test: assert four leaf-crate smoke tests, and two more census fixes

Two more census heuristics, both verified by bisecting the candidate count so a "fix" that widened the queue could not slip through:

- any `assert*!` macro counts as verification, not just the three built-ins — `assert_fields_bound!` in `protos` was being missed. The pattern deliberately stays a substring match: an earlier attempt anchored it with `\b`, which silently stopped matching prefixed macros like `const_assert!` and pushed the queue from 32 to 55 before the count caught it.
- `let _ = Type::<T>::method;` is a signature guard, the same as the already-recognised nested-fn form. That is `iam`'s deprecated-API test.

Tree-wide candidates go 32 to 30 from the script alone, then to 26 with the four tests below.

`detect_storage_media`'s two tests only checked that the call did not panic, over a `match` whose arms were all empty. What the machine reports depends on the machine, but two rules do not: an override wins over probing, including when probing is disabled, and disabled probing reports `Unknown` rather than guessing. A third test keeps the platform call and asserts it returns a known variant *and* the same one twice — a probe that flapped would make the scheduler's profile depend on when it asked.

`runtime_facade_stops_empty_replay_workers` called the stop path and asserted nothing. It now checks the worker list is empty afterwards and that a second call stays harmless, which is what shutdown paths actually do.

`test_mask_never_recurses_for_any_variant` discarded every mask. Termination is still the property under test — a regression overflows the stack rather than failing an assertion — but the masks are now collected and checked, so the loop cannot fold away and a variant that starts returning an empty mask is caught too.

Two known false positives are left in the queue rather than chased: `utils/src/string.rs:942` does assert, but its input string `"{1...2}}"` unbalances the scanner's brace counter and truncates the body before the assertion. Making the counter literal-aware needs a lexer that understands raw strings — a first attempt desynchronised on `r#"{"invalid": json}"#` and pushed the queue to 120, so it was backed out. `s3select-api:379` declares a nested exhaustive-match fn and never calls it; recognising that shape without hiding genuinely empty bodies needs more care than it is worth today.

Refs backlog#1836

crates/e2e_test/src/admin_auth_test.rs

@@ -38,6 +38,7 @@ mod tests {
     use rustfs_signer::constants::UNSIGNED_PAYLOAD;
     use rustfs_signer::sign_v4;
     use s3s::Body;
+    use serial_test::serial;
     use std::error::Error;
     use std::io::Read;
     use std::process::{Command, Stdio};
@@ -161,6 +162,7 @@ mod tests {
     /// A fully authenticated but non-admin credential must be rejected with
     /// `403 AccessDenied` on an admin API, while the root credential succeeds.
     #[tokio::test(flavor = "multi_thread")]
+    #[serial]
     async fn non_admin_credential_denied_on_admin_api() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -196,6 +198,7 @@ mod tests {
     }
 
     #[tokio::test(flavor = "multi_thread")]
+    #[serial]
     async fn non_admin_credential_denied_on_manual_transition_run() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -323,6 +326,7 @@ mod tests {
     /// credential is accepted and the old one is rejected, on both the S3 data
     /// plane and the admin plane.
     #[tokio::test(flavor = "multi_thread")]
+    #[serial]
     async fn root_credential_rotation_takes_effect() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -385,6 +389,7 @@ mod tests {
     /// runtime. We capture the child's stdout/stderr directly (the shared
     /// harness inherits stdio) and poll for the warning until it appears.
     #[tokio::test(flavor = "multi_thread")]
+    #[serial]
     async fn default_credentials_emit_startup_warning() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
 

crates/e2e_test/src/admin_iam_crud_test.rs

@@ -33,6 +33,7 @@ use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::{Client, Config};
 use reqwest::StatusCode;
+use serial_test::serial;
 use std::error::Error;
 use tokio::time::{Duration, sleep};
 
@@ -177,6 +178,7 @@ async fn assert_admin_status(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_update_service_account_enforces_owner_and_parent_scope() -> TestResult {
     init_logging();
 
@@ -346,6 +348,7 @@ async fn test_update_service_account_enforces_owner_and_parent_scope() -> TestRe
 /// Full user -> policy -> service-account lifecycle, proving each management
 /// call takes effect on the data plane, not just that the endpoint answers 200.
 #[tokio::test]
+#[serial]
 async fn test_admin_user_policy_service_account_crud_lifecycle() -> TestResult {
     init_logging();
 
@@ -570,6 +573,7 @@ async fn test_admin_user_policy_service_account_crud_lifecycle() -> TestResult {
 /// non-admin credential with 403 AccessDenied (sec-4 assertion pattern; the
 /// gate implementation itself is owned by sec-4 / admin_auth_test).
 #[tokio::test]
+#[serial]
 async fn test_admin_iam_endpoints_deny_non_admin_credential() -> TestResult {
     init_logging();
 

crates/e2e_test/src/admin_timeout_regression_test.rs

@@ -21,6 +21,7 @@ use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use s3s::Body;
 use serde::Deserialize;
+use serial_test::serial;
 use std::error::Error;
 use std::process::Command;
 use tokio::time::{Duration, sleep, timeout};
@@ -99,6 +100,7 @@ fn offline_server_count(info: &InfoMessage) -> usize {
 }
 
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 async fn test_single_admin_timeout_does_not_immediately_mark_peer_offline() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 

crates/e2e_test/src/anonymous_access_test.rs

@@ -18,6 +18,7 @@
 
 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use aws_sdk_s3::types::PublicAccessBlockConfiguration;
+use serial_test::serial;
 use tracing::info;
 
 async fn setup_public_bucket(
@@ -72,6 +73,7 @@ async fn anonymous_get_object(
 /// Issue #2036: Anonymous GetObject should succeed when bucket policy allows it
 /// and no PublicAccessBlock configuration exists (ConfigNotFound).
 #[tokio::test]
+#[serial]
 async fn test_anonymous_access_allowed_when_public_access_block_missing() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -98,6 +100,7 @@ async fn test_anonymous_access_allowed_when_public_access_block_missing() -> Res
 
 /// Anonymous GetObject should be denied when RestrictPublicBuckets is true.
 #[tokio::test]
+#[serial]
 async fn test_anonymous_access_denied_when_restrict_public_buckets_enabled()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -134,6 +137,7 @@ async fn test_anonymous_access_denied_when_restrict_public_buckets_enabled()
 /// Anonymous GetObject should succeed when PublicAccessBlock exists but
 /// RestrictPublicBuckets is explicitly false.
 #[tokio::test]
+#[serial]
 async fn test_anonymous_access_allowed_when_restrict_public_buckets_disabled()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -172,6 +176,7 @@ async fn test_anonymous_access_allowed_when_restrict_public_buckets_disabled()
 /// reaches authorization through a fallback branch, and that branch has to apply the
 /// same public-access gate as a direct grant.
 #[tokio::test]
+#[serial]
 async fn ghsa_x298_anonymous_list_object_versions_denied_when_restrict_public_buckets_enabled()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();

crates/e2e_test/src/api_rate_limit_test.rs

@@ -18,11 +18,13 @@
 //! completely inert with default configuration.
 
 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
+use serial_test::serial;
 use tracing::info;
 
 type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
 
 #[tokio::test]
+#[serial]
 async fn api_rate_limit_enforces_429_with_retry_after_when_enabled() -> TestResult {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -85,6 +87,7 @@ async fn api_rate_limit_enforces_429_with_retry_after_when_enabled() -> TestResu
 }
 
 #[tokio::test]
+#[serial]
 async fn api_rate_limit_bucket_dimension_throttles_per_bucket() -> TestResult {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -130,6 +133,7 @@ async fn api_rate_limit_bucket_dimension_throttles_per_bucket() -> TestResult {
 }
 
 #[tokio::test]
+#[serial]
 async fn api_rate_limit_stays_inert_by_default() -> TestResult {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/archive_download_integrity_test.rs

@@ -24,6 +24,7 @@ mod tests {
     use rustfs_signer::constants::UNSIGNED_PAYLOAD;
     use rustfs_signer::{pre_sign_v4, sign_v4};
     use s3s::Body;
+    use serial_test::serial;
     use sha2::{Digest, Sha256};
     use std::error::Error;
     use std::io::{Cursor, Write};
@@ -338,6 +339,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_put_allows_content_encoding_by_default() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -365,6 +367,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_put_rejects_content_encoding_when_strict_mode_enabled() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -388,6 +391,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_put_with_aws_chunked_does_not_persist_content_encoding_by_default()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
@@ -423,6 +427,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_put_with_aws_chunked_and_effective_encoding_roundtrips_by_default()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
@@ -458,6 +463,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_put_with_aws_chunked_allowed_when_strict_mode_enabled() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -492,6 +498,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_put_with_aws_chunked_and_effective_encoding_rejects_when_strict_mode_enabled()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
@@ -522,6 +529,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_download_roundtrip_with_http_compression_enabled() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -583,6 +591,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_multipart_roundtrip_preserves_bytes() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -678,6 +687,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_multipart_get_ignores_empty_conditional_etag_headers() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -713,6 +723,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_multipart_with_aws_chunked_and_effective_encoding_roundtrips_by_default()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
@@ -742,6 +753,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_multipart_with_aws_chunked_allowed_when_strict_mode_enabled() -> Result<(), Box<dyn Error + Send + Sync>>
     {
         init_logging();
@@ -771,6 +783,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_archive_multipart_with_aws_chunked_and_effective_encoding_rejects_when_strict_mode_enabled()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
@@ -803,6 +816,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_presigned_get_and_reverse_proxy_preserve_multipart_bytes() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/bucket_logging_test.rs

@@ -24,9 +24,11 @@ mod tests {
     };
     use http::Method;
     use http::header::CONTENT_TYPE;
+    use serial_test::serial;
     use tracing::info;
 
     #[tokio::test]
+    #[serial]
     async fn test_dummy_bucket_compatibility_endpoints() {
         init_logging();
         info!("Starting test: dummy-compat bucket APIs should match S3-compatible behavior");
@@ -234,6 +236,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_dummy_bucket_compatibility_endpoints_no_such_bucket() {
         init_logging();
         info!("Starting test: dummy-compat bucket APIs should return NoSuchBucket for missing bucket");
@@ -389,6 +392,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_dummy_bucket_endpoints_http_contracts() {
         init_logging();
         info!("Starting test: dummy-compat bucket API HTTP contracts");

crates/e2e_test/src/bucket_policy_check_test.rs

@@ -18,6 +18,7 @@
 use crate::common::{RustFSTestEnvironment, init_logging};
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::{Client, Config};
+use serial_test::serial;
 use tracing::info;
 
 async fn create_user(
@@ -50,6 +51,7 @@ fn create_user_client(env: &RustFSTestEnvironment, access_key: &str, secret_key:
 }
 
 #[tokio::test]
+#[serial]
 async fn test_bucket_policy_authenticated_user() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     if !crate::common::awscurl_available() {

crates/e2e_test/src/bucket_stats_regression_test.rs

@@ -35,6 +35,7 @@ mod tests {
     use aws_sdk_s3::primitives::ByteStream;
     use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
     use rustfs_data_usage::DataUsageInfo;
+    use serial_test::serial;
     use std::error::Error;
     use tokio::time::{Duration, sleep};
     use tracing::info;
@@ -58,6 +59,7 @@ mod tests {
     /// 3. Query admin data usage API
     /// 4. Verify object count > 0
     #[tokio::test]
+    #[serial]
     async fn test_bucket_object_count_updates_after_put() -> TestResult {
         init_logging();
         info!("RT-09: bucket object count updates after PUT");
@@ -124,6 +126,7 @@ mod tests {
     /// Regression pattern: stats remain unchanged after objects are deleted
     /// (rustfs#5615).
     #[tokio::test]
+    #[serial]
     async fn test_bucket_object_count_updates_after_delete() -> TestResult {
         init_logging();
         info!("RT-09b: bucket object count updates after DELETE");
@@ -217,6 +220,7 @@ mod tests {
     /// Regression pattern: DataUsageInfo undercounts versioned bucket versions
     /// and delete markers (rustfs#3898).
     #[tokio::test]
+    #[serial]
     async fn test_versioned_bucket_stats_count_all_versions() -> TestResult {
         init_logging();
         info!("RT-09c: versioned bucket stats count all versions");

crates/e2e_test/src/checksum_upload_test.rs

@@ -26,6 +26,7 @@ mod tests {
     use base64::Engine;
     use md5::{Digest as Md5Digest, Md5};
     use rustfs_rio::{Checksum, ChecksumType as RioChecksumType};
+    use serial_test::serial;
     use sha2::Sha256;
     use tracing::info;
 
@@ -89,6 +90,7 @@ mod tests {
 
     /// PutObject with Content-MD5: upload succeeds and GetObject returns same content.
     #[tokio::test]
+    #[serial]
     async fn test_put_object_with_content_md5() {
         init_logging();
         info!("TEST: PutObject with Content-MD5");
@@ -124,6 +126,7 @@ mod tests {
 
     /// PutObject with x-amz-checksum-sha256: upload succeeds and GetObject returns same content.
     #[tokio::test]
+    #[serial]
     async fn test_put_object_with_checksum_sha256() {
         init_logging();
         info!("TEST: PutObject with x-amz-checksum-sha256");
@@ -161,6 +164,7 @@ mod tests {
     /// PutObject with a SHA256 checksum that does NOT match the body must be
     /// rejected (BadDigest / checksum mismatch), NOT accepted with HTTP 200.
     #[tokio::test]
+    #[serial]
     async fn test_put_object_rejects_mismatched_sha256() {
         init_logging();
         info!("TEST: PutObject rejects mismatched x-amz-checksum-sha256 (issue #4341)");
@@ -208,6 +212,7 @@ mod tests {
     /// After PutObject with a correct SHA256 checksum, HeadObject with
     /// ChecksumMode=ENABLED must return that stored base64 SHA256 digest.
     #[tokio::test]
+    #[serial]
     async fn test_head_object_returns_stored_sha256() {
         init_logging();
         info!("TEST: HeadObject returns stored SHA256 with ChecksumMode=ENABLED (issue #4341)");
@@ -253,6 +258,7 @@ mod tests {
     /// Multipart upload with checksum: CreateMultipartUpload, UploadPart(s) with checksum_sha256, CompleteMultipartUpload; then GetObject verifies content.
     /// Uses part size >= 5MB (server minimum) for two parts.
     #[tokio::test]
+    #[serial]
     async fn test_multipart_upload_with_checksum() {
         init_logging();
         info!("TEST: MultipartUpload with checksum (checksum_sha256 on parts)");
@@ -350,6 +356,7 @@ mod tests {
     /// Regression test for issue #2282:
     /// CRC64NVME full-object checksum should match between direct PutObject and multipart upload.
     #[tokio::test]
+    #[serial]
     async fn test_crc64nvme_matches_between_put_object_and_multipart_upload() {
         init_logging();
         info!("TEST: CRC64NVME matches between direct PutObject and multipart upload");
@@ -485,6 +492,7 @@ mod tests {
     /// value is rejected with BadDigest and nothing is stored. Full HEAD/GET header
     /// echo round-trip is additionally exercised by the boto3+awscrt e2e.
     #[tokio::test]
+    #[serial]
     async fn test_additional_checksums_verify_on_write() {
         init_logging();
         info!("TEST: additional checksums (XXHash3/64/128, SHA-512, MD5) verify-on-write");

crates/e2e_test/src/cluster_concurrency_test.rs

@@ -16,6 +16,7 @@ use crate::common::RustFSTestClusterEnvironment;
 use aws_sdk_s3::Client;
 use aws_sdk_s3::error::SdkError;
 use bytes::Bytes;
+use serial_test::serial;
 use std::sync::Arc;
 use tokio::sync::Barrier;
 use tracing::{info, warn};
@@ -134,6 +135,7 @@ async fn run_race_iteration(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_conditional_put_race_cluster() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     crate::common::init_logging();
     info!("Starting conditional PUT race test with auto cluster");
@@ -190,6 +192,7 @@ async fn test_conditional_put_race_cluster() -> Result<(), Box<dyn std::error::E
 }
 
 #[tokio::test]
+#[serial]
 async fn test_conditional_put_basic_cluster() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     crate::common::init_logging();
     info!("Starting basic conditional PUT test with auto cluster");

crates/e2e_test/src/cluster_multidrive_pool_test.rs

@@ -31,6 +31,7 @@
 //! (toxiproxy / socket proxy) and 5GiB large-object budgets.
 
 use crate::common::{ClusterTopology, RustFSTestClusterEnvironment};
+use serial_test::serial;
 
 type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
 
@@ -57,6 +58,7 @@ async fn put_get_roundtrip(cluster: &RustFSTestClusterEnvironment, key: &str, pa
 
 /// 4 nodes x 2 drives, single pool: the multi-drive layout boots and round-trips.
 #[tokio::test]
+#[serial]
 async fn cluster_multidrive_single_pool_smoke() -> TestResult {
     crate::common::init_logging();
 
@@ -79,6 +81,7 @@ async fn cluster_multidrive_single_pool_smoke() -> TestResult {
 /// Two single-node pools, 2 drives each: the multi-pool layout boots and
 /// round-trips. Every pool is a distinct erasure pool (`pool_idx` 0 and 1).
 #[tokio::test]
+#[serial]
 async fn cluster_two_pool_smoke() -> TestResult {
     crate::common::init_logging();
 

crates/e2e_test/src/compression_test.rs

@@ -3,6 +3,7 @@
 use crate::common::{RustFSTestEnvironment, init_logging, rustfs_binary_path};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
+use serial_test::serial;
 use std::fs;
 use std::path::PathBuf;
 use std::process::Command;
@@ -101,6 +102,7 @@ async fn start_rustfs_with_compression(env: &mut RustFSTestEnvironment) -> Resul
 }
 
 #[tokio::test]
+#[serial]
 async fn test_compression_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Starting compression roundtrip test");
@@ -228,6 +230,7 @@ async fn fetch_range(
 /// (rustfs/rustfs#5957: multipart uploads previously bypassed disk compression
 /// entirely).
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Starting multipart compression roundtrip test");
@@ -346,6 +349,7 @@ const MPU_HIGH_RATIO_BUCKET: &str = "compression-mpu-high-ratio-bucket";
 /// reproduced the mid-payload Pending truncation (rustfs/rustfs#5957). Every GET shape must return
 /// the exact original bytes, and the stored size must show the data really was compressed.
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_high_ratio_binary_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Starting multipart high-ratio binary compression roundtrip test");
@@ -442,6 +446,7 @@ const MPU_COPY_RANGE_LEN: usize = 5 * 1024 * 1024;
 /// range must be decompressed on read and re-compressed into the destination part, so the final
 /// object has to match "source prefix + uploaded tail" byte for byte.
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_upload_part_copy_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Starting multipart upload-part-copy compression roundtrip test");
@@ -565,6 +570,7 @@ const MPU_THREE_PARTS_TAIL_SIZE: usize = 512 * 1024;
 /// Three-part upload with uneven part sizes: each partNumber GET must map back to exactly one
 /// compressed part stream, and a suffix range must resolve inside the trailing part.
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_three_parts_part_number_gets() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Starting three-part multipart compression partNumber test");
@@ -683,6 +689,7 @@ async fn start_rustfs_with_compression_and_sse(
 /// shape must still return the original plaintext bytes. Physical size must shrink because the
 /// compression runs before encryption.
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_sse_s3_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     use aws_sdk_s3::types::ServerSideEncryption;
 

crates/e2e_test/src/connection_cap_test.rs

@@ -18,6 +18,7 @@
 //! concurrency — a queued connection is served only after a held one closes.
 
 use crate::common::{RustFSTestEnvironment, init_logging};
+use serial_test::serial;
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;
@@ -56,6 +57,7 @@ async fn read_response_head(stream: &mut TcpStream, dur: Duration) -> Option<Str
 }
 
 #[tokio::test]
+#[serial]
 async fn connection_cap_releases_permits_on_close() -> TestResult {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -87,6 +89,7 @@ async fn open_and_stall(addr: &str) -> std::io::Result<TcpStream> {
 }
 
 #[tokio::test]
+#[serial]
 async fn connection_cap_blocks_excess_connections_until_permits_free() -> TestResult {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/console_smoke_test.rs

@@ -33,6 +33,7 @@
 //!     serve the unauthenticated console endpoints at all.
 
 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
+use serial_test::serial;
 use std::error::Error;
 use tokio::time::{Duration, sleep};
 
@@ -57,6 +58,7 @@ async fn wait_for_console_ready(console_base: &str) -> Result<reqwest::Response,
 }
 
 #[tokio::test]
+#[serial]
 async fn test_console_over_the_wire_smoke() -> TestResult {
     init_logging();
 

crates/e2e_test/src/content_encoding_test.rs

@@ -22,10 +22,12 @@
 mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
     use tracing::info;
 
     /// Verify Content-Encoding header roundtrips through PUT, GET, and HEAD operations
     #[tokio::test]
+    #[serial]
     async fn test_content_encoding_roundtrip() {
         init_logging();
         info!("Starting Content-Encoding roundtrip test");
@@ -103,6 +105,7 @@ mod tests {
     /// Issue #1857: Content-Encoding "aws-chunked" is used by SigV4 streaming clients and must
     /// not be stored or returned. Upload with aws-chunked and verify GET/HEAD do not return it.
     #[tokio::test]
+    #[serial]
     async fn test_content_encoding_aws_chunked_not_returned_issue_1857() {
         init_logging();
         info!("Issue #1857: aws-chunked must not be persisted or returned");
@@ -158,6 +161,7 @@ mod tests {
     /// Issue #2475 / Route A: when aws-chunked is combined with an effective object encoding,
     /// only the effective encoding should roundtrip through GET/HEAD.
     #[tokio::test]
+    #[serial]
     async fn test_content_encoding_aws_chunked_with_effective_encoding_roundtrip() {
         init_logging();
         info!("aws-chunked,gzip should persist only gzip");

crates/e2e_test/src/copy_object_checksum_test.rs

@@ -30,6 +30,7 @@ mod tests {
     use base64::Engine as _;
     use base64::engine::general_purpose::STANDARD as BASE64;
     use rustfs_rio::{Checksum, ChecksumType as RioChecksumType};
+    use serial_test::serial;
     use sha2::{Digest, Sha256};
     use tracing::info;
 
@@ -113,6 +114,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_copy_supports_all_checksum_algorithms() {
         init_logging();
 
@@ -194,6 +196,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_copy_without_algorithm_preserves_every_supported_source_checksum() {
         init_logging();
 
@@ -259,6 +262,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_copy_without_algorithm_preserves_composite_checksum_type() {
         init_logging();
 
@@ -348,6 +352,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_copy_rejects_unknown_algorithm_without_destination_mutation() {
         init_logging();
 
@@ -448,6 +453,7 @@ mod tests {
     /// bytes, return it in `CopyObjectResult.ChecksumSHA256`, and persist it so a checksum-mode
     /// HEAD on the destination returns the identical value.
     #[tokio::test]
+    #[serial]
     async fn test_copy_with_checksum_algorithm_returns_and_persists_sha256() {
         init_logging();
         info!("Issue #4996: CopyObject with ChecksumAlgorithm=SHA256 must return and persist the checksum");
@@ -517,6 +523,7 @@ mod tests {
     /// No algorithm requested: when the source object already carries a checksum, the copy must
     /// preserve it on the destination (AWS default), visible via a checksum-mode HEAD.
     #[tokio::test]
+    #[serial]
     async fn test_copy_without_algorithm_preserves_source_checksum() {
         init_logging();
         info!("Issue #4996: CopyObject without ChecksumAlgorithm must preserve the source object's checksum");
@@ -596,6 +603,7 @@ mod tests {
     /// checksum-not-inherited path, and exercises the CRC32 code path (a different branch of
     /// ChecksumType::from_string than SHA256).
     #[tokio::test]
+    #[serial]
     async fn test_copy_requested_algorithm_overrides_source_checksum() {
         init_logging();
         info!("Issue #4996: a requested CopyObject checksum algorithm must override the source object's algorithm");

crates/e2e_test/src/copy_object_metadata_test.rs

@@ -22,9 +22,11 @@ mod tests {
     use aws_sdk_s3::types::{
         BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, MetadataDirective, StorageClass, VersioningConfiguration,
     };
+    use serial_test::serial;
     use tracing::info;
 
     #[tokio::test]
+    #[serial]
     async fn copy_object_standard_metadata_copy_replace_and_clear() {
         init_logging();
         info!("Issue #2789: self-copy metadata replacement must preserve object data");
@@ -298,6 +300,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn copy_object_replace_accepts_each_standard_field_independently() {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
@@ -413,6 +416,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn copy_object_replace_handles_versioned_multipart_source() {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
@@ -526,6 +530,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn invalid_replacement_metadata_does_not_mutate_destination() {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");

crates/e2e_test/src/copy_object_tagging_test.rs

@@ -21,6 +21,7 @@ mod tests {
     use aws_sdk_s3::error::ProvideErrorMetadata;
     use aws_sdk_s3::primitives::ByteStream;
     use aws_sdk_s3::types::{BucketVersioningStatus, MetadataDirective, TaggingDirective, VersioningConfiguration};
+    use serial_test::serial;
     use std::collections::BTreeMap;
 
     async fn object_tags(client: &Client, bucket: &str, key: &str) -> BTreeMap<String, String> {
@@ -38,6 +39,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn copy_object_applies_copy_replace_and_empty_tagging_directives() {
         init_logging();
         let mut env = RustFSTestEnvironment::new()
@@ -303,6 +305,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn copy_object_tag_replacement_honors_request_tag_policy_denial() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
     {
         init_logging();

crates/e2e_test/src/copy_object_version_restore_test.rs

@@ -21,9 +21,11 @@ mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::primitives::ByteStream;
     use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use serial_test::serial;
     use tracing::info;
 
     #[tokio::test]
+    #[serial]
     async fn test_self_copy_of_historical_version_restores_data_and_metadata() {
         init_logging();
         info!("Issue #4238: self-copy of a historical version must be allowed and preserve metadata");
@@ -163,6 +165,7 @@ mod tests {
     /// version copied via `x-amz-copy-source-version-id` (SDK `CopySourceVersionId`), kept distinct
     /// from the newly created destination `x-amz-version-id`.
     #[tokio::test]
+    #[serial]
     async fn test_copy_of_non_latest_source_version_returns_copy_source_version_id() {
         init_logging();
         info!("Issue #4976: versioned CopyObject must return x-amz-copy-source-version-id for the exact source version");

crates/e2e_test/src/copy_source_invalid_date_test.rs

@@ -47,6 +47,7 @@ mod tests {
     use rustfs_signer::constants::UNSIGNED_PAYLOAD;
     use rustfs_signer::sign_v4;
     use s3s::Body;
+    use serial_test::serial;
     use std::error::Error;
 
     /// Signed raw `PUT` copy request with an explicit copy-source conditional
@@ -83,6 +84,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_copy_source_if_unmodified_since_valid_and_invalid() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/create_bucket_region_test.rs

@@ -25,11 +25,13 @@
 mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::types::{BucketLocationConstraint, CreateBucketConfiguration};
+    use serial_test::serial;
     use std::error::Error;
 
     /// `CreateBucket` with a `LocationConstraint` body must pass SigV4 validation
     /// and create the bucket, mirroring `minio-go` `MakeBucket(bucket, "us-east-1")`.
     #[tokio::test]
+    #[serial]
     async fn test_create_bucket_with_us_east_1_location_constraint() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -60,6 +62,7 @@ mod tests {
     /// A plain `CreateBucket` (no body) must also succeed; guards against a
     /// regression where an empty body would be hashed incorrectly during SigV4.
     #[tokio::test]
+    #[serial]
     async fn test_create_bucket_without_location_constraint() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/data_usage_test.rs

@@ -15,6 +15,7 @@
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
 use rustfs_data_usage::DataUsageInfo;
+use serial_test::serial;
 use tokio::time::{Duration, sleep};
 
 use crate::common::{FAST_DATA_USAGE_SCANNER_ENV, RustFSTestEnvironment, TEST_BUCKET, awscurl_get, init_logging};
@@ -59,6 +60,7 @@ where
 /// Regression test for data usage accuracy (issue #1012).
 /// Launches rustfs, writes 1000 objects, then asserts admin data usage reports the full count.
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "Starts a rustfs server and requires awscurl; enable when running full E2E"]
 async fn data_usage_reports_all_objects() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -116,6 +118,7 @@ async fn data_usage_reports_all_objects() -> Result<(), Box<dyn std::error::Erro
 /// Regression test for issue #3898.
 /// Versioned buckets should expose versions and delete markers through admin data usage.
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "Starts a rustfs server and requires awscurl; enable when running full E2E"]
 async fn data_usage_reports_versioned_objects_and_delete_markers() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();

crates/e2e_test/src/delete_marker_migration_semantics_test.rs

@@ -18,6 +18,7 @@ mod tests {
     use aws_sdk_s3::Client;
     use aws_sdk_s3::primitives::ByteStream;
     use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use serial_test::serial;
 
     async fn create_versioned_bucket(client: &Client, bucket: &str) {
         client
@@ -71,6 +72,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_versioning_only_delete_marker_has_minio_compatible_visibility_for_migration_proof() {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
@@ -111,6 +113,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_versioning_delete_marker_plus_history_remains_visible_for_migration_proof() {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await.expect("create test environment");

crates/e2e_test/src/delete_object_no_content_length_test.rs

@@ -24,6 +24,7 @@ mod tests {
     use rustfs_signer::constants::UNSIGNED_PAYLOAD;
     use rustfs_signer::sign_v4;
     use s3s::Body;
+    use serial_test::serial;
     use std::error::Error;
     use tokio::io::{AsyncReadExt, AsyncWriteExt};
     use tokio::net::TcpStream;
@@ -91,6 +92,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_delete_object_version_without_content_length_succeeds() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         info!("🧪 TEST: signed DELETE Object?versionId succeeds without Content-Length");

crates/e2e_test/src/delete_objects_versioning_test.rs

@@ -29,6 +29,7 @@ mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::Client;
     use aws_sdk_s3::types::{BucketVersioningStatus, Delete, ObjectIdentifier, VersioningConfiguration};
+    use serial_test::serial;
     use tracing::info;
 
     fn create_s3_client(env: &RustFSTestEnvironment) -> Client {
@@ -41,6 +42,7 @@ mod tests {
     /// a versioned bucket, calling `list_object_versions` **immediately** (with
     /// no sleep) returns the newly-created DeleteMarker with `is_latest = true`.
     #[tokio::test]
+    #[serial]
     async fn test_delete_objects_delete_marker_immediately_visible() {
         init_logging();
         info!("🧪 TEST: DeleteMarker from delete_objects is immediately visible via list_object_versions");
@@ -188,6 +190,7 @@ mod tests {
     /// a single `delete_objects` call all have their delete markers visible
     /// immediately afterwards.
     #[tokio::test]
+    #[serial]
     async fn test_delete_objects_multiple_keys_delete_markers_immediately_visible() {
         init_logging();
         info!("🧪 TEST: Multiple delete markers from delete_objects are immediately visible");

crates/e2e_test/src/delete_regression_test.rs

@@ -33,6 +33,7 @@ mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::primitives::ByteStream;
     use aws_sdk_s3::types::{BucketVersioningStatus, Delete, ObjectIdentifier, VersioningConfiguration};
+    use serial_test::serial;
     use std::error::Error;
     use tracing::info;
 
@@ -50,6 +51,7 @@ mod tests {
     /// 4. Verify the object is NOT in LIST
     /// 5. Verify HEAD returns 404
     #[tokio::test]
+    #[serial]
     async fn test_delete_removes_object_from_list() -> TestResult {
         init_logging();
         info!("RT-05: delete removes object from list");
@@ -130,6 +132,7 @@ mod tests {
     /// Regression pattern: batch delete returns success but some objects
     /// remain in LIST.
     #[tokio::test]
+    #[serial]
     async fn test_batch_delete_removes_all_objects() -> TestResult {
         init_logging();
         info!("RT-05c: batch delete removes all objects");
@@ -209,6 +212,7 @@ mod tests {
     /// Covers the pattern where permanent deletion of a specific version
     /// fails with FileAccessDenied (rustfs#4978).
     #[tokio::test]
+    #[serial]
     async fn test_versioned_permanent_delete() -> TestResult {
         init_logging();
         info!("RT-05d: versioned permanent delete");
@@ -279,6 +283,7 @@ mod tests {
     /// Covers the pattern where creating a delete marker and then listing
     /// versions shows incorrect state (rustfs#760).
     #[tokio::test]
+    #[serial]
     async fn test_versioned_delete_marker_and_list_consistency() -> TestResult {
         init_logging();
         info!("RT-05e: versioned delete marker and list consistency");
@@ -374,6 +379,7 @@ mod tests {
     /// Regression pattern: after delete, the object data files remain on disk
     /// (rustfs#5029: Node Does Not Remove Files After Reconnect).
     #[tokio::test]
+    #[serial]
     async fn test_delete_removes_object_head_returns_404() -> TestResult {
         init_logging();
         info!("RT-05f: delete → HEAD 404 consistency");

crates/e2e_test/src/distributed_startup_regression_test.rs

@@ -32,6 +32,7 @@
 mod tests {
     use crate::common::{RustFSTestClusterEnvironment, init_logging};
     use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
     use std::error::Error;
     use tokio::time::{Duration, sleep};
     use tracing::info;
@@ -49,6 +50,7 @@ mod tests {
     /// 3. Verify all nodes report healthy
     /// 4. Verify S3 operations work through any node
     #[tokio::test]
+    #[serial]
     async fn test_four_node_cluster_startup_and_health() -> TestResult {
         init_logging();
         info!("RT-10: 4-node cluster startup and health");
@@ -101,6 +103,7 @@ mod tests {
     /// Regression pattern: after a node restart, it cannot rejoin the cluster
     /// or enters a faulty state (rustfs#2601).
     #[tokio::test]
+    #[serial]
     async fn test_cluster_survives_node_restart() -> TestResult {
         init_logging();
         info!("RT-10b: cluster survives node restart");
@@ -165,6 +168,7 @@ mod tests {
     /// Regression pattern: bucket metadata is not replicated to all nodes,
     /// causing NoSuchBucket errors on some nodes (rustfs#3191).
     #[tokio::test]
+    #[serial]
     async fn test_bucket_visible_from_all_nodes() -> TestResult {
         init_logging();
         info!("RT-10c: bucket visible from all nodes");

crates/e2e_test/src/existing_object_tag_policy_test.rs

@@ -23,6 +23,7 @@ use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{Delete, ObjectIdentifier, Tag, Tagging};
 use aws_sdk_s3::{Client, Config};
+use serial_test::serial;
 use tracing::info;
 use uuid::Uuid;
 
@@ -173,6 +174,7 @@ async fn cleanup_bucket_and_object(admin: &Client, bucket: &str, key: &str) {
 
 /// IAM identity policy: GetObject allowed only when `s3:ExistingObjectTag/security` == `public`.
 #[tokio::test]
+#[serial]
 async fn test_e2e_iam_policy_existing_object_tag_get_object() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     if !awscurl_available() {
@@ -231,6 +233,7 @@ async fn test_e2e_iam_policy_existing_object_tag_get_object() -> Result<(), Box<
 
 /// Bucket policy: same `ExistingObjectTag` condition; user has no canned IAM policy attached.
 #[tokio::test]
+#[serial]
 async fn test_e2e_bucket_policy_existing_object_tag_get_object() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     if !awscurl_available() {
@@ -292,6 +295,7 @@ async fn test_e2e_bucket_policy_existing_object_tag_get_object() -> Result<(), B
 
 /// STS `AssumeRole` with inline `Policy` (session policy): GetObject only when `ExistingObjectTag/security` is `public`.
 #[tokio::test]
+#[serial]
 async fn test_e2e_sts_assume_role_session_policy_existing_object_tag() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     if !awscurl_available() {
@@ -368,6 +372,7 @@ async fn test_e2e_sts_assume_role_session_policy_existing_object_tag() -> Result
 
 /// STS inline session policy: DeleteObjects must evaluate `s3:DeleteObject` per requested object key.
 #[tokio::test]
+#[serial]
 async fn test_e2e_sts_session_policy_delete_objects_object_prefix_only() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     if !awscurl_available() {

crates/e2e_test/src/get_codec_streaming_compat_test.rs

@@ -66,6 +66,7 @@ mod tests {
     use aws_sdk_s3::error::ProvideErrorMetadata;
     use aws_sdk_s3::primitives::ByteStream;
     use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
+    use serial_test::serial;
     use sha2::{Digest, Sha256};
     use std::collections::BTreeMap;
     use std::error::Error;
@@ -276,6 +277,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn codec_streaming_matches_legacy_duplex_body_and_headers() -> TestResult {
         init_logging();
 

crates/e2e_test/src/group_delete_test.rs

@@ -17,6 +17,7 @@
 use crate::common::{RustFSTestEnvironment, admin_request, awscurl_delete, awscurl_get, awscurl_put, init_logging};
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::{Client, Config};
+use serial_test::serial;
 use tracing::info;
 
 fn create_user_s3_client(env: &RustFSTestEnvironment, access_key: &str, secret_key: &str) -> Client {
@@ -83,6 +84,7 @@ async fn update_group_members_rejects_invalid_new_group_names() -> Result<(), Bo
 
 /// Test that deleting a group with members fails, and deleting an empty group succeeds.
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "requires awscurl and spawns a real RustFS server"]
 async fn test_delete_group_requires_empty_membership() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -142,6 +144,7 @@ async fn test_delete_group_requires_empty_membership() -> Result<(), Box<dyn std
 /// Test that a user with only group membership (no explicit user policy) gets group policies
 /// and can perform actions allowed by the group (regression test for #2028.1).
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "requires awscurl and spawns a real RustFS server"]
 async fn test_user_with_only_group_gets_group_policies() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -209,6 +212,7 @@ async fn test_user_with_only_group_gets_group_policies() -> Result<(), Box<dyn s
 /// Test that after deleting a user who was the only member of a group, the group can be deleted
 /// (regression test for #2028.2: delete group uses backend membership, not stale cache).
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "requires awscurl and spawns a real RustFS server"]
 async fn test_delete_group_after_deleting_user() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();

crates/e2e_test/src/head_object_consistency_test.rs

@@ -16,6 +16,7 @@ use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use aws_sdk_s3::presigning::PresigningConfig;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
+use serial_test::serial;
 use std::time::Duration;
 use tracing::info;
 
@@ -28,6 +29,7 @@ fn list_contains_key(output: &aws_sdk_s3::operation::list_objects_v2::ListObject
 }
 
 #[tokio::test]
+#[serial]
 async fn head_object_consistency_after_write_and_multipart_and_presigned_head()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();

crates/e2e_test/src/head_object_range_test.rs

@@ -1,5 +1,6 @@
 use crate::common::{RustFSTestEnvironment, init_logging};
 use aws_sdk_s3::primitives::ByteStream;
+use serial_test::serial;
 use tracing::info;
 
 const RANGE_HEAD_BUCKET: &str = "range-head-test-bucket";
@@ -7,6 +8,7 @@ const RANGE_HEAD_KEY: &str = "range-head-object.bin";
 const ACCEPT_RANGES_BYTES: &str = "bytes";
 
 #[tokio::test]
+#[serial]
 async fn head_object_advertises_accept_ranges() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Starting HeadObject Accept-Ranges regression test");

crates/e2e_test/src/heal_erasure_disk_rebuild_test.rs

@@ -19,6 +19,7 @@ mod tests {
     use crate::chaos::signed_admin_post;
     use crate::common::{RustFSTestClusterEnvironment, RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
     use std::collections::HashSet;
     use std::error::Error;
     use std::path::{Path, PathBuf};
@@ -62,6 +63,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_auto_heal_rebuilds_runtime_wiped_disk_without_restart() {
         init_logging();
         info!("Issue #1533: auto heal should rebuild a runtime-wiped disk in a 4-disk single-node erasure set without restart");
@@ -180,6 +182,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_admin_deep_heal_rebuilds_cleared_disk_in_single_node_erasure_set() {
         init_logging();
         info!("Discussion #2964: admin deep heal should rebuild a wiped disk in a 4-disk single-node erasure set");
@@ -329,6 +332,7 @@ mod tests {
     }
 
     #[tokio::test(flavor = "multi_thread")]
+    #[serial]
     async fn test_cluster_root_heal_rebuilds_replaced_remote_disk() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         info!("Root recursive heal should rebuild data on a remote node after its disk is replaced and the node rejoins");
@@ -440,6 +444,7 @@ mod tests {
     /// topology early-return or the merge hard-fail) turns the down-window
     /// response into a 500 and fails this test.
     #[tokio::test]
+    #[serial]
     async fn test_background_heal_status_degrades_while_peer_down_and_recovers_after_rejoin()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();

crates/e2e_test/src/internode_rpc_signature_e2e_test.rs

@@ -101,6 +101,7 @@ use rustfs_config::{
 };
 use rustfs_protos::canonical_make_volume_request_body;
 use rustfs_protos::proto_gen::node_service::{MakeVolumeRequest, MakeVolumeResponse, PingRequest, PingResponse};
+use serial_test::serial;
 use sha2::{Digest, Sha256};
 use std::error::Error;
 use tonic::{Code, Request, Response, Status};
@@ -396,6 +397,7 @@ fn assert_rejected(result: Result<MakeVolumeResponse, Status>, expected: Code, e
 /// Grouped into one server start because each case is independent and spawning
 /// a `rustfs` process per assertion would dominate the runtime.
 #[tokio::test]
+#[serial]
 async fn internode_rpc_signature_default_posture_e2e() -> TestResult {
     init_logging();
     align_rpc_secret_with_server();
@@ -422,6 +424,7 @@ async fn internode_rpc_signature_default_posture_e2e() -> TestResult {
 /// epoch is learned from a real response, then the same server is restarted in place to prove its
 /// replacement epoch rejects the captured request even though the nonce cache is necessarily new.
 #[tokio::test]
+#[serial]
 async fn replay_scope_rejects_replay_path_transplant_and_stale_epoch_e2e() -> TestResult {
     init_logging();
     align_rpc_secret_with_server();
@@ -494,6 +497,7 @@ async fn replay_scope_rejects_replay_path_transplant_and_stale_epoch_e2e() -> Te
 /// A mutating v2 request cannot use that lane; once the epoch proof is returned, the first v3
 /// mutation succeeds. This protects a server restart without reopening a general downgrade path.
 #[tokio::test]
+#[serial]
 async fn replay_scope_strict_requires_v3_after_ping_bootstrap_e2e() -> TestResult {
     init_logging();
     align_rpc_secret_with_server();
@@ -700,6 +704,7 @@ async fn legacy_only_signature_is_accepted_in_default_posture(url: &str) {
 ///
 /// The paired v2 positive control rules out "strict simply breaks everything".
 #[tokio::test]
+#[serial]
 async fn signature_strict_rejects_legacy_only_downgrade() -> TestResult {
     init_logging();
     align_rpc_secret_with_server();
@@ -736,6 +741,7 @@ async fn signature_strict_rejects_legacy_only_downgrade() -> TestResult {
 /// takes the still-open legacy lane), which is what pins the rejection to the
 /// handler's digest gate; the cited message confirms which check spoke.
 #[tokio::test]
+#[serial]
 async fn body_digest_strict_rejects_digestless_mutation() -> TestResult {
     init_logging();
     align_rpc_secret_with_server();

crates/e2e_test/src/kms/bucket_default_encryption_test.rs

@@ -27,10 +27,12 @@ use aws_sdk_s3::types::{
     ServerSideEncryptionByDefault, ServerSideEncryptionConfiguration, ServerSideEncryptionRule,
 };
 use rustfs_rio::{Checksum, ChecksumType};
+use serial_test::serial;
 use tracing::{debug, info, warn};
 
 /// Test 1: When bucket is configured with default SSE-S3 encryption, put_object should automatically apply encryption
 #[tokio::test]
+#[serial]
 async fn test_bucket_default_sse_s3_put_object() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Testing bucket default SSE-S3 encryption impact on put_object");
@@ -153,6 +155,7 @@ async fn test_bucket_default_sse_s3_put_object() -> Result<(), Box<dyn std::erro
 
 /// Test 2: When bucket is configured with default SSE-KMS encryption, put_object should automatically apply encryption and use the specified KMS key
 #[tokio::test]
+#[serial]
 async fn test_bucket_default_sse_kms_put_object() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Testing bucket default SSE-KMS encryption impact on put_object");
@@ -272,6 +275,7 @@ async fn test_bucket_default_sse_kms_put_object() -> Result<(), Box<dyn std::err
 
 /// Test 3: When bucket is configured with default encryption, create_multipart_upload should inherit the configuration
 #[tokio::test]
+#[serial]
 async fn test_bucket_default_sse_kms_multipart_crc32() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Testing bucket default encryption impact on create_multipart_upload");
@@ -469,6 +473,7 @@ async fn test_bucket_default_sse_kms_multipart_crc32() -> Result<(), Box<dyn std
 
 /// Test 4: Explicitly specified encryption parameters in requests should override bucket default configuration
 #[tokio::test]
+#[serial]
 async fn test_explicit_encryption_overrides_bucket_default() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Testing explicitly specified encryption parameters override bucket default configuration");
@@ -564,6 +569,7 @@ async fn test_explicit_encryption_overrides_bucket_default() -> Result<(), Box<d
 /// Test 5: Setting SSE-KMS without a specific key ID should auto-populate the
 /// default KMS key ID so that GetBucketEncryption returns it (issue #3039).
 #[tokio::test]
+#[serial]
 async fn test_sse_kms_without_key_id_populates_default() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Testing SSE-KMS without explicit key ID populates default key");

crates/e2e_test/src/kms/configured_roundtrip_test.rs

@@ -20,6 +20,7 @@ use super::common::{
 };
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{BucketVersioningStatus, ServerSideEncryption, VersioningConfiguration};
+use serial_test::serial;
 use std::error::Error;
 use uuid::Uuid;
 
@@ -385,6 +386,7 @@ async fn assert_versioned_sse_kms_roundtrip_and_cleanup(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_configured_local_kms_admin_and_versioned_cleanup() -> TestResult {
     let mut env = LocalKMSTestEnvironment::new().await?;
     env.base_env.start_rustfs_server(Vec::new()).await?;
@@ -432,6 +434,7 @@ async fn test_configured_local_kms_admin_and_versioned_cleanup() -> TestResult {
 }
 
 #[tokio::test]
+#[serial]
 #[ignore = "requires a Vault binary"]
 async fn test_configured_vault_kms_admin_and_versioned_cleanup() -> TestResult {
     let mut env = VaultTestEnvironment::new().await?;

crates/e2e_test/src/kms/copy_object_self_copy_sse_test.rs

@@ -32,9 +32,11 @@ use aws_sdk_s3::types::{
     MetadataDirective, ServerSideEncryption, ServerSideEncryptionByDefault, ServerSideEncryptionConfiguration,
     ServerSideEncryptionRule,
 };
+use serial_test::serial;
 use tracing::info;
 
 #[tokio::test]
+#[serial]
 async fn test_metadata_replace_self_copy_of_sse_object_stays_decryptable() {
     init_logging();
     info!("same-key CopyObject with REPLACE metadata must not re-key an SSE-S3 object");
@@ -134,6 +136,7 @@ async fn test_metadata_replace_self_copy_of_sse_object_stays_decryptable() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_metadata_replace_self_copy_dropping_sse_rewrites_plaintext() {
     init_logging();
     info!("same-key CopyObject that drops SSE must rewrite the data, not orphan the ciphertext");
@@ -230,6 +233,7 @@ async fn test_metadata_replace_self_copy_dropping_sse_rewrites_plaintext() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_metadata_replace_self_copy_under_bucket_default_sse_stays_decryptable() {
     init_logging();
     info!("bucket default encryption must also keep a same-key copy off the metadata-only path");

crates/e2e_test/src/kms/copy_object_version_restore_sse_test.rs

@@ -25,9 +25,11 @@ use super::common::{LocalKMSTestEnvironment, create_key_with_specific_id};
 use crate::common::init_logging;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{BucketVersioningStatus, ServerSideEncryption, VersioningConfiguration};
+use serial_test::serial;
 use tracing::info;
 
 #[tokio::test]
+#[serial]
 async fn test_self_copy_of_historical_sse_s3_version_is_readable() {
     init_logging();
     info!("Issue #4238 (SSE): restoring an encrypted historical version must stay decryptable");

crates/e2e_test/src/kms/encryption_metadata_test.rs

@@ -22,6 +22,7 @@ use aws_sdk_s3::types::{
     CompletedMultipartUpload, CompletedPart, ServerSideEncryption, ServerSideEncryptionByDefault,
     ServerSideEncryptionConfiguration, ServerSideEncryptionRule,
 };
+use serial_test::serial;
 use std::collections::{HashMap, VecDeque};
 use tracing::info;
 
@@ -81,6 +82,7 @@ pub(super) fn assert_storage_encrypted(storage_root: &std::path::Path, bucket: &
 }
 
 #[tokio::test]
+#[serial]
 async fn test_head_reports_managed_metadata_for_sse_s3() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Validating SSE-S3 managed encryption metadata exposure");
@@ -141,6 +143,7 @@ async fn test_head_reports_managed_metadata_for_sse_s3() -> Result<(), Box<dyn s
 }
 
 #[tokio::test]
+#[serial]
 async fn test_head_reports_managed_metadata_for_sse_kms_and_copy() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Validating SSE-KMS managed encryption metadata (including copy)");
@@ -244,6 +247,7 @@ async fn test_head_reports_managed_metadata_for_sse_kms_and_copy() -> Result<(),
 }
 
 #[tokio::test]
+#[serial]
 async fn test_multipart_upload_writes_encrypted_data() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("Validating ciphertext persistence for multipart SSE-KMS uploads");

crates/e2e_test/src/kms/kms_authorization_negative_matrix_test.rs

@@ -35,6 +35,7 @@ use aws_sdk_s3::config::{Config, Credentials, Region};
 use aws_sdk_s3::error::ProvideErrorMetadata;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::ServerSideEncryption;
+use serial_test::serial;
 use std::time::Duration;
 use tracing::info;
 
@@ -208,6 +209,7 @@ fn disable_body(key_id: &str) -> String {
 
 /// Data-path matrix: SSE-KMS writes and reads are authorized against the resolved key.
 #[tokio::test]
+#[serial]
 async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
     init_logging();
 
@@ -353,6 +355,7 @@ async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
 /// Runs without the SSE enforcement switch: admin scoping is unconditional, and
 /// leaving the switch off proves the two planes are independent.
 #[tokio::test]
+#[serial]
 async fn kms_admin_per_key_authorization_negative_matrix() -> TestResult {
     init_logging();
 

crates/e2e_test/src/kms/kms_comprehensive_test.rs

@@ -24,11 +24,13 @@ use super::common::{
     test_sse_kms_encryption, test_sse_s3_encryption,
 };
 use crate::common::{TEST_BUCKET, init_logging};
+use serial_test::serial;
 use tokio::time::{Duration, sleep};
 use tracing::info;
 
 /// Comprehensive test: Full KMS workflow with all encryption types
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_kms_full_workflow() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🏁 Start the KMS full-featured synthesis test");
@@ -97,6 +99,7 @@ async fn test_mixed_encryption_workload(
 
 /// Comprehensive stress test: Large dataset with multiple encryption types
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_stress_test() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("💪 Start the KMS stress test");
@@ -131,6 +134,7 @@ async fn test_comprehensive_stress_test() -> Result<(), Box<dyn std::error::Erro
 
 /// Test encryption key isolation and security
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_key_isolation() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🔐 Begin the comprehensive test of encryption key isolation");
@@ -202,6 +206,7 @@ async fn test_comprehensive_key_isolation() -> Result<(), Box<dyn std::error::Er
 
 /// Test concurrent encryption operations
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_concurrent_operations() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("⚡ Started comprehensive testing of concurrent encryption operations");
@@ -247,6 +252,7 @@ async fn test_comprehensive_concurrent_operations() -> Result<(), Box<dyn std::e
 
 /// Test encryption/decryption performance with different file sizes
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_performance_benchmark() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("📊 Start KMS performance benchmarking");

crates/e2e_test/src/kms/kms_edge_cases_test.rs

@@ -26,6 +26,7 @@ use crate::common::{TEST_BUCKET, init_logging};
 use aws_sdk_s3::types::ServerSideEncryption;
 use base64::Engine;
 use md5::{Digest as Md5Digest, Md5};
+use serial_test::serial;
 use std::sync::Arc;
 use tokio::sync::Semaphore;
 use tracing::{info, warn};
@@ -38,6 +39,7 @@ fn md5_hex(input: impl AsRef<[u8]>) -> String {
 
 /// Test encryption of zero-byte files (empty files)
 #[tokio::test]
+#[serial]
 async fn test_kms_zero_byte_file_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS encryption with zero-byte files");
@@ -111,6 +113,7 @@ async fn test_kms_zero_byte_file_encryption() -> Result<(), Box<dyn std::error::
 
 /// Test encryption of single-byte files
 #[tokio::test]
+#[serial]
 async fn test_kms_single_byte_file_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS encryption with single-byte files");
@@ -203,6 +206,7 @@ async fn test_kms_single_byte_file_encryption() -> Result<(), Box<dyn std::error
 
 /// Test multipart upload boundary conditions (minimum 5MB part size)
 #[tokio::test]
+#[serial]
 async fn test_kms_multipart_boundary_conditions() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS multipart upload boundary conditions");
@@ -278,6 +282,7 @@ async fn test_kms_multipart_boundary_conditions() -> Result<(), Box<dyn std::err
 
 /// Test invalid key scenarios and error handling
 #[tokio::test]
+#[serial]
 async fn test_kms_invalid_key_scenarios() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS invalid key scenarios and error handling");
@@ -365,6 +370,7 @@ async fn test_kms_invalid_key_scenarios() -> Result<(), Box<dyn std::error::Erro
 
 /// Test concurrent encryption operations
 #[tokio::test]
+#[serial]
 async fn test_kms_concurrent_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS concurrent encryption operations");
@@ -472,6 +478,7 @@ async fn test_kms_concurrent_encryption() -> Result<(), Box<dyn std::error::Erro
 
 /// Test key validation and security properties
 #[tokio::test]
+#[serial]
 async fn test_kms_key_validation_security() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS key validation and security properties");

crates/e2e_test/src/kms/kms_fault_recovery_test.rs

@@ -24,6 +24,7 @@
 use super::common::LocalKMSTestEnvironment;
 use crate::common::{TEST_BUCKET, init_logging};
 use aws_sdk_s3::types::ServerSideEncryption;
+use serial_test::serial;
 use std::fs;
 use std::time::Duration;
 use tokio::time::sleep;
@@ -31,6 +32,7 @@ use tracing::{info, warn};
 
 /// Test KMS behavior when key directory is temporarily unavailable
 #[tokio::test]
+#[serial]
 async fn test_kms_key_directory_unavailable() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS behavior with unavailable key directory");
@@ -121,6 +123,7 @@ async fn test_kms_key_directory_unavailable() -> Result<(), Box<dyn std::error::
 
 /// Test handling of corrupted key files
 #[tokio::test]
+#[serial]
 async fn test_kms_corrupted_key_files() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS behavior with corrupted key files");
@@ -212,6 +215,7 @@ async fn test_kms_corrupted_key_files() -> Result<(), Box<dyn std::error::Error
 
 /// Test multipart upload interruption and recovery
 #[tokio::test]
+#[serial]
 async fn test_kms_multipart_upload_interruption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS multipart upload interruption and recovery");
@@ -395,6 +399,7 @@ async fn test_kms_multipart_upload_interruption() -> Result<(), Box<dyn std::err
 
 /// Test KMS resilience to temporary resource constraints
 #[tokio::test]
+#[serial]
 async fn test_kms_resource_constraints() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Testing KMS behavior under resource constraints");

crates/e2e_test/src/kms/kms_ilm_sse_kms_test.rs

@@ -51,6 +51,7 @@ use aws_sdk_s3::types::{
     TransitionStorageClass,
 };
 use serde::Deserialize;
+use serial_test::serial;
 use std::time::{Duration as StdDuration, Instant};
 use tracing::info;
 
@@ -423,6 +424,7 @@ async fn wait_for_restore_complete(client: &Client, bucket: &str, key: &str, dea
 /// filter as the cause of the deletion and proves the encrypted bucket stays
 /// readable end to end after the scanner has run.
 #[tokio::test]
+#[serial]
 async fn ilm_expiration_on_sse_kms_bucket_under_enforcement() -> TestResult {
     init_logging();
 
@@ -483,6 +485,7 @@ async fn ilm_expiration_on_sse_kms_bucket_under_enforcement() -> TestResult {
 /// (the mechanism `reliant/tiering.rs` established), so the test does not
 /// depend on scanner scheduling; the 1s scanner cycle stays on as a backstop.
 #[tokio::test]
+#[serial]
 async fn ilm_transition_on_sse_kms_bucket_under_enforcement_reads_back() -> TestResult {
     init_logging();
 

crates/e2e_test/src/kms/kms_local_test.rs

@@ -24,9 +24,11 @@ use super::common::{
     test_kms_key_management, test_sse_c_encryption,
 };
 use crate::common::{TEST_BUCKET, init_logging};
+use serial_test::serial;
 use tracing::{error, info};
 
 #[tokio::test]
+#[serial]
 async fn test_local_kms_end_to_end() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     if skip_if_kms_admin_tool_unavailable("test_local_kms_end_to_end") {
@@ -112,6 +114,7 @@ async fn test_local_kms_end_to_end() -> Result<(), Box<dyn std::error::Error + S
 }
 
 #[tokio::test]
+#[serial]
 async fn test_local_kms_key_isolation() {
     init_logging();
     info!("Starting Local KMS Key Isolation Test");
@@ -212,6 +215,7 @@ async fn test_local_kms_key_isolation() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_local_kms_large_file() {
     init_logging();
     info!("Starting Local KMS Large File Test");
@@ -294,6 +298,7 @@ async fn test_local_kms_large_file() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_local_kms_multipart_upload() {
     init_logging();
     info!("Starting Local KMS Multipart Upload Test");

crates/e2e_test/src/kms/multipart_encryption_test.rs

@@ -23,10 +23,12 @@
 
 use super::common::{LocalKMSTestEnvironment, sse_customer_key_md5_base64};
 use crate::common::{TEST_BUCKET, init_logging};
+use serial_test::serial;
 use tracing::{debug, info};
 
 /// Step 1: Test the basic single-file encryption function (ensure that SSE-S3 works properly in non-sharded scenarios)
 #[tokio::test]
+#[serial]
 async fn test_step1_basic_single_file_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Step 1: Test the basic single-file encryption function");
@@ -83,6 +85,7 @@ async fn test_step1_basic_single_file_encryption() -> Result<(), Box<dyn std::er
 
 /// Step 2: Test the unencrypted shard upload (make sure the shard upload base is working properly)
 #[tokio::test]
+#[serial]
 async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Step 2: Test unencrypted shard uploads");
@@ -181,6 +184,7 @@ async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Bo
 
 /// Step 3: Test Shard Upload + SSE-S3 Encryption (Focus Test)
 #[tokio::test]
+#[serial]
 async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Step 3: Test Shard Upload + SSE-S3 Encryption");
@@ -304,6 +308,7 @@ async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::er
 
 /// Step 4: test larger multipart uploads (streaming encryption)
 #[tokio::test]
+#[serial]
 async fn test_step4_large_multipart_upload_with_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Step 4: test large-file multipart encryption");
@@ -429,6 +434,7 @@ async fn test_step4_large_multipart_upload_with_encryption() -> Result<(), Box<d
 
 /// Step 5: test multipart uploads for every encryption mode
 #[tokio::test]
+#[serial]
 async fn test_step5_all_encryption_types_multipart() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     info!("🧪 Step 5: test multipart uploads for every encryption mode");

crates/e2e_test/src/kms/test_runner.rs

@@ -19,6 +19,7 @@
 //! filtering, and comprehensive reporting capabilities.
 
 use crate::common::init_logging;
+use serial_test::serial;
 use std::time::Instant;
 use tokio::time::{Duration, sleep};
 use tracing::{debug, error, info, warn};
@@ -457,6 +458,7 @@ impl KMSTestSuite {
 
 /// Quick test suite for critical tests only
 #[tokio::test]
+#[serial]
 async fn test_kms_critical_suite() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     let config = TestSuiteConfig {
         categories: vec![TestCategory::CoreFunctionality, TestCategory::MultipartEncryption],
@@ -479,6 +481,7 @@ async fn test_kms_critical_suite() -> Result<(), Box<dyn std::error::Error + Sen
 
 /// Full comprehensive test suite
 #[tokio::test]
+#[serial]
 async fn test_kms_full_suite() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     let suite = KMSTestSuite::new();
     let results = suite.run_test_suite().await;

crates/e2e_test/src/leading_slash_key_test.rs

@@ -24,6 +24,7 @@ mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::Client;
     use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
     use std::error::Error;
     use tracing::info;
 
@@ -35,6 +36,7 @@ mod tests {
     /// PUT with a leading-slash key must succeed and the object must be
     /// readable under the normalized key (leading slash stripped).
     #[tokio::test]
+    #[serial]
     async fn test_put_object_with_leading_slash_key() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         info!("Starting test: PUT object with leading slash in key (Issue #2427)");
@@ -92,6 +94,7 @@ mod tests {
 
     /// Duplicate and repeated slashes after a leading slash collapse MinIO-style.
     #[tokio::test]
+    #[serial]
     async fn test_put_object_with_duplicate_slashes_normalized() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         info!("Starting test: duplicate slash normalization (Issue #2427)");

crates/e2e_test/src/lifecycle_regression_test.rs

@@ -36,6 +36,7 @@ mod tests {
         BucketLifecycleConfiguration, BucketVersioningStatus, ExpirationStatus, LifecycleExpiration, LifecycleRule,
         LifecycleRuleFilter, NoncurrentVersionExpiration, VersioningConfiguration,
     };
+    use serial_test::serial;
     use std::error::Error;
     use tracing::info;
 
@@ -79,6 +80,7 @@ mod tests {
     ///
     /// This tests the rule persistence path (rustfs#4963: 3 days → 0 days).
     #[tokio::test]
+    #[serial]
     async fn test_lifecycle_expiration_rule_persists_correctly() -> TestResult {
         init_logging();
         info!("RT-03: lifecycle expiration rule persists correctly");
@@ -146,6 +148,7 @@ mod tests {
     /// Covers the pattern where noncurrent version expiration rules are
     /// accepted but old versions are never cleaned up.
     #[tokio::test]
+    #[serial]
     async fn test_lifecycle_noncurrent_version_expiration_rule_persists() -> TestResult {
         init_logging();
         info!("RT-03b: noncurrent version expiration rule persists");
@@ -230,6 +233,7 @@ mod tests {
     /// after restart. Transition rules require a configured remote tier
     /// (tested in reliant/tiering.rs), so this test uses expiration only.
     #[tokio::test]
+    #[serial]
     async fn test_lifecycle_prefix_rule_persists() -> TestResult {
         init_logging();
         info!("RT-04: lifecycle prefix rule persists");
@@ -290,6 +294,7 @@ mod tests {
     /// Regression pattern: DELETE on a versioned object fails or does not
     /// create a delete marker, or the delete marker is not visible in LIST.
     #[tokio::test]
+    #[serial]
     async fn test_delete_marker_creation_and_visibility() -> TestResult {
         init_logging();
         info!("RT-05b: delete marker creation and visibility");

crates/e2e_test/src/list_buckets_double_slash_test.rs

@@ -27,6 +27,7 @@ mod tests {
     use rustfs_signer::constants::UNSIGNED_PAYLOAD;
     use rustfs_signer::sign_v4;
     use s3s::Body;
+    use serial_test::serial;
     use std::error::Error;
 
     /// Sends a SigV4-signed `GET` where the signature is computed over `sign_path`
@@ -66,6 +67,7 @@ mod tests {
 
     /// `GET /` (path-style service call) returns `ListBuckets`.
     #[tokio::test]
+    #[serial]
     async fn test_list_buckets_single_slash() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -84,6 +86,7 @@ mod tests {
     /// compat layer rewrites `//` to `/` before `s3s` parses/verifies the request,
     /// so both routing and signature verification operate on `/`.
     #[tokio::test]
+    #[serial]
     async fn test_list_buckets_double_slash_browser_compat() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;
@@ -102,6 +105,7 @@ mod tests {
     /// (`GET //bucket`) must be left untouched by the compat layer — it is not a
     /// `ListBuckets` request and s3s continues to reject the empty bucket name.
     #[tokio::test]
+    #[serial]
     async fn test_double_slash_rewrite_is_narrowly_scoped() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
         let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/list_buckets_iam_filter_test.rs

@@ -15,6 +15,7 @@
 use crate::common::{RustFSTestEnvironment, admin_ok, build_test_s3_config, build_test_sts_client, init_logging};
 use aws_sdk_s3::Client;
 use aws_sdk_s3::error::ProvideErrorMetadata;
+use serial_test::serial;
 use tokio::time::{Duration, Instant};
 
 fn user_client(env: &RustFSTestEnvironment, access_key: &str, secret_key: &str, session_token: Option<&str>) -> Client {
@@ -75,6 +76,7 @@ async fn create_service_account(
 }
 
 #[tokio::test]
+#[serial]
 async fn list_buckets_filters_with_iam_bucket_resources() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/list_object_versions_metadata_extension_test.rs

@@ -24,6 +24,7 @@ mod tests {
     use rustfs_signer::constants::UNSIGNED_PAYLOAD;
     use rustfs_signer::sign_v4;
     use s3s::Body;
+    use serial_test::serial;
     use std::error::Error;
     use tracing::info;
 
@@ -53,6 +54,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_list_object_versions_metadata_extension_returns_metadata_tags_and_internal()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();

crates/e2e_test/src/list_object_versions_regression_test.rs

@@ -21,6 +21,7 @@ mod tests {
     use aws_sdk_s3::Client;
     use aws_sdk_s3::primitives::ByteStream;
     use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use serial_test::serial;
     use tracing::info;
 
     fn create_s3_client(env: &RustFSTestEnvironment) -> Client {
@@ -28,6 +29,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_list_object_versions_immediately_returns_latest_put_after_delete_marker() {
         init_logging();
         info!("🧪 TEST: ListObjectVersions returns the newest version immediately after put -> delete -> put");
@@ -180,6 +182,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_list_object_versions_prefix_with_marker_object_returns_children() {
         init_logging();
         info!("🧪 TEST: ListObjectVersions returns prefix children when a marker object also exists");

crates/e2e_test/src/list_objects_duplicates_test.rs

@@ -17,6 +17,7 @@ mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::Client;
     use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
     use tracing::info;
 
     /// Helper function to create an S3 client for testing
@@ -59,6 +60,7 @@ mod tests {
     /// The bug was that "folder/" (the object) and "folder/" (derived prefix) were both added to CommonPrefixes
     /// when delimiter was "/" because the deduplication check was explicitly skipped for "/" delimiter.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_unique_common_prefixes() {
         init_logging();
         info!("Starting test: ListObjectsV2 should return unique CommonPrefixes");
@@ -138,6 +140,7 @@ mod tests {
     /// When both "marker/subdir/" and "marker/subdir/file.txt" exist, listing with
     /// Prefix="marker/" must not duplicate "marker/subdir/file.txt" in Contents.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_unique_contents_with_explicit_directory_markers() {
         init_logging();
         info!("Starting test: ListObjectsV2 should return unique keys with explicit directory markers");
@@ -205,6 +208,7 @@ mod tests {
     /// and never produce the prefix entry `a/`. Delimiter="/" listings then
     /// returned Contents `a` but silently dropped CommonPrefix `a/`.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_object_and_same_named_prefix_coexist() {
         init_logging();
         info!("Starting test: ListObjectsV2 should return both object `a` and CommonPrefix `a/`");

crates/e2e_test/src/list_objects_v2_metadata_extension_test.rs

@@ -23,6 +23,7 @@ mod tests {
     use rustfs_signer::constants::UNSIGNED_PAYLOAD;
     use rustfs_signer::sign_v4;
     use s3s::Body;
+    use serial_test::serial;
     use std::error::Error;
     use tracing::info;
 
@@ -52,6 +53,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_metadata_extension_returns_metadata_tags_and_internal()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();

crates/e2e_test/src/list_objects_v2_pagination_test.rs

@@ -30,6 +30,7 @@ mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::Client;
     use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
     use std::collections::HashSet;
     use tracing::info;
 
@@ -60,6 +61,7 @@ mod tests {
     /// Test for Issue #2775: continuation forwarding must not
     /// skip a child directory when the prefix component repeats in the key.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_repeated_prefix_continuation() {
         init_logging();
         info!("Starting test: ListObjectsV2 repeated-prefix continuation");
@@ -185,6 +187,7 @@ mod tests {
     /// This is the core bug from issue #1596: the server was returning
     /// IsTruncated=true even when all objects fit within the requested max_keys.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_not_truncated_when_all_objects_returned() {
         init_logging();
         info!("Starting test: ListObjectsV2 should not be truncated when all objects fit within max_keys");
@@ -249,6 +252,7 @@ mod tests {
     /// 2. NextContinuationToken is returned (not NextMarker)
     /// 3. Using ContinuationToken fetches the remaining objects
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_pagination_with_continuation_token() {
         init_logging();
         info!("Starting test: ListObjectsV2 pagination with continuation token");
@@ -390,6 +394,7 @@ mod tests {
     /// Edge case: when max_keys exactly equals the number of objects,
     /// IsTruncated should be false.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_max_keys_equals_object_count() {
         init_logging();
         info!("Starting test: ListObjectsV2 with max_keys equal to object count");
@@ -450,6 +455,7 @@ mod tests {
     ///
     /// Edge case: IsTruncated should be false for empty bucket.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_empty_bucket() {
         init_logging();
         info!("Starting test: ListObjectsV2 with empty bucket");
@@ -489,6 +495,7 @@ mod tests {
 
     /// Test ListObjectsV2 caps max_keys above the service limit and still paginates.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_max_keys_above_limit_returns_token() {
         init_logging();
         info!("Starting test: ListObjectsV2 with max_keys above limit");
@@ -556,6 +563,7 @@ mod tests {
     /// S3 semantics: when max_keys is 0, the response should include no objects
     /// and IsTruncated should be false.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_max_keys_zero() {
         init_logging();
         info!("Starting test: ListObjectsV2 with max_keys=0");
@@ -612,6 +620,7 @@ mod tests {
     /// With max_keys=1000, all 5 visible results (3 prefixes + 2 objects) fit in one
     /// page, so IsTruncated must be false even though raw entry count is much larger.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_delimiter_collapsed_prefix_no_false_truncation() {
         init_logging();
         info!("Starting test: ListObjectsV2 delimiter collapsed-prefix no false truncation");
@@ -735,6 +744,7 @@ mod tests {
     /// Each page returns up to 50 CommonPrefixes. The server must correctly set
     /// IsTruncated and provide a valid continuation token across all pages.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_delimiter_small_page_traverses_all() {
         init_logging();
         info!("Starting test: ListObjectsV2 delimiter small page traverses all keys");
@@ -857,6 +867,7 @@ mod tests {
     /// but after delimiter collapse only 10 CommonPrefixes are visible (10 < 1000).
     /// IsTruncated must be false since there are no additional visible results.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_raw_exceeds_maxkeys_but_visible_below() {
         init_logging();
         info!("Starting test: ListObjectsV2 raw > MaxKeys but visible < MaxKeys after collapse");
@@ -959,6 +970,7 @@ mod tests {
     /// This complements test_list_objects_v2_max_keys_above_limit_returns_token which
     /// tests the non-delimiter case.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_maxkeys_above_limit_with_delimiter() {
         init_logging();
         info!("Starting test: ListObjectsV2 MaxKeys above limit with delimiter");
@@ -1029,6 +1041,7 @@ mod tests {
     /// the next page: with keys `a`, `a.txt`, `zz` and max_keys=1, page 2
     /// returned `zz` and `a.txt` was never listed.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_continuation_keeps_keys_after_marker_stem() {
         init_logging();
         info!("Starting test: continuation must not skip keys sorting below the cursor tag");

crates/e2e_test/src/listing_regression_test.rs

@@ -31,6 +31,7 @@
 mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
     use std::collections::HashSet;
     use std::error::Error;
     use tracing::info;
@@ -48,6 +49,7 @@ mod tests {
     /// 3. Verify all 100 keys are returned exactly once
     /// 4. Verify no duplicates or skipped keys
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_completeness_100_objects() -> TestResult {
         init_logging();
         info!("RT-06: listing completeness with 100 objects");
@@ -131,6 +133,7 @@ mod tests {
     /// Regression pattern: prefix filter returns empty or includes wrong keys
     /// (rustfs#5051: empty results for shallow prefixes).
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_prefix_filter_correctness() -> TestResult {
         init_logging();
         info!("RT-06b: prefix filter correctness");
@@ -230,6 +233,7 @@ mod tests {
     /// Regression pattern: delimiter handling produces incorrect CommonPrefixes
     /// or misses objects at the delimiter boundary.
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_delimiter_common_prefixes() -> TestResult {
         init_logging();
         info!("RT-06c: delimiter and CommonPrefixes");
@@ -286,6 +290,7 @@ mod tests {
     /// Regression pattern: IsTruncated=false when there are more objects
     /// (rustfs#4810: walk_dir timeout truncation with false IsTruncated).
     #[tokio::test]
+    #[serial]
     async fn test_list_objects_v2_is_truncated_correctness() -> TestResult {
         init_logging();
         info!("RT-06d: IsTruncated correctness");

crates/e2e_test/src/mc_mirror_small_bucket_test.rs

@@ -13,6 +13,7 @@
 // limitations under the License.
 
 use crate::common::{DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY, RustFSTestEnvironment};
+use serial_test::serial;
 use std::path::Path;
 use std::process::Command;
 use std::time::Duration;
@@ -72,6 +73,7 @@ fn count_files(root: &Path) -> usize {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_mc_mirror_small_bucket_completes_without_list_timeout() -> TestResult {
     crate::common::init_logging();
     info!("Starting issue #3107 mc mirror regression test");

crates/e2e_test/src/multipart_auth_test.rs

@@ -17,6 +17,7 @@
 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use async_compression::tokio::write::{BzEncoder, XzEncoder};
 use aws_sdk_s3::error::{ProvideErrorMetadata, SdkError};
+use aws_sdk_s3::operation::head_object::HeadObjectOutput;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{
     ServerSideEncryption, ServerSideEncryptionByDefault, ServerSideEncryptionConfiguration, ServerSideEncryptionRule,
@@ -348,6 +349,71 @@ async fn run_post_object_policy_case(
     Ok(())
 }
 
+/// One accepted POST Object upload driven end-to-end (backlog#1838): starts a
+/// fresh server, allows anonymous PutObject on `bucket`, posts an anonymous
+/// POST Object form whose policy carries `policy_conditions` and whose form
+/// carries `form_field` on top of the mandatory key+policy fields, then asserts
+/// 204 with an empty body, that `read_stored` observes the submitted value on
+/// the stored object, and that the object body round-tripped unchanged.
+/// `case` prefixes every assertion message so a failing table row is
+/// identifiable at a glance.
+#[allow(clippy::too_many_arguments)]
+async fn run_post_object_accept_case(
+    bucket: &str,
+    object_key: &str,
+    policy_conditions: Vec<serde_json::Value>,
+    form_field: (&str, &str),
+    file_mime: &str,
+    file_body: &[u8],
+    read_stored: fn(&HeadObjectOutput) -> Option<&str>,
+    case: &str,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(policy_conditions);
+
+    let (field_name, field_value) = form_field;
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text(field_name.to_string(), field_value.to_string())
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(file_body.to_vec())
+                .file_name("upload.txt")
+                .mime_str(file_mime)?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT, "[{case}] unexpected status");
+    assert!(
+        response_body.is_empty(),
+        "[{case}] 204 response should not contain a body, got: {response_body}"
+    );
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(read_stored(&head), Some(field_value), "[{case}] stored {field_name} mismatch");
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), file_body, "[{case}] uploaded body mismatch");
+
+    Ok(())
+}
+
 /// Table-driven fold of the nine `*_missing_from_policy_conditions` POST
 /// Object tests (backlog#1838 PR1). Every row keeps its original test's exact
 /// bucket, key, form field, file body, and expected error strings; the shared
@@ -1534,59 +1600,6 @@ async fn test_anonymous_post_object_accepts_sse_s3_missing_from_policy_condition
     Ok(())
 }
 
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_storage_class_exact_policy_match()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-storage-class";
-    let object_key = "post-storage-class-object.txt";
-    let expected_body = b"post-storage-class-body".to_vec();
-    let storage_class = "REDUCED_REDUNDANCY";
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!({ "x-amz-storage-class": storage_class }),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("x-amz-storage-class", storage_class)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str("text/plain")?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    assert_eq!(post_resp.status(), reqwest::StatusCode::NO_CONTENT);
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(head.storage_class().map(|value| value.as_str()), Some(storage_class));
-
-    let uploaded = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = uploaded.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
-
-    Ok(())
-}
-
 #[tokio::test]
 async fn test_anonymous_post_object_rejects_storage_class_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
@@ -2584,512 +2597,182 @@ async fn test_anonymous_post_object_rejects_success_action_redirect_missing_from
     Ok(())
 }
 
+/// Table-driven fold of the eleven accepted POST Object form-field tests
+/// (backlog#1838 PR4). Every row keeps its original test's exact bucket, key,
+/// form field, submitted value, policy condition, file MIME type, and file
+/// body; the shared shape is: the policy covers the field (exact condition or
+/// `starts-with` prefix), the form submits it, the upload returns 204 with an
+/// empty body, and the stored object echoes the submitted value back.
 #[tokio::test]
-async fn test_anonymous_post_object_accepts_metadata_field_covered_by_starts_with()
+async fn test_anonymous_post_object_accepts_fields_covered_by_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
+    // (case, bucket, object_key, field, submitted value, `starts-with` prefix
+    // (`None` pins the field to an exact policy condition), file part MIME type,
+    // file body, stored-value accessor)
+    type Case = (
+        &'static str,
+        &'static str,
+        &'static str,
+        &'static str,
+        &'static str,
+        Option<&'static str>,
+        &'static str,
+        &'static [u8],
+        fn(&HeadObjectOutput) -> Option<&str>,
+    );
+    let cases: &[Case] = &[
+        (
+            "storage-class",
+            "anon-post-storage-class",
+            "post-storage-class-object.txt",
+            "x-amz-storage-class",
+            "REDUCED_REDUNDANCY",
+            None,
+            "text/plain",
+            b"post-storage-class-body",
+            |head: &HeadObjectOutput| head.storage_class().map(|value| value.as_str()),
+        ),
+        (
+            "metadata-starts-with",
+            "anon-post-policy-meta-accept",
+            "uploads/meta-object.txt",
+            "x-amz-meta-project",
+            "alpha-demo",
+            Some("alpha-"),
+            "text/plain",
+            b"post-policy-meta-body",
+            |head: &HeadObjectOutput| head.metadata().and_then(|meta| meta.get("project")).map(String::as_str),
+        ),
+        (
+            "content-type",
+            "anon-post-policy-content-type-accept",
+            "uploads/content-type-accept.txt",
+            "Content-Type",
+            "text/plain",
+            None,
+            "text/plain",
+            b"post-policy-content-type-accept",
+            |head: &HeadObjectOutput| head.content_type(),
+        ),
+        (
+            "content-type-starts-with",
+            "anon-post-policy-content-type-accept",
+            "uploads/content-type-object.txt",
+            "Content-Type",
+            "image/png",
+            Some("image/"),
+            "image/png",
+            b"post-policy-content-type-body",
+            |head: &HeadObjectOutput| head.content_type(),
+        ),
+        (
+            "content-disposition",
+            "anon-post-policy-disposition-accept",
+            "uploads/disposition-object.txt",
+            "Content-Disposition",
+            "attachment; filename=\"upload.txt\"",
+            None,
+            "text/plain",
+            b"post-policy-disposition-body",
+            |head: &HeadObjectOutput| head.content_disposition(),
+        ),
+        (
+            "cache-control",
+            "anon-post-policy-cache-control-accept",
+            "uploads/cache-control-object.txt",
+            "Cache-Control",
+            "max-age=60",
+            None,
+            "text/plain",
+            b"post-policy-cache-control-body",
+            |head: &HeadObjectOutput| head.cache_control(),
+        ),
+        (
+            "content-language",
+            "anon-post-policy-content-language-accept",
+            "uploads/content-language-object.txt",
+            "Content-Language",
+            "en-US",
+            None,
+            "text/plain",
+            b"post-policy-content-language-body",
+            |head: &HeadObjectOutput| head.content_language(),
+        ),
+        (
+            "content-encoding",
+            "anon-post-policy-content-encoding-accept",
+            "uploads/content-encoding-object.txt",
+            "Content-Encoding",
+            "gzip",
+            None,
+            "text/plain",
+            b"post-policy-content-encoding-body",
+            |head: &HeadObjectOutput| head.content_encoding(),
+        ),
+        (
+            "website-redirect-location",
+            "anon-post-policy-website-redirect-accept",
+            "uploads/website-redirect-object.txt",
+            "x-amz-website-redirect-location",
+            "/docs/landing.html",
+            None,
+            "text/plain",
+            b"post-policy-website-redirect-body",
+            |head: &HeadObjectOutput| head.website_redirect_location(),
+        ),
+        (
+            "expires",
+            "anon-post-policy-expires-accept",
+            "uploads/expires-object.txt",
+            "Expires",
+            "Wed, 21 Oct 2037 07:28:00 GMT",
+            None,
+            "text/plain",
+            b"post-policy-expires-body",
+            |head: &HeadObjectOutput| head.expires_string(),
+        ),
+        (
+            "metadata-exact",
+            "anon-post-policy-meta-exact-accept",
+            "uploads/meta-exact-accept-object.txt",
+            "x-amz-meta-project",
+            "alpha-demo",
+            None,
+            "text/plain",
+            b"post-policy-meta-exact-body",
+            |head: &HeadObjectOutput| head.metadata().and_then(|meta| meta.get("project")).map(String::as_str),
+        ),
+    ];
 
-    let bucket = "anon-post-policy-meta-accept";
-    let object_key = "uploads/meta-object.txt";
-    let metadata_value = "alpha-demo";
-    let expected_body = b"post-policy-meta-body".to_vec();
+    for (case, bucket, object_key, field, value, starts_with_prefix, file_mime, file_body, read_stored) in cases {
+        let condition = match starts_with_prefix {
+            Some(prefix) => serde_json::json!(["starts-with", format!("${field}"), prefix]),
+            None => {
+                let mut exact = serde_json::Map::new();
+                exact.insert((*field).to_string(), serde_json::Value::String((*value).to_string()));
+                serde_json::Value::Object(exact)
+            }
+        };
 
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!(["starts-with", "$x-amz-meta-project", "alpha-"]),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("x-amz-meta-project", metadata_value)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str("text/plain")?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
+        run_post_object_accept_case(
+            bucket,
+            object_key,
+            vec![
+                serde_json::json!({ "bucket": bucket }),
+                serde_json::json!({ "key": object_key }),
+                condition,
+                serde_json::json!(["content-length-range", 0, 1024]),
+            ],
+            (field, value),
+            file_mime,
+            file_body,
+            *read_stored,
+            case,
+        )
         .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    let metadata = head.metadata().expect("head_object should expose uploaded metadata");
-    assert_eq!(metadata.get("project").map(String::as_str), Some(metadata_value));
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_content_type_field_exact_policy_match()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-policy-content-type-accept";
-    let object_key = "uploads/content-type-accept.txt";
-    let content_type = "text/plain";
-    let expected_body = b"post-policy-content-type-accept".to_vec();
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!({ "Content-Type": content_type }),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("Content-Type", content_type)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str(content_type)?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(head.content_type(), Some(content_type));
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_content_type_field_covered_by_starts_with()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-policy-content-type-accept";
-    let object_key = "uploads/content-type-object.txt";
-    let content_type = "image/png";
-    let expected_body = b"post-policy-content-type-body".to_vec();
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!(["starts-with", "$Content-Type", "image/"]),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("Content-Type", content_type)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str(content_type)?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(head.content_type(), Some(content_type));
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_content_disposition_field_exact_policy_match()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-policy-disposition-accept";
-    let object_key = "uploads/disposition-object.txt";
-    let content_disposition = "attachment; filename=\"upload.txt\"";
-    let expected_body = b"post-policy-disposition-body".to_vec();
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!({ "Content-Disposition": content_disposition }),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("Content-Disposition", content_disposition)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str("text/plain")?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(head.content_disposition(), Some(content_disposition));
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_cache_control_field_exact_policy_match()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-policy-cache-control-accept";
-    let object_key = "uploads/cache-control-object.txt";
-    let cache_control = "max-age=60";
-    let expected_body = b"post-policy-cache-control-body".to_vec();
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!({ "Cache-Control": cache_control }),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("Cache-Control", cache_control)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str("text/plain")?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(head.cache_control(), Some(cache_control));
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_content_language_field_exact_policy_match()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-policy-content-language-accept";
-    let object_key = "uploads/content-language-object.txt";
-    let content_language = "en-US";
-    let expected_body = b"post-policy-content-language-body".to_vec();
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!({ "Content-Language": content_language }),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("Content-Language", content_language)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str("text/plain")?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(head.content_language(), Some(content_language));
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_content_encoding_field_exact_policy_match()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-policy-content-encoding-accept";
-    let object_key = "uploads/content-encoding-object.txt";
-    let content_encoding = "gzip";
-    let expected_body = b"post-policy-content-encoding-body".to_vec();
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!({ "Content-Encoding": content_encoding }),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("Content-Encoding", content_encoding)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str("text/plain")?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(head.content_encoding(), Some(content_encoding));
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_website_redirect_location_exact_policy_match()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-policy-website-redirect-accept";
-    let object_key = "uploads/website-redirect-object.txt";
-    let website_redirect_location = "/docs/landing.html";
-    let expected_body = b"post-policy-website-redirect-body".to_vec();
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!({ "x-amz-website-redirect-location": website_redirect_location }),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("x-amz-website-redirect-location", website_redirect_location)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str("text/plain")?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(head.website_redirect_location(), Some(website_redirect_location));
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
-
-    Ok(())
-}
-
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_expires_field_exact_policy_match()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-policy-expires-accept";
-    let object_key = "uploads/expires-object.txt";
-    let expires = "Wed, 21 Oct 2037 07:28:00 GMT";
-    let expected_body = b"post-policy-expires-body".to_vec();
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!({ "Expires": expires }),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("Expires", expires)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str("text/plain")?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(head.expires_string(), Some(expires));
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+    }
 
     Ok(())
 }
@@ -3440,64 +3123,6 @@ async fn test_anonymous_post_object_accepts_tagging_field_exact_policy_match()
     Ok(())
 }
 
-#[tokio::test]
-async fn test_anonymous_post_object_accepts_metadata_field_exact_policy_match()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "anon-post-policy-meta-exact-accept";
-    let object_key = "uploads/meta-exact-accept-object.txt";
-    let metadata_value = "alpha-demo";
-    let expected_body = b"post-policy-meta-exact-body".to_vec();
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(vec![
-        serde_json::json!({ "bucket": bucket }),
-        serde_json::json!({ "key": object_key }),
-        serde_json::json!({ "x-amz-meta-project": metadata_value }),
-        serde_json::json!(["content-length-range", 0, 1024]),
-    ]);
-
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text("x-amz-meta-project", metadata_value)
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(expected_body.clone())
-                .file_name("upload.txt")
-                .mime_str("text/plain")?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
-    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    let metadata = head.metadata().expect("head_object should expose uploaded metadata");
-    assert_eq!(metadata.get("project").map(String::as_str), Some(metadata_value));
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
-
-    Ok(())
-}
-
 #[tokio::test]
 async fn test_anonymous_post_object_allows_x_ignore_fields_outside_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {

crates/e2e_test/src/namespace_lock_quorum_test.rs

@@ -16,6 +16,7 @@ use crate::common::RustFSTestClusterEnvironment;
 use aws_sdk_s3::Client;
 use aws_sdk_s3::error::SdkError;
 use bytes::Bytes;
+use serial_test::serial;
 use std::sync::Arc;
 use tokio::sync::Barrier;
 use tracing::{info, warn};
@@ -50,6 +51,7 @@ fn format_s3_error(err: SdkError<aws_sdk_s3::operation::put_object::PutObjectErr
 }
 
 #[tokio::test]
+#[serial]
 async fn test_concurrent_cluster_overwrites_do_not_fail_namespace_lock_quorum() -> TestResult {
     crate::common::init_logging();
     info!("Starting namespace lock quorum regression test with auto cluster");
@@ -126,6 +128,7 @@ async fn test_concurrent_cluster_overwrites_do_not_fail_namespace_lock_quorum()
 /// `StorageError::other(...)` → `StorageError::Io(...)`, which fell through to
 /// `S3ErrorCode::InternalError` (500) in the error mapping.
 #[tokio::test]
+#[serial]
 async fn test_concurrent_put_same_key_never_returns_500() -> TestResult {
     crate::common::init_logging();
     info!("Starting concurrent PUT 500 regression test");

crates/e2e_test/src/negative_sigv4_test.rs

@@ -37,6 +37,7 @@ use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use aws_sdk_s3::primitives::ByteStream;
 use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::request_signature_v4::{SIGN_V4_ALGORITHM, get_scope, get_signature, get_signing_key};
+use serial_test::serial;
 use std::fmt::Write as _;
 use time::macros::format_description;
 use time::{Duration, OffsetDateTime};
@@ -182,6 +183,7 @@ async fn setup(env: &mut RustFSTestEnvironment) -> Result<(), Box<dyn std::error
 /// this, every negative assertion below could pass for the wrong reason (a
 /// broken signer that never produces a valid signature).
 #[tokio::test]
+#[serial]
 async fn valid_header_sigv4_request_succeeds() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -212,6 +214,7 @@ async fn valid_header_sigv4_request_succeeds() -> Result<(), Box<dyn std::error:
 /// (a) Tampering the `Signature=` component must be rejected with
 /// SignatureDoesNotMatch / 403.
 #[tokio::test]
+#[serial]
 async fn tampered_signature_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -251,6 +254,7 @@ async fn tampered_signature_returns_signature_does_not_match() -> Result<(), Box
 /// (b) A valid AccessKeyId paired with the wrong secret key must be rejected
 /// with SignatureDoesNotMatch / 403.
 #[tokio::test]
+#[serial]
 async fn wrong_secret_key_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -275,6 +279,7 @@ async fn wrong_secret_key_returns_signature_does_not_match() -> Result<(), Box<d
 /// signature itself is valid (it covers the *declared* hash), so the server is
 /// forced to detect the payload/hash mismatch while streaming the body.
 #[tokio::test]
+#[serial]
 async fn tampered_payload_is_rejected() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -315,6 +320,7 @@ async fn tampered_payload_is_rejected() -> Result<(), Box<dyn std::error::Error
 /// x-amz-date both derive from the same skewed timestamp, so skew — not a
 /// signature mismatch — is the failure.
 #[tokio::test]
+#[serial]
 async fn skewed_date_returns_request_time_too_skewed() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -338,6 +344,7 @@ async fn skewed_date_returns_request_time_too_skewed() -> Result<(), Box<dyn std
 /// structurally invalid SigV4 header that must be rejected before any
 /// credential/service handling.
 #[tokio::test]
+#[serial]
 async fn malformed_authorization_header_returns_clean_4xx() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/notification_startup_regression_test.rs

@@ -32,6 +32,7 @@
 mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use serial_test::serial;
     use std::error::Error;
     use tracing::info;
 
@@ -46,6 +47,7 @@ mod tests {
     /// starts successfully with notification enabled and can serve S3 requests.
     /// A full webhook delivery test is in notification_webhook_test.rs.
     #[tokio::test]
+    #[serial]
     async fn test_notification_enabled_server_starts_cleanly() -> TestResult {
         init_logging();
         info!("RT-01: notification enabled server starts cleanly");
@@ -90,6 +92,7 @@ mod tests {
     /// 3. Restart server
     /// 4. Verify notification config still exists
     #[tokio::test]
+    #[serial]
     async fn test_notification_config_survives_restart() -> TestResult {
         init_logging();
         info!("RT-02: notification config survives restart");

crates/e2e_test/src/notification_webhook_test.rs

@@ -47,6 +47,7 @@ use rustfs_utils::egress::ENV_OUTBOUND_ALLOW_ORIGINS;
 use rustfs_utils::http::headers::{AMZ_REQUEST_ID, REQUEST_ID_HEADER};
 use s3s::Body;
 use serde_json::Value;
+use serial_test::serial;
 use std::error::Error;
 use std::io::Cursor;
 use std::path::Path;
@@ -624,6 +625,7 @@ fn assert_generated_request_id_correlation(record: &Value, request_id: &str) {
 /// RUSTFS_NOTIFY_ENABLE, an HTTPS webhook using a configured CA must become
 /// online and receive a real S3 event POST.
 #[tokio::test]
+#[serial]
 async fn test_https_webhook_target_delivers_event_with_notify_env_enabled() -> TestResult {
     init_logging();
 
@@ -678,6 +680,7 @@ async fn test_https_webhook_target_delivers_event_with_notify_env_enabled() -> T
 /// PUT / multipart-complete / DELETE each deliver one event with correct fields,
 /// and the prefix/suffix filter drops non-matching keys.
 #[tokio::test]
+#[serial]
 async fn test_webhook_event_delivery_and_filtering() -> TestResult {
     init_logging();
 
@@ -897,6 +900,7 @@ async fn test_webhook_event_delivery_and_filtering() -> TestResult {
 /// An event queued while the target endpoint rejects delivery survives on the
 /// durable store and is redelivered once the endpoint comes back.
 #[tokio::test]
+#[serial]
 async fn test_webhook_redelivers_event_after_target_recovers() -> TestResult {
     init_logging();
 

crates/e2e_test/src/object_lambda_test.rs

@@ -20,6 +20,7 @@ use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::{pre_sign_v4, sign_v4};
 use rustfs_utils::egress::ENV_OUTBOUND_ALLOW_ORIGINS;
 use s3s::Body;
+use serial_test::serial;
 use std::collections::HashMap;
 use std::error::Error;
 use time::OffsetDateTime;
@@ -547,6 +548,7 @@ async fn read_listen_notification_event(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_notification_target_persists_across_restart_and_delete() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -606,6 +608,7 @@ async fn test_notification_target_persists_across_restart_and_delete() -> Result
 }
 
 #[tokio::test]
+#[serial]
 async fn test_notification_target_with_path_is_online_via_transport_probe() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -638,6 +641,7 @@ async fn test_notification_target_with_path_is_online_via_transport_probe() -> R
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_accepts_presigned_requests() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -678,6 +682,7 @@ async fn test_get_object_lambda_accepts_presigned_requests() -> Result<(), Box<d
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_accepts_named_webhook_target_arn() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -717,6 +722,7 @@ async fn test_get_object_lambda_accepts_named_webhook_target_arn() -> Result<(),
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_invokes_runtime_webhook_target() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -784,6 +790,7 @@ async fn test_get_object_lambda_invokes_runtime_webhook_target() -> Result<(), B
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_passthroughs_non_success_webhook_response() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -843,6 +850,7 @@ async fn test_get_object_lambda_passthroughs_non_success_webhook_response() -> R
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_success_response_without_auth_headers() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -888,6 +896,7 @@ async fn test_get_object_lambda_rejects_success_response_without_auth_headers()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_success_response_with_mismatched_auth_headers() -> Result<(), Box<dyn Error + Send + Sync>>
 {
     init_logging();
@@ -934,6 +943,7 @@ async fn test_get_object_lambda_rejects_success_response_with_mismatched_auth_he
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_unsupported_target_type() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -970,6 +980,7 @@ async fn test_get_object_lambda_rejects_unsupported_target_type() -> Result<(),
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_unconfigured_target() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -1006,6 +1017,7 @@ async fn test_get_object_lambda_rejects_unconfigured_target() -> Result<(), Box<
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_disabled_target() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -1051,6 +1063,7 @@ async fn test_get_object_lambda_rejects_disabled_target() -> Result<(), Box<dyn
 }
 
 #[tokio::test]
+#[serial]
 async fn test_configure_object_lambda_target_rejects_invalid_endpoint() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -1093,6 +1106,7 @@ async fn test_configure_object_lambda_target_rejects_invalid_endpoint() -> Resul
 }
 
 #[tokio::test]
+#[serial]
 async fn test_configure_object_lambda_notify_webhook_rejects_response_header_timeout_key()
 -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
@@ -1126,6 +1140,7 @@ async fn test_configure_object_lambda_notify_webhook_rejects_response_header_tim
 }
 
 #[tokio::test]
+#[serial]
 async fn test_listen_notification_emits_after_put_object() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -1169,6 +1184,7 @@ async fn test_listen_notification_emits_after_put_object() -> Result<(), Box<dyn
 }
 
 #[tokio::test]
+#[serial]
 async fn test_listen_notification_emits_on_empty_bucket_when_notify_disabled() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -1203,6 +1219,7 @@ async fn test_listen_notification_emits_on_empty_bucket_when_notify_disabled() -
 }
 
 #[tokio::test]
+#[serial]
 async fn test_listen_notification_fans_in_remote_node_events() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 

crates/e2e_test/src/overwrite_cleanup_regression_test.rs

@@ -13,6 +13,7 @@
 // limitations under the License.
 
 use aws_sdk_s3::primitives::ByteStream;
+use serial_test::serial;
 use std::path::{Path, PathBuf};
 use uuid::Uuid;
 
@@ -23,6 +24,7 @@ const TEST_OBJECT: &str = "large-object.bin";
 const PAYLOAD_SIZE: usize = 512 * 1024;
 
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 async fn unversioned_overwrite_removes_previous_physical_data_dir() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 

crates/e2e_test/src/presigned_negative_test.rs

@@ -43,6 +43,7 @@ use aws_sdk_s3::presigning::{PresignedRequest, PresigningConfig};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::{Client, Config};
 use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
+use serial_test::serial;
 use std::time::{Duration, SystemTime};
 use tracing::info;
 
@@ -156,6 +157,7 @@ async fn setup(env: &mut RustFSTestEnvironment) -> Result<(), Box<dyn std::error
 /// stored bytes. Without this, every negative assertion could pass for the
 /// wrong reason (a server that rejects all presigned URLs).
 #[tokio::test]
+#[serial]
 async fn valid_presigned_get_succeeds() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -180,6 +182,7 @@ async fn valid_presigned_get_succeeds() -> Result<(), Box<dyn std::error::Error
 /// Positive control (PUT): a valid presigned PUT must store the object, which we
 /// verify with a follow-up authenticated HEAD.
 #[tokio::test]
+#[serial]
 async fn valid_presigned_put_succeeds() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -208,6 +211,7 @@ async fn valid_presigned_put_succeeds() -> Result<(), Box<dyn std::error::Error
 /// ("Request has expired"). s3s checks expiry BEFORE the signature, so the
 /// signature here is otherwise valid — only the elapsed window is at fault.
 #[tokio::test]
+#[serial]
 async fn expired_presigned_get_is_rejected() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -232,6 +236,7 @@ async fn expired_presigned_get_is_rejected() -> Result<(), Box<dyn std::error::E
 /// (b) Tampering the `X-Amz-Signature` query value must be rejected with 403 /
 /// SignatureDoesNotMatch.
 #[tokio::test]
+#[serial]
 async fn tampered_signature_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -257,6 +262,7 @@ async fn tampered_signature_returns_signature_does_not_match() -> Result<(), Box
 /// (c) A presigned URL generated with the WRONG secret (but the real access key
 /// id) must be rejected with 403 / SignatureDoesNotMatch.
 #[tokio::test]
+#[serial]
 async fn wrong_secret_key_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -284,6 +290,7 @@ async fn wrong_secret_key_returns_signature_does_not_match() -> Result<(), Box<d
 /// check runs during auth, before any object lookup, so the swapped key need
 /// not even exist.
 #[tokio::test]
+#[serial]
 async fn tampered_target_key_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -318,6 +325,7 @@ async fn tampered_target_key_returns_signature_does_not_match() -> Result<(), Bo
 /// (e / acceptance 4 negative half) Tampering the signature of a presigned PUT
 /// must be rejected with 403 / SignatureDoesNotMatch — the write must not land.
 #[tokio::test]
+#[serial]
 async fn tampered_presigned_put_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/protocols/test_runner.rs

@@ -22,6 +22,7 @@ use crate::protocols::sftp_compliance::{
 };
 use crate::protocols::sftp_core::{test_sftp_core_operations, test_sftp_idle_timeout_disconnects};
 use crate::protocols::webdav_core::test_webdav_core_operations;
+use serial_test::serial;
 use std::time::Instant;
 use tokio::time::{Duration, sleep};
 use tracing::{error, info};
@@ -228,6 +229,7 @@ fn all_protocol_tests() -> Vec<TestDefinition> {
 
 /// Test suite
 #[tokio::test]
+#[serial]
 async fn test_protocol_core_suite() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     let suite = ProtocolTestSuite::new();
     let results = suite.run_test_suite().await;

crates/e2e_test/src/quota_test.rs

@@ -15,6 +15,7 @@
 use crate::common::{RustFSTestEnvironment, admin_request, awscurl_delete, awscurl_get, awscurl_post, awscurl_put, init_logging};
 use aws_sdk_s3::Client;
 use http::{Method, StatusCode};
+use serial_test::serial;
 use tokio::time::{Duration, sleep, timeout};
 use tracing::{debug, info};
 
@@ -254,6 +255,7 @@ mod integration_tests {
     use aws_sdk_s3::error::ProvideErrorMetadata;
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_basic_operations() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -298,6 +300,7 @@ mod integration_tests {
     /// with 400 UnexpectedContent, and an over-quota aws-chunked PUT must still get the quota
     /// rejection.
     #[tokio::test]
+    #[serial]
     async fn test_quota_admission_aws_chunked_declared_encoding() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -349,6 +352,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_update_and_clear() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -384,6 +388,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_delete_operations() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -420,6 +425,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_usage_tracking() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -458,6 +464,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_statistics() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -491,6 +498,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_check_api() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -531,6 +539,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_multiple_buckets() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -571,6 +580,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_error_handling() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -606,6 +616,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_http_endpoints() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -671,6 +682,7 @@ mod integration_tests {
 
     /// Test that a normal user with `readwrite` policy can read quota but cannot set/clear quota.
     #[tokio::test]
+    #[serial]
     async fn test_quota_normal_user_permissions() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -726,6 +738,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_copy_operations() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -771,6 +784,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_batch_delete() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {
@@ -829,6 +843,7 @@ mod integration_tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_quota_multipart_upload() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
         if skip_without_awscurl() {

crates/e2e_test/src/reliant/conditional_writes.rs

@@ -6,6 +6,7 @@ use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::error::SdkError;
 use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
 use bytes::Bytes;
+use serial_test::serial;
 use std::error::Error;
 
 const ENDPOINT: &str = "http://localhost:9000";
@@ -88,6 +89,7 @@ fn generate_test_key(prefix: &str) -> String {
 }
 
 #[tokio::test]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_conditional_put_okay() -> Result<(), Box<dyn std::error::Error>> {
     let client = create_aws_s3_client().await?;
@@ -130,6 +132,7 @@ async fn test_conditional_put_okay() -> Result<(), Box<dyn std::error::Error>> {
 }
 
 #[tokio::test]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_conditional_put_failed() -> Result<(), Box<dyn std::error::Error>> {
     let client = create_aws_s3_client().await?;
@@ -192,6 +195,7 @@ async fn test_conditional_put_failed() -> Result<(), Box<dyn std::error::Error>>
 }
 
 #[tokio::test]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_conditional_put_when_object_does_not_exist() -> Result<(), Box<dyn std::error::Error>> {
     let client = create_aws_s3_client().await?;
@@ -236,6 +240,7 @@ async fn test_conditional_put_when_object_does_not_exist() -> Result<(), Box<dyn
 }
 
 #[tokio::test]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_conditional_multi_part_upload() -> Result<(), Box<dyn std::error::Error>> {
     let client = create_aws_s3_client().await?;

crates/e2e_test/src/reliant/get_deleted_object_test.rs

@@ -24,6 +24,7 @@ use aws_sdk_s3::Client;
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::error::SdkError;
 use bytes::Bytes;
+use serial_test::serial;
 use std::error::Error;
 use tracing::info;
 
@@ -69,6 +70,7 @@ async fn setup_test_bucket(client: &Client) -> Result<(), Box<dyn Error>> {
 }
 
 #[tokio::test]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_get_deleted_object_returns_nosuchkey() -> Result<(), Box<dyn std::error::Error>> {
     // Initialize logging
@@ -142,6 +144,7 @@ async fn test_get_deleted_object_returns_nosuchkey() -> Result<(), Box<dyn std::
 
 /// Test that HeadObject on a deleted object also returns NoSuchKey
 #[tokio::test]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_head_deleted_object_returns_nosuchkey() -> Result<(), Box<dyn std::error::Error>> {
     let _ = tracing_subscriber::fmt()
@@ -193,6 +196,7 @@ async fn test_head_deleted_object_returns_nosuchkey() -> Result<(), Box<dyn std:
 
 /// Test GetObject with non-existent key (never existed)
 #[tokio::test]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_get_nonexistent_object_returns_nosuchkey() -> Result<(), Box<dyn std::error::Error>> {
     let _ = tracing_subscriber::fmt()
@@ -229,6 +233,7 @@ async fn test_get_nonexistent_object_returns_nosuchkey() -> Result<(), Box<dyn s
 /// Test multiple consecutive GetObject calls on deleted object
 /// This ensures the fix is stable and doesn't have race conditions
 #[tokio::test]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_multiple_gets_deleted_object() -> Result<(), Box<dyn std::error::Error>> {
     let _ = tracing_subscriber::fmt()

crates/e2e_test/src/reliant/head_deleted_object_versioning_test.rs

@@ -25,6 +25,7 @@ use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::error::SdkError;
 use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
 use bytes::Bytes;
+use serial_test::serial;
 use std::error::Error;
 use tracing::info;
 
@@ -84,6 +85,7 @@ async fn setup_test_bucket(client: &Client) -> Result<(), Box<dyn Error>> {
 
 /// Test that HeadObject on a deleted object returns NoSuchKey when versioning is enabled
 #[tokio::test]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_head_deleted_object_versioning_returns_nosuchkey() -> Result<(), Box<dyn std::error::Error>> {
     let _ = tracing_subscriber::fmt()

crates/e2e_test/src/reliant/head_tls_bodyless_test.rs

@@ -30,6 +30,7 @@ use reqwest::{Certificate, Client, Response, StatusCode};
 use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use s3s::Body;
+use serial_test::serial;
 use std::error::Error;
 use std::path::Path;
 use std::process::Command;
@@ -156,6 +157,7 @@ async fn start_tls_rustfs_server(env: &mut RustFSTestEnvironment, tls_dir: &Path
 }
 
 #[tokio::test]
+#[serial]
 async fn test_head_missing_object_over_tls_http2_is_bodyless() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 

crates/e2e_test/src/reliant/sql.rs

@@ -20,6 +20,7 @@ use aws_sdk_s3::types::{
     CsvInput, CsvOutput, ExpressionType, FileHeaderInfo, InputSerialization, JsonInput, JsonOutput, JsonType, OutputSerialization,
 };
 use bytes::Bytes;
+use serial_test::serial;
 use std::error::Error;
 
 const ENDPOINT: &str = "http://localhost:9000";
@@ -117,6 +118,7 @@ async fn process_select_response(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_select_object_content_csv_basic() -> Result<(), Box<dyn Error>> {
     let client = create_aws_s3_client().await?;
@@ -158,6 +160,7 @@ async fn test_select_object_content_csv_basic() -> Result<(), Box<dyn Error>> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_select_object_content_csv_aggregation() -> Result<(), Box<dyn Error>> {
     let client = create_aws_s3_client().await?;
@@ -203,6 +206,7 @@ async fn test_select_object_content_csv_aggregation() -> Result<(), Box<dyn Erro
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_select_object_content_json_basic() -> Result<(), Box<dyn Error>> {
     let client = create_aws_s3_client().await?;
@@ -244,6 +248,7 @@ async fn test_select_object_content_json_basic() -> Result<(), Box<dyn Error>> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_select_object_content_csv_limit() -> Result<(), Box<dyn Error>> {
     let client = create_aws_s3_client().await?;
@@ -286,6 +291,7 @@ async fn test_select_object_content_csv_limit() -> Result<(), Box<dyn Error>> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_select_object_content_csv_order_by() -> Result<(), Box<dyn Error>> {
     let client = create_aws_s3_client().await?;
@@ -331,6 +337,7 @@ async fn test_select_object_content_csv_order_by() -> Result<(), Box<dyn Error>>
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_select_object_content_error_handling() -> Result<(), Box<dyn Error>> {
     let client = create_aws_s3_client().await?;
@@ -366,6 +373,7 @@ async fn test_select_object_content_error_handling() -> Result<(), Box<dyn Error
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[serial]
 #[ignore = "requires running RustFS server at localhost:9000"]
 async fn test_select_object_content_nonexistent_object() -> Result<(), Box<dyn Error>> {
     let client = create_aws_s3_client().await?;

crates/e2e_test/src/replication_extension_test.rs

@@ -60,6 +60,7 @@ use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use s3s::Body;
 use s3s::header::X_AMZ_REPLICATION_STATUS;
+use serial_test::serial;
 use sha2::{Digest, Sha256};
 use std::collections::BTreeMap;
 use std::convert::Infallible;
@@ -4629,6 +4630,7 @@ async fn test_bucket_replication_sse_c_multipart_passthrough() -> TestResult {
 /// fails without any PUT reaching the target (capability cache, proven from
 /// the target journal); plaintext objects still replicate COMPLETED.
 #[tokio::test]
+#[serial]
 async fn test_ssec_replication_fails_closed_when_target_drops_passthrough_headers() -> TestResult {
     init_logging();
 
@@ -4738,6 +4740,7 @@ async fn test_ssec_replication_fails_closed_when_target_drops_passthrough_header
 /// a capability limit, and a plaintext-only deployment against a MinIO-like
 /// target must not turn red.
 #[tokio::test]
+#[serial]
 async fn test_replication_check_flags_ssec_passthrough_dropping_target() -> TestResult {
     init_logging();
 
@@ -4828,6 +4831,7 @@ async fn test_replication_check_flags_ssec_passthrough_dropping_target() -> Test
 /// HEAD-back audit against the recovered RustFS target — and the replica must
 /// be readable with the customer key.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_sse_c_heals_after_target_outage() -> TestResult {
     init_logging();
 
@@ -4920,6 +4924,7 @@ async fn test_bucket_replication_sse_c_heals_after_target_outage() -> TestResult
 /// the existing-object resync (`replicate_all` transport, N2-audited), land as
 /// a REPLICA, and read back with the customer key.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_sse_c_existing_object_resync() -> TestResult {
     init_logging();
 
@@ -8814,6 +8819,7 @@ async fn start_read_proxy_lab(
 /// headers are forwarded verbatim, and an inbound request that was itself
 /// proxied is answered locally (404) without touching the target.
 #[tokio::test]
+#[serial]
 async fn test_get_and_head_proxy_unreplicated_object_to_replication_target() -> TestResult {
     init_logging();
 
@@ -8996,6 +9002,7 @@ async fn test_get_and_head_proxy_unreplicated_object_to_replication_target() ->
 /// proxied to the replication target with the anti-loop marker, mirroring
 /// MinIO `proxyGetTaggingToRepTarget`.
 #[tokio::test]
+#[serial]
 async fn test_get_object_tagging_proxies_unreplicated_object_to_replication_target() -> TestResult {
     init_logging();
 

crates/e2e_test/src/security_boundary_test.rs

@@ -25,6 +25,7 @@ use crate::common::{RustFSTestEnvironment, awscurl_available, awscurl_put, init_
 use aws_sdk_s3::error::ProvideErrorMetadata;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart, Tag, Tagging};
+use serial_test::serial;
 use std::error::Error;
 use tracing::info;
 
@@ -35,6 +36,7 @@ use tracing::info;
 /// far beyond that limit and assert the server rejects it with the specific
 /// error, rather than accepting an arbitrarily large control-plane body.
 #[tokio::test]
+#[serial]
 async fn test_large_xml_body_rejection() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -90,6 +92,7 @@ async fn test_large_xml_body_rejection() -> Result<(), Box<dyn Error + Send + Sy
 
 /// Excessive multipart parts must be rejected.
 #[tokio::test]
+#[serial]
 async fn test_excessive_multipart_parts() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -146,6 +149,7 @@ async fn test_excessive_multipart_parts() -> Result<(), Box<dyn Error + Send + S
 /// (last-writer-wins, no torn/garbage state) and that it is absent after a
 /// subsequent delete.
 #[tokio::test]
+#[serial]
 async fn test_concurrent_object_operations() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
     let mut env = RustFSTestEnvironment::new().await?;
@@ -228,6 +232,7 @@ async fn test_concurrent_object_operations() -> Result<(), Box<dyn Error + Send
 /// pattern used by the other admin-API E2E tests in this crate; the test is
 /// skipped when `awscurl` is not installed.
 #[tokio::test]
+#[serial]
 async fn test_tiering_url_validation() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
     if !awscurl_available() {

crates/e2e_test/src/server_startup_failfast_test.rs

@@ -23,6 +23,7 @@
 #[cfg(test)]
 mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging, rustfs_binary_path};
+    use serial_test::serial;
     use std::net::TcpListener;
     use std::time::{Duration, Instant};
 
@@ -30,6 +31,7 @@ mod tests {
     /// while :9001 is occupied: the server exits at startup, and the harness
     /// must surface that promptly rather than waiting out the 60s timeout.
     #[tokio::test]
+    #[serial]
     async fn test_start_fails_fast_when_server_exits_during_startup() {
         init_logging();
 

crates/e2e_test/src/snowball_auto_extract_test.rs

@@ -17,6 +17,7 @@ mod tests {
     use crate::common::{RustFSTestEnvironment, init_logging};
     use aws_sdk_s3::error::ProvideErrorMetadata;
     use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
     use std::error::Error;
     use std::io::Cursor;
 
@@ -100,6 +101,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn snowball_auto_extract_supports_minio_prefix_and_directory_markers() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
 
@@ -136,6 +138,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn snowball_auto_extract_supports_standard_headers_with_combined_extract_options()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
@@ -226,6 +229,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn snowball_auto_extract_ignores_directories_when_requested() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
 
@@ -264,6 +268,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn snowball_auto_extract_ignores_invalid_entries_when_requested() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
 
@@ -299,6 +304,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn snowball_auto_extract_rejects_parent_dir_entry_without_cross_bucket_write()
     -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
@@ -341,6 +347,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn snowball_auto_extract_prefers_exact_minio_prefix_over_suffix_fallback() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
 

crates/e2e_test/src/special_chars_test.rs

@@ -34,6 +34,7 @@ mod tests {
     use rustfs_signer::constants::UNSIGNED_PAYLOAD;
     use rustfs_signer::sign_v4;
     use s3s::Body;
+    use serial_test::serial;
     use std::error::Error;
     use tracing::{debug, info};
 
@@ -92,6 +93,7 @@ mod tests {
     /// mc cp README.md "local/dummy/a%20f+/b/c/3/README.md"
     /// ```
     #[tokio::test]
+    #[serial]
     async fn test_object_with_space_in_path() {
         init_logging();
         info!("Starting test: object with space in path");
@@ -173,6 +175,7 @@ mod tests {
     /// /test/data/org_main-org/dashboards/ES+net/LHC+Data+Challenge/firefly-details.json
     /// ```
     #[tokio::test]
+    #[serial]
     async fn test_object_with_plus_in_path() {
         init_logging();
         info!("Starting test: object with plus sign in path");
@@ -242,6 +245,7 @@ mod tests {
 
     /// Test with mixed special characters
     #[tokio::test]
+    #[serial]
     async fn test_object_with_mixed_special_chars() {
         init_logging();
         info!("Starting test: object with mixed special characters");
@@ -301,6 +305,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_signed_get_missing_object_with_trailing_equals_returns_no_such_key() -> Result<(), Box<dyn Error + Send + Sync>>
     {
         init_logging();
@@ -329,6 +334,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_signed_get_existing_object_with_trailing_equals_returns_content() -> Result<(), Box<dyn Error + Send + Sync>> {
         init_logging();
 
@@ -367,6 +373,7 @@ mod tests {
 
     /// Test DELETE operation with special characters
     #[tokio::test]
+    #[serial]
     async fn test_delete_object_with_special_chars() {
         init_logging();
         info!("Starting test: DELETE object with special characters");
@@ -414,6 +421,7 @@ mod tests {
 
     /// Test exact scenario from the issue
     #[tokio::test]
+    #[serial]
     async fn test_issue_scenario_exact() {
         init_logging();
         info!("Starting test: Exact scenario from GitHub issue");
@@ -486,6 +494,7 @@ mod tests {
 
     /// Test HEAD object with special characters
     #[tokio::test]
+    #[serial]
     async fn test_head_object_with_special_chars() {
         init_logging();
         info!("Starting test: HEAD object with special characters");
@@ -529,6 +538,7 @@ mod tests {
 
     /// Test COPY object with special characters in both source and destination
     #[tokio::test]
+    #[serial]
     async fn test_copy_object_with_special_chars() {
         init_logging();
         info!("Starting test: COPY object with special characters");
@@ -587,6 +597,7 @@ mod tests {
 
     /// Test Unicode characters in object keys
     #[tokio::test]
+    #[serial]
     async fn test_unicode_characters_in_path() {
         init_logging();
         info!("Starting test: Unicode characters in object paths");
@@ -650,6 +661,7 @@ mod tests {
 
     /// Test special characters in different parts of the path
     #[tokio::test]
+    #[serial]
     async fn test_special_chars_in_different_path_positions() {
         init_logging();
         info!("Starting test: Special characters in different path positions");
@@ -707,6 +719,7 @@ mod tests {
 
     /// Test that control characters are properly rejected
     #[tokio::test]
+    #[serial]
     async fn test_control_characters_rejected() {
         init_logging();
         info!("Starting test: Control characters should be rejected");
@@ -756,6 +769,7 @@ mod tests {
 
     /// Test LIST with various special character prefixes
     #[tokio::test]
+    #[serial]
     async fn test_list_with_special_char_prefixes() {
         init_logging();
         info!("Starting test: LIST with special character prefixes");
@@ -824,6 +838,7 @@ mod tests {
 
     /// Test delimiter-based listing with special characters
     #[tokio::test]
+    #[serial]
     async fn test_list_with_delimiter_and_special_chars() {
         init_logging();
         info!("Starting test: LIST with delimiter and special characters");

crates/e2e_test/src/stale_multipart_cleanup_cluster_test.rs

@@ -16,6 +16,7 @@ use crate::common::{RustFSTestClusterEnvironment, init_logging};
 use aws_sdk_s3::error::SdkError;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::CompletedMultipartUpload;
+use serial_test::serial;
 use tokio::time::{Duration, sleep};
 use tracing::info;
 use uuid::Uuid;
@@ -100,6 +101,7 @@ async fn wait_for_cleanup_on_all_nodes(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_stale_multipart_cleanup_removes_incomplete_upload_across_cluster()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();

crates/e2e_test/src/sts_query_compat_test.rs

@@ -25,6 +25,7 @@ use hyper::server::conn::http1;
 use hyper::service::service_fn;
 use hyper_util::rt::TokioIo;
 use serde_json::Value;
+use serial_test::serial;
 use std::collections::BTreeSet;
 use std::convert::Infallible;
 use std::error::Error;
@@ -349,6 +350,7 @@ impl Drop for OpaMock {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_sts_query_responses_are_aws_sdk_compatible() -> TestResult {
     init_logging();
 
@@ -485,6 +487,7 @@ async fn test_sts_query_responses_are_aws_sdk_compatible() -> TestResult {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_sts_assume_role_opa_contract() -> TestResult {
     init_logging();
 
@@ -556,6 +559,7 @@ async fn test_sts_assume_role_opa_contract() -> TestResult {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_list_buckets_opa_contract() -> TestResult {
     init_logging();
 
@@ -641,6 +645,7 @@ async fn test_list_buckets_opa_contract() -> TestResult {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_sts_and_list_buckets_fail_closed_while_opa_is_initializing() -> TestResult {
     init_logging();
 
@@ -657,6 +662,7 @@ async fn test_sts_and_list_buckets_fail_closed_while_opa_is_initializing() -> Te
 }
 
 #[tokio::test]
+#[serial]
 async fn test_sts_and_list_buckets_fail_closed_after_opa_validation_failure() -> TestResult {
     init_logging();
 
@@ -673,6 +679,7 @@ async fn test_sts_and_list_buckets_fail_closed_after_opa_validation_failure() ->
 }
 
 #[tokio::test]
+#[serial]
 async fn test_sts_query_rate_limit_error_is_aws_sdk_compatible() -> TestResult {
     init_logging();
 

crates/e2e_test/src/tier_transition_regression_test.rs

@@ -30,6 +30,7 @@
 mod tests {
     use crate::common::{RustFSTestEnvironment, admin_ok, init_logging};
     use serde_json::Value;
+    use serial_test::serial;
     use std::error::Error;
     use tracing::info;
 
@@ -41,6 +42,7 @@ mod tests {
     /// validates that an expiration-only rule (the persistence path) survives
     /// a server restart.
     #[tokio::test]
+    #[serial]
     async fn test_lifecycle_rule_persists_after_restart() -> TestResult {
         init_logging();
         info!("RT-13: lifecycle rule persists after restart");
@@ -103,6 +105,7 @@ mod tests {
     /// Regression pattern: tier add/verify/delete API fails or the tier
     /// configuration is not persisted (rustfs#5218).
     #[tokio::test]
+    #[serial]
     async fn test_admin_tier_list_endpoint_returns_json() -> TestResult {
         init_logging();
         info!("RT-13b: admin tier list endpoint returns JSON");
@@ -132,6 +135,7 @@ mod tests {
     /// is not persisted (rustfs#5013), causing the scanner to not run or
     /// use stale settings.
     #[tokio::test]
+    #[serial]
     async fn test_scanner_config_persists_after_restart() -> TestResult {
         init_logging();
         info!("RT-13c: scanner config persists after restart");

crates/e2e_test/src/tls_hot_reload_test.rs

@@ -34,6 +34,7 @@ use rcgen::generate_simple_self_signed;
 use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
 use rustls::pki_types::{CertificateDer, ServerName, UnixTime};
 use rustls::{ClientConfig, ClientConnection, DigitallySignedStruct, Error as RustlsError, SignatureScheme, StreamOwned};
+use serial_test::serial;
 use sha2::{Digest, Sha256};
 use std::error::Error;
 use std::io::{Read, Write};
@@ -241,6 +242,7 @@ async fn roundtrip_and_return(mut session: TlsSession) -> Result<TlsSession, Box
 }
 
 #[tokio::test]
+#[serial]
 async fn test_tls_certificate_hot_reload_live_listener() -> TestResult {
     init_logging();
     // Install the process-wide rustls crypto provider (idempotent).

crates/e2e_test/src/version_id_regression_test.rs

@@ -27,6 +27,7 @@ mod tests {
     use aws_sdk_s3::Client;
     use aws_sdk_s3::primitives::ByteStream;
     use aws_sdk_s3::types::{BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, VersioningConfiguration};
+    use serial_test::serial;
     use tracing::info;
 
     fn create_s3_client(env: &RustFSTestEnvironment) -> Client {
@@ -85,6 +86,7 @@ mod tests {
     /// Test 1: PutObject should return version_id when versioning is enabled
     /// This directly addresses the Veeam issue from #1066
     #[tokio::test]
+    #[serial]
     async fn test_put_object_returns_version_id_with_versioning() {
         init_logging();
         info!("🧪 TEST: PutObject returns version_id with versioning enabled");
@@ -128,6 +130,7 @@ mod tests {
 
     /// Test 2: CopyObject should return version_id when versioning is enabled
     #[tokio::test]
+    #[serial]
     async fn test_copy_object_returns_version_id_with_versioning() {
         init_logging();
         info!("🧪 TEST: CopyObject returns version_id with versioning enabled");
@@ -182,6 +185,7 @@ mod tests {
 
     /// Test 3: CompleteMultipartUpload should return version_id when versioning is enabled
     #[tokio::test]
+    #[serial]
     async fn test_multipart_upload_returns_version_id_with_versioning() {
         init_logging();
         info!("🧪 TEST: CompleteMultipartUpload returns version_id with versioning enabled");
@@ -256,6 +260,7 @@ mod tests {
     /// Test 4: PutObject should NOT return version_id when versioning is NOT enabled
     /// This ensures we didn't break non-versioned buckets
     #[tokio::test]
+    #[serial]
     async fn test_put_object_without_versioning() {
         init_logging();
         info!("🧪 TEST: PutObject behavior without versioning (no regression)");
@@ -291,6 +296,7 @@ mod tests {
 
     /// Test 5: Basic S3 operations still work correctly (no regression)
     #[tokio::test]
+    #[serial]
     async fn test_basic_s3_operations_no_regression() {
         init_logging();
         info!("🧪 TEST: Basic S3 operations work correctly (no regression)");
@@ -357,6 +363,7 @@ mod tests {
     /// Test 6: Veeam-specific scenario simulation
     /// Simulates the exact workflow that Veeam uses when backing up data
     #[tokio::test]
+    #[serial]
     async fn test_veeam_backup_workflow_simulation() {
         init_logging();
         info!("🧪 TEST: Veeam VBR backup workflow simulation (Issue #1066)");
@@ -406,6 +413,7 @@ mod tests {
     }
 
     #[tokio::test]
+    #[serial]
     async fn test_terraform_put_after_delete() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         init_logging();
 
@@ -448,6 +456,7 @@ mod tests {
 
     /// Test 7: PutObject should omit version_id when versioning is Suspended
     #[tokio::test]
+    #[serial]
     async fn test_put_object_omits_version_id_with_suspended_versioning() {
         init_logging();
         info!("🧪 TEST: PutObject omits version_id with versioning suspended");
@@ -491,6 +500,7 @@ mod tests {
 
     /// Test 8: CopyObject should omit version_id when versioning is Suspended
     #[tokio::test]
+    #[serial]
     async fn test_copy_object_omits_version_id_with_suspended_versioning() {
         init_logging();
         info!("🧪 TEST: CopyObject omits version_id with versioning suspended");
@@ -541,6 +551,7 @@ mod tests {
 
     /// Test 9: CompleteMultipartUpload should omit version_id when versioning is Suspended
     #[tokio::test]
+    #[serial]
     async fn test_multipart_upload_omits_version_id_with_suspended_versioning() {
         init_logging();
         info!("🧪 TEST: CompleteMultipartUpload omits version_id with versioning suspended");

crates/ecstore/src/disk/error.rs

@@ -853,13 +853,32 @@ mod tests {
 
     #[test]
     fn test_error_conversions() {
-        // Test From implementations
+        // A plain io::Error carries no typed payload to recover, so it lands in
+        // `Io` rather than being guessed at from its kind — `NotFound` here must
+        // not silently become `FileNotFound`, which quorum aggregation counts as
+        // a different error (rustfs/backlog#1836).
         let io_error = std::io::Error::new(std::io::ErrorKind::NotFound, "test");
-        let _disk_error: DiskError = io_error.into();
+        let disk_error: DiskError = io_error.into();
+        match &disk_error {
+            DiskError::Io(inner) => assert_eq!(inner.kind(), std::io::ErrorKind::NotFound),
+            other => panic!("a plain io::Error must stay typed as Io, got {other:?}"),
+        }
 
-        let json_str = r#"{"invalid": json}"#; // Invalid JSON
+        // A typed DiskError boxed through io::Error round-trips back to itself
+        // instead of degrading to `Io`.
+        let boxed: std::io::Error = std::io::Error::other(DiskError::VolumeNotFound);
+        assert_eq!(DiskError::from(boxed), DiskError::VolumeNotFound);
+
+        // serde_json errors have no dedicated variant and fold into `other`,
+        // keeping the original message.
+        let json_str = r#"{"invalid": json}"#;
         let json_error = serde_json::from_str::<serde_json::Value>(json_str).unwrap_err();
-        let _disk_error: DiskError = json_error.into();
+        let json_message = json_error.to_string();
+        let disk_error: DiskError = json_error.into();
+        assert!(
+            disk_error.to_string().contains(&json_message),
+            "the json error message must survive the conversion: {disk_error}"
+        );
     }
 
     #[test]

crates/heal/src/heal/replacement_readiness.rs

@@ -157,4 +157,219 @@ mod tests {
         )
         .await;
     }
+
+    #[cfg(target_os = "linux")]
+    mod linux_privileged_tests {
+        use super::*;
+        use std::error::Error;
+        use std::path::Path;
+        use std::process::Command;
+
+        const ENABLE_ENV: &str = "RUSTFS_PRIVILEGED_MOUNT_READINESS_TESTS";
+        const NAMESPACE_ENV: &str = "RUSTFS_PRIVILEGED_MOUNT_READINESS_TESTS_IN_NAMESPACE";
+        const MOUNT_SIZE: &str = "size=32m,mode=0700";
+
+        struct MountGuard {
+            mounts: Vec<std::path::PathBuf>,
+        }
+
+        impl MountGuard {
+            fn new() -> Result<Self, Box<dyn Error + Send + Sync>> {
+                run_command("mount", &["--make-rprivate", "/"])?;
+                Ok(Self { mounts: Vec::new() })
+            }
+
+            fn mount_tmpfs(&mut self, target: &Path, label: &str) -> Result<(), Box<dyn Error + Send + Sync>> {
+                mount_tmpfs(target, label)?;
+                self.mounts.push(target.to_path_buf());
+                Ok(())
+            }
+
+            fn mount_bind(&mut self, source: &Path, target: &Path) -> Result<(), Box<dyn Error + Send + Sync>> {
+                mount_bind(source, target)?;
+                self.mounts.push(target.to_path_buf());
+                Ok(())
+            }
+        }
+
+        impl Drop for MountGuard {
+            fn drop(&mut self) {
+                for mount in self.mounts.iter().rev() {
+                    let _ = detach_mount(mount);
+                }
+            }
+        }
+
+        fn run_command(program: &str, args: &[&str]) -> Result<(), Box<dyn Error + Send + Sync>> {
+            let output = Command::new(program).args(args).output()?;
+            if output.status.success() {
+                return Ok(());
+            }
+            Err(format!(
+                "{program} {} failed with status {}: stdout={} stderr={}",
+                args.join(" "),
+                output.status,
+                String::from_utf8_lossy(&output.stdout),
+                String::from_utf8_lossy(&output.stderr)
+            )
+            .into())
+        }
+
+        fn path_to_string(path: &Path, label: &str) -> Result<String, Box<dyn Error + Send + Sync>> {
+            path.to_str()
+                .map(str::to_owned)
+                .ok_or_else(|| format!("{label} path is not UTF-8: {path:?}").into())
+        }
+
+        fn mount_tmpfs(target: &Path, label: &str) -> Result<(), Box<dyn Error + Send + Sync>> {
+            let target = path_to_string(target, "tmpfs target")?;
+            run_command("mount", &["-t", "tmpfs", "-o", MOUNT_SIZE, label, &target])
+        }
+
+        fn mount_bind(source: &Path, target: &Path) -> Result<(), Box<dyn Error + Send + Sync>> {
+            let source = path_to_string(source, "bind source")?;
+            let target = path_to_string(target, "bind target")?;
+            run_command("mount", &["--bind", &source, &target])
+        }
+
+        fn detach_mount(target: &Path) -> Result<(), Box<dyn Error + Send + Sync>> {
+            let target = path_to_string(target, "umount target")?;
+            run_command("umount", &[&target])
+        }
+
+        fn privileged_enabled() -> Result<bool, Box<dyn Error + Send + Sync>> {
+            let enabled = std::env::var(ENABLE_ENV)
+                .ok()
+                .is_some_and(|value| matches!(value.as_str(), "1" | "true" | "TRUE" | "yes" | "YES"));
+            if !enabled {
+                return Ok(false);
+            }
+            Ok(true)
+        }
+
+        fn run_current_test_in_mount_namespace() -> Result<(), Box<dyn Error + Send + Sync>> {
+            let test_name = std::thread::current()
+                .name()
+                .ok_or("privileged mount readiness test thread is unnamed")?
+                .to_owned();
+            let test_binary = std::env::current_exe()?;
+            let status = Command::new("unshare")
+                .arg("--mount")
+                .arg("--propagation")
+                .arg("private")
+                .arg("--")
+                .arg(test_binary)
+                .arg("--exact")
+                .arg(test_name)
+                .arg("--ignored")
+                .arg("--nocapture")
+                .env(NAMESPACE_ENV, "1")
+                .status()?;
+            if status.success() {
+                return Ok(());
+            }
+            Err(format!("{ENABLE_ENV}=1 requires Linux root or CAP_SYS_ADMIN; unshare exited with status {status}").into())
+        }
+
+        fn run_privileged_mount_test<F, Fut>(test: F) -> Result<(), Box<dyn Error + Send + Sync>>
+        where
+            F: FnOnce(MountGuard) -> Fut + Send + 'static,
+            Fut: std::future::Future<Output = Result<(), Box<dyn Error + Send + Sync>>> + 'static,
+        {
+            if !privileged_enabled()? {
+                return Ok(());
+            }
+            if std::env::var_os(NAMESPACE_ENV).is_none() {
+                return run_current_test_in_mount_namespace();
+            }
+
+            let guard = MountGuard::new()?;
+            let runtime = tokio::runtime::Builder::new_current_thread().enable_all().build()?;
+            runtime.block_on(test(guard))
+        }
+
+        #[test]
+        #[ignore = "requires Linux root/CAP_SYS_ADMIN and RUSTFS_PRIVILEGED_MOUNT_READINESS_TESTS=1"]
+        fn auto_replacement_readiness_accepts_an_independent_mount() -> Result<(), Box<dyn Error + Send + Sync>> {
+            run_privileged_mount_test(|mut mounts| async move {
+                let temp = TempDir::new().expect("temporary replacement roots should be created");
+                let target = temp.path().join("target");
+                let sibling = temp.path().join("sibling");
+                std::fs::create_dir(&target).expect("target mountpoint should be created");
+                std::fs::create_dir(&sibling).expect("sibling mountpoint should be created");
+                mounts.mount_tmpfs(&target, "rustfs-readiness-target")?;
+                mounts.mount_tmpfs(&sibling, "rustfs-readiness-sibling")?;
+
+                let target_endpoint = Endpoint::try_from(target.to_string_lossy().as_ref())?;
+                let sibling_endpoint = Endpoint::try_from(sibling.to_string_lossy().as_ref())?;
+                let target_disk = new_disk(
+                    &target_endpoint,
+                    &DiskOption {
+                        cleanup: false,
+                        health_check: false,
+                    },
+                )
+                .await?;
+                let sibling_disk = new_disk(
+                    &sibling_endpoint,
+                    &DiskOption {
+                        cleanup: false,
+                        health_check: false,
+                    },
+                )
+                .await?;
+
+                let identity = auto_replacement_target_identity(&target_disk, &[target_disk.clone(), sibling_disk.clone()]).await;
+                assert!(
+                    identity.is_some(),
+                    "a separately mounted replacement target with no sibling device overlap must be admitted"
+                );
+                Ok(())
+            })
+        }
+
+        #[test]
+        #[ignore = "requires Linux root/CAP_SYS_ADMIN and RUSTFS_PRIVILEGED_MOUNT_READINESS_TESTS=1"]
+        fn auto_replacement_readiness_rejects_a_same_device_sibling_bind_mount() -> Result<(), Box<dyn Error + Send + Sync>> {
+            run_privileged_mount_test(|mut mounts| async move {
+                let temp = TempDir::new().expect("temporary replacement roots should be created");
+                let source = temp.path().join("source");
+                let target = temp.path().join("target");
+                let sibling = temp.path().join("sibling");
+                std::fs::create_dir(&source).expect("source mountpoint should be created");
+                std::fs::create_dir(&target).expect("target mountpoint should be created");
+                std::fs::create_dir(&sibling).expect("sibling mountpoint should be created");
+                mounts.mount_tmpfs(&source, "rustfs-readiness-shared-source")?;
+                mounts.mount_bind(&source, &target)?;
+                mounts.mount_bind(&source, &sibling)?;
+
+                let target_endpoint = Endpoint::try_from(target.to_string_lossy().as_ref())?;
+                let sibling_endpoint = Endpoint::try_from(sibling.to_string_lossy().as_ref())?;
+                let target_disk = new_disk(
+                    &target_endpoint,
+                    &DiskOption {
+                        cleanup: false,
+                        health_check: false,
+                    },
+                )
+                .await?;
+                let sibling_disk = new_disk(
+                    &sibling_endpoint,
+                    &DiskOption {
+                        cleanup: false,
+                        health_check: false,
+                    },
+                )
+                .await?;
+
+                assert!(
+                    auto_replacement_target_identity(&target_disk, &[target_disk.clone(), sibling_disk.clone()])
+                        .await
+                        .is_none(),
+                    "replacement readiness must reject a target sharing its physical device with a sibling endpoint"
+                );
+                Ok(())
+            })
+        }
+    }
 }

crates/io-core/src/io_profile.rs

@@ -436,30 +436,45 @@ mod tests {
         assert_eq!(unknown_profile.sequential_boost_multiplier, 1.0);
     }
 
-    #[cfg(target_os = "linux")]
+    // What platform probing returns depends on the machine, so these pin the two
+    // rules that do not: the override wins over probing, and probing that is
+    // switched off reports Unknown rather than guessing (rustfs/backlog#1836).
     #[test]
-    fn test_linux_storage_detection_exists() {
-        // This test just verifies the detection function exists and doesn't panic
-        // The actual result depends on the system it's running on
-        let result = detect_storage_media(true, "");
-        // We should get some result (not panic)
-        match result {
-            StorageMedia::Nvme | StorageMedia::Ssd | StorageMedia::Hdd | StorageMedia::Unknown => {
-                // All valid results
-            }
+    fn storage_media_override_wins_over_platform_detection() {
+        for (override_value, expected) in [
+            ("nvme", StorageMedia::Nvme),
+            ("ssd", StorageMedia::Ssd),
+            ("hdd", StorageMedia::Hdd),
+        ] {
+            assert_eq!(detect_storage_media(true, override_value), expected);
+            assert_eq!(
+                detect_storage_media(false, override_value),
+                expected,
+                "an override must be honoured even with detection disabled"
+            );
         }
     }
 
-    #[cfg(target_os = "macos")]
     #[test]
-    fn test_macos_storage_detection_exists() {
-        // This test just verifies the detection function exists and doesn't panic
-        let result = detect_storage_media(true, "");
-        // We should get some result (not panic)
-        match result {
-            StorageMedia::Nvme | StorageMedia::Ssd | StorageMedia::Hdd | StorageMedia::Unknown => {
-                // All valid results
-            }
-        }
+    fn disabled_detection_reports_unknown_instead_of_guessing() {
+        assert_eq!(detect_storage_media(false, ""), StorageMedia::Unknown);
+        assert_eq!(
+            detect_storage_media(false, "not-a-medium"),
+            StorageMedia::Unknown,
+            "an unparseable override falls through to the disabled path"
+        );
+    }
+
+    #[test]
+    fn enabled_detection_returns_a_medium_for_this_platform() {
+        // Whatever this machine reports, it must be one of the known variants and
+        // it must be stable across calls — a probe that flapped would make the
+        // scheduler's profile depend on when it asked.
+        let first = detect_storage_media(true, "");
+        assert!(matches!(
+            first,
+            StorageMedia::Nvme | StorageMedia::Ssd | StorageMedia::Hdd | StorageMedia::Unknown
+        ));
+        assert_eq!(detect_storage_media(true, ""), first);
     }
 }

crates/notify/src/runtime_facade.rs

@@ -527,9 +527,19 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn runtime_facade_stops_empty_replay_workers() {
+    async fn stopping_replay_workers_is_a_no_op_when_there_are_none() {
         let (facade, _, _) = build_facade();
+
         facade.stop_replay_workers().await;
+
+        // The stop path takes the worker list and hands it to the adapter, so an
+        // empty facade must come back with the list still empty and dispatch
+        // released rather than left paused (rustfs/backlog#1836).
+        assert!(facade.replay_workers.read().await.is_empty());
+
+        // Calling it twice must stay harmless: shutdown paths do exactly that.
+        facade.stop_replay_workers().await;
+        assert!(facade.replay_workers.read().await.is_empty());
     }
 
     #[tokio::test]

crates/s3-types/src/event_name.rs

@@ -873,9 +873,16 @@ mod tests {
     /// now return a finite, non-panicking mask.
     #[test]
     fn test_mask_never_recurses_for_any_variant() {
-        for ev in ALL_EVENT_NAMES {
-            // Must terminate (no infinite recursion / stack overflow).
-            let _ = ev.mask();
+        // Terminating is the point — a regression here overflows the stack rather
+        // than failing an assertion — but the masks are collected and checked so
+        // the loop cannot be optimised into nothing and so a variant that starts
+        // returning an empty mask is caught too (rustfs/backlog#1836).
+        let masks: Vec<u64> = ALL_EVENT_NAMES.iter().map(|ev| ev.mask()).collect();
+
+        assert_eq!(masks.len(), ALL_EVENT_NAMES.len());
+        for (ev, mask) in ALL_EVENT_NAMES.iter().zip(&masks) {
+            assert_ne!(*mask, 0, "{ev:?} must carry at least one bit");
+            assert_eq!(ev.mask(), *mask, "{ev:?} must return the same mask every call");
         }
     }
 

docs/testing/e2e-suite-inventory.md

@@ -63,7 +63,7 @@
 | list_objects_v2_metadata_extension_test | 1 |  |
 | list_objects_v2_pagination_test | 12 | ✅ |
 | mc_mirror_small_bucket_test | 1 |  |
-| multipart_auth_test | 85 |  |
+| multipart_auth_test | 75 |  |
 | multipart_storage_class_test | 3 | ✅ |
 | namespace_lock_quorum_test | 2 |  |
 | negative_sigv4_test | 6 | ✅ |

rustfs/src/server/layer.rs

@@ -747,11 +747,12 @@ pub struct S3ErrorMessageCompatService<S> {
     inner: S,
 }
 
-impl<S, RestBody, GrpcBody> Service<HttpRequest<Incoming>> for S3ErrorMessageCompatService<S>
+impl<S, ReqBody, RestBody, GrpcBody> Service<HttpRequest<ReqBody>> for S3ErrorMessageCompatService<S>
 where
-    S: Service<HttpRequest<Incoming>, Response = Response<HybridBody<RestBody, GrpcBody>>> + Clone + Send + 'static,
+    S: Service<HttpRequest<ReqBody>, Response = Response<HybridBody<RestBody, GrpcBody>>> + Clone + Send + 'static,
     S::Future: Send + 'static,
     S::Error: Send + 'static,
+    ReqBody: Send + 'static,
     RestBody: Body<Data = Bytes> + From<Bytes> + Send + 'static,
     RestBody::Error: Into<S::Error> + Send + 'static,
     GrpcBody: Send + 'static,
@@ -764,28 +765,27 @@ where
         self.inner.poll_ready(cx)
     }
 
-    fn call(&mut self, req: HttpRequest<Incoming>) -> Self::Future {
+    fn call(&mut self, req: HttpRequest<ReqBody>) -> Self::Future {
         let is_sts_query =
             req.method() == Method::POST && req.uri().path() == "/" && req.extensions().get::<StsQueryRequest>().is_some();
         let mut inner = self.inner.clone();
 
         Box::pin(async move {
             let response = inner.call(req).await?;
+            if is_sts_query || response.status() != StatusCode::FORBIDDEN || !is_xml_response(response.headers()) {
+                return Ok(response);
+            }
+
             let (parts, body) = response.into_parts();
-            let should_fix = !is_sts_query && parts.status == StatusCode::FORBIDDEN && is_xml_response(&parts.headers);
 
             let response = match body {
                 HybridBody::Rest { rest_body } => {
-                    if !should_fix {
-                        Response::from_parts(parts, HybridBody::Rest { rest_body })
-                    } else {
-                        let (rest_body, changed) = fix_s3_error_message_in_xml(rest_body).await.map_err(Into::into)?;
-                        let mut parts = parts;
-                        if changed {
-                            parts.headers.remove(http::header::CONTENT_LENGTH);
-                        }
-                        Response::from_parts(parts, HybridBody::Rest { rest_body })
+                    let (rest_body, changed) = fix_s3_error_message_in_xml(rest_body).await.map_err(Into::into)?;
+                    let mut parts = parts;
+                    if changed {
+                        parts.headers.remove(http::header::CONTENT_LENGTH);
                     }
+                    Response::from_parts(parts, HybridBody::Rest { rest_body })
                 }
                 HybridBody::Grpc { grpc_body } => Response::from_parts(parts, HybridBody::Grpc { grpc_body }),
             };
@@ -886,11 +886,12 @@ pub struct IcebergRestErrorCompatService<S> {
     inner: S,
 }
 
-impl<S, RestBody, GrpcBody> Service<HttpRequest<Incoming>> for IcebergRestErrorCompatService<S>
+impl<S, ReqBody, RestBody, GrpcBody> Service<HttpRequest<ReqBody>> for IcebergRestErrorCompatService<S>
 where
-    S: Service<HttpRequest<Incoming>, Response = Response<HybridBody<RestBody, GrpcBody>>> + Clone + Send + 'static,
+    S: Service<HttpRequest<ReqBody>, Response = Response<HybridBody<RestBody, GrpcBody>>> + Clone + Send + 'static,
     S::Future: Send + 'static,
     S::Error: Send + 'static,
+    ReqBody: Send + 'static,
     RestBody: Body<Data = Bytes> + From<Bytes> + Send + 'static,
     RestBody::Error: Into<S::Error> + Send + 'static,
     GrpcBody: Send + 'static,
@@ -903,18 +904,21 @@ where
         self.inner.poll_ready(cx)
     }
 
-    fn call(&mut self, req: HttpRequest<Incoming>) -> Self::Future {
+    fn call(&mut self, req: HttpRequest<ReqBody>) -> Self::Future {
         let catalog_path =
             (req.method() != Method::HEAD && is_table_catalog_path(req.uri().path())).then(|| req.uri().path().to_string());
         let mut inner = self.inner.clone();
 
         Box::pin(async move {
             let response = inner.call(req).await?;
+            if catalog_path.is_none() || response.status().is_success() || !is_xml_response(response.headers()) {
+                return Ok(response);
+            }
+
             let (parts, body) = response.into_parts();
-            let should_convert = catalog_path.is_some() && !parts.status.is_success() && is_xml_response(&parts.headers);
 
             let response = match body {
-                HybridBody::Rest { rest_body } if should_convert => {
+                HybridBody::Rest { rest_body } => {
                     let (rest_body, converted_status) = convert_iceberg_error_in_xml(
                         rest_body,
                         parts.status,
@@ -932,7 +936,6 @@ where
                     }
                     Response::from_parts(parts, HybridBody::Rest { rest_body })
                 }
-                HybridBody::Rest { rest_body } => Response::from_parts(parts, HybridBody::Rest { rest_body }),
                 HybridBody::Grpc { grpc_body } => Response::from_parts(parts, HybridBody::Grpc { grpc_body }),
             };
 
@@ -1045,11 +1048,12 @@ pub struct ObjectAttributesEtagFixService<S> {
     inner: S,
 }
 
-impl<S, RestBody, GrpcBody> Service<HttpRequest<Incoming>> for ObjectAttributesEtagFixService<S>
+impl<S, ReqBody, RestBody, GrpcBody> Service<HttpRequest<ReqBody>> for ObjectAttributesEtagFixService<S>
 where
-    S: Service<HttpRequest<Incoming>, Response = Response<HybridBody<RestBody, GrpcBody>>> + Clone + Send + 'static,
+    S: Service<HttpRequest<ReqBody>, Response = Response<HybridBody<RestBody, GrpcBody>>> + Clone + Send + 'static,
     S::Future: Send + 'static,
     S::Error: Send + 'static,
+    ReqBody: Send + 'static,
     RestBody: Body<Data = Bytes> + From<Bytes> + Send + 'static,
     RestBody::Error: Into<S::Error> + Send + 'static,
     GrpcBody: Send + 'static,
@@ -1062,27 +1066,26 @@ where
         self.inner.poll_ready(cx)
     }
 
-    fn call(&mut self, req: HttpRequest<Incoming>) -> Self::Future {
+    fn call(&mut self, req: HttpRequest<ReqBody>) -> Self::Future {
         let is_target = is_object_attributes_request(&req);
         let mut inner = self.inner.clone();
 
         Box::pin(async move {
             let response = inner.call(req).await?;
+            if !is_target || !response.status().is_success() || !is_xml_response(response.headers()) {
+                return Ok(response);
+            }
+
             let (parts, body) = response.into_parts();
-            let should_fix = is_target && parts.status.is_success() && is_xml_response(&parts.headers);
 
             let response = match body {
                 HybridBody::Rest { rest_body } => {
-                    if !should_fix {
-                        Response::from_parts(parts, HybridBody::Rest { rest_body })
-                    } else {
-                        let rest_body = fix_object_attributes_etag_in_xml(rest_body).await.map_err(Into::into)?;
+                    let rest_body = fix_object_attributes_etag_in_xml(rest_body).await.map_err(Into::into)?;
 
-                        let mut parts = parts;
-                        parts.headers.remove(http::header::CONTENT_LENGTH);
+                    let mut parts = parts;
+                    parts.headers.remove(http::header::CONTENT_LENGTH);
 
-                        Response::from_parts(parts, HybridBody::Rest { rest_body })
-                    }
+                    Response::from_parts(parts, HybridBody::Rest { rest_body })
                 }
                 HybridBody::Grpc { grpc_body } => Response::from_parts(parts, HybridBody::Grpc { grpc_body }),
             };
@@ -1144,12 +1147,11 @@ where
 
         Box::pin(async move {
             let response = inner.call(req).await?;
-            let (mut parts, body) = response.into_parts();
-
-            if !is_bodyless_status(parts.status) {
-                return Ok(Response::from_parts(parts, body));
+            if !is_bodyless_status(response.status()) {
+                return Ok(response);
             }
 
+            let (mut parts, body) = response.into_parts();
             let response = match body {
                 HybridBody::Rest { .. } => {
                     parts.headers.remove(http::header::CONTENT_LENGTH);
@@ -1802,7 +1804,7 @@ fn strip_quotes_from_first_etag(xml: String) -> String {
     fixed
 }
 
-fn is_object_attributes_request(req: &HttpRequest<Incoming>) -> bool {
+fn is_object_attributes_request<B>(req: &HttpRequest<B>) -> bool {
     if req.method() != Method::GET {
         return false;
     }
@@ -1967,11 +1969,12 @@ fn apply_bucket_cors_result(response_headers: &mut HeaderMap, bucket_cors_header
     }
 }
 
-impl<S, ResBody> Service<HttpRequest<Incoming>> for ConditionalCorsService<S>
+impl<S, ReqBody, ResBody> Service<HttpRequest<ReqBody>> for ConditionalCorsService<S>
 where
-    S: Service<HttpRequest<Incoming>, Response = Response<ResBody>> + Clone + Send + 'static,
+    S: Service<HttpRequest<ReqBody>, Response = Response<ResBody>> + Clone + Send + 'static,
     S::Future: Send + 'static,
     S::Error: Into<Box<dyn std::error::Error + Send + Sync>> + Send + 'static,
+    ReqBody: Send + 'static,
     ResBody: Default + Send + 'static,
 {
     type Response = Response<ResBody>;
@@ -1982,7 +1985,14 @@ where
         self.inner.poll_ready(cx).map_err(Into::into)
     }
 
-    fn call(&mut self, req: HttpRequest<Incoming>) -> Self::Future {
+    fn call(&mut self, req: HttpRequest<ReqBody>) -> Self::Future {
+        let is_options = req.method() == Method::OPTIONS;
+        let has_origin = req.headers().contains_key(cors::standard::ORIGIN);
+        if !is_options && !has_origin {
+            let mut inner = self.inner.clone();
+            return Box::pin(async move { inner.call(req).await.map_err(Into::into) });
+        }
+
         let path = req.uri().path().to_string();
         let method = req.method().clone();
         let request_headers = req.headers().clone();
@@ -1990,7 +2000,7 @@ where
         let is_s3 = ConditionalCorsLayer::is_s3_path(&path);
         let is_root = path == "/";
 
-        if method == Method::OPTIONS {
+        if is_options {
             let has_acrm = request_headers.contains_key(cors::request::ACCESS_CONTROL_REQUEST_METHOD);
 
             if is_root {
@@ -2192,6 +2202,7 @@ mod tests {
     use futures::future::{Ready, ready};
     use http::Request;
     use http_body_util::BodyExt;
+    use http_body_util::Empty;
     use http_body_util::Full;
     use opentelemetry::global;
     use opentelemetry_sdk::propagation::TraceContextPropagator;
@@ -3783,6 +3794,188 @@ mod tests {
         assert_eq!(bytes, input);
     }
 
+    #[derive(Clone)]
+    struct FixedHybridResponse {
+        status: StatusCode,
+        body: Bytes,
+        content_type: &'static str,
+    }
+
+    impl<B: Send + 'static> Service<Request<B>> for FixedHybridResponse {
+        type Response = Response<HybridBody<Full<Bytes>, Empty<Bytes>>>;
+        type Error = Infallible;
+        type Future = Ready<Result<Self::Response, Self::Error>>;
+
+        fn poll_ready(&mut self, _cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+            Poll::Ready(Ok(()))
+        }
+
+        fn call(&mut self, _req: Request<B>) -> Self::Future {
+            let body = self.body.clone();
+            ready(Ok(Response::builder()
+                .status(self.status)
+                .header(http::header::CONTENT_TYPE, self.content_type)
+                .header(http::header::CONTENT_LENGTH, body.len().to_string())
+                .body(HybridBody::Rest {
+                    rest_body: Full::from(body),
+                })
+                .expect("fixed hybrid response")))
+        }
+    }
+
+    async fn collect_hybrid_response(
+        response: Response<HybridBody<Full<Bytes>, Empty<Bytes>>>,
+    ) -> (StatusCode, HeaderMap, String) {
+        let status = response.status();
+        let headers = response.headers().clone();
+        let body = BodyExt::collect(response.into_body())
+            .await
+            .expect("collect hybrid body")
+            .to_bytes();
+        (
+            status,
+            headers,
+            String::from_utf8(body.to_vec()).expect("hybrid response body should be UTF-8"),
+        )
+    }
+
+    #[tokio::test]
+    async fn s3_error_message_compat_fixes_regular_forbidden_xml() {
+        let body = Bytes::from_static(b"<Error><Code>SignatureDoesNotMatch</Code></Error>");
+        let mut service = S3ErrorMessageCompatLayer.layer(FixedHybridResponse {
+            status: StatusCode::FORBIDDEN,
+            body,
+            content_type: "application/xml",
+        });
+        let request = Request::builder()
+            .method(Method::GET)
+            .uri("/bucket/object")
+            .body(())
+            .expect("request");
+
+        let response = service.call(request).await.expect("service response");
+        let (status, headers, body) = collect_hybrid_response(response).await;
+
+        assert_eq!(status, StatusCode::FORBIDDEN);
+        assert!(headers.get(http::header::CONTENT_LENGTH).is_none());
+        assert!(body.contains("<Message>"));
+    }
+
+    #[tokio::test]
+    async fn s3_error_message_compat_leaves_sts_query_response_unchanged() {
+        let input = Bytes::from_static(b"<Error><Code>SignatureDoesNotMatch</Code></Error>");
+        let mut service = S3ErrorMessageCompatLayer.layer(FixedHybridResponse {
+            status: StatusCode::FORBIDDEN,
+            body: input.clone(),
+            content_type: "application/xml",
+        });
+        let mut request = Request::builder().method(Method::POST).uri("/").body(()).expect("request");
+        request.extensions_mut().insert(StsQueryRequest);
+
+        let response = service.call(request).await.expect("service response");
+        let (_status, headers, body) = collect_hybrid_response(response).await;
+
+        let expected_len = input.len().to_string();
+        assert_eq!(
+            headers
+                .get(http::header::CONTENT_LENGTH)
+                .and_then(|value| value.to_str().ok()),
+            Some(expected_len.as_str())
+        );
+        assert_eq!(body.as_bytes(), input.as_ref());
+    }
+
+    #[tokio::test]
+    async fn iceberg_rest_error_compat_converts_catalog_xml_errors() {
+        let mut service = IcebergRestErrorCompatLayer.layer(FixedHybridResponse {
+            status: StatusCode::NOT_FOUND,
+            body: Bytes::from_static(b"<Error><Code>NoSuchTableException</Code><Message>missing</Message></Error>"),
+            content_type: "application/xml",
+        });
+        let request = Request::builder()
+            .method(Method::GET)
+            .uri("/iceberg/v1/warehouse/namespaces/ns/tables/events")
+            .body(())
+            .expect("request");
+
+        let response = service.call(request).await.expect("service response");
+        let (status, headers, body) = collect_hybrid_response(response).await;
+
+        assert_eq!(status, StatusCode::NOT_FOUND);
+        assert_eq!(headers.get(http::header::CONTENT_TYPE).unwrap(), "application/json");
+        assert!(headers.get(http::header::CONTENT_LENGTH).is_none());
+        assert!(body.contains("\"type\":\"NoSuchTableException\""));
+    }
+
+    #[tokio::test]
+    async fn iceberg_rest_error_compat_leaves_non_catalog_errors_unchanged() {
+        let input = Bytes::from_static(b"<Error><Code>NoSuchKey</Code><Message>missing</Message></Error>");
+        let mut service = IcebergRestErrorCompatLayer.layer(FixedHybridResponse {
+            status: StatusCode::NOT_FOUND,
+            body: input.clone(),
+            content_type: "application/xml",
+        });
+        let request = Request::builder()
+            .method(Method::GET)
+            .uri("/bucket/object")
+            .body(())
+            .expect("request");
+
+        let response = service.call(request).await.expect("service response");
+        let (status, headers, body) = collect_hybrid_response(response).await;
+
+        assert_eq!(status, StatusCode::NOT_FOUND);
+        assert_eq!(headers.get(http::header::CONTENT_TYPE).unwrap(), "application/xml");
+        assert_eq!(body.as_bytes(), input.as_ref());
+    }
+
+    #[tokio::test]
+    async fn object_attributes_etag_fix_rewrites_target_response() {
+        let mut service = ObjectAttributesEtagFixLayer.layer(FixedHybridResponse {
+            status: StatusCode::OK,
+            body: Bytes::from_static(b"<GetObjectAttributesOutput><ETag>\"abc\"</ETag></GetObjectAttributesOutput>"),
+            content_type: "application/xml",
+        });
+        let request = Request::builder()
+            .method(Method::GET)
+            .uri("/bucket/object?attributes")
+            .body(())
+            .expect("request");
+
+        let response = service.call(request).await.expect("service response");
+        let (_status, headers, body) = collect_hybrid_response(response).await;
+
+        assert!(headers.get(http::header::CONTENT_LENGTH).is_none());
+        assert!(body.contains("<ETag>abc</ETag>"));
+    }
+
+    #[tokio::test]
+    async fn object_attributes_etag_fix_leaves_regular_get_unchanged() {
+        let input = Bytes::from_static(b"<GetObjectAttributesOutput><ETag>\"abc\"</ETag></GetObjectAttributesOutput>");
+        let mut service = ObjectAttributesEtagFixLayer.layer(FixedHybridResponse {
+            status: StatusCode::OK,
+            body: input.clone(),
+            content_type: "application/xml",
+        });
+        let request = Request::builder()
+            .method(Method::GET)
+            .uri("/bucket/object")
+            .body(())
+            .expect("request");
+
+        let response = service.call(request).await.expect("service response");
+        let (_status, headers, body) = collect_hybrid_response(response).await;
+
+        let expected_len = input.len().to_string();
+        assert_eq!(
+            headers
+                .get(http::header::CONTENT_LENGTH)
+                .and_then(|value| value.to_str().ok()),
+            Some(expected_len.as_str())
+        );
+        assert_eq!(body.as_bytes(), input.as_ref());
+    }
+
     #[derive(Clone)]
     struct FixedStsResponse {
         status: StatusCode,
@@ -4270,6 +4463,63 @@ mod tests {
         });
     }
 
+    #[derive(Clone)]
+    struct CorsOkService;
+
+    impl<B> Service<Request<B>> for CorsOkService {
+        type Response = Response<Empty<Bytes>>;
+        type Error = Infallible;
+        type Future = Ready<Result<Self::Response, Self::Error>>;
+
+        fn poll_ready(&mut self, _cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+            Poll::Ready(Ok(()))
+        }
+
+        fn call(&mut self, _req: Request<B>) -> Self::Future {
+            ready(Ok(Response::builder()
+                .status(StatusCode::OK)
+                .body(Empty::new())
+                .expect("response")))
+        }
+    }
+
+    #[tokio::test]
+    async fn conditional_cors_passthrough_without_origin() {
+        let layer = ConditionalCorsLayer {
+            cors_origins: Some("*".to_string()),
+        };
+        let mut service = layer.layer(CorsOkService);
+        let request = Request::builder()
+            .method(Method::GET)
+            .uri("/bucket/object")
+            .body(())
+            .expect("request");
+
+        let response = service.call(request).await.expect("response");
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert!(response.headers().get(cors::response::ACCESS_CONTROL_ALLOW_ORIGIN).is_none());
+    }
+
+    #[tokio::test]
+    async fn conditional_cors_applies_origin_headers() {
+        let layer = ConditionalCorsLayer {
+            cors_origins: Some("*".to_string()),
+        };
+        let mut service = layer.layer(CorsOkService);
+        let request = Request::builder()
+            .method(Method::GET)
+            .uri("/bucket/object")
+            .header(cors::standard::ORIGIN, "https://example.com")
+            .body(())
+            .expect("request");
+
+        let response = service.call(request).await.expect("response");
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(response.headers().get(cors::response::ACCESS_CONTROL_ALLOW_ORIGIN).unwrap(), "*");
+    }
+
     #[test]
     fn request_context_layer_populates_context_without_mutating_signed_headers() {
         let mut service = RequestContextLayer.layer(CaptureService);

scripts/find_assertless_tests.py

@@ -49,19 +49,47 @@ import sys
 from pathlib import Path
 
 VERIFY_SIGNALS = re.compile(
-    r"assert!|assert_eq!|assert_ne!|debug_assert|panic!\(|\.expect\(|\.unwrap\(|"
+    r"assert[a-z0-9_]*!|debug_assert|panic!\(|\.expect\(|\.unwrap\(|"
     r"unreachable!|matches!\(|insta::|proptest!|\.await\?|\)\?|\?;|should_panic"
 )
 DELEGATION = re.compile(
-    r"\b(?:assert|verify|check|expect|ensure|run)_[a-z0-9_]*\s*\(|"
-    r"\b[a-z0-9_]+_(?:case|cases|harness|roundtrip|round_trip)\s*\("
+    r"\b(?:assert|verify|check|expect|ensure|run)_[a-z0-9_]*(?:::<[^>]*>)?\s*\(|"
+    r"\b[a-z0-9_]+_(?:case|cases|harness|roundtrip|round_trip)(?:::<[^>]*>)?\s*\("
 )
+
+# A body whose whole content is one call delegates by construction, whatever the
+# callee is named: `run(DurabilityMode::Strict).await` and
+# `aborting_encode_drops_blocked_producer(EncodePipeline::Vec).await` both hand
+# every assertion to a shared harness.
+SINGLE_CALL_BODY = re.compile(
+    r"\A\s*[a-zA-Z_][a-zA-Z0-9_:]*(?:::<[^>]*>)?\s*\([^;]*\)\s*(?:\.await\s*)?;?\s*\Z",
+    re.S,
+)
+
+# A nested `fn` that is only bound and discarded is a signature guard: the type
+# system is the assertion, exactly like the `fn _name()` form below.
+SIGNATURE_GUARD = re.compile(r"\bfn\s+[a-zA-Z0-9_]+\s*(?:<[^>]*>)?\s*\([^;]*\)[^;]*\{", re.S)
+DISCARDED_BINDING = re.compile(r"\blet\s+_\s*=\s*[a-zA-Z_][a-zA-Z0-9_]*\s*;")
+# `let _ = Type::<T>::method;` — a path item referenced but never called can only
+# be a signature guard; the call form (`let _ = x.foo();`) is excluded by the
+# absence of parens before the semicolon.
+DISCARDED_PATH_ITEM = re.compile(r"\blet\s+_\s*=\s*[a-zA-Z_][a-zA-Z0-9_]*(?:::(?:<[^>]*>|[a-zA-Z_][a-zA-Z0-9_]*))+\s*;")
 COMPILE_TIME_CHECK = re.compile(r"\bfn\s+_[a-zA-Z0-9_]*\s*(?:<[^>]*>)?\s*\(")
 TEST_ATTR = re.compile(r"#\[(?:tokio::)?test[\](]")
 TEST_CASE_ATTR = re.compile(r"#\[test_case")
 FN_LINE = re.compile(r"^\s*(?:pub\s+)?(?:async\s+)?fn\s+([a-zA-Z0-9_]+)")
 
 
+
+def extract_body(text: str) -> str:
+    """Return what is between the outermost braces of a scanned function."""
+    start = text.find("{")
+    end = text.rfind("}")
+    if start == -1 or end <= start:
+        return text
+    return text[start + 1 : end]
+
+
 def scan_file(path: Path):
     try:
         lines = path.read_text(encoding="utf-8").split("\n")
@@ -105,7 +133,17 @@ def scan_file(path: Path):
                 break
             k += 1
         text = "\n".join(body)
-        if not VERIFY_SIGNALS.search(text) and not DELEGATION.search(text) and not COMPILE_TIME_CHECK.search(text):
+        # The attribute block carries verification too: `#[should_panic(expected
+        # = "...")]` makes the panic message the assertion.
+        attr_text = "\n".join(attrs)
+        inner = extract_body(text)
+        delegates = (
+            DELEGATION.search(text)
+            or SINGLE_CALL_BODY.match(inner)
+            or (SIGNATURE_GUARD.search(inner) and DISCARDED_BINDING.search(inner))
+            or DISCARDED_PATH_ITEM.search(inner)
+        )
+        if not VERIFY_SIGNALS.search(text) and not VERIFY_SIGNALS.search(attr_text) and not delegates and not COMPILE_TIME_CHECK.search(text):
             print(f"{path}:{j + 1}: {name}")
         i = k + 1