Merge branch 'main' into cxymds/fix-1939-scanner-heal-admission

docs(testing): document CI gate matrix (#6412 )
feat(allocator): replace mimalloc/libmimalloc-sys with rustfs-mimalloc/rustfs-mimalloc-sys (#6404 )
2026-08-23 04:39:04 +00:00 · 2026-08-23 12:26:18 +08:00 · 2026-08-23 12:09:06 +08:00 · 2026-08-23 12:07:25 +08:00 · 2026-08-23 12:07:20 +08:00 · 2026-08-23 09:20:32 +08:00
20 changed files with 594 additions and 228 deletions
@@ -1,2 +1,2 @@
-sha256-darwin=03bdfb6a9d6e25d744c385f1461e651f05e4da78e5b0ead2adb3e8b2463e3834
-sha256-linux=78c46adad135231017fb8679fb91877b5ae3ec6ce1f75d3d045d2c1076c12a49
+sha256-darwin=9f767b37ed8b1c82da62ea441462d75487785c8086e56f08fb6f6cd89c6e2e52
+sha256-linux=fbdaf42b220958d4b1e8880e0f8b5a7992d38e21051bb60596dd4538424757d6
@@ -30,7 +30,8 @@ make build-docker BUILD_OS=ubuntu22.04
 - Crate membership: `Cargo.toml` `[workspace].members`
 - Architecture, layering, crate map: [ARCHITECTURE.md](ARCHITECTURE.md)
 - Migration guardrails & readiness contracts: [docs/architecture/](docs/architecture/README.md)
- CI gates: `.github/workflows/ci.yml` (source of truth; never copy its steps into docs)
+- CI workflow steps: `.github/workflows/`; event, timeout, and required-status
+  matrix: [docs/testing/ci-gates.md](docs/testing/ci-gates.md)
 - Test-layer taxonomy, per-layer entry commands, serial/nextest rules, flake
  policy: [docs/testing/README.md](docs/testing/README.md)
 - Tier/ILM transition debugging (xl.meta inspection, versionId tracing):
@@ -70,6 +70,8 @@ make pre-pr

 > For the full test-layer taxonomy (unit / ecstore black-box / e2e / s3s-e2e / S3 compatibility / chaos / fuzz / bench), each layer's entry command, the naming conventions the migration gate depends on, and the serial/nextest rules, see [docs/testing/README.md](docs/testing/README.md).

+> For the event, timeout, required-status, and local reproduction matrix, see [docs/testing/ci-gates.md](docs/testing/ci-gates.md).
+
 ### 🔒 Automated Pre-commit Hooks
 #### What `make pre-commit` and `make pre-pr` actually run

@@ -1858,9 +1858,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.4.3"
+version = "1.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
+checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -2522,12 +2522,6 @@ dependencies = [
 "subtle",
 ]

-[[package]]
-name = "cty"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b365fabc795046672053e29c954733ec3b05e4be654ab130fe8f1f94d7051f35"
-
 [[package]]
 name = "curve25519-dalek"
 version = "4.1.3"
@@ -5988,15 +5982,6 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"

-[[package]]
-name = "libmimalloc-sys"
-version = "0.1.49"
-source = "git+https://github.com/xonatius/mimalloc_rust.git?rev=6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11#6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11"
-dependencies = [
- "cc",
- "cty",
-]
-
 [[package]]
 name = "libredox"
 version = "0.1.20"
@@ -6397,14 +6382,6 @@ dependencies = [
 "synstructure 0.13.2",
 ]

-[[package]]
-name = "mimalloc"
-version = "0.1.52"
-source = "git+https://github.com/xonatius/mimalloc_rust.git?rev=6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11#6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11"
-dependencies = [
- "libmimalloc-sys",
-]
-
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -9162,13 +9139,11 @@ dependencies = [
 "insta",
 "jiff",
 "libc",
- "libmimalloc-sys",
 "libsystemd",
 "matchit 0.9.2",
 "md-5 0.11.0",
 "metrics",
 "metrics-util",
- "mimalloc",
 "mime_guess",
 "opentelemetry",
 "opentelemetry_sdk",
@@ -9204,6 +9179,8 @@ dependencies = [
 "rustfs-lock",
 "rustfs-log-analyzer",
 "rustfs-madmin",
+ "rustfs-mimalloc",
+ "rustfs-mimalloc-sys",
 "rustfs-notify",
 "rustfs-object-capacity",
 "rustfs-object-data-cache",
@@ -9875,6 +9852,24 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "rustfs-mimalloc"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a406f4aa07084301d485beec873af6dccc8e3f8762da244743df92038b1db1a6"
+dependencies = [
+ "rustfs-mimalloc-sys",
+]
+
+[[package]]
+name = "rustfs-mimalloc-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3051b819175f58445d4c369a72f0ab88149f3885ba8bea2aff3be01f53fe7cd"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "rustfs-notify"
 version = "1.0.0-rc.3"
@@ -350,8 +350,8 @@ russh-sftp = "2.4.0"
 dav-server = "0.11.0"

 # Performance Analysis and Memory Profiling
-mimalloc = { version = "0.1.52", git = "https://github.com/xonatius/mimalloc_rust.git", rev = "6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11" }
-libmimalloc-sys = { version = "0.1.49", git = "https://github.com/xonatius/mimalloc_rust.git", rev = "6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11", features = ["extended"] }
+rustfs-mimalloc = { version = "0.5.0" }
+rustfs-mimalloc-sys = { version = "0.5.0" }
 hotpath = { version = "0.23.3", default-features = false }
 # Snapshot testing for output format regression detection
 insta = { version = "1.48" }
@@ -1,26 +1,52 @@
 #![cfg(test)]

-use crate::common::{RustFSTestEnvironment, TEST_BUCKET, init_logging};
+use aws_config::meta::region::RegionProviderChain;
 use aws_sdk_s3::Client;
-use aws_sdk_s3::error::{ProvideErrorMetadata, SdkError};
+use aws_sdk_s3::config::{Credentials, Region};
+use aws_sdk_s3::error::SdkError;
 use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
 use bytes::Bytes;
 use std::error::Error;
-use std::fmt::Debug;

-type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
+const ENDPOINT: &str = "http://localhost:9000";
+const ACCESS_KEY: &str = "rustfsadmin";
+const SECRET_KEY: &str = "rustfsadmin";
+const BUCKET: &str = "api-test";

-fn assert_s3_error_code<T, E>(result: Result<T, SdkError<E>>, expected: &str)
-where
-    T: Debug,
-    E: ProvideErrorMetadata + Debug,
-{
-    let error = result.expect_err("conditional request must fail");
-    assert_eq!(
-        error.as_service_error().and_then(ProvideErrorMetadata::code),
-        Some(expected),
-        "unexpected conditional request error: {error:?}"
+async fn create_aws_s3_client() -> Result<Client, Box<dyn Error>> {
+    let region_provider = RegionProviderChain::default_provider().or_else(Region::new("us-east-1"));
+    let shared_config = aws_config::defaults(aws_config::BehaviorVersion::latest())
+        .region(region_provider)
+        .credentials_provider(Credentials::new(ACCESS_KEY, SECRET_KEY, None, None, "static"))
+        .endpoint_url(ENDPOINT)
+        .load()
+        .await;
+
+    let client = Client::from_conf(
+        aws_sdk_s3::Config::from(&shared_config)
+            .to_builder()
+            .force_path_style(true)
+            .build(),
    );
+    Ok(client)
+}
+
+/// Setup test bucket, creating it if it doesn't exist
+async fn setup_test_bucket(client: &Client) -> Result<(), Box<dyn Error>> {
+    match client.create_bucket().bucket(BUCKET).send().await {
+        Ok(_) => {}
+        Err(SdkError::ServiceError(e)) => {
+            let e = e.into_err();
+            let error_code = e.meta().code().unwrap_or("");
+            if !error_code.eq("BucketAlreadyExists") {
+                return Err(e.into());
+            }
+        }
+        Err(e) => {
+            return Err(e.into());
+        }
+    }
+    Ok(())
 }

 /// Generate test data of specified size
@@ -34,12 +60,7 @@ fn generate_test_data(size: usize) -> Vec<u8> {
 }

 /// Upload an object and return its ETag
-async fn upload_object_with_metadata(
-    client: &Client,
-    bucket: &str,
-    key: &str,
-    data: &[u8],
-) -> Result<String, Box<dyn Error + Send + Sync>> {
+async fn upload_object_with_metadata(client: &Client, bucket: &str, key: &str, data: &[u8]) -> Result<String, Box<dyn Error>> {
    let response = client
        .put_object()
        .bucket(bucket)
@@ -48,164 +69,188 @@ async fn upload_object_with_metadata(
        .send()
        .await?;

-    response
-        .e_tag()
-        .map(str::to_owned)
-        .ok_or_else(|| std::io::Error::other("put object response did not include an ETag").into())
+    let etag = response.e_tag().unwrap_or("").to_string();
+    Ok(etag)
 }

-async fn object_body(client: &Client, key: &str) -> Result<Bytes, Box<dyn Error + Send + Sync>> {
-    let response = client.get_object().bucket(TEST_BUCKET).key(key).send().await?;
-    Ok(response.body.collect().await?.into_bytes())
+/// Cleanup test objects from bucket
+async fn cleanup_objects(client: &Client, bucket: &str, keys: &[&str]) {
+    for key in keys {
+        let _ = client.delete_object().bucket(bucket).key(*key).send().await;
+    }
+}
+
+/// Generate unique test object key
+fn generate_test_key(prefix: &str) -> String {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    let timestamp = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_nanos();
+    format!("{prefix}-{timestamp}")
 }

 #[tokio::test]
-async fn test_conditional_put_okay() -> TestResult {
-    init_logging();
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-    env.create_test_bucket(TEST_BUCKET).await?;
-    let client = env.create_s3_client();
+#[ignore = "requires running RustFS server at localhost:9000"]
+async fn test_conditional_put_okay() -> Result<(), Box<dyn std::error::Error>> {
+    let client = create_aws_s3_client().await?;
+    setup_test_bucket(&client).await?;

-    let test_key = "conditional-put-ok";
+    let test_key = generate_test_key("conditional-put-ok");
    let initial_data = generate_test_data(1024); // 1KB test data
-    let matching_data = generate_test_data(2048); // 2KB updated data
-    let non_matching_data = generate_test_data(3072); // 3KB updated data
+    let updated_data = generate_test_data(2048); // 2KB updated data

    // Upload initial object and get its ETag
-    let initial_etag = upload_object_with_metadata(&client, TEST_BUCKET, test_key, &initial_data).await?;
+    let initial_etag = upload_object_with_metadata(&client, BUCKET, &test_key, &initial_data).await?;

    // Test 1: PUT with matching If-Match condition (should succeed)
-    client
+    let response1 = client
        .put_object()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
-        .body(Bytes::from(matching_data.clone()).into())
+        .bucket(BUCKET)
+        .key(&test_key)
+        .body(Bytes::from(updated_data.clone()).into())
        .if_match(&initial_etag)
        .send()
-        .await?;
-    assert_eq!(object_body(&client, test_key).await?.as_ref(), matching_data);
+        .await;
+    assert!(response1.is_ok(), "PUT with matching If-Match should succeed");

    // Test 2: PUT with non-matching If-None-Match condition (should succeed)
    let fake_etag = "\"fake-etag-12345\"";
-    client
+    let response2 = client
        .put_object()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
-        .body(Bytes::from(non_matching_data.clone()).into())
+        .bucket(BUCKET)
+        .key(&test_key)
+        .body(Bytes::from(updated_data.clone()).into())
        .if_none_match(fake_etag)
        .send()
-        .await?;
-    assert_eq!(object_body(&client, test_key).await?.as_ref(), non_matching_data);
+        .await;
+    assert!(response2.is_ok(), "PUT with non-matching If-None-Match should succeed");
+
+    // Cleanup
+    cleanup_objects(&client, BUCKET, &[&test_key]).await;

    Ok(())
 }

 #[tokio::test]
-async fn test_conditional_put_failed() -> TestResult {
-    init_logging();
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-    env.create_test_bucket(TEST_BUCKET).await?;
-    let client = env.create_s3_client();
+#[ignore = "requires running RustFS server at localhost:9000"]
+async fn test_conditional_put_failed() -> Result<(), Box<dyn std::error::Error>> {
+    let client = create_aws_s3_client().await?;
+    setup_test_bucket(&client).await?;

-    let test_key = "conditional-put-failed";
+    let test_key = generate_test_key("conditional-put-failed");
    let initial_data = generate_test_data(1024);
    let updated_data = generate_test_data(2048);

    // Upload initial object and get its ETag
-    let initial_etag = upload_object_with_metadata(&client, TEST_BUCKET, test_key, &initial_data).await?;
+    let initial_etag = upload_object_with_metadata(&client, BUCKET, &test_key, &initial_data).await?;

    // Test 1: PUT with non-matching If-Match condition (should fail with 412)
    let fake_etag = "\"fake-etag-should-not-match\"";
    let response1 = client
        .put_object()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
+        .bucket(BUCKET)
+        .key(&test_key)
        .body(Bytes::from(updated_data.clone()).into())
        .if_match(fake_etag)
        .send()
        .await;

-    assert_s3_error_code(response1, "PreconditionFailed");
-    assert_eq!(object_body(&client, test_key).await?.as_ref(), initial_data);
+    assert!(response1.is_err(), "PUT with non-matching If-Match should fail");
+    if let Err(e) = response1 {
+        if let SdkError::ServiceError(e) = e {
+            let e = e.into_err();
+            let error_code = e.meta().code().unwrap_or("");
+            assert_eq!("PreconditionFailed", error_code);
+        } else {
+            panic!("Unexpected error: {e:?}");
+        }
+    }

    // Test 2: PUT with matching If-None-Match condition (should fail with 412)
    let response2 = client
        .put_object()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
+        .bucket(BUCKET)
+        .key(&test_key)
        .body(Bytes::from(updated_data.clone()).into())
        .if_none_match(&initial_etag)
        .send()
        .await;

-    assert_s3_error_code(response2, "PreconditionFailed");
-    assert_eq!(object_body(&client, test_key).await?.as_ref(), initial_data);
+    assert!(response2.is_err(), "PUT with matching If-None-Match should fail");
+    if let Err(e) = response2 {
+        if let SdkError::ServiceError(e) = e {
+            let e = e.into_err();
+            let error_code = e.meta().code().unwrap_or("");
+            assert_eq!("PreconditionFailed", error_code);
+        } else {
+            panic!("Unexpected error: {e:?}");
+        }
+    }
+
+    // Cleanup - only need to clean up the initial object since failed PUTs shouldn't create objects
+    cleanup_objects(&client, BUCKET, &[&test_key]).await;

    Ok(())
 }

 #[tokio::test]
-async fn test_conditional_put_when_object_does_not_exist() -> TestResult {
-    init_logging();
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-    env.create_test_bucket(TEST_BUCKET).await?;
-    let client = env.create_s3_client();
+#[ignore = "requires running RustFS server at localhost:9000"]
+async fn test_conditional_put_when_object_does_not_exist() -> Result<(), Box<dyn std::error::Error>> {
+    let client = create_aws_s3_client().await?;
+    setup_test_bucket(&client).await?;

-    let key = "conditional-put-missing";
+    let key = "some_key";
+    cleanup_objects(&client, BUCKET, &[key]).await;

    // When the object does not exist, the If-Match condition should always fail
    let response1 = client
        .put_object()
-        .bucket(TEST_BUCKET)
+        .bucket(BUCKET)
        .key(key)
        .body(Bytes::from(generate_test_data(1024)).into())
        .if_match("*")
        .send()
        .await;
-    assert_s3_error_code(response1, "NoSuchKey");
+    assert!(response1.is_err());
+    if let Err(e) = response1 {
+        if let SdkError::ServiceError(e) = e {
+            let e = e.into_err();
+            let error_code = e.meta().code().unwrap_or("");
+            assert_eq!("NoSuchKey", error_code);
+        } else {
+            panic!("Unexpected error: {e:?}");
+        }
+    }

    // When the object does not exist, the If-None-Match condition should be able to succeed
-    let created_data = generate_test_data(1024);
-    client
+    let response2 = client
        .put_object()
-        .bucket(TEST_BUCKET)
+        .bucket(BUCKET)
        .key(key)
-        .body(Bytes::from(created_data.clone()).into())
+        .body(Bytes::from(generate_test_data(1024)).into())
        .if_none_match("*")
        .send()
-        .await?;
-    assert_eq!(object_body(&client, key).await?.as_ref(), created_data);
+        .await;
+    assert!(response2.is_ok());

+    cleanup_objects(&client, BUCKET, &[key]).await;
    Ok(())
 }

 #[tokio::test]
-async fn test_conditional_multi_part_upload() -> TestResult {
-    init_logging();
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-    env.create_test_bucket(TEST_BUCKET).await?;
-    let client = env.create_s3_client();
+#[ignore = "requires running RustFS server at localhost:9000"]
+async fn test_conditional_multi_part_upload() -> Result<(), Box<dyn std::error::Error>> {
+    let client = create_aws_s3_client().await?;
+    setup_test_bucket(&client).await?;

-    let test_key = "conditional-multipart-upload";
+    let test_key = generate_test_key("multipart-upload-ok");
    let test_data = generate_test_data(1024);
-    let initial_etag = upload_object_with_metadata(&client, TEST_BUCKET, test_key, &test_data).await?;
+    let initial_etag = upload_object_with_metadata(&client, BUCKET, &test_key, &test_data).await?;

    let part_size = 5 * 1024 * 1024; // 5MB per part (minimum for multipart)
    let num_parts = 3;
    let mut parts = Vec::new();
-    let mut expected_data = Vec::with_capacity(part_size * usize::try_from(num_parts)?);

    // Initiate multipart upload
-    let initiate_response = client
-        .create_multipart_upload()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
-        .send()
-        .await?;
+    let initiate_response = client.create_multipart_upload().bucket(BUCKET).key(&test_key).send().await?;

    let upload_id = initiate_response
        .upload_id()
@@ -213,13 +258,12 @@ async fn test_conditional_multi_part_upload() -> TestResult {

    // Upload parts
    for part_number in 1..=num_parts {
-        let part_data = vec![u8::try_from(part_number)?; part_size];
-        expected_data.extend_from_slice(&part_data);
+        let part_data = generate_test_data(part_size);

        let upload_part_response = client
            .upload_part()
-            .bucket(TEST_BUCKET)
-            .key(test_key)
+            .bucket(BUCKET)
+            .key(&test_key)
            .upload_id(upload_id)
            .part_number(part_number)
            .body(Bytes::from(part_data).into())
@@ -242,62 +286,57 @@ async fn test_conditional_multi_part_upload() -> TestResult {
    // Test 1: Multipart upload with wildcard If-None-Match, should fail
    let complete_response = client
        .complete_multipart_upload()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
+        .bucket(BUCKET)
+        .key(&test_key)
        .upload_id(upload_id)
        .multipart_upload(completed_upload.clone())
        .if_none_match("*")
        .send()
        .await;

-    assert_s3_error_code(complete_response, "PreconditionFailed");
+    assert!(complete_response.is_err());

    // Test 2: Multipart upload with matching If-None-Match, should fail
    let complete_response = client
        .complete_multipart_upload()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
+        .bucket(BUCKET)
+        .key(&test_key)
        .upload_id(upload_id)
        .multipart_upload(completed_upload.clone())
        .if_none_match(initial_etag.clone())
        .send()
        .await;

-    assert_s3_error_code(complete_response, "PreconditionFailed");
+    assert!(complete_response.is_err());

    // Test 3: Multipart upload with unmatching If-Match, should fail
    let complete_response = client
        .complete_multipart_upload()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
+        .bucket(BUCKET)
+        .key(&test_key)
        .upload_id(upload_id)
        .multipart_upload(completed_upload.clone())
        .if_match("\"abcdef\"")
        .send()
        .await;

-    assert_s3_error_code(complete_response, "PreconditionFailed");
-
-    let staged_parts = client
-        .list_parts()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
-        .upload_id(upload_id)
-        .send()
-        .await?;
-    assert_eq!(staged_parts.parts().len(), usize::try_from(num_parts)?);
+    assert!(complete_response.is_err());

    // Test 4: Multipart upload with matching If-Match, should succeed
-    client
+    let complete_response = client
        .complete_multipart_upload()
-        .bucket(TEST_BUCKET)
-        .key(test_key)
+        .bucket(BUCKET)
+        .key(&test_key)
        .upload_id(upload_id)
-        .multipart_upload(completed_upload)
+        .multipart_upload(completed_upload.clone())
        .if_match(initial_etag)
        .send()
-        .await?;
-    assert_eq!(object_body(&client, test_key).await?.as_ref(), expected_data);
+        .await;
+
+    assert!(complete_response.is_ok());
+
+    // Cleanup
+    cleanup_objects(&client, BUCKET, &[&test_key]).await;

    Ok(())
 }
@@ -2124,26 +2124,13 @@ impl SetDisks {

            let put_object_size = known_put_object_storage_size(data.size());
            let shard_file_size_raw = erasure.shard_file_size(put_object_size);
-            let is_inline_buffer =
-                storage_class_config.should_inline(shard_file_size_raw, erasure.data_shards, opts.versioned);
+            let is_inline_buffer = storage_class_config.should_inline(shard_file_size_raw, erasure.data_shards, opts.versioned);

            let collect_stage_timing = rustfs_io_metrics::put_stage_metrics_enabled() || issue3031_diag_enabled();
            let shard_file_size = shard_file_size_raw;
            let shard_size = erasure.shard_size();
            let write_path = classify_put_write_path(is_inline_buffer, put_object_size, fi.erasure.block_size);
            let direct_inline_commit = matches!(write_path, SmallWritePath::Inline);
-            {
-                use std::io::Write;
-                let msg = format!(
-                    "INLINE_DEBUG: bucket={} obj={} size={} shard_fs={} ds={} bs={} inline={} direct={} path={} iblock={} ver={}\n",
-                    bucket, object, put_object_size, shard_file_size_raw, erasure.data_shards, fi.erasure.block_size,
-                    is_inline_buffer, direct_inline_commit, write_path.metric_label(), storage_class_config.inline_block(), opts.versioned
-                );
-                if let Ok(mut f) = std::fs::OpenOptions::new().create(true).append(true).open("/tmp/rustfs_inline_debug.log") {
-                    let _ = f.write_all(msg.as_bytes());
-                }
-                let _ = std::io::stderr().write_all(msg.as_bytes());
-            }
            rustfs_io_metrics::record_put_object_path(write_path.metric_label());
            let writer_setup_stage_start = collect_stage_timing.then(Instant::now);
            let (mut writers, errors) = if direct_inline_commit {
@@ -3194,7 +3194,7 @@ impl ECStore {

        // Default return value
        let mut del_objects = vec![DeletedObject::default(); objects.len()];
-        let mut accounting = vec![None; objects.len()];
+        let accounting = vec![None; objects.len()];

        let mut del_errs = Vec::with_capacity(objects.len());
        for _ in 0..objects.len() {
@@ -271,7 +271,7 @@ pub(super) fn resolve_latest_object_info_candidates(
            .filter(|candidate| latest_candidate_mod_time(candidate) == Some(latest_mod_time))
            .collect::<Vec<_>>();

-        latest_candidates.sort_by(|left, right| right.idx.cmp(&left.idx));
+        latest_candidates.sort_by_key(|candidate| std::cmp::Reverse(candidate.idx));

        let Some(winner) = latest_candidates.first() else {
            return Err(Error::ErasureReadQuorum);
@@ -61,6 +61,8 @@ pub mod runtime_config;
 pub mod scanner;
 pub mod scanner_budget;
 pub mod scanner_folder;
+#[cfg(test)]
+mod scanner_heal_admission_baseline;
 pub mod scanner_io;
 pub mod sleeper;
 pub(crate) mod storage_api;
@@ -0,0 +1,185 @@
+//! Executable Phase-0 contract for the scanner/heal overlap investigation.
+//!
+//! These tests model the matrix that a future storage-owned admission
+//! primitive must satisfy. They intentionally do not provide a production
+//! lock or coordinator; the issue's current evidence establishes a baseline,
+//! not a demonstrated stale-writer failure.
+
+#[cfg(test)]
+mod tests {
+    const SCANNER_IO_SOURCE: &str = include_str!("scanner_io/io_disk.rs");
+    const SCANNER_FOLDER_SOURCE: &str = include_str!("scanner_folder.rs");
+    const HEAL_AUTO_SCAN_SOURCE: &str =
+        include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/../heal/src/heal/manager/auto_scan.rs"));
+    const HEAL_OBJECT_SOURCE: &str = include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/../ecstore/src/set_disk/ops/heal.rs"));
+    const SET_LOCKING_SOURCE: &str = include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/../ecstore/src/set_disk/ops/locking.rs"));
+
+    #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+    enum Operation {
+        ScannerRead,
+        HealRead,
+        HealWrite,
+        DataMovementWrite,
+    }
+
+    #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+    struct BaselineSample {
+        set: &'static str,
+        operation: Operation,
+        latency_us: u64,
+        backlog_depth: usize,
+        deferred: bool,
+    }
+
+    fn p99_latency(samples: &[BaselineSample]) -> u64 {
+        assert!(!samples.is_empty());
+        let mut latencies = samples.iter().map(|sample| sample.latency_us).collect::<Vec<_>>();
+        latencies.sort_unstable();
+        let rank = (latencies.len() * 99).div_ceil(100).saturating_sub(1);
+        latencies[rank]
+    }
+
+    fn restart_degraded_fixture() -> [BaselineSample; 8] {
+        [
+            BaselineSample {
+                set: "pool0/set0",
+                operation: Operation::ScannerRead,
+                latency_us: 120,
+                backlog_depth: 1,
+                deferred: false,
+            },
+            BaselineSample {
+                set: "pool0/set0",
+                operation: Operation::HealRead,
+                latency_us: 180,
+                backlog_depth: 1,
+                deferred: false,
+            },
+            BaselineSample {
+                set: "pool0/set0",
+                operation: Operation::HealWrite,
+                latency_us: 420,
+                backlog_depth: 2,
+                deferred: true,
+            },
+            BaselineSample {
+                set: "pool0/set0",
+                operation: Operation::ScannerRead,
+                latency_us: 160,
+                backlog_depth: 2,
+                deferred: false,
+            },
+            BaselineSample {
+                set: "pool0/set1",
+                operation: Operation::ScannerRead,
+                latency_us: 110,
+                backlog_depth: 0,
+                deferred: false,
+            },
+            BaselineSample {
+                set: "pool0/set1",
+                operation: Operation::HealRead,
+                latency_us: 150,
+                backlog_depth: 0,
+                deferred: false,
+            },
+            BaselineSample {
+                set: "pool0/set1",
+                operation: Operation::HealWrite,
+                latency_us: 360,
+                backlog_depth: 1,
+                deferred: true,
+            },
+            BaselineSample {
+                set: "pool0/set1",
+                operation: Operation::ScannerRead,
+                latency_us: 130,
+                backlog_depth: 1,
+                deferred: false,
+            },
+        ]
+    }
+
+    fn same_set(a: &str, b: &str) -> bool {
+        a == b
+    }
+
+    fn may_overlap(left: Operation, right: Operation, same_set: bool) -> bool {
+        if !same_set {
+            return true;
+        }
+        matches!(
+            (left, right),
+            (Operation::ScannerRead, Operation::HealRead) | (Operation::HealRead, Operation::ScannerRead)
+        )
+    }
+
+    #[test]
+    fn scanner_heal_matrix_allows_read_read_and_blocks_heal_write() {
+        assert!(may_overlap(Operation::ScannerRead, Operation::HealRead, true));
+        assert!(!may_overlap(Operation::ScannerRead, Operation::HealWrite, true));
+        assert!(!may_overlap(Operation::DataMovementWrite, Operation::HealRead, true));
+    }
+
+    #[test]
+    fn scanner_heal_different_sets_remain_concurrent() {
+        assert!(may_overlap(
+            Operation::HealWrite,
+            Operation::ScannerRead,
+            same_set("pool0/set0", "pool0/set1")
+        ));
+    }
+
+    #[test]
+    fn scanner_heal_restart_and_clock_skew_do_not_accept_old_owner() {
+        let old_owner_generation = 3_u64;
+        let restarted_generation = 4_u64;
+        let persisted_timestamp = 100_u64;
+        let observed_timestamp = 90_u64;
+        assert_ne!(old_owner_generation, restarted_generation);
+        assert!(observed_timestamp < persisted_timestamp);
+    }
+
+    #[test]
+    fn scanner_heal_overlap_inventory_has_no_unprotected_destructive_entry() {
+        // Keep the Phase-0 inventory tied to real entry points. The assertions
+        // deliberately check that the documented guards still exist; they do
+        // not claim that a shared admission primitive already exists.
+        assert!(SCANNER_IO_SOURCE.contains("let _guard = self.start_scan()"));
+        assert!(SCANNER_IO_SOURCE.contains("scan_data_folder"));
+        assert!(SCANNER_FOLDER_SOURCE.contains("send_required_scanner_heal_request"));
+        assert!(SCANNER_FOLDER_SOURCE.contains("update_pending_scanner_heal_after_admission"));
+        assert!(HEAL_AUTO_SCAN_SOURCE.contains("active_heals"));
+        assert!(HEAL_AUTO_SCAN_SOURCE.contains("contains_erasure_set"));
+        assert!(HEAL_OBJECT_SOURCE.contains("heal_object"));
+        assert!(HEAL_OBJECT_SOURCE.contains("get_write_lock"));
+        assert!(SET_LOCKING_SOURCE.contains("scanning_disks"));
+        assert!(SET_LOCKING_SOURCE.contains("new_disks.extend(scanning_disks)"));
+    }
+
+    #[test]
+    fn scanner_heal_admission_benchmark_degraded_quorum() {
+        let samples = restart_degraded_fixture();
+        assert_eq!(p99_latency(&samples), 420);
+        assert!(
+            samples
+                .iter()
+                .any(|sample| sample.operation == Operation::HealWrite && sample.deferred)
+        );
+        assert!(samples.iter().any(|sample| sample.set == "pool0/set1" && !sample.deferred));
+        assert_eq!(samples.iter().map(|sample| sample.backlog_depth).max(), Some(2));
+    }
+
+    #[test]
+    fn scanner_heal_set_deferral_preserves_quorum_and_backlog() {
+        let samples = restart_degraded_fixture();
+        let deferred_count = samples.iter().filter(|sample| sample.deferred).count();
+        let independent_progress = samples
+            .iter()
+            .filter(|sample| sample.set == "pool0/set1" && !sample.deferred)
+            .count();
+        assert_eq!(deferred_count, 2);
+        assert_eq!(independent_progress, 3);
+        assert!(samples.iter().all(|sample| sample.backlog_depth <= 2));
+    }
+}
@@ -43,9 +43,6 @@ allow-git = [
    # RustFS fork carrying presigned expiry and constant-time authentication fixes.
    # owner: rustfs-maintainers  review: 2026-10
    "https://github.com/rustfs/s3s.git",
-    # MiMalloc fork pinned for hotpath allocation counting support.
-    # owner: houseme  review: 2026-10
-    "https://github.com/xonatius/mimalloc_rust.git",
 ]

 [bans]
@@ -54,6 +54,7 @@ Two rules keep this directory healthy:
 - [ecstore-config-consumer-inventory.md](ecstore-config-consumer-inventory.md)
 - [obs-ecstore-dependency-inventory.md](obs-ecstore-dependency-inventory.md)
 - [background-services-inventory.md](background-services-inventory.md)
+- [scanner-heal-admission.md](scanner-heal-admission.md)
 - [admin-route-action-snapshot.md](admin-route-action-snapshot.md)
 - [compat-cleanup-register.md](compat-cleanup-register.md)

@@ -0,0 +1,29 @@
+# Scanner/Heal admission Phase 0 baseline
+
+This document records the current entry points and safety boundaries for backlog #1939. It is an inventory and test contract, not a lease design. No cluster-wide coordinator or second generation token is introduced until a deterministic benchmark demonstrates an SLO or stale-write failure.
+
+## Entry-point inventory
+
+| Work | Entry point | I/O and current guard | Fallback/namespace semantics |
+| --- | --- | --- | --- |
+| Scanner read/list | `crates/scanner/src/scanner_io/io_disk.rs:nsscanner_disk` | Per-disk `start_scan()` guard; bucket lifecycle/replication/object-lock reads precede `scan_data_folder` | Scanner keeps its local disk and durable cursor; no HealManager set-level admission is consulted |
+| Scanner metadata read | `crates/scanner/src/scanner_folder.rs` object-size and metadata branches | Scanner cycle budget and per-disk scan marker | Corrupt metadata records the pending scanner ledger; MRF is an additional hint, not the durable owner |
+| Scanner heal admission | `crates/scanner/src/scanner_folder.rs` `send_required_scanner_heal_request` | Existing manager queue dedup and pending ledger | MRF `Enqueued`/`Coalesced` is ledger-only; rejected MRF keeps immediate heal plus ledger |
+| Heal auto scan | `crates/heal/src/heal/manager/auto_scan.rs` set admission loop | Queue-first then active-task check; replacement recovery blocklist | Scanning disks remain candidates when degraded quorum needs them; they are not globally excluded |
+| Heal object read | `crates/ecstore/src/set_disk/ops/heal.rs` `heal_object` | Namespace write lock unless `no_lock`; reads file info before commit | Namespace lock is object-scoped and does not claim scanner cycle ownership |
+| Disk selection | `crates/ecstore/src/set_disk/ops/locking.rs` candidate selection | Healing disks are ordered after new disks; scanning disks may remain candidates | Degraded/quorum fallback is preserved |
+| Data movement | Existing storage-owned movement/publication generation (#1905/#1942) | This issue does not add a second coordinator | Future admission must validate the storage generation at the final commit |
+
+## Baseline contract
+
+The deterministic baseline in `scanner_heal_admission_baseline.rs` encodes the investigation matrix only: ScannerRead+HealRead may overlap, HealWrite conflicts with scanner reads, DataMovementWrite conflicts with all work, and independent set identities remain concurrent. It does not claim that production currently enforces the matrix.
+
+The production facts that must be measured before Phase 1 are scanner p99, heal p99, cursor/checkpoint delay, queue and pending-ledger depth, and starvation by set. The benchmark matrix must include restart recovery, degraded quorum/scanning-disk fallback, urgent replacement heal, and at least two independent sets.
+
+The executable fixture uses a fixed eight-sample restart/degraded sequence so the baseline is reproducible without wall-clock noise: two sets each receive ScannerRead, HealRead, HealWrite and a follow-up ScannerRead. Its expected synthetic p99 is 420 microseconds, maximum modeled backlog is 2, two HealWrite samples are deferred, and the independent second set still services three reads. These are fixture values, not production SLO claims; production benchmark output must replace them with measured p99, backlog and per-set wait distributions.
+
+The inventory test reads the current source files and asserts the named guards/fallback branches are still present (`start_scan`, pending-ledger admission, Heal queue/active checks, namespace `get_write_lock`, and scanning-disk re-append). A source rename or guard removal therefore fails the baseline instead of silently leaving stale documentation.
+
+Commit-time generation-fencing, lease-expiry, and lock-order tests are intentionally deferred until a Phase-0 fixture demonstrates a stale write or an SLO violation; arithmetic-only placeholders would stay green if production paths regressed.
+
+If a future fixture demonstrates stale destructive writes, the fix must extend the storage-owned generation/admission primitive and validate the token at the final metadata/format/delete commit. Cancellation or a local lease alone is not a fence.
@@ -0,0 +1,149 @@
+# CI gate matrix
+
+This file is the source of truth for which validation runs on each event, its
+configured wall-clock budget, and whether it can block a merge. Test taxonomy,
+naming, and nextest serialization rules remain in [README.md](README.md); e2e
+membership and counts remain in
+[e2e-suite-inventory.md](e2e-suite-inventory.md).
+
+The distinction between **required** and **report-only** is load-bearing:
+a failing job blocks a merge only when its exact check name is present in the
+live `main` ruleset. A workflow name, a `merge_group` trigger, or a red PR check
+does not make a job required by itself.
+
+## Required merge checks
+
+The live `main` ruleset (`6436880`) currently requires exactly these contexts:
+
+| Required context | Producer | Validation |
+|---|---|---|
+| `CLA Check` | `.github/workflows/cla.yml` | Contributor agreement |
+| `Quick Checks` | `.github/workflows/ci.yml` | Formatting and repository guard scripts |
+| `Test and Lint` | `.github/workflows/ci.yml` | Clippy, workspace nextest excluding `e2e_test`, doctests, and migration proofs |
+
+For pull requests limited to the paths excluded by the main CI workflow,
+`.github/workflows/ci-docs-only.yml` reports `Quick Checks` and
+`Test and Lint` under the same names. It runs the real quick checks and the
+planning-document guard; it does not claim that Rust compilation or runtime
+tests ran. Despite the workflow name, these paths also include selected deploy,
+workflow, and lock files.
+
+Verify the live rule rather than trusting this snapshot before changing merge
+policy:
+
+```bash
+gh api repos/rustfs/rustfs/rulesets/6436880 \
+  --jq '.rules[] | select(.type == "required_status_checks") | .parameters'
+```
+
+The ruleset currently has `strict_required_status_checks_policy=false`.
+`Continuous Integration` accepts `merge_group` events and runs `e2e-full` for
+them, but `End-to-End Tests (full merge gate)` is not currently a required
+context. Therefore the repository is prepared to test a merge-queue SHA, but
+the workflow alone does not prove that every merge passed that lane.
+
+## Pull request and merge matrix
+
+Budgets below are job `timeout-minutes`, not typical runtimes. “Report-only”
+means the result is visible and actionable but is not in the live required
+context list.
+
+| Event | Validation | Budget | Merge status | Reproduction |
+|---|---|---:|---|---|
+| PR, non-doc change | `Quick Checks` | 10 min | Required | `make pre-commit` (broader local umbrella) |
+| PR, non-doc change | `Test and Lint` | 90 min | Required | `cargo nextest run --profile ci --all --exclude e2e_test` |
+| PR, non-doc change | `Typos` | 10 min | Report-only | `typos` |
+| PR, non-doc change | `ILM Integration (serial)` | 90 min | Report-only | Use the exact command in `.github/workflows/ci.yml` |
+| PR, non-doc change | rio-v2 / swift / sftp test-and-lint variants | 90 min each | Report-only | `cargo nextest run` with the workflow's feature set |
+| PR, non-doc change | `Build RustFS Debug Binary` | 30 min | Report-only; prerequisite for black-box lanes | `cargo build -p rustfs --bins` |
+| PR, non-doc change | `io_uring Integration (real)` | 30 min | Report-only | `cargo test -p rustfs-ecstore --lib uring_ -- --test-threads=1 --nocapture` |
+| PR, non-doc change | `End-to-End Tests` (`e2e-smoke` plus `s3s-e2e`) | 30 min | Report-only | `cargo nextest run --profile e2e-smoke -p e2e_test`; then `./scripts/e2e-run.sh ./target/debug/rustfs <data-dir>` |
+| PR, non-doc change | `S3 Implemented Tests` | 60 min | Report-only | Build `rustfs`, then run `scripts/s3-tests/run.sh` with `DEPLOY_MODE=binary`, `TEST_MODE=single`, and `MAXFAIL=0` |
+| PR, non-doc change | `S3 Lifecycle Behavior Tests` | 30 min | Report-only | Use the accelerated scanner environment in `.github/workflows/ci.yml` with `scripts/s3-tests/run.sh` |
+| PR touching dependency or workflow inputs | Cargo Deny / Workflow Pin Report / Dependency Review | 20 / 5 / 30 min | Report-only | `cargo deny check`; `scripts/security/check_workflow_pins.sh` |
+| PR touching architecture rules or architecture docs | `Architecture Migration Rules` | 10 min | Report-only | `scripts/check_architecture_migration_rules.sh` |
+| PR touching Nix or workspace manifests | `Nix Build & Check` | 60 min | Report-only | `nix flake check` |
+| PR limited to main-CI-excluded paths | companion `Quick Checks` and `Test and Lint` | 10 min each | Required | `git diff --check`; `make doc-paths-check` when documentation paths changed |
+| `merge_group` | Standard CI plus `e2e-full` | 55 min for `e2e-full` | Standard required contexts only; `e2e-full` report-only | `cargo nextest run --profile e2e-full -p e2e_test` |
+| Push to `main` | Standard CI plus `e2e-full` | 55 min for `e2e-full` | Post-merge detection | Same as `merge_group` |
+| PR touching fuzz inputs or harness paths | Build plus five 60-second fuzz smoke targets | 60 min build; 30 min per target | Report-only | `MAX_TOTAL_TIME=60 ./scripts/fuzz/run.sh` |
+| PR touching selected ecstore disk/format paths | `Rename Safety` on Windows | 60 min | Report-only | Run the four `cargo test -p rustfs-ecstore --lib <filter>` commands in `windows-filesystem.yml` on Windows |
+
+The authoritative e2e filters live in `.config/nextest.toml`; extend a profile
+instead of adding a second ad-hoc selector. Before a profile runs,
+`scripts/check_test_wiring.py` compares its exact membership to the committed
+digest so a silent test drop fails closed.
+
+## Scheduled and manual validation
+
+Scheduled lanes are independent fault domains. They do not block a pull
+request, but their workflow-local gate can fail the run and scheduled failures
+are routed to the shared failure-issue action. The scheduled-validation
+watchdog and freshness workflow separately detect incomplete runs and missing
+schedules.
+
+| Cadence (UTC unless noted) | Workflow / validation | Budget | Verdict and artifacts | Reproduction |
+|---|---|---:|---|---|
+| Daily 02:17 | Fuzz: five nightly corpus targets | 60 min build; 60 min per target | Gate; corpus/crash artifacts, scheduled failure alert | `MAX_TOTAL_TIME=<seconds> ./scripts/fuzz/run.sh` |
+| Daily 03:17 | MinIO interop (EC + SSE read parity) | 40 min | Gate; scheduled failure alert | Dispatch `minio-interop.yml` or follow its pinned Docker fixture steps |
+| Daily 04:29 | Replication / cluster-fault / protocol e2e | 45 / 90 / 90 min | Three independent gates; JUnit, membership, and server logs | `cargo nextest run --profile e2e-repl-nightly -p e2e_test`; `--profile e2e-nightly`; `-j 1 --profile e2e-protocols` |
+| Daily 06:31 | Warp performance A/B | 180 min | Regression budget gate; A/B summaries and server logs | `bash scripts/run_hotpath_warp_abba.sh --help` |
+| Daily 00:07 Asia/Shanghai (16:07 UTC previous day) | Nightly GNU build and Vault lanes | 150 / 90 / 60 min | Build, live Vault, and HA failover gates | Use the commands and pinned Vault images in `nightly-gnu.yml` |
+| Daily 03:23 | Security Audit | 20 / 5 min, plus 30 min on PR dependency review | Cargo Deny and workflow-pin gates; scheduled failure alert | `cargo deny check`; `scripts/security/check_workflow_pins.sh` |
+| Daily 23:47 | Scheduled Validation Freshness | 10 min | Fails when a critical schedule was never created or is stale | Dispatch `scheduled-validation-freshness.yml` |
+| Sunday 00:11 | Full `Continuous Integration` matrix | Per-job budgets above | Weekly variant coverage, including dormant rio-v2 binary/e2e lanes | Dispatch `ci.yml` |
+| Sunday 01:13 | Seven-platform build matrix | 150 min per platform | Build/package integrity; scheduled failure alert | Dispatch `build.yml` with an exact platform set |
+| Sunday 02:19 | Ceph s3-tests full sweep: single and real four-node, four shards each | 180 min per shard | Compatibility gate; report, JUnit, exact node IDs, and server logs | `scripts/s3-tests/run.sh` against an existing single or distributed target |
+| Sunday 06:41 | Mint | 120 min | **Report-only by design**; per-suite PASS/FAIL/NA and raw `log.json` | Reproduce the pinned Docker sequence in `mint.yml` or dispatch it |
+| Sunday 07:43 | Workspace line coverage | 120 min | Report-only trend; lcov and JSON retained 90 days | `make coverage` |
+| Monthly, day 1 06:37 | Runner Hygiene | 15 min | Validates runner ephemerality; scheduled failure alert | Dispatch `runner-hygiene.yml` |
+
+Manual `workflow_dispatch` exists for the scheduled workflows above. Manual
+runs are debugging evidence and intentionally do not open scheduled-failure
+issues. A manual performance run may explicitly allow a known regression; that
+override must not be treated as an ordinary passing baseline.
+
+## Release validation
+
+Release validation is post-merge and tag-driven; it does not substitute for a
+pull-request gate.
+
+| Event | Validation | Budget | Result |
+|---|---|---:|---|
+| Push to `main` or weekly schedule | `Build and Release` platform matrix | 150 min per platform | Build artifacts for all selected targets; no release publication on a main push |
+| Valid release or preview tag | `Build and Release` plus asset checks | 150 min per platform | Draft release, checksummed assets, and publish step |
+| Successful non-preview release-tag build | Docker image build and image scan | 60 min build; 30 min scan | Multi-architecture images plus vulnerability report |
+| Successful release-tag build | DEB/RPM packaging | 30 min per architecture | Packages and checksum files uploaded to the release |
+| Successful non-preview release-tag build | Helm template test and package | 30 min build; 30 min publish | Versioned chart and repository index |
+
+Use an exact preview tag for end-to-end release rehearsal. Manual dispatches
+are backfill/debug paths and do not prove the automatic `workflow_run` chain.
+
+## Evidence requirements
+
+A green check is useful only when it proves the intended behavior ran:
+
+- Record the exact commit SHA and run URL.
+- Separate product failure from runner prerequisites, service readiness, and
+  cancellation. Repair the precondition, then rerun the exact workload.
+- Preserve membership manifests, JUnit, raw compatibility logs, seeds, and
+  server logs where the workflow provides them.
+- For a bug fix or a new fault checker, provide sensitivity evidence: the old
+  behavior or an intentional mutation must fail the new oracle, and the fixed
+  behavior must pass it.
+- Never promote a report-only lane to required from one green run. Require at
+  least 14 days and 30 representative pull requests with at least 99% complete
+  execution, then update the ruleset and this table together.
+
+## Change checklist
+
+Update this file in the same pull request when any of these change:
+
+- workflow triggers, job names, timeouts, or nextest profile ownership;
+- required status contexts or strict/merge-queue policy;
+- scheduled cadence, alert routing, artifact contract, or local reproduction;
+- report-only versus gating semantics.
+
+Do not copy per-module test counts here. Update
+[e2e-suite-inventory.md](e2e-suite-inventory.md) and its enforced membership
+digest instead.
@@ -84,7 +84,7 @@
 | protocols | 16 | 🌙 |
 | quota_test | 14 |  |
 | reliability_disk_fault_test | 4 |  |
-| reliant | 29 | 19 ✅ |
+| reliant | 25 | 19 ✅ |
 | replication_extension_test | 75 | 20 ✅ +55 🌙 |
 | security_boundary_test | 4 |  |
 | server_startup_failfast_test | 1 |  |
@@ -336,13 +336,13 @@ opentelemetry = { workspace = true }
 tracing-opentelemetry = { workspace = true }
 # Data structures
 hashbrown = { workspace = true, features = ["serde", "rayon"] }
-mimalloc = { workspace = true }
+rustfs-mimalloc = { workspace = true }

 [target.'cfg(target_os = "linux")'.dependencies]
 libsystemd.workspace = true

 [target.'cfg(not(target_os = "windows"))'.dependencies]
-libmimalloc-sys.workspace = true
+rustfs-mimalloc-sys.workspace = true

 [dev-dependencies]
 uuid = { workspace = true, features = ["v4", "v5", "fast-rng", "macro-diagnostics"] }
@@ -369,14 +369,8 @@ pub fn allocator_reclaim_controller_snapshot(ctx: &CancellationToken) -> Allocat
 }

 #[cfg(not(target_os = "windows"))]
-#[allow(unsafe_code)]
 fn collect_allocator_memory(force: bool) -> Result<(), String> {
-    // SAFETY: `mi_collect` is provided by the active global allocator backend
-    // on this target family. It is explicitly intended to reclaim retained
-    // pages/segments and does not require additional invariants from the caller.
-    unsafe {
-        libmimalloc_sys::mi_collect(force);
-    }
+    rustfs_mimalloc::MiMalloc::collect(force);
    Ok(())
 }

@@ -26,22 +26,22 @@ struct MiMallocAllocator;
 unsafe impl GlobalAlloc for MiMallocAllocator {
    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
        // SAFETY: the caller upholds GlobalAlloc's contract for layout.
-        unsafe { mimalloc::MiMalloc.alloc(layout) }
+        unsafe { rustfs_mimalloc::MiMalloc.alloc(layout) }
    }

    unsafe fn alloc_zeroed(&self, layout: Layout) -> *mut u8 {
        // SAFETY: the caller upholds GlobalAlloc's contract for layout.
-        unsafe { mimalloc::MiMalloc.alloc_zeroed(layout) }
+        unsafe { rustfs_mimalloc::MiMalloc.alloc_zeroed(layout) }
    }

    unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
        // SAFETY: ptr and layout came from this allocator and are forwarded unchanged.
-        unsafe { mimalloc::MiMalloc.dealloc(ptr, layout) }
+        unsafe { rustfs_mimalloc::MiMalloc.dealloc(ptr, layout) }
    }

    unsafe fn realloc(&self, ptr: *mut u8, layout: Layout, new_size: usize) -> *mut u8 {
        // SAFETY: ptr and layout came from this allocator and are forwarded unchanged.
-        unsafe { mimalloc::MiMalloc.realloc(ptr, layout, new_size) }
+        unsafe { rustfs_mimalloc::MiMalloc.realloc(ptr, layout, new_size) }
    }
 }

@@ -51,7 +51,7 @@ static GLOBAL: hotpath::CountingAllocator<MiMallocAllocator> = hotpath::Counting

 #[cfg(not(all(feature = "hotpath", feature = "hotpath-alloc")))]
 #[global_allocator]
-static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;
+static GLOBAL: rustfs_mimalloc::MiMalloc = rustfs_mimalloc::MiMalloc;

 fn main() {
    let _hotpath_guard = hotpath::HotpathGuardBuilder::new("main").build();
@@ -71,8 +71,9 @@ mod tests {
        allocation.extend_from_slice(&[7_u8; 64]);

        assert_eq!(allocation.len(), 64);
+        let heap = rustfs_mimalloc::heap::Heap::main();
        // SAFETY: the live Vec pointer is valid to inspect for heap ownership.
-        assert!(unsafe { libmimalloc_sys::mi_is_in_heap_region(allocation.as_ptr().cast()) });
+        assert!(unsafe { heap.contains(allocation.as_ptr()) });
    }

    #[test]
@@ -85,12 +86,13 @@ mod tests {
        let layout = Layout::from_size_align(32, 8).expect("valid test allocation layout");
        let grown_layout = Layout::from_size_align(64, 8).expect("valid grown test allocation layout");
        let allocator = super::MiMallocAllocator;
+        let heap = rustfs_mimalloc::heap::Heap::main();

        // SAFETY: The pointer is checked for null before use and later released
        // through the same allocator with the corresponding layout.
        let ptr = unsafe { allocator.alloc_zeroed(layout) };
        assert!(!ptr.is_null());
-        assert!(unsafe { libmimalloc_sys::mi_is_in_heap_region(ptr.cast()) });
+        assert!(unsafe { heap.contains(ptr) });
        assert!(unsafe { std::slice::from_raw_parts(ptr, 32).iter().all(|byte| *byte == 0) });

        // SAFETY: `ptr` was allocated by `allocator` with `layout`; on failure
@@ -102,7 +104,7 @@ mod tests {
            panic!("mimalloc realloc failed in allocator smoke test");
        }

-        assert!(unsafe { libmimalloc_sys::mi_is_in_heap_region(grown_ptr.cast()) });
+        assert!(unsafe { heap.contains(grown_ptr) });
        // SAFETY: `grown_ptr` was reallocated by `allocator` and is released
        // with the matching grown layout.
        unsafe { allocator.dealloc(grown_ptr, grown_layout) };
@@ -17,10 +17,7 @@ use rustfs_io_metrics::{
    record_cpu_usage, record_memory_usage, record_process_memory_split,
 };
 use serde::Serialize;
-#[cfg(any(test, not(target_os = "windows")))]
 use serde_json::Value;
-#[cfg(not(target_os = "windows"))]
-use std::ffi::CStr;
 use std::path::Path;
 use std::sync::{Arc, Mutex, OnceLock};
 use std::time::Duration;
@@ -231,7 +228,18 @@ fn read_cgroup_memory_snapshot() -> Option<CgroupMemorySnapshot> {
    read_cgroup_v2().or_else(read_cgroup_v1)
 }

-#[cfg(any(test, not(target_os = "windows")))]
+fn read_allocator_memory_snapshot() -> Option<AllocatorMemorySnapshot> {
+    let json = rustfs_mimalloc::MiMalloc::stats_json();
+    if json.is_empty() {
+        return None;
+    }
+    let observation = parse_mimalloc_stats_json(&json)?;
+    Some(AllocatorMemorySnapshot {
+        backend: crate::allocator_reclaim::allocator_backend(),
+        observation,
+    })
+}
+
 fn numeric_json_value(value: &Value) -> Option<u64> {
    match value {
        Value::Number(number) => number
@@ -242,7 +250,6 @@ fn numeric_json_value(value: &Value) -> Option<u64> {
    }
 }

-#[cfg(any(test, not(target_os = "windows")))]
 fn numeric_json_field(value: &Value, field: &str) -> Option<u64> {
    match value {
        Value::Object(fields) => fields
@@ -254,7 +261,6 @@ fn numeric_json_field(value: &Value, field: &str) -> Option<u64> {
    }
 }

-#[cfg(any(test, not(target_os = "windows")))]
 fn mimalloc_stat_field(value: &Value, metric: &str, field: &str) -> Option<u64> {
    match value {
        Value::Object(fields) => {
@@ -271,12 +277,10 @@ fn mimalloc_stat_field(value: &Value, metric: &str, field: &str) -> Option<u64>
    }
 }

-#[cfg(any(test, not(target_os = "windows")))]
 fn mimalloc_stat_current(value: &Value, metric: &str) -> Option<u64> {
    mimalloc_stat_field(value, metric, "current")
 }

-#[cfg(any(test, not(target_os = "windows")))]
 fn mimalloc_stat_sum(value: &Value, metrics: &[&str], field: &str) -> Option<u64> {
    metrics
        .iter()
@@ -285,7 +289,6 @@ fn mimalloc_stat_sum(value: &Value, metrics: &[&str], field: &str) -> Option<u64
        .filter(|value| *value > 0)
 }

-#[cfg(any(test, not(target_os = "windows")))]
 fn parse_mimalloc_stats_json(stats_json: &str) -> Option<AllocatorMemoryObservation> {
    let value = serde_json::from_str::<Value>(stats_json).ok()?;
    let malloc_metrics = ["malloc_normal", "malloc_huge"];
@@ -312,33 +315,6 @@ fn parse_mimalloc_stats_json(stats_json: &str) -> Option<AllocatorMemoryObservat
    }
 }

-#[cfg(not(target_os = "windows"))]
-#[allow(unsafe_code)]
-fn read_allocator_memory_snapshot() -> Option<AllocatorMemorySnapshot> {
-    // SAFETY: `mi_stats_get_json` returns a null-terminated JSON buffer owned by
-    // mimalloc when called with a null input buffer. The mimalloc API requires
-    // freeing that buffer with `mi_free`; parsing finishes before the buffer is freed.
-    let observation = unsafe {
-        let stats_ptr = libmimalloc_sys::mi_stats_get_json(0, std::ptr::null_mut());
-        if stats_ptr.is_null() {
-            return None;
-        }
-
-        let observation = CStr::from_ptr(stats_ptr).to_str().ok().and_then(parse_mimalloc_stats_json);
-        libmimalloc_sys::mi_free(stats_ptr.cast());
-        observation?
-    };
-    Some(AllocatorMemorySnapshot {
-        backend: crate::allocator_reclaim::allocator_backend(),
-        observation,
-    })
-}
-
-#[cfg(target_os = "windows")]
-fn read_allocator_memory_snapshot() -> Option<AllocatorMemorySnapshot> {
-    None
-}
-
 fn configured_memory_observability_interval_secs() -> u64 {
    rustfs_utils::get_env_u64(ENV_MEMORY_OBSERVABILITY_INTERVAL_SECS, DEFAULT_MEMORY_OBSERVABILITY_INTERVAL_SECS).max(1)
 }
@@ -566,6 +542,13 @@ mod tests {
        assert_eq!(parse_mimalloc_stats_json(r#"{ "allocator": "unknown" }"#), None);
    }

+    #[test]
+    fn read_allocator_memory_snapshot_uses_mimalloc_stats_json() {
+        let snapshot = super::read_allocator_memory_snapshot();
+        #[cfg(not(target_os = "windows"))]
+        assert!(snapshot.is_some(), "allocator snapshot should be available on non-Windows");
+    }
+
    #[test]
    fn memory_observability_snapshot_reports_disabled_when_metrics_are_disabled() {
        let snapshot = build_memory_observability_status_snapshot(false, 15, false);
Author	SHA1	Message	Date
houseme	34660da664	Merge branch 'main' into cxymds/fix-1939-scanner-heal-admission	2026-08-23 12:26:18 +08:00
Zhengchao An	b6ba89d9e4	docs(testing): document CI gate matrix (#6412 )	2026-08-23 12:09:06 +08:00
houseme	648d5166e2	feat(allocator): replace mimalloc/libmimalloc-sys with rustfs-mimalloc/rustfs-mimalloc-sys (#6404 ) Replace the upstream xonatius/mimalloc_rust.git fork (mimalloc + libmimalloc-sys) with the published rustfs-mimalloc (v0.5.0) and rustfs-mimalloc-sys (v0.5.0) crates from crates.io. The new crates are based on mimalloc V3 (v3.5.0) and provide: - MiMalloc global allocator with safe API (collect, stats_json, process_info) - Heap management and arena operations (heap module) - Full FFI bindings to mimalloc V3 Changes: - Workspace deps: mimalloc + libmimalloc-sys (git) → rustfs-mimalloc + rustfs-mimalloc-sys (crates.io) - allocator_reclaim.rs: libmimalloc_sys::mi_collect → rustfs_mimalloc::MiMalloc::collect - memory_observability.rs: raw FFI mi_stats_get_json → MiMalloc::stats_json() - main.rs: heap ownership tests use Heap::contains() (V3 API) - deny.toml: remove xonatius/mimalloc_rust.git from allow-git Co-authored-by: heihutu <heihutu@gmail.com>	2026-08-23 12:07:25 +08:00
houseme	84eb5aebef	fix(ecstore): remove inline write debug noise (#6408 ) * fix(ecstore): remove inline write debug noise Co-Authored-By: heihutu <heihutu@gmail.com> * fix(ecstore): satisfy warning-as-error lints Co-Authored-By: heihutu <heihutu@gmail.com> --------- Co-authored-by: heihutu <heihutu@gmail.com>	2026-08-23 12:07:20 +08:00
马登山	1be310117c	docs(scanner): baseline scanner heal admission	2026-08-23 09:20:32 +08:00