()
+    }
+
+    fn put_object_commit_lock_admission_count(
+        rows: &[(
+            metrics_util::CompositeKey,
+            Option<metrics::Unit>,
+            Option<metrics::SharedString>,
+            DebugValue,
+        )],
+        budget: &'static str,
+        outcome: &'static str,
+    ) -> u64 {
+        rows.iter()
+            .filter(|(composite, _, _, _)| {
+                composite.key().name() == "rustfs_s3_put_object_commit_namespace_lock_admission_total"
+                    && composite
+                        .key()
+                        .labels()
+                        .any(|label| label.key() == "budget" && label.value() == budget)
+                    && composite
+                        .key()
+                        .labels()
+                        .any(|label| label.key() == "outcome" && label.value() == outcome)
+            })
+            .map(|(_, _, _, value)| match value {
+                DebugValue::Counter(count) => *count,
+                _ => 0,
+            })
+            .sum()
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_lock_admission_budget_labels_are_bounded() {
+        let cases = [
+            ("0", rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_DISABLED),
+            ("250", rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_250MS),
+            ("251", rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_500MS),
+            ("500", rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_500MS),
+            ("501", rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_1000MS),
+            ("1000", rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_1000MS),
+            ("1001", rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_GT_1000MS),
+        ];
+        for (timeout_ms, expected) in cases {
+            temp_env::with_vars(
+                [(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some(timeout_ms))],
+                || {
+                    assert_eq!(put_object_commit_lock_admission_budget_label(), expected);
+                },
+            );
+        }
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_lock_admission_error_outcomes_are_bounded() {
+        let timeout = LockError::timeout("bucket/object", Duration::from_millis(1));
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("1"))], || {
+            assert_eq!(
+                put_object_commit_lock_acquire_error_outcome("put_object_commit", &timeout),
+                rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_TIMEOUT_SLOWDOWN
+            );
+            assert_eq!(
+                put_object_commit_lock_acquire_error_outcome("complete_multipart_upload_commit", &timeout),
+                rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_LOCK_ERROR
+            );
+        });
+
+        let internal = LockError::internal("simulated lock manager error");
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("1"))], || {
+            assert_eq!(
+                put_object_commit_lock_acquire_error_outcome("put_object_commit", &internal),
+                rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_LOCK_ERROR
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_namespace_lock_wait_metric_is_wired_to_both_write_lock_paths() {
+        let recorder = DebuggingRecorder::new();
+        let snapshotter = recorder.snapshotter();
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("test runtime should start");
+
+        metrics::with_local_recorder(&recorder, || {
+            runtime.block_on(async {
+                let ctx = Arc::new(InstanceContext::new());
+                ctx.update_erasure_type(SetupType::Erasure).await;
+                let set = make_test_set_disks_with_ctx(Vec::new(), ctx).await;
+                let bucket = "bucket";
+                let object = "object";
+
+                rustfs_io_metrics::set_put_stage_metrics_enabled(false);
+                let guard = set
+                    .acquire_write_lock_diag("put_object_commit", bucket, object)
+                    .await
+                    .expect("disabled metrics acquire should succeed");
+                drop(guard);
+                assert_eq!(put_object_commit_namespace_lock_wait_sample_count(&snapshotter), 0);
+
+                rustfs_io_metrics::set_put_stage_metrics_enabled(true);
+                let guard = set
+                    .acquire_write_lock_diag("put_object_commit", bucket, object)
+                    .await
+                    .expect("normal PUT commit acquire should succeed");
+                drop(guard);
+                assert_eq!(put_object_commit_namespace_lock_wait_sample_count(&snapshotter), 1);
+
+                let guard = set
+                    .acquire_write_lock_diag("complete_multipart_upload_commit", bucket, object)
+                    .await
+                    .expect("non-PUT commit acquire should succeed");
+                drop(guard);
+                assert_eq!(put_object_commit_namespace_lock_wait_sample_count(&snapshotter), 0);
+
+                let held_guard = set
+                    .acquire_write_lock_diag("put_object_commit", bucket, object)
+                    .await
+                    .expect("holder acquire should succeed");
+                assert_eq!(put_object_commit_namespace_lock_wait_sample_count(&snapshotter), 1);
+
+                let (pending_tx, pending_rx) = tokio::sync::oneshot::channel();
+                let pending_acquire =
+                    set.acquire_write_lock_diag_with_pending_hook("put_object_commit", bucket, object, move || {
+                        let _ = pending_tx.send(());
+                    });
+                let release_holder = async {
+                    pending_rx.await.expect("pending hook should fire");
+                    drop(held_guard);
+                };
+                let (pending_guard, ()) = tokio::join!(pending_acquire, release_holder);
+                drop(pending_guard.expect("pending-hook PUT commit acquire should succeed"));
+                assert_eq!(put_object_commit_namespace_lock_wait_sample_count(&snapshotter), 1);
+
+                rustfs_io_metrics::set_put_stage_metrics_enabled(false);
+            });
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_lock_timeout_override_only_applies_to_put_commit() {
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("17"))], || {
+            assert_eq!(get_put_object_commit_lock_acquire_timeout("put_object_commit"), Duration::from_millis(17));
+            assert_eq!(
+                get_put_object_commit_lock_acquire_timeout("complete_multipart_upload_commit"),
+                get_lock_acquire_timeout()
+            );
+        });
+
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("0"))], || {
+            assert_eq!(
+                get_put_object_commit_lock_acquire_timeout("put_object_commit"),
+                get_lock_acquire_timeout()
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_lock_timeout_override_bounds_contention_wait() {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("test runtime should start");
+
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("1"))], || {
+            runtime.block_on(async {
+                let ctx = Arc::new(InstanceContext::new());
+                ctx.update_erasure_type(SetupType::Erasure).await;
+                let set = make_test_set_disks_with_ctx(Vec::new(), ctx).await;
+                let bucket = "bucket";
+                let object = "object";
+
+                let held_guard = set
+                    .acquire_write_lock_diag("put_object_commit", bucket, object)
+                    .await
+                    .expect("holder acquire should succeed");
+                let started = Instant::now();
+                let err = match set.acquire_write_lock_diag("put_object_commit", bucket, object).await {
+                    Ok(_) => panic!("contended PUT commit lock should honor the short timeout"),
+                    Err(err) => err,
+                };
+                assert!(
+                    started.elapsed() < Duration::from_secs(1),
+                    "short PUT commit lock timeout should not wait for the global timeout"
+                );
+                assert!(matches!(err, StorageError::SlowDown));
+
+                drop(held_guard);
+                set.acquire_write_lock_diag("put_object_commit", bucket, object)
+                    .await
+                    .expect("permit should not leak after timeout");
+            });
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_lock_admission_records_acquired_and_timeout() {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("test runtime should start");
+
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("1"))], || {
+            let recorder = DebuggingRecorder::new();
+            let snapshotter = recorder.snapshotter();
+            metrics::with_local_recorder(&recorder, || {
+                rustfs_io_metrics::set_put_stage_metrics_enabled(true);
+                runtime.block_on(async {
+                    let ctx = Arc::new(InstanceContext::new());
+                    ctx.update_erasure_type(SetupType::Erasure).await;
+                    let set = make_test_set_disks_with_ctx(Vec::new(), ctx).await;
+                    let held_guard = set
+                        .acquire_write_lock_diag("put_object_commit", "bucket", "object")
+                        .await
+                        .expect("holder acquire should succeed");
+                    let err = match set.acquire_write_lock_diag("put_object_commit", "bucket", "object").await {
+                        Ok(_) => panic!("contended PUT commit acquire should return SlowDown"),
+                        Err(err) => err,
+                    };
+                    assert!(matches!(err, StorageError::SlowDown));
+                    drop(held_guard);
+                    rustfs_io_metrics::set_put_stage_metrics_enabled(false);
+                });
+            });
+
+            let rows = snapshotter.snapshot().into_vec();
+            assert_eq!(
+                put_object_commit_lock_admission_count(
+                    &rows,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_250MS,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_ACQUIRED,
+                ),
+                1
+            );
+            assert_eq!(
+                put_object_commit_lock_admission_count(
+                    &rows,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_250MS,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_TIMEOUT_SLOWDOWN,
+                ),
+                1
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_lock_admission_records_disabled_budget_acquired() {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("test runtime should start");
+
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("0"))], || {
+            let recorder = DebuggingRecorder::new();
+            let snapshotter = recorder.snapshotter();
+            metrics::with_local_recorder(&recorder, || {
+                rustfs_io_metrics::set_put_stage_metrics_enabled(true);
+                runtime.block_on(async {
+                    let ctx = Arc::new(InstanceContext::new());
+                    ctx.update_erasure_type(SetupType::Erasure).await;
+                    let set = make_test_set_disks_with_ctx(Vec::new(), ctx).await;
+                    let guard = set
+                        .acquire_write_lock_diag("put_object_commit", "bucket", "object")
+                        .await
+                        .expect("PUT commit acquire should succeed with default timeout");
+                    drop(guard);
+                    rustfs_io_metrics::set_put_stage_metrics_enabled(false);
+                });
+            });
+
+            let rows = snapshotter.snapshot().into_vec();
+            assert_eq!(
+                put_object_commit_lock_admission_count(
+                    &rows,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_DISABLED,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_ACQUIRED,
+                ),
+                1
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_lock_admission_skips_non_put_commit_ops() {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("test runtime should start");
+
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("250"))], || {
+            let recorder = DebuggingRecorder::new();
+            let snapshotter = recorder.snapshotter();
+            metrics::with_local_recorder(&recorder, || {
+                rustfs_io_metrics::set_put_stage_metrics_enabled(true);
+                runtime.block_on(async {
+                    let ctx = Arc::new(InstanceContext::new());
+                    ctx.update_erasure_type(SetupType::Erasure).await;
+                    let set = make_test_set_disks_with_ctx(Vec::new(), ctx).await;
+                    let guard = set
+                        .acquire_write_lock_diag("complete_multipart_upload_commit", "bucket", "object")
+                        .await
+                        .expect("non-PUT commit acquire should succeed");
+                    drop(guard);
+                    rustfs_io_metrics::set_put_stage_metrics_enabled(false);
+                });
+            });
+
+            let rows = snapshotter.snapshot().into_vec();
+            assert_eq!(
+                rows.iter()
+                    .filter(|(composite, _, _, _)| {
+                        composite.key().name() == "rustfs_s3_put_object_commit_namespace_lock_admission_total"
+                    })
+                    .count(),
+                0
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_lock_admission_records_lock_error() {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("test runtime should start");
+
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("250"))], || {
+            let recorder = DebuggingRecorder::new();
+            let snapshotter = recorder.snapshotter();
+            metrics::with_local_recorder(&recorder, || {
+                rustfs_io_metrics::set_put_stage_metrics_enabled(true);
+                runtime.block_on(async {
+                    let healthy: Arc<dyn LockClient> =
+                        Arc::new(LocalClient::with_manager(Arc::new(rustfs_lock::GlobalLockManager::new())));
+                    let failing: Arc<dyn LockClient> = Arc::new(FailingClient);
+                    let ctx = Arc::new(InstanceContext::new());
+                    ctx.update_erasure_type(SetupType::DistErasure).await;
+                    let set = make_test_set_disks_with_ctx(vec![healthy, failing], ctx).await;
+                    assert!(
+                        set.acquire_write_lock_diag("put_object_commit", "bucket", "object")
+                            .await
+                            .is_err(),
+                        "one healthy locker must not satisfy the PUT commit write quorum"
+                    );
+                    rustfs_io_metrics::set_put_stage_metrics_enabled(false);
+                });
+            });
+
+            let rows = snapshotter.snapshot().into_vec();
+            assert_eq!(
+                put_object_commit_lock_admission_count(
+                    &rows,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_250MS,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_LOCK_ERROR,
+                ),
+                1
+            );
+            assert_eq!(
+                put_object_commit_lock_admission_count(
+                    &rows,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_250MS,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_TIMEOUT_SLOWDOWN,
+                ),
+                0
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn put_object_commit_lock_admission_records_pending_hook_acquired() {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("test runtime should start");
+
+        temp_env::with_vars([(rustfs_config::ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS, Some("500"))], || {
+            let recorder = DebuggingRecorder::new();
+            let snapshotter = recorder.snapshotter();
+            metrics::with_local_recorder(&recorder, || {
+                rustfs_io_metrics::set_put_stage_metrics_enabled(true);
+                runtime.block_on(async {
+                    let ctx = Arc::new(InstanceContext::new());
+                    ctx.update_erasure_type(SetupType::Erasure).await;
+                    let set = make_test_set_disks_with_ctx(Vec::new(), ctx).await;
+                    let held_guard = set
+                        .acquire_write_lock_diag("put_object_commit", "bucket", "object")
+                        .await
+                        .expect("holder acquire should succeed");
+                    let (pending_tx, pending_rx) = tokio::sync::oneshot::channel();
+                    let pending_acquire =
+                        set.acquire_write_lock_diag_with_pending_hook("put_object_commit", "bucket", "object", move || {
+                            let _ = pending_tx.send(());
+                        });
+                    let release_holder = async {
+                        pending_rx.await.expect("pending hook should fire");
+                        drop(held_guard);
+                    };
+                    let (pending_guard, ()) = tokio::join!(pending_acquire, release_holder);
+                    drop(pending_guard.expect("pending-hook PUT commit acquire should succeed"));
+                    rustfs_io_metrics::set_put_stage_metrics_enabled(false);
+                });
+            });
+
+            let rows = snapshotter.snapshot().into_vec();
+            assert_eq!(
+                put_object_commit_lock_admission_count(
+                    &rows,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_BUDGET_LE_500MS,
+                    rustfs_io_metrics::PUT_COMMIT_LOCK_ADMISSION_OUTCOME_ACQUIRED,
+                ),
+                2
+            );
+        });
+    }
+
    #[tokio::test]
    async fn new_ns_lock_shares_clients_without_changing_quorum() {
        let healthy: Arc<dyn LockClient> = Arc::new(LocalClient::with_manager(Arc::new(rustfs_lock::GlobalLockManager::new())));
@@ -124,14 +124,7 @@ impl HealWalkCollector {
        for fi in fiv.versions.iter().chain(fiv.free_versions.iter()) {
            let version_uuid = fi.version_id.filter(|version_id| !version_id.is_nil());
            let lifecycle_object_info = if self.include_lifecycle_object_info {
-                let mut lifecycle_fi = fi.clone();
-                lifecycle_fi.version_id = version_uuid;
-                Some(ObjectInfo::from_file_info(
-                    &lifecycle_fi,
-                    &self.bucket,
-                    &entry.name,
-                    version_uuid.is_some(),
-                ))
+                Some(ObjectInfo::from_file_info_with_version_id(fi, &self.bucket, &entry.name, version_uuid))
            } else {
                None
            };
@@ -198,14 +191,7 @@ impl HealWalkCollector {
                let vid = version_uuid.map(|u| u.to_string());
                if seen.insert(vid.clone()) {
                    let lifecycle_object_info = if self.include_lifecycle_object_info {
-                        let mut lifecycle_fi = fi.clone();
-                        lifecycle_fi.version_id = version_uuid;
-                        Some(ObjectInfo::from_file_info(
-                            &lifecycle_fi,
-                            &self.bucket,
-                            &entry.name,
-                            version_uuid.is_some(),
-                        ))
+                        Some(ObjectInfo::from_file_info_with_version_id(fi, &self.bucket, &entry.name, version_uuid))
                    } else {
                        None
                    };
@@ -2433,8 +2433,8 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for SetDisks {
        let commit_object_lock_guard = object_lock_guard.take();
        let detach_commit_owner = commit_object_lock_guard.is_some() || upload_guard.is_some() || quota_mutation_fence;
        let commit = async move {
-            let _object_lock_guard = commit_object_lock_guard;
-            let _upload_guard = upload_guard;
+            let mut _object_lock_guard = commit_object_lock_guard;
+            let mut _upload_guard = upload_guard;
            let mut quota_reservation = quota_reservation;
            let complete_tail_stage_start = rustfs_io_metrics::put_stage_metrics_enabled().then(Instant::now);

@@ -2570,6 +2570,7 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for SetDisks {
            let op_old_dir = rename_commit.data_dir;
            let cleanup_disks = rename_commit.cleanup_disks;
            let committed_file_info = rename_commit.committed_file_info;
+            let rename_tail_drain = rename_commit.tail_drain;

            // Detach admission before any post-commit await: client cancellation
            // must not couple durable convergence repair to cleanup work.
@@ -2628,7 +2629,30 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for SetDisks {
                .invalidate_get_object_metadata_cache(&commit_bucket, &commit_object)
                .await;

-            drop(_object_lock_guard); // release the object lock before multipart cleanup tail IO.
+            if let Some(rename_tail_drain) = rename_tail_drain {
+                let object_lock_guard = _object_lock_guard.take();
+                let upload_guard = _upload_guard.take();
+                let tail_bucket = commit_bucket.clone();
+                let tail_object = commit_object.clone();
+                tokio::spawn(async move {
+                    let _object_lock_guard = object_lock_guard;
+                    let _upload_guard = upload_guard;
+                    if let Err(err) = rename_tail_drain.await {
+                        warn!(
+                            event = EVENT_SET_DISK_RENAME_TAIL_DRAIN_FAILED,
+                            component = LOG_COMPONENT_ECSTORE,
+                            subsystem = LOG_SUBSYSTEM_SET_DISK,
+                            state = "failed",
+                            bucket = %tail_bucket,
+                            object = %tail_object,
+                            error = %err,
+                            "rename tail drain failed"
+                        );
+                    }
+                });
+            } else {
+                drop(_object_lock_guard.take()); // release the object lock before multipart cleanup tail IO.
+            }

            #[cfg(test)]
            pause_multipart_commit(&commit_bucket, &commit_object, MultipartCommitPause::AfterObjectPublication).await;
@@ -2685,7 +2709,7 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for SetDisks {
                );
            }

-            drop(_upload_guard);
+            drop(_upload_guard.take());

            Ok(ObjectInfo::from_file_info(&fi, &commit_bucket, &commit_object, commit_is_versioned))
        };
@@ -1077,23 +1077,23 @@ impl SetDisks {
                            "Recoverable decode error triggered read repair"
                        );
                        let version_id = fi.version_id.as_ref().map(ToString::to_string);
-                        // MRF journal intent: keeps a durable Urgent ECDecode
-                        // request alive across restarts even when the in-memory
-                        // read-repair request is dropped or lost (HS-01).
-                        rustfs_common::mrf_channel::try_send_mrf_intent(
-                            rustfs_common::mrf_channel::MrfKind::DecodeFailure,
-                            bucket,
-                            object,
-                            fi.version_id,
-                        );
-                        submit_read_repair_heal(
-                            bucket,
-                            object,
-                            version_id.as_deref(),
-                            pool_index,
-                            set_index,
-                            Some(part_number),
-                            "decode_error",
+                        // Single-flight (backlog#1894 axis A): the durable
+                        // MRF intent (Urgent ECDecode across restarts, HS-01)
+                        // is bound to the read-repair reservation, so only the
+                        // first sighting within the dedup TTL books a journal
+                        // record instead of one per retried read.
+                        submit_read_repair_heal_with_submitter(
+                            ReadRepairHealSubmission {
+                                bucket,
+                                object,
+                                version_id: version_id.as_deref(),
+                                pool_index,
+                                set_index,
+                                part_number: Some(part_number),
+                                reason: "decode_error",
+                                mrf_intent: Some((rustfs_common::mrf_channel::MrfKind::DecodeFailure, fi.version_id)),
+                            },
+                            send_read_repair_heal_request,
                        )
                        .await;
                        has_err = false;
@@ -2577,6 +2577,7 @@ mod metadata_cache_tests {
                set_index: 0,
                part_number: Some(1),
                reason: "missing_shards",
+                mrf_intent: None,
            },
            slow_read_repair_submitter,
        )
@@ -2611,6 +2612,7 @@ mod metadata_cache_tests {
                set_index: 0,
                part_number: Some(1),
                reason: "missing_shards",
+                mrf_intent: None,
            },
            dropped_read_repair_submitter,
        )
@@ -2647,6 +2649,7 @@ mod metadata_cache_tests {
                set_index: 0,
                part_number: Some(1),
                reason: "missing_shards",
+                mrf_intent: None,
            },
            capture_read_repair_submitter,
        )
@@ -18,6 +18,78 @@ use rustfs_filemeta::RestoreStatusOps;
 use rustfs_utils::http::headers::{AMZ_RESTORE_EXPIRY_DAYS, AMZ_RESTORE_REQUEST_DATE};
 use s3s::dto::{RestoreStatus, Timestamp};

+#[cfg(all(test, feature = "test-util"))]
+struct RestoreFinalizeBarrierState {
+    bucket: String,
+    object: String,
+    arrived: tokio::sync::Notify,
+    release: tokio::sync::Notify,
+}
+
+#[cfg(all(test, feature = "test-util"))]
+static RESTORE_FINALIZE_BARRIER: std::sync::OnceLock<std::sync::Mutex<Option<Arc<RestoreFinalizeBarrierState>>>> =
+    std::sync::OnceLock::new();
+
+#[cfg(all(test, feature = "test-util"))]
+pub(in crate::set_disk) struct RestoreFinalizeBarrier {
+    state: Arc<RestoreFinalizeBarrierState>,
+}
+
+#[cfg(all(test, feature = "test-util"))]
+impl RestoreFinalizeBarrier {
+    pub(in crate::set_disk) fn install(bucket: &str, object: &str) -> Self {
+        let state = Arc::new(RestoreFinalizeBarrierState {
+            bucket: bucket.to_string(),
+            object: object.to_string(),
+            arrived: tokio::sync::Notify::new(),
+            release: tokio::sync::Notify::new(),
+        });
+        let mut slot = RESTORE_FINALIZE_BARRIER
+            .get_or_init(|| std::sync::Mutex::new(None))
+            .lock()
+            .expect("restore finalize barrier mutex should not poison");
+        assert!(slot.is_none(), "restore finalize barrier must be installed by one test at a time");
+        *slot = Some(Arc::clone(&state));
+        Self { state }
+    }
+
+    pub(in crate::set_disk) async fn wait_until_paused(&self) {
+        self.state.arrived.notified().await;
+    }
+
+    pub(in crate::set_disk) fn release(&self) {
+        self.state.release.notify_one();
+    }
+}
+
+#[cfg(all(test, feature = "test-util"))]
+impl Drop for RestoreFinalizeBarrier {
+    fn drop(&mut self) {
+        let mut slot = RESTORE_FINALIZE_BARRIER
+            .get_or_init(|| std::sync::Mutex::new(None))
+            .lock()
+            .expect("restore finalize barrier mutex should not poison");
+        if slot.as_ref().is_some_and(|state| Arc::ptr_eq(state, &self.state)) {
+            *slot = None;
+        }
+    }
+}
+
+#[cfg(all(test, feature = "test-util"))]
+async fn maybe_pause_restore_finalize(bucket: &str, object: &str) {
+    let barrier = RESTORE_FINALIZE_BARRIER
+        .get_or_init(|| std::sync::Mutex::new(None))
+        .lock()
+        .expect("restore finalize barrier mutex should not poison")
+        .as_ref()
+        .filter(|barrier| barrier.bucket == bucket && barrier.object == object)
+        .cloned();
+    if let Some(barrier) = barrier {
+        barrier.arrived.notify_one();
+        barrier.release.notified().await;
+    }
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 struct RestoreCleanupIdentity {
    version_id: Option<Uuid>,
@@ -80,7 +152,7 @@ impl SetDisks {
            .clone()
            .unwrap_or_else(|| get_raw_etag(obj_info.user_defined.as_ref()));
        let version_id = expected.version_id.map(|v| v.to_string());
-        let _lock_guard = if !opts.no_lock {
+        let lock_guard = if !opts.no_lock {
            Some(
                self.acquire_write_lock_diag("restore_finalize_metadata", bucket, object)
                    .await?,
@@ -99,13 +171,16 @@ impl SetDisks {
            .get_object_fileinfo_gated(bucket, object, &read_opts, false, false)
            .await?
            .into_owned();
-        if let Some(expected_operation_id) = expected_operation_id {
-            require_restore_operation_id(&fi.metadata, expected_operation_id)?;
+        if let Some(expected_operation_id) = expected_operation_id
+            && restore_operation_id_from_metadata(&fi.metadata)?.is_some_and(|actual| actual != expected_operation_id)
+        {
+            return Err(Error::other("restore operation id changed before metadata finalization"));
        }
        if !expected.matches_file_info(&fi, &expected_etag) {
            return Err(Error::other("restored object changed before restore metadata finalization"));
        }
-        ensure_restore_metadata_lock_held(bucket, object, opts, "restore_finalize_metadata")?;
+        #[cfg(all(test, feature = "test-util"))]
+        maybe_pause_restore_finalize(bucket, object).await;
        let restore_expiry =
            lifecycle::expected_expiry_time(OffsetDateTime::now_utc(), opts.transition.restore_request.days.unwrap_or(1));
        fi.metadata.insert(
@@ -117,6 +192,10 @@ impl SetDisks {
            .to_string(),
        );
        self.invalidate_get_object_metadata_cache(bucket, object).await;
+        ensure_restore_metadata_lock_held(bucket, object, opts, "restore_finalize_metadata")?;
+        if lock_guard.as_ref().is_some_and(|guard| guard.is_lock_lost()) {
+            return Err(Error::other("restore finalization lock lost before metadata update"));
+        }
        self.update_object_meta_with_opts(
            bucket,
            object,
@@ -151,6 +151,7 @@ pub(crate) mod init_format;
 pub(crate) mod list_objects;
 mod multipart;
 mod object;
+pub(crate) use object::ObjectLockDiagGuard;
 pub use object::{
    PrepareSelectObjectSnapshotError, PreparedGetObjectReader, SelectObjectSnapshot, SelectObjectSnapshotReadError,
    SnapshotConsistencyError,
@@ -342,6 +343,23 @@ impl ECStore {
        let (decommission, rebalance) = tokio::join!(self.is_decommission_running(), self.is_rebalance_started());
        decommission || rebalance
    }
+
+    /// Returns whether scanner metadata may still be hidden by a local
+    /// data-movement state. Terminal failed/canceled decommission entries
+    /// remain suspended until an operator clears or retries them, so they are
+    /// a publication barrier even after the worker has stopped.
+    pub async fn scanner_data_usage_publication_blocked(&self) -> bool {
+        if self.scanner_data_movement_active().await {
+            return true;
+        }
+
+        let pool_meta = self.pool_meta.read().await;
+        pool_meta.pools.iter().any(|pool| {
+            pool.decommission
+                .as_ref()
+                .is_some_and(|info| !info.queued && (info.failed || info.canceled))
+        })
+    }
 }

 // impl Clone for ECStore {
@@ -874,6 +892,7 @@ impl crate::storage_api_contracts::admin::StorageAdminApi for ECStore {
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::core::pools::{PoolDecommissionInfo, PoolStatus};
    use crate::layout::endpoints::{Endpoints, PoolEndpoints, SetupType};
    use crate::runtime::global::reset_local_disk_test_state;
    use crate::runtime::sources::{clear_local_disk_id_map_for_test, local_disk_path_by_id};
@@ -910,6 +929,72 @@ mod tests {
        })
    }

+    #[tokio::test]
+    async fn scanner_data_usage_publication_blocks_active_and_unqueued_terminal_decommission() {
+        let store = build_store_with_ctx(Arc::new(InstanceContext::new()));
+        let cases = [
+            (
+                "active",
+                PoolDecommissionInfo {
+                    start_time: Some(OffsetDateTime::now_utc()),
+                    ..Default::default()
+                },
+                true,
+            ),
+            (
+                "failed",
+                PoolDecommissionInfo {
+                    failed: true,
+                    ..Default::default()
+                },
+                true,
+            ),
+            (
+                "canceled",
+                PoolDecommissionInfo {
+                    canceled: true,
+                    ..Default::default()
+                },
+                true,
+            ),
+            (
+                "queued_failed",
+                PoolDecommissionInfo {
+                    failed: true,
+                    queued: true,
+                    ..Default::default()
+                },
+                false,
+            ),
+            (
+                "complete",
+                PoolDecommissionInfo {
+                    complete: true,
+                    ..Default::default()
+                },
+                false,
+            ),
+            ("idle", PoolDecommissionInfo::default(), false),
+        ];
+
+        for (name, decommission, expected) in cases {
+            *store.pool_meta.write().await = PoolMeta {
+                pools: vec![PoolStatus {
+                    id: 0,
+                    cmd_line: format!("scanner-publication-{name}"),
+                    last_update: OffsetDateTime::now_utc(),
+                    decommission: Some(decommission),
+                }],
+                ..Default::default()
+            };
+            assert_eq!(
+                store.scanner_data_usage_publication_blocked().await,
+                expected,
+                "unexpected scanner publication barrier state for {name}"
+            );
+        }
+    }
+
    // The object graph is the isolation carrier: two ECStore instances holding
    // distinct contexts report independent erasure state through their real
    // `&self` accessors — no cross-contamination.
@@ -14,6 +14,8 @@

 use super::*;
 use crate::bucket::lifecycle::{
+    bucket_lifecycle_ops::eval_action_from_lifecycle,
+    get_expiry_configs,
    tier_delete_journal::{
        abort_prepared_tier_delete_journal_entry as abort_prepared_journal_entry_if_current, commit_tier_delete_journal_entry,
        enqueue_committed_tier_delete_journal_entry, persist_tier_delete_journal_entry,
@@ -211,7 +213,8 @@ async fn delete_prefix_with_tier_delete_journal(
    opts: &ObjectOptions,
    tier_journal_api: Option<&Arc<ECStore>>,
 ) -> Result<()> {
-    let journal_entry = if let Some(api) = tier_journal_api {
+    let lifecycle_delete_all = opts.lifecycle_delete_all.is_some();
+    let journal_entry = if !lifecycle_delete_all && let Some(api) = tier_journal_api {
        Some(prepare_prefix_tier_delete_journal_entries(api, bucket, object, opts).await?)
    } else {
        None
@@ -220,14 +223,34 @@ async fn delete_prefix_with_tier_delete_journal(
    let result = store.delete_prefix(bucket, object, opts).await;
    match result {
        Ok(()) => {
-            if let (Some(api), Some(entries)) = (tier_journal_api, journal_entry.as_ref()) {
+            let lifecycle_entries = if lifecycle_delete_all {
+                opts.lifecycle_delete_all_journal()
+                    .ok_or(StorageError::PreconditionFailed)?
+                    .lock()
+                    .prepared_entries()
+            } else {
+                Vec::new()
+            };
+            let entries = journal_entry.as_deref().unwrap_or(&lifecycle_entries);
+            if let Some(api) = tier_journal_api {
                commit_prepared_tier_delete_journal_entries(api, entries).await;
            }
            Ok(())
        }
        Err(err) => {
-            if let (Some(api), Some(entries)) = (tier_journal_api, journal_entry.as_ref()) {
-                abort_prepared_tier_delete_journal_entries(api, entries).await;
+            if let Some(api) = tier_journal_api {
+                if lifecycle_delete_all {
+                    let (abort, entries) = {
+                        let journal = opts.lifecycle_delete_all_journal().ok_or(StorageError::PreconditionFailed)?;
+                        let state = journal.lock();
+                        (!state.mutation_started(), state.prepared_entries())
+                    };
+                    if abort {
+                        abort_prepared_tier_delete_journal_entries(api, &entries).await;
+                    }
+                } else if let Some(entries) = journal_entry.as_ref() {
+                    abort_prepared_tier_delete_journal_entries(api, entries).await;
+                }
            }
            Err(err)
        }
@@ -327,7 +350,7 @@ impl fmt::Display for ObjectLockDiagMode {
    }
 }

-struct ObjectLockDiagGuard {
+pub(crate) struct ObjectLockDiagGuard {
    guard: rustfs_lock::NamespaceLockGuard,
    enabled: bool,
    op: &'static str,
@@ -360,14 +383,14 @@ impl ObjectLockDiagGuard {
        }
    }

-    fn lock_lost_signal(&self) -> Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>> {
+    pub(crate) fn lock_lost_signal(&self) -> Option<Arc<rustfs_lock::distributed_lock::LockLostSignal>> {
        match &self.guard {
            rustfs_lock::NamespaceLockGuard::Standard(guard) => Some(guard.lock_lost()),
            rustfs_lock::NamespaceLockGuard::Fast(_) => None,
        }
    }

-    fn is_lock_lost(&self) -> bool {
+    pub(crate) fn is_lock_lost(&self) -> bool {
        self.guard.is_lock_lost()
    }
 }
@@ -1109,6 +1132,26 @@ fn is_equivalent_data_movement_tiered_object(source: &rustfs_filemeta::FileInfo,
        && source_actual_size == target_actual_size
 }

+fn tiered_data_movement_source_matches(
+    expected: &rustfs_filemeta::FileInfo,
+    current: &rustfs_filemeta::FileInfo,
+) -> Result<bool> {
+    let expected_backend = crate::services::tier::tier::tier_destination_id_from_metadata(&expected.metadata)?;
+    let current_backend = crate::services::tier::tier::tier_destination_id_from_metadata(&current.metadata)?;
+    Ok(expected.version_id == current.version_id
+        && expected.data_dir == current.data_dir
+        && expected.mod_time == current.mod_time
+        && expected.size == current.size
+        && expected.get_etag() == current.get_etag()
+        && expected.transition_status == current.transition_status
+        && expected.transitioned_objname == current.transitioned_objname
+        && expected.transition_tier == current.transition_tier
+        && expected.transition_version_id == current.transition_version_id
+        && expected.transition_version == current.transition_version
+        && expected.transition_version_state == current.transition_version_state
+        && expected_backend == current_backend)
+}
+
 fn should_check_data_movement_resume_target(src_pool_idx: usize, target_pool_idx: usize) -> bool {
    target_pool_idx != src_pool_idx
 }
@@ -1247,7 +1290,9 @@ impl ECStore {
        let mut opts = opts.clone();
        opts.no_lock = false;
        opts.metadata_cache_safe = false;
-        let read_lock_guards = self.acquire_select_object_read_locks(bucket, &object, &mut opts).await?;
+        let read_lock_guards = self
+            .acquire_all_object_read_locks("select_object", bucket, &object, &mut opts)
+            .await?;
        if self.ctx.lock_manager().is_disabled() {
            return Err(SnapshotConsistencyError::LockingDisabled.into());
        }
@@ -1488,8 +1533,9 @@ impl ECStore {
        )))
    }

-    async fn acquire_select_object_read_locks(
+    pub(crate) async fn acquire_all_object_read_locks(
        &self,
+        op: &'static str,
        bucket: &str,
        object: &str,
        opts: &mut ObjectOptions,
@@ -1501,10 +1547,7 @@ impl ECStore {
        // for each object's hashed set. DELETE and same-key CopyObject use the
        // fixed domain, while PUT commits and data movement use the hashed set.
        let distributed = self.ctx.is_dist_erasure().await;
-        if let Some(guard) = self
-            .acquire_object_read_lock_if_needed("select_object", bucket, object, opts)
-            .await?
-        {
+        if let Some(guard) = self.acquire_object_read_lock_if_needed(op, bucket, object, opts).await? {
            guards.push(guard);
        }
        let fixed_set = Arc::clone(&self.pools[0].disk_set[0]);
@@ -1527,7 +1570,7 @@ impl ECStore {
                .map_err(|err| Self::map_namespace_lock_error(bucket, object, "read", err))?;
            let owner = diag_enabled.then(|| ns_lock.owner().to_string());
            log_object_lock_acquire_if_slow(
-                "select_object",
+                op,
                bucket,
                object,
                owner.as_deref(),
@@ -1538,7 +1581,7 @@ impl ECStore {
            guards.push(ObjectLockDiagGuard::new(
                guard,
                diag_enabled,
-                "select_object",
+                op,
                diag_enabled.then(|| bucket.to_string()),
                diag_enabled.then(|| object.to_string()),
                owner,
@@ -1549,6 +1592,77 @@ impl ECStore {
        Ok(guards)
    }

+    async fn acquire_data_movement_object_write_locks(
+        &self,
+        bucket: &str,
+        object: &str,
+        source_pool_idx: usize,
+        target_pool_idx: usize,
+        opts: &mut ObjectOptions,
+    ) -> Result<Vec<ObjectLockDiagGuard>> {
+        if self.ctx.lock_manager().is_disabled() {
+            return Err(Error::other("tiered data movement requires namespace locking"));
+        }
+        let distributed = self.ctx.is_dist_erasure().await;
+        let diag_enabled = is_object_lock_diag_enabled();
+        let mut pool_indices = [source_pool_idx, target_pool_idx];
+        pool_indices.sort_unstable();
+        let fixed_set = Arc::clone(&self.pools[0].disk_set[0]);
+        let mut locked_sets = vec![fixed_set];
+        let mut guards = Vec::with_capacity(3);
+
+        // Lock order matches journal recovery: fixed store domain first, then
+        // hashed domains by ascending pool index. This also serializes source
+        // revalidation and target publication against ordinary object deletes.
+        guards.push(self.acquire_object_write_lock("tiered_data_movement", bucket, object).await?);
+        for pool_idx in pool_indices {
+            let pool = self
+                .pools
+                .get(pool_idx)
+                .ok_or_else(|| Error::other(format!("invalid tiered data movement pool {pool_idx}")))?;
+            let set = pool.get_disks_by_key(object);
+            let lock_domain_already_held = !distributed
+                || locked_sets.iter().any(|locked_set: &Arc<crate::set_disk::SetDisks>| {
+                    same_distributed_lock_domain(&locked_set.lockers, &set.lockers)
+                });
+            if lock_domain_already_held {
+                continue;
+            }
+            let ns_lock = set.new_ns_lock(bucket, object).await?;
+            let acquire_start = Instant::now();
+            let guard = ns_lock
+                .get_write_lock(get_lock_acquire_timeout())
+                .await
+                .map_err(|err| Self::map_namespace_lock_error(bucket, object, "write", err))?;
+            let owner = diag_enabled.then(|| ns_lock.owner().to_string());
+            log_object_lock_acquire_if_slow(
+                "tiered_data_movement",
+                bucket,
+                object,
+                owner.as_deref(),
+                ObjectLockDiagMode::Write,
+                acquire_start.elapsed(),
+                diag_enabled,
+            );
+            guards.push(ObjectLockDiagGuard::new(
+                guard,
+                diag_enabled,
+                "tiered_data_movement",
+                diag_enabled.then(|| bucket.to_string()),
+                diag_enabled.then(|| object.to_string()),
+                owner,
+                ObjectLockDiagMode::Write,
+            ));
+            locked_sets.push(set);
+        }
+        opts.no_lock = true;
+        for signal in guards.iter().filter_map(ObjectLockDiagGuard::lock_lost_signal) {
+            opts.add_namespace_lock_lost_signal(signal);
+        }
+        opts.ensure_namespace_lock_fence();
+        Ok(guards)
+    }
+
    fn attach_read_lock_guard(mut reader: GetObjectReader, guard: Option<ObjectLockDiagGuard>) -> GetObjectReader {
        if is_lock_optimization_enabled() || reader.buffered_body.is_some() {
            return reader;
@@ -1686,13 +1800,8 @@ impl ECStore {
            Some(guard)
        };

-        let mut fi = fi.clone();
-        if opts.data_movement {
-            crate::data_movement::prepare_tiered_data_movement_file_info(&mut fi)?;
-        }
-
-        let object = encode_dir_object(object);
-
+        let logical_object = object;
+        let object = encode_dir_object(logical_object);
        if self.single_pool() {
            return Self::resolve_decommission_tiered_object_result(
                Err(Error::other("single pool deployments cannot decommission tiered objects")),
@@ -1715,6 +1824,33 @@ impl ECStore {
                &object,
            )?
        };
+        let _object_guards = self
+            .acquire_data_movement_object_write_locks(bucket, &object, opts.src_pool_idx, idx, &mut opts)
+            .await?;
+        let source_pool = self
+            .pools
+            .get(opts.src_pool_idx)
+            .ok_or_else(|| Error::other(format!("invalid tiered data movement source pool {}", opts.src_pool_idx)))?;
+        let source_versions = source_pool
+            .get_disks_by_key(&object)
+            .load_file_info_versions_exact(bucket, logical_object)
+            .await?;
+        let current_source = source_versions
+            .as_ref()
+            .and_then(|versions| {
+                versions
+                    .versions
+                    .iter()
+                    .find(|current| current.version_id == fi.version_id && !current.tier_free_version())
+            })
+            .ok_or_else(|| to_object_err(StorageError::FileNotFound, vec![bucket, object.as_str()]))?;
+        if !tiered_data_movement_source_matches(fi, current_source)? {
+            return Err(to_object_err(StorageError::FileNotFound, vec![bucket, object.as_str()]));
+        }
+        let mut fi = current_source.clone();
+        if opts.data_movement {
+            crate::data_movement::prepare_tiered_data_movement_file_info(&mut fi)?;
+        }
        if opts.data_movement && idx == opts.src_pool_idx {
            let resume_target_pool_idx = self
                .get_available_pool_idx_excluding(bucket, &object, fi.size, opts.src_pool_idx)
@@ -2190,6 +2326,10 @@ impl ECStore {
    ) -> Result<ObjectInfo> {
        check_del_obj_args(bucket, object)?;

+        if opts.lifecycle_delete_all.is_some() && self.ctx.lock_manager().is_disabled() {
+            return Err(Error::other("lifecycle delete-all requires namespace locking"));
+        }
+
        let _bucket_lifecycle_guard = if is_meta_bucketname(bucket) {
            None
        } else if opts.delete_prefix {
@@ -2204,6 +2344,11 @@ impl ECStore {
        };
        let object = object.as_str();
        let mut opts = opts;
+        let delete_all_configs = if opts.lifecycle_delete_all.is_some() {
+            Some(get_expiry_configs(self, bucket).await?)
+        } else {
+            None
+        };
        opts.tier_delete_journal_api = tier_journal_api.clone();
        if let Some(guard) = _bucket_lifecycle_guard.as_ref() {
            opts.add_bucket_lifecycle_lock_guard(guard);
@@ -2301,6 +2446,34 @@ impl ECStore {
        } else {
            None
        };
+        if let Some(trigger) = opts.lifecycle_delete_all.as_ref() {
+            let configs = delete_all_configs.as_ref().ok_or(StorageError::PreconditionFailed)?;
+            let expected_bucket_incarnation_id = opts.expected_bucket_incarnation_id.ok_or(StorageError::PreconditionFailed)?;
+            if configs.table_bucket_enabled || configs.bucket_incarnation_id != expected_bucket_incarnation_id {
+                return Err(StorageError::PreconditionFailed);
+            }
+            let lifecycle = configs.lifecycle.as_ref().ok_or(StorageError::PreconditionFailed)?;
+            let (mut current, _) = self
+                .get_latest_object_info_with_idx(
+                    bucket,
+                    object,
+                    &ObjectOptions {
+                        no_lock: true,
+                        metadata_cache_safe: false,
+                        ..Default::default()
+                    },
+                )
+                .await?;
+            let current_version_id = current.version_id.filter(|version_id| !version_id.is_nil());
+            if current_version_id != trigger.version_id || current.delete_marker != trigger.delete_marker {
+                return Err(StorageError::PreconditionFailed);
+            }
+            current.name = decode_dir_object(&current.name);
+            let current_event = eval_action_from_lifecycle(lifecycle, configs.object_lock.as_deref(), &current).await;
+            if current_event.action != trigger.action || current_event.rule_id != trigger.rule_id {
+                return Err(StorageError::PreconditionFailed);
+            }
+        }
        if opts.delete_prefix {
            delete_prefix_with_tier_delete_journal(self, bucket, object, &opts, tier_journal_api.as_ref()).await?;
            return Ok(ObjectInfo::default());
@@ -3828,6 +4001,24 @@ mod tests {
        assert!(is_equivalent_data_movement_tiered_object(&source, &target));
    }

+    #[test]
+    fn tiered_data_movement_source_match_rejects_transition_identity_changes() {
+        let source = tiered_equivalence_source();
+        assert!(tiered_data_movement_source_matches(&source, &source).expect("matching source metadata should parse"));
+
+        let mut changed_remote = source.clone();
+        changed_remote.transitioned_objname = "remote/replaced".to_string();
+        assert!(!tiered_data_movement_source_matches(&source, &changed_remote).expect("changed remote metadata should parse"));
+
+        let mut changed_backend = source.clone();
+        rustfs_utils::http::metadata_compat::insert_str(
+            &mut changed_backend.metadata,
+            rustfs_utils::http::metadata_compat::SUFFIX_TRANSITION_TIER_DESTINATION_ID,
+            rustfs_utils::crypto::hex([9; 32]),
+        );
+        assert!(!tiered_data_movement_source_matches(&source, &changed_backend).expect("backend metadata should parse"));
+    }
+
    #[test]
    fn equivalent_data_movement_tiered_object_uses_logical_compressed_and_encrypted_sizes() {
        let mut compressed = tiered_equivalence_source();
@@ -202,10 +202,76 @@ impl ECStore {
    }

    pub(super) async fn delete_prefix(&self, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()> {
+        if opts.lifecycle_delete_all.is_some() {
+            let mut preflight_opts = opts.clone();
+            preflight_opts
+                .lifecycle_delete_all
+                .as_mut()
+                .ok_or(StorageError::PreconditionFailed)?
+                .phase = crate::object_api::LifecycleDeleteAllPhase::Preflight;
+            for pool in &self.pools {
+                #[cfg(test)]
+                lifecycle_delete_all_test_failure(crate::object_api::LifecycleDeleteAllPhase::Preflight, pool.pool_idx)?;
+                pool.delete_object(bucket, object, preflight_opts.clone()).await?;
+            }
+
+            opts.lifecycle_delete_all_journal()
+                .ok_or(StorageError::PreconditionFailed)?
+                .lock()
+                .mark_mutation_started();
+            let mut non_trigger_opts = opts.clone();
+            non_trigger_opts
+                .lifecycle_delete_all
+                .as_mut()
+                .ok_or(StorageError::PreconditionFailed)?
+                .phase = crate::object_api::LifecycleDeleteAllPhase::History;
+            for pool in &self.pools {
+                #[cfg(test)]
+                lifecycle_delete_all_test_failure(crate::object_api::LifecycleDeleteAllPhase::History, pool.pool_idx)?;
+                let mut pool_opts = non_trigger_opts.clone();
+                pool_opts.delete_prefix = true;
+                pool.delete_object(bucket, object, pool_opts).await?;
+            }
+
+            let mut final_preflight_opts = opts.clone();
+            final_preflight_opts
+                .lifecycle_delete_all
+                .as_mut()
+                .ok_or(StorageError::PreconditionFailed)?
+                .phase = crate::object_api::LifecycleDeleteAllPhase::FinalPreflight;
+            let mut trigger_pools = Vec::new();
+            for (pool_index, pool) in self.pools.iter().enumerate() {
+                #[cfg(test)]
+                lifecycle_delete_all_test_failure(crate::object_api::LifecycleDeleteAllPhase::FinalPreflight, pool.pool_idx)?;
+                let result = pool.delete_object(bucket, object, final_preflight_opts.clone()).await?;
+                if !result.name.is_empty() {
+                    trigger_pools.push(pool_index);
+                }
+            }
+            if trigger_pools.is_empty() {
+                return Err(StorageError::PreconditionFailed);
+            }
+
+            let mut trigger_opts = opts.clone();
+            trigger_opts
+                .lifecycle_delete_all
+                .as_mut()
+                .ok_or(StorageError::PreconditionFailed)?
+                .phase = crate::object_api::LifecycleDeleteAllPhase::Trigger;
+            for pool_index in trigger_pools {
+                #[cfg(test)]
+                lifecycle_delete_all_test_failure(crate::object_api::LifecycleDeleteAllPhase::Trigger, pool_index)?;
+                let mut pool_opts = trigger_opts.clone();
+                pool_opts.delete_prefix = true;
+                self.pools[pool_index].delete_object(bucket, object, pool_opts).await?;
+            }
+            return Ok(());
+        }
+
        let mut first_error = None;
        let mut first_volume_error = None;
        let mut has_success = false;
-        for pool in self.pools.iter() {
+        for pool in &self.pools {
            let mut opts = opts.clone();
            opts.delete_prefix = true;
            match pool.delete_object(bucket, object, opts).await {
@@ -774,6 +840,22 @@ impl ECStore {
    }
 }

+#[cfg(test)]
+static LIFECYCLE_DELETE_ALL_TEST_FAILURE: std::sync::Mutex<Option<(crate::object_api::LifecycleDeleteAllPhase, usize)>> =
+    std::sync::Mutex::new(None);
+
+#[cfg(test)]
+fn lifecycle_delete_all_test_failure(phase: crate::object_api::LifecycleDeleteAllPhase, pool_index: usize) -> Result<()> {
+    if LIFECYCLE_DELETE_ALL_TEST_FAILURE
+        .lock()
+        .expect("lifecycle delete-all failure hook should not poison")
+        .is_some_and(|failure| failure == (phase, pool_index))
+    {
+        return Err(StorageError::PreconditionFailed);
+    }
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -781,23 +863,28 @@ mod tests {
    use crate::disk::error::DiskError;
    use crate::layout::endpoint::Endpoint;
    use crate::layout::endpoints::{EndpointServerPools, Endpoints, PoolEndpoints};
+    use crate::object_api::ObjectLockConfigSnapshot;
    use crate::storage_api_contracts::bucket::MakeBucketOptions;
+    use crate::storage_api_contracts::object::ObjectIO as _;
    use arc_swap::ArcSwap;
    use rustfs_config::server_config::KVS;
+    use rustfs_filemeta::FileInfo;
    use std::sync::Arc;
    use tokio_util::sync::CancellationToken;

-    #[tokio::test]
-    async fn delete_prefix_attempts_later_pools_after_an_earlier_pool_error() {
-        let temp_dir = tempfile::tempdir().expect("multi-pool delete test directory should be created");
-        let mut pools = Vec::with_capacity(2);
-        for (pool_index, drives_per_set) in [2, 4].into_iter().enumerate() {
+    async fn setup_multi_pool_test_store(
+        name: &str,
+        drives_per_pool: &[usize],
+    ) -> (tempfile::TempDir, Arc<ECStore>, CancellationToken) {
+        let temp_dir = tempfile::tempdir().expect("multi-pool test directory should be created");
+        let mut pools = Vec::with_capacity(drives_per_pool.len());
+        for (pool_index, drives_per_set) in drives_per_pool.iter().copied().enumerate() {
            let mut endpoints = Vec::with_capacity(drives_per_set);
            for disk_index in 0..drives_per_set {
                let disk_path = temp_dir.path().join(format!("pool{pool_index}-disk{disk_index}"));
                tokio::fs::create_dir_all(&disk_path)
                    .await
-                    .expect("multi-pool delete test disk should be created");
+                    .expect("multi-pool test disk should be created");
                let mut endpoint =
                    Endpoint::try_from(disk_path.to_str().expect("disk path should be utf8")).expect("endpoint should parse");
                endpoint.set_pool_index(pool_index);
@@ -810,7 +897,7 @@ mod tests {
                set_count: 1,
                drives_per_set,
                endpoints: Endpoints::from(endpoints),
-                cmd_line: format!("delete-prefix-pool-{pool_index}"),
+                cmd_line: format!("{name}-pool-{pool_index}"),
                platform: "test".to_string(),
            });
        }
@@ -830,6 +917,92 @@ mod tests {
        .await
        .expect("multi-pool store should initialize");
        crate::bucket::metadata_sys::init_bucket_metadata_sys(store.clone(), Vec::new()).await;
+        (temp_dir, store, shutdown)
+    }
+
+    struct LifecycleDeleteAllFailureGuard;
+
+    impl Drop for LifecycleDeleteAllFailureGuard {
+        fn drop(&mut self) {
+            *LIFECYCLE_DELETE_ALL_TEST_FAILURE
+                .lock()
+                .expect("lifecycle delete-all failure hook should not poison") = None;
+        }
+    }
+
+    async fn seed_multi_pool_delete_all(store: &Arc<ECStore>, bucket: &str, object: &str) -> ObjectOptions {
+        let trigger_id = Uuid::new_v4();
+        for (pool_index, pool) in store.pools.iter().enumerate() {
+            let mut history_reader = PutObjReader::from_vec(format!("{object}-history-{pool_index}").into_bytes());
+            pool.put_object(
+                bucket,
+                object,
+                &mut history_reader,
+                &ObjectOptions {
+                    versioned: true,
+                    version_id: Some(Uuid::new_v4().to_string()),
+                    mod_time: Some(OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(1)),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("history should be stored");
+            let mut trigger_reader = PutObjReader::from_vec(format!("{object}-trigger-{pool_index}").into_bytes());
+            pool.put_object(
+                bucket,
+                object,
+                &mut trigger_reader,
+                &ObjectOptions {
+                    versioned: true,
+                    version_id: Some(trigger_id.to_string()),
+                    mod_time: Some(OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(2)),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("shared trigger should be stored");
+        }
+        let mut opts = ObjectOptions {
+            delete_prefix: true,
+            delete_prefix_object: true,
+            versioned: true,
+            lifecycle_delete_all: Some(crate::object_api::LifecycleDeleteAllRequest {
+                version_id: Some(trigger_id),
+                delete_marker: false,
+                action: rustfs_common::metrics::IlmAction::DeleteAllVersionsAction,
+                rule_id: "rule".to_string(),
+                phase: crate::object_api::LifecycleDeleteAllPhase::Preflight,
+            }),
+            object_lock_config_snapshot: Some(Arc::new(ObjectLockConfigSnapshot::new(
+                crate::bucket::metadata_sys::ObjectLockConfigState::ConfirmedAbsent,
+            ))),
+            delete_replication_config_snapshot: Some(Arc::new(
+                crate::bucket::replication::DeleteReplicationConfigSnapshot::default(),
+            )),
+            ..Default::default()
+        };
+        opts.ensure_lifecycle_delete_all_journal();
+        opts
+    }
+
+    async fn ordinary_version_count(store: &ECStore, pool_index: usize, bucket: &str, object: &str) -> usize {
+        store.pools[pool_index].disk_set[0]
+            .load_file_info_versions_exact(bucket, object)
+            .await
+            .expect("pool metadata should load")
+            .map(|versions| {
+                versions
+                    .versions
+                    .iter()
+                    .filter(|version| !version.tier_free_version())
+                    .count()
+            })
+            .unwrap_or_default()
+    }
+
+    #[tokio::test]
+    async fn delete_prefix_attempts_later_pools_after_an_earlier_pool_error() {
+        let (_temp_dir, store, shutdown) = setup_multi_pool_test_store("delete-prefix", &[2, 4]).await;
        let bucket = format!("delete-prefix-{}", Uuid::new_v4().simple());
        store
            .make_bucket(&bucket, &MakeBucketOptions::default())
@@ -921,6 +1094,171 @@ mod tests {
        shutdown.cancel();
    }

+    #[tokio::test]
+    #[serial_test::serial]
+    async fn lifecycle_delete_all_history_failure_preserves_trigger_and_retry_converges() {
+        let (_temp_dir, store, shutdown) = setup_multi_pool_test_store("lifecycle-delete-all", &[4, 4]).await;
+        let bucket = format!("lifecycle-delete-all-{}", Uuid::new_v4().simple());
+        let object = "object";
+        store
+            .make_bucket(&bucket, &MakeBucketOptions::default())
+            .await
+            .expect("bucket should be created in both pools");
+
+        for pool_index in 0..2 {
+            let mut reader = PutObjReader::from_vec(format!("pool-{pool_index}-history").into_bytes());
+            store.pools[pool_index]
+                .put_object(
+                    &bucket,
+                    object,
+                    &mut reader,
+                    &ObjectOptions {
+                        versioned: true,
+                        ..Default::default()
+                    },
+                )
+                .await
+                .expect("historical version should be stored");
+        }
+        let marker = store.pools[0]
+            .delete_object(
+                &bucket,
+                object,
+                ObjectOptions {
+                    versioned: true,
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("trigger marker should be stored in the first pool");
+        let marker_id = marker.version_id.expect("trigger marker should have a version id");
+        let mut opts = ObjectOptions {
+            delete_prefix: true,
+            delete_prefix_object: true,
+            versioned: true,
+            lifecycle_delete_all: Some(crate::object_api::LifecycleDeleteAllRequest {
+                version_id: Some(marker_id),
+                delete_marker: true,
+                action: rustfs_common::metrics::IlmAction::DelMarkerDeleteAllVersionsAction,
+                rule_id: "rule".to_string(),
+                phase: crate::object_api::LifecycleDeleteAllPhase::Preflight,
+            }),
+            object_lock_config_snapshot: Some(Arc::new(ObjectLockConfigSnapshot::new(
+                crate::bucket::metadata_sys::ObjectLockConfigState::ConfirmedAbsent,
+            ))),
+            delete_replication_config_snapshot: Some(Arc::new(
+                crate::bucket::replication::DeleteReplicationConfigSnapshot::default(),
+            )),
+            ..Default::default()
+        };
+        opts.ensure_lifecycle_delete_all_journal();
+
+        let _failure_guard = LifecycleDeleteAllFailureGuard;
+        *LIFECYCLE_DELETE_ALL_TEST_FAILURE
+            .lock()
+            .expect("lifecycle delete-all failure hook should not poison") =
+            Some((crate::object_api::LifecycleDeleteAllPhase::History, 1));
+        let err = store
+            .delete_prefix(&bucket, object, &opts)
+            .await
+            .expect_err("a later pool history failure must stop before trigger deletion");
+        assert_eq!(err, StorageError::PreconditionFailed);
+        assert!(
+            opts.lifecycle_delete_all_journal()
+                .expect("delete-all journal should be initialized")
+                .lock()
+                .mutation_started()
+        );
+
+        let first_pool = store.pools[0].disk_set[0]
+            .load_file_info_versions_exact(&bucket, object)
+            .await
+            .expect("first pool metadata should load")
+            .expect("the trigger should remain");
+        let first_pool_ordinary: Vec<&FileInfo> = first_pool
+            .versions
+            .iter()
+            .filter(|version| !version.tier_free_version())
+            .collect();
+        assert_eq!(first_pool_ordinary.len(), 1);
+        assert_eq!(first_pool_ordinary[0].version_id, Some(marker_id));
+        assert!(first_pool_ordinary[0].deleted);
+
+        *LIFECYCLE_DELETE_ALL_TEST_FAILURE
+            .lock()
+            .expect("lifecycle delete-all failure hook should not poison") = None;
+        store
+            .delete_prefix(&bucket, object, &opts)
+            .await
+            .expect("retry should delete remaining history and its trigger owner");
+        for pool in &store.pools {
+            assert!(
+                pool.disk_set[0]
+                    .load_file_info_versions_exact(&bucket, object)
+                    .await
+                    .expect("pool metadata should load after retry")
+                    .is_none(),
+                "all ordinary versions should be removed after retry"
+            );
+        }
+
+        shutdown.cancel();
+    }
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn lifecycle_delete_all_phase_failures_preserve_barriers_and_retry() {
+        let (_temp_dir, store, shutdown) = setup_multi_pool_test_store("lifecycle-delete-all-phases", &[4, 4]).await;
+        let bucket = format!("lifecycle-delete-all-phases-{}", Uuid::new_v4().simple());
+        store
+            .make_bucket(&bucket, &MakeBucketOptions::default())
+            .await
+            .expect("bucket should be created in both pools");
+        let _failure_guard = LifecycleDeleteAllFailureGuard;
+
+        for (object, phase, expected_counts, mutation_started) in [
+            ("preflight-failure", crate::object_api::LifecycleDeleteAllPhase::Preflight, [2, 2], false),
+            (
+                "final-preflight-failure",
+                crate::object_api::LifecycleDeleteAllPhase::FinalPreflight,
+                [1, 1],
+                true,
+            ),
+            ("trigger-failure", crate::object_api::LifecycleDeleteAllPhase::Trigger, [0, 1], true),
+        ] {
+            let opts = seed_multi_pool_delete_all(&store, &bucket, object).await;
+            *LIFECYCLE_DELETE_ALL_TEST_FAILURE
+                .lock()
+                .expect("lifecycle delete-all failure hook should not poison") = Some((phase, 1));
+            let err = store
+                .delete_prefix(&bucket, object, &opts)
+                .await
+                .expect_err("injected phase failure should stop the transaction");
+            assert_eq!(err, StorageError::PreconditionFailed);
+            assert_eq!(
+                opts.lifecycle_delete_all_journal()
+                    .expect("delete-all journal should be initialized")
+                    .lock()
+                    .mutation_started(),
+                mutation_started
+            );
+            assert_eq!(ordinary_version_count(&store, 0, &bucket, object).await, expected_counts[0]);
+            assert_eq!(ordinary_version_count(&store, 1, &bucket, object).await, expected_counts[1]);
+
+            *LIFECYCLE_DELETE_ALL_TEST_FAILURE
+                .lock()
+                .expect("lifecycle delete-all failure hook should not poison") = None;
+            store
+                .delete_prefix(&bucket, object, &opts)
+                .await
+                .expect("retry should converge after the injected failure is removed");
+            assert_eq!(ordinary_version_count(&store, 0, &bucket, object).await, 0);
+            assert_eq!(ordinary_version_count(&store, 1, &bucket, object).await, 0);
+        }
+
+        shutdown.cancel();
+    }
+
    fn assert_backend_layout_empty(info: &rustfs_madmin::BackendInfo) {
        assert!(info.standard_sc_parities.is_empty());
        assert!(info.standard_sc_data.is_empty());
@@ -759,7 +759,7 @@ impl HealChannelProcessor {

 #[cfg(test)]
 mod tests {
-    use super::super::{DiskStore, Endpoint};
+    use super::super::DiskStore;
    use super::*;
    use crate::heal::manager::HealConfig;
    use crate::heal::storage::{HealObjectInfo, HealStorageAPI};
@@ -776,45 +776,18 @@ mod tests {
        async fn get_object_meta(&self, _bucket: &str, _object: &str) -> crate::Result<Option<HealObjectInfo>> {
            Ok(None)
        }
-        async fn get_object_data(&self, _bucket: &str, _object: &str) -> crate::Result<Option<Vec<u8>>> {
-            Ok(None)
-        }
-        async fn put_object_data(&self, _bucket: &str, _object: &str, _data: &[u8]) -> crate::Result<()> {
-            Ok(())
-        }
-        async fn delete_object(&self, _bucket: &str, _object: &str) -> crate::Result<()> {
-            Ok(())
-        }
-        async fn verify_object_integrity(&self, _bucket: &str, _object: &str) -> crate::Result<bool> {
-            Ok(true)
-        }
        async fn ec_decode_rebuild(&self, _bucket: &str, _object: &str) -> crate::Result<Vec<u8>> {
            Ok(vec![])
        }
-        async fn get_disk_status(&self, _endpoint: &Endpoint) -> crate::Result<crate::heal::storage::DiskStatus> {
-            Ok(crate::heal::storage::DiskStatus::Ok)
-        }
-        async fn format_disk(&self, _endpoint: &Endpoint) -> crate::Result<()> {
-            Ok(())
-        }
        async fn get_bucket_info(&self, _bucket: &str) -> crate::Result<Option<crate::heal::storage_api::status::BucketInfo>> {
            Ok(None)
        }
-        async fn heal_bucket_metadata(&self, _bucket: &str) -> crate::Result<()> {
-            Ok(())
-        }
        async fn list_buckets(&self) -> crate::Result<Vec<crate::heal::storage_api::status::BucketInfo>> {
            Ok(vec![])
        }
        async fn object_exists(&self, _bucket: &str, _object: &str) -> crate::Result<bool> {
            Ok(false)
        }
-        async fn get_object_size(&self, _bucket: &str, _object: &str) -> crate::Result<Option<u64>> {
-            Ok(None)
-        }
-        async fn get_object_checksum(&self, _bucket: &str, _object: &str) -> crate::Result<Option<String>> {
-            Ok(None)
-        }
        async fn heal_object(
            &self,
            _bucket: &str,
@@ -837,13 +810,6 @@ mod tests {
        ) -> crate::Result<(rustfs_madmin::heal_commands::HealResultItem, Option<crate::Error>)> {
            Ok((rustfs_madmin::heal_commands::HealResultItem::default(), None))
        }
-        async fn list_objects_for_heal(
-            &self,
-            _bucket: &str,
-            _prefix: &str,
-        ) -> crate::Result<Vec<crate::heal::storage::HealListItem>> {
-            Ok(vec![])
-        }
        async fn list_objects_for_heal_page(
            &self,
            _bucket: &str,
@@ -1267,7 +1267,7 @@ mod resume_loop_tests {
        CheckpointManager, RESUME_CHECKPOINT_FILE, ReplacementTargetIdentity, ResumeDeleteFailure, ResumeManager, ResumeUtils,
        compose_key,
    };
-    use crate::heal::storage::{DiskStatus, HealLifecycleExpiryContext, HealListItem, HealObjectInfo, HealStorageAPI};
+    use crate::heal::storage::{HealLifecycleExpiryContext, HealListItem, HealObjectInfo, HealStorageAPI};
    use crate::heal::storage_api::status::BucketInfo;
    use crate::heal::{
        BUCKET_META_PREFIX, DiskOption, DiskStore, EcstoreError, Endpoint, HealDiskExt as _, RUSTFS_META_BUCKET, new_disk,
@@ -1448,36 +1448,15 @@ mod resume_loop_tests {
        async fn get_object_meta(&self, _b: &str, _o: &str) -> Result<Option<HealObjectInfo>> {
            Ok(None)
        }
-        async fn get_object_data(&self, _b: &str, _o: &str) -> Result<Option<Vec<u8>>> {
-            Ok(None)
-        }
-        async fn put_object_data(&self, _b: &str, _o: &str, _d: &[u8]) -> Result<()> {
-            Ok(())
-        }
-        async fn delete_object(&self, _b: &str, _o: &str) -> Result<()> {
-            Ok(())
-        }
-        async fn verify_object_integrity(&self, _b: &str, _o: &str) -> Result<bool> {
-            Ok(true)
-        }
        async fn ec_decode_rebuild(&self, _b: &str, _o: &str) -> Result<Vec<u8>> {
            Ok(Vec::new())
        }
-        async fn get_disk_status(&self, _e: &Endpoint) -> Result<DiskStatus> {
-            Ok(DiskStatus::Ok)
-        }
-        async fn format_disk(&self, _e: &Endpoint) -> Result<()> {
-            Ok(())
-        }
        async fn get_bucket_info(&self, bucket: &str) -> Result<Option<BucketInfo>> {
            Ok(Some(BucketInfo {
                name: bucket.to_string(),
                ..Default::default()
            }))
        }
-        async fn heal_bucket_metadata(&self, _b: &str) -> Result<()> {
-            Ok(())
-        }
        async fn list_buckets(&self) -> Result<Vec<BucketInfo>> {
            Ok(Vec::new())
        }
@@ -1485,12 +1464,6 @@ mod resume_loop_tests {
            // Must never be consulted: the resume loop always goes through heal_object.
            panic!("object_exists must not be called by the resume heal loop");
        }
-        async fn get_object_size(&self, _b: &str, _o: &str) -> Result<Option<u64>> {
-            Ok(None)
-        }
-        async fn get_object_checksum(&self, _b: &str, _o: &str) -> Result<Option<String>> {
-            Ok(None)
-        }
        async fn load_heal_lifecycle_expiry_context(&self, _bucket: &str) -> Result<Option<HealLifecycleExpiryContext>> {
            Ok((!self.lifecycle_expired.lock().unwrap().is_empty()).then(HealLifecycleExpiryContext::test))
        }
@@ -1556,9 +1529,6 @@ mod resume_loop_tests {
                ReplacementCommitEvidence::Error(message) => Err(Error::other(message)),
            }
        }
-        async fn list_objects_for_heal(&self, _b: &str, _p: &str) -> Result<Vec<HealListItem>> {
-            Ok(Vec::new())
-        }
        async fn list_objects_for_heal_page(
            &self,
            _bucket: &str,
@@ -1,683 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::heal::{HealOptions, HealPriority, HealRequest, HealType};
-use crate::{Error, Result};
-use serde::{Deserialize, Serialize};
-use std::time::SystemTime;
-
-use super::Endpoint;
-
-/// Corruption type
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub enum CorruptionType {
-    /// Data corruption
-    DataCorruption,
-    /// Metadata corruption
-    MetadataCorruption,
-    /// Partial corruption
-    PartialCorruption,
-    /// Complete corruption
-    CompleteCorruption,
-}
-
-/// Severity level
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
-pub enum Severity {
-    /// Low severity
-    Low = 0,
-    /// Medium severity
-    Medium = 1,
-    /// High severity
-    High = 2,
-    /// Critical severity
-    Critical = 3,
-}
-
-/// Heal event
-#[derive(Debug, Clone)]
-pub enum HealEvent {
-    /// Object corruption event
-    ObjectCorruption {
-        bucket: String,
-        object: String,
-        version_id: Option<String>,
-        corruption_type: CorruptionType,
-        severity: Severity,
-    },
-    /// Object missing event
-    ObjectMissing {
-        bucket: String,
-        object: String,
-        version_id: Option<String>,
-        expected_locations: Vec<usize>,
-        available_locations: Vec<usize>,
-    },
-    /// Metadata corruption event
-    MetadataCorruption {
-        bucket: String,
-        object: String,
-        corruption_type: CorruptionType,
-    },
-    /// Disk status change event
-    DiskStatusChange {
-        endpoint: Endpoint,
-        old_status: String,
-        new_status: String,
-    },
-    /// EC decode failure event
-    ECDecodeFailure {
-        bucket: String,
-        object: String,
-        version_id: Option<String>,
-        missing_shards: Vec<usize>,
-        available_shards: Vec<usize>,
-    },
-    /// Checksum mismatch event
-    ChecksumMismatch {
-        bucket: String,
-        object: String,
-        version_id: Option<String>,
-        expected_checksum: String,
-        actual_checksum: String,
-    },
-    /// Bucket metadata corruption event
-    BucketMetadataCorruption {
-        bucket: String,
-        corruption_type: CorruptionType,
-    },
-    /// MRF metadata corruption event
-    MRFMetadataCorruption {
-        meta_path: String,
-        corruption_type: CorruptionType,
-    },
-}
-
-impl HealEvent {
-    /// Convert HealEvent to HealRequest
-    pub fn to_heal_request(&self) -> Result<HealRequest> {
-        match self {
-            HealEvent::ObjectCorruption {
-                bucket,
-                object,
-                version_id,
-                severity,
-                ..
-            } => Ok(HealRequest::new(
-                HealType::Object {
-                    bucket: bucket.clone(),
-                    object: object.clone(),
-                    version_id: version_id.clone(),
-                },
-                HealOptions::default(),
-                Self::severity_to_priority(severity),
-            )),
-            HealEvent::ObjectMissing {
-                bucket,
-                object,
-                version_id,
-                ..
-            } => Ok(HealRequest::new(
-                HealType::Object {
-                    bucket: bucket.clone(),
-                    object: object.clone(),
-                    version_id: version_id.clone(),
-                },
-                HealOptions::default(),
-                HealPriority::High,
-            )),
-            HealEvent::MetadataCorruption { bucket, object, .. } => Ok(HealRequest::new(
-                HealType::Metadata {
-                    bucket: bucket.clone(),
-                    object: object.clone(),
-                },
-                HealOptions::default(),
-                HealPriority::High,
-            )),
-            HealEvent::DiskStatusChange { endpoint, .. } => {
-                // Convert disk status change to erasure set heal
-                // Note: This requires access to storage to get bucket list, which is not available here
-                // The actual bucket list will need to be provided by the caller or retrieved differently
-                let set_disk_id = crate::heal::utils::format_set_disk_id_from_i32(endpoint.pool_idx, endpoint.set_idx)
-                    .ok_or_else(|| Error::InvalidHealType {
-                        heal_type: format!("erasure-set(pool={}, set={})", endpoint.pool_idx, endpoint.set_idx),
-                    })?;
-                Ok(HealRequest::new(
-                    HealType::ErasureSet {
-                        buckets: vec![], // Empty bucket list - caller should populate this
-                        set_disk_id,
-                    },
-                    HealOptions::default(),
-                    HealPriority::High,
-                ))
-            }
-            HealEvent::ECDecodeFailure {
-                bucket,
-                object,
-                version_id,
-                ..
-            } => Ok(HealRequest::new(
-                HealType::ECDecode {
-                    bucket: bucket.clone(),
-                    object: object.clone(),
-                    version_id: version_id.clone(),
-                },
-                HealOptions::default(),
-                HealPriority::Urgent,
-            )),
-            HealEvent::ChecksumMismatch {
-                bucket,
-                object,
-                version_id,
-                ..
-            } => Ok(HealRequest::new(
-                HealType::Object {
-                    bucket: bucket.clone(),
-                    object: object.clone(),
-                    version_id: version_id.clone(),
-                },
-                HealOptions::default(),
-                HealPriority::High,
-            )),
-            HealEvent::BucketMetadataCorruption { bucket, .. } => Ok(HealRequest::new(
-                HealType::Bucket { bucket: bucket.clone() },
-                HealOptions::default(),
-                HealPriority::High,
-            )),
-            HealEvent::MRFMetadataCorruption { meta_path, .. } => Ok(HealRequest::new(
-                HealType::MRF {
-                    meta_path: meta_path.clone(),
-                },
-                HealOptions::default(),
-                HealPriority::High,
-            )),
-        }
-    }
-
-    /// Convert severity to priority
-    fn severity_to_priority(severity: &Severity) -> HealPriority {
-        match severity {
-            Severity::Low => HealPriority::Low,
-            Severity::Medium => HealPriority::Normal,
-            Severity::High => HealPriority::High,
-            Severity::Critical => HealPriority::Urgent,
-        }
-    }
-
-    /// Get event description
-    pub fn description(&self) -> String {
-        match self {
-            HealEvent::ObjectCorruption {
-                bucket,
-                object,
-                corruption_type,
-                ..
-            } => {
-                format!("Object corruption detected: {bucket}/{object} - {corruption_type:?}")
-            }
-            HealEvent::ObjectMissing { bucket, object, .. } => {
-                format!("Object missing: {bucket}/{object}")
-            }
-            HealEvent::MetadataCorruption {
-                bucket,
-                object,
-                corruption_type,
-                ..
-            } => {
-                format!("Metadata corruption: {bucket}/{object} - {corruption_type:?}")
-            }
-            HealEvent::DiskStatusChange {
-                endpoint,
-                old_status,
-                new_status,
-                ..
-            } => {
-                format!("Disk status changed: {endpoint:?} {old_status} -> {new_status}")
-            }
-            HealEvent::ECDecodeFailure {
-                bucket,
-                object,
-                missing_shards,
-                ..
-            } => {
-                format!("EC decode failure: {bucket}/{object} - missing shards: {missing_shards:?}")
-            }
-            HealEvent::ChecksumMismatch {
-                bucket,
-                object,
-                expected_checksum,
-                actual_checksum,
-                ..
-            } => {
-                format!("Checksum mismatch: {bucket}/{object} - expected: {expected_checksum}, actual: {actual_checksum}")
-            }
-            HealEvent::BucketMetadataCorruption {
-                bucket, corruption_type, ..
-            } => {
-                format!("Bucket metadata corruption: {bucket} - {corruption_type:?}")
-            }
-            HealEvent::MRFMetadataCorruption {
-                meta_path,
-                corruption_type,
-                ..
-            } => {
-                format!("MRF metadata corruption: {meta_path} - {corruption_type:?}")
-            }
-        }
-    }
-
-    /// Get event severity
-    pub fn severity(&self) -> Severity {
-        match self {
-            HealEvent::ObjectCorruption { severity, .. } => severity.clone(),
-            HealEvent::ObjectMissing { .. } => Severity::High,
-            HealEvent::MetadataCorruption { .. } => Severity::High,
-            HealEvent::DiskStatusChange { .. } => Severity::High,
-            HealEvent::ECDecodeFailure { .. } => Severity::Critical,
-            HealEvent::ChecksumMismatch { .. } => Severity::High,
-            HealEvent::BucketMetadataCorruption { .. } => Severity::High,
-            HealEvent::MRFMetadataCorruption { .. } => Severity::High,
-        }
-    }
-
-    /// Get event timestamp
-    pub fn timestamp(&self) -> SystemTime {
-        SystemTime::now()
-    }
-}
-
-/// Heal event handler
-pub struct HealEventHandler {
-    /// Event queue
-    events: Vec<HealEvent>,
-    /// Maximum number of events
-    max_events: usize,
-}
-
-impl HealEventHandler {
-    pub fn new(max_events: usize) -> Self {
-        Self {
-            events: Vec::new(),
-            max_events,
-        }
-    }
-
-    /// Add event
-    pub fn add_event(&mut self, event: HealEvent) {
-        if self.events.len() >= self.max_events {
-            // Remove oldest event
-            self.events.remove(0);
-        }
-        self.events.push(event);
-    }
-
-    /// Get all events
-    pub fn get_events(&self) -> &[HealEvent] {
-        &self.events
-    }
-
-    /// Clear events
-    pub fn clear_events(&mut self) {
-        self.events.clear();
-    }
-
-    /// Get event count
-    pub fn event_count(&self) -> usize {
-        self.events.len()
-    }
-
-    /// Filter events by severity
-    pub fn filter_by_severity(&self, min_severity: Severity) -> Vec<&HealEvent> {
-        self.events.iter().filter(|event| event.severity() >= min_severity).collect()
-    }
-
-    /// Filter events by type
-    pub fn filter_by_type(&self, event_type: &str) -> Vec<&HealEvent> {
-        self.events
-            .iter()
-            .filter(|event| match event {
-                HealEvent::ObjectCorruption { .. } => event_type == "ObjectCorruption",
-                HealEvent::ObjectMissing { .. } => event_type == "ObjectMissing",
-                HealEvent::MetadataCorruption { .. } => event_type == "MetadataCorruption",
-                HealEvent::DiskStatusChange { .. } => event_type == "DiskStatusChange",
-                HealEvent::ECDecodeFailure { .. } => event_type == "ECDecodeFailure",
-                HealEvent::ChecksumMismatch { .. } => event_type == "ChecksumMismatch",
-                HealEvent::BucketMetadataCorruption { .. } => event_type == "BucketMetadataCorruption",
-                HealEvent::MRFMetadataCorruption { .. } => event_type == "MRFMetadataCorruption",
-            })
-            .collect()
-    }
-}
-
-impl Default for HealEventHandler {
-    fn default() -> Self {
-        Self::new(1000)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::heal::task::{HealPriority, HealType};
-
-    #[test]
-    fn test_heal_event_object_corruption_to_request() {
-        let event = HealEvent::ObjectCorruption {
-            bucket: "test-bucket".to_string(),
-            object: "test-object".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::High,
-        };
-
-        let request = event.to_heal_request().unwrap();
-        assert!(matches!(request.heal_type, HealType::Object { .. }));
-        assert_eq!(request.priority, HealPriority::High);
-    }
-
-    #[test]
-    fn test_heal_event_object_missing_to_request() {
-        let event = HealEvent::ObjectMissing {
-            bucket: "test-bucket".to_string(),
-            object: "test-object".to_string(),
-            version_id: Some("v1".to_string()),
-            expected_locations: vec![0, 1],
-            available_locations: vec![2, 3],
-        };
-
-        let request = event.to_heal_request().unwrap();
-        assert!(matches!(request.heal_type, HealType::Object { .. }));
-        assert_eq!(request.priority, HealPriority::High);
-    }
-
-    #[test]
-    fn test_heal_event_metadata_corruption_to_request() {
-        let event = HealEvent::MetadataCorruption {
-            bucket: "test-bucket".to_string(),
-            object: "test-object".to_string(),
-            corruption_type: CorruptionType::MetadataCorruption,
-        };
-
-        let request = event.to_heal_request().unwrap();
-        assert!(matches!(request.heal_type, HealType::Metadata { .. }));
-        assert_eq!(request.priority, HealPriority::High);
-    }
-
-    #[test]
-    fn test_heal_event_ec_decode_failure_to_request() {
-        let event = HealEvent::ECDecodeFailure {
-            bucket: "test-bucket".to_string(),
-            object: "test-object".to_string(),
-            version_id: None,
-            missing_shards: vec![0, 1],
-            available_shards: vec![2, 3, 4],
-        };
-
-        let request = event.to_heal_request().unwrap();
-        assert!(matches!(request.heal_type, HealType::ECDecode { .. }));
-        assert_eq!(request.priority, HealPriority::Urgent);
-    }
-
-    #[test]
-    fn test_heal_event_checksum_mismatch_to_request() {
-        let event = HealEvent::ChecksumMismatch {
-            bucket: "test-bucket".to_string(),
-            object: "test-object".to_string(),
-            version_id: None,
-            expected_checksum: "abc123".to_string(),
-            actual_checksum: "def456".to_string(),
-        };
-
-        let request = event.to_heal_request().unwrap();
-        assert!(matches!(request.heal_type, HealType::Object { .. }));
-        assert_eq!(request.priority, HealPriority::High);
-    }
-
-    #[test]
-    fn test_heal_event_bucket_metadata_corruption_to_request() {
-        let event = HealEvent::BucketMetadataCorruption {
-            bucket: "test-bucket".to_string(),
-            corruption_type: CorruptionType::MetadataCorruption,
-        };
-
-        let request = event.to_heal_request().unwrap();
-        assert!(matches!(request.heal_type, HealType::Bucket { .. }));
-        assert_eq!(request.priority, HealPriority::High);
-    }
-
-    #[test]
-    fn test_heal_event_mrf_metadata_corruption_to_request() {
-        let event = HealEvent::MRFMetadataCorruption {
-            meta_path: "test-bucket/test-object".to_string(),
-            corruption_type: CorruptionType::MetadataCorruption,
-        };
-
-        let request = event.to_heal_request().unwrap();
-        assert!(matches!(request.heal_type, HealType::MRF { .. }));
-        assert_eq!(request.priority, HealPriority::High);
-    }
-
-    #[test]
-    fn test_heal_event_severity_to_priority() {
-        let event_low = HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::Low,
-        };
-        let request = event_low.to_heal_request().unwrap();
-        assert_eq!(request.priority, HealPriority::Low);
-
-        let event_medium = HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::Medium,
-        };
-        let request = event_medium.to_heal_request().unwrap();
-        assert_eq!(request.priority, HealPriority::Normal);
-
-        let event_high = HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::High,
-        };
-        let request = event_high.to_heal_request().unwrap();
-        assert_eq!(request.priority, HealPriority::High);
-
-        let event_critical = HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::Critical,
-        };
-        let request = event_critical.to_heal_request().unwrap();
-        assert_eq!(request.priority, HealPriority::Urgent);
-    }
-
-    #[test]
-    fn test_heal_event_description() {
-        let event = HealEvent::ObjectCorruption {
-            bucket: "test-bucket".to_string(),
-            object: "test-object".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::High,
-        };
-
-        let desc = event.description();
-        assert!(desc.contains("Object corruption detected"));
-        assert!(desc.contains("test-bucket/test-object"));
-        assert!(desc.contains("DataCorruption"));
-    }
-
-    #[test]
-    fn test_heal_event_severity() {
-        let event = HealEvent::ECDecodeFailure {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            missing_shards: vec![],
-            available_shards: vec![],
-        };
-        assert_eq!(event.severity(), Severity::Critical);
-
-        let event = HealEvent::ObjectMissing {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            expected_locations: vec![],
-            available_locations: vec![],
-        };
-        assert_eq!(event.severity(), Severity::High);
-    }
-
-    #[test]
-    fn test_heal_event_handler_new() {
-        let handler = HealEventHandler::new(10);
-        assert_eq!(handler.event_count(), 0);
-        assert_eq!(handler.max_events, 10);
-    }
-
-    #[test]
-    fn test_heal_event_handler_default() {
-        let handler = HealEventHandler::default();
-        assert_eq!(handler.max_events, 1000);
-    }
-
-    #[test]
-    fn test_heal_event_handler_add_event() {
-        let mut handler = HealEventHandler::new(3);
-        let event = HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::High,
-        };
-
-        handler.add_event(event.clone());
-        assert_eq!(handler.event_count(), 1);
-
-        handler.add_event(event.clone());
-        handler.add_event(event);
-        assert_eq!(handler.event_count(), 3);
-    }
-
-    #[test]
-    fn test_heal_event_handler_max_events() {
-        let mut handler = HealEventHandler::new(2);
-        let event = HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::High,
-        };
-
-        handler.add_event(event.clone());
-        handler.add_event(event.clone());
-        handler.add_event(event); // Should remove oldest
-
-        assert_eq!(handler.event_count(), 2);
-    }
-
-    #[test]
-    fn test_heal_event_handler_get_events() {
-        let mut handler = HealEventHandler::new(10);
-        let event = HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::High,
-        };
-
-        handler.add_event(event.clone());
-        handler.add_event(event);
-
-        let events = handler.get_events();
-        assert_eq!(events.len(), 2);
-    }
-
-    #[test]
-    fn test_heal_event_handler_clear_events() {
-        let mut handler = HealEventHandler::new(10);
-        let event = HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::High,
-        };
-
-        handler.add_event(event);
-        assert_eq!(handler.event_count(), 1);
-
-        handler.clear_events();
-        assert_eq!(handler.event_count(), 0);
-    }
-
-    #[test]
-    fn test_heal_event_handler_filter_by_severity() {
-        let mut handler = HealEventHandler::new(10);
-        handler.add_event(HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::Low,
-        });
-        handler.add_event(HealEvent::ECDecodeFailure {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            missing_shards: vec![],
-            available_shards: vec![],
-        });
-
-        let high_severity = handler.filter_by_severity(Severity::High);
-        assert_eq!(high_severity.len(), 1); // Only ECDecodeFailure is Critical >= High
-    }
-
-    #[test]
-    fn test_heal_event_handler_filter_by_type() {
-        let mut handler = HealEventHandler::new(10);
-        handler.add_event(HealEvent::ObjectCorruption {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            corruption_type: CorruptionType::DataCorruption,
-            severity: Severity::High,
-        });
-        handler.add_event(HealEvent::ObjectMissing {
-            bucket: "test".to_string(),
-            object: "test".to_string(),
-            version_id: None,
-            expected_locations: vec![],
-            available_locations: vec![],
-        });
-
-        let corruption_events = handler.filter_by_type("ObjectCorruption");
-        assert_eq!(corruption_events.len(), 1);
-
-        let missing_events = handler.filter_by_type("ObjectMissing");
-        assert_eq!(missing_events.len(), 1);
-    }
-}
@@ -0,0 +1,562 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+/// The automatic disk scanner: replacement discovery and unformatted-disk enqueue.
+use super::*;
+
+impl HealManager {
+    /// Start background task to auto scan local disks and enqueue erasure set heal requests
+    pub(super) async fn start_auto_disk_scanner(&self) -> Result<()> {
+        let config = self.config.clone();
+        let heal_queue = self.heal_queue.clone();
+        let active_heals = self.active_heals.clone();
+        let task_aliases = self.task_aliases.clone();
+        let mrf_repair_notice_targets = self.mrf_repair_notice_targets.clone();
+        let storage = self.storage.clone();
+        let replacement_recovery_anchors = self.replacement_recovery_anchors.clone();
+        let replacement_recovery_blocked_sets = self.replacement_recovery_blocked_sets.clone();
+        let cancel_token = self.cancel_token.clone();
+        let notify = self.notify.clone();
+        let mut duration = {
+            let config = config.read().await;
+            config.heal_interval
+        };
+        if duration < Duration::from_secs(10) {
+            duration = Duration::from_secs(10);
+        }
+        info!(
+            target: "rustfs::heal::manager",
+            event = EVENT_HEAL_AUTO_SCAN_STATE,
+            component = LOG_COMPONENT_HEAL,
+            subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+            state = "started",
+            interval = ?duration,
+            "Heal auto disk scanner started"
+        );
+
+        tokio::spawn(async move {
+            let mut interval = interval(duration);
+
+            loop {
+                let mut candidate_count = 0usize;
+                let mut skipped_duplicate_count = 0usize;
+                let mut skipped_invalid_count = 0usize;
+                let mut enqueued_count = 0usize;
+                let mut not_enqueued_count = 0usize;
+                let mut dropped_count = 0usize;
+                let mut full_count = 0usize;
+                tokio::select! {
+                    _ = cancel_token.cancelled() => {
+                        info!(
+                            target: "rustfs::heal::manager",
+                            event = EVENT_HEAL_AUTO_SCAN_STATE,
+                            component = LOG_COMPONENT_HEAL,
+                            subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                            state = "shutdown",
+                            "Heal auto disk scanner stopped"
+                        );
+                        break;
+                    }
+                    _ = interval.tick() => {
+                        // Build list of endpoints that need healing
+                        let mut endpoints = HashMap::<String, Vec<Endpoint>>::new();
+                        let mut durable_recoveries = HashMap::<String, (String, Vec<Endpoint>, Vec<String>, String)>::new();
+                        let mut conflicted_recovery_sets = HashSet::<String>::new();
+                        let mut deferred_replacement_endpoints = HashSet::<String>::new();
+                        let local_disks = {
+                            let local_disk_map = local_disk_map_read().await;
+                            local_disk_map.values().flatten().cloned().collect::<Vec<_>>()
+                        };
+                        let local_endpoints = local_disks.iter().map(|disk| disk.endpoint()).collect::<Vec<_>>();
+                        let blocked_sets = replacement_recovery_blocked_sets
+                            .lock()
+                            .expect("replacement recovery blocked set lock poisoned")
+                            .clone();
+                        if !blocked_sets.is_empty() {
+                            let mut retry_succeeded = HashSet::new();
+                            let mut retry_failed = HashSet::new();
+                            for disk in &local_disks {
+                                let endpoint = disk.endpoint();
+                                let Some(set_disk_id) =
+                                    crate::heal::utils::format_set_disk_id_from_i32(endpoint.pool_idx, endpoint.set_idx)
+                                else {
+                                    continue;
+                                };
+                                if !blocked_sets.contains(&set_disk_id) {
+                                    continue;
+                                }
+                                match Self::validate_replacement_recovery_records(disk).await {
+                                    Ok(()) => {
+                                        retry_succeeded.insert(set_disk_id);
+                                    }
+                                    Err(error) => {
+                                        retry_failed.insert(set_disk_id.clone());
+                                        conflicted_recovery_sets.insert(set_disk_id);
+                                        warn!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_AUTO_SCAN_ENQUEUE,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                            endpoint = %endpoint,
+                                            error = %error,
+                                            "Replacement recovery retry failed"
+                                        );
+                                    }
+                                }
+                            }
+                            let mut blocked = replacement_recovery_blocked_sets
+                                .lock()
+                                .expect("replacement recovery blocked set lock poisoned");
+                            unblock_replacement_recovery_sets_after_validation(&mut blocked, retry_succeeded, &retry_failed);
+                        }
+                        for disk in &local_disks {
+                            let endpoint = disk.endpoint();
+                                let runtime_state = disk.runtime_state();
+                                let set_disk_id =
+                                    crate::heal::utils::format_set_disk_id_from_i32(endpoint.pool_idx, endpoint.set_idx);
+                            if set_disk_id.as_ref().is_some_and(|set_disk_id| {
+                                replacement_recovery_blocked_sets
+                                    .lock()
+                                    .expect("replacement recovery blocked set lock poisoned")
+                                    .contains(set_disk_id)
+                            }) {
+                                skipped_invalid_count += 1;
+                                debug!(
+                                    target: "rustfs::heal::manager",
+                                    event = EVENT_HEAL_AUTO_SCAN_DISK,
+                                    component = LOG_COMPONENT_HEAL,
+                                    subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                    endpoint = %endpoint,
+                                    set_disk_id = set_disk_id.as_deref().unwrap_or_default(),
+                                    disk_state = "replacement_recovery_blocked",
+                                    "Heal auto-scan replacement deferred because durable recovery is blocked"
+                                );
+                                continue;
+                            }
+
+                            // detect unformatted disk via get_disk_id()
+                            match disk.get_disk_id().await {
+                                Err(DiskError::UnformattedDisk) => {
+                                    if !super::super::replacement_readiness::auto_replacement_target_ready(disk, &local_disks)
+                                        .await
+                                    {
+                                        deferred_replacement_endpoints.insert(endpoint.to_string());
+                                        skipped_invalid_count += 1;
+                                        debug!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_AUTO_SCAN_DISK,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                            endpoint = %endpoint,
+                                            disk_state = "replacement_path_unavailable",
+                                            "Heal auto-scan replacement deferred"
+                                        );
+                                        continue;
+                                    }
+                                    let Some(set_disk_id) = set_disk_id else {
+                                        skipped_invalid_count += 1;
+                                        continue;
+                                    };
+                                    candidate_count += 1;
+                                    debug!(
+                                        target: "rustfs::heal::manager",
+                                        event = EVENT_HEAL_AUTO_SCAN_DISK,
+                                        component = LOG_COMPONENT_HEAL,
+                                        subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                        endpoint = %endpoint,
+                                        disk_state = "unformatted",
+                                        "Heal auto-scan candidate detected"
+                                    );
+                                    endpoints.entry(set_disk_id).or_default().push(endpoint);
+                                }
+                                Err(e) => {
+                                    warn!(
+                                        target: "rustfs::heal::manager",
+                                        event = EVENT_HEAL_AUTO_SCAN_DISK,
+                                        component = LOG_COMPONENT_HEAL,
+                                        subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                        endpoint = %endpoint,
+                                        disk_state = "check_failed",
+                                        error = ?e,
+                                        "Heal auto-scan disk inspection failed"
+                                    );
+                                }
+                                Ok(_) => {
+                                    if runtime_state.as_str() == "returning" && let Some(set_disk_id) = set_disk_id {
+                                        candidate_count += 1;
+                                        debug!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_AUTO_SCAN_DISK,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                            endpoint = %endpoint,
+                                            set_disk_id,
+                                            disk_state = "returning",
+                                            "Heal auto-scan returning disk candidate detected"
+                                        );
+                                        endpoints.entry(set_disk_id).or_default().push(endpoint);
+                                    }
+                                }
+                            }
+                        }
+
+                        // Once formatting succeeds a replacement is no longer
+                        // discoverable as UnformattedDisk. Re-admit exactly one
+                        // incomplete durable generation per set after bounded
+                        // scheduler retries are exhausted, or re-admit its
+                        // verified terminal cleanup. Multiple generations are a
+                        // durable conflict: leave every marker/state intact and
+                        // require reconciliation rather than choosing one.
+                        for disk in &local_disks {
+                            let endpoint = disk.endpoint();
+                            let disk_set_disk_id =
+                                crate::heal::utils::format_set_disk_id_from_i32(endpoint.pool_idx, endpoint.set_idx);
+                            let replacement_task_ids = match ResumeUtils::get_replacement_intent_tasks(disk).await {
+                                Ok(task_ids) => task_ids,
+                                Err(error) => {
+                                    let endpoint_string = endpoint.to_string();
+                                    if replacement_discovery_error_is_expected_for_deferred_endpoint(
+                                        &error,
+                                        &endpoint_string,
+                                        &deferred_replacement_endpoints,
+                                    ) {
+                                        debug!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_AUTO_SCAN_ENQUEUE,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                            endpoint = %endpoint,
+                                            disk_state = "replacement_path_unavailable",
+                                            result = "recovery_records_unavailable",
+                                            "Replacement recovery discovery skipped for deferred replacement"
+                                        );
+                                        continue;
+                                    }
+                                    if let Some(set_disk_id) = &disk_set_disk_id {
+                                        conflicted_recovery_sets.insert(set_disk_id.clone());
+                                    }
+                                    warn!(
+                                        target: "rustfs::heal::manager",
+                                        event = EVENT_HEAL_AUTO_SCAN_ENQUEUE,
+                                        component = LOG_COMPONENT_HEAL,
+                                        subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                        endpoint = %endpoint,
+                                        error = %error,
+                                        "Replacement recovery discovery failed"
+                                    );
+                                    continue;
+                                }
+                            };
+                            for task_id in replacement_task_ids {
+                                let resume_manager = match ResumeManager::load_replacement_intent(disk.clone(), &task_id).await {
+                                    Ok(resume_manager) => resume_manager,
+                                    Err(error) => {
+                                        if let Some(set_disk_id) = &disk_set_disk_id {
+                                            conflicted_recovery_sets.insert(set_disk_id.clone());
+                                        }
+                                        warn!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_AUTO_SCAN_ENQUEUE,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                            endpoint = %endpoint,
+                                            task_id,
+                                            error = %error,
+                                            "Replacement recovery intent load failed"
+                                        );
+                                        continue;
+                                    }
+                                };
+                                let state = resume_manager.get_state().await;
+                                if !durable_replacement_recovery_is_due(&state, &task_id) {
+                                    continue;
+                                }
+                                if !matches!(state.replacement_phase, ReplacementPhase::CleanupPending) {
+                                    let Ok(identities) = storage.replacement_target_identities(&state.replacement_targets).await else {
+                                        continue;
+                                    };
+                                    if identities != state.replacement_target_identities {
+                                        continue;
+                                    }
+                                }
+                                let targets = state
+                                    .replacement_targets
+                                    .iter()
+                                    .filter_map(|target| {
+                                        local_endpoints
+                                            .iter()
+                                            .find(|endpoint| endpoint.to_string() == *target)
+                                            .cloned()
+                                    })
+                                    .collect::<Vec<_>>();
+                                if targets.len() != state.replacement_targets.len() {
+                                    continue;
+                                }
+                                let Some(set_disk_id) = crate::heal::utils::format_set_disk_id_from_i32(
+                                    targets[0].pool_idx,
+                                    targets[0].set_idx,
+                                ) else {
+                                    continue;
+                                };
+                                if targets.iter().any(|target| {
+                                    crate::heal::utils::format_set_disk_id_from_i32(target.pool_idx, target.set_idx)
+                                        .as_deref()
+                                        != Some(set_disk_id.as_str())
+                                }) {
+                                    continue;
+                                }
+                                let resume_endpoint = disk.endpoint().to_string();
+                                match durable_recoveries.get(&set_disk_id) {
+                                    Some((existing_task_id, _, _, existing_anchor))
+                                        if existing_task_id != &task_id || existing_anchor != &resume_endpoint => {
+                                        replacement_recovery_blocked_sets
+                                            .lock()
+                                            .expect("replacement recovery blocked set lock poisoned")
+                                            .insert(set_disk_id.clone());
+                                        conflicted_recovery_sets.insert(set_disk_id);
+                                    }
+                                    Some(_) => {}
+                                    None => {
+                                        durable_recoveries.insert(
+                                            set_disk_id,
+                                            (task_id, targets, state.replacement_buckets, resume_endpoint),
+                                        );
+                                    }
+                                }
+                            }
+                        }
+
+                        for set_disk_id in &conflicted_recovery_sets {
+                            durable_recoveries.remove(set_disk_id);
+                            endpoints.remove(set_disk_id);
+                            warn!(
+                                target: "rustfs::heal::manager",
+                                event = EVENT_HEAL_AUTO_SCAN_ENQUEUE,
+                                component = LOG_COMPONENT_HEAL,
+                                subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                set_disk_id,
+                                result = "durable_generation_conflict",
+                                "Replacement recovery deferred because multiple durable generations exist"
+                            );
+                        }
+
+                        for (set_disk_id, (_, targets, _, _)) in &durable_recoveries {
+                            let expected = targets.iter().map(ToString::to_string).collect::<HashSet<_>>();
+                            let observed = endpoints
+                                .get(set_disk_id)
+                                .map(|endpoints| endpoints.iter().map(ToString::to_string).collect::<HashSet<_>>())
+                                .unwrap_or_default();
+                            if !observed.is_subset(&expected) {
+                                replacement_recovery_blocked_sets
+                                    .lock()
+                                    .expect("replacement recovery blocked set lock poisoned")
+                                    .insert(set_disk_id.clone());
+                                conflicted_recovery_sets.insert(set_disk_id.clone());
+                                continue;
+                            }
+                            endpoints.entry(set_disk_id.clone()).or_default().extend(targets.clone());
+                        }
+                        for set_disk_id in &conflicted_recovery_sets {
+                            durable_recoveries.remove(set_disk_id);
+                            endpoints.remove(set_disk_id);
+                        }
+
+                        for target_endpoints in endpoints.values_mut() {
+                            target_endpoints.sort_by_key(ToString::to_string);
+                            target_endpoints.dedup_by(|left, right| left.to_string() == right.to_string());
+                        }
+
+                        if endpoints.is_empty() {
+                            debug!(
+                                target: "rustfs::heal::manager",
+                                event = EVENT_HEAL_AUTO_SCAN_STATE,
+                                component = LOG_COMPONENT_HEAL,
+                                subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                state = "idle",
+                                "Heal auto disk scanner idle"
+                            );
+                            continue;
+                        }
+
+                        // Admit one set task with every ready replacement target. Queue deduplication is
+                        // set-scoped, so admitting endpoints independently would silently drop later targets.
+                        for (set_disk_id, endpoints) in endpoints {
+                            if replacement_recovery_blocked_sets
+                                .lock()
+                                .expect("replacement recovery blocked set lock poisoned")
+                                .contains(&set_disk_id)
+                            {
+                                skipped_invalid_count += 1;
+                                debug!(
+                                    target: "rustfs::heal::manager",
+                                    event = EVENT_HEAL_AUTO_SCAN_ENQUEUE,
+                                    component = LOG_COMPONENT_HEAL,
+                                    subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                    set_disk_id,
+                                    result = "replacement_recovery_blocked",
+                                    "Heal auto-scan replacement admission deferred because durable recovery is blocked"
+                                );
+                                continue;
+                            }
+                            // skip if already queued or healing
+                            // Use consistent lock order: queue first, then active_heals to avoid deadlock
+                            let mut skip = false;
+                            {
+                                let queue = heal_queue.lock().await;
+                                if queue.contains_erasure_set(&set_disk_id) {
+                                    skip = true;
+                                }
+                            }
+                            if !skip {
+                                let active = active_heals.lock().await;
+                                if active.values().any(|task| {
+                                    matches!(
+                                        &task.heal_type,
+                                        crate::heal::task::HealType::ErasureSet { set_disk_id: active_id, .. }
+                                        if active_id == &set_disk_id
+                                    )
+                                }) {
+                                    skip = true;
+                                }
+                            }
+
+                            if skip {
+                                skipped_duplicate_count += 1;
+                                debug!(
+                                    target: "rustfs::heal::manager",
+                                    event = EVENT_HEAL_AUTO_SCAN_ENQUEUE,
+                                    component = LOG_COMPONENT_HEAL,
+                                    subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                    endpoint_count = endpoints.len(),
+                                    set_disk_id,
+                                    result = "skipped_duplicate",
+                                    "Heal auto-scan duplicate skipped"
+                                );
+                                continue;
+                            }
+
+                            // enqueue erasure set heal request for all ready replacements in this set
+                            let recovery = durable_recoveries.remove(&set_disk_id);
+                            let mut req = HealRequest::new(
+                                HealType::ErasureSet {
+                                    buckets: recovery
+                                        .as_ref()
+                                        .map(|(_, _, buckets, _)| buckets.clone())
+                                        .unwrap_or_default(),
+                                    set_disk_id: set_disk_id.clone(),
+                                },
+                                HealOptions {
+                                    pool_index: endpoints
+                                        .first()
+                                        .and_then(|endpoint| usize::try_from(endpoint.pool_idx).ok()),
+                                    set_index: endpoints
+                                        .first()
+                                        .and_then(|endpoint| usize::try_from(endpoint.set_idx).ok()),
+                                    timeout: None,
+                                    ..HealOptions::default()
+                                },
+                                HealPriority::Low,
+                            );
+                            let recovery_anchor = recovery.as_ref().map(|(_, _, _, anchor)| anchor.clone());
+                            if let Some((task_id, _, _, _)) = recovery {
+                                req.id = task_id;
+                            }
+                            req.source = HealRequestSource::AutoHeal;
+                            req.heal_endpoints = endpoints.iter().map(ToString::to_string).collect();
+                            let request_id = req.id.clone();
+                            let endpoint_count = req.heal_endpoints.len();
+                            let config = config.read().await;
+                            let mut queue = heal_queue.lock().await;
+                            let admission_decision = Self::admit_request_to_queue(&mut queue, req, &config, "auto_scan");
+                            let admission = admission_decision.result;
+                            let should_notify =
+                                matches!(admission, HealAdmissionResult::Accepted) && config.event_driven_scheduler_enable;
+                            if matches!(admission, HealAdmissionResult::Accepted)
+                                && let Some(anchor) = recovery_anchor
+                            {
+                                replacement_recovery_anchors
+                                    .lock()
+                                    .unwrap_or_else(|poisoned| poisoned.into_inner())
+                                    .insert(request_id, anchor);
+                            }
+                            drop(queue);
+                            drop(config);
+                            if let Some(displaced_task_id) = admission_decision.displaced_task_id {
+                                remove_task_aliases_for_task(&task_aliases, &displaced_task_id).await;
+                                lock_mrf_repair_notice_targets(&mrf_repair_notice_targets).remove(&displaced_task_id);
+                            }
+                            if matches!(admission, HealAdmissionResult::Accepted) {
+                                if should_notify {
+                                    notify.notify_one();
+                                }
+                                enqueued_count += 1;
+                                debug!(
+                                    target: "rustfs::heal::manager",
+                                    event = EVENT_HEAL_AUTO_SCAN_ENQUEUE,
+                                    component = LOG_COMPONENT_HEAL,
+                                    subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                    endpoint_count,
+                                    set_disk_id,
+                                    bucket_count = 0,
+                                    result = "enqueued",
+                                    "Heal auto-scan task enqueued"
+                                );
+                            } else {
+                                if matches!(admission, HealAdmissionResult::Merged) {
+                                    skipped_duplicate_count += 1;
+                                } else {
+                                    not_enqueued_count += 1;
+                                }
+                                if matches!(admission, HealAdmissionResult::Full) {
+                                    full_count += 1;
+                                }
+                                if matches!(admission, HealAdmissionResult::Dropped(_)) {
+                                    dropped_count += 1;
+                                }
+                                debug!(
+                                    target: "rustfs::heal::manager",
+                                    event = EVENT_HEAL_AUTO_SCAN_ENQUEUE,
+                                    component = LOG_COMPONENT_HEAL,
+                                    subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                                    endpoint_count,
+                                    set_disk_id,
+                                    bucket_count = 0,
+                                    admission = admission.result_label(),
+                                    reason = admission.reason_label(),
+                                    result = "not_enqueued",
+                                    "Heal auto-scan task not enqueued"
+                                );
+                            }
+                        }
+                        info!(
+                            target: "rustfs::heal::manager",
+                            event = EVENT_HEAL_AUTO_SCAN_STATE,
+                            component = LOG_COMPONENT_HEAL,
+                            subsystem = LOG_SUBSYSTEM_DISK_SCANNER,
+                            state = "cycle_completed",
+                            candidate_count,
+                            enqueued_count,
+                            not_enqueued_count,
+                            dropped_count,
+                            full_count,
+                            skipped_duplicate_count,
+                            skipped_invalid_count,
+                            "Heal auto-scan cycle completed"
+                        );
+                    }
+                }
+            }
+        });
+        Ok(())
+    }
+}
@@ -0,0 +1,458 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+/// The priority heal queue and its per-key dedup index.
+use super::*;
+
+/// Per-key bookkeeping for the queued-request dedup index: how many queued
+/// requests hold the key, and the id of the first request that opened it —
+/// the O(1) stand-in for the former heap scan when a merge receipt needs to
+/// name a queued representative.
+#[derive(Debug)]
+pub(super) struct DedupKeyEntry {
+    pub(super) refcount: usize,
+    pub(super) representative_request_id: String,
+}
+
+/// Priority queue wrapper for heal requests
+/// Uses BinaryHeap for priority-based ordering while maintaining FIFO for same-priority items
+#[derive(Debug)]
+pub(super) struct PriorityHealQueue {
+    /// Heap of (priority, sequence, request) tuples
+    pub(super) heap: BinaryHeap<PriorityQueueItem>,
+    /// Sequence counter for FIFO ordering within same priority
+    pub(super) sequence: u64,
+    /// Deduplication index for queued requests
+    pub(super) dedup_keys: HashMap<String, DedupKeyEntry>,
+}
+
+/// Wrapper for heap items to implement proper ordering
+#[derive(Debug)]
+pub(super) struct PriorityQueueItem {
+    pub(super) priority: HealPriority,
+    pub(super) sequence: u64,
+    pub(super) dedup_key: String,
+    pub(super) request: HealRequest,
+}
+
+impl Eq for PriorityQueueItem {}
+
+impl PartialEq for PriorityQueueItem {
+    fn eq(&self, other: &Self) -> bool {
+        self.priority == other.priority && self.sequence == other.sequence
+    }
+}
+
+impl Ord for PriorityQueueItem {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        // First compare by priority (higher priority first)
+        match self.priority.cmp(&other.priority) {
+            std::cmp::Ordering::Equal => {
+                // If priorities are equal, use sequence for FIFO (lower sequence first)
+                other.sequence.cmp(&self.sequence)
+            }
+            ordering => ordering,
+        }
+    }
+}
+
+impl PartialOrd for PriorityQueueItem {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum QueuePushOutcome {
+    Accepted,
+    Merged,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) struct ForegroundPressure {
+    pub(super) class: WorkloadClass,
+    pub(super) usage_pct: usize,
+    pub(super) threshold_pct: usize,
+}
+
+impl ForegroundPressure {
+    pub(super) const fn reason(self) -> &'static str {
+        match self.class {
+            WorkloadClass::ForegroundRead => "foreground_read_pressure",
+            WorkloadClass::ForegroundWrite => "foreground_write_pressure",
+            _ => "foreground_pressure",
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(super) struct CompletedHealStatus {
+    pub(super) heal_type: HealType,
+    pub(super) status: HealTaskStatus,
+    pub(super) result_items_truncated: bool,
+    pub(super) completed_at: SystemTime,
+    /// Sequence-stamped retained window, archived with the completion so
+    /// incremental consumers keep their cursor across the transition (HS-06).
+    /// The un-stamped legacy view is derived from it on demand.
+    pub(super) seqed_items: Vec<(u64, HealResultItem)>,
+    pub(super) next_seq: u64,
+    pub(super) min_seq: u64,
+}
+
+#[derive(Debug, Clone)]
+pub(super) struct HealTaskAlias {
+    pub(super) task_id: String,
+}
+
+#[derive(Debug, Clone)]
+pub(super) struct RetryingHeal {
+    pub(super) request: HealRequest,
+    pub(super) error: String,
+    pub(super) cancel_token: CancellationToken,
+}
+
+impl PriorityHealQueue {
+    pub(super) fn new() -> Self {
+        Self {
+            heap: BinaryHeap::new(),
+            sequence: 0,
+            dedup_keys: HashMap::new(),
+        }
+    }
+
+    pub(super) fn len(&self) -> usize {
+        self.heap.len()
+    }
+
+    pub(super) fn pop_next(&mut self) -> Option<HealRequest> {
+        self.heap.pop().map(|item| {
+            Self::decrement_or_remove_dedup_key(&mut self.dedup_keys, &item.dedup_key);
+            item.request
+        })
+    }
+
+    pub(super) fn is_empty(&self) -> bool {
+        self.heap.is_empty()
+    }
+
+    pub(super) fn push(&mut self, request: HealRequest) -> QueuePushOutcome {
+        let key = Self::make_dedup_key(&request);
+
+        // Check for duplicates unless the caller explicitly forces admission.
+        if self.dedup_keys.contains_key(&key) && !request.force_start {
+            return QueuePushOutcome::Merged;
+        }
+        // Track dedup keys for both normal and forced requests so queued forced work
+        // also reserves the dedup key for later non-forced duplicates. The first
+        // request that opens the key becomes the named representative for merge
+        // receipts (taken before `request` moves into the heap).
+        self.dedup_keys
+            .entry(key.clone())
+            .or_insert_with(|| DedupKeyEntry {
+                refcount: 0,
+                representative_request_id: request.id.clone(),
+            })
+            .refcount += 1;
+        self.sequence += 1;
+        self.heap.push(PriorityQueueItem {
+            priority: request.priority,
+            sequence: self.sequence,
+            dedup_key: key,
+            request,
+        });
+        QueuePushOutcome::Accepted
+    }
+
+    pub(super) fn can_displace_lower_priority(&self, priority: HealPriority) -> bool {
+        self.heap.iter().any(|item| item.priority < priority)
+    }
+
+    pub(super) fn push_displacing_lower_priority(&mut self, request: HealRequest) -> Option<HealRequest> {
+        let mut retained = BinaryHeap::new();
+        let mut displaced: Option<PriorityQueueItem> = None;
+
+        while let Some(item) = self.heap.pop() {
+            if item.priority < request.priority {
+                let should_displace = displaced
+                    .as_ref()
+                    .map(|current| {
+                        item.priority < current.priority
+                            || (item.priority == current.priority && item.sequence > current.sequence)
+                    })
+                    .unwrap_or(true);
+                if should_displace {
+                    if let Some(current) = displaced.replace(item) {
+                        retained.push(current);
+                    }
+                } else {
+                    retained.push(item);
+                }
+            } else {
+                retained.push(item);
+            }
+        }
+
+        self.heap = retained;
+
+        let displaced = displaced.map(|item| {
+            Self::decrement_or_remove_dedup_key(&mut self.dedup_keys, &item.dedup_key);
+            self.refresh_dedup_representative(&item.dedup_key);
+            item.request
+        });
+
+        if displaced.is_some() {
+            // The enqueue side effect must run in ALL builds. Do NOT fold `self.push(request)`
+            // into `debug_assert_eq!` — in release builds (`debug_assertions` off) the whole
+            // macro, including its argument expression, is compiled out, which would silently
+            // drop the new high-priority request after having already evicted a queued item.
+            let outcome = self.push(request);
+            debug_assert_eq!(outcome, QueuePushOutcome::Accepted);
+        }
+
+        displaced
+    }
+
+    /// Get statistics about queue contents by priority
+    pub(super) fn get_priority_stats(&self) -> HashMap<HealPriority, usize> {
+        let mut stats = HashMap::new();
+        for item in &self.heap {
+            *stats.entry(item.priority).or_insert(0) += 1;
+        }
+        stats
+    }
+
+    pub(super) fn operation_counts(&self) -> (HealPriorityCounts, HealSourceCounts) {
+        let mut priority = HealPriorityCounts::default();
+        let mut source = HealSourceCounts::default();
+        for item in &self.heap {
+            priority.increment(item.request.priority);
+            source.increment(item.request.source);
+        }
+        (priority, source)
+    }
+
+    #[cfg(test)]
+    pub(super) fn pop(&mut self) -> Option<HealRequest> {
+        self.heap.pop().map(|item| {
+            Self::decrement_or_remove_dedup_key(&mut self.dedup_keys, &item.dedup_key);
+            item.request
+        })
+    }
+
+    pub(super) fn pop_runnable_with_skips<F, G>(&mut self, can_run: F, skip_label: G) -> (Option<HealRequest>, Vec<String>)
+    where
+        F: Fn(&HealRequest) -> bool,
+        G: Fn(&HealRequest) -> Option<String>,
+    {
+        let mut deferred = Vec::new();
+        let mut selected = None;
+        let mut skipped = Vec::new();
+
+        while let Some(item) = self.heap.pop() {
+            if can_run(&item.request) {
+                selected = Some(item);
+                break;
+            }
+            if let Some(label) = skip_label(&item.request) {
+                skipped.push(label);
+            }
+            deferred.push(item);
+        }
+
+        self.restore_deferred_items(deferred);
+
+        (
+            selected.map(|item| {
+                Self::decrement_or_remove_dedup_key(&mut self.dedup_keys, &item.dedup_key);
+                item.request
+            }),
+            skipped,
+        )
+    }
+
+    fn restore_deferred_items(&mut self, deferred: Vec<PriorityQueueItem>) {
+        if deferred.is_empty() {
+            return;
+        }
+
+        if deferred.len() > self.heap.len() / 2 {
+            let mut items = std::mem::take(&mut self.heap).into_vec();
+            items.reserve(deferred.len());
+            items.extend(deferred);
+            self.heap = BinaryHeap::from(items);
+        } else {
+            for item in deferred {
+                self.heap.push(item);
+            }
+        }
+    }
+
+    /// Create a deduplication key from a heal request
+    pub(super) fn make_dedup_key(request: &HealRequest) -> String {
+        Self::make_dedup_key_for_type(&request.heal_type)
+    }
+
+    pub(super) fn make_dedup_key_for_type(heal_type: &HealType) -> String {
+        match heal_type {
+            HealType::Cluster => "cluster".to_string(),
+            HealType::Object {
+                bucket,
+                object,
+                version_id,
+            } => {
+                format!("object:{}:{}:{}", bucket, object, version_id.as_deref().unwrap_or(""))
+            }
+            HealType::Bucket { bucket } => {
+                format!("bucket:{bucket}")
+            }
+            HealType::Prefix { bucket, prefix } => {
+                format!("prefix:{bucket}/{prefix}")
+            }
+            HealType::ErasureSet { set_disk_id, .. } => {
+                format!("erasure_set:{set_disk_id}")
+            }
+            HealType::Metadata { bucket, object } => {
+                format!("metadata:{bucket}:{object}")
+            }
+            HealType::ECDecode {
+                bucket,
+                object,
+                version_id,
+            } => {
+                format!("ecdecode:{}:{}:{}", bucket, object, version_id.as_deref().unwrap_or(""))
+            }
+        }
+    }
+
+    pub(super) fn decrement_or_remove_dedup_key(dedup_keys: &mut HashMap<String, DedupKeyEntry>, key: &str) {
+        if let Some(entry) = dedup_keys.get_mut(key) {
+            if entry.refcount <= 1 {
+                dedup_keys.remove(key);
+            } else {
+                entry.refcount -= 1;
+            }
+        }
+    }
+    /// Check if an erasure set heal request for a specific set_disk_id exists
+    pub(super) fn contains_erasure_set(&self, set_disk_id: &str) -> bool {
+        let key = format!("erasure_set:{set_disk_id}");
+        self.dedup_keys.contains_key(&key)
+    }
+
+    /// Iterate queued requests (used by the admin overlap check).
+    pub(super) fn requests(&self) -> impl Iterator<Item = &HealRequest> {
+        self.heap.iter().map(|item| &item.request)
+    }
+
+    pub(super) fn contains_request_id(&self, request_id: &str) -> bool {
+        self.heap.iter().any(|item| item.request.id == request_id)
+    }
+
+    pub(super) fn contains_request_id_matching_path(&self, request_id: &str, heal_path: &str) -> bool {
+        self.heap
+            .iter()
+            .any(|item| item.request.id == request_id && heal_type_matches_path(&item.request.heal_type, heal_path))
+    }
+
+    pub(super) fn queued_request_id_for_dedup_key(&self, key: &str) -> Option<&str> {
+        self.dedup_keys.get(key).map(|entry| entry.representative_request_id.as_str())
+    }
+
+    /// Re-elect the representative for `key` from the queue entries holding
+    /// it. Needed after a holder leaves the queue *without* becoming active
+    /// (canceled by id, or displaced): the former opener may be the request
+    /// that just left, and a merge receipt must never name an id that
+    /// resolves nowhere. The scheduler pop path does not need this — the
+    /// popped request surfaces in `active_heals` under the same id and the
+    /// duplicate pre-check consults active heals before the queue. No-op for
+    /// released keys; the survivor scan only runs when a key still has
+    /// holders, which under forced duplicates is the rare admin path.
+    pub(super) fn refresh_dedup_representative(&mut self, key: &str) {
+        if !self.dedup_keys.contains_key(key) {
+            return;
+        }
+        if let Some(id) = self
+            .heap
+            .iter()
+            .find(|item| item.dedup_key == key)
+            .map(|item| item.request.id.clone())
+            && let Some(entry) = self.dedup_keys.get_mut(key)
+        {
+            entry.representative_request_id = id;
+        }
+    }
+
+    pub(super) fn contains_matching<F>(&self, mut matches: F) -> bool
+    where
+        F: FnMut(&HealRequest) -> bool,
+    {
+        self.heap.iter().any(|item| matches(&item.request))
+    }
+
+    pub(super) fn remove_request_id(&mut self, request_id: &str) -> Option<HealRequest> {
+        let mut retained = BinaryHeap::new();
+        let mut removed = None;
+        let mut affected_key = None;
+
+        while let Some(item) = self.heap.pop() {
+            if removed.is_none() && item.request.id == request_id {
+                let key = item.dedup_key.clone();
+                Self::decrement_or_remove_dedup_key(&mut self.dedup_keys, &key);
+                affected_key = Some(key);
+                removed = Some(item.request);
+            } else {
+                retained.push(item);
+            }
+        }
+
+        self.heap = retained;
+        if let Some(key) = affected_key.as_deref() {
+            self.refresh_dedup_representative(key);
+        }
+        removed
+    }
+
+    pub(super) fn remove_matching<F>(&mut self, mut should_remove: F) -> Vec<HealRequest>
+    where
+        F: FnMut(&HealRequest) -> bool,
+    {
+        let mut retained = BinaryHeap::new();
+        let mut removed = Vec::new();
+        let mut affected_keys = Vec::new();
+
+        while let Some(item) = self.heap.pop() {
+            if should_remove(&item.request) {
+                Self::decrement_or_remove_dedup_key(&mut self.dedup_keys, &item.dedup_key);
+                affected_keys.push(item.dedup_key);
+                removed.push(item.request);
+            } else {
+                retained.push(item);
+            }
+        }
+
+        self.heap = retained;
+        for key in &affected_keys {
+            self.refresh_dedup_representative(key);
+        }
+        removed
+    }
+}
+
+impl RetryingHeal {
+    pub(super) fn status(&self) -> HealTaskStatus {
+        HealTaskStatus::Retrying {
+            error: self.error.clone(),
+            retry_attempt: self.request.retry_attempts,
+        }
+    }
+}
@@ -0,0 +1,686 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+/// The heal scheduler: queue consumption loop and its skip/metric helpers.
+use super::*;
+
+impl HealManager {
+    /// Start scheduler
+    pub(super) async fn start_scheduler(&self) -> Result<()> {
+        let config = self.config.clone();
+        let heal_queue = self.heal_queue.clone();
+        let active_heals = self.active_heals.clone();
+        let completed_heals = self.completed_heals.clone();
+        let task_aliases = self.task_aliases.clone();
+        let retrying_heals = self.retrying_heals.clone();
+        let mrf_repair_notice_targets = self.mrf_repair_notice_targets.clone();
+        let replacement_recovery_anchors = self.replacement_recovery_anchors.clone();
+        let cancel_token = self.cancel_token.clone();
+        let statistics = self.statistics.clone();
+        let storage = self.storage.clone();
+        let notify = self.notify.clone();
+        let workload_provider = self.workload_provider.clone();
+
+        tokio::spawn(async move {
+            let mut interval = interval(config.read().await.heal_interval);
+
+            loop {
+                let event_driven_scheduler_enable = config.read().await.event_driven_scheduler_enable;
+                tokio::select! {
+                    _ = cancel_token.cancelled() => {
+                        info!(
+                            target: "rustfs::heal::manager",
+                            event = EVENT_HEAL_SCHEDULER_STATE,
+                            component = LOG_COMPONENT_HEAL,
+                            subsystem = LOG_SUBSYSTEM_MANAGER,
+                            state = "shutdown",
+                            "Heal scheduler stopped"
+                        );
+                        break;
+                    }
+                    _ = notify.notified(), if event_driven_scheduler_enable => {
+                        Self::process_heal_queue(HealQueueContext {
+                            heal_queue: &heal_queue,
+                            active_heals: &active_heals,
+                            completed_heals: &completed_heals,
+                            task_aliases: &task_aliases,
+                            retrying_heals: &retrying_heals,
+                            mrf_repair_notice_targets: &mrf_repair_notice_targets,
+                            replacement_recovery_anchors: &replacement_recovery_anchors,
+                            config: &config,
+                            statistics: &statistics,
+                            storage: &storage,
+                            notify: &notify,
+                            cancel_token: &cancel_token,
+                            workload_provider: &workload_provider,
+                        })
+                        .await;
+                    }
+                    _ = interval.tick() => {
+                        Self::process_heal_queue(HealQueueContext {
+                            heal_queue: &heal_queue,
+                            active_heals: &active_heals,
+                            completed_heals: &completed_heals,
+                            task_aliases: &task_aliases,
+                            retrying_heals: &retrying_heals,
+                            mrf_repair_notice_targets: &mrf_repair_notice_targets,
+                            replacement_recovery_anchors: &replacement_recovery_anchors,
+                            config: &config,
+                            statistics: &statistics,
+                            storage: &storage,
+                            notify: &notify,
+                            cancel_token: &cancel_token,
+                            workload_provider: &workload_provider,
+                        })
+                        .await;
+                    }
+                }
+            }
+        });
+
+        Ok(())
+    }
+
+    /// Process heal queue
+    /// Processes multiple tasks per cycle when capacity allows and queue has high-priority items
+    pub(super) async fn process_heal_queue(context: HealQueueContext<'_>) {
+        let HealQueueContext {
+            heal_queue,
+            active_heals,
+            completed_heals,
+            task_aliases,
+            retrying_heals,
+            mrf_repair_notice_targets,
+            replacement_recovery_anchors,
+            config,
+            statistics,
+            storage,
+            notify,
+            cancel_token,
+            workload_provider,
+        } = context;
+
+        let config = config.read().await;
+        let mainline_pressure = Self::mainline_throttle_active(&config, workload_provider);
+        let mut active_heals_guard = active_heals.lock().await;
+        publish_active_heal_count(&active_heals_guard);
+
+        // Check if new heal tasks can be started
+        let active_count = active_heals_guard.len();
+        if active_count >= config.max_concurrent_heals {
+            return;
+        }
+
+        // Calculate how many tasks we can start this cycle
+        let available_slots = config.max_concurrent_heals - active_count;
+
+        let mut queue = heal_queue.lock().await;
+        let queue_len = queue.len();
+        publish_heal_queue_length(&queue);
+
+        if queue_len == 0 {
+            return;
+        }
+
+        let mut running_per_set = running_heal_set_counts(&active_heals_guard);
+        let mut tasks_started = 0usize;
+        let mut delayed_by_mainline_throttle = false;
+
+        for _ in 0..available_slots {
+            let selected_request = if config.set_bulkhead_enable || mainline_pressure.is_some() {
+                let max_concurrent_per_set = config.max_concurrent_per_set;
+                let (selected_request, skipped_sets) = queue.pop_runnable_with_skips(
+                    |request| {
+                        let set_allowed = !config.set_bulkhead_enable
+                            || can_schedule_request(request, &running_per_set, max_concurrent_per_set);
+                        let mainline_allowed = mainline_pressure.is_none() || Self::request_bypasses_mainline_throttle(request);
+                        set_allowed && mainline_allowed
+                    },
+                    |request| heal_request_set_key(request).map(|_| heal_request_set_metric_label(request)),
+                );
+                for skipped_set in skipped_sets {
+                    record_scheduler_skip(&skipped_set);
+                }
+                selected_request
+            } else {
+                queue.pop_next()
+            };
+
+            if let Some(mut request) = selected_request {
+                request.options.timeout.get_or_insert(config.task_timeout);
+                let task_priority = request.priority;
+                let task_type_label = heal_request_type_label(&request).to_string();
+                let task_set_label = heal_request_set_metric_label(&request);
+                if config.set_bulkhead_enable
+                    && let Some(set_key) = heal_request_set_key(&request)
+                {
+                    *running_per_set.entry(set_key).or_insert(0) += 1;
+                }
+                let replacement_resume_endpoint = replacement_recovery_anchors
+                    .lock()
+                    .unwrap_or_else(|poisoned| poisoned.into_inner())
+                    .get(&request.id)
+                    .cloned();
+                let task = Arc::new(HealTask::from_replacement_recovery_request(
+                    request,
+                    storage.clone(),
+                    replacement_resume_endpoint,
+                ));
+                let task_id = task.id.clone();
+                active_heals_guard.insert(task_id.clone(), task.clone());
+                publish_active_heal_count(&active_heals_guard);
+                update_task_running_metric_for_task(&active_heals_guard, task.as_ref());
+                let active_heals_clone = active_heals.clone();
+                let heal_queue_clone = heal_queue.clone();
+                let completed_heals_clone = completed_heals.clone();
+                let task_aliases_clone = task_aliases.clone();
+                let retrying_heals_clone = retrying_heals.clone();
+                let mrf_repair_notice_targets_clone = mrf_repair_notice_targets.clone();
+                let replacement_recovery_anchors_clone = replacement_recovery_anchors.clone();
+                let statistics_clone = statistics.clone();
+                let notify_clone = notify.clone();
+                let manager_cancel_token = cancel_token.clone();
+                let task_type_label_for_spawn = task_type_label.clone();
+                let task_set_label_for_spawn = task_set_label.clone();
+                let config_for_spawn = config.clone();
+
+                // start heal task
+                tokio::spawn(async move {
+                    debug!(
+                        target: "rustfs::heal::manager",
+                        event = EVENT_HEAL_SCHEDULER_STATE,
+                        component = LOG_COMPONENT_HEAL,
+                        subsystem = LOG_SUBSYSTEM_MANAGER,
+                        task_id,
+                        priority = ?task_priority,
+                        heal_type = %task_type_label_for_spawn,
+                        set = %task_set_label_for_spawn,
+                        state = "task_started",
+                        "Heal scheduler task started"
+                    );
+                    let result = task.execute().await;
+                    let retry_request = retry_request_for_result_with_budget(task.as_ref(), &result).await;
+                    match &result {
+                        Ok(_) => {
+                            debug!(
+                                target: "rustfs::heal::manager",
+                                event = EVENT_HEAL_SCHEDULER_STATE,
+                                component = LOG_COMPONENT_HEAL,
+                                subsystem = LOG_SUBSYSTEM_MANAGER,
+                                task_id,
+                                heal_type = %task_type_label_for_spawn,
+                                set = %task_set_label_for_spawn,
+                                state = "task_completed",
+                                "Heal scheduler task completed"
+                            );
+                        }
+                        Err(e) => {
+                            let will_retry = retry_request.is_some();
+                            if will_retry {
+                                demote_to_debug_when!(task.heal_type.is_per_object(), warn, target: "rustfs::heal::manager", {
+                                    event = EVENT_HEAL_SCHEDULER_STATE,
+                                    component = LOG_COMPONENT_HEAL,
+                                    subsystem = LOG_SUBSYSTEM_MANAGER,
+                                    task_id,
+                                    heal_type = %task_type_label_for_spawn,
+                                    set = %task_set_label_for_spawn,
+                                    state = "task_retrying",
+                                    retry_attempt = task.retry_attempts.saturating_add(1),
+                                    error = %e,
+                                    "Heal scheduler task retrying"
+                                });
+                            } else {
+                                error!(
+                                    target: "rustfs::heal::manager",
+                                    event = EVENT_HEAL_SCHEDULER_STATE,
+                                    component = LOG_COMPONENT_HEAL,
+                                    subsystem = LOG_SUBSYSTEM_MANAGER,
+                                    task_id,
+                                    heal_type = %task_type_label_for_spawn,
+                                    set = %task_set_label_for_spawn,
+                                    state = "task_failed",
+                                    error = %e,
+                                    "Heal scheduler task failed"
+                                );
+                            }
+                        }
+                    }
+                    let retry_request_for_status = retry_request.as_ref().map(|(request, _, error)| HealTaskStatus::Retrying {
+                        error: error.clone(),
+                        retry_attempt: request.retry_attempts,
+                    });
+                    let retry_request_for_queue = retry_request;
+                    let retry_cancel_token = retry_request_for_queue.as_ref().map(|_| CancellationToken::new());
+                    if retry_request_for_queue.is_none() {
+                        replacement_recovery_anchors_clone
+                            .lock()
+                            .unwrap_or_else(|poisoned| poisoned.into_inner())
+                            .remove(&task_id);
+                    }
+                    let mut active_heals_guard = active_heals_clone.lock().await;
+                    // Keep retry ownership continuous: status snapshots acquire
+                    // these locks in the same active -> retrying order.
+                    let mut retrying_heals_guard = if let (Some((request, _, error)), Some(cancel_token)) =
+                        (retry_request_for_queue.as_ref(), retry_cancel_token.as_ref())
+                    {
+                        let mut retrying = retrying_heals_clone.lock().await;
+                        if active_heals_guard.contains_key(&task_id) {
+                            retrying.insert(
+                                request.id.clone(),
+                                RetryingHeal {
+                                    request: request.clone(),
+                                    error: error.clone(),
+                                    cancel_token: cancel_token.clone(),
+                                },
+                            );
+                            #[cfg(test)]
+                            pause_retry_ownership_transition(&task_id, false).await;
+                        }
+                        Some(retrying)
+                    } else {
+                        None
+                    };
+                    let completed_task = active_heals_guard.remove(&task_id);
+                    if let Some(completed_task) = completed_task.as_ref() {
+                        publish_active_heal_count(&active_heals_guard);
+                        update_task_running_metric_for_task(&active_heals_guard, completed_task.as_ref());
+                    }
+                    let active_count = active_heals_guard.len();
+                    drop(retrying_heals_guard.take());
+                    drop(active_heals_guard);
+
+                    if let Some(completed_task) = completed_task {
+                        let completed_status = if let Some(status) = retry_request_for_status {
+                            status
+                        } else {
+                            completed_task.get_status().await
+                        };
+                        let terminal_completion = !matches!(completed_status, HealTaskStatus::Retrying { .. });
+                        let successful_completion = matches!(completed_status, HealTaskStatus::Completed);
+                        let completed_progress = completed_task.get_progress().await;
+                        // Single snapshot of the retained window: the task is
+                        // finished and already off the active map, so there is
+                        // no concurrent writer to race with.
+                        let seqed_items = completed_task.get_seqed_result_items().await;
+                        let (next_seq, min_seq) = completed_task.result_seq_cursors();
+                        let completed_status_entry = CompletedHealStatus {
+                            heal_type: completed_task.heal_type.clone(),
+                            status: completed_status.clone(),
+                            result_items_truncated: completed_task.result_items_truncated(),
+                            completed_at: SystemTime::now(),
+                            seqed_items,
+                            next_seq,
+                            min_seq,
+                        };
+                        let mut completed_heals_guard = completed_heals_clone.lock().await;
+                        prune_completed_heal_statuses(&mut completed_heals_guard);
+                        completed_heals_guard.insert(task_id.clone(), Arc::new(completed_status_entry));
+                        drop(completed_heals_guard);
+                        // update statistics
+                        let mut stats = statistics_clone.write().await;
+                        match completed_status {
+                            HealTaskStatus::Completed => {
+                                stats.update_task_completion(true);
+                                stats.add_healed_objects(completed_progress.objects_healed, completed_progress.bytes_processed);
+                            }
+                            HealTaskStatus::Retrying { .. } => {}
+                            _ => {
+                                stats.update_task_completion(false);
+                            }
+                        }
+                        stats.update_running_tasks(usize_to_u64_saturated(active_count));
+                        drop(stats);
+                        if terminal_completion {
+                            let notice_targets = take_mrf_repair_notice_targets(&mrf_repair_notice_targets_clone, &task_id);
+                            if successful_completion {
+                                emit_mrf_repaired_events(notice_targets);
+                            }
+                            task_aliases_clone
+                                .lock()
+                                .await
+                                .retain(|alias_id, alias| alias_id != &task_id && alias.task_id != task_id);
+                        }
+                    }
+
+                    if let (Some((retry_request, retry_delay, retry_error)), Some(retry_cancel_token)) =
+                        (retry_request_for_queue, retry_cancel_token)
+                    {
+                        let retry_request_id = retry_request.id.clone();
+                        let retry_attempt = retry_request.retry_attempts;
+                        let retry_key = PriorityHealQueue::make_dedup_key(&retry_request);
+                        let retry_priority = retry_request.priority;
+                        let retry_active_heals = active_heals_clone.clone();
+                        let retry_heal_queue = heal_queue_clone.clone();
+                        let retrying_heals_for_spawn = retrying_heals_clone.clone();
+                        let retry_task_aliases = task_aliases_clone.clone();
+                        let retry_mrf_repair_notice_targets = mrf_repair_notice_targets_clone.clone();
+                        let retry_completed_heals = completed_heals_clone.clone();
+                        let retry_notify = notify_clone.clone();
+                        let retry_manager_cancel_token = manager_cancel_token.clone();
+                        let retry_config = config_for_spawn.clone();
+                        tokio::spawn(async move {
+                            loop {
+                                tokio::select! {
+                                    _ = retry_cancel_token.cancelled() => {
+                                        debug!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_QUEUE_ADMISSION,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_MANAGER,
+                                            request_id = %retry_request_id,
+                                            priority = ?retry_priority,
+                                            retry_attempt,
+                                            result = "retry_cancelled",
+                                            "Heal retry admission decided"
+                                        );
+                                        return;
+                                    }
+                                    _ = retry_manager_cancel_token.cancelled() => {
+                                        retrying_heals_for_spawn.lock().await.remove(&retry_request_id);
+                                        return;
+                                    }
+                                    _ = sleep(retry_delay) => {}
+                                }
+
+                                {
+                                    let retrying_heals_guard = retrying_heals_for_spawn.lock().await;
+                                    if !retrying_heals_guard.contains_key(&retry_request_id) {
+                                        return;
+                                    }
+                                }
+
+                                let active_duplicate_task_id = {
+                                    let active_heals_guard = retry_active_heals.lock().await;
+                                    active_heal_for_dedup_key(&active_heals_guard, &retry_key).map(|(task_id, _)| task_id)
+                                };
+                                if let Some(active_duplicate_task_id) = active_duplicate_task_id {
+                                    retrying_heals_for_spawn.lock().await.remove(&retry_request_id);
+                                    move_mrf_repair_notice_targets(
+                                        &retry_mrf_repair_notice_targets,
+                                        &retry_request_id,
+                                        &active_duplicate_task_id,
+                                    );
+                                    debug!(
+                                        target: "rustfs::heal::manager",
+                                        event = EVENT_HEAL_QUEUE_ADMISSION,
+                                        component = LOG_COMPONENT_HEAL,
+                                        subsystem = LOG_SUBSYSTEM_MANAGER,
+                                        request_id = %retry_request_id,
+                                        priority = ?retry_priority,
+                                        retry_attempt,
+                                        result = "retry_merged_active_duplicate",
+                                        "Heal retry admission decided"
+                                    );
+                                    return;
+                                }
+
+                                let mut queue = retry_heal_queue.lock().await;
+                                let admission_decision =
+                                    Self::admit_request_to_queue(&mut queue, retry_request.clone(), &retry_config, "retry");
+                                let admission = admission_decision.result;
+                                let should_notify = matches!(admission, HealAdmissionResult::Accepted)
+                                    && retry_config.event_driven_scheduler_enable;
+                                match admission {
+                                    HealAdmissionResult::Accepted => {
+                                        // Transfer ownership while holding queue -> retrying,
+                                        // matching operations_snapshot's lock order.
+                                        #[cfg(test)]
+                                        pause_retry_ownership_transition(&retry_request_id, true).await;
+                                        retrying_heals_for_spawn.lock().await.remove(&retry_request_id);
+                                        let displaced_task_id = admission_decision.displaced_task_id;
+                                        drop(queue);
+                                        if let Some(displaced_task_id) = displaced_task_id {
+                                            remove_task_aliases_for_task(&retry_task_aliases, &displaced_task_id).await;
+                                            remove_mrf_repair_notice_targets(
+                                                &retry_mrf_repair_notice_targets,
+                                                &displaced_task_id,
+                                            );
+                                        }
+                                        retry_completed_heals.lock().await.remove(&retry_request_id);
+                                        debug!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_QUEUE_ADMISSION,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_MANAGER,
+                                            request_id = %retry_request_id,
+                                            priority = ?retry_priority,
+                                            retry_attempt,
+                                            retry_delay_ms = retry_delay.as_millis(),
+                                            error = %retry_error,
+                                            result = "retry_enqueued",
+                                            "Heal retry admission decided"
+                                        );
+                                        if should_notify {
+                                            retry_notify.notify_one();
+                                        }
+                                        return;
+                                    }
+                                    HealAdmissionResult::Merged => {
+                                        let merged_task_id =
+                                            queue.queued_request_id_for_dedup_key(&retry_key).map(ToOwned::to_owned);
+                                        retrying_heals_for_spawn.lock().await.remove(&retry_request_id);
+                                        drop(queue);
+                                        if let Some(merged_task_id) = merged_task_id {
+                                            move_mrf_repair_notice_targets(
+                                                &retry_mrf_repair_notice_targets,
+                                                &retry_request_id,
+                                                &merged_task_id,
+                                            );
+                                        }
+                                        debug!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_QUEUE_ADMISSION,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_MANAGER,
+                                            request_id = %retry_request_id,
+                                            priority = ?retry_priority,
+                                            retry_attempt,
+                                            result = "retry_merged_duplicate",
+                                            "Heal retry admission decided"
+                                        );
+                                        return;
+                                    }
+                                    HealAdmissionResult::Full => {
+                                        // admit_request_to_queue already logged the
+                                        // rejection (context = "retry"); this repeats
+                                        // every backoff cycle while the queue stays
+                                        // full, so keep it at debug!.
+                                        debug!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_QUEUE_ADMISSION,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_MANAGER,
+                                            request_id = %retry_request_id,
+                                            priority = ?retry_priority,
+                                            retry_attempt,
+                                            result = "retry_rejected_full",
+                                            "Heal retry admission decided"
+                                        );
+                                    }
+                                    HealAdmissionResult::Dropped(reason) => {
+                                        debug!(
+                                            target: "rustfs::heal::manager",
+                                            event = EVENT_HEAL_QUEUE_ADMISSION,
+                                            component = LOG_COMPONENT_HEAL,
+                                            subsystem = LOG_SUBSYSTEM_MANAGER,
+                                            request_id = %retry_request_id,
+                                            priority = ?retry_priority,
+                                            retry_attempt,
+                                            reason = reason.as_str(),
+                                            result = "retry_dropped",
+                                            "Heal retry admission decided"
+                                        );
+                                    }
+                                }
+                            }
+                        });
+                    }
+                    notify_clone.notify_one();
+                });
+                tasks_started += 1;
+            } else {
+                delayed_by_mainline_throttle = mainline_pressure.is_some();
+                break;
+            }
+        }
+
+        // Update statistics for all started tasks
+        let mut stats = statistics.write().await;
+        stats.total_tasks += tasks_started as u64;
+        stats.update_running_tasks(active_heals_guard.len() as u64);
+        publish_active_heal_count(&active_heals_guard);
+        publish_heal_queue_length(&queue);
+
+        if delayed_by_mainline_throttle && let Some(pressure) = mainline_pressure {
+            Self::record_mainline_throttle_delay(pressure, &config);
+            Self::schedule_mainline_throttle_recheck(notify.clone(), config.mainline_max_sleep);
+        }
+
+        // Log queue status if items remain
+        if !queue.is_empty() {
+            let remaining = queue.len();
+            if remaining > 10 {
+                info!(
+                    target: "rustfs::heal::manager",
+                    event = EVENT_HEAL_QUEUE_STATE,
+                    component = LOG_COMPONENT_HEAL,
+                    subsystem = LOG_SUBSYSTEM_MANAGER,
+                    queue_len = remaining,
+                    active_tasks = active_heals_guard.len(),
+                    state = "backlog_high",
+                    "Heal queue backlog high"
+                );
+            }
+        }
+    }
+}
+pub(super) fn heal_request_set_key(request: &HealRequest) -> Option<String> {
+    match &request.heal_type {
+        HealType::ErasureSet { set_disk_id, .. } => Some(set_disk_id.clone()),
+        HealType::Object { .. } => request.options.set_key(),
+        _ => None,
+    }
+}
+
+pub(super) fn heal_request_type_label(request: &HealRequest) -> &'static str {
+    request.heal_type.kind_label()
+}
+
+pub(super) fn heal_request_set_metric_label(request: &HealRequest) -> String {
+    heal_request_set_key(request).unwrap_or_else(|| request.options.set_metric_label())
+}
+
+pub(super) fn record_scheduler_skip(set_label: &str) {
+    counter!(
+        "rustfs_heal_scheduler_skip_total",
+        "reason" => "set_limit".to_string(),
+        "set" => set_label.to_string()
+    )
+    .increment(1);
+}
+
+pub(super) fn update_task_running_metric_for_task(active_heals: &HashMap<String, Arc<HealTask>>, task: &HealTask) {
+    let type_label = task.metric_type_label();
+    let set_label = task.metric_set_label();
+    let count = active_heals
+        .values()
+        .filter(|active_task| active_task.metric_type_label() == type_label && active_task.metric_set_label() == set_label)
+        .count();
+
+    gauge!(
+        "rustfs_heal_task_running",
+        "type" => type_label.to_string(),
+        "set" => set_label
+    )
+    .set(count as f64);
+}
+
+pub(super) fn running_heal_set_counts(active_heals: &HashMap<String, Arc<HealTask>>) -> HashMap<String, usize> {
+    let mut running = HashMap::new();
+    for task in active_heals.values() {
+        if let Some(set_key) = heal_request_set_key_for_task(task) {
+            *running.entry(set_key).or_insert(0) += 1;
+        }
+    }
+    running
+}
+
+fn remove_mrf_repair_notice_targets(registry: &Arc<StdMutex<HashMap<String, Vec<MrfRepairNoticeTarget>>>>, task_id: &str) {
+    lock_mrf_repair_notice_targets(registry).remove(task_id);
+}
+
+fn take_mrf_repair_notice_targets(
+    registry: &Arc<StdMutex<HashMap<String, Vec<MrfRepairNoticeTarget>>>>,
+    task_id: &str,
+) -> Vec<MrfRepairNoticeTarget> {
+    lock_mrf_repair_notice_targets(registry).remove(task_id).unwrap_or_default()
+}
+
+fn move_mrf_repair_notice_targets(
+    registry: &Arc<StdMutex<HashMap<String, Vec<MrfRepairNoticeTarget>>>>,
+    from_task_id: &str,
+    to_task_id: &str,
+) {
+    if from_task_id == to_task_id {
+        return;
+    }
+    let mut registry = lock_mrf_repair_notice_targets(registry);
+    let Some(moving) = registry.remove(from_task_id) else {
+        return;
+    };
+    let targets = registry.entry(to_task_id.to_string()).or_default();
+    for target in moving {
+        if !targets.contains(&target) {
+            targets.push(target);
+        }
+    }
+}
+
+fn emit_mrf_repaired_events(targets: Vec<MrfRepairNoticeTarget>) {
+    for target in targets {
+        rustfs_common::mrf_channel::note_mrf_repaired(&target.bucket, &target.object, target.version_id);
+    }
+}
+
+pub(super) fn heal_request_set_key_for_task(task: &HealTask) -> Option<String> {
+    match &task.heal_type {
+        HealType::ErasureSet { set_disk_id, .. } => Some(set_disk_id.clone()),
+        HealType::Object { .. } => task.options.set_key(),
+        _ => None,
+    }
+}
+
+pub(super) fn prune_completed_heal_statuses(completed_heals: &mut HashMap<String, Arc<CompletedHealStatus>>) {
+    let Ok(now) = SystemTime::now().duration_since(SystemTime::UNIX_EPOCH) else {
+        return;
+    };
+
+    completed_heals.retain(|_, completed| {
+        completed
+            .completed_at
+            .duration_since(SystemTime::UNIX_EPOCH)
+            .map(|completed_at| now.saturating_sub(completed_at) <= KEEP_HEAL_TASK_STATUS_DURATION)
+            .unwrap_or(false)
+    });
+}
+
+pub(super) fn can_schedule_request(
+    request: &HealRequest,
+    running_per_set: &HashMap<String, usize>,
+    max_concurrent_per_set: usize,
+) -> bool {
+    match heal_request_set_key(request) {
+        Some(set_key) => running_per_set.get(&set_key).copied().unwrap_or(0) < max_concurrent_per_set,
+        None => true,
+    }
+}
@@ -0,0 +1,390 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+/// Unclean-shutdown recovery: durable replacement-intent discovery and healing-marker rewrite.
+use super::*;
+
+pub(super) fn durable_replacement_recovery_is_due(state: &ResumeState, task_id: &str) -> bool {
+    state.replacement_generation.as_deref() == Some(task_id)
+        && !state.replacement_targets.is_empty()
+        && ((!state.completed
+            && matches!(state.replacement_phase, ReplacementPhase::Intent | ReplacementPhase::Rebuilding)
+            && state.retry_count >= state.max_retries)
+            || (state.completed
+                && matches!(state.replacement_phase, ReplacementPhase::Verified | ReplacementPhase::CleanupPending)))
+}
+
+pub(super) fn replacement_discovery_error_is_expected_for_deferred_endpoint(
+    error: &Error,
+    endpoint: &str,
+    deferred_replacement_endpoints: &HashSet<String>,
+) -> bool {
+    matches!(error, Error::Disk(DiskError::UnformattedDisk)) && deferred_replacement_endpoints.contains(endpoint)
+}
+
+pub(super) fn unblock_replacement_recovery_sets_after_validation(
+    blocked_sets: &mut HashSet<String>,
+    retry_succeeded: HashSet<String>,
+    retry_failed: &HashSet<String>,
+) {
+    for set_disk_id in retry_succeeded {
+        if !retry_failed.contains(&set_disk_id) {
+            blocked_sets.remove(&set_disk_id);
+        }
+    }
+}
+
+impl HealManager {
+    /// Detect whether the previous run ended without a clean shutdown and, if so,
+    /// enqueue a full erasure-set heal for every local set. Also (re)writes the
+    /// marker for the current run; [`super::super::clear_unclean_shutdown_markers`]
+    /// removes it again during graceful shutdown. Best-effort: failures only log.
+    pub(super) async fn process_unclean_shutdown(&self) {
+        let mut unclean = false;
+        let mut set_disk_ids = HashSet::new();
+        let mut replacement_intents = HashMap::<String, (String, Vec<String>, Vec<String>, String)>::new();
+        let mut replacement_restarts = HashMap::<String, (String, Vec<String>)>::new();
+        let mut conflicted_replacement_sets = HashSet::new();
+
+        {
+            let local_disks = {
+                let local_disk_map = local_disk_map_read().await;
+                local_disk_map.values().flatten().cloned().collect::<Vec<_>>()
+            };
+            for disk in &local_disks {
+                let endpoint = disk.endpoint();
+                match disk
+                    .read_all(super::super::RUSTFS_META_BUCKET, super::super::UNCLEAN_SHUTDOWN_MARKER_PATH)
+                    .await
+                {
+                    Ok(_) => unclean = true,
+                    Err(DiskError::FileNotFound) | Err(DiskError::VolumeNotFound) => {}
+                    Err(err) => {
+                        debug!(
+                            target: "rustfs::heal::manager",
+                            event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                            component = LOG_COMPONENT_HEAL,
+                            subsystem = LOG_SUBSYSTEM_MANAGER,
+                            endpoint = %endpoint,
+                            error = ?err,
+                            "Unclean-shutdown marker check failed"
+                        );
+                    }
+                }
+
+                let marker = SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .map(|d| d.as_secs().to_string())
+                    .unwrap_or_default();
+                if let Err(err) = disk
+                    .write_all(
+                        super::super::RUSTFS_META_BUCKET,
+                        super::super::UNCLEAN_SHUTDOWN_MARKER_PATH,
+                        marker.into(),
+                    )
+                    .await
+                {
+                    warn!(
+                        target: "rustfs::heal::manager",
+                        event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                        component = LOG_COMPONENT_HEAL,
+                        subsystem = LOG_SUBSYSTEM_MANAGER,
+                        endpoint = %endpoint,
+                        error = ?err,
+                        "Unclean-shutdown marker write failed"
+                    );
+                }
+
+                let disk_set_disk_id = crate::heal::utils::format_set_disk_id_from_i32(endpoint.pool_idx, endpoint.set_idx);
+                if let Some(set_disk_id) = &disk_set_disk_id {
+                    set_disk_ids.insert(set_disk_id.clone());
+                }
+
+                // Legacy flat records are inspected only while starting. The
+                // periodic scanner lists the dedicated replacement directory.
+                if let Err(error) = ResumeUtils::migrate_legacy_replacement_records(disk).await {
+                    if let Some(set_disk_id) = &disk_set_disk_id {
+                        self.block_replacement_recovery_set(set_disk_id);
+                    }
+                    warn!(
+                        target: "rustfs::heal::manager",
+                        event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                        component = LOG_COMPONENT_HEAL,
+                        subsystem = LOG_SUBSYSTEM_MANAGER,
+                        endpoint = %endpoint,
+                        error = %error,
+                        "Legacy replacement recovery migration failed"
+                    );
+                }
+                let replacement_task_ids = match ResumeUtils::get_replacement_intent_tasks(disk).await {
+                    Ok(task_ids) => task_ids,
+                    Err(error) => {
+                        if let Some(set_disk_id) = &disk_set_disk_id {
+                            self.block_replacement_recovery_set(set_disk_id);
+                        }
+                        warn!(
+                            target: "rustfs::heal::manager",
+                            event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                            component = LOG_COMPONENT_HEAL,
+                            subsystem = LOG_SUBSYSTEM_MANAGER,
+                            endpoint = %endpoint,
+                            error = %error,
+                            "Replacement recovery discovery failed"
+                        );
+                        continue;
+                    }
+                };
+                for task_id in replacement_task_ids {
+                    let manager = match ResumeManager::load_replacement_intent(disk.clone(), &task_id).await {
+                        Ok(manager) => manager,
+                        Err(error) => {
+                            if let Some(set_disk_id) = &disk_set_disk_id {
+                                self.block_replacement_recovery_set(set_disk_id);
+                            }
+                            warn!(
+                                target: "rustfs::heal::manager",
+                                event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                                component = LOG_COMPONENT_HEAL,
+                                subsystem = LOG_SUBSYSTEM_MANAGER,
+                                endpoint = %endpoint,
+                                task_id,
+                                error = %error,
+                                "Replacement recovery intent load failed"
+                            );
+                            continue;
+                        }
+                    };
+                    let state = manager.get_state().await;
+                    let active_replacement = !state.completed
+                        && matches!(state.replacement_phase, ReplacementPhase::Intent | ReplacementPhase::Rebuilding);
+                    let verified_replacement = state.completed
+                        && matches!(state.replacement_phase, ReplacementPhase::Verified | ReplacementPhase::CleanupPending);
+                    if (active_replacement || verified_replacement)
+                        && state.replacement_generation.as_deref() == Some(task_id.as_str())
+                        && !state.replacement_targets.is_empty()
+                    {
+                        if matches!(state.replacement_phase, ReplacementPhase::CleanupPending) {
+                            replacement_intents.entry(task_id).or_insert((
+                                state.set_disk_id,
+                                state.replacement_targets,
+                                state.replacement_buckets,
+                                endpoint.to_string(),
+                            ));
+                            continue;
+                        }
+                        match self.storage.replacement_target_identities(&state.replacement_targets).await {
+                            Ok(identities) if identities == state.replacement_target_identities => {
+                                let resume_endpoint = endpoint.to_string();
+                                match replacement_intents.entry(task_id) {
+                                    std::collections::hash_map::Entry::Vacant(entry) => {
+                                        entry.insert((
+                                            state.set_disk_id,
+                                            state.replacement_targets,
+                                            state.replacement_buckets,
+                                            resume_endpoint,
+                                        ));
+                                    }
+                                    std::collections::hash_map::Entry::Occupied(entry) => {
+                                        let (existing_set_disk_id, existing_targets, existing_buckets, existing_anchor) =
+                                            entry.get();
+                                        if existing_set_disk_id != &state.set_disk_id
+                                            || existing_targets != &state.replacement_targets
+                                            || existing_buckets != &state.replacement_buckets
+                                            || existing_anchor != &resume_endpoint
+                                        {
+                                            conflicted_replacement_sets.insert(state.set_disk_id.clone());
+                                            self.block_replacement_recovery_set(&state.set_disk_id);
+                                        }
+                                    }
+                                }
+                            }
+                            Ok(_) => {
+                                if manager.abandon_replacement_intent().await.is_ok() {
+                                    replacement_restarts
+                                        .entry(task_id)
+                                        .or_insert((state.set_disk_id, state.replacement_targets));
+                                }
+                            }
+                            Err(_) => {}
+                        }
+                    }
+                }
+            }
+        }
+
+        if !unclean && replacement_intents.is_empty() && replacement_restarts.is_empty() {
+            return;
+        }
+
+        let mut recovery_by_set = HashMap::<String, Vec<(Option<String>, Vec<String>, Vec<String>, Option<String>)>>::new();
+        for (task_id, (set_disk_id, heal_endpoints, buckets, resume_endpoint)) in replacement_intents {
+            recovery_by_set
+                .entry(set_disk_id)
+                .or_default()
+                .push((Some(task_id), heal_endpoints, buckets, Some(resume_endpoint)));
+        }
+        for (_abandoned_task_id, (set_disk_id, heal_endpoints)) in replacement_restarts {
+            recovery_by_set
+                .entry(set_disk_id)
+                .or_default()
+                .push((None, heal_endpoints, Vec::new(), None));
+        }
+
+        for (set_disk_id, mut recoveries) in recovery_by_set {
+            let Ok((pool_index, set_index)) = crate::heal::utils::parse_set_disk_id(&set_disk_id) else {
+                continue;
+            };
+            if self.replacement_recovery_set_is_blocked(&set_disk_id) {
+                debug!(
+                    target: "rustfs::heal::manager",
+                    event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                    component = LOG_COMPONENT_HEAL,
+                    subsystem = LOG_SUBSYSTEM_MANAGER,
+                    set_disk_id,
+                    recovery_count = recoveries.len(),
+                    "Replacement recovery deferred because durable recovery validation is blocked"
+                );
+                continue;
+            }
+            if conflicted_replacement_sets.contains(&set_disk_id) || recoveries.len() != 1 {
+                self.block_replacement_recovery_set(&set_disk_id);
+                debug!(
+                    target: "rustfs::heal::manager",
+                    event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                    component = LOG_COMPONENT_HEAL,
+                    subsystem = LOG_SUBSYSTEM_MANAGER,
+                    set_disk_id,
+                    recovery_count = recoveries.len(),
+                    "Replacement recovery deferred because multiple durable generations exist"
+                );
+                continue;
+            }
+            let reuse_single_generation = recoveries.len() == 1 && recoveries[0].0.is_some();
+            let mut heal_endpoints = recoveries
+                .iter_mut()
+                .flat_map(|(_, targets, _, _)| std::mem::take(targets))
+                .collect::<Vec<_>>();
+            heal_endpoints.sort_unstable();
+            heal_endpoints.dedup();
+            let buckets = if reuse_single_generation {
+                std::mem::take(&mut recoveries[0].2)
+            } else {
+                Vec::new()
+            };
+            let mut req = HealRequest::new(
+                HealType::ErasureSet {
+                    buckets,
+                    set_disk_id: set_disk_id.clone(),
+                },
+                HealOptions {
+                    pool_index: Some(pool_index),
+                    set_index: Some(set_index),
+                    timeout: None,
+                    ..HealOptions::default()
+                },
+                HealPriority::Low,
+            );
+            if reuse_single_generation && let Some(task_id) = recoveries[0].0.take() {
+                req.id = task_id;
+            }
+            let recovery_anchor = reuse_single_generation.then(|| recoveries[0].3.take()).flatten();
+            req.source = HealRequestSource::AutoHeal;
+            req.heal_endpoints = heal_endpoints;
+            let request_id = req.id.clone();
+            if let Some(anchor) = &recovery_anchor {
+                self.replacement_recovery_anchors
+                    .lock()
+                    .unwrap_or_else(|poisoned| poisoned.into_inner())
+                    .insert(request_id.clone(), anchor.clone());
+            }
+            match self.submit_heal_request(req).await {
+                Ok(HealAdmissionResult::Accepted) => {}
+                Ok(_) => {
+                    self.replacement_recovery_anchors
+                        .lock()
+                        .unwrap_or_else(|poisoned| poisoned.into_inner())
+                        .remove(&request_id);
+                }
+                Err(err) => {
+                    self.replacement_recovery_anchors
+                        .lock()
+                        .unwrap_or_else(|poisoned| poisoned.into_inner())
+                        .remove(&request_id);
+                    warn!(
+                        target: "rustfs::heal::manager",
+                        event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                        component = LOG_COMPONENT_HEAL,
+                        subsystem = LOG_SUBSYSTEM_MANAGER,
+                        set_disk_id,
+                        error = %err,
+                        "Replacement recovery enqueue failed"
+                    );
+                }
+            }
+        }
+
+        if !unclean || set_disk_ids.is_empty() {
+            return;
+        }
+
+        info!(
+            target: "rustfs::heal::manager",
+            event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+            component = LOG_COMPONENT_HEAL,
+            subsystem = LOG_SUBSYSTEM_MANAGER,
+            set_count = set_disk_ids.len(),
+            "Unclean shutdown detected; scheduling erasure-set heal for local sets"
+        );
+
+        let buckets = match self.storage.list_buckets().await {
+            Ok(buckets) => buckets.iter().map(|b| b.name.clone()).collect::<Vec<String>>(),
+            Err(err) => {
+                error!(
+                    target: "rustfs::heal::manager",
+                    event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                    component = LOG_COMPONENT_HEAL,
+                    subsystem = LOG_SUBSYSTEM_MANAGER,
+                    error = %err,
+                    "Unclean-shutdown heal skipped: bucket listing failed"
+                );
+                return;
+            }
+        };
+
+        for set_disk_id in set_disk_ids {
+            let mut req = HealRequest::new(
+                HealType::ErasureSet {
+                    buckets: buckets.clone(),
+                    set_disk_id: set_disk_id.clone(),
+                },
+                HealOptions {
+                    timeout: None,
+                    ..HealOptions::default()
+                },
+                HealPriority::Low,
+            );
+            req.source = HealRequestSource::AutoHeal;
+            if let Err(err) = self.submit_heal_request(req).await {
+                warn!(
+                    target: "rustfs::heal::manager",
+                    event = EVENT_HEAL_UNCLEAN_SHUTDOWN,
+                    component = LOG_COMPONENT_HEAL,
+                    subsystem = LOG_SUBSYSTEM_MANAGER,
+                    set_disk_id,
+                    error = %err,
+                    "Unclean-shutdown heal enqueue failed"
+                );
+            }
+        }
+    }
+}
@@ -14,7 +14,6 @@

 pub mod channel;
 pub mod erasure_healer;
-pub mod event;
 pub mod manager;
 pub mod mrf_queue;
 pub mod progress;
@@ -25,9 +25,12 @@
 //! set, rewritten on a group-commit cadence (every flush interval or flush
 //! threshold new intents). A rewrite is atomic at the record level only — a
 //! torn tail simply truncates during replay because every record carries its
-//! own CRC32. Losing the last flush window (≤500 ms) is acceptable: replayed
-//! duplicates are merged by the manager's dedup key, and read-repair remains
-//! the safety net.
+//! own CRC32. Losing the last flush window (≤500 ms) is acceptable because
+//! every producer keeps its own safety net: read-repair re-detects on the
+//! next failing read, and the scanner's corrupt-metadata branch leaves a
+//! pending-ledger entry behind even when its MRF intent is accepted
+//! (backlog#1894 axis A), so a lost intent is retried by the ledger rather
+//! than waiting for the failed-object TTL to re-scan the path.

 use super::{DiskStore, HealDiskExt as _, local_disk_map_read};
 use crate::heal::manager::HealManager;
@@ -276,20 +279,26 @@ async fn read_journal() -> Option<Vec<u8>> {
    None
 }

-async fn write_journal(data: &[u8]) {
+/// Write the snapshot to every local disk; returns true when at least one
+/// disk accepted it, so a total write failure keeps the runtime dirty and
+/// the next tick retries the persist.
+async fn write_journal(data: &[u8]) -> bool {
    let payload = bytes::Bytes::copy_from_slice(data);
+    let mut any_persisted = false;
    for disk in journal_disks().await {
-        if let Err(err) = disk
+        match disk
            .write_all(super::RUSTFS_META_BUCKET, MRF_JOURNAL_PATH, payload.clone())
            .await
        {
-            warn_mrf_journal_write(&err);
+            Ok(()) => any_persisted = true,
+            Err(err) => warn_mrf_journal_write(&err),
        }
    }
    if !data.is_empty() {
        counter!("rustfs_heal_mrf_journal_fsync_total").increment(1);
    }
    gauge!("rustfs_heal_mrf_journal_bytes").set(data.len() as f64);
+    any_persisted
 }

 async fn delete_journal() {
@@ -347,10 +356,28 @@ pub(crate) fn build_heal_request(intent: &MrfIntent) -> HealRequest {
    request
 }

+async fn submit_mrf_heal_request(manager: &HealManager, intent: &MrfIntent) -> crate::Result<HealAdmissionResult> {
+    let receipt = manager
+        .submit_mrf_heal_request_with_receipt(
+            build_heal_request(intent),
+            intent.bucket.clone(),
+            intent.object.clone(),
+            intent.version_id,
+        )
+        .await?;
+    Ok(receipt.result)
+}
+
 struct MrfRuntime {
    queue: MrfQueue,
    config: MrfConsumerConfig,
    new_since_flush: usize,
+    /// True while the in-memory pending set has changed since the last
+    /// journal flush (push, pop, or an attempts bump that alters the encoded
+    /// bytes). Only a dirty state rewrites the snapshot: a steady backlog
+    /// waiting out an admission backoff must not re-fsync every local disk
+    /// twice a second.
+    dirty: bool,
    /// True while a journal snapshot exists on disk that no longer reflects
    /// an all-consumed pending set; the next idle tick removes it (MinIO
    /// deletes its `list.bin` after replay for the same reason).
@@ -360,11 +387,6 @@ struct MrfRuntime {
 }

 impl MrfRuntime {
-    fn record_accept(&mut self) {
-        // Accepted intents leave the pending set; the next flush persists the
-        // smaller snapshot, which is the journal's compaction.
-    }
-
    fn snapshot(&self) -> Vec<u8> {
        let mut buf = Vec::new();
        for intent in self.queue.intents() {
@@ -374,8 +396,14 @@ impl MrfRuntime {
    }

    async fn flush(&mut self) {
-        write_journal(&self.snapshot()).await;
+        let persisted = write_journal(&self.snapshot()).await;
        self.new_since_flush = 0;
+        // Keep the dirty flag when every disk write failed: a clean backlog
+        // would otherwise never rewrite, losing the periodic persist retry a
+        // non-empty queue used to provide.
+        if persisted {
+            self.dirty = false;
+        }
        self.journal_on_disk = true;
    }

@@ -389,9 +417,15 @@ impl MrfRuntime {
            self.backoff_until = None;
        }
        while let Some(mut intent) = self.queue.pop_front() {
-            let request = build_heal_request(&intent);
-            match manager.submit_heal_request(request).await {
-                Ok(HealAdmissionResult::Accepted) | Ok(HealAdmissionResult::Merged) => self.record_accept(),
+            // Leaving the pending set (consumed or re-queued with a bumped
+            // attempts counter) changes the encoded snapshot; mark it dirty
+            // either way.
+            self.dirty = true;
+            match submit_mrf_heal_request(manager, &intent).await {
+                // Accepted intents leave the pending set; the next flush persists the
+                // smaller snapshot. The scanner ledger is cleared later, when the
+                // canonical heal task reaches a successful terminal completion.
+                Ok(HealAdmissionResult::Accepted) | Ok(HealAdmissionResult::Merged) => {}
                Ok(HealAdmissionResult::Full) | Ok(HealAdmissionResult::Dropped(HealAdmissionDropReason::QueueFull)) => {
                    intent.attempts = intent.attempts.saturating_add(1);
                    if intent.attempts >= MRF_MAX_ATTEMPTS {
@@ -493,8 +527,7 @@ async fn replay_into(
    // stays armed in `queue` for the consumer's retry loop.
    if backoff_until.is_none() {
        while let Some(mut intent) = queue.pop_front() {
-            let request = build_heal_request(&intent);
-            match manager.submit_heal_request(request).await {
+            match submit_mrf_heal_request(manager, &intent).await {
                Ok(HealAdmissionResult::Accepted) | Ok(HealAdmissionResult::Merged) => {}
                Ok(HealAdmissionResult::Full) | Ok(HealAdmissionResult::Dropped(HealAdmissionDropReason::QueueFull)) => {
                    intent.attempts = intent.attempts.saturating_add(1);
@@ -519,6 +552,7 @@ async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receive
        queue: MrfQueue::new(config.queue_capacity, config.journal_max_bytes),
        config: config.clone(),
        new_since_flush: 0,
+        dirty: false,
        journal_on_disk: false,
        backoff_until: None,
    };
@@ -526,6 +560,10 @@ async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receive
    // Replay: read the journal, re-arm intents (duplicates are merged by the
    // manager's dedup key), then drop the file so the next flush starts clean.
    replay_into(&manager, &mut runtime.queue, &mut runtime.backoff_until).await;
+    // The replay deleted the journal file; anything still pending (e.g. the
+    // manager was full and backoff armed) must be re-persisted by the next
+    // flush or a crash before it would lose those intents.
+    runtime.dirty = runtime.queue.depth() > 0;

    let mut flush_tick = tokio::time::interval(runtime.config.flush_interval);
    flush_tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
@@ -535,8 +573,13 @@ async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receive
        tokio::select! {
            received = receiver.recv_many(&mut batch, runtime.config.replay_batch) => {
                if received == 0 {
-                    // Channel closed: flush once more and stop.
-                    runtime.flush().await;
+                    // Channel closed: flush once more unless the snapshot is
+                    // provably current AND idle (a dirty or pending state
+                    // gets one last persist attempt, matching the shutdown
+                    // retry the unconditional flush used to provide).
+                    if runtime.dirty || runtime.queue.depth() > 0 {
+                        runtime.flush().await;
+                    }
                    tracing::info!(
                        target: "rustfs::heal::mrf",
                        "MRF channel closed; consumer stopped after final flush"
@@ -544,8 +587,10 @@ async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receive
                    return;
                }
                for intent in batch.drain(..) {
-                    runtime.queue.try_push(intent);
-                    runtime.new_since_flush += 1;
+                    if runtime.queue.try_push(intent) {
+                        runtime.new_since_flush += 1;
+                        runtime.dirty = true;
+                    }
                }
                runtime.dispatch(manager.as_ref()).await;
                if runtime.new_since_flush >= runtime.config.flush_threshold {
@@ -553,15 +598,26 @@ async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receive
                }
            }
            _ = flush_tick.tick() => {
-                if runtime.new_since_flush > 0 || runtime.queue.depth() > 0 {
-                    runtime.flush().await;
-                    runtime.dispatch(manager.as_ref()).await;
-                } else if runtime.journal_on_disk {
-                    // All intents consumed: remove the journal so a restart
-                    // replays nothing (mirrors MinIO's post-replay unlink).
-                    delete_journal().await;
-                    runtime.journal_on_disk = false;
-                    gauge!("rustfs_heal_mrf_journal_bytes").set(0.0);
+                match tick_action(runtime.dirty, runtime.queue.depth(), runtime.journal_on_disk) {
+                    TickAction::Flush => {
+                        runtime.flush().await;
+                        runtime.dispatch(manager.as_ref()).await;
+                    }
+                    TickAction::Retry => {
+                        // Pending set unchanged since the last flush (a
+                        // backlog waiting out an admission backoff): skip the
+                        // rewrite but keep dispatching so the retry fires on
+                        // time.
+                        runtime.dispatch(manager.as_ref()).await;
+                    }
+                    TickAction::DeleteJournal => {
+                        // All intents consumed: remove the journal so a restart
+                        // replays nothing (mirrors MinIO's post-replay unlink).
+                        delete_journal().await;
+                        runtime.journal_on_disk = false;
+                        gauge!("rustfs_heal_mrf_journal_bytes").set(0.0);
+                    }
+                    TickAction::Idle => {}
                }
                gauge!("rustfs_heal_mrf_queue_depth").set(runtime.queue.depth() as f64);
            }
@@ -569,6 +625,33 @@ async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receive
    }
 }

+/// What the periodic tick should do, as a pure function of the runtime state
+/// so the decision table is unit-testable.
+enum TickAction {
+    /// The pending set changed since the last snapshot: rewrite it, then
+    /// drain.
+    Flush,
+    /// Pending intents exist but the snapshot is current: only drain (an
+    /// admission backoff may have expired).
+    Retry,
+    /// Nothing pending and a stale journal file remains: remove it.
+    DeleteJournal,
+    /// Quiescent: nothing to do.
+    Idle,
+}
+
+fn tick_action(dirty: bool, depth: usize, journal_on_disk: bool) -> TickAction {
+    if dirty {
+        TickAction::Flush
+    } else if depth > 0 {
+        TickAction::Retry
+    } else if journal_on_disk {
+        TickAction::DeleteJournal
+    } else {
+        TickAction::Idle
+    }
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -586,6 +669,27 @@ mod tests {
        }
    }

+    #[test]
+    fn tick_action_table() {
+        use TickAction::*;
+
+        // Dirty dominates: a changed pending set flushes even when idle
+        // otherwise.
+        assert!(matches!(tick_action(true, 0, false), Flush));
+        assert!(matches!(tick_action(true, 3, true), Flush));
+
+        // Clean backlog: no rewrite, but keep draining so an expired
+        // admission backoff retries on time.
+        assert!(matches!(tick_action(false, 1, false), Retry));
+        assert!(matches!(tick_action(false, 2, true), Retry));
+
+        // Quiescent with a stale journal file on disk: remove it.
+        assert!(matches!(tick_action(false, 0, true), DeleteJournal));
+
+        // Fully quiescent: nothing to do.
+        assert!(matches!(tick_action(false, 0, false), Idle));
+    }
+
    #[test]
    fn queue_enforces_count_and_byte_ceilings() {
        let mut queue = MrfQueue::new(2, usize::MAX);
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`sha256=9b9bc336b43b70d0e06e0adb5455bf035bb18945d85d60936eb6fe4d48e0e680`
				`@@ -0,0 +1 @@`
				`sha256=655a3f3c1d042e694339d15caba7580518320322d1bac0f09450b37e6c09e2e7`
				`@@ -0,0 +1 @@`
				`sha256=ec27cde6ce6400723c4b372bfbd2ac61709c744294e4810af765e8a808d8e31d`